Adopt edgezero strict-clippy gate and PR #257 API

[aram356]

Closes #107.

Tracks stackpop/edgezero#257 (chore/strict-clippy) and pulls mocktioneer onto the same strict clippy gate plus the defensive-coding pass it ships.

Summary

• All edgezero-* workspace deps point at branch = "chore/strict-clippy" pending PR #257 merge.
• Root Cargo.toml adopts [workspace.lints.clippy] from edgezero: pedantic = warn, restriction = deny, 13-entry allow-list. [workspace.lints.rust] denies unsafe_code.
• New clippy.toml mirrors edgezero's test exemptions.
• [lints] workspace = true added to all four crate Cargo.tomls.
• Migrated to the new edgezero API: Router::oneshot returns Result, Body is Once/Stream with Option-returning bytes, run_app moved to dev_server::run_app, IntoResponse::into_response() fallible.
• All eleven route handlers now return Result<Response, EdgeError> for a uniform fallibility contract.

Refactor approach

~700 clippy findings resolved through real refactors per the upstream principle:

• struct fields, enum variants, impl methods reordered alphabetically (~300 sites);
• numeric literals typed (1 → 1_i32, 2.5 → 2.5_f64);
• single-char idents renamed where they don't carry spec meaning;
• #[inline] added to public fns/methods;
• test_ prefix dropped from test fn names;
• as casts replaced with f64::from(i32::try_from(...)) / saturating arithmetic;
• integration tests wrapped in #[cfg(test)] mod tests to satisfy tests_outside_test_module;
• OpenRTB w/h fields renamed to width/height with #[serde(rename = "w"/"h")] to preserve JSON wire format;
• Site._ref → r#ref (raw identifier, default-serialises to ref);
• Geo._type → kind with #[serde(rename = "_type")].

Remaining exceptions

Five call-site #[expect(..., reason = "...")] annotations remain, each documenting a genuine constraint:

Site	Lint	Constraint
auction.rs::get_cpm	float_arithmetic	CPM is f64 by API
render.rs::svg_layout	7-lint layout-math cluster	i64 banner-dimension math on the SVG layout path
adapter-axum/main.rs	print_stderr	startup-error path before logger init
adapter-cloudflare/main.rs	print_stderr	host-side stub reminding operator to target wasm32
adapter-fastly/main.rs	print_stderr (+ a documented dead_code cfg_attr)	same wasm32 stub pattern

Test plan

• cargo check --workspace --all-targets
• cargo check --workspace --all-targets --features "fastly cloudflare"
• cargo clippy --workspace --all-targets --all-features -- -D warnings (0 findings)
• cargo test --workspace --all-targets (90 tests pass)
• cargo fmt --all -- --check

Follow-up

When stackpop/edgezero#257 merges to main, flip the branch = "chore/strict-clippy" entries in the root Cargo.toml back to branch = "main" and rerun cargo update.

[prk-Jr]

PR Review

Summary

Thoroughly executed strict-clippy adoption. ~700 findings resolved through real refactors (not #[allow] suppression), new edgezero API migration is complete, and the wire-format round-trip tests are exactly the right safety net for a rename-heavy change. All CI gates pass locally. No blocking issues — two questions about field naming intent and one pre-existing WASM compatibility concern worth tracking separately.

Findings

❓ Questions

• Geo.kind wire key vs. OpenRTB spec — the kind field now maps to "_type" (not the spec's "type"), while type2 carries the spec-conformant key. This looks intentional and the round-trip test confirms it, but doc comments distinguishing the two fields would prevent future confusion. (openrtb.rs:405)
• Site.ref_ — what spec field does this represent? — ref_ serialises to "ref_" literally with no serde rename; no OpenRTB 2.5/3.0 spec field maps to that key. Worth a doc comment noting whether this is a compat shim or extension. (openrtb.rs:275)

🤔 Thoughts

• Empty impl SizeDimensions {} — dead impl block, likely leftover from the reorder pass. (routes.rs:127)
• PixelQueryParams { .. } discards pid silently — correct for a mock, but a comment explaining the intentional discard prevents future "is this a bug?" reads. (routes.rs:347)
• run_in_browser but Node is the actual runner — wasm_bindgen_test_configure!(run_in_browser) is misleading; a comment noting the env-var fallback to Node would help. (contract.rs:13)
• WASM compatibility: std::sync::Mutex + std::time::Instant in verification.rs — LazyLock<Mutex<…>> and Instant are not available on wasm32-unknown-unknown. This pre-dates the PR and the new WASM contract tests don't exercise the verify path, so it's hidden. Not a regression here, but the new WASM CI matrix makes it the right moment to track this in a follow-up issue. (verification.rs:10-16)

📝 Notes

• wasm-bindgen-test = "0.3" uses a semver range — safe because Cargo.lock is committed, but inconsistent with the explicit CLI version-pin in CI. Consider = "0.3.71" to match. (mocktioneer-adapter-cloudflare/Cargo.toml:31)

👍 Praise

• Wire-format round-trip tests — the seven serde tests in openrtb.rs (lines 582–703) are the right safety net for this rename-heavy PR. They pin JSON key names independently of struct field names, so a future accidental serde annotation removal becomes a test failure, not a silent wire-format change.
• #[expect(..., reason = "...")] usage — all five exception sites are correctly documented with accurate constraint descriptions, and each suppresses individual lints rather than using a blanket restriction. This is exactly how these annotations should be used.
• WASM contract test matrix — moving from a compile-check matrix to an actual execution matrix (Fastly via Viceroy, Cloudflare via wasm-bindgen-test-runner) is a meaningful CI improvement. This will surface adapter-dispatch regressions that host-only cargo test cannot catch.
• Alphabetical field ordering — applied systematically and completely across all changed files. Predictable field lookup without requiring a secondary index.

CI Status

• fmt: PASS
• clippy: PASS
• tests: PASS (90 tests)

[aram356]

Thanks for the review @prk-Jr. Addressed in 5ae2cd5:

Finding	Resolution
Geo.kind wire key vs spec	Doc comments added to kind (non-spec _type compat) and type2 (spec Geo.type).
Site.ref_ spec field	Doc comments added to r#ref (spec Site.ref) and ref_ (non-spec legacy-compat field).
Empty impl SizeDimensions {}	Removed — leftover from the reorder pass.
PixelQueryParams { .. } discards pid	Comment added: pid is validated on extraction, intentionally unused.
run_in_browser misleading	Comment added explaining the runner (CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER) selects the headless-Node environment.
wasm-bindgen-test = "0.3" range	Pinned to =0.3.71 to match the CI CLI version-pin.
WASM Instant/Mutex in verification.rs	Pre-existing; tracked as a follow-up in #109 (Instant::now() panics on wasm32-unknown-unknown).

All gates still green: clippy (-D warnings), 119 tests, fmt.

[ChristianPavilonis]

Summary

Review of PR #108 found one blocking e2e test-registration issue plus two non-blocking comments. Rust/docs gates passed locally; Playwright passed but only registered 2 tests, which is the coverage issue below.

Folded into body

🔧 Playwright only registers 2 tests because AD_SIZES is populated too late — tests/playwright/creative-visibility.test.ts:40

AD_SIZES starts as [] and is populated in test.beforeAll, but Playwright registers tests synchronously while loading this module. The loop at line 40, and the second loop at line 103, therefore runs over an empty array, so the per-size tests are never registered. Local npm test only reported 2 tests instead of the intended per-size suite.

Suggestion: Use a static supported-size list for test registration and assert /_/sizes matches it, or move the dynamic iteration inside an async test with test.step after fetching sizes:

test('all supported SVG creatives render visibly', async ({ request, page }) => {
  const response = await request.get('/_/sizes')
  const data = (await response.json()) as { sizes: AdSize[] }

  for (const size of data.sizes) {
    await test.step(`${size.width}x${size.height}`, async () => {
      await page.goto(`/static/img/${size.width}x${size.height}.svg`)
      // existing assertions...
    })
  }
})

📝 OpenRTB response example omits the signature-status query parameter — docs/api/openrtb-auction.md:107

iframe.html.hbs appends {{#if SIG}}&sig={{SIG}}{{/if}}, and iframe_html always sets SIG from metadata.signature.url_param(). For a minimal unsigned request, the creative URL includes &sig=not_present.

Suggestion: If this response example is intended to be exact, include &sig=not_present in the adm URL or add an ellipsis/note that the markup is abbreviated.

[aram356]

Thanks @ChristianPavilonis — you're right, my earlier comment on this line was wrong. The tests really do execute in the browser harness (headless Firefox via the geckodriver on the ubuntu-latest runner image), not Node.

Fixed in 1098e83 — comment now accurately describes the browser harness and where the runner wiring lives (CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner).

Kept run_in_browser because the tests construct worker::Env/worker::Context via js_sys::Object, and the browser engine matches the Cloudflare Workers runtime more closely than a pure Node fallback would.

[aram356]

@prk-Jr — you're right that my earlier reply dodged your question. I added speculative "legacy compatibility" doc comments rather than actually answering what ref_ was for.

I dug into the history: git log -S "pub ref_:" turns up commit 5bb01d9 (Sep 2025), where ref_ and _ref (now r#ref) were added back-to-back in the same hunk by the same author. The pattern was: write ref_ first (conventional Rust keyword-escape — but that serialises to "ref_", which isn't an OpenRTB key), realise it's wrong, add _ref with #[serde(rename = "ref")] to fix the wire format, then forget to remove the first attempt. Geo._type/type2 (now Geo.kind/type2) is the exact same mistake in the same commit.

Neither field is read or written anywhere outside the round-trip tests I added in this PR — they are dead code.

Fixed in 053037c by removing both fields and tightening the round-trip tests to assert just the spec keys (Site.r#ref → "ref" and Geo.type2 → "type"). The change is behavior-neutral: #[serde(deny_unknown_fields)] isn't set, so any incoming "ref_"/"_type" keys were being silently ignored regardless.

All gates still green.

[ChristianPavilonis]

PR Review

Thanks for the strict-clippy/EdgeZero API migration work. The Rust gates and current PR checks are green, but I’m requesting changes because GitHub reports the branch does not merge cleanly with current main. Please update the branch, resolve conflicts, and rerun the full gate set before approval.

🔧 Needs change

• PR is not mergeable against current main: GitHub reports mergeable: false / mergeable_state: dirty. A local merge-tree check against current origin/main also reports conflicts in .tool-versions, Cargo.lock, Cargo.toml, crates/mocktioneer-core/src/mediation.rs, crates/mocktioneer-core/src/render.rs, crates/mocktioneer-core/src/routes.rs, and crates/mocktioneer-core/tests/endpoints.rs. Please rebase or merge current main, preserve both the strict-clippy/Spin changes and the newer Edge Cookie/trusted-server integration, then rerun CI.

🏕 Documentation follow-ups

• Update adapter/project docs for Spin: The PR adds crates/mocktioneer-adapter-spin and registers spin in edgezero.toml, but project docs/conventions still describe only Axum/Fastly/Cloudflare in several places (for example CLAUDE.md). Please update the adapter overview, getting-started/configuration docs, and project conventions to include Spin/Fermyon where adapters are enumerated.
• Trusted Server docs/examples are stale: The current verifier requires the v1.1 fields (version, request_host, request_scheme, fresh ts), exact compact signing payload bytes, base64url-without-padding keys/signatures, DNS-valid site.domain, and request_host matching site.domain. The docs/examples should be updated or split so the default unsigned example does not always show failed signature verification.
• OpenRTB response example omits sig: Runtime adm now always includes a signature-status query parameter (sig=verified, sig=failed, or sig=not_present). Please either include &sig=not_present in exact examples or mark the markup as abbreviated.

CI / validation observed

• cargo fmt --all -- --check: PASS
• cargo clippy --workspace --all-targets --all-features -- -D warnings: PASS
• cargo test --workspace --all-targets: PASS
• cargo check --workspace --all-targets --features "fastly cloudflare": PASS
• GitHub PR checks: PASS at the reviewed head

[aram356]

Thanks @ChristianPavilonis @prk-Jr. PR is now MERGEABLE and all open feedback addressed.

Merge of main (bf4ebc8) — PR #98 (Edge Cookie sync) is now folded in. Conflicts in routes.rs, render.rs, mediation.rs, tests/endpoints.rs, openrtb.rs, Cargo.toml, .tool-versions resolved by taking main's new behaviour (sync_start / sync_done / resolve handlers, EC types in CreativeMetadata, subtle/sha2 deps) and re-applying this branch's strict-clippy compliance + edgezero #257 API (Result<Response, EdgeError> handlers, alphabetical item ordering, width/height field names, etc.). New EC types are placed in the canonical struct/enum grouping before fns. Test count is now 161 (was 119; +42 from PR #98).

Open feedback resolved in 52c5459:

Item	Resolution
🔧 Playwright AD_SIZES bug (@ChristianPavilonis)	Switched to a static AD_SIZES constant (mirrors STANDARD_SIZES in auction.rs) + a drift-detection assertion. npx playwright test --list now reports 41 tests (was 2).
📝 OpenRTB response example missing sig (@prk-Jr, @ChristianPavilonis)	Updated adm example URL to include &sig=not_present.
🤔 Pin Wasmtime instead of curl ... | bash of latest (@ChristianPavilonis)	Added wasmtime 45.0.0 to .tool-versions; CI installs that version via bash -s -- -v "v$VERSION". Matches how viceroy and wasm-bindgen-cli are pinned.
🏕 Spin in CLAUDE.md (@ChristianPavilonis)	Workspace layout, compilation-targets table, edgezero-cli serve examples, and key-files-reference table all now include mocktioneer-adapter-spin.
🏕 Trusted Server docs/examples stale (@ChristianPavilonis)	Out of scope for this PR — those docs evolve with the verifier itself. Worth a follow-up issue if you want me to file one.

All gates still green: clippy -D warnings, 161 tests, fmt, "fastly cloudflare spin" feature check.

[ChristianPavilonis]

PR Review

Approved. The required local gates and GitHub PR checks are passing. I left one non-blocking reproducibility note on the Wasmtime setup so the pinned .tool-versions version cannot be bypassed by a future runner image that happens to preinstall Wasmtime.

[prk-Jr]

LGTM 👍

[aram356]

Thanks for the heads-up @ChristianPavilonis. Addressed in 9c76c72 — dropped the command -v wasmtime guard so the pinned ${{ steps.wasmtime-version.outputs.version }} is always installed, rather than letting any preinstalled wasmtime on the runner image silently satisfy the check. ~/.wasmtime/bin is prepended to $GITHUB_PATH, so the pinned install shadows any system-wide binary for the rest of the job.