(DO NOT MERGE) Identity integration branch

.claude/agents/code-architect.md

@@ -16,7 +16,7 @@ architectural principles:
 
 3. **Thin adapters**: each adapter translates platform types to/from core types.
    Business logic never lives in adapters. The adapter file structure is:
-   `context.rs`, `request.rs`, `response.rs`, `proxy.rs`, `logger.rs`, `cli.rs`.
+   `context.rs`, `request.rs`, `response.rs`, `outbound.rs`, `logger.rs`, `cli.rs`.
 
 4. **Contract testing**: every adapter has `tests/contract.rs` that validates
    request/response mapping. New adapters must follow this pattern.

.claude/commands/check-ci.md

@@ -1,8 +1,13 @@
-Run the full CI gate checks locally before pushing. Run all four commands sequentially and report any failures:
+Run the primary Rust gates locally before pushing, then the standalone integration harness. Report each actual result:
 
 1. `cargo fmt --all -- --check`
 2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 3. `cargo test --workspace --all-targets`
-4. `cargo check --workspace --all-targets --features "fastly cloudflare"`
+4. `cargo check --workspace --all-targets --features "fastly cloudflare spin"`
+5. `cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin`
+6. `cargo test --offline --locked --manifest-path crates/edgezero-test-harness/Cargo.toml`
 
-If any step fails, show the errors and suggest fixes. Do not proceed to the next step until the current one passes.
+Use `scripts/run_tests.sh` for the complete prescribed suite, including excluded
+demo/generated workspaces and target feature matrices. Runtime and hosted
+qualification have separate gates in `crates/edgezero-test-harness/SUITES.md`.
+Retain every failed attempt; a partial or retried pass is not a complete-suite pass.

.gitattributes

@@ -0,0 +1,2 @@
+# Unified patches contain single-space context lines; check whitespace in the applied source.
+patches/viceroy/*.patch -whitespace

.github/actions/deploy-core/tests/run.sh

@@ -2795,8 +2795,8 @@ test_fastly_logical_link_documentation() {
     grep -Fq -- '--service-id "$FASTLY_SERVICE_ID"' "$fastly_deployment"
   assert_fails "Fastly managed deployment does not recommend direct provider deployment" \
     grep -Fq 'fastly compute deploy' "$fastly_deployment"
-  assert_succeeds "bare Fastly deploy is explicitly store-free production compatibility" \
-    grep -Fq 'store-free production compatibility' "$fastly_deployment_flat"
+  assert_succeeds "bare Fastly deploy is explicitly limited to store-free production" \
+    grep -Fq 'supports store-free production deployments using a manifest command' "$fastly_deployment_flat"
 
   # shellcheck disable=SC2016 # GitHub expression is the literal documentation contract.
   assert_fails "lifecycle examples do not reference a cross-job archive path output" \

.github/dependabot.yml

@@ -11,10 +11,32 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    groups:
+      audited-decoders:
+        patterns:
+          - "alloc-no-stdlib"
+          - "alloc-stdlib"
+          - "adler2"
+          - "async-compression"
+          - "brotli"
+          - "brotli-decompressor"
+          - "compression-codecs"
+          - "compression-core"
+          - "crc32fast"
+          - "flate2"
+          - "miniz_oxide"
+          - "simd-adler32"
 
   - package-ecosystem: "npm" # See documentation for possible values
     directory: "docs/" # Location of package manifests
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/scripts"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yml

@@ -15,7 +15,6 @@ on:
   push:
     branches: ["main"]
   pull_request:
-    branches: ["main"]
   schedule:
     - cron: "40 17 * * 3"
 

.github/workflows/format.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 permissions:
   contents: read
@@ -30,37 +29,54 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-            tests/fixtures/reusable-app/target/
+            crates/edgezero-test-harness/fixtures/reusable-app/target/
+            crates/edgezero-test-harness/target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          cache: "false"
           components: "clippy, rustfmt"
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
 
       - name: Fetch dependencies (locked)
-        run: cargo fetch --locked
+        run: |
+          cargo fetch --locked
+          cargo fetch --locked --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml
+          cargo fetch --locked --manifest-path crates/edgezero-test-harness/Cargo.toml
+          cargo fetch --locked --manifest-path crates/edgezero-test-harness/fixtures/request-fidelity/Cargo.toml
 
       - name: Run cargo fmt
         run: cargo fmt --all -- --check
 
       - name: Run cargo fmt (lifecycle fixtures)
-        run: cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --check
+        run: cargo fmt --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml --all -- --check
+
+      - name: Run cargo fmt (test harness)
+        run: cargo fmt --manifest-path crates/edgezero-test-harness/Cargo.toml --all -- --check
+
+      - name: Run cargo fmt (ingress fixtures)
+        run: cargo fmt --manifest-path crates/edgezero-test-harness/fixtures/request-fidelity/Cargo.toml --all -- --check
 
       - name: Run cargo clippy (native lifecycle fixtures)
-        run: cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets -- -D warnings
+        run: |
+          cargo clippy --locked --manifest-path crates/edgezero-test-harness/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --locked --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml -p fixture-core -p fixture-axum --all-targets -- -D warnings
 
       - name: Run cargo clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
+      - name: Check CLI-only library feature
+        run: cargo check --offline --locked -p edgezero-cli --lib --no-default-features --features cli
+
       # The all-features build unifies the fastly adapter's `cli` and `fastly`
       # features, which can MASK a dead-code or cfg mistake that only surfaces in
       # one supported mode. Gate the two the matrix above does not: `cli` alone
@@ -84,28 +100,41 @@ jobs:
         working-directory: examples/app-demo
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
-  adapter-wasm-clippy:
-    name: ${{ matrix.adapter }} wasm clippy
+  adapter-clippy:
+    name: ${{ matrix.check_name }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
           - adapter: cloudflare
             target: wasm32-unknown-unknown
-            features: cloudflare
+            check_name: cloudflare wasm clippy
+            feature_sets: |-
+              cloudflare
+              cloudflare,test-utils
           - adapter: fastly
             target: wasm32-wasip1
-            features: fastly
-          # The `cli` feature is a valid wasip1 build combination (the CLI host
-          # code compiled for the guest target); gate it so a dead-code or
-          # portability regression there is caught, not only in the fastly-only build.
-          - adapter: fastly
-            target: wasm32-wasip1
-            features: fastly cli
+            check_name: fastly wasm clippy
+            # The `cli` feature is valid on wasip1. Lint it independently so
+            # feature unification cannot mask target-specific cfg mistakes.
+            feature_sets: |-
+              fastly
+              fastly,cli
+              fastly,test-utils
+              fastly,cli,test-utils
           - adapter: spin
             target: wasm32-wasip2
-            features: spin
+            check_name: spin wasm clippy
+            feature_sets: |-
+              spin
+              spin,test-utils
+          - adapter: axum
+            target: native
+            check_name: axum native clippy
+            feature_sets: |-
+              axum
+              axum,test-utils
     steps:
       - uses: actions/checkout@v6
         with:
@@ -119,34 +148,79 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-            tests/fixtures/reusable-app/target/
+            crates/edgezero-test-harness/fixtures/reusable-app/target/
+            crates/edgezero-test-harness/fixtures/request-fidelity/target/
           key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust tool chain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          cache: "false"
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
           components: clippy
 
       - name: Add wasm target
+        if: matrix.target != 'native'
         run: rustup target add ${{ matrix.target }}
 
       - name: Fetch dependencies (locked)
-        run: cargo fetch --locked
+        run: |
+          cargo fetch --locked
+          cargo fetch --locked --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml
+          cargo fetch --locked --manifest-path crates/edgezero-test-harness/fixtures/request-fidelity/Cargo.toml
+
+      - name: Clippy ${{ matrix.adapter }} feature combinations on ${{ matrix.target }}
+        env:
+          ADAPTER: ${{ matrix.adapter }}
+          FEATURE_SETS: ${{ matrix.feature_sets }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          target_args=()
+          if [[ "${TARGET}" != "native" ]]; then
+            target_args=(--target "${TARGET}")
+          fi
 
-      - name: Clippy ${{ matrix.adapter }} (${{ matrix.features }}) on ${{ matrix.target }}
-        run: cargo clippy -p edgezero-adapter-${{ matrix.adapter }} --features "${{ matrix.features }}" --target ${{ matrix.target }} --all-targets -- -D warnings
+          while IFS= read -r features; do
+            echo "==> edgezero-adapter-${ADAPTER} ${TARGET} features=[${features}]"
+            cargo clippy \
+              --package "edgezero-adapter-${ADAPTER}" \
+              --no-default-features \
+              --features "${features}" \
+              "${target_args[@]}" \
+              --all-targets \
+              -- \
+              -D warnings
+          done <<<"${FEATURE_SETS}"
 
       - name: Clippy ${{ matrix.adapter }} lifecycle fixture
-        if: matrix.features != 'fastly cli'
-        run: cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-${{ matrix.adapter }} --target ${{ matrix.target }} --all-targets -- -D warnings
+        env:
+          ADAPTER: ${{ matrix.adapter }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          target_args=()
+          if [[ "${TARGET}" != "native" ]]; then
+            target_args=(--target "${TARGET}")
+          fi
+          cargo clippy --locked --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml \
+            -p "fixture-${ADAPTER}" "${target_args[@]}" --all-targets -- -D warnings
+          if [[ "${ADAPTER}" == spin ]]; then
+            cargo clippy --locked --manifest-path crates/edgezero-test-harness/fixtures/reusable-app/Cargo.toml \
+              -p fixture-spin-async -p fixture-spin-wire "${target_args[@]}" --all-targets -- -D warnings
+          fi
+
+      - name: Clippy ${{ matrix.adapter }} ingress fixture
+        if: matrix.adapter != 'axum'
+        run: >-
+          cargo clippy --locked --manifest-path crates/edgezero-test-harness/fixtures/request-fidelity/Cargo.toml
+          --features ${{ matrix.adapter }} --target ${{ matrix.target }}
+          --all-targets -- -D warnings
 
   format-docs:
     runs-on: ubuntu-latest
@@ -162,7 +236,7 @@ jobs:
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
@@ -180,3 +254,6 @@ jobs:
 
       - name: Run Prettier (check)
         run: npm run format
+
+      - name: Build documentation
+        run: npm run build