Prove the edge's core guarantees with real traffic

[scotwells]

What this proves

Four end-to-end tests that send real traffic through the edge and confirm the guarantees customers depend on:

• The firewall enforces. It blocks what it should and lets legitimate traffic through.
• An offline origin fails cleanly. When a connector's origin is unreachable, the edge returns a clear error instead of hanging or leaking an internal failure.
• The branded error page shows. When something goes wrong, customers see our page, not a raw proxy error.
• One bad certificate can't break its neighbors. A single customer's expired or invalid certificate can't take down the edge for everyone else sharing it.

Each test checks the outcome with a real request — the same thing a customer would experience — rather than confirming the control plane wrote the right configuration and assuming the edge followed.

It also adds a short, plain-language guide to how we test the edge: what each test guarantees, how we know a result is trustworthy, and — honestly — what we can't yet guarantee.

Why it matters

These are the promises the edge makes to customers. Proving them with real traffic, in an environment that mirrors production, is the difference between believing the edge works and knowing it does.

Builds on

The faithful test environment and the real-vs-intended config check opened alongside this. Together they let each test give a verdict from real traffic, backed by proof the edge was actually configured the way the test assumed.

---

Part of #247 — catching silent edge misconfiguration before it reaches customers.

One of a five-PR stack, best reviewed and merged in order:

• Let the edge report the protections it was told to run #224 — report the protections the edge was told to run
• Confirm the edge is actually running the configuration it was given #225 — confirm the edge is running the configuration it was given
• Stand up a test environment that mirrors how the edge really runs #226 — a test environment that mirrors how the edge really runs
• Carry edge policy from the control plane out to the edges #227 — carry edge policy from the control plane out to the edges
• Prove the edge's core guarantees with real traffic #228 — prove the edge's core guarantees with real traffic ← you are here