Prove the edge's core guarantees with real traffic

[scotwells]

What this proves

Four end-to-end tests that send real traffic through the edge and confirm the guarantees customers depend on:

• The firewall enforces. It blocks what it should and lets legitimate traffic through.
• An offline origin fails cleanly. When a connector's origin is unreachable, the edge returns a clear error instead of hanging or leaking an internal failure.
• The branded error page shows. When something goes wrong, customers see our page, not a raw proxy error.
• One bad certificate can't break its neighbors. A single customer's expired or invalid certificate can't take down the edge for everyone else sharing it.

Each test checks the outcome with a real request — the same thing a customer would experience — rather than confirming the control plane wrote the right configuration and assuming the edge followed.

It also adds a short, plain-language guide to how we test the edge: what each test guarantees, how we know a result is trustworthy, and — honestly — what we can't yet guarantee.

Why it matters

These are the promises the edge makes to customers. Proving them with real traffic, in an environment that mirrors production, is the difference between believing the edge works and knowing it does.

Builds on

The faithful test environment and the real-vs-intended config check opened alongside this. Together they let each test give a verdict from real traffic, backed by proof the edge was actually configured the way the test assumed.