Add full-surface documentation refresh spec

.claude/agents/code-architect.md

@@ -8,20 +8,23 @@ Analyze the codebase architecture and suggest improvements when asked.
 
 ## Context
 
-This is a Rust workspace targeting Fastly Compute (`wasm32-wasip1`) with three
-crates: `common` (core logic), `fastly` (entry point), and `js` (TS/JS build).
+This is a multi-adapter Rust workspace. Shared logic lives in
+`trusted-server-core`; Fastly, Cloudflare, Spin, and Axum adapters provide
+runtime-specific entry points, and the JS crate builds TSJS assets.
 
 Key patterns:
 
-- **RequestWrapper trait** abstracts HTTP handling for different backends
+- **RuntimeServices and platform traits** supply stores, outbound HTTP,
+  backends, geo lookup, and template services to shared request handlers
 - **Settings-driven config** via `trusted-server.toml`
 - **Integration system** with Rust registration + per-integration JS bundles
 - **Runtime JS concatenation** — server assembles core + integration scripts
 
 ## When Analyzing
 
 1. Read relevant source files before making suggestions.
-2. Consider WASM constraints (no filesystem, no threads, no Tokio).
+2. Apply the constraints of the adapter being reviewed. Core and WASM adapter
+   code cannot assume Tokio or host filesystem access; Axum is native.
 3. Respect existing patterns — suggest improvements that fit the current architecture.
 4. Prioritize simplicity and correctness over cleverness.
 

.claude/agents/issue-creator.md

@@ -82,7 +82,7 @@ Output the issue URL and type.
   - Core (Edge Cookies, GDPR)
   - Integrations (prebid, lockr, permutive, etc.)
   - HTML processing / JS injection
-  - Ad serving (Equativ)
+  - Ad serving / auctions
   - Fastly runtime
   - JS build pipeline
   - Documentation

.claude/commands/check-ci.md

@@ -1,11 +1,5 @@
-Run all CI checks locally, in order. Stop and report if any step fails.
+Run every check in the [canonical CI gate list](/CLAUDE.md#ci-gates), in its
+documented order. Stop and report if any gate fails.
 
-1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
-3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
-4. `cargo check-cloudflare` (wasm32-unknown-unknown target check, mirrors CI)
-5. `cd crates/trusted-server-js/lib && npx vitest run`
-6. `cd crates/trusted-server-js/lib && npm run format`
-7. `cd docs && npm run format`
-
-Report a summary of all results when done.
+Report the result of each canonical gate. Do not maintain a separate gate list
+in this command.

.claude/commands/review-changes.md

@@ -1,5 +1,8 @@
 Review all staged and unstaged changes in the working tree.
 
+Use the [canonical CI gate list](/CLAUDE.md#ci-gates) as the sole source for
+required verification. Do not copy its commands into this file.
+
 1. Run `git diff` and `git diff --cached` to see all changes.
 2. Review each changed file for:
    - Correctness and logic errors

.claude/commands/test-all.md

@@ -1,13 +1,6 @@
-Run the full test suite for both Rust and JavaScript.
+Run the Rust and JavaScript test gates from the
+[canonical CI gate list](/CLAUDE.md#ci-gates). Do not maintain a separate test
+command list in this file.
 
-```bash
-cargo test-fastly && cargo test-axum && cargo test-cloudflare
-```
-
-Then run JS tests:
-
-```bash
-cd crates/trusted-server-js/lib && npx vitest run
-```
-
-Report results for both. If any test fails, investigate and suggest a fix.
+Report each test-gate result. If a test fails, investigate it before reporting
+the command complete.

.claude/commands/test-crate.md

@@ -2,16 +2,10 @@ Test a specific crate by name.
 
 Usage: /test-crate $ARGUMENTS
 
-Run:
+Use the target-aware test rules referenced by the
+[canonical CI gate list](/CLAUDE.md#ci-gates). Select the canonical adapter or
+JavaScript gate that covers `$ARGUMENTS`; do not substitute a bare workspace
+test. For a host-only crate without a covering alias, follow the host-target
+procedure in `CLAUDE.md`.
 
-```bash
-cargo test -p $ARGUMENTS
-```
-
-If $ARGUMENTS is "js" or "javascript", run:
-
-```bash
-cd crates/trusted-server-js/lib && npx vitest run
-```
-
-Report results and investigate any failures.
+Report the selected canonical rule and its result. Investigate any failure.

.claude/commands/verify.md

@@ -1,12 +1,5 @@
-Full verification: build, test, and lint the entire project.
+Run full repository verification from the
+[canonical CI gate list](/CLAUDE.md#ci-gates). That region is the sole source
+for required gate commands; do not maintain a copy here.
 
-1. `cargo build-fastly && cargo build-axum && cargo build-cloudflare`
-2. `cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1`
-3. `cargo fmt --all -- --check`
-4. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
-5. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
-6. `cd crates/trusted-server-js/lib && npx vitest run`
-7. `cd crates/trusted-server-js/lib && npm run format`
-8. `cd docs && npm run format`
-
-Report results for each step. Stop and investigate if any step fails.
+Report every canonical gate result. Stop and investigate if any gate fails.

.env.dev

@@ -5,9 +5,11 @@
 # [publisher]
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=http://localhost:9090
 
-# [synthetic]
-TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
+# [ec]
+# The passphrase is secret-store material, not a development overlay. This
+# non-secret threshold is applied only when the file is exported before a
+# `ts config` command.
+TRUSTED_SERVER__EC__CLUSTER_TRUST_THRESHOLD=10
 
 # [proxy]
 # Disable TLS certificate verification for local dev with self-signed certs

.env.example

@@ -18,27 +18,26 @@ TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.publisher.com
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
 
 # =============================================================================
-# Synthetic ID Settings
+# Edge Cookie Settings
 # =============================================================================
-TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
-# Template variables: client_ip, user_agent, first_party_id, auth_user_id, publisher_domain, accept_language
-TRUSTED_SERVER__SYNTHETIC__TEMPLATE={{ client_ip }}:{{ user_agent }}:{{ first_party_id }}
+# Non-secret CLI overlay. Keep the EC passphrase in the app-config secret
+# store; do not place it in this file.
+TRUSTED_SERVER__EC__CLUSTER_TRUST_THRESHOLD=10
 
 # =============================================================================
-# Request Signing (optional)
+# Request Signing (optional CLI overlay)
 # =============================================================================
 TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=false
 # TRUSTED_SERVER__REQUEST_SIGNING__CONFIG_STORE_ID=<fastly-config-store-id>
 # TRUSTED_SERVER__REQUEST_SIGNING__SECRET_STORE_ID=<fastly-secret-store-id>
 
 # =============================================================================
-# Response Headers (optional)
+# Response Headers (optional CLI overlay)
 # =============================================================================
 # TRUSTED_SERVER__RESPONSE_HEADERS__X_CUSTOM_HEADER=custom-value
 
 # =============================================================================
-# Integrations
+# Integrations (optional CLI overlays)
 # =============================================================================
 
 # Prebid

.gitattributes

@@ -0,0 +1,2 @@
+# Authenticated CLI-help goldens preserve the runners' exact output bytes.
+tools/docs-parity/goldens/*.txt -whitespace

.github/actions/setup-integration-test-env/action.yml

@@ -44,6 +44,11 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    - name: Set up Node.js
+      uses: actions/setup-node@v7.0.0
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+
     - name: Retrieve Viceroy version
       id: viceroy-version
       if: ${{ inputs.install-viceroy == 'true' }}
@@ -52,7 +57,7 @@ runs:
       run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
       with:
         toolchain: ${{ steps.rust-version.outputs.rust-version }}
         target: wasm32-wasip1
@@ -61,7 +66,7 @@ runs:
     - name: Cache Viceroy binary
       if: ${{ inputs.install-viceroy == 'true' }}
       id: cache-viceroy
-      uses: actions/cache@v4
+      uses: actions/cache@v6.1.0
       with:
         path: ~/.cargo/bin/viceroy
         key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}

.github/dependabot.yml

@@ -1,21 +1,43 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
-  - package-ecosystem: "cargo" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+
+  - package-ecosystem: "cargo"
+    directory: "/tools/docs-parity"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+
+  - package-ecosystem: "npm"
+    directory: "/crates/trusted-server-js/lib"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+
+  - package-ecosystem: "npm"
+    directory: "/crates/trusted-server-integration-tests/browser"
     schedule:
       interval: "weekly"
+    target-branch: "main"
 
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "crates/trusted-server-js/lib/" # Location of package manifests
+  - package-ecosystem: "npm"
+    directory: "/crates/trusted-server-integration-tests/fixtures/frameworks/nextjs"
     schedule:
       interval: "weekly"
+    target-branch: "main"
 
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "docs/" # Location of package manifests
+  - package-ecosystem: "npm"
+    directory: "/docs"
     schedule:
       interval: "weekly"
+    target-branch: "main"

.github/pull_request_template.md

@@ -21,22 +21,15 @@ Closes #
 
 ## Test plan
 
-<!-- How did you verify this works? Check all that apply -->
-
-- [ ] `cargo test-fastly && cargo test-axum`
-- [ ] `cargo clippy-fastly && cargo clippy-axum`
-- [ ] `cargo fmt --all -- --check`
-- [ ] JS tests: `cd crates/trusted-server-js/lib && npx vitest run`
-- [ ] JS format: `cd crates/trusted-server-js/lib && npm run format`
-- [ ] Docs format: `cd docs && npm run format`
-- [ ] WASM build: `cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1`
-- [ ] Manual testing via `fastly compute serve`
-- [ ] Other: <!-- describe -->
+<!-- Follow the canonical gates; do not copy their command list here. -->
+
+- [ ] Completed the [canonical CI gate list](/CLAUDE.md#ci-gates)
+- Evidence: <!-- Record exact results and any scoped additional checks. -->
 
 ## Checklist
 
 - [ ] Changes follow [CLAUDE.md](/CLAUDE.md) conventions
 - [ ] No `unwrap()` in production code — use `expect("should ...")`
-- [ ] Uses `tracing` macros (not `println!`)
+- [ ] Uses `log` macros (not `println!`)
 - [ ] New code has tests
 - [ ] No secrets or credentials committed

.github/workflows/codeql.yml

@@ -15,7 +15,7 @@ on:
   push:
     branches: ["main"]
   pull_request:
-    branches: ["main"]
+    branches: ["main", "rc/*"]
   schedule:
     - cron: "42 6 * * 0"
 
@@ -59,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -69,7 +69,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -98,6 +98,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.9
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/deploy-docs.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
     paths:
       - "docs/**"
+      - ".tool-versions"
       - ".github/workflows/deploy-docs.yml"
   workflow_dispatch: # Allow manual triggers
 
@@ -24,34 +25,42 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0 # For lastUpdated feature
 
       - name: Retrieve Node.js version
         id: node-version
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
           cache: "npm"
           cache-dependency-path: docs/package-lock.json
 
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v6.0.0
 
       - name: Install dependencies
         working-directory: docs
         run: npm ci
 
       - name: Build with VitePress
         working-directory: docs
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         run: npm run build
 
+      - name: Assert exact source provenance
+        working-directory: docs
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: grep -R --fixed-strings --quiet "$GITHUB_SHA" .vitepress/dist
+
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: docs/.vitepress/dist
 
@@ -64,4 +73,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5.0.1