Open Fastly stores by logical ID on the EdgeZero PR 381 branch head

Move the EdgeZero pin from 8efad3c8 to 657bfdcb. The branch head replaces
the edgezero_runtime_env selector store with logical-ID resource links and
removes runtime_env_config, so the Fastly entry point now opens
trusted_server_config and trusted_server_secrets by logical ID and derives
the config key from Fastly's staging signal through EdgeZero's target key
rule.

Expose the local Viceroy secret store under trusted_server_secrets, drop
the runtime selector store from fastly.toml and the integration template,
and regress that shape in the config test. Update the Fastly and CLI
guides for deterministic config keys, logical-ID links, and the
application release that managed deploys now require.

Author: aram356

Cargo.lock

@@ -90,7 +90,6 @@ use std::sync::Arc;
 
 use crate::rate_limiter::{FastlyRateLimiter, RATE_COUNTER_NAME};
 use edgezero_adapter_fastly::context::FastlyRequestContext;
-use edgezero_adapter_fastly::runtime_env_config;
 use edgezero_core::app::{App, Hooks, StoreMetadata, StoresMetadata};
 use edgezero_core::context::RequestContext;
 use edgezero_core::env_config::EnvConfig;
@@ -100,6 +99,7 @@ use edgezero_core::http::{
 };
 use edgezero_core::router::RouterService;
 use error_stack::Report;
+use fastly::compute_runtime;
 use trusted_server_core::auction::AuctionTelemetrySink;
 use trusted_server_core::auction::endpoints::handle_auction;
 use trusted_server_core::auction::{
@@ -162,11 +162,21 @@ pub(crate) struct RuntimeStoreConfig {
 }
 
 impl RuntimeStoreConfig {
-    pub(crate) fn from_env(env: &EnvConfig) -> Self {
+    /// Store bindings for the running Fastly publication target.
+    ///
+    /// Fastly Compute has no process environment. `EdgeZero` links each selected
+    /// physical store to the service version under its logical ID, so the
+    /// runtime opens stores by logical ID and derives the config entry key from
+    /// the target alone: production reads `<id>`, staging reads `<id>_staging`.
+    pub(crate) fn for_target(staging: bool) -> Self {
         Self {
-            config_store_name: StoreName::from(env.store_name("config", DEFAULT_CONFIG_STORE_ID)),
-            config_key: env.store_key("config", DEFAULT_CONFIG_STORE_ID),
-            secret_store_name: StoreName::from(env.store_name("secrets", DEFAULT_SECRET_STORE_ID)),
+            config_store_name: StoreName::from(DEFAULT_CONFIG_STORE_ID),
+            config_key: EnvConfig::default().store_key_for_target(
+                "config",
+                DEFAULT_CONFIG_STORE_ID,
+                staging,
+            ),
+            secret_store_name: StoreName::from(DEFAULT_SECRET_STORE_ID),
         }
     }
 }
@@ -1343,8 +1353,7 @@ impl Hooks for TrustedServerApp {
     }
 
     fn routes() -> RouterService {
-        let runtime_env = runtime_env_config(Self::stores());
-        let stores = RuntimeStoreConfig::from_env(&runtime_env);
+        let stores = RuntimeStoreConfig::for_target(compute_runtime::is_staging());
         Self::router_with_state(&stores).0
     }
 
@@ -1385,7 +1394,6 @@ mod tests {
     use edgezero_core::app::Hooks as _;
     use edgezero_core::body::Body;
     use edgezero_core::context::RequestContext;
-    use edgezero_core::env_config::EnvConfig;
     use edgezero_core::http::{Method, Response, StatusCode, header, request_builder};
     use edgezero_core::key_value_store::NoopKvStore;
     use edgezero_core::params::PathParams;
@@ -1455,32 +1463,17 @@ mod tests {
     }
 
     #[test]
-    fn runtime_store_config_maps_logical_store_names_and_config_key() {
-        let env = EnvConfig::from_vars([
-            (
-                "EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME",
-                "physical_config",
-            ),
-            (
-                "EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__KEY",
-                "active_config",
-            ),
-            (
-                "EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME",
-                "ts_secrets",
-            ),
-        ]);
-
-        let stores = RuntimeStoreConfig::from_env(&env);
+    fn runtime_store_config_reads_the_staging_config_key_on_staging() {
+        let stores = RuntimeStoreConfig::for_target(true);
 
-        assert_eq!(stores.config_store_name.as_ref(), "physical_config");
-        assert_eq!(stores.config_key, "active_config");
-        assert_eq!(stores.secret_store_name.as_ref(), "ts_secrets");
+        assert_eq!(stores.config_store_name.as_ref(), "trusted_server_config");
+        assert_eq!(stores.config_key, "trusted_server_config_staging");
+        assert_eq!(stores.secret_store_name.as_ref(), "trusted_server_secrets");
     }
 
     #[test]
-    fn runtime_store_config_uses_logical_defaults_without_overrides() {
-        let stores = RuntimeStoreConfig::from_env(&EnvConfig::default());
+    fn runtime_store_config_opens_logical_store_ids_in_production() {
+        let stores = RuntimeStoreConfig::for_target(false);
 
         assert_eq!(stores.config_store_name.as_ref(), "trusted_server_config");
         assert_eq!(stores.config_key, "trusted_server_config");

crates/trusted-server-adapter-fastly/src/app.rs

@@ -2,14 +2,13 @@ use std::sync::Arc;
 
 use edgezero_adapter_fastly::config_store::FastlyConfigStore as EdgeZeroFastlyConfigStore;
 use edgezero_adapter_fastly::request::into_core_request;
-use edgezero_adapter_fastly::runtime_env_config;
-use edgezero_core::app::Hooks as _;
 use edgezero_core::body::Body as EdgeBody;
 use edgezero_core::config_store::ConfigStoreHandle;
 use edgezero_core::error::EdgeError;
 use edgezero_core::http::{Request as HttpRequest, Response as HttpResponse};
 use edgezero_core::response::IntoResponse;
 use error_stack::Report;
+use fastly::compute_runtime;
 use fastly::http::Method as FastlyMethod;
 use fastly::{Request as FastlyRequest, Response as FastlyResponse};
 
@@ -90,8 +89,7 @@ fn main() {
 
 /// Handles a request through the `EdgeZero` router path.
 fn edgezero_main(mut req: FastlyRequest) {
-    let runtime_env = runtime_env_config(TrustedServerApp::stores());
-    let runtime_stores = RuntimeStoreConfig::from_env(&runtime_env);
+    let runtime_stores = RuntimeStoreConfig::for_target(compute_runtime::is_staging());
 
     // Short-circuit the JA4 debug probe before app construction. Must run here
     // because TLS/JA4 accessors are only available on FastlyRequest before

crates/trusted-server-adapter-fastly/src/main.rs

@@ -66,28 +66,23 @@
             key = "api_key"
             data = "test-api-key"
 
-        [[local_server.secret_stores.ts_secrets]]
+        [[local_server.secret_stores.trusted_server_secrets]]
             key = "integration_admin_password"
             data = "integration-admin-password-32-bytes-ok"
-        [[local_server.secret_stores.ts_secrets]]
+        [[local_server.secret_stores.trusted_server_secrets]]
             key = "integration_proxy_secret"
             data = "integration-test-proxy-secret-32-bytes-ok"
-        [[local_server.secret_stores.ts_secrets]]
+        [[local_server.secret_stores.trusted_server_secrets]]
             key = "integration_ec_passphrase"
             data = "integration-test-ec-secret-padded-32"
-        [[local_server.secret_stores.ts_secrets]]
+        [[local_server.secret_stores.trusted_server_secrets]]
             key = "integration_partner_token_alpha"
             data = "integration-test-token-alpha-32-bytes-ok"
-        [[local_server.secret_stores.ts_secrets]]
+        [[local_server.secret_stores.trusted_server_secrets]]
             key = "integration_partner_token_bravo"
             data = "integration-test-token-bravo-32-bytes-ok"
 
     [local_server.config_stores]
-        [local_server.config_stores.edgezero_runtime_env]
-            format = "inline-toml"
-        [local_server.config_stores.edgezero_runtime_env.contents]
-            EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME = "ts_secrets"
-
         # Generated integration configs inject the trusted_server_config blob
         # into the store required by the Fastly entry point.
         # GENERATED_TRUSTED_SERVER_CONFIG_STORES

crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml

@@ -46,8 +46,7 @@ pub fn cloudflare_config_json(origin_port: u16) -> TestResult<String> {
 mod tests {
     const FASTLY_CONFIG: &str = include_str!("../../../../fastly.toml");
     const VICEROY_TEMPLATE: &str = include_str!("../../fixtures/configs/viceroy-template.toml");
-    const VICEROY_SECRET_STORE_MAPPING_KEY: &str =
-        "EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME";
+    const LOGICAL_SECRET_STORE_ID: &str = "trusted_server_secrets";
 
     #[test]
     fn local_fastly_config_defines_runtime_kv_stores() {
@@ -74,20 +73,24 @@ mod tests {
     }
 
     #[test]
-    fn local_fastly_secret_store_mapping_is_canonical() {
+    fn local_fastly_secret_store_is_exposed_under_its_logical_id() {
         for (name, config) in [
             ("fastly.toml", FASTLY_CONFIG),
             ("Viceroy integration template", VICEROY_TEMPLATE),
         ] {
             let parsed: toml::Value =
                 toml::from_str(config).expect("should parse Fastly configuration");
-            let runtime_env =
-                &parsed["local_server"]["config_stores"]["edgezero_runtime_env"]["contents"];
+            let local_server = &parsed["local_server"];
 
-            assert_eq!(
-                runtime_env[VICEROY_SECRET_STORE_MAPPING_KEY].as_str(),
-                Some("ts_secrets"),
-                "{name} should define the canonical secret-store mapping"
+            assert!(
+                local_server["secret_stores"][LOGICAL_SECRET_STORE_ID].is_array(),
+                "{name} should expose the secret store under its logical ID"
+            );
+            assert!(
+                local_server["config_stores"]
+                    .get("edgezero_runtime_env")
+                    .is_none(),
+                "{name} should not define the legacy runtime selector store"
             );
         }
     }
@@ -96,9 +99,9 @@ mod tests {
     fn local_fastly_config_defines_starter_secret_references() {
         let parsed: toml::Value =
             toml::from_str(FASTLY_CONFIG).expect("should parse root fastly.toml");
-        let entries = parsed["local_server"]["secret_stores"]["ts_secrets"]
+        let entries = parsed["local_server"]["secret_stores"][LOGICAL_SECRET_STORE_ID]
             .as_array()
-            .expect("fastly.toml should define ts_secrets");
+            .expect("fastly.toml should define trusted_server_secrets");
 
         for key in [
             "publisher_proxy_secret",

crates/trusted-server-integration-tests/tests/common/config.rs

@@ -118,30 +118,36 @@ deploy. Adapter passthrough arguments must now follow a `--` separator; unknown
 flags before `--` (including the renamed-away `--stage`) are rejected at parse
 time rather than forwarded. This is a change: passthrough args previously
 worked without the separator, so existing runbooks and CI jobs that pass
-adapter flags directly need the `--` added:
+adapter flags directly need the `--` added. Trusted Server declares Config, KV,
+and Secret Stores, so EdgeZero treats every Fastly deploy as managed and
+requires a verified application release root via `--application-release`; a
+bare `ts deploy --adapter fastly` without a release is accepted only for
+store-free applications:
 
 ```bash
-ts deploy --adapter fastly --service-id <service-id> --staging
-ts deploy --adapter fastly -- --comment "release"
+ts deploy --adapter fastly --service-id <service-id> --application-release <release-root> --staging
+ts deploy --adapter fastly --service-id <service-id> --application-release <release-root> -- --comment "release"
 ```
 
 A staged deploy selects the physical Config Store from the staging environment
-and points the staged version's config selector at the
-`<logical-store-id>_staging` key. It does not copy the production config blob
-there. Push the staged config before probing the staged version:
+and links it to the staged version under the logical store ID. The staged
+runtime reads the `<logical-store-id>_staging` key from that store. It does not
+copy the production config blob there. Push the staged config before probing
+the staged version:
 
 ```bash
 ts config push --adapter fastly --staging
 ts config diff --adapter fastly --staging
 ```
 
-The staged version resolves its app-config key through a staging selector store
-linked under the name `edgezero_runtime_env`. Production and staging may select
-the same physical Config Store or different stores. After
-`ts config push --staging`, the staged binary reads
-`<logical-store-id>_staging` in the store selected by the staging environment,
-while the active production version continues to read its production key and
-store.
+Config keys are deterministic on Fastly: production reads `<logical-store-id>`,
+staging reads `<logical-store-id>_staging`, and local Viceroy reads the
+production key. The binary decides which key to read from Fastly's staging
+signal, not from a stored selector. Production and staging may select the same
+physical Config Store or different stores. After `ts config push --staging`,
+the staged binary reads `<logical-store-id>_staging` in the store selected by
+the staging environment, while the active production version continues to read
+its production key and store.
 
 `--staging` on `config push` / `config diff` writes and compares the
 `<logical-store-id>_staging` key in the physical store selected by the staging

docs/guide/cli.md

@@ -275,27 +275,25 @@ export EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME=ts_secrets
 ts provision --adapter fastly
 ```
 
-Provisioning creates or reuses the physical store and the
-`edgezero_runtime_env` Config Store, but does not write environment selectors.
-Deployment copies the selected environment's declared store selectors into
-`edgezero_runtime_env` under their canonical names:
-
-```text
-EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME=ts_secrets
-```
-
-There is no Fastly service ID in the environment variable name. Each GitHub
-Environment or deploy process uses the same canonical names and may select
-different physical resources. A production deploy reconciles its selectors
-into `edgezero_runtime_env`. A staged deploy creates a per-service staging twin,
-applies the staging environment's selectors, links every selected physical
-store to the staged version, and links the twin under the name
-`edgezero_runtime_env`. Selected resources must already exist before deployment.
-
-The custom streaming entry point reads the deployed mapping before loading app
-config, so every startup and reload resolves static credentials from
-`ts_secrets` while the portable manifest continues to declare
-`trusted_server_secrets`.
+Provisioning creates or reuses the physical store. A managed deployment reads
+the selector from its deployment environment and links the selected physical
+store to the target service version under the logical ID
+`trusted_server_secrets`. The runtime opens the store by that logical ID; no
+selector is stored in a Config Store and no service ID appears in the variable
+name.
+
+Each GitHub Environment or deploy process uses the same canonical names and may
+select different physical resources. Production and staging can therefore run
+identical package bytes against different stores. A staged deploy links the
+staging environment's selected stores into only the staged version. Selected
+resources must already exist before deployment.
+
+The custom streaming entry point opens `trusted_server_secrets` before loading
+app config, so every startup and reload resolves static credentials from the
+physical store linked under that ID while the portable manifest continues to
+declare `trusted_server_secrets`. Local Viceroy configuration exposes the store
+under the logical ID directly; see `[local_server.secret_stores]` in
+`fastly.toml`.
 
 Create the separate request-signing store when that feature is enabled: