[prk-Jr]

Summary

• Adds operator tooling to verify server-side ad-template ([creative_opportunities]) configuration: static path/slot diagnostics via ts config ad-templates …, and browser-backed live verification via ts audit … (local Chrome/Chromium over CDP).
• Adds ts audit ad-templates generate <url> to bootstrap [creative_opportunities] from a live site. One run crawls the publisher's sections (sitemap via robots.txt, else navigation links), samples a landing page and an article per section, reconciles each slot across the pages it appeared on, and writes the result into an existing trusted-server.toml in place, preserving every other section and comment.
• Where the evidence proves it, the run infers a {network_id}/{section} ad-unit template plus the section_root/section_segment policy it depends on, instead of pinning each slot to the one literal path it happened to be scraped from. A wrong template makes a publisher bid against inventory that does not exist, so inference refuses rather than guesses — see the table below.
• Everything the run writes is validated before it replaces the file, on the --dry-run path too. The candidate is deserialized as TrustedServerAppConfig and checked through TrustedServerAppConfig::new, the push-time validation path. This checks slot/template compilation, provider configuration, and secret-store key references without I/O. Resolved secret values are checked separately at runtime. Parse/schema failures report safe location or context without source excerpts or invalid values. Deploy-validation failures report a generic phase-level error because their detailed messages can contain literal values. This applies to both candidate refusal and pre-existing-baseline warnings.
• Lets publishers catch slot/config drift before deploy — match a path to configured slots, assert expected slots in CI, explain runtime ad-stack gating, and confirm configured slots actually render (DOM/GPT/APS evidence) on live pages.
• Keeps the CLI host-only: browser deps (chromiumoxide) are excluded from the wasm32-wasip1 build, and the runtime ad-stack gate is shared with publisher.rs so the CLI cannot drift from server behavior.

Stacks on the EdgeZero CLI base (server-side-ad-templates-impl). After merging the base back in, the diff against it is feature-only.

Behavior change: bare ts audit <url> remains a hidden alias for ts audit generate <url>; the base branch's draft-artifact generation moved to the explicit ts audit generate <url>.

Deploy ordering — read before pushing generated config. A config carrying section_root or section_segment is not rollback-safe. CreativeOpportunitiesConfig is deny_unknown_fields, so a binary predating ad-unit templating (cee1e20e) rejects the entire Settings load — not just the ad-template section — and every route serves an error. Deploy the template-aware binary first, then push, and do not roll that binary back while the config is live. A run that did not template writes neither key and leaves the config exactly as rollback-safe as it was. The command prints this warning itself.

closes #701

Registry and slot matching

Generation stops its final GPT wait after two consecutive empty snapshots. A nonempty registry needs the configured dwell window; late bursts reset that window. Initial settling, optional post-scroll settling, and GPT polling share one settle budget, with GPT receiving at least --settle-quiet-ms plus two 250ms poll intervals even when preceding phases exhaust it. This gives an already-stable registry time to establish a repeat and finish its dwell before the deadline. Later changes or slow browser reads can still leave incomplete nonempty evidence, which retains its warning. GPT polling precedes metadata extraction, so DOM, script, and network snapshots reflect the post-GPT-wait page. An exhausted post-scroll budget reports a skipped wait rather than a timeout.

A concrete slot written from one page remains literal evidence when another page refuses its stem, keeping sibling slots separate and preventing unintended floor-price inheritance. Split warnings identify only the longest matching configured ancestor. Consonant-only placement abbreviations remain a documented limitation of the random-suffix heuristic.

Artifact generation also retains disabled JavaScript asset-proxy candidates and their summary counts alongside discovered ad-template slots.

Changes

Area	Change
trusted-server-core/src/creative_opportunities.rs	[creative_opportunities] config types, match_slots, shared evaluate_ad_stack_gate; compile_page_pattern as the single glob definition; derive_section made public so tooling checks inference against the runtime's own derivation rather than a second implementation
trusted-server-core/src/publisher.rs	Route should_run_server_side_ad_stack through the shared gate (behavior-preserving)
trusted-server-cli/src/commands/config/ad_templates.rs	ts config ad-templates {lint,match,check,explain} static diagnostics
trusted-server-cli/src/app_config.rs	Shared effective app-config loader for the config + audit commands
trusted-server-cli/src/ad_templates/{expected,compare,output}.rs	Pure expected-slot projection, DOM/GPT/APS evidence comparison, stable JSON model, terminal-safe text escaping
trusted-server-cli/src/commands/audit/{mod,page,collector,browser,ad_templates}.rs, commands/audit/ad_template_collector.js	ts audit page + ts audit ad-templates verify: chromiumoxide collector, read-only GPT/APS/DOM init script, verifier orchestration, cross-origin refusal
trusted-server-cli/src/commands/audit/generate/crawl_plan.rs	New. Turns links and sitemap entries into a bounded page set — one landing page and one article per section, ranked by nav/sitemap corroboration, capped by section and page budgets, same-origin enforced on both sources
trusted-server-cli/src/commands/audit/generate/evidence.rs	New. Cross-page slot evidence: formats unioned, divergent unit paths retained, network ids required to agree, and detection of one placement fragmented across per-render div ids
trusted-server-cli/src/commands/audit/generate/unit_template.rs	New. {network_id}/{section} inference with positional network binding, a single-varying-segment rule, the witness rule, and replay through the runtime's own renderer
trusted-server-cli/src/commands/audit/generate/page_patterns.rs	New. Expands observed paths into per-section glob pairs (/news and /news/*) without extrapolating past a witnessed section
trusted-server-cli/src/commands/audit/generate/validate.rs	New. Write-side gate: the candidate config must pass TrustedServerAppConfig::new source-config validation before it replaces the file; a pre-existing failure downgrades to a warning so an already-broken config can still be updated
trusted-server-cli/src/commands/audit/generate/{mod,gpt_slots}.rs	Crawl orchestration, challenge-rate refusal, per-page diagnostics; slot reconstruction from live GPT plus normalization of ephemeral div-id noise (React _R_/_r_ ids, -container, hex UUIDs)
trusted-server-cli/src/commands/audit/generate/{browser_collector,collector,analyzer}.rs	Batch collection on one reused browser, hydrated-DOM link extraction, in-page sitemap fetch, device profiles, request pacing, consent answering, proxy support; GPT slot reads wait for the registry to hold still for the settle-quiet window, within the remaining settle budget or minimum of the quiet window plus 500ms, reporting partial evidence when stabilization cannot finish
trusted-server-cli/src/run.rs, src/lib.rs	Command wiring and parser tests for the audit namespace
trusted-server-cli/Cargo.toml	Host-only edgezero-core + serde_json deps (cfg-gated off wasm, like the existing browser deps)
docs/guide/cli.md	ts audit ad-templates generate documented: crawl behavior, refusal table, consent platforms, proxy auditing, the deploy-ordering contract, and generation’s shared settle budget with GPT stabilization before metadata extraction
docs/superpowers/{specs,plans}/2026-06-26-server-side-ad-template-cli*	Design spec and implementation plan

Test plan

Per CLAUDE.md, a bare cargo test/cargo clippy --workspace fails at the workspace root — the repo has multiple wasm runtimes with runtime-specific SDKs, so the target-matched aliases are the real gate.

• cargo fmt --all -- --check
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo clippy -p trusted-server-cli --target <host-triple> --all-targets --all-features -- -D warnings
• cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spin
• cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity (13 passed)
• Host CLI tests: cargo test -p trusted-server-cli --target <host-triple>
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1 (plus cargo build -p trusted-server-cli --target wasm32-wasip1 — browser deps stay out of wasm)
• Chrome-gated browser fixtures (./scripts/test-cli.sh) for evidence collection, scroll-phase attribution, and GPT registry stability — including a fixture whose second registration burst lands on a real timer
• Manual: full crawl against a live publisher through ts dev proxy — template and section policy inferred, per-render div-id fragments refused, generated config loads through Settings::from_toml

Generation command-path tests cover malformed TOML and creative-section values, with and without --dry-run, asserting safe errors and unchanged files. Browser-backed command tests also exercise deploy-validation refusal and baseline warnings in both write and dry-run modes; the CI helper runs these explicitly. The exhausted-budget Chrome fixture exposes its second batch on the second read; separate fixtures retain timer-driven registration coverage.

Notable fixture-based coverage, all offline: crawl planning (cross-origin rejection on links and sitemap entries, utility/asset filtering, query/fragment collapsing, budget truncation), evidence reconciliation (format union, network-id conflict, fragment detection with a co-occurrence false-positive guard), and one test per template-inference refusal case.

How to use

Static ts config ad-templates … commands only read local effective config (no browser). Browser-backed ts audit … commands launch a local Chrome/Chromium.

Configure slots

In your (gitignored) trusted-server.toml — fictional values shown:

[creative_opportunities]
gam_network_id = "123"
section_root = "homepage"     # required when a template uses {section}

[[creative_opportunities.slot]]
id = "atf"
gam_unit_path = "/{network_id}/news/{section}"   # or a literal path
div_id = "ad-atf-"            # treated as a prefix; matches e.g. ad-atf-0
page_patterns = ["/", "/news", "/news/*"]
formats = [{ width = 300, height = 250 }]

# optional provider hints
[creative_opportunities.slot.providers.aps]
slot_id = "atf"

Generate slots from a live site (needs local Chrome/Chromium)

# Crawl the site's sections and write [creative_opportunities] in place
ts audit ad-templates generate https://www.example.com/

ts audit ad-templates generate https://www.example.com/ --dry-run    # preview, no write
ts audit ad-templates generate https://www.example.com/ --replace    # overwrite instead of merge

# Bound the crawl
ts audit ad-templates generate https://www.example.com/ --max-sections 20 --max-pages 41
ts audit ad-templates generate https://www.example.com/ --max-pages 1   # single page, as before

# Set the patterns yourself; disables pattern inference
ts audit ad-templates generate https://www.example.com/ \
  --page-pattern '/' --page-pattern '/news' --page-pattern '/news/*'

# Check whether the publisher splits ad units by device
ts audit ad-templates generate https://www.example.com/ --profiles desktop,mobile

# Behind bot protection: carry a session, pace the crawl, or use a visible browser
ts audit ad-templates generate https://www.example.com/ \
  --cookie '<NAME>=<VALUE>' --page-delay-ms 1500
ts audit ad-templates generate https://www.example.com/ --headful

Re-running merges: a slot seen again keeps its hand-tuned fields and gains this run's patterns and newly observed formats, and a hand-written gam_unit_path template is preserved. --replace discards existing slots, including any template written by hand.

Consent platforms. Publishers gate slot definition behind their consent platform, and the audit runs in a throwaway profile with no consent cookie — so such a site would define no slots at all and look identical to a site with no ad stack. The crawl therefore answers the two IAB interfaces every compliant platform exposes (TCF v2 and US Privacy) as a consenting, out-of-scope reader, before any page script runs. This changes only what the audit browser sees. --no-assume-consent observes the un-consented page instead.

Auditing a production hostname served locally. ts dev proxy serves a production hostname from a local Trusted Server; auditing through it keeps the page's origin, cookie scope, and any origin checks in the ad stack matching production rather than localhost:

ts dev proxy --map www.example.com=127.0.0.1:7676 --upstream-plaintext --rewrite-host

ts audit ad-templates generate https://www.example.com/ \
  --browser-proxy 127.0.0.1:18080 --danger-accept-invalid-certs

Note that a local Trusted Server injects its own configured slots, so a run through the proxy can rediscover config it already has; slot ids absent from the current config are the publisher's own.

When generation keeps literal paths, and when it refuses

Situation	Result
Only one page was crawled	Literal path — one observation cannot distinguish a literal from a template
The ad unit never varied by section	Literal path
A section's slug is not derivable from its URL	Refused slot omitted; the failed round-trip is reported
No root page was seen, so section_root is unknown	Refused slot omitted rather than guessing a fallback
Two path segments could both be the section	No template; the ambiguity is reported
The unit varies by device, geo, or anything the URL cannot supply	Refused slot omitted with the conflicting evidence reported
Several slots are one placement under per-render div ids	Fragments reported and skipped, with the stable prefix they share
Crawled pages report different GAM network ids	Run fails — the pages are not one property
More than a quarter of crawled pages return no slots	Run fails — the signature of bot protection serving challenge pages

Static diagnostics (no browser)

# Summarize config + deploy-time implications
ts config ad-templates lint

# Which configured slots match a path (or full URL)
ts config ad-templates match /news/story --details

# CI assertion: exact expected slot set
ts config ad-templates check /news/story --expected-slot atf
ts config ad-templates check /weather --expect-no-slots
ts config ad-templates check /news/story --expected-slot atf --allow-extra-slots

# Explain the runtime ad-stack gates for a modeled request
ts config ad-templates explain /news/story --bot --consent-denied --prefetch

Browser-backed audit (needs local Chrome/Chromium)

# Generic read-only page summary
ts audit page https://www.example.com/

# Verify configured slots render on live pages (DOM/GPT/APS evidence)
ts audit ad-templates verify https://www.example.com/news/story
ts audit ad-templates verify https://www.example.com/news/story --json
ts audit ad-templates verify https://www.example.com/ --strict --scroll

# Carry a session past an origin challenge (repeatable)
ts audit ad-templates verify https://www.example.com/ --cookie '<NAME>=<VALUE>'

# Allow a known redirect between your own properties (e.g. apex → www)
ts audit ad-templates verify https://example.com/ --allow-cross-origin-redirect

# Point at a specific browser / tune settle timing
ts audit ad-templates verify https://www.example.com/ \
  --chrome /path/to/chrome --settle-quiet-ms 1000 --settle-max-ms 15000

Generation shares one --settle-max-ms budget across the initial settle, optional post-scroll settle, and GPT registry wait. Scrolling consumes the same budget. GPT receives the remaining budget or --settle-quiet-ms plus 500ms, whichever is greater. The minimum allowance includes time to establish a repeated reading and confirm a completed dwell before the deadline. It adds at most the quiet window plus 500ms to the shared settle allowance; later changes and slow browser reads can still produce partial evidence and a warning. DOM and network extraction follows GPT polling. Two consecutive empty polls end the registry wait early. Navigation, scrolling, and in-flight browser operations retain their own bounds, so this is not a total page deadline. Increasing --settle-max-ms can help, but continuously busy pages can consume it in initial settling and still leave GPT only its minimum polling allowance. Verification applies its settle budget separately to each page-settle phase and records slot definitions through its injected collector.

Shared config flags (all of the above)

--app-config <path>     # default: <app.name>.toml beside edgezero.toml
--manifest <path>       # default: edgezero.toml
--no-env                # skip the app-config environment overlay

Exit behavior

• Default verify is auditor-assist: exits 0 even with missing/partial evidence.
• --strict exits 1 when a confirmable matched slot is missing or partially confirmed; video, native, and out-of-page slots are unconfirmable and do not fail the gate. A page-level navigation failure, or a redirect that leaves the requested origin, also exits non-zero.
• Runtime gates (e.g. [auction].enabled = false) mark a page "skipped" so --strict does not fail it.

Local live test (deterministic, no external site)

Many large ad publishers block headless/non-evasive browsers, so verify against them sees a challenge page rather than the article (this tool does not evade bot detection — --cookie forwards a clearance a human already earned, and --headful runs a visible browser). When a page comes back without slots, the run now reports GPT's observable state — whether the library reached apiReady, how many queued commands never drained, how many scripts ran — which distinguishes "the library never loaded" from "this page has no ads".

To exercise the full pipeline reliably without an external site, serve a local fixture:

# 1. Fixture page that stubs just enough GPT (no network), served over HTTP
mkdir -p demo/news
cat > demo/news/story.html <<'HTML'
<!doctype html><html><head><meta charset="utf-8">
<div id="ad-atf-0"></div>
<script>
(function(){var s=[];var gt={cmd:[]};
gt.defineSlot=function(p,z,d){var o={getAdUnitPath:function(){return p},getSlotElementId:function(){return d},getSizes:function(){return z.map(function(x){return {getWidth:function(){return x[0]},getHeight:function(){return x[1]}}})}};s.push(o);return o};
gt.pubads=function(){return {getSlots:function(){return s}}};var op=gt.cmd.push.bind(gt.cmd);gt.cmd.push=function(c){op(c);c()};
window.googletag=gt;googletag.cmd.push(function(){googletag.defineSlot('/123/news/atf',[[300,250]],'ad-atf-0')});})();
</script></head><body></body></html>
HTML
(cd demo && python3 -m http.server 8771 &)

# 2. Verify against it (config from the example above, with page_patterns ["/news/*"])
ts audit ad-templates verify http://127.0.0.1:8771/news/story.html --json
#   => slots[0].status == "confirmed"

For a realistic end-to-end generation run, ts dev proxy in front of a local Trusted Server is the reliable path — see the proxy example above.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• No println!/eprintln! in library code (CLI output uses writeln!; errors use log)
• New code has tests
• No secrets or credentials committed

[aram356]

Correction to my previous review

My last review's blocking finding claimed the fixture server's HTML-for-every-path behavior caused a ~25% flake in waits_for_delayed_gpt_registry_to_stabilize_in_definition_order, citing a bisect where the parent passed 6/6 and the guard restored 10/10. That causal claim does not reproduce, and I withdraw it. Re-measured on an idle machine: the test fails 3/3 at this head (20-24s) and 2/2 at the previous head c18e59813 (14-20s), always with "timed out waiting for browser process to exit after audit" from browser.wait() (browser_collector.rs:490) rather than anything in the fixture path. The machine has Chrome running at 152.0.7977.76 against an installed framework at 152.0.7977.66 — a mid-flight browser update that postdates my original numbers. The failure is a load- and environment-sensitive problem in the child-process reap against the 5s BROWSER_CLOSE_TIMEOUT, not fixture routing.

The 404 guard is still a correct change on its own merits, and extending fixture_server_answers_every_speculative_browser_request to request /favicon.ico, /robots.txt, and /sitemap.xml and assert byte-exact 404s addresses the separate objection that the old test only proved connection reuse. It simply does not buy the stability I attributed to it. If the flake is worth chasing, the target is the browser.wait() reap path and its timeout — a separate concern from this commit, and not something I would hold this PR for.

Summary

Three of the five findings carried into this pass are resolved. The shared settle budget is implemented correctly: one Instant at browser_collector.rs:621, all three phases drawing from it, saturating_sub clamping at zero, no double-counting, and the zero-budget single-read path in poll_gpt_registry preserved so a spent budget still takes one snapshot. The two-empty-poll shortcut is now documented in cli.md:583-587, the flag help, and the rustdoc, and all three match the code — previous_empty is set on Empty and reset on both Changed and Repeated, so the exit genuinely requires two consecutive empties. The fixture acceptor now blocks in accept() with a wake-on-shutdown connect in Drop, with no shutdown race in either interleaving.

Requesting changes for one defect the shared clock introduced: an exhausted budget silently skips the post-scroll settle entirely and then reports a timeout that never happened.

Both inline suggestion blocks were verified in a scratch worktree, applied individually and together: cargo fmt --all -- --check, cargo clippy -p trusted-server-cli --all-targets --all-features -- -D warnings, and the full CLI suite (509 passed, 0 failed) all clean, with byte-exact drift checks.

Blocking

🔧 wrench

• Exhausted budget skips the post-scroll settle and reports a timeout that never occurred — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:642 (suggestion)

Non-blocking

🤔 thinking / ⛏ nitpick / 📝 note

• 🤔 Fixed-cost evidence reads sit inside the shared budget and starve the GPT phase — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:657
• ⛏ First saturating_sub is dead arithmetic — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:622 (suggestion)
• 📝 New zero-budget test is sound but silently coupled to quiet == max — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:2093
• 🤔 Vowel-gate residue remains, closed by concession — see inline at crates/trusted-server-cli/src/commands/audit/generate/gpt_slots.rs:321

Cross-cutting / body-level findings

• 📝 Squash-merge reminder. HEAD remains clean of real-world identifiers, but the branch's authored commits still carry customer names in their commit messages. A squash keeps them out of main's history.

CI Status

All 19 checks PASS at 5cefd4368, including the four required (cargo fmt, cargo test, format-typescript, format-docs): Analyze (actions / javascript-typescript ×2 / rust), CodeQL, browser integration tests, cargo check (cloudflare native + wasm32-unknown-unknown), cargo check/build/test (spin native + wasm32-wasip1), cargo test (axum native), cargo test (cross-adapter parity), cargo test (ts CLI, native), integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts, vitest.

Local verification at 5cefd4368: 504 passed, 0 failed, 14 ignored across the CLI lib and integration targets; clippy -D warnings clean; cargo fmt --all -- --check clean. Chrome-gated tests fail in teardown on this machine for the environmental reason described above, at this head and the previous one alike.

[aram356]

Summary

Review at cacfb7111, covering two authored commits: the settle-budget follow-up and the adaptation to main's provider-map and secret-reference config split.

Three of the four findings carried into this pass are resolved. The zero-budget post-scroll settle now emits a distinguishable "settle budget was exhausted" warning instead of a fabricated timeout, pinned by assertions in both scroll polarities; the dead saturating_sub is collapsed; and the test-coupling comment landed. The provider-map adaptation is faithful and, on the write-side gate, stronger than what it replaced: TrustedServerAppConfig::new keeps the full prepare_runtime slot and template compilation chain and adds compile_auction_plan plus per-integration deploy validation, while correctly dropping only validate_admin_handler_passwords, which would misread a secret-store key name as a weak password. Provider iteration is BTreeMap-ordered and escaped, and no secret value can reach output because the leaves are Redacted.

Requesting changes for two issues. The new config validator echoes raw source bytes on a parse error, which can be a literal secret. And the GPT settle phase still has no floor, so the knob that exists to fund it remains non-monotonic on exactly the pages this command targets.

Three inline suggestion blocks, each verified in a scratch worktree individually and as a batch: cargo fmt --all -- --check, cargo clippy -p trusted-server-cli --all-targets --all-features -- -D warnings, and the full CLI suite (511 passed, 0 failed) all clean, with byte-exact drift checks.

Blocking

🔧 wrench

• validate_source_config echoes raw config bytes, which can be a literal secret — see inline at crates/trusted-server-cli/src/commands/audit/generate/validate.rs:50 (suggestion)
• GPT settle phase still has no floor, so --settle-max-ms stays non-monotonic — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:663 (suggestion)

Non-blocking

🤔 thinking / ⛏ nitpick

• 🤔 The reorder silently moved the DOM and network snapshot point past the GPT dwell — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:691
• ⛏ Three dead .replace() no-ops survive in the diagnostics fixture — see inline at crates/trusted-server-cli/src/commands/config/ad_templates.rs:567 (suggestion)
• ⛏ Provider-map assertion covers neither ordering determinism nor the empty map — see inline at crates/trusted-server-cli/src/commands/config/ad_templates.rs:731
• ⛏ explain_keeps_provider_state_separate_from_runtime_verdict reads as self-contradictory — see inline at crates/trusted-server-cli/src/commands/config/ad_templates.rs:667
• ⛏ Ragged prose wrap in the edited docs paragraph — see inline at docs/guide/cli.md:580

Cross-cutting / body-level findings

• 📝 Squash-merge reminder. HEAD remains clean of real-world identifiers, but the branch's authored commits still carry customer names in their commit messages. A squash keeps them out of main's history.

CI Status

All 19 checks PASS at cacfb7111, including the four required (cargo fmt, cargo test, format-typescript, format-docs): Analyze (actions / javascript-typescript ×2 / rust), CodeQL, browser integration tests, cargo check (cloudflare native + wasm32-unknown-unknown), cargo check/build/test (spin native + wasm32-wasip1), cargo test (axum native), cargo test (cross-adapter parity), cargo test (ts CLI, native), integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts, vitest.

Local verification at cacfb7111: 511 passed, 0 failed, 9 ignored across the CLI lib and integration targets; clippy -D warnings clean; cargo fmt --all -- --check clean. The 9 ignored are the Chrome-gated set, which fails in teardown on this machine for the environmental reason described in the previous review (Chrome version skew against the 5s browser-close timeout), at this head and earlier ones alike.

[aram356]

Summary

Review at 24ac93f32, covering both authored commits.

Five of the seven findings carried into this pass are resolved: the dead .replace() no-ops are gone, provider-map ordering is now genuinely pinned (the second provider is injected after the first in source order, so the assertion tests BTreeMap sorting rather than input order) with new empty-map coverage for both the (none) and the empty-providers status branches, the load-bearing toml::Value round-trip is explained, and the DOM/network snapshot-point change is documented in the code comment, in cli.md, and pinned by new positive assertions. The prose wrap is fixed.

The GPT budget floor is load-bearing rather than decorative: removing it drops the Chrome fixture from two collected batches to one. The #poll-driven fixture change is a legitimate conversion from a wall-clock race to a read-count-driven shape, and the warning assertion still holds for the right reason. The new tests/audit_config_diagnostics.rs is a real regression guard, verified by reverting each of creative_config's sanitization branches independently and watching it fail.

Both remaining blockers originate in my own suggestion bytes from the previous round, not in a misreading of them. The first sanitized only half of validate_source_config and carried the leaking half forward verbatim. The second floored the GPT budget one poll interval short of what a dwell actually needs. The author implemented exactly what I gave them in both cases; the corrections are below.

Two inline suggestion blocks, each verified in a scratch worktree individually and together: cargo fmt --all -- --check, cargo clippy -p trusted-server-cli --all-targets --all-features -- -D warnings, and the full CLI suite (516 passed, 0 failed) all clean, with byte-exact drift checks.

Blocking

🔧 wrench

• Deploy-validation errors still echo literal config values — see inline at crates/trusted-server-cli/src/commands/audit/generate/validate.rs:50 (suggestion)
• The quiet-window floor can never complete a dwell, so an exhausted budget always warns — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:664 (suggestion)

Cross-cutting / body-level findings

• 📝 Follow-up worth filing rather than fixing here. The cleanest fix for the value echo is upstream in trusted-server-core/src/config.rs: have the configuration-validation error render field paths without validator's params map, so every caller gets a useful diagnostic that cannot carry a secret. The CLI-side sanitization suggested inline is the contiguous change available within this PR's diff, and it costs the field path. If you would rather keep the paths, make the upstream change instead and leave validate.rs alone.
• 📝 Squash-merge reminder. HEAD remains clean of real-world identifiers, but the branch's authored commits still carry customer names in their commit messages. A squash keeps them out of main's history.

CI Status

All 19 checks PASS at 24ac93f32, including the four required (cargo fmt, cargo test, format-typescript, format-docs): Analyze (actions / javascript-typescript ×2 / rust), CodeQL, browser integration tests, cargo check (cloudflare native + wasm32-unknown-unknown), cargo check/build/test (spin native + wasm32-wasip1), cargo test (axum native), cargo test (cross-adapter parity), cargo test (ts CLI, native), integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts, vitest.

Local verification at 24ac93f32: 481 passed, 0 failed, 9 ignored at unmodified HEAD; 516 passed with both suggestions applied; clippy -D warnings clean; cargo fmt --all -- --check clean. The ignored set is Chrome-gated and fails in teardown on this machine for the environmental reason described in an earlier review, at this head and earlier ones alike.

[aram356]

Summary

Both blocking findings from the previous round are resolved, and I verified each independently rather than from the diff.

Deploy-validation output. Both error arms of validate_source_config are sanitized, and the misleading "not valid TOML" wording for schema errors is gone. Probed end to end through the real ts binary across five failure shapes: the raw core errors still embed literal values (a #[validate(url)] field yields {"value": String("SENTINEL_URL")}), while CLI stderr, stdout, and notes are clean in both the refusal and the warning path. The coverage gap that let this half slip through last round is closed and provably so: reverting the one-line sanitization fails one unit test and both browser-gated integration tests.

GPT dwell floor. Now settle_quiet + 2 * SETTLE_POLL_INTERVAL behind a documented gpt_polling_budget helper. An independent probe against a registry that never changes, with the shared budget exhausted, returns warned=false at every quiet value from 100ms to 3000ms, versus warned=true at every value before. Common-case wall time is unchanged at quiet + 250ms, since the loop returns the moment the dwell completes, and the per-page bound stays flat rather than multiplying with phase count. The coupled Chrome test moved from a 600ms to an 1100ms budget assertion without losing any of its four assertions, and two new unit tests preserve the negative case so the floor cannot have simply muted the warning.

New work in a5da1b89d. The ordering fix is correct and both halves are load-bearing. Reverting the collector guard reproduces the masked diagnostic, refusing cross-origin root redirect from https://example.com to null, which told operators to change their URL when the browser had never reached the network; reverting the mod.rs half replaces the specific cause with the generic missing-root error. All four navigation branches check out, and neither new message interpolates a URL that could carry credentials.

CI wiring. scripts/test-cli.sh is invoked at .github/workflows/test.yml:99 and :239 with Chrome provisioned, both new filters resolve to real tests, and the script's zero-match guard means a renamed test cannot silently stop being exercised.

Approving. Two non-blocking observations are inline, plus one follow-up below.

The inline suggestion was verified in a scratch worktree: cargo fmt --all -- --check, cargo clippy -p trusted-server-cli --all-targets --all-features -- -D warnings, and the full CLI suite (520 passed, 0 failed) all clean, with a byte-exact drift check.

Non-blocking

• 🤔 Failed navigation burns the settle budget before the guard fires — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:686
• ⛏ Orphaned short line in the reflowed doc comment — see inline at crates/trusted-server-cli/src/commands/audit/generate/browser_collector.rs:1046 (suggestion)

Cross-cutting

• 📝 Follow-up worth filing, not fixing here. The CLI now trades the failing field path for safety, which the code's doc comment acknowledges honestly. The real fix belongs upstream in crates/trusted-server-core/src/config.rs: render field paths without validator's params map, so every caller gets a diagnostic that names the field and cannot carry a value. That would let this CLI path report the field again.
• 📝 Squash-merge reminder. HEAD is clean of real-world identifiers, but the branch's authored commits still carry customer names in their commit messages. A squash keeps them out of main's history.

CI Status

All 20 checks PASS at 66d1b8022, including the four required (cargo fmt, cargo test, format-typescript, format-docs).

Local verification at 66d1b8022: 482 passed / 0 failed / 9 ignored in the CLI lib target plus the integration binaries; 520 passed with the suggestion applied; clippy -D warnings clean; cargo fmt --all -- --check clean. Two Chrome-gated tests were run directly and passed, exhausted_page_settle_budget_still_polls_gpt_registry and generate_unavailable_proxy_reports_navigation_failure, without hitting the teardown signature seen on this machine in earlier rounds.