Platform capabilities for server-side identity on every adapter #468

Description

Trusted Server keeps a server-side Edge Cookie (EC) identity record for each reader. The identity logic is portable and lives in Trusted Server core. It needs platform capabilities that EdgeZero does not expose yet, so today it runs only on Fastly, where Trusted Server calls the Fastly SDK directly.

This epic tracks the EdgeZero side: the capabilities that let the same identity code run on Fastly, Axum, Cloudflare and Spin with no platform code in Trusted Server.

Read at EdgeZero main e11ea308 (crates at v0.0.11) and PR #275 head 14a6ca8b on 2026-11-11.

Needed capabilities

• Conditional KV writes and strong reads. KvStore offers get, put, delete, exists and list. The identity record also needs a read that returns a generation marker, create-if-absent and generation compare-and-swap writes, and strongly consistent existence checks and prefix listing. A store that cannot provide these returns a capability error instead of a weaker answer.
• Work after the response is sent. A portable way to run bounded work after delivery, drained on shutdown on Axum. Today only Fastly's custom serve loop and Cloudflare's wait_until allow it, each through its own platform API.
• Rate limiting. A portable limiter, backed by Edge Rate Limiting on Fastly and by in-memory and shared-counter backends on native.
• Trusted client IP. One accessor on every adapter. The adapters expose the client IP in four different shapes, and Cloudflare exposes none.
• Geo with region on every adapter. Main has no geo module. ctx.geo() exists only on the Add pluggable native Geo providers and protected CloudFront ingress #439 stack, and only Axum fills it there. Region is modelled as subdivision.

Related

• Make the Axum adapter production-ready for self-hosted deployments #391 owns Axum production readiness: lifecycle, configuration, storage providers and containers. This epic does not repeat that work.
• feat: implement portable outbound HTTP and request lifecycle contracts #275 owns portable outbound HTTP and the request lifecycle.
• Trusted Server epic: Server-side identity on every adapter trusted-server#1558, which consumes these capabilities.
• Make the Axum adapter production-ready for self-hosted deployments #391 stays the Axum production epic. Axum: add safe production diagnostics and trusted-proxy handling #397, Add native AWS configuration, secret, and ordinary KV store providers #410, Axum: add protected CloudFront Geo metadata provider #432, Add native celld configuration and KV store providers #437, Axum: follow up with an explicit local GeoIP provider #438, Expose JA4 through a standard request interface #283 moved from it or had no parent and are tracked here.

Done when

• Each capability above has its own issue with behavior and acceptance criteria, linked here as a sub-issue.
• Each capability works on Fastly, Axum, Cloudflare and Spin, or is declared Unsupported on a platform with a documented reason and a capability error at the point of use.
• A released EdgeZero tag contains them.

Out of scope

The identity record format and its logic, which stay in Trusted Server.