Taskfile.yaml
Rama main · réplica de lectura del repositorio original.
# Taskfile.yaml
# tummycrypt/tcfs build system
# https://taskfile.dev
version: '3'
vars:
VERSION:
sh: git describe --tags --always --dirty 2>/dev/null || echo "0.1.0-dev"
COMMIT:
sh: git rev-parse --short HEAD 2>/dev/null || echo "unknown"
tasks:
default:
desc: Show available tasks
cmds:
- task --list
# ── Rust workspace ──────────────────────────────────────────────────────────
build:
desc: Build all Rust crates (debug)
cmds:
- cargo build --workspace
build:release:
desc: Build all Rust crates (release)
cmds:
- cargo build --workspace --release
test:
desc: Run all tests
cmds:
- cargo test --workspace
lint:
desc: Run clippy (deny warnings) + rustfmt check
cmds:
- cargo clippy --workspace -- -D warnings
- cargo fmt --all -- --check
fmt:
desc: Auto-format all Rust code
cmds:
- cargo fmt --all
clean:
desc: Clean build artifacts
cmds:
- cargo clean
bench:
desc: Run all divan benchmarks
cmds:
- ~/.cargo/bin/cargo bench -p tcfs-chunks --bench chunks
- ~/.cargo/bin/cargo bench -p tcfs-crypto --bench crypto
deny:
desc: Check licenses and advisories (cargo-deny)
cmds:
- cargo deny check
audit:
desc: Check for security advisories (cargo-audit)
cmds:
- cargo audit
# ── Lazy hydration demo proof ───────────────────────────────────────────────
lazy:mounted-smoke:
desc: "Verify an already-mounted lazy hydration surface: MOUNT_ROOT=... EXPECTED_FILE=..."
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
: "${MOUNT_ROOT:?set MOUNT_ROOT=/path/to/tcfs-mount}"
: "${EXPECTED_FILE:?set EXPECTED_FILE=relative/path/to/file}"
args=(
--mount-root "$MOUNT_ROOT"
--expected-file "$EXPECTED_FILE"
)
if [[ -n "${EXPECTED_CONTENT:-}" ]]; then
args+=(--expected-content "$EXPECTED_CONTENT")
fi
if [[ -n "${EXPECTED_CONTENT_FILE:-}" ]]; then
args+=(--expected-content-file "$EXPECTED_CONTENT_FILE")
fi
if [[ -n "${EXPECTED_CONTAINS:-}" ]]; then
args+=(--expected-contains "$EXPECTED_CONTAINS")
fi
if [[ -n "${MAX_DEPTH:-}" ]]; then
args+=(--max-depth "$MAX_DEPTH")
fi
for entry in ${EXPECT_ENTRIES:-}; do
args+=(--expect-entry "$entry")
done
scripts/lazy-hydration-mounted-smoke.sh "${args[@]}"
EOF
lazy:test-mounted-smoke:
desc: Regression-test the mounted lazy hydration smoke helper
cmds:
- bash scripts/test-lazy-hydration-mounted-smoke.sh
lazy:check:
desc: Run lazy hydration harness/static regression checks
cmds:
- bash -n scripts/lazy-hydration-linux-demo.sh scripts/lazy-hydration-linux-lifecycle-demo.sh scripts/test-lazy-hydration-linux-lifecycle-demo.sh scripts/lazy-hydration-mounted-smoke.sh scripts/test-lazy-hydration-mounted-smoke.sh scripts/installed-runtime-acceptance.sh scripts/test-installed-runtime-acceptance.sh scripts/git-dotgit-fsck-conflict-harness.sh scripts/test-git-dotgit-fsck-conflict-harness.sh scripts/git-repo-canary.sh scripts/test-git-repo-canary.sh scripts/git-repo-restore-proof.sh scripts/test-git-repo-restore-proof.sh scripts/git-roam-daily-driver-harness.sh scripts/test-git-roam-daily-driver-harness.sh scripts/tcfs-symlink-package-probe.sh scripts/test-tcfs-symlink-package-probe.sh scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh scripts/home-canary-linux-xr-storage-posture.sh scripts/test-home-canary-linux-xr-storage-posture.sh scripts/macos-fileprovider-neo-cleanup-packet.sh scripts/test-macos-fileprovider-neo-cleanup-packet.sh scripts/macos-developer-cert-match.sh scripts/macos-fileprovider-profile-inventory.sh scripts/test-macos-fileprovider-profile-inventory.sh scripts/macos-fileprovider-preflight.sh scripts/test-macos-fileprovider-preflight.sh scripts/macos-tcfs-rollout-readiness.sh scripts/test-macos-tcfs-rollout-readiness.sh scripts/macos-postinstall-smoke.sh scripts/macos-build-pkg.sh scripts/macos-pkg-postinstall.sh scripts/macos-pkg-structure-smoke.sh scripts/macos-fileprovider-testing-mode-dispatch.sh scripts/macos-fileprovider-lab-gatekeeper-override.sh scripts/macos-codesign-p12-probe.sh scripts/test-macos-build-pkg.sh scripts/test-bazel-macos-package-contract.sh scripts/test-macos-postinstall-smoke.sh scripts/test-macos-pkg-structure-smoke.sh scripts/test-macos-fileprovider-pkg-notarization-proof.sh scripts/test-macos-fileprovider-testing-mode-dispatch.sh scripts/test-macos-fileprovider-lab-gatekeeper-override.sh scripts/test-asc-fileprovider-lab-provision.sh scripts/test-fileprovider-provision-config.sh scripts/test-fileprovider-surface-contract.sh scripts/test-release-workflow-fileprovider.sh scripts/test-release-workflow-container.sh swift/fileprovider/provision-config.sh swift/fileprovider/build.sh scripts/tcfsd-health-check.sh scripts/test-tcfsd-health-check.sh
- shellcheck scripts/lazy-hydration-linux-demo.sh scripts/lazy-hydration-linux-lifecycle-demo.sh scripts/test-lazy-hydration-linux-lifecycle-demo.sh scripts/lazy-hydration-mounted-smoke.sh scripts/test-lazy-hydration-mounted-smoke.sh scripts/installed-runtime-acceptance.sh scripts/test-installed-runtime-acceptance.sh scripts/git-dotgit-fsck-conflict-harness.sh scripts/test-git-dotgit-fsck-conflict-harness.sh scripts/git-repo-canary.sh scripts/test-git-repo-canary.sh scripts/git-repo-restore-proof.sh scripts/test-git-repo-restore-proof.sh scripts/git-roam-daily-driver-harness.sh scripts/test-git-roam-daily-driver-harness.sh scripts/tcfs-symlink-package-probe.sh scripts/test-tcfs-symlink-package-probe.sh scripts/home-canary-linux-xr-shadow.sh scripts/test-home-canary-linux-xr-shadow.sh scripts/home-canary-linux-xr-storage-posture.sh scripts/test-home-canary-linux-xr-storage-posture.sh scripts/macos-fileprovider-neo-cleanup-packet.sh scripts/test-macos-fileprovider-neo-cleanup-packet.sh scripts/macos-developer-cert-match.sh scripts/macos-fileprovider-profile-inventory.sh scripts/test-macos-fileprovider-profile-inventory.sh scripts/macos-fileprovider-preflight.sh scripts/test-macos-fileprovider-preflight.sh scripts/macos-tcfs-rollout-readiness.sh scripts/test-macos-tcfs-rollout-readiness.sh scripts/macos-postinstall-smoke.sh scripts/macos-build-pkg.sh scripts/macos-pkg-postinstall.sh scripts/macos-pkg-structure-smoke.sh scripts/macos-fileprovider-testing-mode-dispatch.sh scripts/macos-fileprovider-lab-gatekeeper-override.sh scripts/macos-codesign-p12-probe.sh scripts/test-macos-build-pkg.sh scripts/test-bazel-macos-package-contract.sh scripts/test-macos-postinstall-smoke.sh scripts/test-macos-pkg-structure-smoke.sh scripts/test-macos-fileprovider-pkg-notarization-proof.sh scripts/test-macos-fileprovider-testing-mode-dispatch.sh scripts/test-macos-fileprovider-lab-gatekeeper-override.sh scripts/test-asc-fileprovider-lab-provision.sh scripts/test-fileprovider-provision-config.sh scripts/test-fileprovider-surface-contract.sh scripts/test-release-workflow-fileprovider.sh scripts/test-release-workflow-container.sh swift/fileprovider/provision-config.sh swift/fileprovider/build.sh scripts/tcfsd-health-check.sh scripts/test-tcfsd-health-check.sh
- python3 -m py_compile scripts/asc-fileprovider-lab-provision.py scripts/tcfs-smoke-endpoint-preflight.py scripts/test-tcfs-smoke-endpoint-preflight.py scripts/large-workdir-inventory.py scripts/test-large-workdir-inventory.py
- task: lazy:test-linux-lifecycle-demo
- task: lazy:test-mounted-smoke
- bash scripts/test-installed-runtime-acceptance.sh
- task: lazy:test-git-dotgit-fsck-conflict
- task: lazy:test-git-repo-canary
- task: lazy:test-git-repo-restore-proof
- task: lazy:test-git-roam-daily-driver
- task: lazy:test-tcfs-symlink-package-probe
- task: lazy:test-tcfsd-health-check
- task: lazy:test-home-canary-linux-xr-shadow
- task: lazy:test-home-canary-linux-xr-storage-posture
- task: lazy:test-macos-fileprovider-neo-cleanup
- task: lazy:test-macos-profile-inventory
- task: lazy:test-macos-preflight
- task: lazy:test-macos-tcfs-rollout-readiness
- task: lazy:test-macos-postinstall
- task: lazy:test-macos-build-pkg
- task: lazy:test-bazel-macos-package-contract
- task: lazy:test-macos-pkg-structure
- task: lazy:test-macos-fileprovider-pkg-notarization-proof
- task: lazy:test-macos-fileprovider-testing-mode-dispatch
- task: lazy:test-macos-fileprovider-lab-gatekeeper-override
- task: lazy:test-asc-fileprovider-lab-provision
- task: lazy:test-fileprovider-provision
- task: lazy:test-ios-bootstrap-qr
- task: lazy:test-fileprovider-surface-contract
- task: lazy:test-release-workflow-fileprovider
- task: lazy:test-release-workflow-container
- task: lazy:test-linux-package-container-workflow
- task: install-smoke-test
- task: lazy:test-smoke-endpoint-preflight
- cargo test -p tcfs-cli cli_unsync
- cargo test -p tcfs-cli cli_pull_after_unsync_hydrates_latest_remote_and_removes_stub
- cargo test -p tcfs-cli cli_pull_adjacent_stub_cleanup_ignores_non_tcfs_files
- cargo test -p tcfs-vfs
lazy:linux-demo:
desc: "Linux lazy proof: set TCFS_LAZY_DEMO_REMOTE=... and optional TCFS_LAZY_DEMO_CREATE_BUCKET=1"
cmds:
- bash scripts/lazy-hydration-linux-demo.sh
lazy:linux-lifecycle-demo:
desc: "Linux lifecycle parity proof: read, write, rehydrate, safe-unsync"
cmds:
- bash scripts/lazy-hydration-linux-lifecycle-demo.sh
lazy:test-linux-lifecycle-demo:
desc: Regression-test the Linux lifecycle proof helper shape
cmds:
- bash scripts/test-lazy-hydration-linux-lifecycle-demo.sh
lazy:honey-backbone-preflight:
desc: "Read-only G2/G3 preflight for neo/honey daemon, NATS, and device registry posture"
cmds:
- bash scripts/honey-backbone-preflight.sh
lazy:test-honey-backbone-preflight:
desc: Regression-test the read-only honey backbone preflight helper
cmds:
- bash scripts/test-honey-backbone-preflight.sh
lazy:test-git-dotgit-fsck-conflict:
desc: "FACET 6: .git-as-files fsck/flip-flop/conflict corruption harness (local-only)"
cmds:
- bash scripts/test-git-dotgit-fsck-conflict-harness.sh
lazy:git-repo-canary:
desc: "Safe git repo canary: shadow-first single-worktree proof packet"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${SOURCE:-}" ]]; then
args+=(--source "$SOURCE")
fi
if [[ -n "${NAME:-}" ]]; then
args+=(--name "$NAME")
fi
if [[ -n "${SHADOW_ROOT:-}" ]]; then
args+=(--shadow-root "$SHADOW_ROOT")
fi
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${REMOTE:-}" ]]; then
args+=(--remote "$REMOTE")
fi
if [[ -n "${STATE_DIR:-}" ]]; then
args+=(--state-dir "$STATE_DIR")
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs-bin "$TCFS_BIN")
fi
if [[ -n "${HONEY_HOST:-}" ]]; then
args+=(--honey-host "$HONEY_HOST")
fi
if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then
args+=(--honey-mount-root "$HONEY_MOUNT_ROOT")
fi
if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then
args+=(--honey-remote-dir "$HONEY_REMOTE_DIR")
fi
if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then
args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN")
fi
if [[ -n "${HONEY_SMOKE_MAX_DEPTH:-}" ]]; then
args+=(--honey-smoke-max-depth "$HONEY_SMOKE_MAX_DEPTH")
fi
if [[ -n "${HONEY_SMOKE_TIMEOUT_SECS:-}" ]]; then
args+=(--honey-smoke-timeout-secs "$HONEY_SMOKE_TIMEOUT_SECS")
fi
if [[ "${PUSH:-0}" == "1" ]]; then
args+=(--push)
fi
if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then
args+=(--resume-after-push)
fi
if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then
args+=(--reuse-shadow)
fi
if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then
args+=(--create-bucket)
fi
if [[ "${RUN_HONEY:-0}" == "1" ]]; then
args+=(--run-honey)
fi
if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then
args+=(--honey-start-mount)
fi
if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then
args+=(--honey-existing-mount)
fi
if [[ "${RUN_LINUX_LIFECYCLE:-0}" == "1" ]]; then
args+=(--run-linux-lifecycle)
fi
if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then
args+=(--forward-aws-env)
fi
if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then
args+=(--keep-shadow)
fi
if [[ "${ALLOW_DIRTY_SOURCE:-0}" == "1" ]]; then
args+=(--allow-dirty-source)
fi
scripts/git-repo-canary.sh "${args[@]}"
EOF
lazy:test-git-repo-canary:
desc: Regression-test the generic git repo canary helper
cmds:
- bash scripts/test-git-repo-canary.sh
lazy:dev-env-fingerprint:
desc: "Git-aware dev-env zero-diff fingerprint (G5/TIN-1620 precision layer over T2/T3/T8/T10)"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
mode="${MODE:-self-test}"
case "$mode" in
self-test)
scripts/repo-roam-fingerprint.sh self-test "${OUT_DIR:-}"
;;
capture)
: "${REPO:?set REPO=<git worktree> for MODE=capture}"
: "${OUT_DIR:?set OUT_DIR=<evidence dir> for MODE=capture}"
scripts/repo-roam-fingerprint.sh capture "$REPO" "$OUT_DIR"
;;
compare)
: "${DIR_A:?set DIR_A=<source fingerprint> for MODE=compare}"
: "${DIR_B:?set DIR_B=<rehydrated fingerprint> for MODE=compare}"
scripts/repo-roam-fingerprint.sh compare "$DIR_A" "$DIR_B"
;;
seed-canary)
: "${OUT_DIR:?set OUT_DIR=<throwaway dir> for MODE=seed-canary}"
scripts/repo-roam-fingerprint.sh seed-canary "$OUT_DIR"
;;
*)
echo "MODE must be self-test|capture|compare|seed-canary" >&2
exit 2
;;
esac
EOF
lazy:test-dev-env-fingerprint:
desc: Regression-test the git-aware dev-env fingerprint tool
cmds:
- bash scripts/test-repo-roam-fingerprint.sh
lazy:git-repo-restore-proof:
desc: "Fresh-tree restore proof for an existing pushed git repo canary packet"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${RESTORE_ROOT:-}" ]]; then
args+=(--restore-root "$RESTORE_ROOT")
fi
if [[ -n "${TCFS_RESTORE_CONFIG:-}" ]]; then
args+=(--config "$TCFS_RESTORE_CONFIG")
fi
if [[ -n "${CONFIG:-}" ]]; then
args+=(--config "$CONFIG")
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs-bin "$TCFS_BIN")
fi
if [[ -n "${TCFS_STATE_PATH:-}" ]]; then
args+=(--state "$TCFS_STATE_PATH")
fi
if [[ -n "${RESTORE_RECONCILE_TIMEOUT_SECS:-}" ]]; then
args+=(--reconcile-timeout-secs "$RESTORE_RECONCILE_TIMEOUT_SECS")
fi
if [[ "${REQUIRE_EMPTY_DIRS:-0}" == "1" ]]; then
args+=(--require-empty-dirs)
fi
if [[ "${RESTORE_REQUIRE_HEADROOM:-0}" == "1" ]]; then
args+=(--require-restore-headroom)
fi
if [[ -n "${RESTORE_HEADROOM_MARGIN_BYTES:-}" ]]; then
args+=(--restore-headroom-margin-bytes "$RESTORE_HEADROOM_MARGIN_BYTES")
fi
scripts/git-repo-restore-proof.sh "${args[@]}"
EOF
lazy:test-git-repo-restore-proof:
desc: Regression-test the git repo fresh-tree restore proof helper
cmds:
- bash scripts/test-git-repo-restore-proof.sh
lazy:git-roam-daily-driver-plan:
desc: "Plan-only evidence packet for the ~/git daily-driver roam story"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${REPO:-}" ]]; then
args+=(--repo "$REPO")
fi
if [[ -n "${AGENT_ROOT:-}" ]]; then
args+=(--agent-root "$AGENT_ROOT")
fi
if [[ -n "${NAME:-}" ]]; then
args+=(--name "$NAME")
fi
if [[ -n "${ORIGIN_HOST:-}" ]]; then
args+=(--origin-host "$ORIGIN_HOST")
fi
if [[ -n "${CONTINUATION_HOST:-}" ]]; then
args+=(--continuation-host "$CONTINUATION_HOST")
fi
if [[ -n "${THIRD_HOST:-}" ]]; then
args+=(--third-host "$THIRD_HOST")
fi
if [[ -n "${REMOTE_PREFIX:-}" ]]; then
args+=(--remote-prefix "$REMOTE_PREFIX")
fi
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${MAX_HASH_FILES:-}" ]]; then
args+=(--max-hash-files "$MAX_HASH_FILES")
fi
if [[ -n "${MAX_HASH_FILE_BYTES:-}" ]]; then
args+=(--max-hash-file-bytes "$MAX_HASH_FILE_BYTES")
fi
scripts/git-roam-daily-driver-harness.sh "${args[@]}"
EOF
lazy:test-git-roam-daily-driver:
desc: Regression-test the git roam daily-driver plan-only harness
cmds:
- bash scripts/test-git-roam-daily-driver-harness.sh
lazy:storage-large-restore-slo:
desc: "Evaluate a storage large-restore packet against optional SLO budgets"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${MIN_RESTORE_THROUGHPUT_BPS:-}" ]]; then
args+=(--min-restore-throughput-bps "$MIN_RESTORE_THROUGHPUT_BPS")
fi
if [[ -n "${MAX_RESTORE_ELAPSED_SECS:-}" ]]; then
args+=(--max-restore-elapsed-secs "$MAX_RESTORE_ELAPSED_SECS")
fi
if [[ -n "${MAX_502_LOG_LINES:-}" ]]; then
args+=(--max-502-log-lines "$MAX_502_LOG_LINES")
fi
if [[ -n "${MAX_OPENDAL_RETRY_ROWS:-}" ]]; then
args+=(--max-opendal-retry-rows "$MAX_OPENDAL_RETRY_ROWS")
fi
if [[ -n "${MAX_TCFS_CHUNK_RETRY_ROWS:-}" ]]; then
args+=(--max-tcfs-chunk-retry-rows "$MAX_TCFS_CHUNK_RETRY_ROWS")
fi
if [[ -n "${MAX_PUSH_WARN_ROWS:-}" ]]; then
args+=(--max-push-warn-rows "$MAX_PUSH_WARN_ROWS")
fi
if [[ -n "${MAX_PUSH_ERROR_ROWS:-}" ]]; then
args+=(--max-push-error-rows "$MAX_PUSH_ERROR_ROWS")
fi
if [[ -n "${MAX_SOCKET_HIGHWATER:-}" ]]; then
args+=(--max-socket-highwater "$MAX_SOCKET_HIGHWATER")
fi
scripts/evaluate-storage-large-restore-slo.sh "${args[@]}"
EOF
lazy:test-storage-large-restore-slo:
desc: Regression-test the storage large-restore SLO evaluator
cmds:
- bash scripts/test-evaluate-storage-large-restore-slo.sh
lazy:tcfs-symlink-package-probe:
desc: "Probe candidate package/current tcfs binaries for sync_symlinks behavior"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${ENDPOINT:-}" ]]; then
args+=(--endpoint "$ENDPOINT")
fi
if [[ -n "${BUCKET:-}" ]]; then
args+=(--bucket "$BUCKET")
fi
if [[ -n "${PREFIX_BASE:-}" ]]; then
args+=(--prefix-base "$PREFIX_BASE")
fi
if [[ "${STRICT:-0}" == "1" ]]; then
args+=(--strict)
fi
for candidate in ${CANDIDATES:-}; do
args+=(--candidate "$candidate")
done
scripts/tcfs-symlink-package-probe.sh "${args[@]}"
EOF
lazy:test-tcfs-symlink-package-probe:
desc: Regression-test the package symlink probe helper
cmds:
- bash scripts/test-tcfs-symlink-package-probe.sh
lazy:test-tcfsd-health-check:
desc: Regression-test the tcfsd supervisor health check (backend-down vs restart backoff)
cmds:
- bash scripts/test-tcfsd-health-check.sh
lazy:large-workdir-inventory:
desc: "Read-only inventory packet for a selected large workdir"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
root="${ROOT:-/Users/jess/git/linux-xr-fast}"
args=()
if [[ -n "${OUT_DIR:-}" ]]; then
args+=(--out-dir "$OUT_DIR")
fi
if [[ "${SKIP_XATTRS:-0}" == "1" ]]; then
args+=(--skip-xattrs)
fi
if [[ -n "${MAX_UNSUPPORTED:-}" ]]; then
args+=(--max-unsupported "$MAX_UNSUPPORTED")
fi
if [[ "${#args[@]}" -gt 0 ]]; then
python3 scripts/large-workdir-inventory.py "$root" "${args[@]}"
else
python3 scripts/large-workdir-inventory.py "$root"
fi
EOF
lazy:large-workdir-onboarding:
desc: "Large workdir onboarding packet: inventory plus shadow-first pilot"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
export SOURCE="${SOURCE:-/Users/jess/git/linux-xr-fast}"
export EVIDENCE_DIR="${EVIDENCE_DIR:-docs/release/evidence/large-workdir-${timestamp}}"
export SHADOW_ROOT="${SHADOW_ROOT:-$HOME/TCFS Pilot/real-canaries/linux-xr-fast-shadow-${timestamp}}"
export REMOTE="${REMOTE:-seaweedfs://localhost:8333/tcfs/large-workdir-${timestamp}}"
export STATE_DIR="${STATE_DIR:-$EVIDENCE_DIR/state}"
task lazy:home-canary-linux-xr-shadow
EOF
lazy:home-canary-linux-xr-shadow:
desc: "Real project-tree canary: isolated /Users/jess/git/linux-xr shadow packet"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${SOURCE:-}" ]]; then
args+=(--source "$SOURCE")
fi
if [[ -n "${SHADOW_ROOT:-}" ]]; then
args+=(--shadow-root "$SHADOW_ROOT")
fi
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${REMOTE:-}" ]]; then
args+=(--remote "$REMOTE")
fi
if [[ -n "${STATE_DIR:-}" ]]; then
args+=(--state-dir "$STATE_DIR")
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs-bin "$TCFS_BIN")
fi
if [[ -n "${HONEY_HOST:-}" ]]; then
args+=(--honey-host "$HONEY_HOST")
fi
if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then
args+=(--honey-mount-root "$HONEY_MOUNT_ROOT")
fi
if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then
args+=(--honey-remote-dir "$HONEY_REMOTE_DIR")
fi
if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then
args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN")
fi
if [[ "${PUSH:-0}" == "1" ]]; then
args+=(--push)
fi
if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then
args+=(--resume-after-push)
fi
if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then
args+=(--reuse-shadow)
fi
if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then
args+=(--create-bucket)
fi
if [[ "${RUN_HONEY:-0}" == "1" ]]; then
args+=(--run-honey)
fi
if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then
args+=(--honey-start-mount)
fi
if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then
args+=(--honey-existing-mount)
fi
if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then
args+=(--forward-aws-env)
fi
if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then
args+=(--keep-shadow)
fi
scripts/home-canary-linux-xr-shadow.sh "${args[@]}"
EOF
lazy:test-home-canary-linux-xr-shadow:
desc: Regression-test the linux-xr shadow canary helper
cmds:
- bash scripts/test-home-canary-linux-xr-shadow.sh
lazy:home-canary-linux-xr-storage-posture:
desc: "S3 posture canary: release-binary fresh-prefix linux-xr shadow packet"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${SOURCE:-}" ]]; then
args+=(--source "$SOURCE")
fi
if [[ -n "${SHADOW_ROOT:-}" ]]; then
args+=(--shadow-root "$SHADOW_ROOT")
fi
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${REMOTE:-}" ]]; then
args+=(--remote "$REMOTE")
fi
if [[ -n "${STATE_DIR:-}" ]]; then
args+=(--state-dir "$STATE_DIR")
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs-bin "$TCFS_BIN")
fi
if [[ -n "${HONEY_HOST:-}" ]]; then
args+=(--honey-host "$HONEY_HOST")
fi
if [[ -n "${HONEY_MOUNT_ROOT:-}" ]]; then
args+=(--honey-mount-root "$HONEY_MOUNT_ROOT")
fi
if [[ -n "${HONEY_REMOTE_DIR:-}" ]]; then
args+=(--honey-remote-dir "$HONEY_REMOTE_DIR")
fi
if [[ -n "${HONEY_TCFS_BIN:-}" ]]; then
args+=(--honey-tcfs-bin "$HONEY_TCFS_BIN")
fi
if [[ -n "${UPLOAD_CONCURRENCY:-}" ]]; then
args+=(--upload-concurrency "$UPLOAD_CONCURRENCY")
fi
if [[ -n "${FILE_UPLOAD_CONCURRENCY:-}" ]]; then
args+=(--file-upload-concurrency "$FILE_UPLOAD_CONCURRENCY")
fi
if [[ -n "${PROGRESS_EVERY_CHUNKS:-}" ]]; then
args+=(--progress-every-chunks "$PROGRESS_EVERY_CHUNKS")
fi
if [[ -n "${CHUNK_TIMEOUT_SECS:-}" ]]; then
args+=(--chunk-timeout-secs "$CHUNK_TIMEOUT_SECS")
fi
if [[ -n "${PROGRESS_HEARTBEAT_SECS:-}" ]]; then
args+=(--progress-heartbeat-secs "$PROGRESS_HEARTBEAT_SECS")
fi
if [[ -n "${S3_CONNECT_TIMEOUT_SECS:-}" ]]; then
args+=(--s3-connect-timeout-secs "$S3_CONNECT_TIMEOUT_SECS")
fi
if [[ -n "${S3_POOL_IDLE_TIMEOUT_SECS:-}" ]]; then
args+=(--s3-pool-idle-timeout-secs "$S3_POOL_IDLE_TIMEOUT_SECS")
fi
if [[ -n "${S3_POOL_MAX_IDLE_PER_HOST:-}" ]]; then
args+=(--s3-pool-max-idle-per-host "$S3_POOL_MAX_IDLE_PER_HOST")
fi
if [[ "${S3_HTTP1_ONLY:-0}" == "1" ]]; then
args+=(--s3-http1-only)
fi
if [[ -n "${SOCKET_SAMPLE_INTERVAL_SECS:-}" ]]; then
args+=(--socket-sample-interval-secs "$SOCKET_SAMPLE_INTERVAL_SECS")
fi
if [[ "${PUSH:-0}" == "1" ]]; then
args+=(--push)
fi
if [[ "${RESUME_AFTER_PUSH:-0}" == "1" ]]; then
args+=(--resume-after-push)
fi
if [[ "${REUSE_SHADOW:-0}" == "1" ]]; then
args+=(--reuse-shadow)
fi
if [[ "${CREATE_BUCKET:-0}" == "1" ]]; then
args+=(--create-bucket)
fi
if [[ "${RUN_HONEY:-0}" == "1" ]]; then
args+=(--run-honey)
fi
if [[ "${HONEY_START_MOUNT:-0}" == "1" ]]; then
args+=(--honey-start-mount)
fi
if [[ "${HONEY_EXISTING_MOUNT:-0}" == "1" ]]; then
args+=(--honey-existing-mount)
fi
if [[ "${RUN_LINUX_LIFECYCLE:-0}" == "1" ]]; then
args+=(--run-linux-lifecycle)
fi
if [[ "${FORWARD_AWS_ENV:-0}" == "1" ]]; then
args+=(--forward-aws-env)
fi
if [[ "${NO_ASSUME_FRESH_PREFIX:-0}" == "1" ]]; then
args+=(--no-assume-fresh-prefix)
fi
if [[ "${ALLOW_DEBUG_BINARY:-0}" == "1" ]]; then
args+=(--allow-debug-binary)
fi
if [[ "${ALLOW_NON_POSTURE_PREFIX:-0}" == "1" ]]; then
args+=(--allow-non-posture-prefix)
fi
if [[ "${KEEP_SHADOW:-0}" == "1" ]]; then
args+=(--keep-shadow)
fi
scripts/home-canary-linux-xr-storage-posture.sh "${args[@]}"
EOF
lazy:test-home-canary-linux-xr-storage-posture:
desc: Regression-test the linux-xr storage posture canary wrapper
cmds:
- bash scripts/test-home-canary-linux-xr-storage-posture.sh
lazy:macos-fileprovider-neo-cleanup-packet:
desc: "Archive neo FileProvider divergence and optionally install the published pkg"
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${EVIDENCE_DIR:-}" ]]; then
args+=(--evidence-dir "$EVIDENCE_DIR")
fi
if [[ -n "${PKG_PATH:-}" ]]; then
args+=(--pkg "$PKG_PATH")
fi
if [[ -n "${APP_PATH:-}" ]]; then
args+=(--app-path "$APP_PATH")
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs "$TCFS_BIN")
fi
if [[ -n "${TCFSD_BIN:-}" ]]; then
args+=(--tcfsd "$TCFSD_BIN")
fi
if [[ "${INSTALL_PKG:-0}" == "1" ]]; then
args+=(--install-pkg)
fi
if [[ -n "${INSTALL_MODE:-}" ]]; then
args+=(--install-mode "$INSTALL_MODE")
fi
if [[ "${QUARANTINE_STALE:-0}" == "1" ]]; then
args+=(--quarantine-stale)
fi
if [[ "${STRICT_PREFLIGHT:-0}" == "1" ]]; then
args+=(--strict-preflight)
fi
scripts/macos-fileprovider-neo-cleanup-packet.sh "${args[@]}"
EOF
lazy:test-macos-fileprovider-neo-cleanup:
desc: Regression-test the neo FileProvider cleanup packet helper
cmds:
- bash scripts/test-macos-fileprovider-neo-cleanup-packet.sh
lazy:test-macos-postinstall:
desc: Regression-test the macOS FileProvider post-install smoke helper with fake platform tools
cmds:
- bash scripts/test-macos-postinstall-smoke.sh
lazy:test-macos-build-pkg:
desc: Regression-test the macOS .pkg builder with fake packaging tools
cmds:
- bash scripts/test-macos-build-pkg.sh
lazy:test-bazel-macos-package-contract:
desc: Regression-test the Bazel macOS .pkg target contract
cmds:
- bash scripts/test-bazel-macos-package-contract.sh
lazy:test-macos-pkg-structure:
desc: Regression-test the non-installing macOS .pkg structure smoke helper
cmds:
- bash scripts/test-macos-pkg-structure-smoke.sh
lazy:test-macos-fileprovider-pkg-notarization-proof:
desc: Regression-test the remote macOS FileProvider .pkg notarization proof workflow shape
cmds:
- bash scripts/test-macos-fileprovider-pkg-notarization-proof.sh
lazy:test-macos-fileprovider-testing-mode-dispatch:
desc: Regression-test the lab macOS FileProvider testing-mode dispatch helper
cmds:
- bash scripts/test-macos-fileprovider-testing-mode-dispatch.sh
lazy:test-macos-fileprovider-lab-gatekeeper-override:
desc: Regression-test the PZM FileProvider lab Gatekeeper override helper
cmds:
- bash scripts/test-macos-fileprovider-lab-gatekeeper-override.sh
lazy:test-asc-fileprovider-lab-provision:
desc: Regression-test ASC FileProvider lab provisioning helper shape
cmds:
- bash scripts/test-asc-fileprovider-lab-provision.sh
lazy:macos-pkg-structure-smoke:
desc: "Non-installing macOS .pkg structure proof: set PKG_PATH=..."
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
: "${PKG_PATH:?set PKG_PATH=/path/to/tcfs.pkg}"
args=(--pkg "$PKG_PATH")
if [[ -n "${EXPECTED_POSTINSTALL:-}" ]]; then
args+=(--expected-postinstall "$EXPECTED_POSTINSTALL")
fi
if [[ "${REQUIRE_SIGNATURE:-0}" == "1" ]]; then
args+=(--require-signature)
fi
if [[ "${REQUIRE_GATEKEEPER_INSTALL:-0}" == "1" ]]; then
args+=(--require-gatekeeper-install)
fi
if [[ "${REQUIRE_STAPLED_TICKET:-0}" == "1" ]]; then
args+=(--require-stapled-ticket)
fi
scripts/macos-pkg-structure-smoke.sh "${args[@]}"
EOF
lazy:test-macos-preflight:
desc: Regression-test the non-mutating macOS FileProvider preflight helper
cmds:
- bash scripts/test-macos-fileprovider-preflight.sh
lazy:test-macos-tcfs-rollout-readiness:
desc: Regression-test the read-only macOS TCFS rollout readiness helper
cmds:
- bash scripts/test-macos-tcfs-rollout-readiness.sh
lazy:test-macos-profile-inventory:
desc: Regression-test the macOS FileProvider provisioning profile inventory helper
cmds:
- bash scripts/test-macos-fileprovider-profile-inventory.sh
lazy:macos-finder-profile-inventory:
desc: Non-mutating inventory of matching macOS FileProvider provisioning profiles
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${PROFILES_DIR:-}" ]]; then
args+=(--profiles-dir "$PROFILES_DIR")
fi
if [[ -n "${HOST_BUNDLE_ID:-}" ]]; then
args+=(--host-bundle-id "$HOST_BUNDLE_ID")
fi
if [[ -n "${EXTENSION_BUNDLE_ID:-}" ]]; then
args+=(--extension-bundle-id "$EXTENSION_BUNDLE_ID")
fi
if [[ -n "${APP_GROUP_ID:-}" ]]; then
args+=(--app-group "$APP_GROUP_ID")
fi
if [[ -n "${KEYCHAIN_GROUP_SUFFIX:-}" ]]; then
args+=(--keychain-group-suffix "$KEYCHAIN_GROUP_SUFFIX")
fi
if [[ "${STRICT:-0}" == "1" ]]; then
args+=(--strict)
fi
scripts/macos-fileprovider-profile-inventory.sh "${args[@]}"
EOF
lazy:macos-finder-signing-preflight:
desc: Non-mutating signing/profile check for a built TCFSProvider.app
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=(--signing-only)
if [[ -n "${APP_PATH:-}" ]]; then
args+=(--app-path "$APP_PATH")
fi
if [[ "${TCFS_REQUIRE_PRODUCTION_SIGNING:-${REQUIRE_PRODUCTION_SIGNING:-0}}" == "1" ]]; then
args+=(--require-production-signing)
fi
scripts/macos-fileprovider-preflight.sh "${args[@]}"
EOF
lazy:test-fileprovider-provision:
desc: Regression-test FileProvider config provisioning metadata
cmds:
- bash scripts/test-fileprovider-provision-config.sh
lazy:test-ios-bootstrap-qr:
desc: Regression-test iOS bootstrap QR storage transport validation
cmds:
- bash -n swift/ios/Scripts/gen-bootstrap-qr.sh scripts/test-ios-bootstrap-qr.sh
- shellcheck scripts/test-ios-bootstrap-qr.sh
- bash scripts/test-ios-bootstrap-qr.sh
lazy:test-fileprovider-surface-contract:
desc: Regression-test FileProvider decorations, progress, and custom action contract
cmds:
- bash scripts/test-fileprovider-surface-contract.sh
lazy:test-release-workflow-fileprovider:
desc: Regression-test release workflow FileProvider profile import and package postinstall scripts
cmds:
- bash scripts/test-release-workflow-fileprovider.sh
lazy:test-release-workflow-container:
desc: Regression-test release workflow container platform publication
cmds:
- bash scripts/test-release-workflow-container.sh
lazy:test-linux-package-container-workflow:
desc: Regression-test Linux package container smoke workflow
cmds:
- bash scripts/test-linux-package-container-smoke-workflow.sh
install-smoke-test:
desc: Regression-test the installed-binary smoke helper with fake installed binaries
cmds:
- bash scripts/test-install-smoke.sh
lazy:test-smoke-endpoint-preflight:
desc: Regression-test CI smoke endpoint posture preflight
cmds:
- python3 scripts/test-tcfs-smoke-endpoint-preflight.py
lazy:test-large-workdir-inventory:
desc: Regression-test large workdir inventory packet generator
cmds:
- python3 scripts/test-large-workdir-inventory.py
lazy:macos-finder-preflight:
desc: Non-mutating readiness check for macOS Finder/FileProvider smoke
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
args=()
if [[ -n "${EXPECTED_VERSION:-}" ]]; then
args+=(--expected-version "$EXPECTED_VERSION")
fi
if [[ -n "${CONFIG_PATH:-}" ]]; then
args+=(--config "$CONFIG_PATH")
fi
if [[ -n "${FILEPROVIDER_CONFIG:-}" ]]; then
args+=(--fileprovider-config "$FILEPROVIDER_CONFIG")
fi
if [[ -n "${APP_PATH:-}" ]]; then
args+=(--app-path "$APP_PATH")
fi
if [[ -n "${CLOUD_ROOT:-}" ]]; then
args+=(--cloud-root "$CLOUD_ROOT")
fi
if [[ -n "${PLUGIN_ID:-}" ]]; then
args+=(--plugin-id "$PLUGIN_ID")
fi
if [[ -n "${DOMAIN_ID:-}" ]]; then
args+=(--domain-id "$DOMAIN_ID")
fi
if [[ "${ALLOW_MULTIPLE_PLUGIN_REGISTRATIONS:-0}" == "1" ]]; then
args+=(--allow-multiple-plugin-registrations)
fi
if [[ "${TCFS_REQUIRE_PRODUCTION_SIGNING:-${REQUIRE_PRODUCTION_SIGNING:-0}}" == "1" ]]; then
args+=(--require-production-signing)
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs "$TCFS_BIN")
fi
if [[ -n "${TCFSD_BIN:-}" ]]; then
args+=(--tcfsd "$TCFSD_BIN")
fi
scripts/macos-fileprovider-preflight.sh "${args[@]}"
EOF
lazy:macos-finder-preflight-workspace:
desc: Build local tcfs/tcfsd and run non-mutating macOS Finder/FileProvider preflight against target/debug
cmds:
- cargo build -p tcfs-cli -p tcfsd
- cmd: |
bash -euo pipefail <<'EOF'
if [[ -z "${EXPECTED_VERSION:-}" ]]; then
EXPECTED_VERSION="$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)"
export EXPECTED_VERSION
fi
export TCFS_BIN="${TCFS_BIN:-target/debug/tcfs}"
export TCFSD_BIN="${TCFSD_BIN:-target/debug/tcfsd}"
task lazy:macos-finder-preflight
EOF
lazy:macos-finder-smoke:
desc: Verify macOS Finder/FileProvider enumerate + hydrate after install
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then
echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2
exit 2
fi
args=()
if [[ -n "${EXPECTED_FILE:-}" ]]; then
args+=(--expected-file "$EXPECTED_FILE")
fi
if [[ -n "${EXPECTED_VERSION:-}" ]]; then
args+=(--expected-version "$EXPECTED_VERSION")
fi
if [[ -n "${EXPECTED_CONTENT:-}" ]]; then
args+=(--expected-content "$EXPECTED_CONTENT")
fi
if [[ -n "${EXPECTED_CONTENT_FILE:-}" ]]; then
args+=(--expected-content-file "$EXPECTED_CONTENT_FILE")
fi
if [[ -n "${CONFIG_PATH:-}" ]]; then
args+=(--config "$CONFIG_PATH")
fi
if [[ -n "${APP_PATH:-}" ]]; then
args+=(--app-path "$APP_PATH")
fi
if [[ -n "${CLOUD_ROOT:-}" ]]; then
args+=(--cloud-root "$CLOUD_ROOT")
fi
if [[ -n "${PLUGIN_ID:-}" ]]; then
args+=(--plugin-id "$PLUGIN_ID")
fi
if [[ -n "${DOMAIN_ID:-}" ]]; then
args+=(--domain-id "$DOMAIN_ID")
fi
if [[ "${ALLOW_MULTIPLE_PLUGIN_REGISTRATIONS:-0}" == "1" ]]; then
args+=(--allow-multiple-plugin-registrations)
fi
if [[ "${TCFS_REQUIRE_KEYCHAIN_CONFIG:-${REQUIRE_KEYCHAIN_CONFIG:-0}}" == "1" ]]; then
args+=(--require-keychain-config)
fi
if [[ -n "${TCFS_BIN:-}" ]]; then
args+=(--tcfs "$TCFS_BIN")
fi
if [[ -n "${TCFSD_BIN:-}" ]]; then
args+=(--tcfsd "$TCFSD_BIN")
fi
if [[ -n "${TIMEOUT_SECS:-}" ]]; then
args+=(--timeout "$TIMEOUT_SECS")
fi
if [[ -n "${LOG_DIR:-}" ]]; then
args+=(--log-dir "$LOG_DIR")
fi
if [[ "${SKIP_STATUS:-0}" == "1" ]]; then
args+=(--skip-status)
fi
if [[ "${DIRECT_HOST_LAUNCH:-${TCFS_FILEPROVIDER_DIRECT_HOST_LAUNCH:-0}}" == "1" ]]; then
args+=(--direct-host-launch)
fi
if [[ "${REBUILD_DOMAIN:-${TCFS_FILEPROVIDER_REBUILD_DOMAIN:-0}}" == "1" ]]; then
args+=(--rebuild-domain)
fi
if [[ "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" == "1" ]]; then
args+=(--seed-expected-file)
fi
scripts/macos-postinstall-smoke.sh "${args[@]}"
EOF
lazy:macos-finder-smoke-workspace:
desc: Build local tcfs/tcfsd and run macOS Finder/FileProvider smoke against target/debug
cmds:
- cargo build -p tcfs-cli -p tcfsd
- cmd: |
bash -euo pipefail <<'EOF'
if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then
echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2
exit 2
fi
if [[ -z "${EXPECTED_VERSION:-}" ]]; then
EXPECTED_VERSION="$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)"
export EXPECTED_VERSION
fi
export TCFS_BIN="${TCFS_BIN:-target/debug/tcfs}"
export TCFSD_BIN="${TCFSD_BIN:-target/debug/tcfsd}"
task lazy:macos-finder-smoke
EOF
lazy:macos-finder-release-smoke:
desc: Strict macOS Finder/FileProvider release proof with signing and shared-Keychain config gates
cmds:
- cmd: |
bash -euo pipefail <<'EOF'
if [[ -z "${EXPECTED_FILE:-}" && "${SEED_EXPECTED_FILE:-${TCFS_FILEPROVIDER_SEED_EXPECTED_FILE:-0}}" != "1" ]]; then
echo "set EXPECTED_FILE=relative/path/under/CloudStorage or SEED_EXPECTED_FILE=1" >&2
exit 2
fi
export TCFS_REQUIRE_PRODUCTION_SIGNING=1
export TCFS_REQUIRE_KEYCHAIN_CONFIG=1
task lazy:macos-finder-preflight
task lazy:macos-finder-smoke
EOF
# ── Local dev stack ─────────────────────────────────────────────────────────
dev:
desc: Start local dev stack (SeaweedFS + NATS + Prometheus + Grafana)
deps:
- generate-certs
cmds:
- docker-compose up -d
- cmd: 'echo ""'
- cmd: 'echo "Local dev stack started:"'
- cmd: 'echo " SeaweedFS master-1: http://localhost:9333"'
- cmd: 'echo " SeaweedFS master-2: http://localhost:9334"'
- cmd: 'echo " SeaweedFS master-3: http://localhost:9335"'
- cmd: 'echo " SeaweedFS volume: http://localhost:8080"'
- cmd: 'echo " SeaweedFS filer: http://localhost:8888"'
- cmd: 'echo " SeaweedFS S3: http://localhost:8333"'
- cmd: 'echo " NATS: nats://localhost:4222"'
- cmd: 'echo " NATS monitoring: http://localhost:8222"'
- cmd: 'echo " Prometheus: http://localhost:9090"'
- cmd: 'echo " Grafana: http://localhost:3000 (admin/admin)"'
- cmd: 'echo ""'
- cmd: 'echo "Logs: docker-compose logs -f"'
dev:stop:
desc: Stop local dev stack
cmds:
- docker-compose down
dev:restart:
desc: Restart local dev stack
cmds:
- task: dev:stop
- task: dev
dev:logs:
desc: Tail local dev stack logs
cmds:
- docker-compose logs -f
dev:status:
desc: Show local dev stack status
cmds:
- docker-compose ps
# ── Certificates ─────────────────────────────────────────────────────────────
generate-certs:
desc: Generate SeaweedFS TLS certificates
cmds:
- bash scripts/generate-certs.sh
# ── SOPS / Credentials ───────────────────────────────────────────────────────
sops:init:
desc: Bootstrap SOPS+age keys (run once on setup)
cmds:
- bash scripts/sops-init.sh
sops:migrate:
desc: Migrate plaintext credentials from Ansible inventory to SOPS
cmds:
- bash scripts/migrate-credentials.sh
sops:encrypt:
desc: "Encrypt a file with SOPS: task sops:encrypt FILE=credentials/foo.yaml"
vars:
FILE: '{{.FILE}}'
cmds:
- sops --encrypt --in-place {{.FILE}}
sops:decrypt:
desc: "Decrypt a SOPS file to stdout: task sops:decrypt FILE=credentials/foo.yaml"
vars:
FILE: '{{.FILE}}'
cmds:
- sops --decrypt {{.FILE}}
# ── Infrastructure ───────────────────────────────────────────────────────────
infra:plan:
desc: "OpenTofu plan: task infra:plan ENV=civo"
vars:
ENV: '{{.ENV | default "local"}}'
cmds:
- cd infra/tofu/environments/{{.ENV}} && tofu plan
infra:apply:
desc: "OpenTofu apply: task infra:apply ENV=civo"
vars:
ENV: '{{.ENV | default "local"}}'
cmds:
- cd infra/tofu/environments/{{.ENV}} && tofu apply
infra:destroy:
desc: "OpenTofu destroy (DESTRUCTIVE): task infra:destroy ENV=local"
vars:
ENV: '{{.ENV | default "local"}}'
prompt: "This will DESTROY infrastructure in '{{.ENV}}'. Continue?"
cmds:
- cd infra/tofu/environments/{{.ENV}} && tofu destroy
# ── Cross-compilation ─────────────────────────────────────────────────────────
cross:build:
desc: Cross-compile all targets (requires cargo cross)
cmds:
- bash scripts/cross-compile.sh
# ── Convenience ──────────────────────────────────────────────────────────────
check:
desc: Run all checks (build + lint + test + deny)
cmds:
- task: build
- task: lint
- task: test
- task: deny
# ── Documentation ──────────────────────────────────────────────────────────
docs:links:
desc: Check for broken links in documentation
cmds:
- lychee --config .lychee.toml "docs/**/*.md" "README.md"
docs:pdf:
desc: Build PDF versions of technical design docs (LaTeX → PDF)
cmds:
- mkdir -p dist/docs
- cmd: 'cd docs/tex && tectonic architecture.tex -o ../../dist/docs'
- cmd: 'cd docs/tex && tectonic protocol.tex -o ../../dist/docs'
- cmd: 'cd docs/tex && tectonic security.tex -o ../../dist/docs'
- cmd: 'cd docs/tex && tectonic fileprovider.tex -o ../../dist/docs'
docs:serve:
desc: Serve docs site locally with Jekyll
cmds:
- cd docs && bundle exec jekyll serve