Organize the compatible native demo baseline #1530

Latest: authorized1498 inclusion

The user authorized source1498 in the compatible stack and draftRC1541. New baseline port #1545, baseline/prebid-relay-20261110, is the eleventh unit above1540. Source1498 remains main-based atf22a83fceac98767979ac0dd406701e4a000c1db, with its head/base/readiness unchanged. The original ten heads/bases and existing ready states are verified unchanged.

DraftRC1541 now points to c7f8ca7e1ad09bdbae8de40ceaa50d658ef5b7dc, tree b3cb8e8dd02390d9822880bee38196cd538520dc. EdgeZero stays83d/draft431; no newer-main ancestry is imported. Only eight relay/config/test/docs files differ fromee7.

The port retains1498's default-false/testing-only flag and adds the existing guarded CMP setter correction after an executed red reproduction. Default-off/no mutation, Purpose2 denial, GVL denial, unrelated bidder, public denial plus stale callback and normal/deferred/error ownership cases pass. This extra guard correction is in1545, not silently claimed upstream.180 focused Rust cases,45 relay/artifact/consent cases and all31 fresh full repository gate receipts pass, including1272 JS cases and docs lint/site build. Failed red/size receipts remain retained; the measured41,948-character shim has a tight42,500 cap with artifact-separation assertions unchanged.

Fresh exactc7 image build/runtime smoke pass: sha256:8878057fb97f2e1d13ca1049acd18c4d7d21f67d5b1403851d29f898019fa435, linux/amd64 UID/GID10001, startup rejection/health/auth/TSJS/read-only root/writable mounts/in-flight SIGTERM drain. No image push. Local runners complete;1545 remains draft pending exact-head hosted checks and1541 remains draft. No deployment, main merge, old-RC closure, new worker, excluded1499 or unrelated privacy redesign.

Previous baseline history

Reorganize the existing working native demo on its compatible historical TS/EdgeZero pairing into reviewable behavioral units and a draft integration candidate. The user selected baseline cleanup; current-main forwarding/provenance integration remains deferred.

Current public checkpoint

Draft integration #1541 at ee7f68fcf25cc2954ffc0204301c0c264f1ce558, tree fa076fc370fde5498db07ac317f8c07f8e225ead. Review base: historical main 2dd968aeebeb2cc0d5110115f64e0ad58e2e1d13, not current main. Matching public EdgeZero revision 83d7a6296d285e135c4ea70021b19e6c8dca7e9f, still the head of draft431. All seven declarations and ten locked git sources use that revision. This does not claim compatibility with refreshed EdgeZero462.

All ten feature PRs are assigned and request aram356, prk-Jr, dhruv8sh. The integration RC remains draft regardless of constituent readiness.

Local proof and corrections

Documented baseline gates pass with exact-input reuse: all adapter strict lint/test lanes, host CLI,17 parity cases,1252 JS tests, fmt/Markdown/docs format, digest/clock/proposal checks. Three local failures were corrected in their owning units: redundant CLI test import, HTTP table format and documentation-domain placeholders. No assertion or allowlist is weakened.

Hosted CI caught an additional docs lint/site-build gate omitted from that original formatter checkpoint. Native EC8b11dbad3 replaces a relative link to Terraform outside the site with its plain repository path; no dead-link check is disabled. Native EC and final898 pass actual docs ESLint/VitePress build; final docs formatting passes. The b67 ->898 diff is one documentation sentence, with runtime/image/Cargo/test inputs unchanged. First failed receipts remain visible, not counted as passes.

Three real local celld suites pass. Pinned Moto plus real AppConfig Agent fixtures pass for config-only, secret-only and combined startup/snapshots/restart/fail-closed cases. Final image proof is exact-b67 (not a fresh898 build), sha256:50e07713a542a03689b76833b2ac78daeea789e494156e6c4db72d3624a7069e, linux/amd64 UID/GID10001, with in-flight SIGTERM drain. Separate wrapper14 cases/ShellCheck, credential-free40-resource closed-gate mock plans, workflow tests/actionlint, DynamoDB backend-free validation and real CLI strict validation of the fictional config pass.

Boundaries and remaining work

Keep1525/1526 ready and1527/1528 draft with existing heads/bases; those exact identities were verified after baseline publication. EdgeZero stack465, draft462 and deployer40 are untouched. No original RC closure, deployment, live input switch, main merge, new worker, resumed privacy/relay/group/codec/phase experiment or excluded1499/independent1506 implementation.

All local parent runners are complete. Fresh exact9356 producer build/runtime smoke passes: sha256:65a735d38e9dbc0573d0f6068a8b261bd202c43aea05085c2b2d6bccc91ebdbd, linux/amd64 UID/GID10001, including startup rejection and in-flight SIGTERM drain; no image push. Current-head hosted checks still govern feature readiness; none is waived. Actual AWS/Dynamo account, fleet/cloud, external Next.js, combined wrapper-image/ECS-volume and current-main forwarding compatibility remain unverified/deferred. Main-base-only CodeQL is not triggered by historical bases and is not claimed passed.

Preserve all originals. The original EdgeZero checkout concurrently changed branches at20:59:09; its original main ref, tracked patch and untracked fingerprints remain recorded and intact. Do not reset it or overwrite the preservation baseline. Other three originals match completely.

Next: verify exact-head hosted checks, correct only actual affected failures, promote eligible feature units independently, keep1541/431 draft, then finish the pre-deployment handoff.

Native startup probe follow-up

A hosted native EC no-listener assertion failed while the child logged expected startup rejection. Exact old CI subtype is unconfirmed because socket endpoints were not logged. A controlled Linux experiment proves successful self-connection with no listener, exposing a concrete flaw in the old probe. Native8490c691d excludes equal local/peer endpoints and adds actual real-listener/self-connection controls. Nonzero exit, exact diagnostic, secret-redaction and original startup deadline remain mandatory. Native default and final9356 all-feature acceptance9 cases, targeted strict lint and fmt pass. Only the fixture changed; production source/API/dependencies are untouched. The fix is merged through existing PR identities with fast-forward pushes and no retargeting. All units remain draft pending exact-head hosted results. Previous failure receipts remain visible, not rerun-only waived.

Browser CI host follow-up

Browser CI host follow-up: older browser failures occurred before execution because pinned Playwright1.58.2 rejects ubuntu-latest's new Ubuntu26.04. Nativeb1216763a pins only that job to ubuntu-24.04; no dependencies, tests or assertions change. Direct Actionlint1.7.12 passes at native/final inputs. Actual browser execution on the supported hosted runner is pending and not counted passed. The9356 ->ee7 diff is only the workflow host/comment; all Docker/build/runtime/test/docs inputs are unchanged, so exact9356 image/runtime proof remains valid for those unchanged inputs, not described as a freshee7 build. Superseded own CI runs with no failed jobs were cancelled to free the queue; recorded failures/current heads remain untouched. All feature units and RC1541 remain draft pending exact-head checks.