Consolidate request timing and GPT diagnostics

.gitignore

@@ -63,3 +63,7 @@ src/*.html
 # leftover local build artifacts (node_modules, target, dist) that remain on disk.
 /crates/js/
 /crates/integration-tests/
+
+# Wrangler config rendered by the Cloudflare integration-test harness from
+# wrangler.ci.toml for CI or test-specific configuration overrides.
+wrangler.integration.generated.toml

CHANGELOG.md

@@ -9,6 +9,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Access telemetry v2 now uses `auction_collected_ms` for collection return, sets `ts_version` to the TS build identifier matching `x-ts-version`, and adds `delivery_result` for local complete/partial/error transport handoff. It does not establish client receipt. Coordinate any deployed preview v2 schema before updating the producer.
+- Access ingestion now dispatches without waiting for Tinybird's reply. Start failures are reported; later transport errors, non-2xx responses and remote ingestion acceptance are unobserved, with no retry.
+- `/auction`, page-bids and HTML collectors share measured collection waits and outcome mapping. Real mediator-only work can have collection/wait/commit timing without a provider dispatch offset; routing and admission still decide whether any request is sent.
+- Prebid diagnostics listener, targeting and correlation code now lives in the optional diagnostics bundle. Badge evidence passes clicks through, its small control sits outside observed creative bounds, and selecting the latest request no longer opens history.
+
+- Auction telemetry failure batches for `/auction` and page-bids now include provider launch-failure rows alongside the summary, so a failed dispatch can emit more than one row. `/auction` summary `elapsed_ms` now uses the orchestrator's elapsed time.
+- GPT diagnostics JSON exports now include bounded server winner and Prebid candidate/win bidder codes and bucketed `hb_pb` values. These observations do not establish which creative GAM ultimately served; raw CPM and creative markup remain excluded.
+- The Axum dev server now runs its own serve loop to apply terminal request-timing handling.
+- The default `tinybird.access_dataset` is now `access_logs_v2`. Since this field is serialized, an upgrade from TOML that omits it may produce a one-time config-envelope diff; review and push once to settle it. Explicit legacy dataset values must be changed before enabling access telemetry.
 - **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.
 - **Breaking:** `ts prebid bundle` is now `ts prebid client`, alongside the new `ts prebid server` namespace. Update scripts and runbooks to use `ts prebid client` with the same arguments. The old `bundle` spelling is no longer accepted and has no compatibility alias.
 - The S2S `/_ts/api/v1/batch-sync` endpoint now validates the full batch and calls the CAS-protected update path once per distinct normalized EC ID. The last valid UID wins within a group, and infrastructure failures reject the failing and each unprocessed group, so accepted and `kv_unavailable` input indexes may interleave.
@@ -43,6 +52,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added opt-in request-phase `Server-Timing` on private Fastly/Axum responses and sampled post-delivery Fastly access telemetry. Deploy the new `access_logs_v2` datasource and its scoped APPEND token before enabling access emission; the legacy `access_logs_raw` schema and data remain unchanged. Access rows retain bounded route templates and coarse operational dimensions for 30 days, with random UUID joins for active auction observations and null UUIDs for disabled auctions. Each row stores its sampling rate. Access ingestion waits after delivery and can delay the next request in a reused Fastly sandbox. Before rolling back to an older binary, disable access emission, remove non-default `[observability]` config, and re-push; access-only deployments must also disable the Tinybird master switch. See the telemetry guide and Tinybird cutover runbook.
 - Added the `[auction].rewrite_creatives` (default `true`) and `[auction].sanitize_creatives` (default `false`) options. `rewrite_creatives` rewrites winning-bid adm to first-party endpoints across `POST /auction` and publisher SSAT/page-bids delivery (proxy/click URL conversion, bidder `<base>` removal; creative TSJS injection on `POST /auction` only). Enabling `sanitize_creatives` strips executable markup from winning-bid adm before delivery.
 - `creative_opportunities.slot.gam_unit_path` is now a template supporting `{network_id}`, `{slot_id}`, and `{section}`, so a publisher whose ad unit varies by site section expresses it in one slot rule instead of one per (slot × section). `{section}` derives from the request path: `[creative_opportunities].section_segment` selects which path segment names the section (0-based, default `0`; set `1` for locale-prefixed URLs), and `section_root` supplies the value for paths with no such segment. `section_root` is required when a template uses `{section}`. Existing static and absent `gam_unit_path` configs are unchanged. Startup rejects a blank `gam_network_id` only when an absent/default path or `{network_id}` template consumes it. Trusted Server conservatively caps whole rendered dynamic paths at 100 UTF-8 bytes, informed by Google's 100-character per-ad-unit-code limit; an over-limit request-specific path omits that slot without failing the response. During typed/startup finalization, every placeholder-bearing template that omits `section_segment` materializes `section_segment = 0`, so an older binary rejects the blob loudly. Static and absent paths remain legacy-schema compatible only when both `section_root` and `section_segment` are omitted. Before rolling back below this feature, replace or remove dynamic paths, remove both keys, re-push and finalize the config, then roll back the binary.
 - Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.

Cargo.toml

@@ -56,12 +56,14 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "683202c66948146ec360f490126f1d60f920288b", default-features = false }
+# Temporary integration pin for EdgeZero PR #389. Before merging TS into main,
+# replace all six pins with the approved EdgeZero release tag and revalidate.
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "ab444946fcacb1d44c020c6079abb6ba29231402", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"

crates/trusted-server-adapter-axum/Cargo.toml

@@ -20,14 +20,16 @@ path = "src/main.rs"
 
 [dependencies]
 async-trait = { workspace = true }
+axum = { workspace = true }
 edgezero-adapter-axum = { workspace = true, features = ["axum"] }
 edgezero-core = { workspace = true }
 error-stack = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
 reqwest = { workspace = true }
 simple_logger = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "signal", "sync", "time"] }
+tower = { workspace = true, features = ["util"] }
 trusted-server-core = { workspace = true }
 
 [dev-dependencies]
@@ -36,4 +38,3 @@ axum = { workspace = true }
 base64 = { workspace = true }
 temp-env = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-tower = { workspace = true, features = ["util"] }

crates/trusted-server-adapter-axum/src/app.rs

@@ -1,6 +1,7 @@
 use core::future::Future;
 use std::sync::Arc;
 
+use edgezero_adapter_axum::service::EdgeZeroAxumService;
 use edgezero_core::app::Hooks;
 use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
@@ -615,16 +616,10 @@ impl Hooks for TrustedServerApp {
         "TrustedServer"
     }
 
+    /// Returns the bare router without terminal timing; serve with
+    /// [`Self::dev_server_service`] to preserve `Server-Timing` emission.
     fn routes() -> RouterService {
-        let state = match build_state() {
-            Ok(s) => s,
-            Err(ref e) => {
-                log::error!("failed to build application state: {:?}", e);
-                return startup_error_router(e);
-            }
-        };
-
-        build_router(&state)
+        Self::routes_with_server_timing_flag().0
     }
 }
 
@@ -646,6 +641,43 @@ impl TrustedServerApp {
         Ok(build_router(&state))
     }
 
+    /// The dev server's fully configured tower service: the application
+    /// router wrapped in the terminal timing layer
+    /// ([`crate::timing::TimingService`]), with `server_timing_enabled`
+    /// read from the same settings snapshot that built the router.
+    ///
+    /// This is the standard construction path for serving this adapter.
+    /// [`Hooks::routes`] satisfies the `Hooks` trait contract and returns
+    /// the bare router without the timing layer; callers who serve traffic
+    /// should use this instead so `server_timing_enabled` is never
+    /// silently discarded.
+    #[must_use]
+    pub fn dev_server_service() -> crate::timing::TimingService<EdgeZeroAxumService> {
+        let (router, server_timing_enabled) = Self::routes_with_server_timing_flag();
+        crate::timing::TimingService::new(EdgeZeroAxumService::new(router), server_timing_enabled)
+    }
+
+    /// Build the router alongside whether `Server-Timing` emission is
+    /// enabled, read from the same settings snapshot used to build the
+    /// router.
+    ///
+    /// The Axum dev server's terminal timing layer ([`crate::timing`]) needs
+    /// this flag once at startup. The Axum dev server builds its application
+    /// state once and reuses the same [`RouterService`] for every request.
+    #[must_use]
+    fn routes_with_server_timing_flag() -> (RouterService, bool) {
+        let state = match build_state() {
+            Ok(s) => s,
+            Err(ref e) => {
+                log::error!("failed to build application state: {:?}", e);
+                return (startup_error_router(e), false);
+            }
+        };
+
+        let server_timing_enabled = state.settings.observability.server_timing_enabled;
+        (build_router(&state), server_timing_enabled)
+    }
+
     /// Build the full router with explicit settings and runtime services.
     ///
     /// Each request receives a clone of the supplied services, allowing callers

crates/trusted-server-adapter-axum/src/lib.rs

@@ -10,3 +10,6 @@ pub mod app;
 pub mod middleware;
 /// Platform-trait implementations backed by env vars and `reqwest`.
 pub mod platform;
+/// Terminal timing layer wrapping the Axum dev server's tower `Service`
+/// boundary with the request-phase `Server-Timing` freeze point.
+pub mod timing;