✨ feat(infra): add enable_provisioner option to skip the provisioner Lambda

[mrohr]

Summary

StackOptions gains enable_provisioner (default True), mirroring enable_aggregator. The CloudFormation template already had an EnableProvisioner parameter with conditions guarding the provisioner Lambda, its role, and its log group — but nothing on the client side ever set it, so the provisioner was always deployed.

• StackOptions.enable_provisioner + to_parameters() mapping to EnableProvisioner
• StackManager / SyncStackManager parameter name mapping
• RepositoryBuilder.enable_provisioner() (and sync counterpart)
• CLI: --enable-provisioner/--no-provisioner on deploy, plus a Provisioner: enabled|disabled line in the deploy summary

Sync counterparts regenerated via hatch run generate-sync.

Bug fix: don't push Lambda code to functions CloudFormation never created

CloudFormation only creates the aggregator and provisioner functions when a role exists for them, but both deploy paths pushed code based on the enable_* flags alone. Under --no-iam / .create_iam(False) the functions are absent and the code push failed with ResourceNotFoundException, exiting 1 on an otherwise successful deploy.

• CLI: --no-iam now auto-disables the provisioner the same way it auto-disables the aggregator
• StackOptions gains deploys_aggregator_lambda / deploys_provisioner_lambda, mirroring the template's DeployAggregatorLambda / DeployProvisionerLambda conditions (aggregator's external-role escape hatch included), and Repository._ensure_infrastructure_internal() gates the code deploys on those — closing the same hole on the Repository.builder() path

Config	Aggregator Lambda	Provisioner Lambda
default	deployed	deployed
--no-provisioner	deployed	not created
--no-aggregator	not created	deployed
--no-iam	not created	not created
--no-iam + --aggregator-role-arn	deployed	not created

Visibility and error handling

Now that the provisioner is a real deployment choice, the CLI reports and explains its absence:

• zae-limiter status gains a Provisioner: Enabled|Disabled|Unknown line in the Infrastructure section, next to the existing Aggregator: line. The template's ProvisionerFunctionName output is conditioned on DeployProvisionerLambda, so its presence in the stack outputs is exactly whether CloudFormation created the function — and status already calls describe_stacks for the role ARNs, so this costs no extra API call. When the stack outputs cannot be read at all it reports Unknown rather than Disabled, so an externally managed stack (Terraform/CDK) that omits the output is not misreported.
• Bug fix (found during the real-AWS verification below): the existing Aggregator: line inferred state from the DynamoDB table's StreamSpecification, which the template enables unconditionally — so every stack reported Aggregator: Enabled, including one deployed with --no-aggregator. AggregatorFunctionName is conditioned on DeployAggregatorLambda exactly like ProvisionerFunctionName, so both states now come from the same describe_stacks call and share one Enabled/Disabled/Unknown renderer. The stream-spec inference is gone.
• zae-limiter limits plan|apply|diff now exits 1 with an explanation when the provisioner Lambda is missing, instead of surfacing a raw botocore ResourceNotFoundException traceback.

Test plan

• tests/unit/test_models.py — to_parameters() emits EnableProvisioner=false; deploys_*_lambda properties for default / --no-iam / external-role / disabled configs
• tests/unit/test_repository_builder.py — _ensure_infrastructure_internal() skips the disabled provisioner, skips both Lambdas without IAM, and still deploys the aggregator with an external role
• tests/unit/test_cli.py::test_deploy_with_no_provisioner_flag — --no-provisioner skips provisioner code deployment
• tests/unit/test_limits_cli.py::test_invoke_provisioner_missing_function_exits_cleanly — clean exit 1, no traceback
• tests/unit/test_cli.py — status reports Enabled / Disabled / Unknown for both the aggregator and the provisioner (the status docstring sample output, which feeds docs/cli.md via mkdocs-click, was updated to match)
• tests/unit/test_cli.py::test_status_aggregator_disabled_despite_table_stream — pins the regression: outputs present with no AggregatorFunctionName → Disabled
• uv run pytest tests/unit/ -q → 2954 passed
• ruff check, ruff format, mypy src/zae_limiter → clean
• Sync generation → no drift
• diff-cover vs origin/main → 100% patch coverage, 38 lines, 0 missing
• Manual: zae-limiter deploy --name x --no-iam completes with exit 0 (previously exited 1)
• Manual: zae-limiter deploy --name x --no-provisioner creates no {stack}-limits-provisioner function

Both manual items were verified against real AWS (account 733153035800, us-east-1) with real CloudFormation stacks, all since deleted:

Deploy	Result
default	exit 0; {stack}-limits-provisioner exists; status printed Provisioner: Enabled
--no-provisioner	exit 0; provisioner absent; status printed Provisioner: Disabled; limits plan printed the new clean error (Error: Lambda function '...-limits-provisioner' not found. The limits provisioner is not deployed for this stack...) rather than a botocore traceback
--no-iam	exit 0; provisioner absent — the regression this PR fixes, confirmed working

Caveat on the --no-iam case: it reaches exit 0 only when --permission-boundary and --role-name-format are also supplied. With either omitted the stack rolls back before the CLI ever reaches the provisioner step, due to a pre-existing bug on main that this PR neither touches nor causes: PermissionBoundaryArn and RoleNameFormat in src/zae_limiter/infra/cfn_template.yaml are exported unconditionally while both parameters default to '', and CloudFormation rejects empty export values (Cannot export output PermissionBoundaryArn. Exported values must not be empty or whitespace-only.). Introduced in 80a1a34 and now tracked in #445. The --no-iam fix in this PR is verified working.

🤖 Generated with Claude Code

https://claude.ai/code/session_014nPStTtHkW7zqj3X3wGpVg

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.93%. Comparing base (9485bcb) to head (3af38d7).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #443      +/-   ##
==========================================
+ Coverage   92.91%   92.93%   +0.02%     
==========================================
  Files          37       37              
  Lines        8324     8353      +29     
==========================================
+ Hits         7734     7763      +29     
  Misses        590      590              

Flag	Coverage Δ
doctest	29.97% <15.78%> (-0.04%)	⬇️
e2e	43.74% <73.68%> (+0.08%)	⬆️
integration	53.72% <73.68%> (+0.05%)	⬆️
unit	92.82% <100.00%> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: 3af38d7	Previous: 9485bcb	Ratio
tests/benchmark/test_localstack.py::TestLocalStackBenchmarks::test_acquire_release_localstack	18.103334101206823 iter/sec (stddev: 0.03938246977539952)	28.2083270139138 iter/sec (stddev: 0.007097106796083319)	1.56
tests/benchmark/test_localstack.py::TestCascadeOptimizationBenchmarks::test_cascade_with_batchgetitem_optimization	10.594873975464141 iter/sec (stddev: 0.10143684040737734)	29.740897984517193 iter/sec (stddev: 0.004872259368349679)	2.81
tests/benchmark/test_localstack.py::TestCascadeOptimizationBenchmarks::test_cascade_multiple_resources	9.95450375118606 iter/sec (stddev: 0.07499362296151371)	28.42705895758373 iter/sec (stddev: 0.004165152020627401)	2.86
tests/benchmark/test_localstack.py::TestLocalStackCascadeSpeculativeComparison::test_cascade_speculative_cache_cold_localstack	15.13881447788611 iter/sec (stddev: 0.06199454924695345)	28.30620601547383 iter/sec (stddev: 0.002496931856171016)	1.87
tests/benchmark/test_localstack.py::TestLocalStackCascadeSpeculativeComparison::test_cascade_speculative_cache_warm_localstack	18.036485534712767 iter/sec (stddev: 0.058482648534910656)	31.87679296055283 iter/sec (stddev: 0.003964527014694207)	1.77

This comment was automatically generated by workflow using github-action-benchmark.