feat: provision --local + gitignored adapter manifests + hardened path safety

.claude/settings.json

@@ -21,7 +21,9 @@
       "Bash(tail:*)",
       "Bash(tree:*)",
       "Bash(wc:*)",
-      "Bash(which:*)"
+      "Bash(which:*)",
+      "WebFetch(domain:www.fastly.com)",
+      "WebFetch(domain:raw.githubusercontent.com)"
     ]
   },
   "enabledPlugins": {

.github/actions/deploy-core/tests/run.sh

@@ -2479,7 +2479,7 @@ test_fastly_logical_link_documentation() {
   local manifest="$REPO_ROOT/docs/guide/manifest-store-migration.md"
   local blob="$REPO_ROOT/docs/guide/blob-app-config-migration.md"
   local adoption="$REPO_ROOT/docs/guide/deploy-action-adoption.md"
-  local fastly_cli="$REPO_ROOT/crates/edgezero-adapter-fastly/src/cli.rs"
+  local fastly_cli="$REPO_ROOT/crates/edgezero-adapter-fastly/src/cli/staging.rs"
   local corpus="$WORK_DIR/fastly-logical-link-docs.md"
   local example_workflow="$WORK_DIR/application-deploy-workflow.yml"
   local example_deploy="$WORK_DIR/application-deploy-job.yml"

.github/actions/deploy-fastly/tests/make-smoke-fixture.sh

@@ -116,9 +116,11 @@ name = "fixture-app"
 
 [adapters.fastly.adapter]
 manifest = "adapter/fastly.toml"
+crate = "adapter"
 
 [adapters.spin.adapter]
 manifest = "adapter/spin.toml"
+crate = "adapter"
 TOML
   if [[ "$mode" == store-aware ]]; then
     cat >>edgezero.toml <<'TOML'
@@ -154,6 +156,7 @@ version = "0.1.0"
 source = "fixture.wasm"
 TOML
 
+  printf '\n.edgezero/\n' >>.gitignore
   cargo generate-lockfile
   # Path dependencies live in the enclosing EdgeZero checkout, not this Git repo.
   git -C "$workspace" rev-parse HEAD >.edgezero-source-revision

.github/workflows/test.yml

@@ -76,10 +76,60 @@ jobs:
         if: matrix.suite == 'cli'
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
 
+      # Enforce spec §"Adapter manifests are gitignored" + §"Migration for
+      # downstream projects". All five generated adapter manifests
+      # (`axum.toml`, `wrangler.toml`, `fastly.toml`, `spin.toml`,
+      # `runtime-config.toml`), Cloudflare's `.dev.vars`, AND the
+      # provision-written secret-bearing env-line files (Spin's
+      # `<crate>/.env`, Axum's `.edgezero/.env`) MUST NOT be tracked --
+      # teammates regenerate them locally via `provision --local`.
+      - name: Enforce adapter manifests and secret env files are not tracked
+        run: |
+          if git ls-files | grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.dev\.vars$|(^|/)\.env$'; then
+            echo "::error::These adapter manifests AND secret-bearing env files (.dev.vars / .env) must be gitignored (spec §'Adapter manifests are gitignored' + §'Migration for downstream projects'). They carry operator secret values and must NEVER be committed."
+            exit 1
+          fi
+
+      # The step above only proves these files are not CURRENTLY tracked.
+      # Also prove they are actually IGNORED, so a `git add` can't slip a
+      # regenerated manifest (or a secret-bearing env file) into a commit.
+      # `git check-ignore` evaluates the ignore rules against the pathname
+      # whether or not the file exists.
+      - name: Enforce adapter manifests and secret env files are gitignored
+        run: |
+          for probe in \
+            crates/demo/axum.toml \
+            crates/demo/wrangler.toml \
+            crates/demo/fastly.toml \
+            crates/demo/spin.toml \
+            crates/demo/runtime-config.toml \
+            crates/demo/.dev.vars \
+            crates/demo/.env \
+            .edgezero/.env; do
+            if ! git check-ignore -q "$probe"; then
+              echo "::error::'$probe' is NOT gitignored. Add the pattern to .gitignore so provision-generated adapter state and secret-bearing env files can never be committed by accident."
+              exit 1
+            fi
+          done
+
+      # The checker's own unit tests live behind `required-features =
+      # ["nested-app-config-check"]`, so the unfeatured
+      # `cargo test --workspace` step below does not compile or run them.
+      # Exercise them explicitly to keep the coverage closure enforced by CI.
       - name: Nested AppConfig checker tests
         if: matrix.suite == 'cli'
         run: cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config
 
+      # Lint the smoke/helper shell scripts. `-x` follows `source`d libs;
+      # `--severity=warning` gates on warnings and errors (SC1091/SC2086-style
+      # info notes stay advisory). ubuntu-latest ships shellcheck.
+      - name: ShellCheck smoke scripts
+        run: shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh
+
+      # Run the backup/restore helper's own unit tests -- fail-closed backup,
+      # atomic restore, symlink refusal, ownership-guarded server teardown.
+      - name: Smoke backup helper unit tests
+        run: bash scripts/lib/smoke_backup_test.sh
       - name: Lifecycle fixture host tests
         if: matrix.suite == 'workspace'
         run: >-

.gitignore

@@ -1,7 +1,7 @@
-# node
+# --- Node ---
 node_modules/
 
-# compiled output
+# --- Cargo / Rust ---
 bin/
 # `bin/` above is overly broad — it also blocks Cargo's `src/bin/`
 # directories, which are LEGITIMATE source (one file per binary
@@ -10,27 +10,69 @@ bin/
 !**/src/bin/**
 pkg/
 target/
-.wrangler/
-.spin/
+*.rlib
+
+# --- EdgeZero core (shared across adapters) ---
+# Runtime dir the CLI creates for adapter-local state:
+#   - `.edgezero/.env`             — Axum's env-line file
+#   - `.edgezero/local-config-<id>.json` — Axum's local config store
+#   - `.edgezero/provision.lock`   — cross-process advisory lock
+#                                    (`provision` + `config push`)
+# The whole `.edgezero/` directory is per-machine and never committed.
 .edgezero/
 
+# --- Cloudflare adapter ---
+# `wrangler.toml` is regenerated by `provision --local`; teammates
+# must not commit each other's namespace ids / platform binding
+# names. `.dev.vars` holds operator-filled runtime secrets and
+# `.wrangler/` is `wrangler dev`'s local state directory.
+wrangler.toml
+.dev.vars
+.wrangler/
+
+# --- Fastly adapter ---
+# `fastly.toml` is regenerated by `provision --local`. It carries
+# the compute manifest + `[local_server]` Viceroy state; per-machine
+# secret entries and setup blocks must not be shared via git.
+fastly.toml
+fastly.edgezero-*.toml
+
 # Fastly local config-push lock and staging temp files (sidecars next to the
 # manifest). `examples/app-demo` has a `fastly.toml`, so `config push --local`
 # there leaves these behind; a SIGKILL/panic mid-push can also strand a temp.
 # The globs cover a manifest named something other than `fastly.toml`.
 .*.edgezero-lock
 .*.edgezero-*.tmp
 
-# env
+# --- Spin adapter ---
+# `spin.toml` (component / variables) + `runtime-config.toml` (KV
+# backend paths) are regenerated by `provision --local`.
+# `.spin/` is Spin's local state directory (SQLite KV, log tail).
+spin.toml
+runtime-config.toml
+.spin/
+
+# --- Axum adapter ---
+# `axum.toml` is regenerated by `provision --local` (host / port /
+# crate name defaults; operator edits are preserved because
+# provision's merge path never re-writes the file after the first
+# synthesis).
+axum.toml
+
+# --- Shared per-crate `.env` ---
+# Spin's `<spin_crate>/.env` and any future adapter's crate-local
+# `.env` land here. `.edgezero/.env` also matches via the top-level
+# `.env` pattern; both are provision-owned + operator-filled and
+# must never be committed.
 .env
 
-# OS
+# --- OS ---
 .DS_Store
 
-# Worktrees
+# --- Worktrees ---
 .worktrees/
 
-# Editors
+# --- Editors ---
 .claude/*
 !.claude/settings.json
 !.claude/commands/
@@ -42,4 +84,3 @@ target/
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
-*.rlib

CHANGELOG.md

@@ -0,0 +1,154 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Breaking changes
+
+- **Adapter CLI execution and lifecycle contexts.** `Adapter::execute` takes
+  `&AdapterExecContext`, and `deploy` takes both `&AdapterDeployContext` and
+  `&AdapterExecContext`. `preflight_deploy` and `finalize_deploy` now also receive
+  execution context. Apply `exec.env()` to every child process and credential
+  lookup while retaining the adapter's selected working directory. Build
+  contexts with `AdapterExecContext::new().with_env(...).with_cwd(...)`; honor
+  declared manifest/crate/component paths instead of rediscovering them.
+- **Adapter-owned local CLI metadata.** Implement `Adapter::local_layout` to
+  describe provision artifacts and the optional serve env file. Paths are
+  project-relative and receive the manifest, crate, and component declarations
+  through `AdapterLocalContext`. Mark secret-bearing env files with
+  `LocalArtifactKind::Env`, including custom filenames, and credential-bearing
+  TOML with `LocalArtifactKind::SensitiveToml`. The default describes
+  only the declared manifest. `AdapterBlueprint` literals now require
+  `tool_pins`, `install_notes`, and `local_ignore_patterns`; use empty slices
+  when unnecessary. Logging endpoints support the command template vocabulary
+  plus `{project_mod}`. `CommandTemplates` also requires `emit_commands`: choose
+  `false` when registry execution must honor the adapter manifest.
+- **Explicit config cloud target.** `AdapterPushContext::cloud_target` and
+  `.with_cloud_target(bool)` replace deploy-command inference. Set
+  `[adapters.<name>.adapter].cloud = true` for a cloud target and use the context
+  builder instead of the removed deploy-command context field.
+
+- **`edgezero-adapter::Adapter::provision` trait method changed shape.** Was
+  `fn provision(&self, root, adapter_manifest, component, stores, dry_run) -> Result<Vec<String>, String>`
+  with an `Ok(Vec::new())` default. Is now
+  `fn provision(&self, root, adapter_manifest, component, stores, deployed: Option<&AdapterDeployedState>, mode: ProvisionMode, dry_run) -> Result<ProvisionOutcome, String>`
+  with **no default** — every `impl Adapter` must supply it. Any
+  out-of-tree adapter written against the previous shape will fail to
+  compile with two errors: the method's arity and its return type. To
+  migrate:
+  1. Add a `mode: ProvisionMode` match arm and a `deployed: Option<&AdapterDeployedState>` parameter.
+  2. Return `ProvisionOutcome::from_status_lines(lines)` (or
+     `::with_deployed(lines, deployed_state)` when the cloud arm has
+     an id to write back) instead of `Ok(vec![...])`.
+  3. Add a fall-through arm `other => Err(...)` on the `match mode` —
+     `ProvisionMode` is `#[non_exhaustive]` and may gain variants.
+
+- **`edgezero-adapter::AdapterDeployedState`, `ProvisionOutcome`,
+  and `ProvisionMode` are now `#[non_exhaustive]`.** Struct-literal
+  construction from a downstream crate (e.g.
+  `ProvisionOutcome { status_lines, deployed }`) no longer compiles.
+  Use the new constructors:
+  - `ProvisionOutcome::from_status_lines(status_lines)` for local mode
+    (which returns `deployed: None`).
+  - `ProvisionOutcome::with_deployed(status_lines, deployed_state)`
+    for cloud mode that populates the writeback.
+  - `AdapterDeployedState::default()` + `.fields.insert(...)` /
+    `.sub_tables.insert(...)` for the deployed state.
+
+### Added
+
+- **`edgezero provision` / `edgezero config push` cross-process advisory
+  lock** (`.edgezero/provision.lock` under the manifest's project root).
+  Serialises concurrent invocations against the same tree so
+  read-modify-write on `.env` / `.dev.vars` / `edgezero.toml` no
+  longer silently drops a competing writer's edits. Dry-run skips
+  the lock. Auto-released on process exit; the sentinel file itself
+  is git-ignored per-machine and safe to delete when no invocation
+  is running.
+
+### Fixed
+
+- Redact native TOML values and comments in local provisioning previews and
+  omit source excerpts from native provision parse errors. Serialize Fastly
+  local provision with deploy writeback under the same manifest lock.
+- Preserve relative application-manifest selection across child working
+  directories, accept root adapter crates, and guard Spin artifact copies and
+  SQLite paths against intermediate symlinks, including paths containing `..`.
+
+- Preserve quoted multiline env records and original line endings during
+  provisioning. Readers, writers, and preview redaction share dotenv grammar;
+  generated values are encoded losslessly or rejected explicitly.
+- Targeted provision/config commands validate the selected adapter's policy;
+  whole-project config validation still checks all registered adapters. Derived
+  artifacts are checked in the original tree before previews are staged.
+- Remove inherited project-lock borrowing and deploy-wide shell locks. Rust
+  provision/config transactions hold real exclusive locks. Native Fastly deploy
+  writes a private manifest and merges only `service_id`, preserving unrelated
+  concurrent edits and refusing conflicting service changes. Immutable managed
+  deploys use a private native startup directory and forward execution context
+  to both Fastly and curl. Native Fastly serve requires a `fastly.toml` basename.
+- Reject symlinked Cloudflare local persistence before reads as well as writes;
+  Wrangler can initialize local state while reading.
+
+- Fastly `service_id` no longer lands under `[local_server]` on
+  re-provision; the merged `fastly.toml` correctly carries it at the
+  TOML root so `fastly compute deploy` picks it up.
+- Fastly cloud `provision` no longer auto-captures `service_id` from
+  the gitignored, per-machine `fastly.toml` into tracked
+  `[adapters.fastly.deployed]`. Per the v1 contract that writeback
+  stays a documented one-time manual copy after `fastly compute deploy`;
+  auto-capturing it let a stale local file silently overwrite the
+  team's committed service id.
+- Cloudflare `.dev.vars` commented `__KEY` placeholder now uses
+  `<logical>_staging` (was `<placeholder-<logical>-key>`).
+- Cross-adapter `path_mutation_guard` unification (`edgezero-cli`
+  test binary): scaffold + push-shim tests share the same mutex, no
+  more intermittent CI flakes from PATH-restore races.
+- Cloud `config push` now honours the spec's path-containment MUST
+  (absolute path + `..` traversal rejection). The strict-local
+  "manifest inside adapter crate" check stays `--local`-gated so
+  existing cloud fixtures with root-level manifest paths keep
+  working.
+- Provision `.dev.vars` / `.env` written 0600 on Unix so operator-
+  filled secret values are not world-readable.
+- Provision line-oriented files reject values containing `\n` or
+  `\r` — a malicious env override can no longer split into a second
+  `KEY=VALUE` line and inject an unintended env-var.
+- Dry-run report emits a **unified diff with 2-line context radius**
+  instead of the full pre-image; `.dev.vars` / `.env` operator
+  values no longer stream into CI logs.
+- Adapter error paths inside `run_local_dry_run` sanitise raw
+  `/var/folders/.../edgezero-staging-*` tempdir paths back to the
+  project-relative form before surfacing.
+
+### Test coverage
+
+- End-to-end env-overlay: `EDGEZERO__STORES__<KIND>__<LOGICAL>__NAME`
+  now has an integration test that drives it from process env
+  through `EnvConfig::store_name()` into the emitted `.edgezero/.env`.
+- Case-insensitive adapter arg: `--adapter AXUM` against
+  `[adapters.axum]` lowercase now covered (previously only the
+  reverse direction was locked).
+- Cloudflare `wrangler.toml` schema header preserved at line 1 after
+  provision merge into an operator-authored doc.
+- `*.toml.hbs` scaffold templates walker asserts no `KEY = ""`
+  placeholder leaks past `write_baseline_to_disk`.
+- Fastly root-scalar assertions (`service_id`, `[[local_server.kv_stores.sessions]]`
+  stub row) now reparse-then-index instead of substring-match, so
+  the shipped `service_id`-under-`[local_server]` bug's regression
+  class is locked.
+
+### Deprecated / renamed
+
+- Three tests named `provision_local_push_after_provision_preserves_*`
+  were renamed to `provision_typed_local_re_run_preserves_*` —
+  their bodies never invoked `push_config_entries` and the prior
+  name misled readers looking for real push→provision coverage.
+  Real push→provision coverage now exists as
+  `push_after_provision_preserves_*` in each adapter (Axum/Cloudflare/
+  Fastly/Spin): each seeds an operator secret into the provision-written
+  file, runs `config push --local`, and asserts that file is untouched.