Browse Projects

Show this help message

Check system dependencies (via CI resolver)

Install system dependencies (platform-aware: brew on macOS, two-phase sudo on Linux)

(ROOT) Privileged bootstrap: deploy-ci + guard + hooks/exemptions + syslog limits

Bootstrap CI tools (uv + ansible + node) + VM-specific tools (uv python + git-xet)

Install CI project deps (boot tools, Python venv, gitleaks) - delegates to CI

Interactive TUI to select and install components

Install QEMU + firmware into platform boot directory (GPL-2.0)

Interactive TUI for llama/hardware lifecycle

Non-interactive llama/hardware setup (llama-setup-defaults.yaml)

Non-interactive component install (uses install-defaults.yaml)

Build git-guard binary (operator: sudo make build-guard) - delegates to CI

Alias for install-guard-host-exec

Alias for guard-refresh (workspace root)

Enforce system-level log ceilings (needs sudo) - delegates to CI

Enforce multi-server capacity limits: inotify/conntrack/socket/fd (needs sudo)

(ROOT) Provision second NVMe as fast ext4 (preview: FAST_STORAGE_ARGS='--dry-run'; apply: '--wipe-nvme1')

Move podman store/models/QEMU/caches onto fast storage (preview: MIGRATE_ARGS='--dry-run')

Install + start the hang-evidence sampler user unit

Tail the hang-evidence sampler output

Clone every workspace repo per moon.yml metadata

Sync package dependencies via uv

Lightweight uv sync (dev extras only, no boot/repos)

Setup configuration files

Setup automation configuration

(CONTROL PLANE) Register extensions in the platform boot bin

Install WORKSPACE shell environment to ~/.bashrc

Remove WORKSPACE shell environment from ~/.bashrc

Build and start a VM from config file

podman start <id> + write PID

podman stop <id> + remove PID

podman start <id> (alias)

podman rm <id> + optional volume purge

read .vms/<id>/pid and send SIGKILL directly

podman exec -it <id> bash

podman exec <id> -- <cmd>

podman logs <id>

podman ps -a --filter label=workspace.type=vm

podman inspect + stats for <id>

re-build + restart <id> from stored vm.yaml

file sync per config.sync rules

print the vm.yaml used to create <id>

generate or print client cert for <id>

Install native git hooks (root-only: root-owned, immutable; no user-owned hook path exists)

Install deps in every nested repo

Install hooks in workspace + every nested .git under projects/ (root-only: root-owned, immutable)

Preview generated hooks (dry-run)

Run tests (delegates to moon for caching)

Run AgentCI TypeScript plugin tests

Run end-to-end VM integration tests

QEMU poc + guard E2E (set TEST_QEMU_FULL=1 to include full-ci)

QEMU poc + full-ci + guard (authoritative, slow)

Authoritative WORKSPACE-GUARD gate in QEMU guest

Authoritative shell-guard gate in QEMU guest

Pre-release QEMU + guard checklist

Remove orphaned QEMU per-VM overlays (keeps .vms/_base/)

Run linters (delegates to moon for caching)

Run type checker (delegates to moon for caching)

Run all checks (lint + type-check + test, with caching)

Pre-push gate: lint + type-check + test (single pass)

Run AST-based dead code analysis (delegates to moon for caching)

Update workspace via moon - walks every project topologically (^:update)

Update opencode in the checkout-owned platform boot directory

Optional source build alias; leaves npm-installed 'oc' untouched

Build opencode from source with the package version and latest channel

Update Python dependencies only

Uninstall workspace

List context rules and redeploy plugin

Add rule - make rules-add REGEX="pattern" RULE="instruction"

Delete rule - make rules-delete NUM=3

Update rule - make rules-update NUM=3 REGEX="pattern" RULE="instruction"

List assistant response hooks and redeploy plugin

Add hook - make hooks-add REGEX="pattern" RULE="instruction"

Delete hook - make hooks-delete NUM=3

Update hook - make hooks-update NUM=3 REGEX="pattern" RULE="instruction"

Clean build artifacts

Scaffold quality_exceptions.yaml in every strict-tier repo

Audit every nested repo for CI contract compliance

Show this help

Install all system-level dependencies (Homebrew on macOS + apt packages on Linux + Rust toolchain)

Verify environment (curl + tar for bootstrapping; uv is bootstrapped by install-boot-tools)

Full install: deps + bootstrap binaries + hooks

CI install: deps + bootstrap binaries, no hooks

Build candidate-local bootstrap tools + pinned osv-scanner

Install boot tools + Python pool + .venv deps + gitleaks + osv-scanner + cloc + moon + ansible + node + web deps

Bootstrap uv into $(BOOT_NAME)/bin/ (idempotent)

Bootstrap uv + rust toolchain + Podman into $(BOOT_NAME)/bin/ (idempotent)

uv sync the Python deps (project-level .venv)

Bootstrap the gitleaks binary used by the secret-content scanner

Bootstrap the osv-scanner binary used by the dependency vulnerability scanner

Bootstrap the cloc binary (single-file Perl) used by code-stats

Bootstrap the moon binary (workspace task runner) into $(BOOT_NAME)/bin

Bootstrap ansible + passlib into $(BOOT_NAME)/bin

Bootstrap certbot + dns-cloudflare into $(BOOT_NAME)/bin

Install the workspace CPython pool into $(BOOT_NAME)/python (idempotent)

Bootstrap Node.js + npm into $(BOOT_NAME)/node-env/ (idempotent)

npm ci JS workspace dependencies (repo root: web/ + web-components/ + hitl/web/)

(Re)generate native git hooks (root-owned hooks: run via sudo)

Root-lock config/*.yaml catalogs and regenerate root-owned hooks (root only)

Pre-create agent-owned runtime dirs (.venv, node_modules, egg-info); OWNER=<user> required, root only

Sync .venv deps + reinstall hooks

Run all quality gates (lint + type-check + test)

Runs ruff format and ruff lint with auto-fix on all ci/ modules. Catches style violations, import sorting issues, and unused variables before they reach the remote. Acts as the first stage of the pre-commit quality gate.

Runs mypy strict type checking on all ci/ Python modules. Catches type errors, missing annotations, and incompatible signatures before they can break downstream consumers. Acts as the second stage of the pre-commit quality gate after lint passes.

Run all tests (shell + Python)

Run shell tests only (no moon caching)

Run Python tests only (no moon caching)

Single-pass pre-push gate running ruff lint, mypy, shell unit tests, pytest with unit coverage, and web/ JS quality (eslint + tsc + vitest) in one invocation. Eliminates the previous redundancy where the same tests ran two to three times across separate targets. Fails the push if any lint, type, test, or coverage threshold check does not pass.

Verify generated policy-derived data is current and deterministic

Alias for wiki-dev-start (make start)

Start wiki dev server (Next.js HMR on :4000)

Alias for wiki-dev-start

Stop wiki dev server

Restart wiki dev server (stop + sync content + start; refreshes code-stats if stale)

Restart wiki dev server after regenerating wiki JSON (cloc may take minutes)

Show wiki dev server status

Tail wiki dev server logs

Verify wiki prod Makefile recipes parse under bash -n

Build wiki production image (Podman; refreshes code-stats if stale)

Alias for wiki-prod-build

Start wiki production stack on :8080/:8443

Stop wiki production stack

Restart wiki production stack + verify health

Wiki prod health report (containers, probes, TLS, public URL, settle check)

Show wiki production stack status

Tail wiki production stack logs

Install + enable wiki prod on boot (systemd user + linger)

Disable + remove wiki prod systemd unit

Tail wiki prod systemd unit logs

Start Cloudflare tunnel (requires cloudflare/config.yml + credentials)

Stop Cloudflare tunnel

Restart Cloudflare tunnel

Show Cloudflare tunnel status

Install + enable wiki tunnel on boot (systemd user + linger)

Disable + remove wiki tunnel systemd unit

Tail wiki tunnel logs

Route DNS (WIKI_TUNNEL_HOSTNAME from .env)

Issue Let's Encrypt cert (DNS-01; LETSENCRYPT_STAGING=1 to test)

Renew Let's Encrypt cert and reload nginx

Verify TLS cert expiry and SAN

Install systemd user timer for daily cert renewal

Remove Let's Encrypt renewal timer

Remove build artifacts

Audit workspace repos for CI integration

Deep compliance score for a project (usage: make compliance PROJECT=path)

Recursive compliance audit of all repos in workspace

Strip blocked patterns from git history (dangerous)

Remove pre-commit framework traces (operator-only tool; refuses non-interactive agents)

Verify generated templates are fresh vs config/required_hooks.yaml

Codebase statistics across the workspace via cloc (lines, files, per-repo, per-language)

Generate web/src/data/code-stats.json for wiki Project Catalogue badges

Regenerate code-stats.json only when workspace repos have newer commits

Generate web/src/data/hook-sources.json for wiki Hook EntryPointDialog

Generate web/src/data/script-sources.json for wiki Tooling EntryPointDialog

Generate web/src/data/swallow-detectors.json for wiki Silent Swallow Detectors

Regenerate all wiki JSON data files

Append a list entry: make yaml-add FILE=.. KEY=.. FIELDS="pattern=x;paths=[a]" (ROOT)

Remove matching entries: make yaml-remove FILE=.. KEY=.. FIELDS="pattern=x" (ROOT)

Set a scalar: make yaml-set FILE=.. KEY=.. VALUE=.. (ROOT)

Create a missing top-level scalar key: make yaml-bootstrap FILE=.. KEY=.. VALUE=.. (ROOT)

Print a scalar: make yaml-get FILE=.. KEY=..

Print the file or one list key's block: make yaml-list FILE=.. [KEY=..]

Schema-validate a policy file: make yaml-validate FILE=..

Enforce system-level log ceilings: logrotate maxsize + journald rate limiting (prevents /var/log/syslog filling root disk)

Build git-guard binary (operator: sudo make build-guard)

REMOVED: use install-guard-host-exec

Install git-guard (host-exec; operator: sudo make install-guard-host-exec)

Uninstall git-guard, restore stock git; preserve provision state (operator: sudo make uninstall-guard)

Force rebuild + reinstall git guard and aux artifacts (operator: sudo make reconcile-guard-host-exec)

REMOVED: use check-guard-host-exec

Check host-exec git-guard installation (read-only, runs as agent)

Generate CI integration files for a consumer project (make scaffold-ci CONSUMER=<path> ARGS="--force-precommit --yes")

Build and atomically publish /opt/workspace-ci (root only). Optional REV=<commit>: deploy a committed ancestor of origin/main (reviewed-ancestor rollback).

Show this help

Verify environment

Install podman binaries if not on PATH

Create .venv with podman-compose

Full install: podman + .venv + hooks + images

CI install: deps only, no hooks

Install project dependencies

Install the gateway-owned Bun plugin dependencies from the frozen lockfile

(Re)generate native git hooks (root on locked repos; preserves the +i invariant)

Sync deps + reinstall hooks

Check system dependencies and print install instructions if missing

Check system dependencies (report only, fail if any missing)

Refresh vendored profanity/VADER dictionaries from upstream

Sync model-registry.yaml + provider local flags into ClickHouse model_registry

Run the rejection-language cruncher now (DAYS=N window, REBUILD=1 for clean recompute)

Recalculate historical cost (dry-run unless APPLY=1; LIMIT=N default 100, DAYS=N, SOURCE=list)

Install + enable the daily 00:00 systemd timer for the cruncher

Build container images

Start the gateway stack via systemd, then health checks + init + sync

DANGER: stops gateway with NO restart (kills LLM service for ALL agents). Requires `make gw-stop -- --confirm`

Restart stack via systemd (unit force-recreates all containers from current compose)

Build images, redeploy changed services via systemd, then reconcile

Reconcile routes, schema, and provider catalog without restarting containers

Restart one existing service without recreating it

Recreate one service from the current compose (applies network/config changes); SVC=grafana

Restart Grafana, wait healthy, reload provisioning

Health report: container/endpoint status + one request through the gateway

Show gateway systemd + container status

Show the latest 200 gateway log lines (optional SVC=grafana)

Exec into APISIX container shell

Run full test suite against running stack

Apply pending ClickHouse schema migrations (golang-migrate via compose)

Show ClickHouse schema migration status (golang-migrate version)

Clear a dirty migration state and re-run: make ch-migrate-force V=7

(Re)apply ClickHouse users/grants from .env (idempotent; also runs on fresh volumes)

Enable etcd RBAC: root + least-privilege apisix user (idempotent; dev + prod)

Run the live lockdown verification matrix (tests/e2e/test_security_lockdown.sh)

Trigger provider model sync on the gateway

Install ALL gateway providers into opencode config (auth skipped by default; REQUIRE_AUTH=1 to prompt)

Unified key CLI (ARGS='issue ...', 'list', 'show vgw-xxx', 'map vgw-xxx --pool kimi', 'revoke vgw-xxx', 'pool list')

Issue a new virtual gateway key (use KEY_ID=, TENANT_ID=, USER_ID=, POOL=)

Manage upstream key pools (ARGS='create kimi', 'add kimi k1 sk-...', 'list', 'reset kimi')

List all virtual gateway keys

Revoke a virtual gateway key (KEY_ID=vgw-xxx required)

Lint shell scripts and validate YAML

Lua syntax check and TypeScript plugin contract check

Type-check the gateway-owned OpenCode plugin with Bun

Run gateway-owned OpenCode plugin Bun tests

Run all test stages (excludes live upstream API tests)

Run all tests including live upstream API tests (RUN_LIVE_API_TESTS=1)

Run all quality gates

Pre-push gate: check + E2E if API key available

Install + enable gateway compose on boot (systemd user + linger), then health checks + init + sync

Disable + remove gateway compose systemd unit

Tail gateway systemd unit logs

Build production image localhost/workspace-gateway:0.1.0

Start prod stack on :9081 (etcd, openbao, clickhouse, vector, apisix) + seed routes

DANGER: stops prod gateway with NO restart (kills LLM service for dependents). Requires `make gw-prod-stop -- --confirm`

Stop + start + verify prod stack

Health report: containers, root, provider sync, device flow, 401, routes

Show prod stack status

Tail prod apisix logs

Remove build artifacts

Show this help

Check system dependencies (via CI resolver + config/system-deps.yaml)

Install system-level dependencies (platform-aware via config/system-deps.yaml)

Verify required tooling is present

Bootstrap gitleaks binary to ${WORKSPACE_ROOT}/${BOOT_NAME}/bin

Full install: deps + gitleaks + hooks

CI install: gitleaks + no hooks (CI env already set up)

Regenerate native git hooks from .pre-commit-config.yaml

Sync dependencies + reinstall hooks

Run cargo check (all feature combinations)

Run cargo fmt --check + clippy

Rust has no separate type-check; run cargo check

Run cargo test (all feature combinations; integration gated by euid)

Unit/binary tests only (both feature combinations)

Capability-mode integration tests (non-root)

Root-only integration tests (root)

Run the bats shell test suite (gated in check-push).

Pre-push quality gate: fmt + clippy + check + tests + shell tests + full Podman tiers (Linux).

Full Podman harness: Tier 0 (Darwin) + Tiers 1-3

Podman harness Tiers 0-2 only (skip capability E2E)

Podman host-provision E2E only (phases 0-4, privileged)

Build git-guard binary (delegates to WORKSPACE-CI bootstrap) (ROOT)

Build git-guard + binary-guard once (provision phase 5)

Build + install guard + optional lock/auditd

REMOVED - use install-guard-host-exec

Install git-guard (host-exec class; requires root)

Uninstall git-guard, restore stock git; preserve provision state (requires root)

Force rebuild + reinstall git guard and aux artifacts (requires root)

REMOVED - use check-guard-host-exec

Check host-exec git-guard installation status

Install shell guard at /bin/bash + /bin/sh (ROOT)

Uninstall shell guard, restore stock bash/sh (ROOT)

Read-only shell guard health check (modes, caps, divert, +i, hash)

Build release binary (default + root-only) (ROOT)

Build the generic binary guard (one binary, full GTFOBins table) (ROOT)

Build the shell guard binary (release) (ROOT)

Clean build artifacts

Run cargo clippy

Run the WORKSPACE-CI compliance audit on this repo

Fetch GTFOBins + konstruktoid, scan live SUID/CAP, write res/ baselines + refresh .gitleaksignore

Regenerate res/ baselines in Linux container (do not sync on Darwin for commit)

Regenerate .gitleaksignore fingerprints for docs/references/ cached content (skips when unchanged)

Re-fetch sources and emit SHA-256 manifest of canonical references

Compare live SUID/CAP surface against res/ baselines; detail dump only on CRITICAL; exit 1 on CRITICAL

Contain-via-guard every SUID binary per res/binary-lock.yaml (ROOT)

Rollback contain-via-guard: restore .real -> original SUID path (ROOT)

Read-only combined guard health check (non-root safe)

Canonical guard operator intents (see docs/OPERATOR.md)

Mount WS-BACKUP for agent (ROOT)

Unmount WS-BACKUP (ROOT)

Build workspace-yaml-edit release binary (ROOT)

Install workspace-yaml-edit to /usr/bin (ROOT)

Append a list entry: make yaml-add FILE=.. KEY=.. FIELDS="hook=x;paths=[a]" (ROOT)

Remove matching entries: make yaml-remove FILE=.. KEY=.. FIELDS="hook=x" (ROOT)

Set a scalar: make yaml-set FILE=.. KEY=.. VALUE=.. (ROOT)

Create a top-level scalar: make yaml-bootstrap FILE=.. KEY=.. VALUE=.. (ROOT)

Remove fields by path: make yaml-unset FILE=.. KEY='hooks[].safety' (ROOT)

Remove exact comments: make yaml-remove-comment FILE=.. VALUE='text' (ROOT)

Delete one reviewed file: make yaml-delete FILE=.. EXPECT_SHA256=.. (ROOT)

Print a scalar: make yaml-get FILE=.. KEY=..

Print the file or one list key's block: make yaml-list FILE=.. [KEY=..]

Schema-validate a policy file: make yaml-validate FILE=..

Syntax + schema + splice-shape preflight: make yaml-check FILE=..

Canonicalize indentless block sequences (ROOT): make yaml-format FILE=..

Full host bootstrap: admin, fleet sudo audit, identities, guard stack (ROOT)

Alias: provision-host (recommended fleet install)

Read-only host provision state report (ROOT)

Provision per-user gitconfig + SSH keys from config/home-lock-users.yaml (ROOT)

Lock the absolute_file_paths entries in config/shared_locked_paths.yaml (ROOT) if [ "$$(id -u)" != "0" ]; then echo "ERROR: install-home-lock needs root: sudo make install-home-lock" >&2; exit 1; fi

Rollback home lock: restore original owner/mode per /usr/lib/workspace-guard/home-lock-state.yaml (ROOT)

Compare live home-lock surface against /usr/lib/workspace-guard/home-lock-state.yaml; detail dump only on CRITICAL; exit 1 on CRITICAL

Install auditd rules + generated per-binary execve watches (ROOT)

Install sandbox profile + systemd unit (ROOT)

Dry-run: report which sandbox profile auto-selection would pick on this host