Skip to content
workspaceguardrails
  • Home
  • Open Source[4]
  • System Policies[0]
  • Git Hooks[21]
  • Anti-Patterns[293]
  • Hook Configs[20]
  • Sandbox Configs[27]
  • Tools & Scripts[14]
  • AI Governance[20]
  • LLM Gateway
  • Static Analysis
  • Playground
  • Integration Guide
  1. Home
  2. Open Source
    The Digital and AI Workspace Guardrails Platform2026 ◆ Independent AI Labs
    Skip to content
    workspaceguardrails
    • Home
    • Open Source[4]
    • System Policies[0]
    • Git Hooks[21]
    • Anti-Patterns[293]
    • Hook Configs[20]
    • Sandbox Configs[27]
    • Tools & Scripts[14]
    • AI Governance[20]
    • LLM Gateway
    • Static Analysis
    • Playground
    • Integration Guide
    1. Home
    2. Open Source
      The Digital and AI Workspace Guardrails Platform2026 ◆ Independent AI Labs

      Browse Projects

      Each card summarizes a workspace repo. Open the project title for the full README, or Makefile on the card for targets and recipes.

      4 of 4 projects

      WORKSPACE-VM

      Sovereign Digital Workspace Stack

      A federated repository for developing and running web services and AI agents on infrastructure you control.

      The design centers on data sovereignty, system immutability, and workspace-wide compliance: agents run inside guarded sandboxes, quality gates apply before code ships, and sensitive services stay on your machines rather than a vendor cloud.

      Python 57.1%Markdown 18.4%Bourne Shell 9.7%YAML 4.9%Bourne Again Shell 4.7%OTHER 2.7%PowerShell 1.5%make 1%

      Share feedback

      You voted thumbs down

      WORKSPACE-VM Makefile

      Help

      help.PHONY

      Show this help message

      Init & System Dependencies

      init-check.PHONY

      Check system dependencies (via CI resolver)

      init.PHONY

      Install system dependencies (platform-aware: brew on macOS, two-phase sudo on Linux)

      init-root.PHONY

      (ROOT) Privileged bootstrap: deploy-ci + guard + hook/exemption locks + syslog limits

      Core Bootstrap

      core.PHONY

      Bootstrap CI tools (uv + ansible + node) + VM-specific tools (python + git-xet + playwright)

      Installation

      ci-install-deps.PHONY

      Install CI project deps (boot tools, Python venv, gitleaks) - delegates to CI

      Depends on:ensure-repos
      install.PHONY

      Interactive TUI to select and install components

      Depends on:init-check sync-package
      install-qemu.PHONY

      Install QEMU + firmware into platform boot directory (GPL-2.0)

      llama-setup.PHONY

      Interactive TUI for llama/hardware lifecycle

      Depends on:init-check sync-package
      llama-setup-ci.PHONY

      Non-interactive llama/hardware setup (llama-setup-defaults.yaml)

      Depends on:init-check sync-package
      install-ci.PHONY

      Non-interactive component install (uses install-defaults.yaml)

      Depends on:init-check sync-package

      WORKSPACE-GUARD

      build-guard.PHONY

      Build git-guard binary (operator: sudo make build-guard) - delegates to CI

      Depends on:ensure-repos
      install-guard.PHONY

      Alias for install-guard-host-exec

      Depends on:install-guard-host-exec
      refresh-guard.PHONY

      Alias for guard-refresh (workspace root)

      install-guard-host-exec reconcile-guard-host-exec check-guard-host-exec uninstall-guard purge-guard-state install-host-stack-phase5 guard-up guard-refresh guard-check guard-down guard-reset

      System Hardening

      enforce-syslog-limits.PHONY

      Enforce system-level log ceilings (needs sudo) - delegates to CI

      Repos

      ensure-repos.PHONY

      Clone every workspace repo per moon.yml metadata

      Package Sync

      sync-package.PHONY

      Sync package dependencies via uv

      Depends on:core ensure-repos
      install-package.PHONY

      Lightweight uv sync (dev extras only, no boot/repos)

      Configuration

      setup-config.PHONY

      Setup configuration files

      Depends on:setup-automation
      setup-automation.PHONY

      Setup automation configuration

      Extensions

      register-extensions.PHONY

      Register extensions in .boot-linux/bin

      Shell

      install-shell.PHONY

      Install AMI shell environment to ~/.bashrc

      uninstall-shell.PHONY

      Remove AMI shell environment from ~/.bashrc

      VM Management

      vm.PHONY

      Build and start a VM from config file

      provision-host install-host-stack provision-host-preflight
      %
      Depends on::
      vm-start.PHONY

      podman start <id> + write PID

      vm-stop.PHONY

      podman stop <id> + remove PID

      vm-resume.PHONY

      podman start <id> (alias)

      vm-delete.PHONY

      podman rm <id> + optional volume purge

      vm-kill.PHONY

      read .vms/<id>/pid and send SIGKILL directly

      vm-shell.PHONY

      podman exec -it <id> bash

      vm-exec.PHONY

      podman exec <id> -- <cmd>

      vm-logs.PHONY

      podman logs <id>

      vm-list.PHONY

      podman ps -a --filter label=workspace.type=vm

      vm-status.PHONY

      podman inspect + stats for <id>

      vm-rebuild.PHONY

      re-build + restart <id> from stored vm.yaml

      vm-sync.PHONY

      file sync per config.sync rules

      vm-config.PHONY

      print the vm.yaml used to create <id>

      vm-cert.PHONY

      generate or print client cert for <id>

      Git Hooks

      install-hooks.PHONY

      Install native git hooks (run via sudo for root-owned hooks; no unseal/lock cycle exists)

      install-deps-recursive.PHONY

      Install deps in every nested repo (skip CI, handled by ci-install-deps)

      Depends on:ensure-repos
      install-hooks-recursive.PHONY

      Install hooks in workspace + every nested .git under projects/ (run via sudo for root-owned hooks)

      check-hooks.PHONY

      Preview generated hooks (dry-run)

      Depends on:ensure-repos

      Quality & Test

      test.PHONY

      Run tests (delegates to moon for caching)

      test-e2e.PHONY

      Run end-to-end VM integration tests

      test-e2e-qemu.PHONY

      QEMU poc + guard E2E (set TEST_QEMU_FULL=1 to include full-ci)

      test-e2e-qemu-full.PHONY

      QEMU poc + full-ci + guard (authoritative, slow)

      test-vm-guard.PHONY

      Authoritative WORKSPACE-GUARD gate in QEMU guest

      test-authoritative.PHONY

      Pre-release QEMU + guard checklist

      Depends on:test-e2e-qemu-full
      clean-qemu-e2e.PHONY

      Remove orphaned QEMU per-VM overlays (keeps .vms/_base/)

      lint.PHONY

      Run linters (delegates to moon for caching)

      type-check.PHONY

      Run type checker (delegates to moon for caching)

      check.PHONY

      Run all checks (lint + type-check + test, with caching)

      check-push.PHONY

      Pre-push gate: lint + type-check + test (single pass)

      dead-code.PHONY

      Run AST-based dead code analysis (delegates to moon for caching)

      Update & Maintenance

      update.PHONY

      Update workspace via moon - walks every project topologically (^:update)

      update-oc.PHONY

      Update opencode to latest version via npm (operator: sudo make update-oc; installs into root-locked .boot-linux)

      update-deps.PHONY

      Update Python dependencies only

      uninstall.PHONY

      Uninstall workspace

      Context Rules & Assistant Hooks

      rules.PHONY

      List context rules and redeploy plugin

      rules-add.PHONY

      Add rule - make rules-add REGEX="pattern" RULE="instruction"

      rules-delete.PHONY

      Delete rule - make rules-delete NUM=3

      rules-update.PHONY

      Update rule - make rules-update NUM=3 REGEX="pattern" RULE="instruction"

      hooks.PHONY

      List assistant response hooks and redeploy plugin

      hooks-add.PHONY

      Add hook - make hooks-add REGEX="pattern" RULE="instruction"

      hooks-delete.PHONY

      Delete hook - make hooks-delete NUM=3

      hooks-update.PHONY

      Update hook - make hooks-update NUM=3 REGEX="pattern" RULE="instruction"

      Utility

      clean.PHONY

      Clean build artifacts

      scaffold-recursive.PHONY

      Scaffold quality_exceptions.yaml in every strict-tier repo

      Depends on:ensure-repos
      check-compliance-recursive.PHONY

      Audit every nested repo for CI contract compliance

      Depends on:ensure-repos
      GitHub
      WORKSPACE-CI

      Practical Guardrails for Coding Agents

      AI coding agents ship code fast and cut every corner doing it: skipped tests, ignored lint failures, --no-verify to bypass hooks, amended history to hide the mess.

      WORKSPACE-CI generates native git hooks from a single config file and hard-enforces lint, tests, secrets, and coverage at commit and push time.

      TypeScript 27.8%Markdown 18.1%Bourne Shell 13.1%Python 12.7%Bourne Again Shell 6.1%JSON 5.8%YAML 5.7%CSS 5.7%JavaScript 1.9%make 1.1%Rust 1%OTHER 1%

      Share feedback

      You voted thumbs down

      WORKSPACE-CI Makefile

      Help

      help.PHONY

      Show this help

      Setup

      init.PHONY

      Install all system-level dependencies (Homebrew on macOS + apt packages on Linux + Rust toolchain)

      preflight.PHONY

      Verify environment (curl + tar for bootstrapping; uv is bootstrapped by install-boot-tools)

      install.PHONY

      Full install: deps + bootstrap binaries + hooks

      Depends on:preflight install-deps
      install-ci.PHONY

      CI install: deps + bootstrap binaries, no hooks

      Depends on:preflight install-deps
      install-deps.PHONY

      Install boot tools + python pool + .venv deps + gitleaks + osv-scanner + cloc + moon + ansible + node + web deps

      Depends on:install-boot-tools install-pythons install-python-deps install-gitleaks install-osv-scanner install-cloc install-moon install-ansible install-node install-web-deps
      install-uv.PHONY

      Bootstrap uv into $(BOOT_NAME)/bin/ (idempotent)

      install-boot-tools.PHONY

      Bootstrap uv + rust toolchain into $(BOOT_NAME)/bin/ (idempotent)

      Depends on:install-uv
      install-python-deps.PHONY

      uv sync the Python deps (project-level .venv)

      Depends on:install-uv
      install-gitleaks.PHONY

      Bootstrap the gitleaks binary used by the secret-content scanner

      install-osv-scanner.PHONY

      Bootstrap the osv-scanner binary used by the dependency vulnerability scanner

      install-cloc.PHONY

      Bootstrap the cloc binary (single-file Perl) used by code-stats

      install-moon.PHONY

      Bootstrap the moon binary (workspace task runner) into $(BOOT_NAME)/bin

      install-ansible.PHONY

      Bootstrap ansible + passlib into $(BOOT_NAME)/bin

      Depends on:install-uv
      install-certbot.PHONY

      Bootstrap certbot + dns-cloudflare into $(BOOT_NAME)/bin

      Depends on:install-uv
      install-pythons.PHONY

      Install the workspace CPython pool into $(BOOT_NAME)/python (idempotent)

      Depends on:install-uv
      install-node.PHONY

      Bootstrap Node.js + npm into $(BOOT_NAME)/node-env/ (idempotent)

      install-web-deps.PHONY

      npm ci JS workspace dependencies (repo root: web/ + web-components/ + hitl/web/)

      Depends on:install-node
      install-hooks.PHONY

      (Re)generate native git hooks (root-owned hooks: run via sudo)

      lock-repo.PHONY

      Root-lock config/*.yaml catalogs and regenerate root-owned hooks (root only)

      runtime-dirs.PHONY

      Pre-create agent-owned runtime dirs (.venv, node_modules, egg-info); OWNER=<user> required, root only

      sync.PHONY

      Sync .venv deps + reinstall hooks

      Quality Gates

      check.PHONY

      Run all quality gates (lint + type-check + test)

      check-templates.PHONY

      Verify generated templates are fresh vs config/required_hooks.yaml

      lint.PHONY

      Runs ruff format and ruff lint with auto-fix on all ci/ modules. Catches style violations, import sorting issues, and unused variables before they reach the remote. Acts as the first stage of the pre-commit quality gate.

      type-check.PHONY

      Runs mypy strict type checking on all ci/ Python modules. Catches type errors, missing annotations, and incompatible signatures before they can break downstream consumers. Acts as the second stage of the pre-commit quality gate after lint passes.

      test.PHONY

      Run all tests (shell + Python)

      Selective Tests

      test-shell.PHONY

      Run shell tests only (no moon caching)

      test-python.PHONY

      Run Python tests only (no moon caching)

      Pre-push Quality Gate

      check-push.PHONY

      Single-pass pre-push gate running ruff lint, mypy, shell unit tests, pytest with per-suite coverage, and web/ JS quality (eslint + tsc + vitest) in one invocation. Eliminates the previous redundancy where the same tests ran two to three times across separate targets. Fails the push if any lint, type, test, or coverage threshold check does not pass.

      Wiki Dev Server

      start.PHONY

      Alias for wiki-dev-start (make start)

      Depends on:wiki-dev-start
      wiki-dev-start.PHONY

      Start wiki dev server (Next.js HMR on :4000)

      Depends on:extract-wiki-data
      wiki-dev.PHONY

      Alias for wiki-dev-start

      Depends on:wiki-dev-start
      wiki-dev-stop.PHONY

      Stop wiki dev server

      wiki-dev-restart.PHONY

      Restart wiki dev server (stop + sync content + start; refreshes code-stats if stale)

      wiki-dev-restart-refresh.PHONY

      Restart wiki dev server after regenerating wiki JSON (cloc may take minutes)

      wiki-dev-status.PHONY

      Show wiki dev server status

      wiki-dev-logs.PHONY

      Tail wiki dev server logs

      Wiki Production

      wiki-prod-check-syntax.PHONY

      Verify wiki prod Makefile recipes parse under bash -n

      wiki-prod-build.PHONY

      Build wiki production image (Podman; refreshes code-stats if stale)

      wiki-build-prod

      Alias for wiki-prod-build

      Depends on:wiki-prod-build
      wiki-prod-start.PHONY

      Start wiki production stack on :8080/:8443

      wiki-prod-stop.PHONY

      Stop wiki production stack

      wiki-prod-redeploy.PHONY

      Restart wiki production stack + verify health

      wiki-prod-verify.PHONY

      Wiki prod health report (containers, probes, TLS, public URL, settle check)

      wiki-prod-status.PHONY

      Show wiki production stack status

      wiki-prod-logs.PHONY

      Tail wiki production stack logs

      wiki-prod-deploy.PHONY

      Install + enable wiki prod on boot (systemd user + linger)

      wiki-prod-undeploy.PHONY

      Disable + remove wiki prod systemd unit

      wiki-prod-systemd-logs.PHONY

      Tail wiki prod systemd unit logs

      Wiki Cloudflare Tunnel

      wiki-tunnel-start.PHONY

      Start Cloudflare tunnel (requires cloudflare/config.yml + credentials)

      wiki-tunnel-stop.PHONY

      Stop Cloudflare tunnel

      wiki-tunnel-restart.PHONY

      Restart Cloudflare tunnel

      wiki-tunnel-status.PHONY

      Show Cloudflare tunnel status

      wiki-tunnel-deploy.PHONY

      Install + enable wiki tunnel on boot (systemd user + linger)

      wiki-tunnel-undeploy.PHONY

      Disable + remove wiki tunnel systemd unit

      wiki-tunnel-logs.PHONY

      Tail wiki tunnel logs

      wiki-tunnel-route-dns.PHONY

      Route DNS (WIKI_TUNNEL_HOSTNAME from .env)

      Wiki TLS

      wiki-tls-issue.PHONY

      Issue Let's Encrypt cert (DNS-01; LETSENCRYPT_STAGING=1 to test)

      wiki-tls-renew.PHONY

      Renew Let's Encrypt cert and reload nginx

      wiki-tls-verify.PHONY

      Verify TLS cert expiry and SAN

      wiki-tls-deploy.PHONY

      Install systemd user timer for daily cert renewal

      wiki-tls-undeploy.PHONY

      Remove Let's Encrypt renewal timer

      Cleanup

      clean.PHONY

      Remove build artifacts

      clean-precommit.PHONY

      Remove pre-commit framework traces

      Workspace Tools

      audit.PHONY

      Audit workspace repos for CI integration

      compliance.PHONY

      Deep compliance score for a project (usage: make compliance PROJECT=path)

      compliance-all.PHONY

      Recursive compliance audit of all repos in workspace

      rewrite-history.PHONY

      Strip blocked patterns from git history (dangerous)

      code-stats.PHONY

      Codebase statistics across the workspace via cloc (lines, files, per-repo, per-language)

      extract-code-stats.PHONY

      Generate web/src/data/code-stats.json for wiki Project Catalogue badges

      extract-code-stats-if-stale.PHONY

      Regenerate code-stats.json only when workspace repos have newer commits

      extract-hook-sources.PHONY

      Generate web/src/data/hook-sources.json for wiki Hook EntryPointDialog

      extract-script-sources.PHONY

      Generate web/src/data/script-sources.json for wiki Tooling EntryPointDialog

      extract-swallow-source.PHONY

      Generate web/src/data/swallow-detectors.json for wiki Silent Swallow Detectors

      extract-wiki-data.PHONY

      Regenerate all wiki JSON data files

      Depends on:extract-code-stats extract-hook-sources extract-script-sources extract-swallow-source
      scaffold-ci.PHONY

      Generate CI integration files for a consumer project

      yaml-add.PHONY

      Append a list entry: make yaml-add FILE=.. KEY=.. FIELDS="pattern=x;paths=[a]" (ROOT)

      yaml-remove.PHONY

      Remove matching entries: make yaml-remove FILE=.. KEY=.. FIELDS="pattern=x" (ROOT)

      yaml-set.PHONY

      Set a scalar: make yaml-set FILE=.. KEY=.. VALUE=.. (ROOT)

      yaml-get.PHONY

      Print a scalar: make yaml-get FILE=.. KEY=..

      yaml-list.PHONY

      Print the file or one list key's block: make yaml-list FILE=.. [KEY=..]

      yaml-validate.PHONY

      Schema-validate a policy file: make yaml-validate FILE=..

      System Hardening

      enforce-syslog-limits.PHONY

      Enforce system-level log ceilings: logrotate maxsize + journald rate limiting (prevents /var/log/syslog filling root disk)

      WORKSPACE-GUARD

      build-guard.PHONY

      Build git-guard binary (operator: sudo --preserve-env=HOME,SSH_AUTH_SOCK make build-guard)

      install-guard.PHONY

      REMOVED: use install-guard-host-exec

      install-guard-host-exec.PHONY

      Install git-guard (host-exec; operator: sudo --preserve-env=HOME,SSH_AUTH_SOCK make install-guard-host-exec)

      Depends on:build-guard
      uninstall-guard.PHONY

      Uninstall git-guard, restore stock git; preserve provision state (operator: sudo make uninstall-guard)

      purge-guard-state.PHONY

      Destroy all guard state (requires GUARD_PURGE_CONFIRM=1)

      reconcile-guard-host-exec.PHONY

      Force rebuild + reinstall git guard and aux artifacts (operator: sudo --preserve-env=HOME,SSH_AUTH_SOCK make reconcile-guard-host-exec)

      Depends on:build-guard
      check-guard.PHONY

      REMOVED: use check-guard-host-exec

      check-guard-host-exec.PHONY

      Check host-exec git-guard installation (read-only, runs as agent)

      deploy-ci

      Promote WORKSPACE-CI to locked projects/CI (operator: sudo --preserve-env=HOME,SSH_AUTH_SOCK make deploy-ci)

      GitHub
      WORKSPACE-GATEWAY

      Multi-tenant LLM Gateway on APISIX

      Apache APISIX gateway for shared LLM traffic with virtual key sharding, spend limits, PII redaction, and built-in safety and moderation pipelines.

      Cloud backends run through ai-proxy or relay configuration, including OpenAI, Anthropic, Gemini, Bedrock, and others, with usage, cost, and health tracked in ClickHouse and Grafana.

      Markdown 29.5%Bourne Shell 28.4%Lua 19.6%JSON 8.8%YAML 6.1%Jinja Template 2.2%SQL 1.7%make 1.3%JavaScript 1.3%OTHER 1.1%

      Share feedback

      You voted thumbs down

      WORKSPACE-GATEWAY Makefile

      Help

      help.PHONY

      Show this help

      Setup / Install

      preflight.PHONY

      Verify environment

      bootstrap-podman.PHONY

      Install podman binaries if not on PATH

      setup.PHONY

      Create .venv with podman-compose

      Depends on:bootstrap-podman
      install.PHONY

      Full install: podman + .venv + hooks + images

      Depends on:setup install-hooks
      install-ci.PHONY

      CI install: deps only, no hooks

      Depends on:install-deps
      install-deps.PHONY

      Install project dependencies

      Depends on:setup
      install-hooks.PHONY

      (Re)generate native git hooks

      sync.PHONY

      Sync deps + reinstall hooks

      Depends on:install-deps install-hooks
      init.PHONY

      Check system dependencies and print install instructions if missing

      init-check.PHONY

      Check system dependencies (report only, fail if any missing)

      Dev Lifecycle

      dev-start.PHONY

      Start the gateway stack (build + up + health checks)

      Depends on:_compose-build _compose-up
      dev-stop.PHONY

      Stop the gateway stack (keep volumes)

      Depends on:_compose-down
      dev-restart.PHONY

      Restart the gateway stack (stop + start)

      Depends on:dev-stop dev-start
      dev-rebuild.PHONY

      Rebuild images and restart

      Depends on:dev-stop _compose-build _compose-up
      dev-restart-service.PHONY

      Restart a single service (SVC=grafana|clickhouse|apisix|vector|openbao|prometheus)

      dev-restart-grafana.PHONY

      Recreate Grafana (pulls new image from compose), wait healthy, reload provisioning

      dev-logs.PHONY

      Tail container logs (Ctrl-C to stop)

      dev-status.PHONY

      Show running containers and health status

      dev-clean.PHONY

      Stop stack and remove all volumes (data loss!)

      Depends on:_compose-clean
      dev-shell.PHONY

      Exec into APISIX container shell

      dev-test.PHONY

      Run full test suite against running stack

      dev-sanity.PHONY

      Quick sanity check: one request through the gateway

      ClickHouse Migrations

      ch-migrate.PHONY

      Apply pending ClickHouse schema migrations (golang-migrate via compose)

      ch-migrate-status.PHONY

      Show ClickHouse schema migration status (golang-migrate version)

      Model Sync

      sync-models

      Trigger provider model sync on the gateway

      Key Management

      issue-key.PHONY

      Issue a new virtual gateway key (use KEY_ID=, TENANT_ID=, USER_ID=, POOL=)

      pool-key.PHONY

      Manage upstream key pools (ARGS='create kimi', 'add kimi k1 sk-...', 'list', 'reset kimi')

      list-keys.PHONY

      List all virtual gateway keys

      revoke-key.PHONY

      Revoke a virtual gateway key (KEY_ID=vgw-xxx required)

      Quality Gates

      lint.PHONY

      Lint shell scripts and validate YAML

      type-check.PHONY

      Lua syntax check via resty in Podman

      test.PHONY

      Run all test stages (excludes live upstream API tests)

      test-live.PHONY

      Run all tests including live upstream API tests (RUN_LIVE_API_TESTS=1)

      check.PHONY

      Run all quality gates

      Depends on:lint type-check test
      check-push.PHONY

      Pre-push gate: check + E2E if API key available

      Depends on:check

      Boot Persistence

      gateway-deploy.PHONY

      Install + enable gateway compose on boot (systemd user + linger)

      gateway-start.PHONY

      Start gateway compose via systemd

      gateway-stop.PHONY

      Stop gateway compose via systemd

      gateway-restart.PHONY

      Restart gateway compose via systemd

      gateway-status.PHONY

      Show gateway systemd + container status

      gateway-undeploy.PHONY

      Disable + remove gateway compose systemd unit

      gateway-logs.PHONY

      Tail gateway compose logs

      Cleanup

      clean.PHONY

      Remove build artifacts

      clean-precommit.PHONY

      Remove pre-commit framework traces

      GitHub
      WORKSPACE-GUARD

      WORKSPACE-GUARD

      WORKSPACE-GUARD wraps the most abusable surfaces of an agent dev machine in compiled Rust guards, vetting every git invocation for destructive history and policy bypass while containing GTFOBins-class SUID and file-capability binaries behind per-binary policy wrappers.

      It then root-locks .git/ trees and fleet identity files so agents cannot tamper with enforcement, and keeps a continuous record of the result through GTFOBins baselines, drift checks, and auditd/AIDE rules.

      HTML 46.2%Rust 19.2%Markdown 13.8%Bourne Again Shell 11%Bourne Shell 4.6%YAML 3.6%OTHER 1.6%

      Share feedback

      You voted thumbs down

      WORKSPACE-GUARD Makefile

      Help

      help.PHONY

      Show this help

      Init & Preflight

      init-check.PHONY

      Check system dependencies (via CI resolver + config/system-deps.yaml)

      init.PHONY

      Install system-level dependencies (platform-aware via config/system-deps.yaml)

      preflight.PHONY

      Verify required tooling is present

      Installation

      install-gitleaks.PHONY

      Bootstrap gitleaks binary to ${WORKSPACE_ROOT}/${BOOT_NAME}/bin

      install.PHONY

      Full install: deps + gitleaks + hooks

      Depends on:preflight install-gitleaks install-hooks
      install-ci.PHONY

      CI install: gitleaks + no hooks (CI env already set up)

      Depends on:preflight install-gitleaks
      install-hooks.PHONY

      Regenerate native git hooks from .pre-commit-config.yaml

      sync.PHONY

      Sync dependencies + reinstall hooks

      Quality Gates

      check.PHONY

      Run cargo check (all feature combinations)

      lint.PHONY

      Run cargo fmt --check + clippy

      type-check.PHONY

      Rust has no separate type-check; run cargo check

      test.PHONY

      Run cargo test (all feature combinations; integration gated by euid)

      test-unit.PHONY

      Unit/binary tests only (both feature combinations)

      test-integration-cap.PHONY

      Capability-mode integration tests (non-root)

      test-integration-root.PHONY

      Root-only integration tests (root)

      test-shell.PHONY

      Run the bats shell test suite (gated in check-push).

      Pre-push Quality Gate

      check-push.PHONY

      Pre-push quality gate: fmt + clippy + check + tests + shell tests + host-provision Podman E2E (Linux).

      Podman Test Harness

      test-podman.PHONY

      Full Podman harness: Tier 0 (Darwin) + Tiers 1-3

      Depends on:init-check
      test-podman-quick.PHONY

      Podman harness Tiers 0-2 only (skip capability E2E)

      Depends on:init-check
      test-podman-provision.PHONY

      Podman host-provision E2E only (phases 0-4, privileged)

      Depends on:init-check
      test-qemu-guest.PHONY

      Authoritative E2E inside QEMU guest only (requires root in guest)

      Git Guard

      build-guard.PHONY

      Build git-guard binary (delegates to WORKSPACE-CI bootstrap) (ROOT)

      build-host-stack

      Build git-guard + binary-guard once (provision phase 5)

      Depends on:build-guard build-binary-guard
      install-guard-stack.PHONY

      Build + install guard + optional lock/auditd

      Depends on:_install-guard-stack-build
      install-guard.PHONY

      REMOVED - use install-guard-host-exec

      install-guard-host-exec.PHONY

      Install git-guard (host-exec class; requires root)

      Depends on:$(_INSTALL_GUARD_DEPS)
      uninstall-guard.PHONY

      Uninstall git-guard, restore stock git; preserve provision state (requires root)

      purge-guard-state.PHONY

      Destroy all /usr/lib/workspace-guard state (requires GUARD_PURGE_CONFIRM=1)

      reconcile-guard-host-exec.PHONY

      Force rebuild + reinstall git guard and aux artifacts (requires root)

      Depends on:build-guard
      check-guard.PHONY

      REMOVED - use check-guard-host-exec

      check-guard-host-exec.PHONY

      Check host-exec git-guard installation status

      install-shell-guard.PHONY

      Install shell guard at /bin/bash + /bin/sh (ROOT)

      uninstall-shell-guard.PHONY

      Uninstall shell guard, restore stock bash/sh (ROOT)

      shell-guard-check.PHONY

      Read-only shell guard health check (modes, caps, divert, +i, hash)

      Build

      build.PHONY

      Build release binary (default + root-only) (ROOT)

      build-binary-guard.PHONY

      Build the generic binary guard (one binary, full GTFOBins table) (ROOT)

      build-shell-guard.PHONY

      Build the shell guard binary (release)

      Cleanup & Compliance

      clean.PHONY

      Clean build artifacts

      clippy.PHONY

      Run cargo clippy

      compliance.PHONY

      Run the WORKSPACE-CI compliance audit on this repo

      Binary Lockdown & Sandbox

      sync-gtfobins.PHONY

      Fetch GTFOBins + konstruktoid, scan live SUID/CAP, write res/ baselines + refresh .gitleaksignore

      sync-gtfobins-linux.PHONY

      Regenerate res/ baselines in Linux container (do not sync on Darwin for commit)

      gitleaks-ignore-regen.PHONY

      Regenerate .gitleaksignore fingerprints for docs/references/ cached content (skips when unchanged)

      sync-gtfobins-verify.PHONY

      Re-fetch sources and emit SHA-256 manifest of canonical references

      drift-check.PHONY

      Compare live SUID/CAP surface against res/ baselines; detail dump only on CRITICAL; exit 1 on CRITICAL

      install-lock.PHONY

      Contain-via-guard every SUID binary per res/binary-lock.yaml (ROOT)

      Depends on:$(_INSTALL_LOCK_DEPS)
      uninstall-lock.PHONY

      Rollback contain-via-guard: restore .real -> original SUID path (ROOT)

      guard-%.PHONY

      Canonical guard operator intents (see docs/OPERATOR.md)

      YAML Policy Edit (sudo-gated secure YAML editor; SPEC-YAML-EDIT)

      build-yaml-edit.PHONY

      Build workspace-yaml-edit release binary (ROOT)

      install-yaml-edit.PHONY

      Install workspace-yaml-edit to /usr/bin (ROOT)

      Depends on:build-yaml-edit
      yaml-add.PHONY

      Append a list entry: make yaml-add FILE=.. KEY=.. FIELDS="hook=x;paths=[a]" (ROOT)

      yaml-remove.PHONY

      Remove matching entries: make yaml-remove FILE=.. KEY=.. FIELDS="hook=x" (ROOT)

      yaml-set.PHONY

      Set a scalar: make yaml-set FILE=.. KEY=.. VALUE=.. (ROOT)

      yaml-get.PHONY

      Print a scalar: make yaml-get FILE=.. KEY=..

      yaml-list.PHONY

      Print the file or one list key's block: make yaml-list FILE=.. [KEY=..]

      yaml-validate.PHONY

      Schema-validate a policy file: make yaml-validate FILE=..

      Host Provision

      provision-host.PHONY

      Full host bootstrap: admin, fleet sudo audit, identities, guard stack (ROOT)

      install-host-stack.PHONY

      Alias: provision-host (recommended fleet install)

      Depends on:provision-host
      provision-host-preflight.PHONY

      Read-only host provision state report (ROOT)

      provision-git-identities.PHONY

      Provision per-user gitconfig + SSH keys from config/home-lock-users.yaml (ROOT)

      install-home-lock.PHONY

      Lock the absolute_file_paths entries in config/shared_locked_paths.yaml (ROOT) if [ "$$(id -u)" != "0" ]; then echo "ERROR: install-home-lock needs root: sudo make install-home-lock" >&2; exit 1; fi

      uninstall-home-lock.PHONY

      Rollback home lock: restore original owner/mode per /usr/lib/workspace-guard/home-lock-state.yaml (ROOT)

      home-drift-check.PHONY

      Compare live home-lock surface against /usr/lib/workspace-guard/home-lock-state.yaml; detail dump only on CRITICAL; exit 1 on CRITICAL

      install-auditd.PHONY

      Install auditd rules + generated per-binary execve watches (ROOT)

      install-sandbox.PHONY

      Install sandbox profile + systemd unit (ROOT)

      sandbox-check.PHONY

      Dry-run: report which sandbox profile auto-selection would pick on this host

      GitHub