[ChristianPavilonis]

Summary

• Default-off CloudFront boot profile, one immutable request outcome and absent optional detail.
• Reorganize the existing working demo using EdgeZero83d7a629, not current-main forwarding compatibility.

Draft baseline review unit. Not a current-main merge candidate, deployment approval or completed current-head CI claim.

Baseline and sequence

Head: affb0d0a4c0a1f3b9ac00d11c12de1f45080a8ce. Base: baseline/native-aws-20261110.

Historical main anchor: 2dd968aeebeb2cc0d5110115f64e0ad58e2e1d13. Original demo: TS2423a2ed plus separately preserved dirty inputs. Matching EdgeZero: draft431, exact revision 83d7a6296d285e135c4ea70021b19e6c8dca7e9f.

The user selected compatible-baseline cleanup. Current-main integration with EdgeZero462 and the authenticated-forwarder incompatibility are deferred. Preserve current-main PR1525/1526 ready and1527/1528 draft, with their existing bases. No excluded1499 or independent1506 implementation, relay/privacy experiment, new transport fallback, group/codec/phase design or operational deployment is included.

Changes

Area	Change
This unit	Default-off CloudFront boot profile, one immutable request outcome and absent optional detail.
Unchanged work	Original checkouts, dirty Prebid inputs, recovery references and existing PRs remain preserved.

Closes

Refs #1530. This unit completes one part of the baseline extraction and does not close the overall tracker on its own.

Spec

Not a new feature. This is extraction of existing demo behavior and bounded build/caller corrections. Original native and EC storage design/review records remain in the baseline where applicable; they are not presented as approval of later combined source. No new forwarding, consent, timer or provider policy is designed here.

Test plan

Core3002 and native all-feature suites pass, including10 real startup cases. No production KV Geo, local Geo database, new consent authority or cloud acceptance is added.

• Required current-head hosted checks complete before ready-state transition.
• Final baseline combined-check results recorded with exact input revisions and limitations.
• Focused failures and corrections retained rather than assertions relaxed.

The b67ffc6 baseline checkpoint has passing documented local gates: Fastly/default/reuse/native/Cloudflare/Spin suites, all adapter strict lint lanes, 17 cross-adapter parity cases, 1252 JS cases, CLI suites, formatting, clock/digest/proposal checks and changed-lines domain lint. Passing checks at121ebcc36 are reused only for unchanged relevant inputs; the final follow-up covers the CLI test-import and documentation-only corrections. These results are not a substitute for this PR's current-head hosted checks.

Checklist

• Existing behavior extracted into a scoped review unit.
• Public examples use fictional inputs and no licensed Geo data.
• No deployment, main merge, old-RC closure or recovery deletion.
• No new worker launched or paused experiment resumed.
• Review readiness confirmed independently from later units.

Operational Terraform remains in trusted-server-deployer. Local checks and prototype tests do not qualify cloud access, fleet durability or a live publisher.

Hosted docs-build correction

The first hosted format-docs job caught an additional site-build gate that the original local formatter checkpoint had not run: a relative link from the native EC guide to a Terraform example outside the site. Native EC correction8b11dbad3 replaces it with the plain repository path; no dead-link check is disabled. That docs-only correction is carried through the existing upper PR identities. Native EC and final integration8985b111 both pass docs ESLint and VitePress build; the final docs formatter also passes. Runtime, dependency, image-build-context and test inputs are unchanged from b67ffc6, so their prior exact-input proofs are reused. Hosted current-head checks still control readiness.

Startup negative-probe correction

A hosted native EC case failed the no-listener probe while its child logged the expected startup validation failure. The old log has no socket endpoints, so the failure's exact subtype is not claimed confirmed. A separate controlled Linux reproduction demonstrates a successful TCP self-connection with no listening server. Native correction8490c691d distinguishes equal local/peer endpoints from a real listener; actual socket controls prove the self-connection is excluded and a real listener is still detected. Nonzero exit, expected diagnostic, secret-redaction and the original startup deadline remain required. This changes only the acceptance fixture, not production admission, transport or trust.

The earliest native unit and final9356c557 default/all-feature acceptance checks and strict lint pass, including both controls and the original failure case. Ignores remain explicit; earlier separately executed celld proof is not relabeled as a new ignored-case run. Correction is merged upward through existing PR identities without force-pushing or retargeting. Current-head hosted checks must pass; the old failure is retained rather than rerun-only waived. Runtime/API/dependency inputs remain unchanged. A fresh exact9356 producer build and real runtime smoke now pass: image sha256:65a735d38e9dbc0573d0f6068a8b261bd202c43aea05085c2b2d6bccc91ebdbd, linux/amd64 UID/GID10001, including startup rejection and in-flight SIGTERM drain. Prior b67 image receipts remain separate; no image was pushed. All local parent runners are complete.

Browser CI host compatibility

Preserved older browser failures show Playwright1.58.2 rejecting ubuntu-latest's new Ubuntu26.04 image before browser installation; later missing-executable failures are consequences, not passing browser tests. Nativeb1216763a pins only the browser job to ubuntu-24.04, leaving dependency versions, tests and assertions unchanged. Direct Actionlint1.7.12 passes at the owning native and final integration points; the first shim-only attempt could not run because no global version was configured, and is not counted as lint proof. No global tooling was changed. The only9356 ->ee7 delta is this workflow host/comment; runtime, Cargo, docs, tests and Docker-context inputs are unchanged. Actual browser execution on the supported hosted runner remains pending and must pass before readiness. No waiver or browser skip.

[prk-Jr]

Reviewed affb0d0a4c0a1f3b9ac00d11c12de1f45080a8ce against baseline b1216763a3c2a38df1a2909285330e818823423a. No actionable findings.

Reviewed native Geo admission and startup, request isolation, response finalization, optional-field serialization, consent handling, and affected auction consumers.

Local verification: cargo test --locked -p trusted-server-adapter-axum --all-features --test startup passed all 10 tests, including CloudFront trust rejection and error-response finalization, using Rust 1.98.1 and Node 24.12.0. Head and base were rechecked and remain unchanged.

This approval covers the historical baseline unit. Current-main compatibility and live AWS qualification remain outside scope. Main-only CodeQL did not run.

CI status: all 17 reported checks PASS at the reviewed head:

• integration tests
• integration tests (Fastly EC lifecycle)
• browser integration tests
• docs-proposal scripts
• cargo test (cross-adapter parity)
• cargo test (axum native)
• cargo fmt
• CLAUDE.md symlink guard
• cargo test (ts CLI, native) (macos-latest)
• cargo check/build/test (spin native + wasm32-wasip2)
• vitest
• cargo test (ts CLI, native) (ubuntu-latest)
• cargo check (cloudflare native + wasm32-unknown-unknown)
• cargo test
• format-docs
• format-typescript
• prepare integration artifacts