Axum readiness RC

.dockerignore

@@ -0,0 +1,37 @@
+# Allow only build inputs, never the entire operator checkout.
+**
+!Cargo.toml
+!Cargo.lock
+!.tool-versions
+!rust-toolchain.toml
+!edgezero.toml
+!.cargo/
+!.cargo/config.toml
+!crates/
+!crates/**
+# Exclude operator TOMLs even if placed below a crate.
+**/*.toml
+!**/Cargo.toml
+!rust-toolchain.toml
+!edgezero.toml
+!.cargo/config.toml
+!trusted-server.example.toml
+**/.git
+**/target
+**/node_modules
+**/dist
+crates/trusted-server-adapter-cloudflare/build
+crates/trusted-server-adapter-cloudflare/pkg
+**/.env
+**/.env.*
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/keys
+**/secrets
+**/.aws
+**/.npmrc
+**/.cargo/credentials*
+**/.ts-tmp
+**/.tsjs-npm-ci.lock

.env.dev

@@ -15,9 +15,6 @@ TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
 TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
 
 # [proxy]
-# Disable TLS certificate verification for local dev with self-signed certs
-# TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false
-#
 # Restrict first-party proxy redirect targets to an allowlist (JSON array or indexed form).
 # Leave unset in local dev; configure in production to prevent SSRF via redirect chains
 # initiated by signed first-party proxy URLs.

.github/actions/setup-integration-test-env/action.yml

@@ -91,7 +91,6 @@ runs:
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
         TRUSTED_SERVER__EC__PARTNERS: >-
           [{"name":"Integration Test Partner","source_domain":"inttest.example.com","bidstream_enabled":true,"api_token":"integration-test-token-alpha-32-bytes-ok"},{"name":"Integration Test Partner 2","source_domain":"inttest2.example.com","bidstream_enabled":true,"api_token":"integration-test-token-bravo-32-bytes-ok"}]
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
     - name: Build Axum native binary
@@ -101,7 +100,6 @@ runs:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build -p trusted-server-adapter-axum
 
     - name: Build WordPress test container
@@ -132,5 +130,4 @@ runs:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
         TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/format.yml

@@ -63,6 +63,20 @@ jobs:
       - name: Verify jobs pin Node before compiling Rust
         run: node scripts/check-ci-node-pin.mjs
 
+  fastly-response-diff:
+    name: Fastly response diff script
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+
+      - name: Test the response comparison
+        run: node --test scripts/fastly-response-diff.test.mjs
+
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
@@ -129,10 +143,10 @@ jobs:
       - name: Run host-target OpenRTB codegen clippy
         run: cargo clippy --package trusted-server-openrtb-codegen --target x86_64-unknown-linux-gnu --all-targets -- -D warnings
 
-      # The build-digest tests are native-only, so clippy-fastly compiles them
-      # to an empty crate. Lint them on the host.
-      - name: Run host-target core build-digest test clippy
-        run: cargo clippy --package trusted-server-core --target x86_64-unknown-linux-gnu --test template_build_digest -- -D warnings
+      # These core tests are native-only, so clippy-fastly compiles them
+      # to empty crates. Lint them on the host.
+      - name: Run host-target core build-digest and AWS config test clippy
+        run: cargo clippy --package trusted-server-core --target x86_64-unknown-linux-gnu --test template_build_digest --test aws_example_config -- -D warnings
 
   format-typescript:
     runs-on: ubuntu-latest

.github/workflows/integration-tests.yml

@@ -105,6 +105,9 @@ jobs:
           -- --include-ignored
           --skip test_wordpress_fastly --skip test_nextjs_fastly
           --skip trace_browser_workflow --skip trace_runtime_boundary
+          --skip multi_provider_auction_runs_spin --skip spin_runtime_
+          --skip navigation_bids_include_180_and_320_ms_and_exclude_600_ms_spin
+          --skip publisher_head_and_conditional_304_return_real_status_spin
           --test-threads=1
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
@@ -199,7 +202,7 @@ jobs:
           npm ci --prefix crates/trusted-server-js/lib
           npm ci --prefix crates/trusted-server-integration-tests/browser
           cd crates/trusted-server-integration-tests/browser
-          npx playwright install --with-deps chromium
+          npx playwright install chromium
           npm install -g wrangler@4.83.0
 
       - name: Install the verified Spin runtime
@@ -229,6 +232,7 @@ jobs:
         run: |
           cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_runtime_boundary -- --ignored --test-threads=1 --nocapture
           cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration trace_browser_workflow -- --ignored --test-threads=1 --nocapture
+          cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --test integration -- --ignored --test-threads=1 --nocapture multi_provider_auction_runs_spin spin_runtime_ navigation_bids_include_180_and_320_ms_and_exclude_600_ms_spin publisher_head_and_conditional_304_return_real_status_spin
         env:
           WASM_BINARY_PATH: ${{ env.WASM_ARTIFACT_PATH }}
           AXUM_BINARY_PATH: ${{ env.AXUM_ARTIFACT_PATH }}
@@ -297,7 +301,7 @@ jobs:
         working-directory: crates/trusted-server-integration-tests/browser
         run: |
           npm ci
-          npx playwright install --with-deps chromium
+          npx playwright install chromium
 
       # startViceroy retargets the config after choosing its listener port. Build
       # on this runner rather than relying on an uncached binary or a native

.github/workflows/native-aws-workload.yml

@@ -0,0 +1,62 @@
+name: Native AWS deployment example
+
+on:
+  pull_request:
+    paths:
+      - 'deploy/examples/native-aws-workload/**'
+      - '.tool-versions'
+      - '.github/workflows/native-aws-workload.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'deploy/examples/native-aws-workload/**'
+      - '.tool-versions'
+      - '.github/workflows/native-aws-workload.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  offline-checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      AWS_EC2_METADATA_DISABLED: 'true'
+      TF_IN_AUTOMATION: 'true'
+      CHECKPOINT_DISABLE: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Read pinned tooling
+        id: versions
+        run: |
+          terraform=$(awk '$1 == "terraform" { print $2 }' .tool-versions)
+          node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)
+          test -n "$terraform"
+          test -n "$node"
+          printf 'terraform=%s\nnode=%s\n' "$terraform" "$node" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ steps.versions.outputs.node }}
+
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_version: ${{ steps.versions.outputs.terraform }}
+          terraform_wrapper: false
+
+      - name: Check the offline workflow contract
+        run: node --test deploy/examples/native-aws-workload/test-workflow.mjs
+
+      - name: Validate schema and credential-free mock plans
+        run: |
+          terraform -chdir=deploy/examples/native-aws-workload fmt -check -recursive
+          terraform -chdir=deploy/examples/native-aws-workload init -backend=false -input=false -lockfile=readonly
+          terraform -chdir=deploy/examples/native-aws-workload validate
+          terraform -chdir=deploy/examples/native-aws-workload/retained init -backend=false -input=false -lockfile=readonly
+          terraform -chdir=deploy/examples/native-aws-workload/retained validate
+          env -u NODE_OPTIONS -u NODE_PATH node deploy/examples/native-aws-workload/test-draft.mjs
+          git diff --exit-code -- deploy/examples/native-aws-workload/.terraform.lock.hcl deploy/examples/native-aws-workload/retained/.terraform.lock.hcl

.github/workflows/native-container.yml

@@ -0,0 +1,45 @@
+name: Native RC container
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - .tool-versions
+      - rust-toolchain.toml
+      - Cargo.toml
+      - Cargo.lock
+      - edgezero.toml
+      - .cargo/**
+      - crates/trusted-server-adapter-axum/**
+      - crates/trusted-server-core/**
+      - crates/trusted-server-js/**
+      - crates/trusted-server-openrtb*/**
+      - scripts/test-native-container.mjs
+      - .github/workflows/native-container.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  local-provider-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Read pinned Node version
+        id: node
+        run: |
+          version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)
+          test -n "$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node.outputs.version }}
+      - name: Build local-provider image
+        run: docker build --build-arg TRUSTED_SERVER__GIT_VERSION="${{ github.sha }}" -t ts-rc-local:test .
+      - name: Check real TS routes, startup rejection and drain
+        run: node scripts/test-native-container.mjs ts-rc-local:test

.github/workflows/test.yml

@@ -186,8 +186,8 @@ jobs:
           path: ${{ runner.temp }}/trusted-server-finalize-axum-*/
           if-no-files-found: ignore
 
-      - name: Test template build digest inputs (native)
-        run: cargo test -p trusted-server-core --test template_build_digest
+      - name: Test build digest inputs and AWS config envelopes (native)
+        run: cargo test -p trusted-server-core --test template_build_digest --test aws_example_config
 
       - name: Run HTML processor benchmarks (smoke)
         # -- --test runs each benchmark as a regular test (no timing harness) so CI stays fast
@@ -279,7 +279,6 @@ jobs:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
           TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
         run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
 
       - name: Run Spin adapter tests (native host)
@@ -355,6 +354,9 @@ jobs:
         if: runner.os == 'macOS'
         id: setup-chrome
         uses: browser-actions/setup-chrome@v1
+        with:
+          # An exact version selects Chrome for Testing, not a snapshot or the desktop DMG.
+          chrome-version: '157.0.8103.78'
 
       - name: cargo test
         if: runner.os == 'Linux'

AGENTS.md

@@ -377,7 +377,8 @@ Every PR must pass:
 13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
 15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
-16. Release producer checks: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh`
+16. Fastly response diff script: `node --test scripts/fastly-response-diff.test.mjs` with the `.tool-versions` Node
+17. Release producer checks: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh`
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code: