Quantize auction transport timeouts to stabilize Fastly backend names

[prk-Jr]

Summary

• Fastly dynamic backend names deliberately embed the first-byte and between-bytes timeouts so a registration can never be silently reused with a different transport configuration. But deriving those timeouts from the remaining wall-clock auction budget minted a new backend name on nearly every request — defeating cross-request TCP/TLS connection reuse to bidder hosts (Fastly pools connections per backend name) and accumulating registrations toward the per-service dynamic backend limit.
• Compute the effective transport timeout in three regimes: the provider's configured timeout verbatim when the budget allows (a constant, already name-stable), the remaining budget floored to 250ms buckets when the budget is the binding constraint, and exact passthrough for sub-quantum remainders so publishers with sub-250ms configured budgets keep launching. The value feeds both the backend name and the registered configuration, so they cannot diverge; rounding down never extends a transport cap past the auction deadline, which the mediator and dispatched-collect paths rely on to bound the </body> hold.
• Pin predict_name == ensure on the Fastly platform backend with a Viceroy test, since the orchestrator maps SSP responses back to providers by predicted backend name.

Changes

File	Change
crates/trusted-server-core/src/auction/orchestrator.rs	Add TRANSPORT_TIMEOUT_QUANTUM_MS, quantize_transport_timeout_ms, and effective_transport_timeout_ms; apply at the four provider-launch sites (parallel, dispatch, synchronous mediator, collect-path mediator); extend the test stub with an optional timeout recorder and add quantization, sub-quantum-passthrough, and mediator-budget tests
crates/trusted-server-adapter-fastly/src/platform.rs	Add predict_name_matches_ensured_backend_name test pinning the predicted name to the registered name for an identical spec

Closes

Closes #847

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare && cargo test-spin, cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm, and the integration parity suite (cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity) all pass

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

[ChristianPavilonis]

Summary

Reviewed the timeout quantization change against the PR's actual main base. The arithmetic is internally consistent, but the current implementation has correctness and operational risks that should be addressed before merge. Detailed findings are attached inline.

[ChristianPavilonis]

Summary

Reviewed current HEAD 5512d850 against main. The Fastly-only canonicalization and provider-discriminator wiring are directionally correct, but two high-risk backend identity/cardinality issues and two medium reliability/compatibility issues remain; details are inline.

Documentation

The PR description no longer describes HEAD: it still claims exact sub-quantum passthrough and a two-file change, while HEAD uses a [200, 150, 100, 50] ladder, skips values below 50 ms, adds a platform trait capability and discriminator, and changes 15 files. Please refresh the Summary, Changes table, and test plan.

[aram356]

Summary

Reviewed HEAD 77f3521 against main. All nine findings from the two earlier review rounds are verified fixed on this HEAD: the digest-based backend naming makes name equality imply spec equality (and I confirmed the only Backend::builder call in the Fastly adapter flows through it), the discriminator keeps same-origin providers on distinct names on all four adapters, cardinality is globally bounded by the sub-quantum and coarse ladders, duplicate providers are rejected at startup with a pre-launch guard on both paths, canonicalization is Fastly-only via the platform trait, and the timeout wiring tests are deterministic. Remaining items are one documentation blocker and a handful of non-blocking suggestions, inline.

Blocking

🔧 wrench

• Stale PR description: the description still describes the pre-review design — "exact passthrough for sub-quantum remainders so publishers with sub-250ms configured budgets keep launching" was removed in 5512d85 (budget-derived sub-quantum values now snap to the [200, 150, 100, 50] ladder; only configured sub-250ms constants pass through). It also predates most of what the PR now contains: digest-based backend naming, provider discriminators, the coarse ladder, duplicate-provider startup rejection, and the platform-capability split. The changes table still places the quantization helpers in orchestrator.rs, but they live in the Fastly adapter now. Please rewrite the Summary/Changes to describe HEAD.

Non-blocking

⛏ nitpick

• ensure() doc drift: the doc comment still says the name is "derived from the scheme, host, port, certificate setting, first_byte_timeout, and between_bytes_timeout" — no digest, no discriminator, no Host override (crates/trusted-server-adapter-fastly/src/backend.rs:328-334). compute_name carries the accurate description; this paragraph should defer to it instead of restating a stale subset.

CI Status

• fmt: PASS
• clippy: PASS
• rust tests (fastly/axum/cloudflare/spin + parity + CLI): PASS
• js tests: PASS
• integration/browser tests: PASS

[aram356]

🤔 thinking — The coarse ladder's worst-case haircut is ~50%: a remaining budget of 9,999ms snaps to 5,000ms, and 19,999ms to 10,000ms. On the mediator path this value is the effective bound (there is no select-loop backstop), so a mediator can lose half its usable transport window to bucketing. A denser geometric ladder (ratio ≈1.3, e.g. [2000, 2500, 3250, 4250, 5500, 7000, 9000, 12000, 15500, 20000, 26000, 34000, 44000, 60000]) stays globally finite at ~14 rungs while capping the loss near 25%. If the 50% loss is an accepted trade-off, a sentence in the const doc saying so would keep the next reader from re-deriving it.

[prk-Jr]

Documented rather than densified, in bfde031. The const doc now records the worst-case ~50% haircut with the 9,999→5,000ms example and why it is accepted: on this ladder a denser rung set buys back at most half a bucket of transport window while growing the backend-name space proportionally, and the 8 rungs here already cover the practical mediator budgets. If a real config shows up living just under a rung we can add that rung then, grounded in the observed budget.

[aram356]

♻️ refactor — Both enumeration loops (here and in canonicalize_budget_derived_names_stay_bounded_for_large_ceiling) assert quantum alignment and cardinality, but not the invariant the mediator </body> hold bound actually relies on: the canonical value never exceeds the remaining budget. The loops already visit every reachable input, so one line in each closes the gap:

assert!(
    value <= remaining,
    "canonical value {value}ms must not extend past the remaining {remaining}ms budget"
);

[prk-Jr]

Added in bfde031 — both enumeration loops now assert value <= remaining on every reachable input, with a comment tying the assertion to the mediator </body> hold bound it protects.

[aram356]

🤔 thinking — This rejects a provider listed twice in providers, but providers = ["x"], mediator = "x" still validates: the same provider is then called twice per auction — once in the bidding phase and again as the mediator. If a provider acting as its own mediator is never a legitimate configuration, the same startup validation should reject the overlap:

if let Some(mediator_name) = &self.config.mediator {
    if seen.contains(mediator_name.as_str()) {
        return Err(/* mediator also listed as a provider */);
    }
}

[prk-Jr]

Confirmed never legitimate before adding the guard: a mediator's own demand already flows through its mediation response (winning bids are extracted from the mediator's reply), so listing the same provider as both bidder and mediator only buys a duplicate outbound call. Startup validation now rejects the overlap in bfde031, with rejects_mediator_also_listed_as_provider covering it.

[aram356]

⛏ nitpick — format!("{byte:02x}") allocates a fresh String per byte before collecting, and this runs on every predict_name and ensure (twice per auction launch). Writing into one pre-sized buffer avoids the 16 small allocations:

let mut hex = String::with_capacity(SPEC_DIGEST_HEX_LEN);
for byte in digest.iter().take(SPEC_DIGEST_HEX_LEN / 2) {
    write!(hex, "{byte:02x}").expect("should write hex digit to string");
}
hex

(with use core::fmt::Write as _;)

[prk-Jr]

Fixed in bfde031 — hex digits are now written into one String::with_capacity(SPEC_DIGEST_HEX_LEN) buffer via core::fmt::Write.