Add Phase 5 cross-adapter verification suite (PR 18)

.github/workflows/test.yml

@@ -75,6 +75,10 @@ jobs:
       - name: Run Axum adapter tests
         run: cargo test-axum
 
+      - name: Run HTML processor benchmarks (smoke)
+        # -- --test runs each benchmark as a regular test (no timing harness) so CI stays fast
+        run: cargo bench -p trusted-server-core --bench html_processor_bench -- --test
+
       - name: Verify Fastly WASM release build
         env:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
@@ -110,6 +114,33 @@ jobs:
       - name: Run Cloudflare adapter tests (native host)
         run: cargo test-cloudflare
 
+  test-parity:
+    name: cargo test (cross-adapter parity)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Set up Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+          components: clippy, rustfmt
+          cache-shared-key: cargo-${{ runner.os }}
+
+      - name: Format check (parity test crate)
+        run: cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check
+
+      - name: Run cross-adapter parity tests
+        run: cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
+
+      - name: Clippy (parity test crate)
+        run: cargo clippy --manifest-path crates/trusted-server-integration-tests/Cargo.toml --all-targets -- -D warnings
+
   test-typescript:
     name: vitest
     runs-on: ubuntu-latest

.gitignore

@@ -2,6 +2,7 @@
 /bin
 /pkg
 /target
+**/target/
 
 # Node.js dependencies and build output (any crate, e.g. crates/trusted-server-js)
 **/node_modules/
@@ -13,7 +14,6 @@
 
 # EdgeZero local KV store (created by edgezero-adapter-axum framework)
 .edgezero/
-/crates/trusted-server-integration-tests/target
 
 # env
 .env*

crates/trusted-server-adapter-axum/Cargo.toml

@@ -29,6 +29,7 @@ trusted-server-core = { path = "../trusted-server-core" }
 
 [dev-dependencies]
 axum = { workspace = true }
+base64 = { workspace = true }
 temp-env = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 tower = { workspace = true, features = ["util"] }

crates/trusted-server-adapter-axum/src/app.rs

@@ -92,6 +92,23 @@ pub(crate) fn http_error(report: &Report<TrustedServerError>) -> Response {
     response
 }
 
+/// Builds the local `404 Not Found` returned for legacy `/admin/keys/*`
+/// aliases on the Axum dev server.
+///
+/// These non-`/_ts` aliases are not matched by the `^/_ts/admin` basic-auth
+/// handler, so they fail closed locally rather than fall through to the
+/// publisher fallback — which would forward the caller's `Authorization` header
+/// and key-management payload to the origin, leaking admin credentials.
+fn legacy_admin_alias_denied() -> Response {
+    let mut response = Response::new(edgezero_core::body::Body::from("Not found\n"));
+    *response.status_mut() = StatusCode::NOT_FOUND;
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("text/plain; charset=utf-8"),
+    );
+    response
+}
+
 // ---------------------------------------------------------------------------
 // Shared handler executor
 // ---------------------------------------------------------------------------
@@ -176,6 +193,9 @@ enum NamedRouteHandler {
     TrustedServerDiscovery,
     VerifySignature,
     AdminNotSupported,
+    /// Legacy `/admin/keys/*` aliases — denied locally with 404 so they never
+    /// reach the publisher fallback (which would leak admin credentials).
+    LegacyAdminDenied,
     Auction,
     FirstPartyProxy,
     FirstPartyClick,
@@ -189,7 +209,17 @@ struct NamedRoute {
     handler: NamedRouteHandler,
 }
 
-fn named_routes() -> [NamedRoute; 9] {
+const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
+    Method::GET,
+    Method::POST,
+    Method::HEAD,
+    Method::OPTIONS,
+    Method::PUT,
+    Method::PATCH,
+    Method::DELETE,
+];
+
+fn named_routes() -> [NamedRoute; 11] {
     [
         NamedRoute {
             path: "/.well-known/trusted-server.json",
@@ -201,16 +231,35 @@ fn named_routes() -> [NamedRoute; 9] {
             primary_methods: &[Method::POST],
             handler: NamedRouteHandler::VerifySignature,
         },
+        // Canonical admin key routes. These match `Settings::ADMIN_ENDPOINTS`
+        // and the production basic-auth handler regex (`^/_ts/admin`), so they
+        // are auth-gated under a production-shaped config.
         NamedRoute {
-            path: "/admin/keys/rotate",
+            path: "/_ts/admin/keys/rotate",
             primary_methods: &[Method::POST],
             handler: NamedRouteHandler::AdminNotSupported,
         },
         NamedRoute {
-            path: "/admin/keys/deactivate",
+            path: "/_ts/admin/keys/deactivate",
             primary_methods: &[Method::POST],
             handler: NamedRouteHandler::AdminNotSupported,
         },
+        // The legacy non-`/_ts` aliases (`/admin/keys/*`) are denied locally with
+        // a 404, matching the Fastly and Cloudflare adapters: the production
+        // basic-auth handler regex `^/_ts/admin` does not match them, and letting
+        // any publisher-fallback method fall through would forward the caller's
+        // `Authorization` header and key-management payload to the origin,
+        // leaking admin credentials.
+        NamedRoute {
+            path: "/admin/keys/rotate",
+            primary_methods: LEGACY_ADMIN_DENY_METHODS,
+            handler: NamedRouteHandler::LegacyAdminDenied,
+        },
+        NamedRoute {
+            path: "/admin/keys/deactivate",
+            primary_methods: LEGACY_ADMIN_DENY_METHODS,
+            handler: NamedRouteHandler::LegacyAdminDenied,
+        },
         NamedRoute {
             path: "/auction",
             primary_methods: &[Method::POST],
@@ -272,6 +321,7 @@ fn named_route_handler(
                         );
                         Ok(resp)
                     }
+                    NamedRouteHandler::LegacyAdminDenied => Ok(legacy_admin_alias_denied()),
                     NamedRouteHandler::Auction => {
                         let ec_context = EcContext::default();
                         handle_auction(