September release candidate (DO NOT MERGE)

.cargo/config.toml

@@ -64,6 +64,13 @@ run_cli_macos = "run --package trusted-server-cli --target aarch64-apple-darwin
 test_cli_linux = "test --package trusted-server-cli --target x86_64-unknown-linux-gnu"
 test_cli_macos = "test --package trusted-server-cli --target aarch64-apple-darwin"
 
+# --- Host-target lint gates that no adapter alias covers ---
+# CI lints these two crates explicitly (see .github/workflows/format.yml), but
+# pins the Linux triple, so there was no command a developer could run locally
+# to reproduce them. These omit --target and therefore build for the host.
+clippy-cli = "clippy -p trusted-server-cli --all-targets --all-features -- -D warnings"
+clippy-codegen = "clippy -p trusted-server-openrtb-codegen --all-targets -- -D warnings"
+
 # When a wasm binary IS built, run it under Viceroy.
 [target.'cfg(all(target_arch = "wasm32"))']
 runner = "viceroy run -C ../../fastly.toml -- "

.github/workflows/test.yml

@@ -231,9 +231,14 @@ jobs:
         run: |
           cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings
 
+      - name: Set up Chrome for browser fixture tests
+        id: setup-chrome
+        uses: browser-actions/setup-chrome@v1
+
       - name: cargo test
-        run: |
-          cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"
+        run: ./scripts/test-cli.sh
+        env:
+          CHROME: ${{ steps.setup-chrome.outputs.chrome-path }}
 
   test-typescript:
     name: vitest

.gitignore

@@ -63,3 +63,4 @@ src/*.html
 # leftover local build artifacts (node_modules, target, dist) that remain on disk.
 /crates/js/
 /crates/integration-tests/
+wrangler.integration.generated.toml

CLAUDE.md

@@ -120,6 +120,12 @@ cargo clippy-cloudflare-wasm
 cargo clippy-spin-native
 cargo clippy-spin-wasm
 
+# The CLI and the OpenRTB codegen crate are host-target members that no adapter
+# alias covers. CI lints both with the Linux triple pinned; these aliases omit
+# `--target` so they reproduce it on any host.
+cargo clippy-cli
+cargo clippy-codegen
+
 # Check compilation (per-target aliases — bare `cargo check` fails at the workspace root)
 cargo check-fastly && cargo check-axum && cargo check-cloudflare
 
@@ -336,7 +342,7 @@ IntegrationRegistration::builder(ID)
 Every PR must pass:
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm`
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm && cargo clippy-cli && cargo clippy-codegen`
 3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin`
 4. `cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity`
 5. JS build and test (`cd crates/trusted-server-js/lib && npx vitest run`)

Cargo.toml

@@ -97,6 +97,7 @@ scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.149"
 sha2 = "0.10.9"
+similar = "2.7"
 simple_logger = "5"
 spin-sdk = { version = "~6.0", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
@@ -109,6 +110,7 @@ tokio-rustls = "0.26"
 toml = "1.1"
 toml_edit = "0.23.10"
 tower = "0.4"
+tracing = "0.1"
 trusted-server-core = { path = "crates/trusted-server-core" }
 trusted-server-js = { path = "crates/trusted-server-js" }
 trusted-server-openrtb = { path = "crates/trusted-server-openrtb" }

README.md

@@ -42,7 +42,7 @@ ts config init
 ts config validate
 
 # Audit a public page with Chrome/Chromium to bootstrap a draft config
-ts audit https://publisher.example
+ts audit generate https://publisher.example
 
 # Run tests (Fastly/WASM crates — requires Viceroy)
 cargo test-fastly

crates/trusted-server-adapter-axum/Cargo.toml

@@ -20,19 +20,19 @@ path = "src/main.rs"
 
 [dependencies]
 async-trait = { workspace = true }
+axum = { workspace = true }
 edgezero-adapter-axum = { workspace = true, features = ["axum"] }
 edgezero-core = { workspace = true }
 error-stack = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
 reqwest = { workspace = true }
 simple_logger = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "signal", "sync", "time"] }
+tower = { workspace = true, features = ["util"] }
 trusted-server-core = { workspace = true }
 
 [dev-dependencies]
-axum = { workspace = true }
 base64 = { workspace = true }
 temp-env = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-tower = { workspace = true, features = ["util"] }

crates/trusted-server-adapter-axum/src/app.rs

@@ -1,6 +1,7 @@
 use core::future::Future;
 use std::sync::Arc;
 
+use edgezero_adapter_axum::service::EdgeZeroAxumService;
 use edgezero_core::app::Hooks;
 use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
@@ -574,15 +575,7 @@ impl Hooks for TrustedServerApp {
     }
 
     fn routes() -> RouterService {
-        let state = match build_state() {
-            Ok(s) => s,
-            Err(ref e) => {
-                log::error!("failed to build application state: {:?}", e);
-                return startup_error_router(e);
-            }
-        };
-
-        build_router(&state)
+        Self::routes_with_server_timing_flag().0
     }
 }
 
@@ -603,6 +596,44 @@ impl TrustedServerApp {
         let state = build_state_with_settings(settings)?;
         Ok(build_router(&state))
     }
+
+    /// The dev server's fully configured tower service: the application
+    /// router wrapped in the terminal timing layer
+    /// ([`crate::timing::TimingService`]), with `server_timing_enabled`
+    /// read from the same settings snapshot that built the router.
+    ///
+    /// This is the standard construction path for serving this adapter.
+    /// [`Hooks::routes`] satisfies the `Hooks` trait contract and returns
+    /// the bare router without the timing layer; callers who serve traffic
+    /// should use this instead so `server_timing_enabled` is never
+    /// silently discarded.
+    #[must_use]
+    pub fn dev_server_service() -> crate::timing::TimingService<EdgeZeroAxumService> {
+        let (router, server_timing_enabled) = Self::routes_with_server_timing_flag();
+        crate::timing::TimingService::new(EdgeZeroAxumService::new(router), server_timing_enabled)
+    }
+
+    /// Build the router alongside whether `Server-Timing` emission is
+    /// enabled, read from the same settings snapshot used to build the
+    /// router.
+    ///
+    /// The Axum dev server's terminal timing layer ([`crate::timing`]) needs
+    /// this flag once at startup: unlike the Fastly adapter, which rebuilds
+    /// `Settings` per request, the Axum dev server builds its application
+    /// state once and reuses the same [`RouterService`] for every request.
+    #[must_use]
+    fn routes_with_server_timing_flag() -> (RouterService, bool) {
+        let state = match build_state() {
+            Ok(s) => s,
+            Err(ref e) => {
+                log::error!("failed to build application state: {:?}", e);
+                return (startup_error_router(e), false);
+            }
+        };
+
+        let server_timing_enabled = state.settings.observability.server_timing_enabled;
+        (build_router(&state), server_timing_enabled)
+    }
 }
 
 fn build_router(state: &Arc<AppState>) -> RouterService {

crates/trusted-server-adapter-axum/src/lib.rs

@@ -10,3 +10,6 @@ pub mod app;
 pub mod middleware;
 /// Platform-trait implementations backed by env vars and `reqwest`.
 pub mod platform;
+/// Terminal timing layer wrapping the Axum dev server's tower `Service`
+/// boundary with the request-phase `Server-Timing` freeze point.
+pub mod timing;

crates/trusted-server-adapter-axum/src/main.rs

@@ -1,6 +1,15 @@
-use edgezero_adapter_axum::dev_server::{AxumDevServer, AxumDevServerConfig};
-use edgezero_core::app::Hooks as _;
+use std::net::SocketAddr;
+
+use axum::Router;
+use edgezero_adapter_axum::dev_server::AxumDevServerConfig;
+use edgezero_adapter_axum::service::EdgeZeroAxumService;
+use tokio::net::TcpListener;
+use tokio::runtime::Builder as RuntimeBuilder;
+use tokio::signal;
+use tower::Service as _;
+use tower::service_fn;
 use trusted_server_adapter_axum::app::TrustedServerApp;
+use trusted_server_adapter_axum::timing::TimingService;
 
 #[allow(clippy::print_stderr)]
 fn main() {
@@ -20,13 +29,63 @@ fn main() {
     };
 
     log::info!("Listening on http://{}", config.addr);
-    let router = TrustedServerApp::routes();
-    if let Err(err) = AxumDevServer::with_config(router, config).run() {
+    let service = TrustedServerApp::dev_server_service();
+    if let Err(err) = run(service, config) {
         log::error!("trusted-server-adapter-axum failed: {err}");
         std::process::exit(1);
     }
 }
 
+/// Runs the Axum dev server with the request-phase timing terminal layer
+/// ([`trusted_server_adapter_axum::timing::TimingService`]) wrapped around
+/// `EdgeZeroAxumService`, ahead of `axum::serve`.
+///
+/// This does not use `edgezero_adapter_axum::dev_server::AxumDevServer::run`:
+/// that helper only accepts a bare [`RouterService`] and builds its own
+/// `EdgeZeroAxumService` and `axum::Router` internally, with no seam for an
+/// outer service wrapper. Router-generated 404/405 responses bypass
+/// `RouterBuilder::middleware` (see `trusted_server_adapter_axum::timing`),
+/// so the freeze point has to wrap the tower `Service` boundary itself.
+/// Driving `axum::serve` directly here mirrors that helper's own internal
+/// bind/wrap/serve/shutdown sequence closely enough to keep behavior
+/// identical for callers (`PORT` env var, ctrl-c graceful shutdown).
+///
+/// # Errors
+///
+/// Returns an error if the Tokio runtime fails to start, the listener fails
+/// to bind, or the underlying serve loop errors.
+fn run(
+    service: TimingService<EdgeZeroAxumService>,
+    config: AxumDevServerConfig,
+) -> std::io::Result<()> {
+    let runtime = RuntimeBuilder::new_multi_thread().enable_all().build()?;
+    runtime.block_on(serve(service, config))
+}
+
+async fn serve(
+    service: TimingService<EdgeZeroAxumService>,
+    config: AxumDevServerConfig,
+) -> std::io::Result<()> {
+    let listener = TcpListener::bind(config.addr).await?;
+
+    let axum_router = Router::new().fallback_service(service_fn(move |req| {
+        let mut svc = service.clone();
+        async move { svc.call(req).await }
+    }));
+    let make_service = axum_router.into_make_service_with_connect_info::<SocketAddr>();
+
+    let server = axum::serve(listener, make_service);
+    if config.enable_ctrl_c {
+        server
+            .with_graceful_shutdown(async {
+                let _ctrl_c = signal::ctrl_c().await;
+            })
+            .await
+    } else {
+        server.await
+    }
+}
+
 /// Read a port number from the `PORT` environment variable.
 ///
 /// Returns `None` when the variable is unset. Exits non-zero if the value

crates/trusted-server-adapter-axum/src/platform.rs

@@ -522,16 +522,13 @@ impl PlatformHttpClient for AxumPlatformHttpClient {
 ///
 /// # Degraded features in dev
 ///
-/// KV store is [`trusted_server_core::platform::UnavailableKvStore`] — any route
-/// touching synthetic-ID or consent KV will degrade gracefully. A `warn` log is
+/// The generic runtime KV slot uses
+/// [`trusted_server_core::platform::UnavailableKvStore`]. A `warn` log is
 /// emitted once per process.
 pub fn build_runtime_services(ctx: &edgezero_core::context::RequestContext) -> RuntimeServices {
     static KV_WARNED: std::sync::OnceLock<()> = std::sync::OnceLock::new();
     KV_WARNED.get_or_init(|| {
-        log::warn!(
-            "Axum dev server: KV store is unavailable (UnavailableKvStore). \
-             Routes that depend on synthetic-ID or consent KV will degrade gracefully."
-        );
+        log::warn!("Axum dev server: generic runtime KV is unavailable (UnavailableKvStore).");
     });
 
     let client_ip = edgezero_adapter_axum::context::AxumRequestContext::get(ctx.request())