Repository navigation
Description
Summary
On Fastly, lifecycle::run_custom and lifecycle::serve_custom install the managed logger before the custom callback. When that install fails, they return ManagedLoggerError to the caller without sending a response, so the client's request goes unanswered, health checks included.
Behavior today
At 10166628 (the same files as PR #275's 5c32ae61):
run_customrunsinitialize_for_app::<A>()?before the callback (crates/edgezero-adapter-fastly/src/lifecycle.rs:198), andserve_customdoes the same per request (:170). On failure the callback never runs and nothing is sent. Underserve_custom,DeliveryResult::sendreturns the error without sending (:31-40), and the loop stops.- The failure is kept for the instance (
edgezero-core/src/logging.rs,ManagedLoggerInstallation). Theedgezero_loggingoverride is read once per instance, and an unexpected host failure there returnsConfigurationUnavailable(docs/guide/adapters/fastly.md, "Runtime Level Overrides"). So one failed read fails every later request in a reused instance. - Under Viceroy 0.21.0 the client gets
HTTP/1.1 200 OKwithcontent-length: 0. What hosted Fastly answers was not checked. - The other adapters hand the host an error rather than leaving the request unanswered:
- Cloudflare
run_appmaps the failure toWorkerError::RustError("managed logger initialization failed"). - Spin
run_appreturns it with?.
- Cloudflare
- The Fastly guide does not say what the client receives in this case.
Reproduction
Trusted Server PR IABTechLab/trusted-server#1506, which calls run_custom::<TrustedServerApp, _, _, _> and serve_custom::<TrustedServerApp, _, _, _>:
- Set
[adapters.fastly.logging] endpoint = "ts:log"inedgezero.toml. - Build the release wasm and serve it with Viceroy 0.21.0.
curl -si /healthandcurl -si /.
Both answer HTTP/1.1 200 OK, content-length: 0, with no body. Viceroy's stderr shows Trusted Server's report of the returned error: managed logger installation failed: managed logging configuration is invalid. With endpoint = "tslog", /health answers 200 with body ok.
Acceptance criteria
- When managed logging fails before the callback, the client receives an error response (5xx) instead of none, under both
run_customand every requestserve_customstops on. - The error still returns to the caller.
- The Fastly guide states what the client receives.
- A Viceroy test pins the status.
Related
- Found in the round-2 review of Cut Trusted Server over to EdgeZero PR 275 trusted-server#1506, which pins
rc/identityat10166628((DO NOT MERGE) Identity integration branch #495). Trusted Server records the behavior as an open EdgeZero gap and adds no workaround. - Related: Reject Fastly logging endpoint names the logger cannot install when the manifest loads #506, the endpoint names that fail this way. Part of Platform capabilities for server-side identity on every adapter #468.
Metadata
Metadata
Assignees
Labels
No labels
Activity
fix(fastly): validate logging and reject setup failures
aram356 commentedon Nov 15, 2026
CREATOR: fixed in
4cbabfeeon PR #275.Both custom runners now use one private setup gate. A managed-logging failure before callback entry consumes the unread request through existing app-free assembly-error egress, attempts canonical redacted JSON 500 (no HEAD payload), and returns the original typed logger error even if delivery fails. Secondary delivery/fallback degradation uses bounded category-only, fallible stderr output. Callback errors, including the same logger-error type after sending, never trigger another response.
Verified on the committed head:
Both commands exit 0. The selected runtime test executes six actual Viceroy controls: GET/HEAD setup failures for each runner and two already-committed callback-error controls. Before the fix, the four setup cases exposed host-generated WASI-error 500 bodies rather than canonical JSON; both callback controls already passed.
The complete prescribed local suite and 35 additional checks pass. The separate broader assembly run still exits 1 on seven first-response attestation cases; all 27 existing logging controls and six new controls pass. That blocker and hosted qualification remain open; no gate was relaxed or capability promoted. The issue remains open until default-branch integration.