test: certify Cloudflare R2-first and GitHub fallback behavior - #187

What

Certify the intended Zed artifact retrieval order end to end:

1. owned registry/API servers;
2. immutable content-addressed artifacts in owned Cloudflare R2;
3. Cloudflare /github/* proxy when the R2 copy is unavailable;
4. later direct GitHub/GHCR/archive client fallbacks.

This PR:

• adds a deterministic Node contract that imports and executes the exact zed-pkg/zed-infra CDN Worker at immutable commit 2150c08b94ae64bb6a30ef7d2465462b6d65cd48;
• proves an artifacts/<sha> R2 hit returns exact bytes with x-zed-source: r2 and performs no upstream fetch;
• proves a digest miss does not guess a GitHub identity;
• proves the subsequent /github/<owner>/<repo>/<tag>/<file> request is proxied by Cloudflare through an allowlisted GitHub redirect chain with x-zed-source: github-release;
• asserts caller authorization and cookie headers are never forwarded to GitHub;
• upgrades the black-box CLI canary to record three clean installs: healthy owned registry, registry-down R2 hit, then registry-down/R2-miss Cloudflare GitHub proxy;
• pins zed-infra explicitly for workflow-call/dispatch certification and documents the private-R2/public-proxy security boundary.

The locator correction consumed by the candidate CLI is in zed-pkg/zed-interfaces#105.

Why

The previous canary copied all guessable paths into a static HTTP directory and proved only that some CDN fallback restored the package. It neither executed the real Cloudflare Worker nor distinguished an R2 hit from the /github/* proxy path. That allowed source-precedence drift to go undetected.

/github/* is intentionally a credential-free Cloudflare proxy, not a private-bucket read oracle. Direct R2 access remains limited to immutable artifacts/<sha> objects and signed metadata.

Verification

Completed on the branch:

• python3 -m py_compile scripts/github_r2_fallback.py;
• node --check scripts/cloudflare_github_fallback_contract.mjs;
• git diff --check;
• exact pinned Worker contract: R2 source r2, fallback source github-release, allowlisted upstream hosts only.

The reusable full lane additionally builds an exact CLI/interface tuple, checks interface/client/lib-core contracts, executes the Worker contract, and runs the three-phase frozen-install canary. The exact candidate tuple will be supplied after the focused zed-cli pin finishes validation.

No credentials, production buckets, package publication, deployment, token mutation, or public redirect behavior are involved.