Epic: provision --local implementation #288

Epic tracking the provision --local workstream. Delivered by PR #287 (ready for review; all sub-sections landed on one branch).

Source artifacts

• Spec: docs/superpowers/specs/2026-06-23-provision-local.md
• Plan: docs/superpowers/plans/2026-06-27-provision-local.md
• PR: feat: provision --local + gitignored adapter manifests + hardened path safety #287

Goal

Add --local to edgezero provision. Local mode synthesises minimal per-adapter manifests, merges per-store bindings, writes adapter-local env files, and never shells out to cloud CLIs. Dry-run stages a real tempdir copy and diffs the result back. All five adapter manifests (axum.toml, wrangler.toml, fastly.toml, spin.toml, runtime-config.toml) become gitignored generated state — the 2026-07 amendment folded axum.toml into the set.

Delivered sections

All sub-sections landed directly on PR #287 (rather than as separate sub-PRs merging into it). Each closes on that PR's merge:

• Section 1 — CLI surface, neutral types, trait method (Tasks 1–5) #289 — Section 1: CLI surface, neutral types, trait method (Tasks 1–5)
• Section 2 — Shared path safety (Tasks 6–7) #290 — Section 2: Shared path safety (Tasks 6–7)
• Section 3 — Local provision orchestration + dry-run staging (Tasks 8–13) #291 — Section 3: Local provision orchestration + dry-run staging (Tasks 8–13)
• Section 4 — ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c) #292 — Section 4: ManifestAdapterDeployed schema + writeback (Tasks 14–16, 16b–16c)
• Section 5 — Per-adapter local writers (Tasks 17–28, 28b) #293 — Section 5: Per-adapter local writers (Tasks 17–28, 28b)
• Section 6 — Typed provision wiring (Tasks 29–31, 30b) #294 — Section 6: Typed provision wiring (Tasks 29–31, 30b)
• Section 7 — Scaffold + gitignore + run_serve (Tasks 32–35) #295 — Section 7: Scaffold + gitignore + run_serve (Tasks 32–35)
• Section 8 — Documentation + CI grep gate (Tasks 36–37) #296 — Section 8: Documentation + CI grep gate (Tasks 36–37)
• Section 9 — Per-adapter contract tests + final verification (Tasks 38–43) #297 — Section 9: Per-adapter contract tests + final verification (Tasks 38–43)

Post-plan additions (from external review iterations)

Beyond the original 43 plan tasks, review iterations added:

• Axum folded into gitignored-generated set (scaffold template removed; CI gate + .gitignore + docs updated).
• Renamed / nested adapter crate support via cli_support::read_adapter_crate_name upward walk.
• Spin [application].name and wasm basename decoupled from the [adapters.spin.adapter].component selector.
• Path safety extended to run_config_diff_typed and run_serve; strict-local now requires BOTH .manifest AND .crate.
• Env-value redaction in dry-run diff output, including commented # KEY=value lines.
• Typed dry-run runs full run_manifest_shape_gates (not just capability + handler-path checks).
• Spin run_serve derives .env from [adapters.spin.adapter].manifest.parent() (was .crate; broke on nested manifests). Contract test observes the spawned child's inherited env.
• Non-test #[expect(...)] restructure sweep — removed via explicit trait method overrides, ConfigPushSuppressions sub-struct, stream module, and structural code fixes rather than workspace-level allows.

CI gates (per plan's Global Constraints)

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin

Out of scope

Listed in the spec's "Out of scope" section — most notably: automatic Cloudflare preview-namespace capture, provision --local --gen-secrets, sync-deployed command, and OS-level filesystem sandboxing for adapter dispatch.