feat: add adapter-owned local provisioning and CLI lifecycle

.github/actions/deploy-core/tests/run.sh

@@ -2479,7 +2479,7 @@ test_fastly_logical_link_documentation() {
   local manifest="$REPO_ROOT/docs/guide/manifest-store-migration.md"
   local blob="$REPO_ROOT/docs/guide/blob-app-config-migration.md"
   local adoption="$REPO_ROOT/docs/guide/deploy-action-adoption.md"
-  local fastly_cli="$REPO_ROOT/crates/edgezero-adapter-fastly/src/cli.rs"
+  local fastly_cli="$REPO_ROOT/crates/edgezero-adapter-fastly/src/cli/staging.rs"
   local corpus="$WORK_DIR/fastly-logical-link-docs.md"
   local example_workflow="$WORK_DIR/application-deploy-workflow.yml"
   local example_deploy="$WORK_DIR/application-deploy-job.yml"

.github/actions/deploy-fastly/tests/make-smoke-fixture.sh

@@ -116,9 +116,11 @@ name = "fixture-app"
 
 [adapters.fastly.adapter]
 manifest = "adapter/fastly.toml"
+crate = "adapter"
 
 [adapters.spin.adapter]
 manifest = "adapter/spin.toml"
+crate = "adapter"
 TOML
   if [[ "$mode" == store-aware ]]; then
     cat >>edgezero.toml <<'TOML'
@@ -154,6 +156,7 @@ version = "0.1.0"
 source = "fixture.wasm"
 TOML
 
+  printf '\n.edgezero/\n' >>.gitignore
   cargo generate-lockfile
   # Path dependencies live in the enclosing EdgeZero checkout, not this Git repo.
   git -C "$workspace" rev-parse HEAD >.edgezero-source-revision

.github/workflows/test.yml

@@ -82,10 +82,83 @@ jobs:
         if: matrix.suite == 'cli'
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
 
+      # Enforce spec §"Adapter manifests are gitignored" + §"Migration for
+      # downstream projects". All five generated adapter manifests
+      # (`axum.toml`, `wrangler.toml`, `fastly.toml`, `spin.toml`,
+      # `runtime-config.toml`), Cloudflare's `.dev.vars`, AND the
+      # provision-written secret-bearing env-line files (Spin's
+      # `<crate>/.env`, Axum's `.edgezero/.env`) MUST NOT be tracked --
+      # teammates regenerate them locally via `provision --local`.
+      # The three exact request-fidelity manifests are hand-written runtime
+      # test inputs, not provision output. No other fixture state is exempt.
+      - name: Enforce adapter manifests and secret env files are not tracked
+        run: |
+          if git ls-files |
+            grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.(dev\.vars|env)(\..*)?$|(^|/)\.edgezero-write-' |
+            grep -Ev '^tests/fixtures/request-fidelity/(fastly|spin|wrangler)\.toml$|(^|/)\.env\.example$'; then
+            echo "::error::These adapter manifests AND secret-bearing env files (.dev.vars / .env) must be gitignored (spec §'Adapter manifests are gitignored' + §'Migration for downstream projects'). They carry operator secret values and must NEVER be committed."
+            exit 1
+          fi
+
+      # The step above only proves these files are not CURRENTLY tracked.
+      # Also prove they are actually IGNORED, so a `git add` can't slip a
+      # regenerated manifest (or a secret-bearing env file) into a commit.
+      # `git check-ignore` evaluates the ignore rules against the pathname
+      # whether or not the file exists.
+      - name: Enforce adapter manifests and secret env files are gitignored
+        run: |
+          for probe in \
+            crates/demo/axum.toml \
+            crates/demo/wrangler.toml \
+            crates/demo/fastly.toml \
+            crates/demo/spin.toml \
+            crates/demo/runtime-config.toml \
+            crates/demo/.dev.vars \
+            crates/demo/.dev.vars.production \
+            crates/demo/.dev.vars.local \
+            crates/demo/.env \
+            crates/demo/.env.production \
+            crates/demo/.env.local \
+            crates/demo/.edgezero-write-probe \
+            .edgezero/.env; do
+            if ! git check-ignore -q "$probe"; then
+              echo "::error::'$probe' is NOT gitignored. Add the pattern to .gitignore so provision-generated adapter state and secret-bearing env files can never be committed by accident."
+              exit 1
+            fi
+          done
+          for probe in .env.example crates/demo/.env.example crates/demo/src/bin/main.rs; do
+            if git check-ignore -q "$probe"; then
+              echo "::error::'$probe' must remain available for source control."
+              exit 1
+            fi
+          done
+
+      # The checker's own unit tests live behind `required-features =
+      # ["nested-app-config-check"]`, so the unfeatured
+      # `cargo test --workspace` step below does not compile or run them.
+      # Exercise them explicitly to keep the coverage closure enforced by CI.
       - name: Nested AppConfig checker tests
         if: matrix.suite == 'cli'
         run: cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config
 
+      - name: Check standalone CLI feature combinations
+        if: matrix.suite == 'cli'
+        run: |
+          cargo check -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check
+          cargo clippy -p edgezero-cli --lib --no-default-features -- -D warnings
+          cargo clippy -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check -- -D warnings
+          cargo clippy -p edgezero-cli --all-targets --no-default-features --features cli -- -D warnings
+
+      # Lint the smoke/helper shell scripts. `-x` follows `source`d libs;
+      # `--severity=warning` gates on warnings and errors (SC1091/SC2086-style
+      # info notes stay advisory). ubuntu-latest ships shellcheck.
+      - name: ShellCheck smoke scripts
+        run: shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh
+
+      # Run the backup/restore helper's own unit tests -- fail-closed backup,
+      # atomic restore, symlink refusal, ownership-guarded server teardown.
+      - name: Smoke backup helper unit tests
+        run: bash scripts/lib/smoke_backup_test.sh
       - name: Verify native request ingress harness
         if: matrix.suite == 'workspace'
         run: |

.gitignore

@@ -1,7 +1,7 @@
-# node
+# --- Node ---
 node_modules/
 
-# compiled output
+# --- Cargo / Rust ---
 bin/
 # `bin/` above is overly broad — it also blocks Cargo's `src/bin/`
 # directories, which are LEGITIMATE source (one file per binary
@@ -10,9 +10,34 @@ bin/
 !**/src/bin/**
 pkg/
 target/
-.wrangler/
-.spin/
+*.rlib
+
+# --- EdgeZero core (shared across adapters) ---
+# Runtime dir the CLI creates for adapter-local state:
+#   - `.edgezero/.env`             — Axum's env-line file
+#   - `.edgezero/local-config-<id>.json` — Axum's local config store
+#   - `.edgezero/provision.lock`   — cross-process advisory lock
+#                                    (`provision` + `config push`)
+# The whole `.edgezero/` directory is per-machine and never committed.
 .edgezero/
+.edgezero-write-*
+
+# --- Cloudflare adapter ---
+# `wrangler.toml` is regenerated by `provision --local`; teammates
+# must not commit each other's namespace ids / platform binding
+# names. `.dev.vars` holds operator-filled runtime secrets and
+# `.wrangler/` is `wrangler dev`'s local state directory.
+wrangler.toml
+.dev.vars
+.dev.vars.*
+.wrangler/
+
+# --- Fastly adapter ---
+# `fastly.toml` is regenerated by `provision --local`. It carries
+# the compute manifest + `[local_server]` Viceroy state; per-machine
+# secret entries and setup blocks must not be shared via git.
+fastly.toml
+fastly.edgezero-*.toml
 
 # Fastly local config-push lock and staging temp files (sidecars next to the
 # manifest). `examples/app-demo` has a `fastly.toml`, so `config push --local`
@@ -21,16 +46,37 @@ target/
 .*.edgezero-lock
 .*.edgezero-*.tmp
 
-# env
+# --- Spin adapter ---
+# `spin.toml` (component / variables) + `runtime-config.toml` (KV
+# backend paths) are regenerated by `provision --local`.
+# `.spin/` is Spin's local state directory (SQLite KV, log tail).
+spin.toml
+runtime-config.toml
+.spin/
+
+# --- Axum adapter ---
+# `axum.toml` is regenerated by `provision --local` (host / port /
+# crate name defaults; operator edits are preserved because
+# provision's merge path never re-writes the file after the first
+# synthesis).
+axum.toml
+
+# --- Shared per-crate `.env` ---
+# Spin's `<spin_crate>/.env` and any future adapter's crate-local
+# `.env` land here. `.edgezero/.env` also matches via the top-level
+# `.env` pattern; both are provision-owned + operator-filled and
+# must never be committed.
 .env
+.env.*
+!.env.example
 
-# OS
+# --- OS ---
 .DS_Store
 
-# Worktrees
+# --- Worktrees ---
 .worktrees/
 
-# Editors
+# --- Editors ---
 .claude/*
 !.claude/settings.json
 !.claude/commands/
@@ -42,4 +88,3 @@ target/
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
-*.rlib