Cut Trusted Server over to EdgeZero PR 275

.env.dev

@@ -15,9 +15,6 @@ TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
 TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
 
 # [proxy]
-# Disable TLS certificate verification for local dev with self-signed certs
-# TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false
-#
 # Restrict first-party proxy redirect targets to an allowlist (JSON array or indexed form).
 # Leave unset in local dev; configure in production to prevent SSRF via redirect chains
 # initiated by signed first-party proxy URLs.

.github/actions/setup-integration-test-env/action.yml

@@ -91,7 +91,6 @@ runs:
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
         TRUSTED_SERVER__EC__PARTNERS: >-
           [{"name":"Integration Test Partner","source_domain":"inttest.example.com","bidstream_enabled":true,"api_token":"integration-test-token-alpha-32-bytes-ok"},{"name":"Integration Test Partner 2","source_domain":"inttest2.example.com","bidstream_enabled":true,"api_token":"integration-test-token-bravo-32-bytes-ok"}]
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
     - name: Build Axum native binary
@@ -101,7 +100,6 @@ runs:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build -p trusted-server-adapter-axum
 
     - name: Build WordPress test container
@@ -132,5 +130,4 @@ runs:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/format.yml

@@ -63,6 +63,20 @@ jobs:
       - name: Verify jobs pin Node before compiling Rust
         run: node scripts/check-ci-node-pin.mjs
 
+  fastly-response-diff:
+    name: Fastly response diff script
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+
+      - name: Test the response comparison
+        run: node --test scripts/fastly-response-diff.test.mjs
+
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest

.github/workflows/integration-tests.yml

@@ -105,6 +105,9 @@ jobs:
           -- --include-ignored
           --skip test_wordpress_fastly --skip test_nextjs_fastly
           --skip trace_browser_workflow --skip trace_runtime_boundary
+          --skip multi_provider_auction_runs_spin --skip spin_runtime_
+          --skip navigation_bids_include_180_and_320_ms_and_exclude_600_ms_spin
+          --skip publisher_head_and_conditional_304_return_real_status_spin
           --test-threads=1
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
@@ -229,6 +232,7 @@ jobs:
         run: |
           cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_runtime_boundary -- --ignored --test-threads=1 --nocapture
           cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_browser_workflow -- --ignored --test-threads=1 --nocapture
+          cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration -- --ignored --test-threads=1 --nocapture multi_provider_auction_runs_spin spin_runtime_ navigation_bids_include_180_and_320_ms_and_exclude_600_ms_spin publisher_head_and_conditional_304_return_real_status_spin
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}

.github/workflows/test.yml

@@ -279,7 +279,6 @@ jobs:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
           TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
         run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
 
       - name: Run Spin adapter tests (native host)

AGENTS.md

@@ -378,6 +378,7 @@ Every PR must pass:
 14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
 15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
 16. Release producer checks: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh`
+17. Fastly response diff script: `node --test scripts/fastly-response-diff.test.mjs` with the `.tool-versions` Node
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code: