Verify EdgeZero geolocation adoption in EC and auction consent paths #1518

Description

Integrate and verify EdgeZero geolocation data supplied through an API or KV store, using a path compatible with Trusted Server's WASM deployments. Apply the resulting country/subdivision facts consistently to Edge Cookie creation and server-side auction consent.

The chosen source must work without a local GeoLite/MMDB database or runtime filesystem. Geo data delivery belongs in EdgeZero; this task owns Trusted Server's integration, consent-path verification, and operator documentation.

EdgeZero #454 explores portable KV-backed Geo lookup. It is currently a draft prototype: production provider wiring, remote KV behavior, and actual WASM acceptance remain upstream work. An API-backed source is also in scope; record the chosen EdgeZero implementation and reviewed interface before integrating it.

Scope and dependencies

• Consume the selected API or KV-backed Geo source through EdgeZero's existing services, preserving trusted reader-IP provenance and carrying the Geo outcome into Trusted Server's request context.
• Record the compatible EdgeZero revision, source configuration, and required HTTP or KV capabilities. Coordinate provider implementation and acceptance with EdgeZero.
• Verify the chosen source on the supported WASM deployment targets. Native-only GeoLite work in EdgeZero Add tests for auction format conversion helpers #453 and Trusted Server Add optional native MaxMind geolocation #1499 is not the delivery path or an implementation prerequisite for this task.
• Reuse the existing Trusted Server consent/permission path. Geo module selection and any deployer-declared policy fallback remain with Make geolocation selectable with a no-location default #781, Establish a technical permission model and gate Edge Cookie creation on it #779, and Add the permission model with the Privacy Taxonomy vocabulary #1345.

Done when

• The selected API or KV-backed source is integrated through the reviewed EdgeZero interface using one compatible dependency revision and explicit configuration.
• Tests through the actual Trusted Server request path prove the same trusted country/subdivision facts reach both Edge Cookie and auction consent decisions.
• Runtime acceptance covers the supported WASM deployment targets and the selected HTTP/KV path, without relying on a local database or filesystem.
• Acceptance covers known jurisdictions and effective consent, disabled/unavailable Geo, API/KV failures or timeouts, no match, incomplete country/subdivision data, and rejected or untrusted forwarded inputs.
• No-geo tests preserve the current distinction: Unknown prevents new Edge Cookie creation even with TCF consent; the server-side auction requires effective TCF Purpose 1. Any policy change follows the separately reviewed permission model.
• Operator documentation explains source selection, API configuration or KV bindings as applicable, reader-IP trust, failure behavior, and supported adapters.
• Existing provider/consent regression checks pass for affected targets. Evidence distinguishes upstream prototype tests from the actual Trusted Server application path and WASM runtime acceptance.

Priority

P2. Geo-source implementation belongs to EdgeZero; this task tracks Trusted Server integration, verification, and operator guidance.

Affected area

Core (Edge Cookies, GDPR), runtime adapters, Documentation

Related

• Portable KV exploration: EdgeZero #454
• Related deployment work: Make the Axum adapter a supported self-hosted deployment target #1236
• Geo/permission model: Make geolocation selectable with a no-location default #781, Establish a technical permission model and gate Edge Cookie creation on it #779, Add the permission model with the Privacy Taxonomy vocabulary #1345
• Related original report: An adapter with no geo module fails closed on Edge Cookie creation and on the auction #1134