[jwrosewell]

This description was updated on 7 October 2026, and on 8 October for the merge of main at 182fdf4. The branch now carries
the refreshed client-set Edge Cookie value path (#1046 at 9a37728) and,
through it, main at 182fdf4. Since the last version of this text:

1. What an operator selects is a module, and a module is named by its
   crate folder. The guides and the example settings read [ec] module,
   [device] module, [geo] module and [permission-signal] modules, the
   environment override examples read TRUSTED_SERVER__EC__MODULE,
   TRUSTED_SERVER__DEVICE__MODULE and TRUSTED_SERVER__GEO__MODULE, and
   the prose says module wherever it meant an Edge Cookie, device, geo or
   permission signal module. The configuration guide states the name rule
   (a name is parts joined by ., each of lower case letters, digits, _
   or -, and a module from a crate is named by its folder below crates/,
   written in full, as edgecookie.<name>, or with that type folder left
   off), and the permission signals guide lists the modules by those names,
   gpc, gpp, us-privacy, tcf and mtm.
2. The guides describe what the refreshed pull requests below now do: a
   resolve_allowed_origins entry must be a bare origin and is refused
   otherwise, the old client-fixed spelling is no longer refused by name,
   the batch-sync ec_id field is the full value as issued
   (hmac~{64hex}.{6alnum}, with the bare form still accepted), and the
   Edge Cookie guide carries main's text on grouped batch-sync mappings
   and on the completion markers that keep a stale read from rewriting a
   withdrawal.
3. The evidence module keeps the HostSignals trait at the top of the file,
   as this pull request moved it, and the no-client-IP test says module.
4. The Edge Cookie guide describes the permission model as it is. It
   still said that an unknown country falls back to a configured default
   country and that only the storage permission is resolved from a TCF
   signal. It now says that the baseline on the top node of the rules tree
   applies, that every permission is resolved from that baseline and the
   signal modules in the configured order, and that a failed location
   lookup resolves at the requires-signal floor. The setup guide describes
   the bare identifier form as a value with no module prefix.

The commits since the last version are 3c77e44 (the merge of #1046 at
ff56a5f), caccf8d (the documentation set says module), ecb5fb7 (the
merge of #1046's conflict-test fix at 17fd681) and 30fbc6d (the merge of
#1046's inspector lockfile fix at e3aeeba, which names the icu_provider
crate again), then on 7 October 833089e (the merge of #1046 at 9a37728,
which brings the module name rule), 93af3ea (the configuration guide
states the module name rule), 327211c (the merge of #1046 at 6b9f52b),
f220687 (the Edge Cookie guides describe the permission model as it is)
and 1f31ba5 (the merge of #1046 at 59660c4, which brings #1043's wording
of the identity graph's comments as device records, not person records).

Stacks on the client-set Edge Cookie value path (#1046), and depends on #1043
to #1046 together, because this pull request documents what they build. The
stack has six pull requests (#1043, #1044, #1045, #1046, #1047, #1094), each
targeting main, with this one fifth and the last of the five that decompose
the module work in #838, as requested in the #986 review.
Compare split/4-client-resolve with split/5-response-hook-docs
to see only this pull request's change.

The design specs for the series are carried by the spec pull request (#1084),
including the two this pull request used to carry:

• 2026-07-30-provider-migration-rollout-design.md,
  the migration and rollout draft revised against the implemented series. Its
  sign-off ledger is kept intact, with each row the series implements marked
  with its pull request, so the task force can ratify rows rather than argue
  them again.
• 2026-07-30-integration-response-header-hook-design.md,
  kept as the design bar for the response-header hook. The hook itself is not
  in this series.

What this pull request does

• The IntegrationResponseMutator response-header hook that an earlier version
  of this pull request added is not in the series. The hook had no consumer,
  and the spec set's own rule is against speculative surface. The hook returns
  with the first integration that needs one, and its spec is the starting bar
  for that design.
• docs/guide/configuration.md
  gains the [ec] module selector with its [ec.hmac] and
  [ec.host_signals] tables, the [device] and [geo] selectors, the
  implementation line, the assume_single_jurisdiction acknowledgment, the
  requires-signal floor on a failed geo lookup, the bare-origin rule for
  resolve_allowed_origins, and a section on the country and region rules in
  permissions.yaml. It also says what stops a deployment, being a table the
  selector does not name, a name this build does not have, a name that is
  not a module name, and a setting the module does not know.
• The Edge Cookie guide
  (docs/guide/ec-setup-guide.md)
  is rewritten around modules and the permission model, including the narrow
  withdrawal rules, the hardened resolve endpoint and the resolved-marker
  cookie. The setup guide, API reference, error reference, Fastly guide and
  key-rotation guide are updated to match.
• trusted-server.example.toml
  adds a commented [ec.host_signals] block and rewrites the [device] and
  [geo] comments to say what each default does and how to override it.
• CI runs the Axum and Cloudflare jobs in
  .github/workflows/test.yml
  on windows-latest as well as ubuntu-latest, and the Axum job also runs
  the core library's unit tests natively, because on the WebAssembly targets
  the test harness stops at the first failing test and reports the rest as
  never run.
• Two small code changes come with the documentation. A test in
  crates/trusted-server-core/src/ec/mod.rs
  checks that a module receives the empty string as the client IP when the
  host cannot determine one, and
  crates/trusted-server-core/src/evidence.rs
  corrects its module documentation and moves the HostSignals trait to the
  top of the file.

What happens to #838

Once the five pull requests that decompose #838 merge, #838 is closed. It stays
open as a draft reference for the review period only.

How it was verified

The head this pull request shows now is 3c7ef00e7, which merges #1046 at e7623de78 and, through it, main at 182fdf4 into 1f31ba53e. The merge brings the ts dev lint domains and ts dev install-hooks commands (#733) and a design document (#930), and changes none of this pull request's own code. No dependency of core or of an adapter changed version, and the one line of core the merge touches gains a comment. On 3c7ef00e7 these ran locally on Windows: cargo fmt --all --check, a locked dependency check (cargo tree --locked) and the core suite natively (3,140 tests).

1f31ba53e adds to 93af3ea2b
two merges of #1046, which bring comment and guide wording, the identity
graph's comments, one doc comment and one test, and one commit to two guide
pages. On 1f31ba53e these ran
locally on Windows: cargo fmt --all --check, Clippy with warnings denied on
all four adapters and the five permission signal crates, the core suite
natively (3,140 tests), the five permission signal crates' own tests
(55 tests), and the docs lint, Prettier (inside docs/ and over the Markdown
outside it) and VitePress build. The wider set last ran locally on
9a3772871, the head of #1046 that the earlier merge brought, being the core
suite under Viceroy (3,377 across the test binaries the Fastly alias runs),
the Axum (123 tests, the five permission signal crates included), Cloudflare
(56) and Spin (90) adapter suites, the cross-adapter parity suite (17) and
the permissions inspector's wasm build, and CI runs all of them on this
head. The CLI tests, the browser integration tests and the Fastly Edge
Cookie lifecycle test run only in CI.

CI on 3c7ef00e7: every check passes, being Run Tests, Run Format, Integration Tests, Permissions Inspector and CodeQL Advanced, with the Fastly Edge Cookie lifecycle test in the integration run. There are 22 checks rather than the 20 the earlier
pull requests run because this one puts the Axum test job and the Cloudflare
check job on a [ubuntu-latest, windows-latest] matrix.

References #777 and #778. Decomposes #838. Spec baseline from #986.

[aram356]

The sequencing discussion for this series is on #1084. This PR is superseded rather than rejected. The design in §3.6 is accepted and most of the provider work carries over onto the reordered base. See #1084.

[jwrosewell]

Moved into this repository as #1347, one branch of the stack, so the review continues there. This pull request is closed in its favor and its comments stay here for the record.