feat(server): startup sequence + health listeners

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]

[moonming]

Summary

Wires the 10-step startup sequence from spec §1 into the `aisix`
binary:

1. Parse CLI args (`--config`, with `AISIX_CONFIG` env fallback)
2. Load + validate bootstrap config
3. `init_tracing` — `aisix-obs` now installs an `EnvFilter` subscriber
4. `EtcdConfigProvider::connect` (5s × 5 retry, reused from PR feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators #3)
5. Initial snapshot load via `Supervisor::load_once`
6. Spawn `Supervisor::run` on a dedicated task (cancel via `watch`)
7. Build proxy router (`aisix-proxy` now exposes `build_router`)
8. Build admin router (`aisix-admin` now exposes `build_router`)
9. Bind + serve both listeners with `axum::serve` + graceful shutdown
10. SIGINT/SIGTERM → flip cancel → drain serves → join supervisor

Both routers only mount `/health` for now so the bootstrap is
observable without dragging in feature code that hasn't landed yet.
The health handler reports current snapshot table sizes so the full
path is end-to-end verifiable.

Test plan

• `cargo test --workspace` — 75 tests pass (new + existing)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• `cargo build --bin aisix` succeeds
• CI green on all 6 jobs

[Copilot]

Pull request overview

Implements the spec §1 startup sequence wiring in the aisix server binary, introducing minimal /health endpoints for both proxy and admin listeners so bootstrap + snapshot plumbing can be exercised end-to-end.

Changes:

• Adds an async aisix-server startup flow: CLI config path, config load, tracing init, etcd supervisor spawn, and dual Axum listeners with graceful shutdown.
• Exposes build_router + state types in aisix-proxy and aisix-admin, each mounting a basic /health handler reporting snapshot table sizes.
• Introduces aisix-obs::init_tracing to install a tracing_subscriber with an EnvFilter derived from config and/or RUST_LOG.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-server/src/main.rs	Implements the server startup orchestration, supervisor wiring, listener binding/serving, and shutdown coordination.
crates/aisix-proxy/src/lib.rs	Adds ProxyState and build_router() with a /health endpoint and tests.
crates/aisix-proxy/Cargo.toml	Adds tokio dev-dependency features needed for async tests.
crates/aisix-obs/src/lib.rs	Adds init_tracing() and error types for observability bootstrap.
crates/aisix-admin/src/lib.rs	Adds AdminState and build_router() with a /health endpoint and tests.
crates/aisix-admin/Cargo.toml	Adds tokio dev-dependency features needed for async tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

EnvFilter::try_from_default_env().or_else(|_| ...) also falls back when RUST_LOG is set but invalid, silently ignoring the operator override. If RUST_LOG is present but can’t be parsed, it’s usually better to return an error that references the invalid RUST_LOG value (and only fall back to cfg.log_level when the env var is absent).

[Copilot]

tokio::join!(proxy_serve, admin_serve) can deadlock: if either server future returns early (e.g. bind/serve error) while the other is still running, join! will wait forever and the cancellation cancel_tx.send(true) is never reached. Use tokio::select! (or spawn both serves and select on their JoinHandles) to trigger cancellation as soon as any of (signal, proxy_serve, admin_serve) completes, then gracefully shut down the remaining tasks.

Suggested change

	let signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	let(proxy_res, admin_res) = tokio::join!(proxy_serve, admin_serve);
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	// Ask the supervisor to stop (no-op if the signal task already did).
	let _ = cancel_tx.send(true);
	let _ = signal_task.await;
	let _ = watch_task.await;
	letmut signal_task = tokio::spawn(wait_for_signal(cancel_tx.clone()));
	letmut proxy_task = tokio::spawn(proxy_serve);
	letmut admin_task = tokio::spawn(admin_serve);
	let first_result: anyhow::Result<()> = tokio::select! {
	res = &mut signal_task => {
	res.map_err(|e| anyhow::anyhow!("signal task join error: {e}"))?;
	Ok(())
	}
	res = &mut proxy_task => {
	res.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))
	}
	res = &mut admin_task => {
	res.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?
	.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))
	}
	};
	// Ask the supervisor and remaining servers to stop.
	let _ = cancel_tx.send(true);
	// The signal task may still be waiting for SIGINT/SIGTERM if a server
	// completed first, so do not wait forever on it.
	if !signal_task.is_finished(){
	signal_task.abort();
	}
	let _ = signal_task.await;
	if !proxy_task.is_finished(){
	let proxy_res = proxy_task
	.await
	.map_err(|e| anyhow::anyhow!("proxy task join error: {e}"))?;
	proxy_res.map_err(|e| anyhow::anyhow!("proxy serve error: {e}"))?;
	}
	if !admin_task.is_finished(){
	let admin_res = admin_task
	.await
	.map_err(|e| anyhow::anyhow!("admin task join error: {e}"))?;
	admin_res.map_err(|e| anyhow::anyhow!("admin serve error: {e}"))?;
	}
	let _ = watch_task.await;
	first_result?;

[Copilot]

signal_task.await can hang indefinitely when shutdown is triggered by something other than SIGINT/SIGTERM (e.g. one of the serve futures errors/exits). wait_for_signal doesn’t observe the cancel channel, so it never returns in that scenario. Consider either (1) passing a watch::Receiver<bool> into wait_for_signal and select!ing between cancel and OS signals, or (2) aborting/dropping signal_task once cancellation is triggered.

Suggested change

	let _ = signal_task.await;
	// If shutdown was triggered by something other than SIGINT/SIGTERM,
	// the signal task may still be blocked waiting on OS signals.
	// Abort it so this join cannot hang indefinitely.
	signal_task.abort();
	match signal_task.await{
	Ok(()) => {}
	Err(err)if err.is_cancelled() => {}
	Err(err) => returnErr(anyhow::anyhow!("signal task join error: {err}")),
	}

[Copilot]

The startup sequence comment and PR description call for bootstrapping an initial snapshot before serving, but the code starts serving immediately after spawning Supervisor::run. Since Supervisor::run performs the first load_all asynchronously, /health (and future proxy routing) can observe an empty snapshot during startup. Call supervisor.load_once().await? (or otherwise await the first successful load) before binding/serving.

[Copilot]

This assertion does not compile: b.admin_keys[0] is an &String, so &*b.admin_keys[0] attempts to move out of a borrow. Compare using b.admin_keys[0].as_str() (or &b.admin_keys[0] with an appropriate RHS) instead.

Suggested change

	assert_eq!(&*b.admin_keys[0],"k1");
	assert_eq!(b.admin_keys[0].as_str(),"k1");

[Copilot]

This crate drops #![forbid(unsafe_code)] while the rest of the workspace consistently forbids unsafe (e.g. aisix-core, aisix-etcd, aisix-admin, aisix-proxy). If that wasn’t intentional, re-add #![forbid(unsafe_code)] to keep the workspace policy consistent.

Suggested change

	#![deny(rust_2018_idioms)]
	#![deny(rust_2018_idioms)]
	#![forbid(unsafe_code)]