[ChristianPavilonis]

Summary

• Existing local-future EC trait and callers, retaining the managed Fastly post-send lifecycle.
• Reorganize the existing working demo using EdgeZero83d7a629, not current-main forwarding compatibility.

Draft baseline review unit. Not a current-main merge candidate, deployment approval or completed current-head CI claim.

Baseline and sequence

Head: a8e61218fea4ccccfa77b8d0b932b38d1090dcbe. Base: baseline/http-auction-20261110.

Historical main anchor: 2dd968aeebeb2cc0d5110115f64e0ad58e2e1d13. Original demo: TS2423a2ed plus separately preserved dirty inputs. Matching EdgeZero: draft431, exact revision 83d7a6296d285e135c4ea70021b19e6c8dca7e9f.

The user selected compatible-baseline cleanup. Current-main integration with EdgeZero462 and the authenticated-forwarder incompatibility are deferred. Preserve current-main PR1525/1526 ready and1527/1528 draft, with their existing bases. No excluded1499 or independent1506 implementation, relay/privacy experiment, new transport fallback, group/codec/phase design or operational deployment is included.

Changes

Area	Change
This unit	Existing local-future EC trait and callers, retaining the managed Fastly post-send lifecycle.
Unchanged work	Original checkouts, dirty Prebid inputs, recovery references and existing PRs remain preserved.

Closes

Refs #1530. This unit completes one part of the baseline extraction and does not close the overall tracker on its own.

Spec

Not a new feature. This is extraction of existing demo behavior and bounded build/caller corrections. Original native and EC storage design/review records remain in the baseline where applicable; they are not presented as approval of later combined source. No new forwarding, consent, timer or provider policy is designed here.

Test plan

Core3006, native all-feature suites and strict Core lint pass; Fastly WASM check passes. Fastly-only synchronous hooks bridge the original async operations; native and worker executors do not gain nested blocking executors. Current-main PR1526 remains untouched.

• Required current-head hosted checks complete before ready-state transition.
• Final baseline combined-check results recorded with exact input revisions and limitations.
• Focused failures and corrections retained rather than assertions relaxed.

The b67ffc6 baseline checkpoint has passing documented local gates: Fastly/default/reuse/native/Cloudflare/Spin suites, all adapter strict lint lanes, 17 cross-adapter parity cases, 1252 JS cases, CLI suites, formatting, clock/digest/proposal checks and changed-lines domain lint. Passing checks at121ebcc36 are reused only for unchanged relevant inputs; the final follow-up covers the CLI test-import and documentation-only corrections. These results are not a substitute for this PR's current-head hosted checks.

Checklist

• Existing behavior extracted into a scoped review unit.
• Public examples use fictional inputs and no licensed Geo data.
• No deployment, main merge, old-RC closure or recovery deletion.
• No new worker launched or paused experiment resumed.
• Review readiness confirmed independently from later units.

Operational Terraform remains in trusted-server-deployer. Local checks and prototype tests do not qualify cloud access, fleet durability or a live publisher.

Hosted docs-build correction

The first hosted format-docs job caught an additional site-build gate that the original local formatter checkpoint had not run: a relative link from the native EC guide to a Terraform example outside the site. Native EC correction8b11dbad3 replaces it with the plain repository path; no dead-link check is disabled. That docs-only correction is carried through the existing upper PR identities. Native EC and final integration8985b111 both pass docs ESLint and VitePress build; the final docs formatter also passes. Runtime, dependency, image-build-context and test inputs are unchanged from b67ffc6, so their prior exact-input proofs are reused. Hosted current-head checks still control readiness.

Startup negative-probe correction

A hosted native EC case failed the no-listener probe while its child logged the expected startup validation failure. The old log has no socket endpoints, so the failure's exact subtype is not claimed confirmed. A separate controlled Linux reproduction demonstrates a successful TCP self-connection with no listening server. Native correction8490c691d distinguishes equal local/peer endpoints from a real listener; actual socket controls prove the self-connection is excluded and a real listener is still detected. Nonzero exit, expected diagnostic, secret-redaction and the original startup deadline remain required. This changes only the acceptance fixture, not production admission, transport or trust.

The earliest native unit and final9356c557 default/all-feature acceptance checks and strict lint pass, including both controls and the original failure case. Ignores remain explicit; earlier separately executed celld proof is not relabeled as a new ignored-case run. Correction is merged upward through existing PR identities without force-pushing or retargeting. Current-head hosted checks must pass; the old failure is retained rather than rerun-only waived. Runtime/API/dependency inputs remain unchanged. A fresh exact9356 producer build and real runtime smoke now pass: image sha256:65a735d38e9dbc0573d0f6068a8b261bd202c43aea05085c2b2d6bccc91ebdbd, linux/amd64 UID/GID10001, including startup rejection and in-flight SIGTERM drain. Prior b67 image receipts remain separate; no image was pushed. All local parent runners are complete.

Browser CI host compatibility

Preserved older browser failures show Playwright1.58.2 rejecting ubuntu-latest's new Ubuntu26.04 image before browser installation; later missing-executable failures are consequences, not passing browser tests. Nativeb1216763a pins only the browser job to ubuntu-24.04, leaving dependency versions, tests and assertions unchanged. Direct Actionlint1.7.12 passes at the owning native and final integration points; the first shim-only attempt could not run because no global version was configured, and is not counted as lint proof. No global tooling was changed. The only9356 ->ee7 delta is this workflow host/comment; runtime, Cargo, docs, tests and Docker-context inputs are unchanged. Actual browser execution on the supported hosted runner remains pending and must pass before readiness. No waiver or browser skip.

[prk-Jr]

Summary

Converts EcKvStore and its core callers to local (?Send) async futures, keeping Fastly's blocking KV hostcalls behind a futures::executor::block_on bridge in the synchronous response hook and post-send pull sync. The conversion is mechanical: CAS/retry loops, withdrawal-marker handling, tombstone and finalize ordering are unchanged, and no lock or borrow is held across an await.

Checked and not a problem:

• Nested executor: in the pinned edgezero revision the finalize hook runs only after block_on(app.dispatch_admitted(..)) has returned, and post-send pull sync after delivery, so the new block_on calls are not nested. The Fastly EC lifecycle integration job exercises this path under Viceroy.
• Other adapters: FastlyEcKvStore is the only production implementation and all newly async callers are in core or the Fastly adapter, so Axum/Cloudflare/Spin gain no blocking bridge.
• Pull sync concurrency: all partner requests are still dispatched before any are awaited.
• Removed apply_withdrawal_tombstones test: coverage is retained end-to-end by finalize_withdrawal_tombstones_both_present_ids_once.

1 of the inline comments below carries a one-click GitHub suggestion.

Non-blocking

⛏ nitpick

• Assertions without messages — see inline at crates/trusted-server-core/src/ec/pull_sync.rs:977

CI Status

All 17 checks PASS at a8e61218: CLAUDE.md symlink guard, browser integration tests, cargo check (cloudflare native + wasm32-unknown-unknown), cargo check/build/test (spin native + wasm32-wasip2), cargo fmt (includes all adapter clippy lanes), cargo test, cargo test (axum native), cargo test (cross-adapter parity), cargo test (ts CLI, native) (macos-latest), cargo test (ts CLI, native) (ubuntu-latest), docs-proposal scripts, format-docs, format-typescript, integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts, vitest.

[prk-Jr]

⛏ nitpick: assertions without messages

Both assert_eq! calls in this new test lack a descriptive message, which AGENTS.md asks for in test code.

Suggested change

	assert_eq!(stub.recorded_backend_names().len(), 1);
	let (entry, _) = graph
	.get(&ec_id)
	.await
	.expect("should read row")
	.expect("row should exist");
	assert_eq!(
	entry.ids.get("alpha.example.com").map(|id| id.uid.as_str()),
	Some("synced-uid"),
	);
	assert_eq!(
	stub.recorded_backend_names().len(),
	1,
	"should dispatch one pull request to the single eligible partner"
	);
	let (entry, _) = graph
	.get(&ec_id)
	.await
	.expect("should read row")
	.expect("row should exist");
	assert_eq!(
	entry.ids.get("alpha.example.com").map(|id| id.uid.as_str()),
	Some("synced-uid"),
	"should persist the pulled partner UID"
	);