Identity conformance suite that runs against each adapter, Fastly and Axum first #1586

Summary

Identity conformance suite that runs against each adapter, Fastly and Axum first.

Part of #1558, server-side identity on every adapter. Plan ID T5, planned in wave 2 (MVP: Fastly and Axum); priority P1, size M. Design: spec; order and dependencies: plan.

Requirements

ID-1 One EC lifecycle

On every supported adapter a consented document navigation or EC route call (ID-9) mints the EC, creates the record and sets ts-ec together. A cookie is never issued without a record. An existing EC is kept when geo is unknown.

SH-5 One app for every adapter

The identity routes (identify, batch sync, admin lookup and the EC route), pull sync, the EC lifecycle, provider lookups and cookie write-back run from one app built in core, which every adapter mounts and which builds its state once (SH-1). An adapter crate supplies only platform services: through EdgeZero where it offers them, and otherwise through the adapter's existing platform bridge until the EdgeZero ask lands (today Fastly's limiter, ID-6, and Fastly's geo, EZI-4). A capability an adapter lacks is an EdgeZero ask, never new code in that adapter (DEC-16).

Current state

What the code does today, from the design's survey at the revisions it names:

• SH-5: at Cut Trusted Server over to EdgeZero PR 275 #1506's head only the Fastly adapter wires identity (EC generation and finalization are called from its app.rs and main.rs); Axum, Cloudflare and Spin each build their own router without it.

Acceptance criteria

• ID-1: The conformance suite (T5) asserts on each supported adapter that a consented navigation creates the record and sets ts-ec in the same response, that a store failure sets no ts-ec, and that an existing EC survives unknown geo
• ID-1: On an unsupported adapter, startup with identity configuration fails
• SH-5: No adapter crate's non-test code calls EC generation, finalization or an identity handler directly, and the same conformance suite (T5) runs on each supported adapter

Dependencies

Blocked by:

• Cut Trusted Server over to EdgeZero PR 275 #1507 Cut Trusted Server over to EdgeZero PR 275

Blocks:

• Identity on Axum through T21's shared app #1574 Identity on Axum through T21's shared app (new in this plan)
• Identity on Cloudflare through T21's shared app with EZI-2c's store, passing T5's suite #1588 Identity on Cloudflare through T21's shared app with EZI-2c's store, passing T5's suite (new in this plan)

Notes from the plan

• Cut Trusted Server over to EdgeZero PR 275 #1507 delivers the cutover and stays under Integrate Auctioneer into Trusted Server on EdgeZero PR 275 #1505; it blocks A1, T4, T5, T21, Reduce Fastly adapter per-request fixed cost: defer KV/geo work, cache settings/registry/template fingerprint #1192 and Certificate checks on identity backends that still follow proxy.certificate_check #1556.