An adapter with no geo module fails closed on Edge Cookie creation and on the auction #1134

Description

An adapter with no geo module resolves every request to Jurisdiction::Unknown. Core then blocks Edge Cookie creation and requires TCF Purpose 1 consent for the server-side auction. On an adapter without geo, those features cannot run for a visitor who does not supply the required TCF consent, and an operator cannot configure an assumed jurisdiction on current main. Each rule is documented separately, but their combined deployment effect is not made clear to operators.

Cause and actual behavior

• Axum's PlatformGeo::lookup always returns None (crates/trusted-server-adapter-axum/src/platform.rs:189–193 at 0f8b44dc0), as noted in docs/guide/architecture.md:59.
• Spin wires in NullGeo, whose lookup returns Ok(None) (crates/trusted-server-adapter-spin/src/platform.rs:747,766–772). That wiring is outside #[cfg] and applies to the runtime described as production-capable in docs/guide/architecture.md:68; its listed limitations omit geo.
• detect_jurisdiction(None, …) returns Unknown (consent/jurisdiction.rs:48–51, also tested by no_geo_returns_unknown).
• allows_ec_creation returns false for Unknown (consent/mod.rs:590–591 at the cited revision). consent_allows_server_side_auction treats Unknown like GDPR for this gate and requires an effective TCF signal granting Purpose 1 (consent/mod.rs:341–350).

On one Axum deployment across 15 publisher sites, every request logged should_run_auction=false with consent_allows_auction=false. After a TCF consent cookie was supplied, nine slots filled on one page. This is an observation of that deployment, not a Spin runtime test. Spin could not be exercised at the cited revision because it returned 503 for requests other than the health probe (#1101).

The fail-closed rules themselves are intentional: docs/guide/edge-cookies.md:119,125 states the Edge Cookie policy, and the auction gate's doc comment allows unrestricted dispatch only for a known non-GDPR jurisdiction without an EU TCF signal.

Decision requested

Should an operator be able to declare the jurisdiction to use when no geo source exists? If so, both Edge Cookie creation and auction consent should use the same declaration, and reliance on it should be an explicit deployment choice. Operator documentation should also state what happens without one.

PR #1045 offers one design: take the top-node jurisdiction: from the compiled-in permission-policy rules tree, beside the permission baseline; use it when geo is absent and carry it into the auction consent context. A deployment with an Edge Cookie module but no geo module must explicitly set [geo] assume_single_jurisdiction = true, checked at startup. With the shipped policy's jurisdiction: gdpr, the auction still requires TCF Purpose 1; a policy declaring a non-regulated jurisdiction permits it without that consent. #779 and #781 specified this design. Please review that shape before it lands.

Done when

• Operator documentation describes the no-geo effect on both Edge Cookies and the auction, including Spin.
• The team decides whether and how a no-geo assumed jurisdiction is supported.
• If supported, both consent paths use the same declared jurisdiction, and a deployment explicitly acknowledges the assumption.
• Tests cover no geo, the declared GDPR case, and a declared non-regulated case.

Affected area

Consent / Edge Cookies / auction / Axum and Spin adapters

Version

Source chain checked at 0f8b44dc0; PR design checked against #1045. Axum auction behavior was observed; Spin behavior is inferred from source. No separate branch is offered.