feat: provision --local (umbrella PR)

.github/workflows/test.yml

@@ -58,6 +58,19 @@ jobs:
       - name: Nested AppConfig audit
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
 
+      # Enforce spec §"Adapter manifests are gitignored" + §"Migration for
+      # downstream projects". All five generated adapter manifests
+      # (`axum.toml`, `wrangler.toml`, `fastly.toml`, `spin.toml`,
+      # `runtime-config.toml`) and Cloudflare's `.dev.vars` MUST NOT be
+      # tracked -- teammates regenerate them locally via
+      # `provision --local`.
+      - name: Enforce adapter manifests and .dev.vars are not tracked
+        run: |
+          if git ls-files | grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.dev\.vars$'; then
+            echo "::error::These adapter manifests AND Cloudflare's .dev.vars must be gitignored (spec §'Adapter manifests are gitignored' + §'Migration for downstream projects'). .dev.vars carries operator secret values and must NEVER be committed."
+            exit 1
+          fi
+
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 

.gitignore

@@ -1,7 +1,7 @@
-# node
+# --- Node ---
 node_modules/
 
-# compiled output
+# --- Cargo / Rust ---
 bin/
 # `bin/` above is overly broad — it also blocks Cargo's `src/bin/`
 # directories, which are LEGITIMATE source (one file per binary
@@ -10,20 +10,61 @@ bin/
 !**/src/bin/**
 pkg/
 target/
+*.rlib
+
+# --- EdgeZero core (shared across adapters) ---
+# Runtime dir the CLI creates for adapter-local state:
+#   - `.edgezero/.env`             — Axum's env-line file
+#   - `.edgezero/local-config-<id>.json` — Axum's local config store
+#   - `.edgezero/provision.lock`   — cross-process advisory lock
+#                                    (`provision` + `config push`)
+# The whole `.edgezero/` directory is per-machine and never committed.
+.edgezero/
+
+# --- Cloudflare adapter ---
+# `wrangler.toml` is regenerated by `provision --local`; teammates
+# must not commit each other's namespace ids / platform binding
+# names. `.dev.vars` holds operator-filled runtime secrets and
+# `.wrangler/` is `wrangler dev`'s local state directory.
+wrangler.toml
+.dev.vars
 .wrangler/
+
+# --- Fastly adapter ---
+# `fastly.toml` is regenerated by `provision --local`. It carries
+# the compute manifest + `[local_server]` Viceroy state; per-machine
+# secret entries and setup blocks must not be shared via git.
+fastly.toml
+
+# --- Spin adapter ---
+# `spin.toml` (component / variables) + `runtime-config.toml` (KV
+# backend paths) are regenerated by `provision --local`.
+# `.spin/` is Spin's local state directory (SQLite KV, log tail).
+spin.toml
+runtime-config.toml
 .spin/
-.edgezero/
 
-# env
+# --- Axum adapter ---
+# `axum.toml` is regenerated by `provision --local` (host / port /
+# crate name defaults; operator edits are preserved because
+# provision's merge path never re-writes the file after the first
+# synthesis).
+axum.toml
+
+# --- Shared per-crate `.env` ---
+# Spin's `<spin_crate>/.env` and any future adapter's crate-local
+# `.env` land here. `.edgezero/.env` also matches via the top-level
+# `.env` pattern; both are provision-owned + operator-filled and
+# must never be committed.
 .env
 
-# OS
+# --- OS ---
 .DS_Store
 
-# Worktrees
+# --- Worktrees ---
 .worktrees/
 
-# Editors
+# --- Editors ---
 .claude/*
 !.claude/settings.json
 !.claude/commands/
@@ -35,4 +76,3 @@ target/
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
-*.rlib

CHANGELOG.md

@@ -0,0 +1,104 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Breaking changes
+
+- **`edgezero-adapter::Adapter::provision` trait method changed shape.** Was
+  `fn provision(&self, root, adapter_manifest, component, stores, dry_run) -> Result<Vec<String>, String>`
+  with an `Ok(Vec::new())` default. Is now
+  `fn provision(&self, root, adapter_manifest, component, stores, deployed: Option<&AdapterDeployedState>, mode: ProvisionMode, dry_run) -> Result<ProvisionOutcome, String>`
+  with **no default** — every `impl Adapter` must supply it. Any
+  out-of-tree adapter written against the previous shape will fail to
+  compile with two errors: the method's arity and its return type. To
+  migrate:
+  1. Add a `mode: ProvisionMode` match arm and a `deployed: Option<&AdapterDeployedState>` parameter.
+  2. Return `ProvisionOutcome::from_status_lines(lines)` (or
+     `::with_deployed(lines, deployed_state)` when the cloud arm has
+     an id to write back) instead of `Ok(vec![...])`.
+  3. Add a fall-through arm `other => Err(...)` on the `match mode` —
+     `ProvisionMode` is `#[non_exhaustive]` and may gain variants.
+
+- **`edgezero-adapter::AdapterDeployedState`, `ProvisionOutcome`,
+  and `ProvisionMode` are now `#[non_exhaustive]`.** Struct-literal
+  construction from a downstream crate (e.g.
+  `ProvisionOutcome { status_lines, deployed }`) no longer compiles.
+  Use the new constructors:
+  - `ProvisionOutcome::from_status_lines(status_lines)` for local mode
+    (which returns `deployed: None`).
+  - `ProvisionOutcome::with_deployed(status_lines, deployed_state)`
+    for cloud mode that populates the writeback.
+  - `AdapterDeployedState::default()` + `.fields.insert(...)` /
+    `.sub_tables.insert(...)` for the deployed state.
+
+### Added
+
+- **`edgezero provision` / `edgezero config push` cross-process advisory
+  lock** (`.edgezero-provision.lock` alongside `edgezero.toml`).
+  Serialises concurrent invocations against the same tree so
+  read-modify-write on `.env` / `.dev.vars` / `edgezero.toml` no
+  longer silently drops a competing writer's edits. Dry-run skips
+  the lock. Auto-released on process exit; the sentinel file itself
+  is git-ignored per-machine and safe to delete when no invocation
+  is running.
+
+### Fixed
+
+- Fastly `service_id` no longer lands under `[local_server]` on
+  re-provision; the merged `fastly.toml` correctly carries it at the
+  TOML root so `fastly compute deploy` picks it up.
+- Fastly cloud `provision` populates `ProvisionOutcome.deployed.service_id`
+  from `fastly.toml`; the writeback to `[adapters.fastly.deployed]`
+  in `edgezero.toml` no longer silently drops.
+- Cloudflare `.dev.vars` commented `__KEY` placeholder now uses
+  `<logical>_staging` per spec Task 19 (was
+  `<placeholder-<logical>-key>`).
+- Cross-adapter `path_mutation_guard` unification (`edgezero-cli`
+  test binary): scaffold + push-shim tests share the same mutex, no
+  more intermittent CI flakes from PATH-restore races.
+- Cloud `config push` now honours the spec's path-containment MUST
+  (absolute path + `..` traversal rejection). The strict-local
+  "manifest inside adapter crate" check stays `--local`-gated so
+  existing cloud fixtures with root-level manifest paths keep
+  working.
+- Provision `.dev.vars` / `.env` written 0600 on Unix so operator-
+  filled secret values are not world-readable.
+- Provision line-oriented files reject values containing `\n` or
+  `\r` — a malicious env override can no longer split into a second
+  `KEY=VALUE` line and inject an unintended env-var.
+- Dry-run report emits a **unified diff with 2-line context radius**
+  instead of the full pre-image; `.dev.vars` / `.env` operator
+  values no longer stream into CI logs.
+- Adapter error paths inside `run_local_dry_run` sanitise raw
+  `/var/folders/.../edgezero-staging-*` tempdir paths back to the
+  project-relative form before surfacing.
+
+### Test coverage
+
+- End-to-end env-overlay: `EDGEZERO__STORES__<KIND>__<LOGICAL>__NAME`
+  now has an integration test that drives it from process env
+  through `EnvConfig::store_name()` into the emitted `.edgezero/.env`.
+- Case-insensitive adapter arg: `--adapter AXUM` against
+  `[adapters.axum]` lowercase now covered (previously only the
+  reverse direction was locked).
+- Cloudflare `wrangler.toml` schema header preserved at line 1 after
+  provision merge into an operator-authored doc.
+- `*.toml.hbs` scaffold templates walker asserts no `KEY = ""`
+  placeholder leaks past `write_baseline_to_disk`.
+- Fastly root-scalar assertions (`service_id`, `[[local_server.kv_stores.sessions]]`
+  stub row) now reparse-then-index instead of substring-match, so
+  the shipped `service_id`-under-`[local_server]` bug's regression
+  class is locked.
+
+### Deprecated / renamed
+
+- Three tests named `provision_local_push_after_provision_preserves_*`
+  were renamed to `provision_typed_local_re_run_preserves_*` —
+  their bodies never invoked `push_config_entries` and the prior
+  name misled readers looking for real push→provision coverage.
+  Real push→provision integration coverage is still an open gap.

Cargo.toml

@@ -42,6 +42,12 @@ edgezero-cli = { path = "crates/edgezero-cli", default-features = false }
 fastly = "0.12"
 fern = "0.7"
 flate2 = { version = "1", features = ["rust_backend"] }
+# Cross-platform advisory file locks (flock on Unix, LockFileEx on
+# Windows). Used by edgezero-cli to serialise concurrent `provision`
+# / `config push` invocations against the same project tree so
+# read-modify-write on `.env` / `.dev.vars` / `edgezero.toml`
+# doesn't silently drop a competing writer's changes.
+fs4 = { version = "0.13", default-features = false, features = ["sync"] }
 futures = { version = "0.3", features = ["std", "executor"] }
 futures-util = { version = "0.3", features = ["alloc", "io"] }
 handlebars = "6"
@@ -165,5 +171,25 @@ exhaustive_enums = "allow"
 std_instead_of_alloc = "allow"
 std_instead_of_core = "allow"
 
+# --- Layout / ordering restrictions that fight standard Rust conventions ---
+#
+# `mod_module_files` (deny) requires `cli.rs` sibling to `cli/` (2018
+# layout). We use the `cli/mod.rs` form because it groups the module + its
+# submodules under one directory — more grep-friendly and matches the
+# codebase's four adapter crates. `self_named_module_files` (the opposite
+# lint) would fire the other way. This workspace picks the `mod.rs` form
+# and allows the lint globally with one line here rather than sprinkling
+# a `#![expect]` in every adapter's `cli/mod.rs`.
+mod_module_files = "allow"
+#
+# `arbitrary_source_item_ordering` (deny) enforces a strict order among 5
+# item kinds (module/struct/enum/trait/impl) and its config API can't be
+# tuned for the common patterns this workspace uses: cfg-gated `use` in
+# the middle of a file for test-only helpers, the "declare struct then
+# immediately impl it" convention, and interleaved trait impls between
+# module declarations and statics. Reordering the ~15k lines across four
+# adapter crates to satisfy the lint would be pure churn.
+arbitrary_source_item_ordering = "allow"
+
 [workspace.lints.rust]
 unsafe_code = "deny"