# Taskfile.yaml # tummycrypt/tcfs build system # https://taskfile.dev version: '3' vars: VERSION: sh: git describe --tags --always --dirty 2>/dev/null || echo "0.1.0-dev" COMMIT: sh: git rev-parse --short HEAD 2>/dev/null || echo "unknown" tasks: default: desc: Show available tasks cmds: - task --list # ── Rust workspace ────────────────────────────────────────────────────────── build: desc: Build all Rust crates (debug) cmds: - cargo build --workspace build:release: desc: Build all Rust crates (release) cmds: - cargo build --workspace --release test: desc: Run all tests cmds: - cargo test --workspace lint: desc: Run clippy (deny warnings) + rustfmt check cmds: - cargo clippy --workspace -- -D warnings - cargo fmt --all -- --check fmt: desc: Auto-format all Rust code cmds: - cargo fmt --all clean: desc: Clean build artifacts cmds: - cargo clean bench: desc: Run all divan benchmarks cmds: - ~/.cargo/bin/cargo bench -p tcfs-chunks --bench chunks - ~/.cargo/bin/cargo bench -p tcfs-crypto --bench crypto deny: desc: Check licenses and advisories (cargo-deny) cmds: - cargo deny check audit: desc: Check for security advisories (cargo-audit) cmds: - cargo audit # ── Lazy hydration demo proof ─────────────────────────────────────────────── lazy:mounted-smoke: desc: "Verify an already-mounted lazy hydration surface: MOUNT_ROOT=... EXPECTED_FILE=..." cmds: - cmd: | bash -euo pipefail <<'EOF' : "${MOUNT_ROOT:?set MOUNT_ROOT=/path/to/tcfs-mount}" : "${EXPECTED_FILE:?set EXPECTED_FILE=relative/path/to/file}" args=( --mount-root "$MOUNT_ROOT" --expected-file "$EXPECTED_FILE" ) if [[ -n "${EXPECTED_CONTENT:-}" ]]; then args+=(--expected-content "$EXPECTED_CONTENT") fi if [[ -n "${EXPECTED_CONTENT_FILE:-}" ]]; then args+=(--expected-content-file "$EXPECTED_CONTENT_FILE") fi if [[ -n "${EXPECTED_CONTAINS:-}" ]]; then args+=(--expected-contains "$EXPECTED_CONTAINS") fi if [[ -n "${MAX_DEPTH:-}" ]]; then args+=(--max-depth "$MAX_DEPTH") fi for entry in ${EXPECT_ENTRIES:-}; do args+=(--expect-entry "$entry") done scripts/lazy-hydration-mounted-smoke.sh "${args[@]}" EOF lazy:test-mounted-smoke: desc: Regression-test the mounted lazy hydration smoke helper cmds: - bash scripts/test-lazy-hydration-mounted-smoke.sh lazy:check: desc: Run lazy hydration harness/static regression checks cmds: - bash -n scripts/lazy-hydration-linux-demo.sh scripts/lazy-hydration-linux-lifecycle-demo.sh scripts/test-lazy-hydration-linux-lifecycle-demo.sh scripts/lazy-hydration-mounted-smoke.sh scripts/test-lazy-hydration-mounted-smoke.sh scripts/installed-runtime-acceptance.sh scripts/test-installed-runtime-acceptance.sh scripts/git-dotgit-fsck-conflict-harness.sh scripts/test-git-dotgit-fsck-conflict-harness.sh scripts/git-repo-canary.sh scripts/test-git-repo-canary.sh scripts/git-repo-restore-proof.sh scripts/test-git-repo-restore-proof.sh scripts/git-roam-daily-driver-harness.sh scripts/test-git-roam-daily-driver-harness.sh scripts/tcfs-symlink-package-probe.sh scripts/test-tcfs-symlink-package-probe.sh scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh scripts/home-canary-linux-xr-storage-posture.sh scripts/test-home-canary-linux-xr-storage-posture.sh scripts/macos-fileprovider-neo-cleanup-packet.sh scripts/test-macos-fileprovider-neo-cleanup-packet.sh scripts/macos-developer-cert-match.sh scripts/macos-fileprovider-profile-inventory.sh scripts/test-macos-fileprovider-profile-inventory.sh scripts/macos-fileprovider-preflight.sh scripts/test-macos-fileprovider-preflight.sh scripts/macos-tcfs-rollout-readiness.sh scripts/test-macos-tcfs-rollout-readiness.sh scripts/macos-postinstall-smoke.sh scripts/macos-build-pkg.sh scripts/macos-pkg-postinstall.sh scripts/macos-pkg-structure-smoke.sh scripts/macos-fileprovider-testing-mode-dispatch.sh scripts/macos-fileprovider-lab-gatekeeper-override.sh scripts/macos-codesign-p12-probe.sh scripts/test-macos-build-pkg.sh scripts/test-bazel-macos-package-contract.sh scripts/test-macos-postinstall-smoke.sh scripts/test-macos-pkg-structure-smoke.sh scripts/test-macos-fileprovider-pkg-notarization-proof.sh scripts/test-macos-fileprovider-testing-mode-dispatch.sh scripts/test-macos-fileprovider-lab-gatekeeper-override.sh scripts/test-asc-fileprovider-lab-provision.sh scripts/test-fileprovider-provision-config.sh scripts/test-fileprovider-surface-contract.sh scripts/test-release-workflow-fileprovider.sh scripts/test-release-workflow-container.sh swift/fileprovider/provision-config.sh swift/fileprovider/build.sh scripts/tcfsd-health-check.sh scripts/test-tcfsd-health-check.sh - shellcheck scripts/lazy-hydration-linux-demo.sh scripts/lazy-hydration-linux-lifecycle-demo.sh scripts/test-lazy-hydration-linux-lifecycle-demo.sh scripts/lazy-hydration-mounted-smoke.sh scripts/test-lazy-hydration-mounted-smoke.sh scripts/installed-runtime-acceptance.sh scripts/test-installed-runtime-acceptance.sh scripts/git-dotgit-fsck-conflict-harness.sh scripts/test-git-dotgit-fsck-conflict-harness.sh scripts/git-repo-canary.sh scripts/test-git-repo-canary.sh scripts/git-repo-restore-proof.sh scripts/test-git-repo-restore-proof.sh scripts/git-roam-daily-driver-harness.sh scripts/test-git-roam-daily-driver-harness.sh scripts/tcfs-symlink-package-probe.sh scripts/test-tcfs-symlink-package-probe.sh scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh scripts/home-canary-linux-xr-storage-posture.sh scripts/test-home-canary-linux-xr-storage-posture.sh scripts/macos-fileprovider-neo-cleanup-packet.sh scripts/test-macos-fileprovider-neo-cleanup-packet.sh scripts/macos-developer-cert-match.sh scripts/macos-fileprovider-profile-inventory.sh scripts/test-macos-fileprovider-profile-inventory.sh scripts/macos-fileprovider-preflight.sh scripts/test-macos-fileprovider-preflight.sh scripts/macos-tcfs-rollout-readiness.sh scripts/test-macos-tcfs-rollout-readiness.sh scripts/macos-postinstall-smoke.sh scripts/macos-build-pkg.sh scripts/macos-pkg-postinstall.sh scripts/macos-pkg-structure-smoke.sh scripts/macos-fileprovider-testing-mode-dispatch.sh scripts/macos-fileprovider-lab-gatekeeper-override.sh scripts/macos-codesign-p12-probe.sh scripts/test-macos-build-pkg.sh scripts/test-bazel-macos-package-contract.sh scripts/test-macos-postinstall-smoke.sh scripts/test-macos-pkg-structure-smoke.sh scripts/test-macos-fileprovider-pkg-notarization-proof.sh scripts/test-macos-fileprovider-testing-mode-dispatch.sh scripts/test-macos-fileprovider-lab-gatekeeper-override.sh scripts/test-asc-fileprovider-lab-provision.sh scripts/test-fileprovider-provision-config.sh scripts/test-fileprovider-surface-contract.sh scripts/test-release-workflow-fileprovider.sh scripts/test-release-workflow-container.sh swift/fileprovider/provision-config.sh swift/fileprovider/build.sh scripts/tcfsd-health-check.sh scripts/test-tcfsd-health-check.sh - python3 -m py_compile scripts/asc-fileprovider-lab-provision.py scripts/tcfs-smoke-endpoint-preflight.py scripts/test-tcfs-smoke-endpoint-preflight.py scripts/large-workdir-inventory.py scripts/test-large-workdir-inventory.py - task: lazy:test-linux-lifecycle-demo - task: lazy:test-mounted-smoke - bash scripts/test-installed-runtime-acceptance.sh - task: lazy:test-git-dotgit-fsck-conflict - task: lazy:test-git-repo-canary - task: lazy:test-git-repo-restore-proof - task: lazy:test-git-roam-daily-driver - task: lazy:test-tcfs-symlink-package-probe - task: lazy:test-tcfsd-health-check - task: lazy:test-home-canary-linux-xr-shadow - task: lazy:test-home-canary-linux-xr-storage-posture - task: lazy:test-macos-fileprovider-neo-cleanup - task: lazy:test-macos-profile-inventory - task: lazy:test-macos-preflight - task: lazy:test-macos-tcfs-rollout-readiness - task: lazy:test-macos-postinstall - task: lazy:test-macos-build-pkg - task: lazy:test-bazel-macos-package-contract - task: lazy:test-macos-pkg-structure - task: lazy:test-macos-fileprovider-pkg-notarization-proof - task: lazy:test-macos-fileprovider-testing-mode-dispatch - task: lazy:test-macos-fileprovider-lab-gatekeeper-override - task: lazy:test-asc-fileprovider-lab-provision - task: lazy:test-fileprovider-provision - task: lazy:test-ios-bootstrap-qr - task: lazy:test-fileprovider-surface-contract - task: lazy:test-release-workflow-fileprovider - task: lazy:test-release-workflow-container - task: lazy:test-linux-package-container-workflow - task: install-smoke-test - task: lazy:test-smoke-endpoint-preflight - cargo test -p tcfs-cli cli_unsync - cargo test -p tcfs-cli cli_pull_after_unsync_hydrates_latest_remote_and_removes_stub - cargo test -p tcfs-cli cli_pull_adjacent_stub_cleanup_ignores_non_tcfs_files - cargo test -p tcfs-vfs lazy:linux-demo: desc: "Linux lazy proof: set TCFS_LAZY_DEMO_REMOTE=... and optional TCFS_LAZY_DEMO_CREATE_BUCKET=1" cmds: - bash scripts/lazy-hydration-linux-demo.sh lazy:linux-lifecycle-demo: desc: "Linux lifecycle parity proof: read, write, rehydrate, safe-unsync" cmds: - bash scripts/lazy-hydration-linux-lifecycle-demo.sh lazy:test-linux-lifecycle-demo: desc: Regression-test the Linux lifecycle proof helper shape cmds: - bash scripts/test-lazy-hydration-linux-lifecycle-demo.sh lazy:honey-backbone-preflight: desc: "Read-only G2/G3 preflight for neo/honey daemon, NATS, and device registry posture" cmds: - bash scripts/honey-backbone-preflight.sh lazy:test-honey-backbone-preflight: desc: Regression-test the read-only honey backbone preflight helper cmds: - bash scripts/test-honey-backbone-preflight.sh lazy:test-git-dotgit-fsck-conflict: desc: "FACET 6: .git-as-files fsck/flip-flop/conflict corruption harness (local-only)" cmds: - bash scripts/test-git-dotgit-fsck-conflict-harness.sh lazy:git-repo-canary: desc: "Safe git repo canary: shadow-first single-worktree proof packet" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${SOURCE:-}" ]]; then args+=(--source "$SOURCE") fi if [[ -n "${NAME:-}" ]]; then args+=(--name "$NAME") fi if [[ -n "${SHADOW_ROOT:-}" ]]; then args+=(--shadow-root "$SHADOW_ROOT") fi if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${REMOTE:-}" ]]; then args+=(--remote "$REMOTE") fi if [[ -n "${STATE_DIR:-}" ]]; then args+=(--state-dir "$STATE_DIR") fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs-bin "$TCFS_BIN") fi if [[ -n "${HONEY_HOST:-}" ]]; then args+=(--honey-host "$HONEY_HOST") fi if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then args+=(--honey-mount-root "$HONEY_MOUNT_ROOT") fi if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then args+=(--honey-remote-dir "$HONEY_REMOTE_DIR") fi if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN") fi if [[ -n "${HONEY_SMOKE_MAX_DEPTH:-}" ]]; then args+=(--honey-smoke-max-depth "$HONEY_SMOKE_MAX_DEPTH") fi if [[ -n "${HONEY_SMOKE_TIMEOUT_SECS:-}" ]]; then args+=(--honey-smoke-timeout-secs "$HONEY_SMOKE_TIMEOUT_SECS") fi if [[ "${PUSH:-0}" == "1" ]]; then args+=(--push) fi if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then args+=(--resume-after-push) fi if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then args+=(--reuse-shadow) fi if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then args+=(--create-bucket) fi if [[ "${RUN_HONEY:-0}" == "1" ]]; then args+=(--run-honey) fi if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then args+=(--honey-start-mount) fi if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then args+=(--honey-existing-mount) fi if [[ "${RUN_LINUX_LIFECYCLE:-0}" == "1" ]]; then args+=(--run-linux-lifecycle) fi if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then args+=(--forward-aws-env) fi if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then args+=(--keep-shadow) fi if [[ "${ALLOW_DIRTY_SOURCE:-0}" == "1" ]]; then args+=(--allow-dirty-source) fi scripts/git-repo-canary.sh "${args[@]}" EOF lazy:test-git-repo-canary: desc: Regression-test the generic git repo canary helper cmds: - bash scripts/test-git-repo-canary.sh lazy:dev-env-fingerprint: desc: "Git-aware dev-env zero-diff fingerprint (G5/TIN-1620 precision layer over T2/T3/T8/T10)" cmds: - cmd: | bash -euo pipefail <<'EOF' mode="${MODE:-self-test}" case "$mode" in self-test) scripts/repo-roam-fingerprint.sh self-test "${OUT_DIR:-}" ;; capture) : "${REPO:?set REPO= for MODE=capture}" : "${OUT_DIR:?set OUT_DIR= for MODE=capture}" scripts/repo-roam-fingerprint.sh capture "$REPO" "$OUT_DIR" ;; compare) : "${DIR_A:?set DIR_A= for MODE=compare}" : "${DIR_B:?set DIR_B= for MODE=compare}" scripts/repo-roam-fingerprint.sh compare "$DIR_A" "$DIR_B" ;; seed-canary) : "${OUT_DIR:?set OUT_DIR= for MODE=seed-canary}" scripts/repo-roam-fingerprint.sh seed-canary "$OUT_DIR" ;; *) echo "MODE must be self-test|capture|compare|seed-canary" >&2 exit 2 ;; esac EOF lazy:test-dev-env-fingerprint: desc: Regression-test the git-aware dev-env fingerprint tool cmds: - bash scripts/test-repo-roam-fingerprint.sh lazy:git-repo-restore-proof: desc: "Fresh-tree restore proof for an existing pushed git repo canary packet" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${RESTORE_ROOT:-}" ]]; then args+=(--restore-root "$RESTORE_ROOT") fi if [[ -n "${TCFS_RESTORE_CONFIG:-}" ]]; then args+=(--config "$TCFS_RESTORE_CONFIG") fi if [[ -n "${CONFIG:-}" ]]; then args+=(--config "$CONFIG") fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs-bin "$TCFS_BIN") fi if [[ -n "${TCFS_STATE_PATH:-}" ]]; then args+=(--state "$TCFS_STATE_PATH") fi if [[ -n "${RESTORE_RECONCILE_TIMEOUT_SECS:-}" ]]; then args+=(--reconcile-timeout-secs "$RESTORE_RECONCILE_TIMEOUT_SECS") fi if [[ "${REQUIRE_EMPTY_DIRS:-0}" == "1" ]]; then args+=(--require-empty-dirs) fi if [[ "${RESTORE_REQUIRE_HEADROOM:-0}" == "1" ]]; then args+=(--require-restore-headroom) fi if [[ -n "${RESTORE_HEADROOM_MARGIN_BYTES:-}" ]]; then args+=(--restore-headroom-margin-bytes "$RESTORE_HEADROOM_MARGIN_BYTES") fi scripts/git-repo-restore-proof.sh "${args[@]}" EOF lazy:test-git-repo-restore-proof: desc: Regression-test the git repo fresh-tree restore proof helper cmds: - bash scripts/test-git-repo-restore-proof.sh lazy:git-roam-daily-driver-plan: desc: "Plan-only evidence packet for the ~/git daily-driver roam story" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${REPO:-}" ]]; then args+=(--repo "$REPO") fi if [[ -n "${AGENT_ROOT:-}" ]]; then args+=(--agent-root "$AGENT_ROOT") fi if [[ -n "${NAME:-}" ]]; then args+=(--name "$NAME") fi if [[ -n "${ORIGIN_HOST:-}" ]]; then args+=(--origin-host "$ORIGIN_HOST") fi if [[ -n "${CONTINUATION_HOST:-}" ]]; then args+=(--continuation-host "$CONTINUATION_HOST") fi if [[ -n "${THIRD_HOST:-}" ]]; then args+=(--third-host "$THIRD_HOST") fi if [[ -n "${REMOTE_PREFIX:-}" ]]; then args+=(--remote-prefix "$REMOTE_PREFIX") fi if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${MAX_HASH_FILES:-}" ]]; then args+=(--max-hash-files "$MAX_HASH_FILES") fi if [[ -n "${MAX_HASH_FILE_BYTES:-}" ]]; then args+=(--max-hash-file-bytes "$MAX_HASH_FILE_BYTES") fi scripts/git-roam-daily-driver-harness.sh "${args[@]}" EOF lazy:test-git-roam-daily-driver: desc: Regression-test the git roam daily-driver plan-only harness cmds: - bash scripts/test-git-roam-daily-driver-harness.sh lazy:storage-large-restore-slo: desc: "Evaluate a storage large-restore packet against optional SLO budgets" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${MIN_RESTORE_THROUGHPUT_BPS:-}" ]]; then args+=(--min-restore-throughput-bps "$MIN_RESTORE_THROUGHPUT_BPS") fi if [[ -n "${MAX_RESTORE_ELAPSED_SECS:-}" ]]; then args+=(--max-restore-elapsed-secs "$MAX_RESTORE_ELAPSED_SECS") fi if [[ -n "${MAX_502_LOG_LINES:-}" ]]; then args+=(--max-502-log-lines "$MAX_502_LOG_LINES") fi if [[ -n "${MAX_OPENDAL_RETRY_ROWS:-}" ]]; then args+=(--max-opendal-retry-rows "$MAX_OPENDAL_RETRY_ROWS") fi if [[ -n "${MAX_TCFS_CHUNK_RETRY_ROWS:-}" ]]; then args+=(--max-tcfs-chunk-retry-rows "$MAX_TCFS_CHUNK_RETRY_ROWS") fi if [[ -n "${MAX_PUSH_WARN_ROWS:-}" ]]; then args+=(--max-push-warn-rows "$MAX_PUSH_WARN_ROWS") fi if [[ -n "${MAX_PUSH_ERROR_ROWS:-}" ]]; then args+=(--max-push-error-rows "$MAX_PUSH_ERROR_ROWS") fi if [[ -n "${MAX_SOCKET_HIGHWATER:-}" ]]; then args+=(--max-socket-highwater "$MAX_SOCKET_HIGHWATER") fi scripts/evaluate-storage-large-restore-slo.sh "${args[@]}" EOF lazy:test-storage-large-restore-slo: desc: Regression-test the storage large-restore SLO evaluator cmds: - bash scripts/test-evaluate-storage-large-restore-slo.sh lazy:tcfs-symlink-package-probe: desc: "Probe candidate package/current tcfs binaries for sync_symlinks behavior" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${ENDPOINT:-}" ]]; then args+=(--endpoint "$ENDPOINT") fi if [[ -n "${BUCKET:-}" ]]; then args+=(--bucket "$BUCKET") fi if [[ -n "${PREFIX_BASE:-}" ]]; then args+=(--prefix-base "$PREFIX_BASE") fi if [[ "${STRICT:-0}" == "1" ]]; then args+=(--strict) fi for candidate in ${CANDIDATES:-}; do args+=(--candidate "$candidate") done scripts/tcfs-symlink-package-probe.sh "${args[@]}" EOF lazy:test-tcfs-symlink-package-probe: desc: Regression-test the package symlink probe helper cmds: - bash scripts/test-tcfs-symlink-package-probe.sh lazy:test-tcfsd-health-check: desc: Regression-test the tcfsd supervisor health check (backend-down vs restart backoff) cmds: - bash scripts/test-tcfsd-health-check.sh lazy:large-workdir-inventory: desc: "Read-only inventory packet for a selected large workdir" cmds: - cmd: | bash -euo pipefail <<'EOF' root="${ROOT:-/Users/jess/git/linux-xr-fast}" args=() if [[ -n "${OUT_DIR:-}" ]]; then args+=(--out-dir "$OUT_DIR") fi if [[ "${SKIP_XATTRS:-0}" == "1" ]]; then args+=(--skip-xattrs) fi if [[ -n "${MAX_UNSUPPORTED:-}" ]]; then args+=(--max-unsupported "$MAX_UNSUPPORTED") fi if [[ "${#args[@]}" -gt 0 ]]; then python3 scripts/large-workdir-inventory.py "$root" "${args[@]}" else python3 scripts/large-workdir-inventory.py "$root" fi EOF lazy:large-workdir-onboarding: desc: "Large workdir onboarding packet: inventory plus shadow-first pilot" cmds: - cmd: | bash -euo pipefail <<'EOF' timestamp="$(date -u +%Y%m%dT%H%M%SZ)" export SOURCE="${SOURCE:-/Users/jess/git/linux-xr-fast}" export EVIDENCE_DIR="${EVIDENCE_DIR:-docs/release/evidence/large-workdir-${timestamp}}" export SHADOW_ROOT="${SHADOW_ROOT:-$HOME/TCFS Pilot/real-canaries/linux-xr-fast-shadow-${timestamp}}" export REMOTE="${REMOTE:-seaweedfs://localhost:8333/tcfs/large-workdir-${timestamp}}" export STATE_DIR="${STATE_DIR:-$EVIDENCE_DIR/state}" task lazy:home-canary-linux-xr-shadow EOF lazy:home-canary-linux-xr-shadow: desc: "Real project-tree canary: isolated /Users/jess/git/linux-xr shadow packet" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${SOURCE:-}" ]]; then args+=(--source "$SOURCE") fi if [[ -n "${SHADOW_ROOT:-}" ]]; then args+=(--shadow-root "$SHADOW_ROOT") fi if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${REMOTE:-}" ]]; then args+=(--remote "$REMOTE") fi if [[ -n "${STATE_DIR:-}" ]]; then args+=(--state-dir "$STATE_DIR") fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs-bin "$TCFS_BIN") fi if [[ -n "${HONEY_HOST:-}" ]]; then args+=(--honey-host "$HONEY_HOST") fi if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then args+=(--honey-mount-root "$HONEY_MOUNT_ROOT") fi if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then args+=(--honey-remote-dir "$HONEY_REMOTE_DIR") fi if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN") fi if [[ "${PUSH:-0}" == "1" ]]; then args+=(--push) fi if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then args+=(--resume-after-push) fi if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then args+=(--reuse-shadow) fi if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then args+=(--create-bucket) fi if [[ "${RUN_HONEY:-0}" == "1" ]]; then args+=(--run-honey) fi if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then args+=(--honey-start-mount) fi if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then args+=(--honey-existing-mount) fi if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then args+=(--forward-aws-env) fi if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then args+=(--keep-shadow) fi scripts/home-canary-linux-xr-shadow.sh "${args[@]}" EOF lazy:test-home-canary-linux-xr-shadow: desc: Regression-test the linux-xr shadow canary helper cmds: - bash scripts/test-home-canary-linux-xr-shadow.sh lazy:home-canary-linux-xr-storage-posture: desc: "S3 posture canary: release-binary fresh-prefix linux-xr shadow packet" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${SOURCE:-}" ]]; then args+=(--source "$SOURCE") fi if [[ -n "${SHADOW_ROOT:-}" ]]; then args+=(--shadow-root "$SHADOW_ROOT") fi if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${REMOTE:-}" ]]; then args+=(--remote "$REMOTE") fi if [[ -n "${STATE_DIR:-}" ]]; then args+=(--state-dir "$STATE_DIR") fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs-bin "$TCFS_BIN") fi if [[ -n "${HONEY_HOST:-}" ]]; then args+=(--honey-host "$HONEY_HOST") fi if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then args+=(--honey-mount-root "$HONEY_MOUNT_ROOT") fi if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then args+=(--honey-remote-dir "$HONEY_REMOTE_DIR") fi if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN") fi if [[ -n "${UPLOAD_CONCURRENCY:-}" ]]; then args+=(--upload-concurrency "$UPLOAD_CONCURRENCY") fi if [[ -n "${FILE_UPLOAD_CONCURRENCY:-}" ]]; then args+=(--file-upload-concurrency "$FILE_UPLOAD_CONCURRENCY") fi if [[ -n "${PROGRESS_EVERY_CHUNKS:-}" ]]; then args+=(--progress-every-chunks "$PROGRESS_EVERY_CHUNKS") fi if [[ -n "${CHUNK_TIMEOUT_SECS:-}" ]]; then args+=(--chunk-timeout-secs "$CHUNK_TIMEOUT_SECS") fi if [[ -n "${PROGRESS_HEARTBEAT_SECS:-}" ]]; then args+=(--progress-heartbeat-secs "$PROGRESS_HEARTBEAT_SECS") fi if [[ -n "${S3_CONNECT_TIMEOUT_SECS:-}" ]]; then args+=(--s3-connect-timeout-secs "$S3_CONNECT_TIMEOUT_SECS") fi if [[ -n "${S3_POOL_IDLE_TIMEOUT_SECS:-}" ]]; then args+=(--s3-pool-idle-timeout-secs "$S3_POOL_IDLE_TIMEOUT_SECS") fi if [[ -n "${S3_POOL_MAX_IDLE_PER_HOST:-}" ]]; then args+=(--s3-pool-max-idle-per-host "$S3_POOL_MAX_IDLE_PER_HOST") fi if [[ "${S3_HTTP1_ONLY:-0}" == "1" ]]; then args+=(--s3-http1-only) fi if [[ -n "${SOCKET_SAMPLE_INTERVAL_SECS:-}" ]]; then args+=(--socket-sample-interval-secs "$SOCKET_SAMPLE_INTERVAL_SECS") fi if [[ "${PUSH:-0}" == "1" ]]; then args+=(--push) fi if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then args+=(--resume-after-push) fi if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then args+=(--reuse-shadow) fi if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then args+=(--create-bucket) fi if [[ "${RUN_HONEY:-0}" == "1" ]]; then args+=(--run-honey) fi if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then args+=(--honey-start-mount) fi if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then args+=(--honey-existing-mount) fi if [[ "${RUN_LINUX_LIFECYCLE:-0}" == "1" ]]; then args+=(--run-linux-lifecycle) fi if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then args+=(--forward-aws-env) fi if [[ "${NO_ASSUME_FRESH_PREFIX:-0}" == "1" ]]; then args+=(--no-assume-fresh-prefix) fi if [[ "${ALLOW_DEBUG_BINARY:-0}" == "1" ]]; then args+=(--allow-debug-binary) fi if [[ "${ALLOW_NON_POSTURE_PREFIX:-0}" == "1" ]]; then args+=(--allow-non-posture-prefix) fi if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then args+=(--keep-shadow) fi scripts/home-canary-linux-xr-storage-posture.sh "${args[@]}" EOF lazy:test-home-canary-linux-xr-storage-posture: desc: Regression-test the linux-xr storage posture canary wrapper cmds: - bash scripts/test-home-canary-linux-xr-storage-posture.sh lazy:macos-fileprovider-neo-cleanup-packet: desc: "Archive neo FileProvider divergence and optionally install the published pkg" cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${EVIDENCE_DIR:-}" ]]; then args+=(--evidence-dir "$EVIDENCE_DIR") fi if [[ -n "${PKG_PATH:-}" ]]; then args+=(--pkg "$PKG_PATH") fi if [[ -n "${APP_PATH:-}" ]]; then args+=(--app-path "$APP_PATH") fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs "$TCFS_BIN") fi if [[ -n "${TCFSD_BIN:-}" ]]; then args+=(--tcfsd "$TCFSD_BIN") fi if [[ "${INSTALL_PKG:-0}" == "1" ]]; then args+=(--install-pkg) fi if [[ -n "${INSTALL_MODE:-}" ]]; then args+=(--install-mode "$INSTALL_MODE") fi if [[ "${QUARANTINE_STALE:-0}" == "1" ]]; then args+=(--quarantine-stale) fi if [[ "${STRICT_PREFLIGHT:-0}" == "1" ]]; then args+=(--strict-preflight) fi scripts/macos-fileprovider-neo-cleanup-packet.sh "${args[@]}" EOF lazy:test-macos-fileprovider-neo-cleanup: desc: Regression-test the neo FileProvider cleanup packet helper cmds: - bash scripts/test-macos-fileprovider-neo-cleanup-packet.sh lazy:test-macos-postinstall: desc: Regression-test the macOS FileProvider post-install smoke helper with fake platform tools cmds: - bash scripts/test-macos-postinstall-smoke.sh lazy:test-macos-build-pkg: desc: Regression-test the macOS .pkg builder with fake packaging tools cmds: - bash scripts/test-macos-build-pkg.sh lazy:test-bazel-macos-package-contract: desc: Regression-test the Bazel macOS .pkg target contract cmds: - bash scripts/test-bazel-macos-package-contract.sh lazy:test-macos-pkg-structure: desc: Regression-test the non-installing macOS .pkg structure smoke helper cmds: - bash scripts/test-macos-pkg-structure-smoke.sh lazy:test-macos-fileprovider-pkg-notarization-proof: desc: Regression-test the remote macOS FileProvider .pkg notarization proof workflow shape cmds: - bash scripts/test-macos-fileprovider-pkg-notarization-proof.sh lazy:test-macos-fileprovider-testing-mode-dispatch: desc: Regression-test the lab macOS FileProvider testing-mode dispatch helper cmds: - bash scripts/test-macos-fileprovider-testing-mode-dispatch.sh lazy:test-macos-fileprovider-lab-gatekeeper-override: desc: Regression-test the PZM FileProvider lab Gatekeeper override helper cmds: - bash scripts/test-macos-fileprovider-lab-gatekeeper-override.sh lazy:test-asc-fileprovider-lab-provision: desc: Regression-test ASC FileProvider lab provisioning helper shape cmds: - bash scripts/test-asc-fileprovider-lab-provision.sh lazy:macos-pkg-structure-smoke: desc: "Non-installing macOS .pkg structure proof: set PKG_PATH=..." cmds: - cmd: | bash -euo pipefail <<'EOF' : "${PKG_PATH:?set PKG_PATH=/path/to/tcfs.pkg}" args=(--pkg "$PKG_PATH") if [[ -n "${EXPECTED_POSTINSTALL:-}" ]]; then args+=(--expected-postinstall "$EXPECTED_POSTINSTALL") fi if [[ "${REQUIRE_SIGNATURE:-0}" == "1" ]]; then args+=(--require-signature) fi if [[ "${REQUIRE_GATEKEEPER_INSTALL:-0}" == "1" ]]; then args+=(--require-gatekeeper-install) fi if [[ "${REQUIRE_STAPLED_TICKET:-0}" == "1" ]]; then args+=(--require-stapled-ticket) fi scripts/macos-pkg-structure-smoke.sh "${args[@]}" EOF lazy:test-macos-preflight: desc: Regression-test the non-mutating macOS FileProvider preflight helper cmds: - bash scripts/test-macos-fileprovider-preflight.sh lazy:test-macos-tcfs-rollout-readiness: desc: Regression-test the read-only macOS TCFS rollout readiness helper cmds: - bash scripts/test-macos-tcfs-rollout-readiness.sh lazy:test-macos-profile-inventory: desc: Regression-test the macOS FileProvider provisioning profile inventory helper cmds: - bash scripts/test-macos-fileprovider-profile-inventory.sh lazy:macos-finder-profile-inventory: desc: Non-mutating inventory of matching macOS FileProvider provisioning profiles cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${PROFILES_DIR:-}" ]]; then args+=(--profiles-dir "$PROFILES_DIR") fi if [[ -n "${HOST_BUNDLE_ID:-}" ]]; then args+=(--host-bundle-id "$HOST_BUNDLE_ID") fi if [[ -n "${EXTENSION_BUNDLE_ID:-}" ]]; then args+=(--extension-bundle-id "$EXTENSION_BUNDLE_ID") fi if [[ -n "${APP_GROUP_ID:-}" ]]; then args+=(--app-group "$APP_GROUP_ID") fi if [[ -n "${KEYCHAIN_GROUP_SUFFIX:-}" ]]; then args+=(--keychain-group-suffix "$KEYCHAIN_GROUP_SUFFIX") fi if [[ "${STRICT:-0}" == "1" ]]; then args+=(--strict) fi scripts/macos-fileprovider-profile-inventory.sh "${args[@]}" EOF lazy:macos-finder-signing-preflight: desc: Non-mutating signing/profile check for a built TCFSProvider.app cmds: - cmd: | bash -euo pipefail <<'EOF' args=(--signing-only) if [[ -n "${APP_PATH:-}" ]]; then args+=(--app-path "$APP_PATH") fi if [[ "${TCFS_REQUIRE_PRODUCTION_SIGNING:-${REQUIRE_PRODUCTION_SIGNING:-0}}" == "1" ]]; then args+=(--require-production-signing) fi scripts/macos-fileprovider-preflight.sh "${args[@]}" EOF lazy:test-fileprovider-provision: desc: Regression-test FileProvider config provisioning metadata cmds: - bash scripts/test-fileprovider-provision-config.sh lazy:test-ios-bootstrap-qr: desc: Regression-test iOS bootstrap QR storage transport validation cmds: - bash -n swift/ios/Scripts/gen-bootstrap-qr.sh scripts/test-ios-bootstrap-qr.sh - shellcheck scripts/test-ios-bootstrap-qr.sh - bash scripts/test-ios-bootstrap-qr.sh lazy:test-fileprovider-surface-contract: desc: Regression-test FileProvider decorations, progress, and custom action contract cmds: - bash scripts/test-fileprovider-surface-contract.sh lazy:test-release-workflow-fileprovider: desc: Regression-test release workflow FileProvider profile import and package postinstall scripts cmds: - bash scripts/test-release-workflow-fileprovider.sh lazy:test-release-workflow-container: desc: Regression-test release workflow container platform publication cmds: - bash scripts/test-release-workflow-container.sh lazy:test-linux-package-container-workflow: desc: Regression-test Linux package container smoke workflow cmds: - bash scripts/test-linux-package-container-smoke-workflow.sh install-smoke-test: desc: Regression-test the installed-binary smoke helper with fake installed binaries cmds: - bash scripts/test-install-smoke.sh lazy:test-smoke-endpoint-preflight: desc: Regression-test CI smoke endpoint posture preflight cmds: - python3 scripts/test-tcfs-smoke-endpoint-preflight.py lazy:test-large-workdir-inventory: desc: Regression-test large workdir inventory packet generator cmds: - python3 scripts/test-large-workdir-inventory.py lazy:macos-finder-preflight: desc: Non-mutating readiness check for macOS Finder/FileProvider smoke cmds: - cmd: | bash -euo pipefail <<'EOF' args=() if [[ -n "${EXPECTED_VERSION:-}" ]]; then args+=(--expected-version "$EXPECTED_VERSION") fi if [[ -n "${CONFIG_PATH:-}" ]]; then args+=(--config "$CONFIG_PATH") fi if [[ -n "${FILEPROVIDER_CONFIG:-}" ]]; then args+=(--fileprovider-config "$FILEPROVIDER_CONFIG") fi if [[ -n "${APP_PATH:-}" ]]; then args+=(--app-path "$APP_PATH") fi if [[ -n "${CLOUD_ROOT:-}" ]]; then args+=(--cloud-root "$CLOUD_ROOT") fi if [[ -n "${PLUGIN_ID:-}" ]]; then args+=(--plugin-id "$PLUGIN_ID") fi if [[ -n "${DOMAIN_ID:-}" ]]; then args+=(--domain-id "$DOMAIN_ID") fi if [[ "${ALLOW_MULTIPLE_PLUGIN_REGISTRATIONS:-0}" == "1" ]]; then args+=(--allow-multiple-plugin-registrations) fi if [[ "${TCFS_REQUIRE_PRODUCTION_SIGNING:-${REQUIRE_PRODUCTION_SIGNING:-0}}" == "1" ]]; then args+=(--require-production-signing) fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs "$TCFS_BIN") fi if [[ -n "${TCFSD_BIN:-}" ]]; then args+=(--tcfsd "$TCFSD_BIN") fi scripts/macos-fileprovider-preflight.sh "${args[@]}" EOF lazy:macos-finder-preflight-workspace: desc: Build local tcfs/tcfsd and run non-mutating macOS Finder/FileProvider preflight against target/debug cmds: - cargo build -p tcfs-cli -p tcfsd - cmd: | bash -euo pipefail <<'EOF' if [[ -z "${EXPECTED_VERSION:-}" ]]; then EXPECTED_VERSION="$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)" export EXPECTED_VERSION fi export TCFS_BIN="${TCFS_BIN:-target/debug/tcfs}" export TCFSD_BIN="${TCFSD_BIN:-target/debug/tcfsd}" task lazy:macos-finder-preflight EOF lazy:macos-finder-smoke: desc: Verify macOS Finder/FileProvider enumerate + hydrate after install cmds: - cmd: | bash -euo pipefail <<'EOF' if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2 exit 2 fi args=() if [[ -n "${EXPECTED_FILE:-}" ]]; then args+=(--expected-file "$EXPECTED_FILE") fi if [[ -n "${EXPECTED_VERSION:-}" ]]; then args+=(--expected-version "$EXPECTED_VERSION") fi if [[ -n "${EXPECTED_CONTENT:-}" ]]; then args+=(--expected-content "$EXPECTED_CONTENT") fi if [[ -n "${EXPECTED_CONTENT_FILE:-}" ]]; then args+=(--expected-content-file "$EXPECTED_CONTENT_FILE") fi if [[ -n "${CONFIG_PATH:-}" ]]; then args+=(--config "$CONFIG_PATH") fi if [[ -n "${APP_PATH:-}" ]]; then args+=(--app-path "$APP_PATH") fi if [[ -n "${CLOUD_ROOT:-}" ]]; then args+=(--cloud-root "$CLOUD_ROOT") fi if [[ -n "${PLUGIN_ID:-}" ]]; then args+=(--plugin-id "$PLUGIN_ID") fi if [[ -n "${DOMAIN_ID:-}" ]]; then args+=(--domain-id "$DOMAIN_ID") fi if [[ "${ALLOW_MULTIPLE_PLUGIN_REGISTRATIONS:-0}" == "1" ]]; then args+=(--allow-multiple-plugin-registrations) fi if [[ "${TCFS_REQUIRE_KEYCHAIN_CONFIG:-${REQUIRE_KEYCHAIN_CONFIG:-0}}" == "1" ]]; then args+=(--require-keychain-config) fi if [[ -n "${TCFS_BIN:-}" ]]; then args+=(--tcfs "$TCFS_BIN") fi if [[ -n "${TCFSD_BIN:-}" ]]; then args+=(--tcfsd "$TCFSD_BIN") fi if [[ -n "${TIMEOUT_SECS:-}" ]]; then args+=(--timeout "$TIMEOUT_SECS") fi if [[ -n "${LOG_DIR:-}" ]]; then args+=(--log-dir "$LOG_DIR") fi if [[ "${SKIP_STATUS:-0}" == "1" ]]; then args+=(--skip-status) fi if [[ "${DIRECT_HOST_LAUNCH:-${TCFS_FILEPROVIDER_DIRECT_HOST_LAUNCH:-0}}" == "1" ]]; then args+=(--direct-host-launch) fi if [[ "${REBUILD_DOMAIN:-${TCFS_FILEPROVIDER_REBUILD_DOMAIN:-0}}" == "1" ]]; then args+=(--rebuild-domain) fi if [[ "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" == "1" ]]; then args+=(--seed-expected-file) fi scripts/macos-postinstall-smoke.sh "${args[@]}" EOF lazy:macos-finder-smoke-workspace: desc: Build local tcfs/tcfsd and run macOS Finder/FileProvider smoke against target/debug cmds: - cargo build -p tcfs-cli -p tcfsd - cmd: | bash -euo pipefail <<'EOF' if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2 exit 2 fi if [[ -z "${EXPECTED_VERSION:-}" ]]; then EXPECTED_VERSION="$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)" export EXPECTED_VERSION fi export TCFS_BIN="${TCFS_BIN:-target/debug/tcfs}" export TCFSD_BIN="${TCFSD_BIN:-target/debug/tcfsd}" task lazy:macos-finder-smoke EOF lazy:macos-finder-release-smoke: desc: Strict macOS Finder/FileProvider release proof with signing and shared-Keychain config gates cmds: - cmd: | bash -euo pipefail <<'EOF' if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2 exit 2 fi export TCFS_REQUIRE_PRODUCTION_SIGNING=1 export TCFS_REQUIRE_KEYCHAIN_CONFIG=1 task lazy:macos-finder-preflight task lazy:macos-finder-smoke EOF # ── Local dev stack ───────────────────────────────────────────────────────── dev: desc: Start local dev stack (SeaweedFS + NATS + Prometheus + Grafana) deps: - generate-certs cmds: - docker-compose up -d - cmd: 'echo ""' - cmd: 'echo "Local dev stack started:"' - cmd: 'echo " SeaweedFS master-1: http://localhost:9333"' - cmd: 'echo " SeaweedFS master-2: http://localhost:9334"' - cmd: 'echo " SeaweedFS master-3: http://localhost:9335"' - cmd: 'echo " SeaweedFS volume: http://localhost:8080"' - cmd: 'echo " SeaweedFS filer: http://localhost:8888"' - cmd: 'echo " SeaweedFS S3: http://localhost:8333"' - cmd: 'echo " NATS: nats://localhost:4222"' - cmd: 'echo " NATS monitoring: http://localhost:8222"' - cmd: 'echo " Prometheus: http://localhost:9090"' - cmd: 'echo " Grafana: http://localhost:3000 (admin/admin)"' - cmd: 'echo ""' - cmd: 'echo "Logs: docker-compose logs -f"' dev:stop: desc: Stop local dev stack cmds: - docker-compose down dev:restart: desc: Restart local dev stack cmds: - task: dev:stop - task: dev dev:logs: desc: Tail local dev stack logs cmds: - docker-compose logs -f dev:status: desc: Show local dev stack status cmds: - docker-compose ps # ── Certificates ───────────────────────────────────────────────────────────── generate-certs: desc: Generate SeaweedFS TLS certificates cmds: - bash scripts/generate-certs.sh # ── SOPS / Credentials ─────────────────────────────────────────────────────── sops:init: desc: Bootstrap SOPS+age keys (run once on setup) cmds: - bash scripts/sops-init.sh sops:migrate: desc: Migrate plaintext credentials from Ansible inventory to SOPS cmds: - bash scripts/migrate-credentials.sh sops:encrypt: desc: "Encrypt a file with SOPS: task sops:encrypt FILE=credentials/foo.yaml" vars: FILE: '{{.FILE}}' cmds: - sops --encrypt --in-place {{.FILE}} sops:decrypt: desc: "Decrypt a SOPS file to stdout: task sops:decrypt FILE=credentials/foo.yaml" vars: FILE: '{{.FILE}}' cmds: - sops --decrypt {{.FILE}} # ── Infrastructure ─────────────────────────────────────────────────────────── infra:plan: desc: "OpenTofu plan: task infra:plan ENV=civo" vars: ENV: '{{.ENV | default "local"}}' cmds: - cd infra/tofu/environments/{{.ENV}} && tofu plan infra:apply: desc: "OpenTofu apply: task infra:apply ENV=civo" vars: ENV: '{{.ENV | default "local"}}' cmds: - cd infra/tofu/environments/{{.ENV}} && tofu apply infra:destroy: desc: "OpenTofu destroy (DESTRUCTIVE): task infra:destroy ENV=local" vars: ENV: '{{.ENV | default "local"}}' prompt: "This will DESTROY infrastructure in '{{.ENV}}'. Continue?" cmds: - cd infra/tofu/environments/{{.ENV}} && tofu destroy # ── Cross-compilation ───────────────────────────────────────────────────────── cross:build: desc: Cross-compile all targets (requires cargo cross) cmds: - bash scripts/cross-compile.sh # ── Convenience ────────────────────────────────────────────────────────────── check: desc: Run all checks (build + lint + test + deny) cmds: - task: build - task: lint - task: test - task: deny # ── Documentation ────────────────────────────────────────────────────────── docs:links: desc: Check for broken links in documentation cmds: - lychee --config .lychee.toml "docs/**/*.md" "README.md" docs:pdf: desc: Build PDF versions of technical design docs (LaTeX → PDF) cmds: - mkdir -p dist/docs - cmd: 'cd docs/tex && tectonic architecture.tex -o ../../dist/docs' - cmd: 'cd docs/tex && tectonic protocol.tex -o ../../dist/docs' - cmd: 'cd docs/tex && tectonic security.tex -o ../../dist/docs' - cmd: 'cd docs/tex && tectonic fileprovider.tex -o ../../dist/docs' docs:serve: desc: Serve docs site locally with Jekyll cmds: - cd docs && bundle exec jekyll serve