Repository navigation
October release candidate (DO NOT MERGE) - #1228
Draft
ChristianPavilonis wants to merge 403 commits into
Draft
ChristianPavilonis wants to merge 403 commits into
ChristianPavilonis wants to merge 403 commits into
Conversation
Remove an existing x-ts-version when the compiled-in version is unknown or invalid, so a proxied origin header is never reported as the deployed version. Ignore git metadata unless the repository top level is the workspace root, and watch the nearest existing ancestor of a packed current-branch ref so the next commit re-runs the build script. Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
Record the design and implementation plan for issue #1105. Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
Add a Documentation proposal workflow that runs GitHub Copilot CLI on each code merge to main, proposes edits to docs/guide or docs/index.md, and opens one pull request per merge on docs/auto/<sha12>. The publish job runs the docs gates first, skips empty diffs, and never reopens a closed proposal. It also posts a review comment on every hunk that cites the merged source and offers a suggestion reverting the hunk. Closes #1105. Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
Keep regex literals after statement blocks inert without hiding Flight calls after object, function, or class expressions. Bound brace and pending-class context alongside existing lexical nesting limits. Add fragment-boundary and identity/gzip regressions for origin/GTM rewrites and decoded Flight T lengths. Both reported brace/slash regressions were reproduced before the fix.
Preserve main’s resolved credentials, consent-store removal, route-specific EID persistence, and lazy pull-sync while adding request timings. Adapt timing wrappers to the current KV traits and carry September’s config-push expectation for the pinned EdgeZero revision.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Keep browser cookie writers, readers and EID diagnostics alongside body ingestion; defer their retirement to a separate PR. Preserve consent, metadata and pending authenticated capture protections. Allow valid authenticated handoff IDs over known-expired stored records for auctions without replacing stored state or enabling replay writes. Verified native and adapter tests, all target Clippy gates, JS tests and build, and formatting checks.
Co-authored-by: prk-Jr <49094961+prk-Jr@users.noreply.github.com>
8 tasks
The core build script exports TRUSTED_SERVER__GIT_VERSION with cargo:rustc-env, and Cargo also sets it on every cargo test run of the crate. The test-only from_toml_and_env loader reads every TRUSTED_SERVER__ variable as a settings override, so the variable is deserialized as an unknown git_version field and settings loading fails. Native `cargo test -p trusted-server-core --lib` fails 11 env override tests. CI runs core unit tests only on wasm32-wasip1 under Viceroy, which does not pass the host environment to the guest, so it never sees the variable. Setting it explicitly in the test reproduces the failure on both targets.
from_toml_and_env now reads overrides from a copy of the environment without TRUSTED_SERVER__GIT_VERSION. That name is a build input that shares the settings prefix, and Cargo exports it to every cargo test run of the crate through cargo:rustc-env. Runtime loading is unaffected: the EdgeZero overlay only overrides keys that already exist in the config.
… state, and apply approved cleanup.
Trusted Server spans four runtime adapters, consent, identity, auctions, HTML rewriting, and browser bundles, so design problems are cheaper to catch in a spec than in code review. Feature pull requests now need a spec written with the superpowers brainstorming skill and reviewed with an AI coding agent over at least two rounds. Add the requirement to CONTRIBUTING.md, a banner to README.md, and a Spec field and checklist item to the pull request template.
CONTRIBUTING.md pointed to a reviewed real-host exception in CLAUDE.md that does not exist; AGENTS.md banned real domains outright while the lint-domains allowlist and allow-domain suppressions are the actual mechanism. Document that exception in both places. The pull request template asked for tracing macros, but AGENTS.md and the runtime crates use log. It also required an issue for every pull request while CONTRIBUTING.md asked for one only before substantial changes; both now require an issue for features and substantial changes. CONTRIBUTING.md now links AGENTS.md by its canonical name.
Review found that the relay recorded nothing in a real browser. Four independent gaps each dropped the reason, and the new bridge test passed only because it used keys and a sender that production never produces. The relay was posted from the wrong realm. Universal Creative runs the renderer source inside a hidden frame it creates in the creative document, so a postMessage call made from that source carries the hidden frame as event.source whatever window it targets: the source is the realm of the running function, not the window the method is called on. The top-window listener authenticates a sender by matching it against iframes in the publisher document, which the hidden frame is not, so every relay was dropped. Reports now go through Universal Creative's own sendMessage helper, which is a creative-realm function, so a report arrives as the creative iframe the listener already recognizes. Verified in headless Chromium against a page mirroring Universal Creative's structure: the previous call reports the hidden renderer frame and matches no slot iframe, the helper reports the creative iframe and matches. The Prebid path recorded under the publisher's ad unit code, which is a div id, while the store keys associations by the configured Trusted Server slot id. Whenever they differ the lookup missed, the failure was dropped, and a creative_request_without_slot attribution issue was recorded in its place, so a render failure surfaced as a misleading attribution problem. The relay now resolves the slot id through divToSlotId. Server-side APS winners are served the same renderer and emit the same relay, but are tracked per slot rather than through the Prebid tombstone, so their relays were dropped. They are now resolved too, requiring the sender to sit in the slot that consumed the ad ID because hb_adid is not unique per slot. nonce_mismatch could never be recorded: the report echoed the mismatching nonce, which no parent accepts. It now echoes the nonce the frame expects, which only the parent receives, and the parent is the window that set it. Accepting any nonce-less failure let code running inside the renderer frame tear the frame down without knowing the nonce. bad_hash is the only report a frame sends before it has learned one, so nonce-less acceptance is narrowed to that reason in both parents. A tombstone could also expire before the frame's timeout fired, dropping the reason for a capability consumed late in its TTL. Tombstones now live at least as long as that timeout, which also keeps the ad ID blocked longer. The browser spec now asserts the reasons the renderer document actually emits, including the echoed nonce. That is the only coverage that executes the document rather than matching substrings in its Rust source, and it is where the nonce_mismatch bug would have been caught. The direct render path logs the reason instead of reporting every cause as a load failure. Operator docs describe the ten categories and where each is observed.
Brings in the squash-merged #1175 (a0b00c7), #1239 (d2f0d8c) and #1226 (3e85161), replacing the RC's earlier branch revisions. Conflict resolutions: - EdgeZero stays pinned to 78439fd4. Main pins v0.0.9, which 78439fd4 contains; #1107 and #1251 still need its pre-dispatch hooks, and no released tag carries them yet. The lockfile needed no changes. - Fastly main.rs keeps #1107's ingress-capturing signatures, which already carry #1175's logical store selection. - proxy.rs takes #1239's final redirect-limit passthrough test. - AGENTS.md keeps the RC's gate list, which already includes main's wasm clock lint. - getting-started takes main's final #1175/#1213 deploy wording. - Integration-test config.rs and cloudflare.rs keep the RC's trace-aware envelope and readiness-probe helpers, which carry #1226's spawn_with_config_json.
# Conflicts: # .github/workflows/test.yml
Brings #1260 to 77dc8c7, which restores browser EIDs and the expired capture fallback. Conflict resolutions: - formats.rs keeps #1260's restored x-ts-eids response header and then applies #1107's trace cache privacy last. - publisher.rs keeps both the chrono and cookie imports. - The Prebid shim guard stays at 55.5 KB; the shim measures 54,603 characters with diagnostics, trace and the EID cookie writer.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
October release candidate, replacing September RC #1112.
This PR is an integration branch for release-candidate validation. Do not merge it into
main.Contents
The RC head
97bcfa11containsmainthrougha0b00c72(#1175), every open PR in milestone202610except #1323 at the revision listed below, and the September revisions of the #1074 stack.Open milestone PRs
b4a20f49e03a5a0322ef7ca0c3a33e67d824a42d3993b7257c5eca0drewrite_clickscode is superseded by #1253'se210f623rewrite_clickscommits7fecdbddtest-cli's cache read-only through #1259'ssetup-rust77bd197b8a2f2b4877dc8c741cf83d98a90f2f8065198038d29da66090662315#1252 and #1253 target the
spec/1234-creative-click-rewrite-switchandspec/1231-creative-asset-host-allowlistbranches, so their design specs and plans are included too.Merged milestone PRs
#1137, #1166, #1173, #1175, #1176, #1177, #1179, #1180, #1181, #1182, #1209, #1210, #1213, #1214, #1220, #1221, #1223, #1226, #1227, #1239 and #1256 are in
mainand reach the RC through themainmerge. Earlier RC merges of #1137 and #1173 through #1182 are superseded by their finalmainversions.Closed PRs still carried
a152367558f8a354f951955f0fa7dfb6#1052 was closed in favor of #1300. Its RC merge was reverted before #1300 was merged, so none of its superseded code remains.
#1323 is not included. It points the EdgeZero dependencies at
github.com/IABTechLab/edgezero, which does not exist yet, and its description says not to merge it before the repository moves. Merging it would break every RC build.#1261 has no milestone and is not in this RC. Swapping the carried stack for #1261 would require rebuilding the branch. #1217 was closed in favor of #1225 and was never included.
Each included revision was verified as an ancestor of the RC head.
EdgeZero pin
The RC pins EdgeZero to
78439fd4on the unreleasedspec/pre-dispatch-request-fidelitybranch. It is the only revision that has both the v0.0.9 store bindings #1175 needs and the pre-dispatch ingress hooks #1107 and #1251 need (they pin965d482f, which predates v0.0.9). A released tag carrying both is a release gate.RC-only integration changes
These adapt PRs to each other and exist only in this branch:
scheduleInitialAdInittakes(bids, slots, auctionDiagnostics, traceAuctionTransport), andrecordTrustedServerOpportunitytakesauctionFactsbeforetraceIdentity. The diagnostics stack and Add mobile ad-rendering trace workflow #1107 each added the third and sixth arguments respectively; Add mobile ad-rendering trace workflow #1107's call sites and positional tests were shifted.RUST_LOGhandling and Add mobile ad-rendering trace workflow #1107's trace terminal path. Trace terminal responses skip Server-Timing, sandbox counters, access telemetry andx-ts-version.build.rsembeds Add mobile ad-rendering trace workflow #1107's trace assets from Build tsjs bundles into a private OUT_DIR and validate the set #1214's private bundle directory. The viewer rebuilds byte-identical; the pinned trace source digest changed becausebuild-all.mjsgained--out-dir.AxumDevServer, as onmain. EdgeZero records the inbound origin Add mobile ad-rendering trace workflow #1107's trace actions require only for requests from its own listener, so the RC's custom timing server made every trace action return 403. The Axum dev server therefore omits the timing stack's Server-Timing header until EdgeZero offers a seam to wrap its service.aps_*creative failure reasons that the trace report does not carry. The trace projection drops them instead of failing capture, and still rejects unknown values.lint-domainsjob now restorestest-cli's cache read-only (cache-key: cargo-cli,save-cache: "false") through Give each Rust CI job its own cache and save caches only from main #1259'ssetup-rustaction, which is what Gate PRs on non-allowlisted URL hosts in changed lines #1254's latest commit asks for.x-ts-eidsresponse header is written before Add mobile ad-rendering trace workflow #1107's trace cache privacy is applied. The Prebid shim measures 54,603 characters with diagnostics, trace and Implement server-side identity foundation and Lockr capture #1260's EID cookie writer, under the 55.5 KB guard.ts deploycommand and documents Report deployed git version in x-ts-version #1213'sTRUSTED_SERVER__GIT_VERSIONas a build input for the release package.RequestInfo::from_requestkeeps Preserve browser Origin with authenticated proxy forwarding #1251's source order (authenticated forwarder, immutable ingress, runtime origin,Host) and applies Preserve Next.js and Google Tag Manager rewrites in streamed pages #1222's host syntax check to whichever host is selected, returningBadRequestfor a malformed or non-text host. RawForwardedandX-Forwarded-Hostare never selected here, so Preserve Next.js and Google Tag Manager rewrites in streamed pages #1222's tests for those headers assert they are ignored rather than rejected. RC-only callers (DataDome protection, Fastly compat, Spin, and the forwarder, orchestrator and publisher tests) handle the fallible signature.GtmScriptStatein place ofmain'sScriptTextAccumulatorfrom Adopt EdgeZero reusable-sandbox lifecycle for Fastly #1179. The state still lives inIntegrationDocumentState, and Adopt EdgeZero reusable-sandbox lifecycle for Fastly #1179's two-document residue tests remain.lint-domainsjob from Gate PRs on non-allowlisted URL hosts in changed lines #1254 uses Give each Rust CI job its own cache and save caches only from main #1259'ssetup-rustaction and pins Node before cargo, so Set up pinned Node in Rust CI jobs and drop unused tsjs deps #1257'scheck-ci-node-pingate passes. The three PRs merged cleanly, but the combination failed that gate.AGENTS.mdlists Gate PRs on non-allowlisted URL hosts in changed lines #1254'slint-domains, Propose documentation updates after code merges to main #1225's documentation proposal scripts and Use web_time::Instant for Cloudflare timing #1226's wasm clock lint as CI gates 10, 11 and 12.app_config_envelopeand takes Add mobile ad-rendering trace workflow #1107's trace flag as a parameter. The Cloudflare environment keeps Use web_time::Instant for Cloudflare timing #1226'sspawn_with_config_jsonand threads Add mobile ad-rendering trace workflow #1107's readiness probe through the shared wrangler launcher.proxy.rs,creative.rsandsettings.rstake Add a host allowlist for creative asset rewriting #1253's versions of therewrite_clickscode it shares with Make creative click rewriting a separate switch #1252; they include Make creative click rewriting a separate switch #1252's suffix-spoofing test case and doc-link fix. Settings normalization keepsmain's fallibleimage_optimizer.normalize()?from Reject image optimizer names that collide after trimming #1221.send_identity_response, extended with the timing stack'sSendContextand post-send steps. Identity effects apply after send, pull sync runs only when capture storage is available, and access telemetry always reports the delivered response.ts-eidscookie parsing and thex-ts-eidsresponse headers. Add mobile ad-rendering trace workflow #1107's trace cookie health checks thets-eidsformat with a local validator that accepts the same shapes the removed parser did, and/auctionkeeps Add mobile ad-rendering trace workflow #1107's trace cache privacy.ec_finalize_kv_lands_before_freezedrives its KV round trip with a SharedID cookie instead of the removedts-eidsingestion.Verification
At
97bcfa11on macOS:cargo fmt, all eight clippy gates plus the build-digest clippy,test-fastly,test-fastly-reuse,test-axum,test-cloudflare,test-spin, parity, the CLI suite and the native build-digest test (5,132 Rust tests, 0 failures), the wasm clock lint, the CI Node-pin check, 1,816 vitest tests, ESLint, and JS, docs and Markdown formatting. The full Next.js (49) and WordPress (28) browser suites and the Axum trace browser workflow also pass locally.ts dev lint domains --changed-vs origin/main, which #1254'slint-domainsjob runs on this PR, fails on 54 lines in 16 files. Every line comes from an included PR, not from an RC integration change: #1238 (19), #1253 (12), #1252 (10), #1107 and #1251 (8) and the carried timing stack (5). #1222's latest revision cleared its 3. Each PR has to clear its own lines before it lands onmainafter #1254.