[ChristianPavilonis]

Summary

• Add portable validated Geo values, bounded redacted assertions, a synchronous provider contract and one immutable outcome per request.
• Add default-off native CloudFront and supplied-provider selection, early startup validation and protected-ALB source admission based only on the owned socket peer. No fallback, remote lookup or automatic HTTP permission decision.
• Add real hosting and portable WASM regressions, deployment guidance, compiled examples and explicit feature/dependency CI coverage.

Stack and prerequisite reconciliation

Base branch: feat/native-celld-stores, draft #422 at 5426ea65. This PR stays on top of the existing native celld stack.

Although the GitHub stack names #409 as an ancestor, this base did not contain its checked-ingress implementation. This diff therefore also reconciles the pinned 66a05e25 checked-ingress/proxy/diagnostics contract. It adapts that commit's own delta while preserving newer native stores, local non-Send initialization, Connections/FuturesUnordered, bounded ingress/config snapshots and asynchronous response EOF validation. The existing forwarding parser supplies the shared bounded peer-network matcher.

The distinct #407 buffered JSON-cap/managed Body feature is not imported or claimed. Native JSON error privacy is retained through private admitted/context state. The plan records exactly which #407-dependent cap/carrier checks are excluded. No old branch tree replaced newer files.

Changes

Crate / File	Change
edgezero-core::geo	Validated provider IDs, pinned ISO country allowlist, syntax-only subdivisions, bounded input slots and source-free error categories. Portable providers gain no Send/Sync or async requirement.
Core dispatch/context	Owned Geo handoff outside public extensions, read-only ctx.geo(), default NoSelection on legacy/unmanaged paths, preserved framework error privacy and egress classification.
Native Geo composition	One Off/CloudFront/Supplied selection in AxumRunOptions, capability inspection through finalized options, startup rejection before runner resources, native-only Arc thread bounds.
Checked native ingress	Shared CIDR bounds/mapped-peer normalization, separate opaque protected-ALB policy, credential removal before callbacks/error handling while original bytes still count, exactly-once admitted resolution.
Native and portable tests	Real no-store listener proof, enabled/disabled/supplied modes, mutation/forgery/cancellation/finalization tests, retained checked-ingress/TLS/lifecycle tests, no-selection WASM contracts.
Docs and CI	Native Geo and reconciled diagnostics guides, four compiled Geo examples, explicit feature-state tests, fail-closed dependency graph script, PR trigger for the celld base.
Lockfiles	Dependency edges only in root/demo/reusable locks. No selected package version changes. Geo itself adds no third-party runtime dependency.

Issue scope

Implements the initial CloudFront/synchronous-contract scope of #432 under #391. Local GeoIP databases, checked-reader-IP input and database lifecycle are split into #438, with the split recorded on #432. This PR does not satisfy or close that deferred work.

Trusted Server adoption and jurisdiction/consent interpretation remain separate. Geo is an estimate, not proof of residence, identity or consent. Country-only and unrecognized subdivisions stay unknown to application policy.

Test plan

• cargo test --locked --workspace --all-targets: 2,115 passed, 6 existing generated-consumer/real-service tests ignored.
• cargo test --locked -p edgezero-adapter-axum --all-targets --all-features: 422 passed, including mixed AWS/celld startup, preserved lifecycle/EOF tests and 32 hosting tests. Provider service fixtures are loopback-only.
• Explicit default-off/enabled library suites: 323 disabled and 322 enabled tests passed. Startup-before-resources, bounded parsing, supplied-provider, immutable outcome and exactly-once sentinels executed.
• Explicit no-default-feature real-hosting suites: 32 enabled and 33 disabled tests passed. Both unavailable-built-in and supplied-without-built-in sentinels passed.
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings, disabled-native Clippy, cargo fmt --all -- --check, git diff --check.
• Workspace feature compilation, minimal native and bindings-only builds, all three adapter WASM target checks.
• WASM runtime contracts: Fastly 24 tests using Viceroy 0.21.0, Cloudflare 29 using wasm-bindgen-test-runner 0.2.128 and Node 24.12.0, Spin 35 using Wasmtime 48.0.2. Fastly's preparer/closed-lifecycle sentinel also ran explicitly.
• New Geo and existing native-store dependency scripts. Geo script also has 16 executed failure-case mock checks.
• Native doc tests: 5 passed. Warnings-denied workspace rustdoc passed. Guide snippets match the compiled examples.
• App-demo workspace: 54 passed. Reusable fixture-axum checked against its updated lockfile.
• Docs lint, format and site build. Seven official AWS source pages checked.
• Manual edgezero serve --adapter axum. Programmatic production-runner and real-listener tests were used instead; no Geo CLI selector is introduced.
• Actual CloudFront/ALB deployment and downstream policy acceptance. These require separate authorization and are not substitutes for local CI.

Tested implementation is 56eab85f; the later commit records evidence/status only. Exact commands, tested feature sets, timings, local logs and ignored-test limits are in the implementation plan. No failing local gate is excluded.

Trust and acceptance limits

The protected policy declares an externally credential-gated and isolated ALB path. A matching subnet does not authenticate a distribution or prove that its listener rules are correct. EdgeZero does not receive the configured credential value or call AWS to inspect/provision infrastructure.

Production use still requires deployed proof of the credential gate, target isolation, viewer-header replacement including AWS-network missing-subdivision spoofing, value rotation and shared-cache/error-TTL isolation. The guide requires HTTPS, a default-deny ALB, CloudFront origin-facing prefix-list restrictions, private target access, explicitly generated geographic headers and disabled shared caching. No deployment was attempted.

The six existing ignored generated/service harnesses were not counted as passes. Unchanged docs dependencies report seven npm audit vulnerabilities; no unrelated dependency upgrades were attempted. ShellCheck was unavailable; Bash syntax, behavioral failure cases and real graph checks passed.

Checklist

• Changes follow CLAUDE.md conventions and scoped ownership.
• No native runtime or AWS SDK dependency added to portable core/WASM graphs. Reconciled TLS fixture dependencies are native test-only.
• No legacy route-param syntax or application-side geographic-header trust added.
• Existing store wiring retains typed registries; Geo is separate from stores and PreparedStores.
• New behavior has constructor, integration, real-listener and WASM tests.
• No production secrets committed. Checked-in TLS certificates/key and credential strings are public, disposable fixture material only.