Finish the default_country retirement across the seam branches

The retirement on the permissions branch left stale references in content the later branches carry. The seam-probe fixtures and the Axum probe tests no longer write the retired setting and acknowledge running without a geo provider instead, the moved DisabledGeo doc and two settings serialization tests describe the rules tree rather than the retired field, and the configuration guide's remaining prose follows. The deployer states the policy in permissions.yaml, and the software encodes no jurisdiction's law.

Author: jwrosewell

crates/integrations/seam-probe/src/lib.rs

@@ -652,7 +652,6 @@ mod tests {
                 passphrase = "test-secret-key-32-bytes-minimum"
 
                 [geo]
-                default_country = "US"
                 assume_single_jurisdiction = true
 
                 [integrations.seam_probe]
@@ -726,7 +725,6 @@ mod tests {
                 passphrase = "test-secret-key-32-bytes-minimum"
 
                 [geo]
-                default_country = "US"
                 assume_single_jurisdiction = true
             "#,
         )

crates/trusted-server-adapter-axum/tests/seam_probe.rs

@@ -40,16 +40,16 @@ const MAX_BODY_BYTES: usize = 4 * 1024 * 1024;
 /// The settings baked into the binary carry placeholder secrets that
 /// `get_settings()` rejects by design, so every test states its own.
 fn settings_with(extra: &str) -> Settings {
-    // The permission model requires a `[geo] default_country`, because there
-    // must always be a permission baseline for a request the geo provider
-    // leaves unmatched. Tests that select a geo provider write their own
-    // `[geo]` table, so only supply one when the caller has not.
+    // A request the geo provider leaves unmatched resolves at the top of the
+    // permissions.yaml rules tree, and a deployment that runs an Edge Cookie
+    // provider with no geo provider acknowledges that explicitly. Tests that
+    // select a geo provider write their own `[geo]` table, so only supply one
+    // when the caller has not.
     let geo = if extra.contains("[geo]") {
         String::new()
     } else {
         "
 [geo]
-default_country = \"US\"
 assume_single_jurisdiction = true
 "
         .to_owned()
@@ -221,7 +221,6 @@ async fn proxy_route_reports_the_modules_geo_and_that_the_preparer_ran() {
         r#"
             [geo]
             provider = "seam_probe"
-            default_country = "US"
             {PROBE_BLOCK}
         "#
     ));
@@ -345,7 +344,6 @@ fn geo_selector_naming_a_module_without_a_provider_fails_at_startup() {
         r#"
             [geo]
             provider = "seam_probe"
-            default_country = "US"
 
             [integrations.seam_probe]
             country = "ZZ"
@@ -467,7 +465,6 @@ fn settings_selecting_module(extra: &str) -> Settings {
             proxy_secret = "seam-probe-test-proxy-secret"
 
             [geo]
-            default_country = "US"
             assume_single_jurisdiction = true
 
             {extra}

crates/trusted-server-core/src/platform/geo.rs

@@ -11,7 +11,7 @@ use super::{GeoInfo, PlatformError, PlatformGeo, RuntimeServices};
 /// sent to any host geo service, so a default deployment is not tied to any host
 /// geo capability. Every geo consumer already treats [`GeoInfo`] as optional, so
 /// a `None` result degrades gracefully: the permission baseline falls back to
-/// the configured `[geo] default_country`, the auction omits geo, and so on.
+/// the top of the `permissions.yaml` rules tree, the auction omits geo, and so on.
 ///
 /// Adapter crates should use this type rather than defining their own stub so
 /// the behavior is the same on every platform.

crates/trusted-server-core/src/settings.rs

@@ -4193,17 +4193,18 @@ mod tests {
         // set must not appear in the blob. A `deny_unknown_fields` binary that
         // predates the selector rejects the key during rollout or rollback.
         //
-        // The `[geo]` table itself is always written now that `default_country`
-        // is required, so the assertion is about the selector key rather than
-        // the table, which is what the blob's compatibility actually turns on.
+        // The shared fixture writes a `[geo]` table (it acknowledges running
+        // with no geo provider), so the assertion is about the selector key
+        // rather than the table, which is what the blob's compatibility
+        // actually turns on.
         let settings = Settings::from_toml(&crate_test_settings_str())
             .expect("should parse settings without a geo selector");
 
         let value = serde_json::to_value(&settings).expect("should serialize settings");
 
         let geo = value
             .get("geo")
-            .expect("the geo table is written because default_country is required");
+            .expect("the geo table is written because the fixture acknowledges no geo provider");
         assert!(
             geo.get("provider").is_none(),
             "an unset geo selector should not be serialized, got {geo}"
@@ -4218,10 +4219,9 @@ mod tests {
 
     #[test]
     fn a_selected_geo_provider_stays_in_the_serialized_config() {
-        // The shared test settings already carry a `[geo]` table, because
-        // `default_country` is required, so the selector is set inside that
-        // table rather than in a second one, which TOML rejects as a duplicate
-        // key.
+        // The shared test settings already carry a `[geo]` table, so the
+        // selector is set inside that table rather than in a second one, which
+        // TOML rejects as a duplicate key.
         let settings = Settings::from_toml(&crate_test_settings_str().replace(
             "[geo]",
             "[geo]

docs/guide/configuration.md

@@ -629,7 +629,7 @@ Selects how a client IP is resolved into geolocation (country, region, coordinat
 | `provider`                   | String or null | No              | Key of the geo provider. Omit, or set `none`, to resolve no location and make no host geo call. Set `platform` to use the host's own geo lookup.                                                                 |
 | `assume_single_jurisdiction` | Boolean        | See description | With no geo provider, every request resolves at the top of the `permissions.yaml` rules tree. A deployment that runs an Edge Cookie provider without a geo provider acknowledges that by setting this to `true`. |
 
-No provider is the default, so a default deployment is not tied to any host geo service. Selecting an unknown provider key fails at startup. A failed geo lookup at request time does not fall back to `default_country`; it resolves every permission to the requires-signal floor and is logged at error level, so an outage is handled protectively.
+No provider is the default, so a default deployment is not tied to any host geo service. Selecting an unknown provider key fails at startup. A failed geo lookup at request time does not fall back to the rules tree. It resolves every permission to the requires-signal floor and is logged at error level, so an outage is handled protectively.
 
 **Example**:
 
@@ -650,7 +650,7 @@ A provider advertises the technical permissions its data use requires, and Trust
 
 ### Country and region rules (`permissions.yaml`)
 
-The country and region permission rules are defined in a human-editable `permissions.yaml` at the repository root, compiled into the build (not loaded at runtime). Edit that file and rebuild to change the policy. There is no `[permissions]` block in `trusted-server.toml`. It defines named **groups** (baselines such as `gdpr-eu`, `gdpr-uk`, `us-opt-out`) and **rules** that map a country or country/state to a group, with an optional `permissions` map that overrides single Data Uses (`granted`, `requires_signal`, or `denied`). A request that matches no rule uses the required `[geo] default_country` set in `trusted-server.toml`. See the [Permission Model](/guide/permission-model) for the schema and the shipped defaults.
+The country and region permission rules are defined in a human-editable `permissions.yaml` at the repository root, compiled into the build (not loaded at runtime). Edit that file and rebuild to change the policy. There is no `[permissions]` block in `trusted-server.toml`. It defines named **groups** (baselines such as `gdpr-eu` and `us-opt-out`) and a **rules** tree whose nodes map a country, and regions beneath it, to a group, with an optional `permissions` map that overrides single Data Uses (`granted`, `requires_signal`, or `denied`). A request that matches no node resolves at the top of the tree, which also names the `jurisdiction` for consent handling. See the [Permission Model](/guide/permission-model) for the schema and the shipped defaults.
 
 ## Geo Configuration