feat(celld): add experimental local Worker runtime adapter

[ChristianPavilonis]

Summary

Add an experimental sibling runtime adapter for celld. Rust WASM and the workers-rs shim run directly inside celld, without Axum or an HTTP proxy.

• Reuse the existing Worker transport through explicit runtime options for adapter identity, provider metadata, secret policy, and config reader mode.
• Keep Cloudflare's public APIs and BYOB defaults. celld uses an explicit bounded default-stream reader because celld 0.6.2's KV BYOB reader returned zero bytes for valid stored data.
• Add registered local build/serve, JSON scaffolds, dependency wiring, and build/state/dev-variable ignore rules. Empty command overrides are omitted so generated consumers use registered validation.
• Reject declared secret stores and unsupported remote actions. Host allocation bounds and complete resource accounting remain unsupported.
• Include the detailed specification and implementation plan.

Dependency and draft status

Stacked on #275 using base branch docs/outbound-http-spec. This PR contains only the celld changes above that prerequisite. It should be retargeted after #275 merges.

Companion consumer: stackpop/mocktioneer#122, pinned to this PR's published commit.

Local-only experiment. No deployment, fleet provisioning, managed secrets, or remote config publication is implemented. It does not close the Axum production-readiness work.

AWS deployment comparison

For the first scalable Trusted Server deployment on AWS, prefer native Axum with AppConfig Agent, Secrets Manager and DynamoDB. Keep celld as an experimental sibling runtime while its stateful benefits and operational costs are evaluated.

This comparison assumes #414 will add DynamoDB support soon. It does not claim DynamoDB is implemented in its currently published revision, or that either deployment has production acceptance. Providing a generic DynamoDB store also does not automatically satisfy Trusted Server's stronger identity backend contract.

Concern	Axum with AWS stores, including planned DynamoDB	celld on AWS with this adapter
Topology	ALB plus replaceable native replicas across AZs; AWS-managed state	ALB plus a private EC2 fleet across AZs, encrypted local disks and a shared S3 fleet bucket
Config and secrets	AppConfig Agent and Secrets Manager startup snapshots; restart-based adoption in the current design	Verified KV config works locally; declared secrets are rejected; secure production publication/adoption remains additional work
Identity correctness	DynamoDB provides conditional writes and strong base-table reads for an explicitly designed Add/CAS/generation/withdrawal backend	Public KV does not expose conditional Add or generation-match updates; internal cell-ownership CAS is not application-key CAS
Scaling	HTTP replicas scale separately from database capacity; schema, hot keys and operation budgets still matter	HTTP execution and different cells can spread across nodes, but one KV namespace remains one owner/writer
Replacement and recovery	No identity ownership transfer between HTTP replicas once authoritative state is external	Scale-in needs draining/handoff and a tested crash-recovery path; fleet durability can depend on follower disks before S3 upload
Operations	Application lifecycle, IAM, release coordination and managed-store acceptance	Also private peer/operator protection, cell placement, replication, node/disk recovery and stateful upgrade qualification

flowchart TD
    NativeALB[ALB for native deployment] --> Axum[Stateless Axum replicas across AZs]
    Axum --> AWSConfig[Startup snapshots from AppConfig Agent and Secrets Manager]
    Axum --> DDB[DynamoDB identity backend with enforced preconditions]

    CelldALB[ALB for celld deployment] --> Fleet[Private EC2 celld fleet across AZs]
    Fleet --> Owner[Binding calls route to the cell owner]
    Fleet --> S3[S3 deployment, lease and durable-state bucket]
    Owner --> S3

Loading

A plausible celld starting point is three On-Demand nodes in one region, supervised processes, scoped instance roles, private peer/operator networking, ALB readiness that includes application config, and ASG lifecycle hooks for planned termination. Begin durability acceptance with CELLD_DURABILITY=bucket; qualify peer-disk fleet mode separately. Do not expose the internal listener or assume three-AZ compute placement proves follower placement. This PR does not provision that architecture.

For DynamoDB, use explicit strong reads and a schema that supports strong per-identity prefix queries on the base table, not an eventual GSI. Apply logical expiry rather than relying on asynchronous TTL deletion. Validate generation reuse, concurrent consent withdrawal and the current synchronous identity interface's integration with async SDK calls. Those remain application/backend acceptance requirements even after #414 adds provider support.

celld could become worthwhile for independently sharded transactional actors, long-lived sessions, Worker portability or non-AWS storage. A per-identity Durable Object/SQLite backend is a possible future design, but is not delivered by the current KV adapter.

No comparative latency/cost benchmark or AWS fault testing has been performed. The real localhost WASM/config demo is transport evidence, not proof of production fleet or identity correctness.

References: celld KV, security, durability/recovery, DynamoDB consistency, conditional writes, and TTL.

Validation

• Cloudflare host tests: 33 passed; celld tests: 11 passed.
• CLI: 239 unit tests and enabled integration/doc checks passed; one inherited integration test remains ignored.
• Formatting, diff checks, focused Clippy with warnings denied, celld WASM check, and WASM-target regression compilation/Clippy passed.
• The added Node-executed WASM regression rejects a 151-byte host chunk at 10-byte caps and accepts an exact 10-byte chunk.
• A fresh generated consumer built and served through the registered CLI. Real celld HTTP checks passed for scoped RUNTIME_ID=celld, KV put/get/exists/list/delete, bounded config caps, expired deadline rejection, ingress grant consumption, and a three-chunk response.
• The real Mocktioneer WASM consumer passed clean missing-config and seeded CPM 0.37 OpenRTB/APS acceptance.

CI currently reports one Fastly documentation contract failure in static-checks: store-free production compatibility is missing from the extracted deployment section. The test and Fastly guide are unchanged from #275, and the same assertion was reproduced at the base commit. The other deploy-action smoke jobs passed. This inherited failure is not repaired here.

Local runtime observations do not certify production deadlines/cancellation, fleet recovery, streaming under load, or workload performance. No live Cloudflare deployment or full workspace-wide acceptance run was performed.

Linked issue

Closes #421.