Adopt ENV_FILE=.env.local.martyrology-api instead of writing a shared .env.local

[JohnRDOrazio]

Split out of CatholicOS/cdcf-infra#34, which is being closed by CatholicOS/cdcf-infra#37. Nothing here is broken today — this is convention alignment plus one stale doc line.

Background

--target local in cdcf-infra/auth/setup-zitadel.sh does not name one instance the way production and staging do. Every umbrella property runs its own local Zitadel, so a shared .env.local is last-writer-wins across properties. cdcf-infra now documents ENV_FILE=.env.local.<property> as the convention and enforces it: the script reads the owning property out of the PAT's path (<property>/.zitadel-data/automation-user.pat) and refuses a mismatched run with exit 17.

This repo passes the guard, but writes the shared filename

scripts/setup-stack.sh:84 writes the provisioner env file into the cloned infra checkout as:

cat > "$INFRA_DIR/auth/.env.local" <<EOF

The run itself is correct — ZITADEL_PAT_FILE is made absolute and points at this repo's own .zitadel-data/, and --create-org Martyrology --provision-martyrology is allow-listed for martyrology-api. Verified against the new guard:

[setup-zitadel] PAT file: .../martyrology-api/.zitadel-data/automation-user.pat
[setup-zitadel] Local property: martyrology-api
[setup-zitadel] Provisioning single Org: Martyrology

So this is not a bug report. The filename is the issue: $INFRA_DIR is a reusable clone (CDCF_INFRA_REF), and .env.local is the one name every property would write to. Two properties sharing a checkout would overwrite each other's file.

Ask

1. Write $INFRA_DIR/auth/.env.local.martyrology-api and pass ENV_FILE=.env.local.martyrology-api to the setup-zitadel.sh invocation at scripts/setup-stack.sh:100.
2. Same treatment for the setup-openfga.sh invocation if it reads an env file from the same clone.
3. Document the convention in the repo's README, so it isn't folklore living only in the setup script.

Stale doc line

docs/superpowers/specs/2026-08-04-local-development-stack-design.md:236-241 says the provisioning run is:

runs --create-org Martyrology --provision-martyrology --provision-martyrology-frontend

scripts/setup-stack.sh:100-102 runs only --create-org Martyrology --provision-martyrology. Worth correcting while touching this — and note that if --provision-martyrology-frontend is ever added back here, it is currently allow-listed for martyrology-frontend only and would be refused. Say so in cdcf-infra and the allow-list can be widened.

🤖 Generated with Claude Code