Add the permission model with the Privacy Taxonomy vocabulary

.cargo/config.toml

@@ -36,10 +36,12 @@ test-fastly = "test -p trusted-server-core -p trusted-server-adapter-fastly -p t
 test-fastly-reuse = "test -p trusted-server-adapter-fastly --target wasm32-wasip1 --features reusable-sandbox"
 
 # --- Axum adapter (native dev server) ---
+# Test and clippy also cover the permission signal crates, whose own tests
+# run with the Axum adapter in CI.
 build-axum = "build -p trusted-server-adapter-axum"
 check-axum = "check -p trusted-server-adapter-axum"
-clippy-axum = "clippy -p trusted-server-adapter-axum --all-targets --all-features -- -D warnings"
-test-axum = "test -p trusted-server-adapter-axum"
+clippy-axum = "clippy -p trusted-server-adapter-axum -p trusted-server-permission-signal-gpc -p trusted-server-permission-signal-gpp -p trusted-server-permission-signal-mtm -p trusted-server-permission-signal-tcf -p trusted-server-permission-signal-us-privacy --all-targets --all-features -- -D warnings"
+test-axum = "test -p trusted-server-adapter-axum -p trusted-server-permission-signal-gpc -p trusted-server-permission-signal-gpp -p trusted-server-permission-signal-mtm -p trusted-server-permission-signal-tcf -p trusted-server-permission-signal-us-privacy"
 
 # --- Cloudflare adapter (native host + wasm32-unknown-unknown) ---
 # Build/check target the WASM runtime (requires the `cloudflare` feature);

.claude/skills/deploying-trusted-server-to-fastly/SKILL.md

@@ -28,7 +28,7 @@ For each shared-name store a service needs:
    `fastly resource-link create --service-id <SID> --version <v> --resource-id <store-id> --name trusted_server_config`
 3. Push config into the scoped store with the name override, so the write cannot
    land in the shared default:
-   `EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=<service>_ts_config ts config push --adapter fastly --app-config <file>`
+   `EDGEZERO__STORES__CONFIG__TRUSTED_SERVER_CONFIG__NAME=<service>_ts_config ts config push --adapter fastly --app-config <file> --permissions <policy file>`
 
 At runtime the service opens `trusted_server_config` and gets the linked physical
 store, so no other service is touched. Apply the same physical-name-per-service

.github/actions/setup-integration-test-env/action.yml

@@ -2,9 +2,6 @@ name: Setup integration test environment
 description: Prepare toolchains, Viceroy, and Docker images for integration test jobs.
 
 inputs:
-  origin-port:
-    description: Fixed origin port baked into the WASM binary for integration tests.
-    required: true
   install-viceroy:
     description: Install the Viceroy binary used by integration tests.
     required: false
@@ -73,23 +70,11 @@ runs:
     - name: Build WASM binary
       if: ${{ inputs.build-wasm == 'true' }}
       shell: bash
-      env:
-        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
-        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__EC__PARTNERS: >-
-          [{"name":"Integration Test Partner","source_domain":"inttest.example.com","bidstream_enabled":true,"api_token":"integration-test-token-alpha-32-bytes-ok"},{"name":"Integration Test Partner 2","source_domain":"inttest2.example.com","bidstream_enabled":true,"api_token":"integration-test-token-bravo-32-bytes-ok"}]
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
     - name: Build Axum native binary
       if: ${{ inputs.build-axum == 'true' }}
       shell: bash
-      env:
-        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
-        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build -p trusted-server-adapter-axum
 
     - name: Build WordPress test container
@@ -116,9 +101,4 @@ runs:
     - name: Build Cloudflare Workers bundle
       if: ${{ inputs.build-cloudflare == 'true' }}
       shell: bash
-      env:
-        TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
-        TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-        TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: bash crates/trusted-server-adapter-cloudflare/build.sh

.github/workflows/inspector.yml

@@ -0,0 +1,23 @@
+name: "Permissions Inspector"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build-inspector-wasm:
+    name: build inspector wasm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Rust toolchain
+        uses: ./.github/actions/setup-rust
+        with:
+          target: wasm32-unknown-unknown
+          cache-key: cargo-inspector
+      - name: Build the inspector engine
+        run: ./scripts/build-inspector-wasm.sh

.github/workflows/integration-tests.yml

@@ -29,10 +29,12 @@ jobs:
       - name: Set up shared integration build environment
         uses: ./.github/actions/setup-integration-test-env
         with:
-          origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "false"
           build-cloudflare: "true"
 
+      - name: Check that no permission policy is compiled into the Cloudflare WASM
+        run: ./scripts/check-no-compiled-policy.sh crates/trusted-server-adapter-cloudflare/build/index_bg.wasm
+
       - name: Generate integration Viceroy configs
         run: ./scripts/generate-integration-viceroy-configs.sh
         env:
@@ -67,7 +69,6 @@ jobs:
         id: shared-setup
         uses: ./.github/actions/setup-integration-test-env
         with:
-          origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "true"
           build-wasm: "false"
           build-axum: "false"
@@ -126,7 +127,6 @@ jobs:
         id: shared-setup
         uses: ./.github/actions/setup-integration-test-env
         with:
-          origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "true"
           build-wasm: "false"
           build-test-images: "false"
@@ -170,7 +170,6 @@ jobs:
         id: shared-setup
         uses: ./.github/actions/setup-integration-test-env
         with:
-          origin-port: ${{ env.ORIGIN_PORT }}
           install-viceroy: "true"
           build-wasm: "false"
           build-test-images: "false"

.github/workflows/test.yml

@@ -113,6 +113,21 @@ jobs:
       - name: Verify Fastly WASM release build
         run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 
+      - name: Check that no permission policy is compiled into the Fastly WASM
+        run: ./scripts/check-no-compiled-policy.sh target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm
+
+      # The sample carries both markers the guard looks for, so a guard that
+      # stops finding them passes the sample and fails the job here. Exit 1 is
+      # the refusal; exit 2 means the guard could not run.
+      - name: Check that the policy guard refuses a file that carries a policy
+        run: |
+          status=0
+          ./scripts/check-no-compiled-policy.sh config/permissions/sample.yaml || status=$?
+          if [ "$status" -ne 1 ]; then
+            echo "the guard should refuse config/permissions/sample.yaml with exit 1, and exited $status" >&2
+            exit 1
+          fi
+
   test-cloudflare:
     name: cargo check (cloudflare native + wasm32-unknown-unknown)
     runs-on: ubuntu-latest
@@ -153,17 +168,11 @@ jobs:
         run: cargo check-spin
 
       - name: Build Spin adapter release WASM
-        # Mirror the Fastly release-build overrides so the artifact embeds usable
-        # settings instead of the trusted-server.toml placeholders, which startup
-        # rejects (falling back to the generic 503 router). This proves the
-        # documented Spin artifact can boot, not just compile.
-        env:
-          TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
-          TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-          TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
         run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
 
+      - name: Check that no permission policy is compiled into the Spin WASM
+        run: ./scripts/check-no-compiled-policy.sh target/wasm32-wasip1/release/trusted_server_adapter_spin.wasm
+
       - name: Run Spin adapter tests (native host)
         run: cargo test-spin
 

AGENTS.md

@@ -21,6 +21,11 @@ crates/
   trusted-server-adapter-cloudflare/    # Cloudflare Workers entry point (wasm32-unknown-unknown binary)
   trusted-server-adapter-spin/          # Fermyon Spin entry point (wasm32-wasip1 component)
   trusted-server-cli/                   # Host-target `ts` operator CLI
+  device/
+    fastly/                             # trusted-server-device-fastly (opt-in TLS/H2 device module)
+  edgecookie/                           # vendor Edge Cookie module crates (built-in HMAC module is in core)
+  geo/                                  # vendor geo module crates (host geo is injected by the adapter)
+  permission-signal/                    # permission signal module crates, one per scheme (gpc, gpp, tcf, us-privacy); core links none
   trusted-server-js/                    # TypeScript/JS build — per-integration IIFE bundles
     lib/         # TS source, Vitest tests, esbuild pipeline
 ```
@@ -63,7 +68,11 @@ fastly compute serve
 EDGEZERO_MANIFEST="<release-root>/edgezero.toml" \
   ts deploy --adapter fastly --service-id <service-id> --application-release "<release-root>"
 
-# Run Axum dev server (native — no Viceroy)
+# Run Axum dev server (native — no Viceroy). Settings load at runtime from the
+# platform config store on every adapter; publish an operator config with
+# `ts config push --permissions <policy file>` (see
+# trusted-server.example.toml for the template). Axum reads the policy file
+# from the folder TRUSTED_SERVER_PERMISSIONS_DIR names.
 cargo run -p trusted-server-adapter-axum
 
 # Test Axum adapter only
@@ -162,6 +171,24 @@ cd crates/trusted-server-js/lib && node build-all.mjs
 cargo install viceroy --version 0.21.0 --locked --force
 ```
 
+### Windows (use WSL for the Linux-only tests)
+
+The Rust adapter tests run natively on Windows through the cargo aliases
+(`cargo test-fastly` via Viceroy, `cargo test-axum`, `cargo test-cloudflare`),
+and CI runs them on `ubuntu-latest`.
+
+The Docker-based integration suite (`scripts/integration-tests.sh`) and the
+Cloudflare worker build (`crates/trusted-server-adapter-cloudflare/build.sh`,
+which uses `worker-build` + `wrangler dev`) are Linux tools. On Windows run them
+inside WSL (Ubuntu) with Docker Desktop's WSL integration enabled. Provision the
+WSL distro with the same toolchain as `.tool-versions` (rustup + the
+`wasm32-wasip1` / `wasm32-unknown-unknown` targets, Node, Viceroy, wrangler), then
+run the scripts from a clone on the WSL native filesystem for fast builds.
+The CLI crate (`trusted-server-cli`) does not build on a Windows host either,
+because its dependency `edgezero-adapter-fastly` uses a standard library
+feature that is unstable on Windows, so run its tests and the template cache
+harness (`scripts/template-cache-local-test.sh`), which builds it, in WSL too.
+
 ---
 
 ## Coding Conventions
@@ -289,6 +316,11 @@ impl core::error::Error for MyError {}
 
 ## Other guidelines
 
+- Use US English spelling everywhere: code, identifiers, comments,
+  documentation, tests, commit messages, and configuration. For example, write
+  `color`, `behavior`, and `optimize`, not `colour`, `behaviour`, or `optimise`.
+  Where a term comes from an external source (for example the IAB TCF purpose
+  names), match that source's spelling even when it is not US English.
 - Use only example or fictional information in comments, tests, docs, examples,
   and similar non-runtime materials. (e.g. use example.com for URLs by default)
 - Do not write or commit real domains, customer names, credentials,
@@ -302,6 +334,37 @@ impl core::error::Error for MyError {}
   under the [allowlist maintenance policy](docs/superpowers/specs/2026-05-18-check-domains-design.md#allowlist-maintenance-policy).
   Per-line suppressions also need review.
 
+### Permission model terminology
+
+Permissions are the primitive. A module declares the permissions it requires
+(`required_permissions`) and the system decides whether each is _set_. Consent
+is only one of many ways a permission may be established. Country or
+jurisdiction rules (a `Granted` group baseline), legitimate interest, or
+configuration can set a permission with no consent at all.
+
+- A module that needs nothing **requires no permission**. Never write that it
+  "runs without any consent".
+- A gated module **runs once its required permissions are set**, by whatever
+  method.
+
+**Evidence is not rationed, use is.** Every module and every integration sees
+all the evidence available for a request, including host signals such as the TLS
+JA4 and HTTP/2 signals. The core never decides which vendor may see what,
+because withholding a signal from one vendor and not another discriminates
+between them, and the core stays neutral. What a vendor may _do_ with the
+evidence is governed by the permissions it declares and the system sets. Access
+is universal, use is gated.
+
+The practical consequence: never "fix" a vendor's access to a signal by hiding
+the signal. If a use needs controlling, express it as a permission. A change
+that removes evidence from a module's reach is working against the
+architecture, not protecting it.
+
+- Reserve "consent" for the consent subsystem (`consent/`, `ConsentContext`,
+  GDPR and TCF strings) where it genuinely means a consent signal. In the
+  permission layer prefer "permission", "set" / "unset", and "signal" (consent
+  is one kind of signal, alongside privacy and opt-out signals).
+
 ---
 
 ## Git Commit Conventions
@@ -318,6 +381,42 @@ Bad: `"fix: added feature flags"`
 
 ---
 
+## Module Architecture
+
+Each vendor-differentiated capability is pluggable behind its own trait, so a
+deployment selects an implementation and the core stays neutral:
+
+| Capability            | Trait                                                 | Selector                                        | Built-in (core)                                                                    | Vendor / host crates                |
+| --------------------- | ----------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------------------------------------- | ----------------------------------- |
+| Edge Cookie identity  | `EdgeCookieModule` (`ec/module.rs`)                   | `[ec] module`                                   | HMAC, client-fixed (opt-in, no default)                                            | `crates/edgecookie/<vendor>`        |
+| Device detection      | `DeviceModule` (`ec/device.rs`)                       | `[device] module`                               | User-Agent only (default)                                                          | `crates/device/<vendor>`            |
+| Geo / IP intelligence | `PlatformGeo` (`platform/traits.rs`)                  | `[geo] module`                                  | Disabled, no location (default)                                                    | `crates/geo/<vendor>`               |
+| Permission signals    | `PermissionSignalModule` (`permission_signal/mod.rs`) | `[permission-signal] modules` (an ordered list) | None, and with no module every permission stays at its country and region baseline | `crates/permission-signal/<scheme>` |
+
+Principles for adding or changing a module:
+
+- **Core stays neutral.** The trait and the host-neutral default live in
+  `trusted-server-core`. Host-specific and vendor implementations live in their
+  own crates and are injected by the adapter (for example `build_device_module`
+  and `build_geo_module`), so core never depends on a host SDK or a vendor, and
+  the default request path makes no host-specific calls.
+- **Modules read request evidence, not a fixed parameter set.** A module must
+  be able to see everything about the request it needs (User-Agent, headers, and
+  host signals such as the TLS JA4 and HTTP/2 signals) through an evidence
+  abstraction rather than a hard-coded struct of fields. Host signals come from
+  the host (the Fastly SDK) and are opt-in, so a neutral module triggers no
+  host signal calls.
+- **Modules are separated by capability but composed per request, and one may
+  need another's output.** Geo resolves the country and region the permission
+  model uses, and the permission model gates whether the Edge Cookie module
+  runs. Device signals gate Edge Cookie writes (the browser / bot gate). When
+  multiple vendor modules share a backend (for example a vendor's Edge Cookie,
+  geo, and device module on one cloud pipeline) they share a single call per
+  request rather than calling independently. Give a module the inputs and
+  upstream results it needs explicitly, rather than having it reach into globals.
+
+---
+
 ## Integration System
 
 Integrations register in Rust via:
@@ -347,14 +446,14 @@ IntegrationRegistration::builder(ID)
 
 ## Configuration Files
 
-| File                          | Purpose                                                                                           |
-| ----------------------------- | ------------------------------------------------------------------------------------------------- |
-| `edgezero.toml`               | EdgeZero app/platform manifest and logical stores                                                 |
-| `fastly.toml`                 | Fastly service configuration and build settings                                                   |
-| `trusted-server.example.toml` | Source-controlled Trusted Server app-config template                                              |
-| `trusted-server.toml`         | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
-| `rust-toolchain.toml`         | Pins Rust version to 1.98.1                                                                       |
-| `.env.dev`                    | Local development environment variables                                                           |
+| File                          | Purpose                                                                                                                                             |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `edgezero.toml`               | EdgeZero app/platform manifest and logical stores                                                                                                   |
+| `fastly.toml`                 | Fastly service configuration and build settings                                                                                                     |
+| `trusted-server.example.toml` | Source-controlled app-config template, which carries the `[ec]`, `[geo]` and `[device]` module selectors and the `[permission-signal] modules` list |
+| `trusted-server.toml`         | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope                                                   |
+| `rust-toolchain.toml`         | Pins Rust version to 1.98.1                                                                                                                         |
+| `.env.dev`                    | Local development environment variables                                                                                                             |
 
 ---