[prk-Jr]

Summary

• Restrict Prebid Server Cookie headers to euconsent-v2, __gpp, __gpp_sid, and us_privacy; omit the header in openrtb_only.
• Match consent extraction's parsing and last-duplicate behavior. Normalize safe decimal GPP section whitespace and preserve unsafe-to-forward consent through JSON without forwarding unsafe cookie bytes.
• In cookies_only, body fallback includes only the affected signal; GPP and section IDs travel together. Original consent gating and identity decisions use the unchanged complete context.

Changes

Files	Change
crates/trusted-server-core/src/integrations/prebid.rs	Shared consent-cookie selection and selective serialization fallback for both request builders.
crates/trusted-server-core/src/auction/{openrtb,orchestrator}.rs	Apply fallback in production request construction and test every forwarding mode, unsafe TC/GPP/US values, duplicates, header framing, and body placement.
crates/trusted-server-core/src/cookies.rs	Remove unused unrestricted forwarding and stripping helpers.
Cookie-forwarding/Prebid guides, architecture spec, technical plan, CHANGELOG	Document actual forwarding surfaces, identity exceptions, and signal-specific fallback.

Closes

Closes #763

Spec

Not a feature. The issue specifies the policy. Technical plan: docs/superpowers/plans/2026-10-22-prebid-consent-cookie-allowlist.md.

Behavior decisions and review

A consent signal that cannot be safely framed as a cookie falls back to its JSON representation in cookies_only; unrelated safe signals stay cookie-only. GPP string and section IDs are one coupled signal, with required GDPR applicability metadata. Policy-sourced consent retains its existing body behavior. Unsafe raw bytes never bypass the header filter.

Production-path regressions cover unsafe euconsent-v2, GPP section IDs, and US Privacy values alongside safe unrelated signals. The regression first failed with the broad fallback, then passed with selective fallback. Fresh independent cookie and cross-PR reviews found no remaining actionable correctness issues.

Compatibility limitation: a receiving service must consume consent cookies for safe cookies_only signals. The standard PBS auction documentation specifies OpenRTB consent fields; it does not establish support for these four incoming consent cookies. This existing mode's compatibility with particular PBS deployments was not validated here. This PR preserves the mode rather than silently changing all safe consent to body forwarding.

Test plan

• Full native core tests, integration tests, and doctests; 229 focused Prebid tests.
• All five adapter test aliases, including reusable Fastly sandboxes.
• Cross-adapter parity and native build-digest tests.
• All eight clippy aliases, build-digest lint, Rust format, and diff checks.
• 1,211 JS tests, JS format, and 13-module build.
• Docs/outside-doc Markdown format, WASM clock lint, and documentation-proposal checks.
• Optimized Fastly WASM build.
• Independent cookie and cross-PR review.
• Actual combined tree: 2,982 native core tests and 2,976 Viceroy core tests passed, plus integration suites and doctests.

Exploratory tsc --noEmit and whole-repository actionlint report pre-existing errors in unchanged files; they are not counted as passing checks. The changed workflows in #1433 pass scoped lint. Local verification uses Rust 1.98.1, Viceroy 0.21.0, and Node 24.12.0; the repository pins Node 24.20.0. No live PBS/browser validation was performed.

Checklist

• Changes follow AGENTS.md conventions.
• No Python code, secrets, customer data, new dependencies, or unsafe raw-cookie fallback.
• Original consent context remains intact for enforcement.
• Production serialization and malformed-input cases have regression coverage.