Add an AWS deployment planning skill for Prebid Server Go

[ChristianPavilonis]

Summary

• Add an explicitly invoked skill for planning Prebid Server Go deployments on AWS and generating approved Terraform/runtime files from an operator interview.
• Prototype ts pbs inspect, check, secrets set, and status inside the existing CLI, with redacted discovery, local configuration checks, guarded Secrets Manager writes, and EC2 infrastructure status.
• Keep planning and file generation separate from AWS execution. Deployment, rollback, and runtime secret injection remain deferred; the generated deploy/ sandbox is excluded from this PR.

Current blocker after integrating the remote branch

Not ready to merge. The remote branch had advanced to 7d919d66, which merged current main. That work is preserved by local merge commit 1dfd8c83; no force push or history replacement was used.

The upstream schema now keeps server-side bidder routing under auction.providers and auction.bidders, while PrebidIntegrationConfig is browser-only. The current inspect implementation and skill discovery guidance still target the earlier server-side fields under integrations.prebid and need a compatibility update.

Post-merge ./scripts/test-cli.sh fails to compile at crates/trusted-server-cli/src/commands/pbs/inspect.rs:282 with E0609: PrebidIntegrationConfig no longer has a bidders field. Removing the parity assertion alone would hide the discovery mismatch. Adapt discovery, fixtures, and guidance to the new schema, then rerun tests and lint before treating the prototype as usable with current configuration.

The successful verification below was performed before integrating that remote merge. It is not a green result for the current PR head.

Changes

Files	Change
.claude/skills/planning-prebid-aws/SKILL.md	Defines explicit invocation, requirements gathering, design approval, generation, and evidence gates. Routes supported operations through ts pbs.
Skill references and two-region example	Cover architecture choices, Prebid Go requirements, Terraform state/authentication/testing, read-only TOML discovery, configuration/secret ownership, and proposed release delivery. Pilot choices remain conditional.
crates/trusted-server-cli/src/commands/pbs/	Implements the four commands with strict local schemas, deterministic regional merging, secret-binding conflict checks, an injectable AWS CLI runner, account checks, confirmation, and retry UUIDs.
CLI command registration, Cargo.toml, and Cargo.lock	Registers the experimental namespace and adds native-only YAML parsing, hidden terminal input, and error/UUID dependencies. Existing ts config, ts deploy, and ts prebid bundle behavior stays unchanged.
crates/trusted-server-cli/tests/pbs_cli.rs and module tests	Exercise the actual binary against a fake AWS executable, plus discovery, merging, validation, redaction, target refusal, retries, and partial status.
crates/trusted-server-cli/README.md and examples/pbs/	Document usage, schema, authorization boundaries, recovery, and limitations; provide fictional fixtures for local checks.
.tool-versions	Adds AWS CLI tooling and aligns the existing entries.

Operator commands

Command	Current scope
ts pbs inspect --config <file>	Reads the selected TOML file without changing it. Separates server bidders, browser bidders, and bundle inputs; withholds account, endpoint, and bid-parameter values. Does not expand runtime overrides or establish host-secret requirements.
ts pbs check --deployment <file>	Validates local descriptor/binding structure and regional YAML merges without credentials or AWS calls. Does not prove compatibility with the upstream PBS schema or successful startup.
ts pbs secrets set <bidder> --deployment <file> --region <region>	Writes a complete JSON payload to an existing declared secret after identity and metadata checks. Supports hidden terminal/file/stdin input, explicit approval, and stable retry tokens. Refuses replica writes, enabled AWS CLI history, and shared secret ARNs across bidder bindings. No automatic deployment or partner rotation.
ts pbs status --deployment <file>	Reads only declared EC2 instances. Reports infrastructure state, not PBS health or readiness. Installed release and consumed secret versions remain unknown; incomplete reports exit nonzero.

Secret values stay out of process arguments and reports. AWS request payloads use owner-only temporary files on Unix, removed on normal success/error paths. Raw AWS stderr is withheld. Abrupt termination can leave temporary files; use protected temporary storage. Windows ACL behavior has not been validated.

Review decision and remaining scope

Please review whether PBS management belongs permanently under ts pbs in the existing CLI. This is an experiment, not a decision to create a separate crate, binary, or per-deployment wrapper.

The current descriptor supports ec2-compose only. The planning skill can still recommend ECS or another approved architecture, but its CLI integration must be implemented separately. There are no placeholder deploy or rollback subcommands.

Versioned runtime delivery needs an approved ownership transition where Terraform user data currently installs runtime files. This PR does not provision infrastructure, install a secret loader, replace containers, adopt sandbox state, activate bidders, or change caller traffic. All committed deployment examples use fictional targets and are not deployable configurations.

Closes

Closes #1163

Test plan

• Current merged head: ./scripts/test-cli.sh is blocked by the schema compatibility compile error above.
• Update inspection and discovery guidance for the current auction.* configuration, then rerun the complete native CLI checks.

Completed before integrating the remote branch

• ./scripts/test-cli.sh: 110 tests passed on Linux, including five process-level PBS tests using a fake aws executable.
• cargo fmt --all -- --check.
• cargo clippy --package trusted-server-cli --all-targets --target x86_64-unknown-linux-gnu -- -D warnings.
• Scoped formatting: npx --yes prettier@3.4.2 --check --config docs/.prettierrc '.claude/skills/planning-prebid-aws/**/*.md' crates/trusted-server-cli/README.md 'crates/trusted-server-cli/examples/pbs/*.{yaml,json}'.
• Frontmatter and local-link validation: eight Markdown files, explicit invocation enabled, and 22 local links/anchors.
• Local smoke checks: cargo run_cli_linux pbs inspect --config trusted-server.example.toml --json and cargo run_cli_linux pbs check --deployment crates/trusted-server-cli/examples/pbs/deployment.yaml --json.
• Failing-before/passing-after evidence for namespace registration, supported runtime bidder-list encodings, and rejection of shared secret ownership.
• Read-only correctness review; its bidder-list compatibility finding was fixed and covered by a parity test against the runtime schema.
• Staged diff/whitespace review and explicit verification that deploy/ is excluded.

Deferred evidence

• Fresh-agent skill invocation and end-to-end file-generation exercise.
• Live AWS CLI/authentication and service integration, real-terminal interaction, PBS startup, and runtime delivery. No real AWS calls or secret writes were made during implementation.
• macOS/Windows validation and repository-wide adapter/JS CI. Local checks were scoped to the changed native CLI and skill files; unrelated adapter and JavaScript source is unchanged.

Checklist

• Skill requires explicit invocation with disable-model-invocation: true.
• New code has unit and process-level tests; production code adds no unwrap() calls.
• Credentials are absent from committed examples and reports; test payloads are dummy values.
• .tool-versions is included; the generated deploy/ directory remains local and untracked.
• Unsupported operations, the post-merge schema blocker, and unverified integration behavior are documented rather than reported as working.
• Resolve the CLI ownership decision and deferred evidence before treating this as production-ready tooling.