Add Spin framework adapter

[ChristianPavilonis]

Summary

• Add a new mocktioneer-adapter-spin crate so Mocktioneer can run on the Fermyon Spin platform via WASI.
• Register the Spin adapter across all existing HTTP trigger routes in edgezero.toml.
• Ignore Spin runtime log directories in .gitignore.

Changes

Crate / File	Change
crates/mocktioneer-adapter-spin/Cargo.toml	New crate manifest with cdylib target, spin feature, and WASM-only deps
crates/mocktioneer-adapter-spin/src/lib.rs	Spin HTTP component entrypoint delegating to edgezero_adapter_spin::run_app
crates/mocktioneer-adapter-spin/spin.toml	Spin manifest (catch-all route, WASM source, outbound hosts, build config)
edgezero.toml	Added "spin" to every route's adapters list; added [adapters.spin] section with build/serve/deploy commands
.gitignore	Ignore .spin/logs/ directories

Test plan

• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo check --workspace --all-targets --features "fastly cloudflare"

Checklist

• Changes follow CLAUDE.md conventions
• Business logic lives in mocktioneer-core, not in adapter crates
• New routes added to both routes.rs and edgezero.toml
• Determinism preserved — no randomness or time-dependent logic
• No secrets or credentials committed

[aram356]

PR Review

Summary

The PR adds a Spin framework adapter following the existing adapter pattern. The adapter code itself is clean and minimal, but there are fundamental workspace integration issues that prevent the crate from building or being validated by CI.

Findings

🔧 Needs Change

• Crate not in workspace members: crates/mocktioneer-adapter-spin is not listed in [workspace].members in root Cargo.toml. All CI gates (test, clippy, fmt) pass only because cargo doesn't know this crate exists — it is never compiled, tested, or linted.
• Missing workspace dependencies: edgezero-adapter-spin and spin-sdk are referenced as workspace = true but not declared in [workspace.dependencies]. Hard build failure once the crate is added to workspace members.
• Duplicate dependency with conflicting features: edgezero-adapter-spin appears in both [dependencies] and [target.wasm32.dependencies] with different feature specs. See inline comment for details.
• Missing license.workspace = true: Inconsistent with Fastly and Cloudflare adapters.
• Empty crate on host target: All code is #[cfg(target_arch = "wasm32")], leaving an empty lib for host builds.

❓ Questions

• Does edgezero-adapter-spin exist upstream? It's not in Cargo.lock or workspace deps. If the edgezero framework doesn't have Spin support yet, this PR is premature.
• Spin 2 vs Spin 3? spin_manifest_version = 2 + wasm32-wasip1 = Spin 2.x. Spin 3.x uses WASI Preview 2. Which is targeted?

🤔 Thoughts

• spin.toml build command missing -p flag: Will try to build entire workspace for WASM, which will fail (Axum can't compile to WASM).

⛏ Nitpicks

• Missing echo_stdout in spin adapter logging (edgezero.toml): Other adapters explicitly set this. Minor inconsistency.

🌱 Seeds

• CI feature check: Once merged, cargo check --features "fastly cloudflare" should become --features "fastly cloudflare spin".

👍 Praise

• Clean route registration: All existing routes correctly updated with "spin" in the adapters array. No routes missed.
• Adapter stays thin: 12 lines delegating to edgezero_adapter_spin::run_app. Exactly the right pattern.

CI Status

• fmt: PASS (but spin crate not checked — not in workspace)
• clippy: PASS (but spin crate not checked — not in workspace)
• tests: PASS (but spin crate not compiled — not in workspace)

[aram356]

PR Review

Summary

Clean adapter addition that follows the thin-adapter pattern well. All CI gates pass (fmt, clippy, tests, feature check). One blocking item on dependency placement.

Findings

🔧 Needs Change

• edgezero-core in wrong dependency section: Should be in base [dependencies], not WASM-only target section — inconsistent with Cloudflare adapter and fragile if the adapter evolves (crates/mocktioneer-adapter-spin/Cargo.toml:23)

❓ Questions

• No main.rs fallback: Fastly adapter has a #[cfg(not(target_arch = "wasm32"))] fn main() stub. Spin is a cdylib like Cloudflare (which also lacks one), so this is consistent — confirming it's intentional?
• Release-only builds for local dev: spin.toml source path and build command always use --release. Consistent with Fastly's pattern, but means spin up always does a release build.

🤔 Thoughts

• anyhow dependency asymmetry: Neither Fastly nor Cloudflare adapters depend on anyhow. Justified by spin-sdk API contract — just noting the asymmetry.
• Missing echo_stdout in spin logging section: Fastly adapter has echo_stdout = false, Spin doesn't. Cloudflare also omits it, so consistent with at least one adapter.

🌱 Seeds

• Wildcard allowed_outbound_hosts: ["https://*:*"] is broad for a mock bidder making no outbound requests. Consider tightening to [] or documenting why (spin.toml:13).
• Documentation updates needed: CLAUDE.md workspace layout, compilation targets table, and project overview don't mention Spin. Should be a follow-up.

📝 Notes

• spin_manifest_version = 3 is correct for Spin 3.x
• .gitignore additions for .spin/logs/ are appropriate
• Cargo.lock changes bring in legitimate Spin ecosystem crates

CI Status

• fmt: PASS
• clippy: PASS
• tests: PASS (90 tests)
• feature check (fastly cloudflare spin): PASS

[aram356]

PR Review

Summary

Clean, well-structured Spin adapter that follows established project patterns. One security-relevant finding around outbound permissions; the rest are questions and suggestions.

Findings

🔧 Needs Change

• Overly permissive allowed_outbound_hosts: https://*:* grants full outbound HTTPS access but Mocktioneer never makes outbound calls (crates/mocktioneer-adapter-spin/spin.toml:13)

❓ Questions

• Does edgezero-adapter-spin require outbound host permissions?: If the framework makes outbound calls at init or during request processing, the field needs to stay but should be scoped to specific hosts rather than a wildcard
• Is edgezero-core needed as a direct wasm32 dependency?: lib.rs never imports from it directly — other WASM adapters have the same pattern, is it needed for Cargo feature unification? (crates/mocktioneer-adapter-spin/Cargo.toml:23)

🤔 Thoughts

• Missing echo_stdout in logging config: Other adapters explicitly set this field; Spin section omits it (edgezero.toml:218)

📌 Out of Scope

• Documentation needs updating: Adapters overview, architecture diagram, and CLAUDE.md compilation targets table don't include Spin yet — follow-up PR
• EdgeZero CLI --adapter spin support: Confirm the CLI recognizes the spin adapter from edgezero.toml entries

CI Status

• fmt: PASS
• clippy: PASS
• tests: PASS (71 unit + 19 integration)

[aram356]

🔧 Overly permissive outbound hosts

allowed_outbound_hosts = ["https://*:*"] grants the component permission to make outbound HTTPS requests to any host on any port. Mocktioneer is a deterministic mock bidder that never makes outbound network calls — all responses are computed locally from the request.

This should be empty unless edgezero-adapter-spin itself requires outbound connectivity (config fetch, telemetry, etc.). If it does, it should be narrowed to specific hosts.

allowed_outbound_hosts = []

Or remove the line entirely — Spin 3 defaults to no outbound.

[aram356]

❓ Is edgezero-core needed as a direct dependency?

lib.rs never directly uses anything from edgezero_core — it only references edgezero_adapter_spin::run_app, mocktioneer_core::MocktioneerApp, and spin_sdk types.

The other WASM adapters (Cloudflare, Fastly) also include edgezero-core as a direct dep despite not importing it in their entrypoints. Is this needed for Cargo feature unification or a build-time requirement? If so, a brief comment would help future contributors understand why.

[aram356]

🤔 Missing echo_stdout in logging config

Axum and Cloudflare explicitly set echo_stdout = true, Fastly sets echo_stdout = false. If this field has a meaningful default or is irrelevant for Spin's WASI stderr-based logging, that's fine — but explicit consistency with other adapters would be clearer.

[adapters.spin.logging]
level = "info"
echo_stdout = true