Integration-branch tag with the Cloudflare parts #492

Summary

Integration-branch tag with the Cloudflare parts.

Behavior

EdgeZero keeps a protected integration branch for this work (DEC-5), and each integration point is a tag on it that Trusted Server main pins until EdgeZero releases the work. R1 creates the branch and tags #275 through #439, so Axum production serving does not wait for the record contract. R1b adds EZI-2a and EZI-2b. R2 adds the Fastly and Axum parts of EZI-1. R2b adds EZI-3, #90, #92, the JA4 accessor (#283) and Axum's geo binding (EZI-4a), so providers never wait on JA4. Together R1, R1b, R2 and R2b cover Fastly and Axum. R3 adds the Cloudflare parts of EZI-1 to EZI-4, and R4 the Spin parts. EZI-2p and EZI-5 follow the MVP (DEC-15).

Acceptance criteria

• Each tag exists on the protected integration branch and Trusted Server main pins it
• R1, R1b, R2 and R2b contain no Cloudflare or Spin part

Dependencies

Blocked by:

• After-response work on Cloudflare (waitUntil) #478 After-response work on Cloudflare (waitUntil) (new in this plan)
• Cloudflare record store: portable providers and Workers KV pass the record contract #479 Cloudflare record store: portable providers and Workers KV pass the record contract (new in this plan)
• Geo with country and region through ctx.geo() on Cloudflare #480 Geo with country and region through ctx.geo() on Cloudflare (new in this plan)
• Cloudflare ClientInfo #91 Cloudflare ClientInfo

Waits on these decisions:

• DEC-8 Cloudflare and Spin store (open). Which store Cloudflare and Spin use by default for the record: the DynamoDB or celld adapter, or a native store that meets the contract, per Platform support. Blocks EZI-2c, EZI-2s, R3, T8 and T9.

Blocks:

• Integration-branch tag with the Spin parts #493 Integration-branch tag with the Spin parts (new in this plan)
• Identity on Cloudflare through T21's shared app with EZI-2c's store, passing T5's suite trusted-server#1588 Identity on Cloudflare through T21's shared app with EZI-2c's store, passing T5's suite (new in this plan)
• Identity features pass on Cloudflare from the shared app trusted-server#1596 Identity features pass on Cloudflare from the shared app (new in this plan)
• Verify EdgeZero geolocation adoption in EC and auction consent paths trusted-server#1518 Verify EdgeZero geolocation adoption in EC and auction consent paths

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 12 (after the MVP: Cloudflare); priority P2, size S.
• Requirement EZI-6 in the design.