test: close host-testable coverage gaps (handler, nested-AppConfig checker, AdapterPushContext, run_native_cli, compression)

.claude/agents/build-validator.md

@@ -27,7 +27,7 @@ cargo check -p edgezero-core --all-features
 cargo check -p edgezero-adapter-fastly --features cli
 cargo check -p edgezero-adapter-cloudflare --features cli
 cargo check -p edgezero-adapter-axum --features axum
-cargo check -p edgezero-cli --features dev-example
+cargo check -p edgezero-cli --features demo-example
 ```
 
 ## Demo apps

.claude/agents/verify-app.md

@@ -50,7 +50,7 @@ Demo adapters must build for their respective WASM targets.
 ## 6. Dev server smoke test
 
 ```
-cargo run -p edgezero-cli --features dev-example -- dev &
+cargo run -p edgezero-cli --features demo-example -- demo &
 pid=$!
 trap 'kill "$pid" 2>/dev/null || true; wait "$pid" 2>/dev/null || true' EXIT
 sleep 3

.claude/settings.json

@@ -1,32 +1,30 @@
 {
   "permissions": {
     "allow": [
-      "Bash(ls:*)",
-      "Bash(cat:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)",
-      "Bash(wc:*)",
-      "Bash(tree:*)",
-      "Bash(which:*)",
-
       "Bash(cargo build:*)",
-      "Bash(cargo test:*)",
       "Bash(cargo check:*)",
+      "Bash(cargo clippy:*)",
+      "Bash(cargo fmt:*)",
       "Bash(cargo metadata:*)",
       "Bash(cargo run -p edgezero-cli:*)",
-
-      "Bash(cargo fmt:*)",
-      "Bash(cargo clippy:*)",
-
+      "Bash(cargo test:*)",
+      "Bash(cat:*)",
+      "Bash(git branch:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git status:*)",
+      "Bash(head:*)",
+      "Bash(ls:*)",
       "Bash(npm ci:*)",
       "Bash(npm run:*)",
-
       "Bash(rustup target:*)",
-
-      "Bash(git status:*)",
-      "Bash(git diff:*)",
-      "Bash(git log:*)",
-      "Bash(git branch:*)"
+      "Bash(tail:*)",
+      "Bash(tree:*)",
+      "Bash(wc:*)",
+      "Bash(which:*)"
     ]
+  },
+  "enabledPlugins": {
+    "superpowers@claude-plugins-official": true
   }
 }

.github/pull_request_template.md

@@ -25,9 +25,12 @@ Closes #
 
 - [ ] `cargo test --workspace --all-targets`
 - [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
-- [ ] `cargo check --workspace --all-targets --features "fastly cloudflare"`
-- [ ] WASM builds: `wasm32-wasip1` (Fastly) / `wasm32-unknown-unknown` (Cloudflare)
-- [ ] Manual testing via `edgezero-cli dev`
+- [ ] `cargo fmt --all -- --check`
+- [ ] `cargo check --workspace --all-targets --features "fastly cloudflare spin"`
+- [ ] WASM builds: `wasm32-wasip1` (Fastly) / `wasm32-wasip2` (Spin) / `wasm32-unknown-unknown` (Cloudflare)
+- [ ] `examples/app-demo` workspace: `cd examples/app-demo && cargo test --workspace --all-targets`
+- [ ] Docs build: `cd docs && npm run lint && npm run format && npm run build`
+- [ ] Manual testing via `edgezero serve --adapter axum` (the pre-rewrite `edgezero-cli dev` was renamed; see [cli-reference](docs/guide/cli-reference.md#edgezero-demo))
 - [ ] Other: <!-- describe -->
 
 ## Checklist
@@ -36,5 +39,6 @@ Closes #
 - [ ] No Tokio deps added to core or adapter crates
 - [ ] Route params use `{id}` syntax (not `:id`)
 - [ ] Types imported from `edgezero_core` (not `http` crate)
+- [ ] Store wiring goes through `KvRegistry` / `ConfigRegistry` / `SecretRegistry` (not the legacy single-handle setters) — see spec §6.6
 - [ ] New code has tests
 - [ ] No secrets or credentials committed

.github/workflows/format.yml

@@ -52,6 +52,19 @@ jobs:
       - name: Run cargo clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
+      # Plan task 8.3 corollary: `examples/app-demo` is excluded
+      # from the root workspace, so the fmt/clippy steps above
+      # don't cover it. Run the same gates against it explicitly
+      # — the app-demo workspace has the same strict-clippy
+      # config and is the showcase a new user clones.
+      - name: Run cargo fmt (app-demo workspace)
+        working-directory: examples/app-demo
+        run: cargo fmt --all -- --check
+
+      - name: Run cargo clippy (app-demo workspace)
+        working-directory: examples/app-demo
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
   adapter-wasm-clippy:
     name: ${{ matrix.adapter }} wasm clippy
     runs-on: ubuntu-latest
@@ -64,7 +77,7 @@ jobs:
           - adapter: fastly
             target: wasm32-wasip1
           - adapter: spin
-            target: wasm32-wasip1
+            target: wasm32-wasip2
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/test.yml

@@ -44,17 +44,43 @@ jobs:
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
 
       - name: Add wasm targets
-        run: rustup target add wasm32-wasip1 wasm32-unknown-unknown
+        run: rustup target add wasm32-wasip1 wasm32-wasip2 wasm32-unknown-unknown
 
       - name: Fetch dependencies (locked)
         run: cargo fetch --locked
 
+      - name: No placeholder pins
+        run: ./scripts/check_no_placeholder_pins.sh
+
+      - name: No legacy typed reads
+        run: ./scripts/check_no_legacy_typed_reads.sh
+
+      - name: Nested AppConfig audit
+        run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
+
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 
       - name: Check feature compilation
         run: cargo check --workspace --all-targets --features "fastly cloudflare spin"
 
+      - name: Verify a generated project compiles
+        run: cargo test -p edgezero-cli --test generated_project_builds -- --ignored
+
+      # `examples/app-demo` is excluded from the root workspace, so
+      # `cargo test --workspace` above does not cover it. Run its own
+      # workspace tests separately. An end-to-end push →
+      # AxumConfigStore → handler roundtrip in
+      # `app-demo-cli/tests/config_flow.rs` exists to be exercised by
+      # THIS step — without it, a regression in the JSON-file contract
+      # between `config push --adapter axum` and
+      # `AxumConfigStore::from_path` would not be caught by CI.
+      # Axum-only path, no live external calls — intentionally kept
+      # off the wasm matrix.
+      - name: Run app-demo workspace tests
+        working-directory: examples/app-demo
+        run: cargo test --workspace --all-targets
+
   adapter-wasm-tests:
     name: ${{ matrix.adapter }} wasm tests
     runs-on: ubuntu-latest
@@ -71,8 +97,8 @@ jobs:
             runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
             runner_value: viceroy run
           - adapter: spin
-            target: wasm32-wasip1
-            runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
+            target: wasm32-wasip2
+            runner_env: CARGO_TARGET_WASM32_WASIP2_RUNNER
             runner_value: wasmtime run
     steps:
       - uses: actions/checkout@v6

.gitignore

@@ -3,6 +3,11 @@ node_modules/
 
 # compiled output
 bin/
+# `bin/` above is overly broad — it also blocks Cargo's `src/bin/`
+# directories, which are LEGITIMATE source (one file per binary
+# target). Re-include any `src/bin/` directory anywhere in the tree.
+!**/src/bin/
+!**/src/bin/**
 pkg/
 target/
 .wrangler/
@@ -18,9 +23,6 @@ target/
 # Worktrees
 .worktrees/
 
-# Superpowers plans
-docs/superpowers/
-
 # Editors
 .claude/*
 !.claude/settings.json

.tool-versions

@@ -1,5 +1,12 @@
 fastly 15.1.0
 nodejs 24.12.0
 rust 1.95.0
+# spin-cli is not pinned by asdf-style version managers (no
+# asdf-spin plugin in widespread use). spin-sdk ~6.0 in the
+# workspace imports wasi:http/types@0.3.0-rc-2026-03-15, which
+# the Spin 3.6.x runtime does not provide; Spin 3.7+ is required
+# for the demo's Spin adapter to boot. Install matching CLI
+# manually (https://spinframework.dev/install) before running
+# smoke_test_config_key_override.sh; otherwise set SKIP_SPIN=1.
 viceroy 0.17.0
 wasmtime 44.0.1

CLAUDE.md

@@ -17,9 +17,9 @@ crates/
   edgezero-adapter/           # Adapter registry and traits
   edgezero-adapter-fastly/    # Fastly Compute bridge (wasm32-wasip1)
   edgezero-adapter-cloudflare/# Cloudflare Workers bridge (wasm32-unknown-unknown)
-  edgezero-adapter-spin/      # Fermyon Spin bridge (wasm32-wasip1)
+  edgezero-adapter-spin/      # Fermyon Spin bridge (wasm32-wasip2)
   edgezero-adapter-axum/      # Axum/Tokio bridge (native, dev server)
-  edgezero-cli/               # CLI: new, build, deploy, dev, serve
+  edgezero-cli/               # CLI lib + bin: new, build, deploy, serve, auth, provision, config (validate|push), demo
 examples/app-demo/            # Reference app with all 4 adapters (excluded from workspace)
 docs/                         # VitePress documentation site (Node.js)
 scripts/                      # Build/deploy/test helper scripts
@@ -53,10 +53,10 @@ cargo clippy --workspace --all-targets --all-features -- -D warnings
 cargo check --workspace --all-targets --features "fastly cloudflare spin"
 
 # Spin wasm32 compilation check
-cargo check -p edgezero-adapter-spin --target wasm32-wasip1 --features spin
+cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin
 
-# Run the demo dev server
-cargo run -p edgezero-cli --features dev-example -- dev
+# Run the demo server
+cargo run -p edgezero-cli --features demo-example -- demo
 
 # Docs site
 cd docs && npm ci && npm run dev
@@ -71,7 +71,7 @@ faster iteration on a single crate.
 | ---------- | ------------------------ | ---------------------------------- |
 | Fastly     | `wasm32-wasip1`          | Requires Viceroy for local testing |
 | Cloudflare | `wasm32-unknown-unknown` | Requires `wrangler` for dev/deploy |
-| Spin       | `wasm32-wasip1`          | Requires `spin` CLI for dev/deploy |
+| Spin       | `wasm32-wasip2`          | Requires `spin` CLI for dev/deploy |
 | Axum       | Native (host triple)     | Standard Tokio runtime             |
 
 ## Coding Conventions
@@ -170,7 +170,7 @@ Each adapter follows the same structure:
 - `response.rs` — core response → platform response conversion
 - `proxy.rs` — platform-specific proxy client
 - `logger.rs` — platform-specific logging init
-- `cli.rs` — build/deploy commands (behind `cli` feature)
+- `cli.rs` — adapter dispatch behind the `cli` feature: `build` / `deploy` / `serve` (legacy) plus `Adapter::execute` for `auth` (login/logout/status) and dedicated trait methods `provision` (Stage 6 — platform-resource creation) and `push_config_entries` (Stage 7 — `config push` writeback). Self-registers via `#[ctor]` into the `edgezero-adapter` registry.
 
 Contract tests live in `tests/contract.rs` within each adapter crate.
 
@@ -187,7 +187,7 @@ Every PR must pass:
 2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 3. `cargo test --workspace --all-targets`
 4. `cargo check --workspace --all-targets --features "fastly cloudflare spin"`
-5. `cargo check -p edgezero-adapter-spin --target wasm32-wasip1 --features spin`
+5. `cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin`
 
 Docs CI additionally runs ESLint + Prettier on the `docs/` directory.