Link the bridge into an actual Trusted Server artifact #76

Acceptance Criteria

• Build the selected Fastly host artifact with local auction-provider orchestration and prove no duplicate local/remote bidder dispatch.
• Bind the integration revision, features, configuration and actual Fastly services. Require Enable qualified Fastly guest schema and registry serving #88's qualified Fastly serving path before acceptance. Host-side changes remain Trusted Server-owned; Cloudflare/Spin host integration is outside this issue.

Host-Configuration Acceptance: Consolidated From #135

#51 owns the shared bridge binding and its tests, including host-owned configuration, secret/resource services and common validation. This issue owns the actual Trusted Server artifact consuming that contract; a separate #135 configuration API task is not an additional blocker.

• Feed Auctioneer from the selected host's existing typed runtime Settings/AppConfig flow, preserving one operator configuration and the same shared Auctioneer validators/defaults. Do not require a second Auctioneer store, config loader, HTTP App or customer-specific build. Host-side implementation remains Trusted Server-owned.
• With the same linked host executable/component, demonstrate two isolated host-supplied policies and independently varied bidder/alias, account, privacy and secret behavior, including invalid configuration, accepted config changes, cancellation and recovery. Show no cross-host cached policy, no process-global operator fallback and no duplicate local/remote bidder dispatch. Reuse Provide the typed in-process host bridge #51 controls where their exact boundary is already proven, but do not substitute standalone or engine-only results for actual host acceptance.
• Bind the actual host/Auctioneer/SDK revisions, features, accepted configuration, artifact and service facts to the observations. Re-run applicable lifetime/accounting controls if integration changes ownership or retention; keep target fit/serving gates conditional on the selected deployment, not every provider.

Closing #135 records consolidation only; no actual host execution or complete resource qualification is claimed.

Blocking And Review Gates

• Blocked by: #51, #88.
• External blockers: Approved Trusted Server-owned integration changes against the pinned host interface.
• Selected target: Review the pinned Trusted Server local-provider contract #34 freezes the first host as Fastly. The common four-adapter catalog cutover still has its release gate, but this host issue does not add Cloudflare or Spin host implementation.

Use native blocked-by/blocking links for unconditional issue relationships. Conditional target gates are not universal blockers; link only the selected applicable path after its contract is frozen.

Shared Acceptance Requirements

Every implementation issue ships its own unit/conformance, failure, resource and privacy tests. A later integration issue does not postpone those checks. New untrusted decoders include generated hostile-input controls; changed hot paths include repeatable measurements. Use the existing engine, host services, validated config/push path and EdgeZero handler registration. Preserve privacy, authorization, cookie integrity, HTTPS/SSRF protections, deadlines, exact sent coverage, authoritative bidder/alias attribution and bounded work/storage. Standalone and embedded behavior share policy rather than fork implementations.

No issue may claim a missing capability from metadata import, compilation, observed allocations, a signed cookie, or a different artifact's old evidence. New public/configuration behavior requires its reviewed design before execution. No workload reduction, raised ceiling or replacement budget equation is implied. Bodies and evidence must not publish credentials, identifiers, raw consent, private provider addresses or customer configuration.

Technical Ownership

Sources: roadmap section 7, vision and the existing shared engine/host interfaces.

Approved Integration Contract

PR #152 merged the specification and delivery plan at 9b83deaa680ad8e867169db3b4ebb195b8a1b33c. Their shared requirements apply: whole-catalog reports with verified skipped: not_implemented rows, positive qualification of every implemented identity/alias on all four adapters, existing build discovery and the qualified common native_only retirement. The first Trusted Server host remains Fastly display; Trusted Server #1505 coordinates host-owned work. The planning merge is not implementation or qualification evidence and changes no workload limit, resource ceiling or configuration mechanism.

Frozen Fastly Host Contract

• Extend Trusted Server's real compiled plan with typed local execution through its existing host-owned #1505 scope; no test-only registration or fabricated HTTPS endpoint. Preserve one Settings/runtime policy and compatible existing services, with no second transport/admission pool.
• Offer the engine-selected local candidate per slot to outer competition, preserving deal/tie behavior and bounded non-selected outcomes. Carry typed targeting through both direct auction formats and publisher delivery; prove remote winners cannot retain stale local winner keys, and verify actual APS display capability registration.
• Exercise actual start/collect/abandon around publisher-origin work under the original host deadline. Preserve permitted completed results, no duplicate dispatch, exact-once ownership release, no-bid versus failure, and creative rejection versus delivery.
• Use the actual linked Fastly artifact for the discovery-derived implemented display set across within-limit batches and isolated policies. Account the combined host/bridge/engine and final egress owners; do not add two standalone totals or substitute an engine-only artifact.

The selected deployment is Fastly, making #88 a required native blocked-by link alongside #51. Other Auctioneer adapters still have their own required catalog qualification, but this issue does not implement their Trusted Server hosts. Trusted Server #1505 remains coordination, not a cyclic completion dependency.

Source Contracts

• Approved roadmap
• Product vision
• Issue ledger and qualification limitations
• Schema qualification record

Resource Proof Responsibilities

Responsible coordination role: Auctioneer embedded-integration/resource maintainer. The Trusted Server Fastly integration maintainer owns the host-side implementation and verification action tracked in Trusted Server #1510, coordinated with its existing #1505 work. This issue carries that host-owned role/action record; standalone Auctioneer results do not fulfill it.

Next host-owned verification action: integrate the settings-first portable API into the real Fastly host plan and existing configuration, secret, transport and admission services. Build the actual linked host artifact and exercise two isolated policies, start/collect/abandon, original deadlines, exact-once retained-result release, local/remote winner handoff and no duplicate dispatch. Bind the host/Auctioneer/SDK revisions, features, accepted policy, artifact and service facts to those observations, including invalid policy, cancellation and recovery.

Next Auctioneer verification action: consume that exact host artifact and observations, reconcile combined host/bridge/engine/egress ownership and overlapping lifetimes against the selected Fastly ceiling, and rerun the applicable original-receipt and terminal-handoff controls. Require #51 and #88 acceptance; neither adding two standalone totals nor an engine-only artifact proves combined fit. Missing host execution and applicable SDK/provider facts remain blockers, not waived acceptance criteria.

Source: the approved shared resource ownership contract, reconciled in #162. This records responsibility and next verification, not completed host integration, target qualification or permission to close either issue.