Integration-branch revision with ClientInfo, JA4 and Axum geo binding #491

Summary

Integration-branch revision with EZI-3, the Fastly and Axum ClientInfo, the JA4 accessor and Axum's geo binding.

Behavior

EdgeZero keeps the integration branch rc/identity for this work (DEC-5, #495). Each integration point is a commit on it that Trusted Server main pins by SHA until EdgeZero releases the work; there are no tags. The branch moves only forward, by merges, and is never force-pushed. R1 is the first commit that carries #275 through #439, so Axum production serving does not wait for the record contract. R1b adds EZI-2a and EZI-2b. R2 adds the Fastly and Axum parts of EZI-1. R2b adds EZI-3, #90, #92, the JA4 accessor (#283) and Axum's geo binding (EZI-4a), so providers never wait on JA4. Together R1, R1b, R2 and R2b cover Fastly and Axum. R3 adds the Cloudflare parts of EZI-1 to EZI-4, and R4 the Spin parts. EZI-2p and EZI-5 follow the MVP (DEC-15).

Acceptance criteria

• Each integration point is a commit on rc/identity that Trusted Server main pins
• R1, R1b, R2 and R2b contain no Cloudflare or Spin part

Dependencies

Blocked by:

• ClientInfo contract: portable client IP and TLS metadata #475 ClientInfo contract: portable client IP and TLS metadata (new in this plan)
• Fastly ClientInfo #90 Fastly ClientInfo
• Axum ClientInfo #92 Axum ClientInfo
• Expose JA4 through a standard request interface #283 Expose JA4 through a standard request interface
• Axum geo bound from EdgeZero's manifest, so ctx.geo() needs no application boot profile #482 Axum geo bound from EdgeZero's manifest, so ctx.geo() needs no application boot profile (new in this plan)

Blocks:

• Identity features pass on Axum from the shared app trusted-server#1581 Identity features pass on Axum from the shared app (new in this plan)
• Refuse record creation when a trusted JA4 contradicts the User-Agent trusted-server#1592 Refuse record creation when a trusted JA4 contradicts the User-Agent (new in this plan)
• Extract the protected CloudFront native Geo integration trusted-server#1529 Extract the protected CloudFront native Geo integration

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 4 (MVP: Fastly and Axum); priority P1, size S.
• Requirement EZI-6 in the design.