Enforce absolute deadlines for auction response collection

.github/workflows/test.yml

@@ -55,6 +55,9 @@ jobs:
       - name: Run tests
         run: cargo test-fastly
 
+      - name: Run Fastly absolute deadline slow-network tests
+        run: node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"
+
       - name: Run trace emitted-script regressions
         run: |
           cargo test -p trusted-server-core --target x86_64-unknown-linux-gnu --lib trace_document_skipped_emitted_script_leaves_ad_state_untouched -- --ignored

.github/workflows/worker-auction-deadlines.yml

@@ -0,0 +1,93 @@
+name: Worker auction deadline runtime regressions
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  worker-deadlines:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        adapter: [cloudflare, spin]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Read tool versions
+        id: versions
+        shell: bash
+        run: |
+          {
+            echo "node=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)"
+            echo "spin=$(awk '$1 == "spin" { print $2 }' .tool-versions)"
+            echo "bindgen=$(sed -n '/^name = "wasm-bindgen"$/ { n; s/version = "\(.*\)"/\1/p; }' Cargo.lock)"
+          } >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.versions.outputs.node }}
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust
+        with:
+          target: ${{ matrix.adapter == 'cloudflare' && 'wasm32-unknown-unknown' || 'wasm32-wasip1' }}
+          components: clippy
+          cache-key: worker-deadline-${{ matrix.adapter }}
+      - name: Install JS dependencies
+        working-directory: crates/trusted-server-js/lib
+        run: npm ci
+      - name: Build actual adapter HTTP fixture
+        shell: bash
+        run: |
+          if [ "${{ matrix.adapter }}" = cloudflare ]; then
+            cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare
+          else
+            cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin
+          fi
+      - name: Lint runtime fixture
+        shell: bash
+        run: |
+          if [ "${{ matrix.adapter }}" = cloudflare ]; then
+            cargo clippy --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare -- -D warnings
+          else
+            cargo clippy --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin -- -D warnings
+          fi
+      - name: Install local Cloudflare tools
+        if: matrix.adapter == 'cloudflare'
+        shell: bash
+        run: |
+          npm install --global wrangler@4.83.0
+          mkdir -p "$RUNNER_TEMP/bindgen"
+          # Digests are published with the upstream GitHub release assets.
+          # Update the digest alongside the pinned version.
+          test "${{ steps.versions.outputs.bindgen }}" = 0.2.126
+          archive="$RUNNER_TEMP/wasm-bindgen.tar.gz"
+          curl --fail --location --silent --show-error "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/${{ steps.versions.outputs.bindgen }}/wasm-bindgen-${{ steps.versions.outputs.bindgen }}-x86_64-unknown-linux-musl.tar.gz" --output "$archive"
+          echo "064948d58e2d6c0a745216477a639ba696216d6309aaa902939d1b865b1d869d  $archive" | sha256sum --check
+          tar -xz --strip-components=1 -C "$RUNNER_TEMP/bindgen" -f "$archive"
+          echo "$RUNNER_TEMP/bindgen" >> "$GITHUB_PATH"
+      - name: Install pinned Spin runtime
+        if: matrix.adapter == 'spin'
+        shell: bash
+        run: |
+          mkdir -p "$RUNNER_TEMP/spin"
+          # Update the published upstream digest alongside the pinned version.
+          test "${{ steps.versions.outputs.spin }}" = 4.1.0
+          archive="$RUNNER_TEMP/spin.tar.gz"
+          curl --fail --location --silent --show-error "https://github.com/spinframework/spin/releases/download/v${{ steps.versions.outputs.spin }}/spin-v${{ steps.versions.outputs.spin }}-linux-amd64.tar.gz" --output "$archive"
+          echo "aeeb892f94cf861f5302546faa0bdaa82cc4be30539621299746a6dc011f3b5a  $archive" | sha256sum --check
+          tar -xz -C "$RUNNER_TEMP/spin" -f "$archive"
+          echo "$RUNNER_TEMP/spin" >> "$GITHUB_PATH"
+      - name: Exercise delayed headers, trickling bodies, and slow publisher work
+        shell: bash
+        env:
+          WRANGLER_SEND_METRICS: 'false'
+        run: |
+          if [ "${{ matrix.adapter }}" = cloudflare ]; then
+            node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"
+          else
+            node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"
+          fi

AGENTS.md

@@ -375,6 +375,8 @@ Every PR must pass:
 11. Documentation proposal scripts: `shellcheck scripts/docs-proposal/*.sh && node --test scripts/docs-proposal/hunks.test.mjs && scripts/docs-proposal/test.sh`
 12. URL-host linter on lines the PR adds (`lint-domains` job, PRs only); run it locally with `cargo run --manifest-path crates/trusted-server-cli/Cargo.toml --target <host-triple> --bin ts -- dev lint domains --changed-vs origin/main`, using the PR's base branch in place of `main` when it targets another branch
 13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
+14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
+15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code:

CHANGELOG.md

@@ -9,6 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Auction response collection now bounds network waiting by `[auction].timeout_ms`
+  measured from dispatch, including delayed headers and trickling bodies on all
+  adapters. Complete available responses survive a slow publisher origin;
+  unfinished providers time out and mediation is skipped after budget exhaustion.
+  Provider bids that are already complete at the final nonblocking snapshot remain
+  eligible even after `tmax`; mediation starts only with remaining budget and
+  rejects responses collected after its cutoff.
+  Fastly abandons unfinished requests; Axum, Cloudflare, and Spin cancel owned work.
 - Explicit TS Console activation with `?ts_console=1` now sets a 30-minute diagnostics cookie instead of a browser-session cookie, independently of the mobile trace flag. Ordinary requests do not refresh it; end and explicitly enable diagnostics again to adopt the lifetime for an existing session.
 - Publisher documents with diagnostics active now use private, no-store responses and strip conditional and range request headers before fetching the origin. An unexpected origin `304` becomes a private `502` because it cannot supply an instrumented document, including when mobile tracing is disabled.
 - **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.

CONTRIBUTING.md

@@ -146,6 +146,14 @@ link it in the description, and mark it ready for review again.
 - Update the canonical guide or crate README when a user-visible contract
   changes; do not copy volatile matrices into multiple documents.
 
+## Fastly dependency updates
+
+Update the workspace `fastly` and `fastly-sys` dependencies together. The
+Fastly deadline collector uses raw asynchronous I/O readiness calls from
+`fastly-sys` with handles created by `fastly`, so both must use a compatible
+SDK ABI. Check the resolved versions in `Cargo.lock` and run the Fastly
+adapter tests, including the real deadline network fixture, after an SDK update.
+
 ## Verify
 
 Run the target-matched checks in [AGENTS.md](AGENTS.md#ci-gates), the

Cargo.toml

@@ -66,6 +66,7 @@ env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
 fastly = "0.13"
+fastly-sys = "0.13.1"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"

crates/trusted-server-adapter-axum/Cargo.toml

@@ -29,6 +29,7 @@ reqwest = { workspace = true }
 simple_logger = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
 trusted-server-core = { workspace = true }
+web-time = { workspace = true }
 
 [dev-dependencies]
 trusted-server-core = { workspace = true, features = ["test-utils"] }