[aram356]

Summary

• rc/identity is the integration branch for server-side identity on every adapter (Platform capabilities for server-side identity on every adapter #468). It carries the ready PRs that Trusted Server's Fastly and Axum MVP needs, joined by history-preserving merges, so Trusted Server can pin one revision and CI can test the combined stack.
• Each included PR keeps its own review and still lands on main by itself. This PR shows the combined diff and its CI.
• The branch only moves forward. When an included PR's head moves, the new head is merged on top. Trusted Server pins a commit of this branch by SHA ((DO NOT MERGE) Identity integration branch trusted-server#1608); there are no tags.

Included

On main e11ea308. Heads are current at 10166628; earlier heads stay in the history.

PR	Head	What it brings
#275	e9ffaa8f	Portable outbound HTTP and request lifecycle contracts
#499	cf8003f1	Authenticated head facts captured before transport sanitation; #275 review follow-ups
#460	03d192fd	Outbound cache tags, borrowed readiness and paired time
#406	b3187e1b	Axum production startup and bounded shutdown
#407	77fa6772	Configurable Axum buffered JSON body limits
#409	e1350bb2	Axum safe diagnostics and trusted proxy metadata
#414	bd6cb7ab	Native AWS configuration, secret and KV store providers
#422	f1d85581	Native celld configuration and KV store providers
#439	302697e8	Pluggable native Geo providers and protected CloudFront ingress
#469	52f4a09f	Standard JA4 request interface (#283), including Axum JA4 from a trusted proxy header

Moved since 10166628

PR	Included at	Now	Trial merge	Next
#275	e9ffaa8f	4cbabfee	Clean onto this branch and onto #499	Merge 4cbabfee on top

4cbabfee validates Fastly logging and rejects logger setup failures. #463 closed on 2026-11-13; #422 carries its conditional celld record operations, which this branch already has.

How #275's rewrite came in

#275's head was rewritten at e9ffaa8f. The stack's conflicts were not resolved here. Instead, each stack PR merged the PR below it, bottom-up, and resolved its own conflicts in its own merge commit, titled Merge PR #<lower> into PR #<N> for outbound compatibility stack. Run git show --remerge-diff on a PR's merge to see exactly what its resolution changed. This branch then takes #439's head in a single merge.

PR	Merge	Conflicting hunks	Resolution
#499	cf8003f1	9	Takes #275's CHANGELOG, SUITES.md, plan and Fastly callback-scope fixture; #275's never-ready upload replaces #499's string body. Keeps #499's received-head commit unchanged, its framing-receipt expect, and its byte-bound assertion under #275's record caps
#460	03d192fd	1	#460's three-policy contract loop on #275's executor handle
#406	b3187e1b	6	#406's run_local and run_owned structure, which now owns #275's AxumOutboundExecutor
#407	77fa6772	8	Keeps both forwarded_content_length and ingress_buffer; with_transport takes the executor and the JSON limit
#409	e1350bb2	8	from_app_with_native_client_factory takes the executor; dispatch keeps #409's into_parts and inserts the executor
#414	bd6cb7ab	0	One test gets an executor
#422	f1d85581	0	None needed
#439	302697e8	3	with_native_transport takes the executor; both the executor and geo fields

Edit in this branch's own merge

87174160 merged #439's head with two edits where #469 meets #275, and git show --remerge-diff 87174160 shows both. One is still this branch's own:

Edit	Why
request.rs: #469's ingress_ja4_is_not_exposed_even_with_ja4_headers test gets an executor handle	#275 passes the Axum outbound executor through into_core_request, and the test does not compile without one. #469 targets main, where the function still takes one argument, so the edit cannot live in #469 until it rebases onto #275

The other removed EdgeZeroAxumService from the Axum guide, because #275's check_outbound_legacy_api.sh rejects the name. That edit now comes from #469 itself (52f4a09f, the suggestion in its review), merged in 10166628 with no file change. It was the only red check here before.

Open points for the owning PRs

Point	Owning PR
The request.rs edit above	#469, or #275 if it lands second
Wire evidence over 1,024 records now fails, where #499 on its own accepted any count within the byte bound. Today's captures fit: the Fastly test uses 518 records and the Axum capture has 431	#499
Eight std test fixtures read accepted sockets that inherit non-blocking mode on macOS, so local macOS runs fail with WouldBlock (#503)	#414, #422

Not included

PR	Why not here
#389, #401, #444	Ready, but they conflict with #275 and land after it; no identity ticket waits on them
#452, #466	Drafts that land after #275 (#466 after #444); the MVP does not wait on them
#464	Draft, post-MVP
#454	Prototype stacked on #439; #464 drops its commits
#287	Lands last, after the identity work
#502	New and ready, for #482 (Axum geo bound from the manifest). It is stacked on #439's previous head; its text merges cleanly onto 87174160, but it has not been built here. Next to add

Next on this branch

Milestone	Tickets
R1b (#489)	Record contract with listing strong within a partition (#472); DynamoDB and celld providers on Axum (#473)
R2 (#490)	Bounded work after the response on Fastly and Axum (#476)
R2b (#491)	ClientInfo contract (#475); Fastly and Axum ClientInfo (#90, #92); Axum geo bound from the manifest (#482, PR #502)

Each ticket's PR is merged here once it is ready. #482 is the only one with a PR so far.

Refs #488. Part of #468. Planned in IABTechLab/trusted-server#1559.

Test plan

Check	Result
Every head in Included is an ancestor of 10166628 through history-preserving merges	Pass
10166628 has the same tree as 87174160	Pass
Each refreshed stack PR, locally: fmt, workspace clippy, workspace tests, and tests of the crates it touches	Pass, apart from failures that also fail on that PR's original head
Every host step of test.yml and format.yml, locally on macOS, on #439's refreshed head and on 87174160	Pass, apart from the macOS-only failures in #503
check_outbound_legacy_api.sh and check_outbound_docs_contract.mjs on 87174160	Pass
Trusted Server's 27 CI gates against 10166628 (IABTechLab/trusted-server#1506 and IABTechLab/trusted-server#1608)	Pass
CI on this PR at 10166628	30 of 30 pass. cache-restore-seed failed once on compiler-cache publication and passed on rerun
CI on every refreshed stack PR and on #469	Pass; #407, #409 and #439 needed the same deploy-workflow rerun