EdgeZero full-migration umbrella design spec

.superpowers/sdd/progress.md

@@ -0,0 +1,9 @@
+# Phase 1 (EdgeZero store-registry migration) — progress ledger
+
+Plan: docs/superpowers/plans/2026-07-02-edgezero-store-registry-migration.md
+Pin: edgezero @ d8f71a4a (--locked). D6-a confirmed (keep composite write path).
+Branch: worktree-edgezero-migration-spec
+
+## Tasks
+- Task 1: in progress (inventory + D5/D6-a decision record)
+- Task 1: COMPLETE — preflight green, D6-a confirmed, D5 map recorded (commit pending)

Cargo.toml

@@ -43,12 +43,12 @@ criterion = { version = "0.5", default-features = false, features = ["cargo_benc
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", branch = "main", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", branch = "main", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", branch = "main", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", branch = "main", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", branch = "main" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", branch = "main", default-features = false }
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", branch = "worktree-state-nested-secrets-spec-review", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 fastly = "0.12"

crates/trusted-server-core/src/config.rs

@@ -92,9 +92,11 @@ impl edgezero_core::app_config::AppConfigMeta for TrustedServerAppConfig {
     // Phase 1 intentionally preserves the existing inline-settings model:
     // `ts config push` publishes the validated Trusted Server config as one
     // app-config blob. Migrating app-level secrets to `EdgeZero` secret-store
-    // references needs nested/array extraction support and operator migration
-    // work tracked separately.
-    const SECRET_FIELDS: &'static [edgezero_core::app_config::SecretField] = &[];
+    // references (via `#[secret]` on `Settings`) is Phase 3; until then no
+    // fields are externalized, so the secret-field set is empty.
+    fn secret_fields() -> Vec<edgezero_core::app_config::SecretField> {
+        Vec::new()
+    }
 }
 
 /// Runs Trusted Server deploy-time validation for pushed app config.