Identity on Axum through T21's shared app #1574

Summary

Identity on Axum through T21's shared app: a new PR that takes #1536's and #1537's tests but not their Axum-only stores, store selection or wiring, and switches the production image's store features (aws-dynamodb-ec, celld-ec in #1539) to EZI-2b's providers; partner APIs included; passes T5's suite.

Part of #1558, server-side identity on every adapter. Plan ID A2, planned in wave 7 (MVP: Fastly and Axum); priority P1, size M. Design: spec; order and dependencies: plan.

Requirements

ID-1 One EC lifecycle

On every supported adapter a consented document navigation or EC route call (ID-9) mints the EC, creates the record and sets ts-ec together. A cookie is never issued without a record. An existing EC is kept when geo is unknown.

ID-2 One shared record store

The identity logic stays in core and becomes awaitable (#1526). It runs on one EcKvStore over EdgeZero's KvStore (DEC-3). A store that cannot meet the contract makes startup reject identity configuration with a clear error.

ID-3 Partner APIs answered locally

Identify, batch sync, pull sync and admin lookup run on every adapter with a record store. Without one, identify and batch sync return a local error and never reach the publisher origin. Admin lookup already answers 501 locally; pull sync is outbound only.

ID-8 Body EIDs keep being saved

EIDs sent in the /auction body are saved to the record.

WB-1 Document and EC route responses only

Identity cookies are set on top-level HTML document responses and on EC route responses (ID-9), on every supported adapter.

SH-5 One app for every adapter

The identity routes (identify, batch sync, admin lookup and the EC route), pull sync, the EC lifecycle, provider lookups and cookie write-back run from one app built in core, which every adapter mounts and which builds its state once (SH-1). An adapter crate supplies only platform services: through EdgeZero where it offers them, and otherwise through the adapter's existing platform bridge until the EdgeZero ask lands (today Fastly's limiter, ID-6, and Fastly's geo, EZI-4). A capability an adapter lacks is an EdgeZero ask, never new code in that adapter (DEC-16).

Current state

What the code does today, from the design's survey at the revisions it names:

• ID-8: main saves them on Fastly; the provider stack and the RC's Axum lifecycle do not.
• WB-1: main mints ts-ec on Fastly navigations, and the RC adds Axum.
• SH-5: at Cut Trusted Server over to EdgeZero PR 275 #1506's head only the Fastly adapter wires identity (EC generation and finalization are called from its app.rs and main.rs); Axum, Cloudflare and Spin each build their own router without it.

Acceptance criteria

• ID-1: The conformance suite (T5) asserts on each supported adapter that a consented navigation creates the record and sets ts-ec in the same response, that a store failure sets no ts-ec, and that an existing EC survives unknown geo
• ID-1: On an unsupported adapter, startup with identity configuration fails
• ID-2: No adapter crate's non-test code implements EcKvStore, and a store reporting KvError::Unsupported for the contract fails startup with identity enabled
• ID-3: In each adapter's tests a capturing origin receives no identify or batch-sync request
• ID-3: With a store they run, without one they return 501
• ID-8: On each supported adapter a body EID is in the record after the request
• WB-1: Identity Set-Cookie headers appear on navigation and EC route responses and never on asset or other API responses
• SH-5: No adapter crate's non-test code calls EC generation, finalization or an identity handler directly, and the same conformance suite (T5) runs on each supported adapter

Dependencies

Blocked by:

• Identity conformance suite that runs against each adapter, Fastly and Axum first #1586 Identity conformance suite that runs against each adapter, Fastly and Axum first (new in this plan)
• One record backend over EdgeZero KvStore; delete the Fastly ec_kv.rs #1587 One record backend over EdgeZero KvStore; delete the Fastly ec_kv.rs (new in this plan)
• One identity app in core for every adapter #1600 One identity app in core for every adapter (new in this plan)
• Serve Axum in production mode from main #1573 Serve Axum in production mode from main (new in this plan)
• Extract the protected CloudFront native Geo integration #1529 Extract the protected CloudFront native Geo integration

Blocks:

• Load-test the record store at the target page-load rate with provider refreshes #1576 Load-test the record store at the target page-load rate with provider refreshes (new in this plan)
• Axum reference infrastructure #1578 Axum reference infrastructure (new in this plan)
• Run the SIGTERM-during-record-write test in CI (scripts/test-native-ec-image.mjs from #1536) #1579 Run the SIGTERM-during-record-write test in CI (scripts/test-native-ec-image.mjs from Extract native EC lifecycle and DynamoDB persistence #1536) (new in this plan)
• Identity features pass on Axum from the shared app #1581 Identity features pass on Axum from the shared app (new in this plan)

Related pull requests

• Extract native EC lifecycle and DynamoDB persistence #1536 Extract native EC lifecycle and DynamoDB persistence: carries part of this work.

  Fixes the plan asks of Extract native EC lifecycle and DynamoDB persistence #1536

  When this unit is ported to main: do not port the adapter-local DynamoDB store (ID-2, AX-4). All units: replace TS_* names (AX-2). Proposed closure, for the author to decide: Extract existing Sourcepoint consent synchronization #1535, Extract native EC lifecycle and DynamoDB persistence #1536 and Extract explicit EC storage selection and celld #1537 once T19, T20, A2 and A8 carry their code and tests.

• Extract explicit EC storage selection and celld #1537 Extract explicit EC storage selection and celld: carries part of this work.

  Fixes the plan asks of Extract explicit EC storage selection and celld #1537

  When this unit is ported to main: do not port its Axum celld store or storage selection, which EdgeZero's providers and logical stores replace (EZI-2b, DEC-16); its example config also breaks startup on Axum, Cloudflare and Spin. All units: replace TS_* names (AX-2). Proposed closure, for the author to decide: Extract existing Sourcepoint consent synchronization #1535, Extract native EC lifecycle and DynamoDB persistence #1536 and Extract explicit EC storage selection and celld #1537 once T19, T20, A2 and A8 carry their code and tests.

• Run server-side identity collection on the Axum dev server #1566 Run server-side identity collection on the Axum dev server: carries part of this work.

  Fixes the plan asks of Run server-side identity collection on the Axum dev server #1566

  Move 0a2a00aaf (SharedID name, source and retention) and 0c13d4272 (drops the blanket provider rejection) into Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488. Rebuild the Axum part on T21's shared app and EdgeZero capabilities: no Axum-only EcKvStore (ec_kv.rs:87; ID-2, DEC-3), no Trusted Server rate limiter (none on Axum, DEC-11), no User-Agent-only gate (EZI-3, ID-7), and no detached block_on task (EZI-1). Local development uses EdgeZero's local store (EZI-2a). It then serves A2 and A10.

Notes from the plan

• Run server-side identity collection on the Axum dev server #1566 overlaps A2 and A10; its Axum part is rebuilt on T21 (Part C).
• T7, T14 and A11 are folded into A2 and A10, because the shared app (T21) brings partner APIs, the mirror cookie and the EC route to every adapter.