feat: bootstrap the shared Pingora edge runtime

[seonghobae]

Purpose

Bootstrap the reusable ContextualWisdomLab Pingora edge runtime as a Supporting/Generic boundary. The gateway owns reusable transport/edge behavior only; product authentication/business routing, Keyverse identity, certificate issuance/key custody, static-site semantics, workflow state, Wardnet/EgressWeave policy and domain retry/failover decisions remain with their canonical owners.

Current exact foundation

PR head remains 0da81a93f93e869c15bb7d34c55fc87479d16522 on protected main@f8b4c99b8e5d3de79af1ff0c00c0c8fd63b52991. Keep Draft. No force update, destructive rebase, self-approval, administrator bypass, security suppression or predecessor-success transfer is authorized.

The foundation provides the initial Rust/Pingora serving path, verified upstream TLS/hostname identity with optional trust bundle, bounded timeout/body/keepalive/in-flight budgets, fail-fast backpressure, forwarding sanitation, health/readiness, low-cardinality observability, HTTP/TLS/failure/drain acceptance, non-root/read-only OCI packaging, committed dependency lock/policy, and DDD/security/operability documentation. Later stacked PRs extend protocol, performance and release evidence; their GREEN does not make this root protected-integrated.

Live root RED

Fresh exact-head Security Scan run 33976768725 is terminal failure for a real dependency finding, not runner noise. The OSV job checked base f8b4c99... and head 0da81a9...; base had zero findings while the head lockfile introduced derivative@2.2.0 / RUSTSEC-2024-0388. The reporter records one affected package, no fixed version, and fails the PR-introduced finding gate. Do not rerun this as if transient and do not add an ignore merely to make the root GREEN.

Cloudflare Pingora now has two distinct authorities that must not be conflated. Protected upstream main has advanced to 4487f7b2ab50f159e4a2cf4f6a6b813f61bb6e19, but the latest published release remains Pingora 0.9.0, whose lightweight tag points to 702f69015e53f7244d6ad2e743de571d859a70a4. Current upstream main still declares workspace derivative = "2.2.0", and owner issue #889 remains open with no maintainer-integrated derivative-removal disposition. A moving main, downstream fork/patch, advisory ignore, or mutable contributor pin is not an acceptable release authority.

Central CodeQL run 33976768716 is also not GREEN. Its actions, python, and javascript-typescript compatibility shards dispatched current-head scans and intentionally failed pending an authenticated codeql-dispatch/<language> terminal verdict. The current commit-status feed contains no such authenticated dispatch verdict. Do not count those first-attempt failures as security findings, but also do not promote them to GREEN without the canonical central callback. .github remains a dedicated owner boundary.

Stacked repair/evidence authority

#56 18fb38b1ba70c4bf222642ef347f3d57a98379a2 is the Rust 1.98.1 compiler foundation on top of this branch. Its repository CI/Supply Chain gates are GREEN and it is Ready/mergeable, but fresh formal review history still has no independent APPROVED review. Rust 1.98.1 therefore remains a gated successor, not protected main authority.

The intended supplier absence regression remains represented by #54; the current upstream derivative graph means that regression cannot become GREEN honestly until a maintainer-integrated, release-qualified supplier repair exists and the gateway regenerates its committed lock against that immutable authority.

Protocol/performance/release successors have advanced far beyond the historical root body. The downstream TLS/H2 chain #75–#88 is exact-head GREEN/Ready; #89 bf66d0317f2f7709dee611b513f1a44551c1fac9 closes handshake-vs-reuse performance; #90 069e11e170cd60b321e28ef4499c88d690a45956 closes controlled clean-build reproducibility; #91 bc85547ebed648c03142edad661c57b1b42a2dc4 adds signed GitHub OIDC/Sigstore provenance; and #92 411ea0361fc392508c19c4ad0362c0cc845c3de3 now binds protected evidence to the exact scanned OCI image as well as report digests. #92 has reacquired terminal GREEN on CI 34657862357, Supply Chain 34657862365, PgErd capacity 34657862366, TLS H2 Performance 34657862338, and Release Reproducibility 34657862364; exact-current technical re-review 5184411500 found no additional writer-safe defect and review threads are 0. It is Ready/mergeable, but still has no independent APPROVED review and cannot execute its real protected bundle before dependency-ordered integration.

Dedicated documentation lane #61 remains owner of docs/product-technical-gap-baseline.md. Current promotion/protocol handoff is maintained in #51/#58; do not race #61 source/docs/refs.

Supplier and protocol boundary

Published Pingora 0.9.0 is not sufficient to clear all current supplier gates. In addition to #889, H2→H1 Cookie coalescing #901, H1 empty-final-body #976 and configurable H1 parser admission #1000 remain open contributor PRs; downstream whole-header lifetime owner issue #447 also remains open. Treat mutable contributor heads as evidence only until maintainer-integrated and release-qualified. HTTP/3/QUIC remains fail-closed.

Promotion boundary

The root cannot honestly reach Ready/merge while its exact dependency scan introduces RUSTSEC-2024-0388. Current causal order is:

maintainer-integrated release-qualified Pingora derivative repair → gateway immutable supplier bump + Cargo-generated lock → exact #1/#54 dependency RED→GREEN without advisory suppression → preserve/revalidate #62 supplier semantics and stacked protocol/performance acceptance → #56 independent approval and then-live protected governance → dependency-ordered non-force integration/restack → protected-main same-SHA Supply Chain/reproducibility/provenance + #92 evidence bundle → immutable-release administration verification → version/CHANGELOG/tag/package + immutable release/SBOM/provenance/reproducibility → representative NUMA and remaining release-qualified supplier gates → consumer parity/shadow/canary/observed rollback/cutover → verified Nginx/OpenResty removal.

No release, cutover or legacy-removal credit is assigned before those gates exist.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current TDD direction needs one correction before GREEN: tests/pingora_peer_adapter.rs currently requires repository-defined DEFAULT_*_TIMEOUT constants. That would encode an arbitrary rule-of-thumb into the shared transport layer, which conflicts with CWL's no-unsupported-heuristics policy and with the PR's fail-closed configuration boundary. Please make connection/read/write/idle/total-connection budgets explicit versioned edge-contract inputs (positive durations), then assert build_peer transfers those configured values into PeerOptions. Do not silently choose product-wide timeout numbers in the generic Pingora runtime. Keep verify_cert=true, verify_hostname=true, standards-oriented HttpUpstreamRequestPolicy, and explicit H1 upstream ALPN until a separately tested H2 policy is accepted. This should remain RED until both the contract and delivery adapter exist.

[seonghobae]

Fresh root-state correction: Cloudflare protected main has moved from the 0.9.0 exact cited in this PR body to 4487f7b2ab50f159e4a2cf4f6a6b813f61bb6e19, but current upstream Cargo.toml still declares derivative = "2.2.0" and #889 remains open. This movement therefore does not clear the #1 Security Scan RED or provide release-qualified supplier authority. Release successor #92 has also moved beyond the historical exact in this body: it is now Draft at 411ea0361fc392508c19c4ad0362c0cc845c3de3 after repairing a real Trivy scan-to-candidate-image identity gap; fresh exact-head gates are nonterminal and predecessor GREEN is not transferred. Root causal order is unchanged: maintainer-integrated derivative removal + release-qualified supplier identity → ordinary lock regeneration → unchanged #1/#54 RED→GREEN → central CodeQL callback → dependency-ordered governance/integration → protected-main release evidence.

[seonghobae]

Fresh central-governance handoff (2026-09-12): canonical .github protected main remains fb17ef556f94f673234aa557254ae52779e9a7b0. The historical CodeQL non-GREEN on this PR remains a central-owner defect, not a reason to copy or weaken workflows in pingora-gateway.

Predecessor .github#2105@fde889ad611054cad0c1be5a14289b7eb881b124 is closed, not merged, only after canonical .github#2106 mechanically proved complete valid-delta succession by ordinary ancestry. That closure retires the duplicate landing vehicle; it is not protected-main integration and transfers no Checks/review credit.

Canonical .github#2106 remains exact 24bb6591ab7df23558cb793b4af60c567ff9da97, based on protected main@fb17ef55..., open/mergeable/Ready/Proposed. There is still no qualifying independent approval. Current-head Runtime Quality, SAST, Python Security, Security Scan and replacement CodeQL PR run 34692079677 have completed; the required CodeQL path remains non-GREEN because protected-main still runs the legacy per-language wake model.

The matching current-generation protected-handler run 34692405217 is now terminal failure, not queued. validate-dispatch succeeded. The Actions shard completed CodeQL analysis, SARIF gate/upload, status publication, and Wake exact CodeQL required job successfully. The Python shard independently completed CodeQL analysis, SARIF gate/upload, and status publication, then failed only at its own Wake exact CodeQL required job. This is a second direct execution of the shared-run multi-writer defect that #2106 removes with one post-matrix settle-required-run; it is not a leaf CodeQL/SARIF source finding.

Do not manual-rerun, source-neutral retrigger, publish synthetic statuses, self-approve, auto-merge, copy the handler locally, or bypass protection. .github#2040@85522306949bada2b5939608dc911f6374125f1b remains the producer/consumer successor. After #2106 lands normally, #2040 must non-force merge-forward to that protected commit, switch the producer to codeql-scan-v2, and obtain fresh exact-head terminal CodeQL/canary plus qualifying independent review.

This governance path remains independent of supplier qualification. Cloudflare protected main@4487f7b2ab50f159e4a2cf4f6a6b813f61bb6e19 is unchanged; upstream #889 remains open and current supplier authority still contains derivative = "2.2.0". Keep #1/#54 supplier RED, #62 supplier-semantics control, and protocol successors separate from the central CodeQL repair.