Bind credentials to approved contexts and add secure provisioning

.env.example

@@ -1,21 +1,21 @@
 # Trusted Server development environment variables
 # Copy this file to .env.dev, .env.staging, or .env.production and fill in
-# non-secret values. App-config secrets are key names in the pushed blob and
-# their values belong in the platform secret store; see the configuration guide.
+# non-secret values. App config contains no credential values or key names.
+# Provision generated native bindings separately; see docs/guide/secrets.md.
 # For Axum runtime loading, export the config blob as:
 # TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG=<blob-envelope-json>
-# and export one secret per key name as:
-# TRUSTED_SERVER_SECRET_TRUSTED_SERVER_SECRETS_<KEY_NAME>=<secret-value>
+# Use `ts secrets plan --adapter axum` for exact generated environment names.
+# Inject their raw values through the launcher, not a tracked environment file.
 # The commented examples below are CLI overlays for ordinary fields only.
 # Fastly example: map logical app-config secrets to physical `ts_secrets`.
 # EDGEZERO__STORES__SECRETS__TRUSTED_SERVER_SECRETS__NAME=ts_secrets
 
 # =============================================================================
 # Publisher Settings
 # =============================================================================
-TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
-TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.publisher.com
-TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
+TRUSTED_SERVER__PUBLISHER__DOMAIN=example.com
+TRUSTED_SERVER__PUBLISHER__COOKIE_DOMAIN=.example.com
+TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.example.com
 
 # =============================================================================
 # Synthetic ID Settings

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-name: "Run Tests"
+name: 'Run Tests'
 
 permissions:
   contents: read
@@ -108,6 +108,13 @@ jobs:
           TMPDIR: ${{ runner.temp }}
         run: ./scripts/async-html-finalization-local-test.sh fastly --release --auction
 
+      - name: Verify native credential TLS, redirects, and config-only attacks
+        timeout-minutes: 10
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+          TMPDIR: ${{ runner.temp }}
+        run: ./scripts/secret-bindings-runtime.sh fastly
+
       - name: Upload EOF runtime diagnostics on failure
         if: failure()
         uses: actions/upload-artifact@v4
@@ -149,6 +156,9 @@ jobs:
       - name: Run Axum adapter tests
         run: cargo test-axum
 
+      - name: Verify native security harness process cleanup
+        run: node --test scripts/secret-bindings-runtime.test.mjs
+
       - name: Verify finalization harness process cleanup
         run: cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --target x86_64-unknown-linux-gnu --features html-eof-runtime --test html_eof_runtime
 
@@ -223,6 +233,24 @@ jobs:
       - name: Run Cloudflare adapter tests (native host)
         run: cargo test-cloudflare
 
+      - name: Install pinned local Workers tools
+        shell: bash
+        run: |
+          WORKER_VERSION=$(awk '/^name = "worker"$/ { getline; gsub(/"/, "", $3); print $3; exit }' Cargo.lock)
+          WRANGLER_VERSION=$(awk '$1 == "wrangler" { print $2 }' .tool-versions)
+          cargo install worker-build --version "$WORKER_VERSION" --locked
+          npm install --prefix "$RUNNER_TEMP/secret-bindings-tools" --no-save "wrangler@$WRANGLER_VERSION"
+
+      # No shipping S3 route on this adapter. A test-utils integration drives
+      # the shared exporter through real workerd stores and transport.
+      - name: Verify native credential TLS, redirects, and config-only attacks
+        timeout-minutes: 10
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+          TMPDIR: ${{ runner.temp }}
+          WRANGLER_BIN: ${{ runner.temp }}/secret-bindings-tools/node_modules/.bin/wrangler
+        run: ./scripts/secret-bindings-runtime.sh cloudflare
+
   test-spin:
     name: cargo check/build/test (spin native + wasm32-wasip1)
     runs-on: ubuntu-latest
@@ -263,12 +291,32 @@ jobs:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
           TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
-          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
+          TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: 'false'
         run: cargo build --package trusted-server-adapter-spin --target wasm32-wasip1 --features spin --release
 
       - name: Run Spin adapter tests (native host)
         run: cargo test-spin
 
+      - name: Install pinned Spin runtime
+        shell: bash
+        run: |
+          VERSION=$(awk '$1 == "spin" { print $2 }' .tool-versions)
+          mkdir -p "$RUNNER_TEMP/secret-bindings-tools"
+          curl --fail --silent --show-error --location \
+            "https://github.com/spinframework/spin/releases/download/v$VERSION/spin-v$VERSION-linux-amd64.tar.gz" \
+            --output "$RUNNER_TEMP/spin.tar.gz"
+          tar -xzf "$RUNNER_TEMP/spin.tar.gz" -C "$RUNNER_TEMP/secret-bindings-tools" spin
+
+      # No shipping S3 route on this adapter. A test-utils integration drives
+      # the shared exporter through real Spin stores and transport.
+      - name: Verify native credential TLS, redirects, and config-only attacks
+        timeout-minutes: 10
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+          TMPDIR: ${{ runner.temp }}
+          SPIN_BIN: ${{ runner.temp }}/secret-bindings-tools/spin
+        run: ./scripts/secret-bindings-runtime.sh spin
+
   test-parity:
     name: cargo test (cross-adapter parity)
     runs-on: ubuntu-latest
@@ -312,7 +360,7 @@ jobs:
       - name: Set up Rust toolchain
         uses: ./.github/actions/setup-rust
         with:
-          components: "clippy, rustfmt"
+          components: 'clippy, rustfmt'
           cache-key: cargo-cli
 
       - name: Read pinned Node.js version
@@ -392,7 +440,7 @@ jobs:
           # main and this job only runs on PRs; `save-cache` keeps it
           # restore-only if either changes.
           cache-key: cargo-cli
-          save-cache: "false"
+          save-cache: 'false'
 
       # Building `ts` compiles trusted-server-core, whose trusted-server-js
       # build script runs the TSJS build with the `npm` on PATH, so pin Node
@@ -428,7 +476,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
-          cache: "npm"
+          cache: 'npm'
           cache-dependency-path: crates/trusted-server-js/lib/package.json
 
       - name: Install dependencies

.tool-versions

@@ -1,6 +1,7 @@
 fastly    16.0.0
 rust      1.98.1
 nodejs    24.20.0
+wrangler  4.83.0
 viceroy   0.21.0
 wasmtime  48.0.1
 spin      4.1.0

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking:** App credentials use context-derived native bindings, not operator-selected secret references. Remove all twelve credential properties, including on disabled features, and provision raw values through reviewed `ts secrets plan` output. Partner inbound auth uses boolean `api_token_enabled`; optional S3 session credentials use boolean `session_token_enabled`, both default false. Enabled credentials and compiled destinations load as one snapshot. First-release direct `ts secrets set` supports Fastly only; all four adapters have native rendering. Cloudflare/Spin presence checks remain unsupported. See the provisioning, protected CI, and migration guides. New keys do not revoke retired contexts, warm states need recreation, and an old-binary rollback restores the original attack. Native/provider/IAM and migration rehearsals remain release gates; this entry is not a completed security-release claim.
+
 - **Breaking:** `x-ts-version` now reports the deployed git version — the release tag, else the branch, else the first 6 characters of the commit — compiled in from the build-time `TRUSTED_SERVER__GIT_VERSION` (set by the deploy pipeline) or local git, and is sent by every adapter, including on the Fastly `GET /health` probe. The Fastly service version it previously carried is now `x-ts-fastly-version`; update dashboards, monitors, and scripts that read `x-ts-version` as the Fastly version number. Builds with neither the override nor git omit the header.
 - **Breaking:** `ts prebid bundle` is now `ts prebid client`, alongside the new `ts prebid server` namespace. Update scripts and runbooks to use `ts prebid client` with the same arguments. The old `bundle` spelling is no longer accepted and has no compatibility alias.
 - The S2S `/_ts/api/v1/batch-sync` endpoint now validates the full batch and calls the CAS-protected update path once per distinct normalized EC ID. The last valid UID wins within a group, and infrastructure failures reject the failing and each unprocessed group, so accepted and `kv_unavailable` input indexes may interleave.