Makefile

# SPDX-License-Identifier: AGPL-3.0-or-later
# Copyright (C) 2024-2026 Jason Ricca

# CambiOS Makefile - Build kernel and Limine bootable ISO
#
# Usage:
#   make all     - Build kernel + ISO
#   make run     - Build + run in QEMU (BIOS)
#   make run-uefi - Build + run in QEMU (UEFI)
#   make clean   - Remove build artifacts
#   make test    - Run unit tests
#
# Signing modes:
#   make run                        # YubiKey signing (default, requires CAMBIO_SIGN_PIN)
#   make run SIGN_MODE=seed         # Seed-based signing (CI/testing)
#   CAMBIO_SIGN_PIN=123456 make run # YubiKey with PIN via env var

KERNEL := target/x86_64-unknown-none/release/cambios_microkernel
ISO := cambios.iso
LIMINE_DIR := $(HOME)/.cache/cambios/limine
LIMINE_BRANCH := v8.x-binary
LIMINE_REPO := https://github.com/limine-bootloader/limine.git

# User-space ELF binaries (x86_64)
USER_ELF := user/hello.elf
USER_SRC := user/hello.S
USER_LD  := user/user.ld
FS_SERVICE_DIR := user/fs-service
FS_SERVICE_ELF := $(FS_SERVICE_DIR)/target/x86_64-unknown-none/release/cambios-fs-service
KS_SERVICE_DIR := user/key-store-service
KS_SERVICE_ELF := $(KS_SERVICE_DIR)/target/x86_64-unknown-none/release/cambios-key-store-service
NET_DRIVER_DIR := user/virtio-net
NET_DRIVER_ELF := $(NET_DRIVER_DIR)/target/x86_64-unknown-none/release/cambios-virtio-net
BLK_DRIVER_DIR := user/virtio-blk
BLK_DRIVER_ELF := $(BLK_DRIVER_DIR)/target/x86_64-unknown-none/release/cambios-virtio-blk
USB_HOST_DIR := user/usb-host
USB_HOST_ELF := $(USB_HOST_DIR)/target/x86_64-unknown-none/release/cambios-usb-host
CCID_DIR := user/ccid
CCID_ELF := $(CCID_DIR)/target/x86_64-unknown-none/release/cambios-ccid
I219_DRIVER_DIR := user/i219-net
I219_DRIVER_ELF := $(I219_DRIVER_DIR)/target/x86_64-unknown-none/release/cambios-i219-net
UDP_STACK_DIR := user/udp-stack
UDP_STACK_ELF := $(UDP_STACK_DIR)/target/x86_64-unknown-none/release/cambios-udp-stack
SHELL_DIR := user/shell
SHELL_ELF := $(SHELL_DIR)/target/x86_64-unknown-none/release/cambios-shell
POLICY_SERVICE_DIR := user/policy-service
POLICY_SERVICE_ELF := $(POLICY_SERVICE_DIR)/target/x86_64-unknown-none/release/cambios-policy-service
FB_DEMO_DIR := user/fb-demo
FB_DEMO_ELF := $(FB_DEMO_DIR)/target/x86_64-unknown-none/release/cambios-fb-demo
COMPOSITOR_DIR := user/compositor
COMPOSITOR_ELF := $(COMPOSITOR_DIR)/target/x86_64-unknown-none/release/cambios-compositor
SCANOUT_LIMINE_DIR := user/scanout-limine
SCANOUT_LIMINE_ELF := $(SCANOUT_LIMINE_DIR)/target/x86_64-unknown-none/release/cambios-scanout-limine
SCANOUT_VGPU_DIR := user/scanout-virtio-gpu
SCANOUT_VGPU_ELF := $(SCANOUT_VGPU_DIR)/target/x86_64-unknown-none/release/cambios-scanout-virtio-gpu
VIRTIO_INPUT_DIR := user/virtio-input
VIRTIO_INPUT_ELF := $(VIRTIO_INPUT_DIR)/target/x86_64-unknown-none/release/cambios-virtio-input
HELLO_WINDOW_DIR := user/hello-window
HELLO_WINDOW_ELF := $(HELLO_WINDOW_DIR)/target/x86_64-unknown-none/release/cambios-hello-window
TREE_DIR := user/tree
TREE_ELF := $(TREE_DIR)/target/x86_64-unknown-none/release/cambios-tree
WORM_DIR := user/worm
WORM_ELF := $(WORM_DIR)/target/x86_64-unknown-none/release/cambios-worm
PING_DIR := user/ping
PING_ELF := $(PING_DIR)/target/x86_64-unknown-none/release/cambios-ping
SPROUTY_DIR := user/sprouty
SPROUTY_ELF := $(SPROUTY_DIR)/target/x86_64-unknown-none/release/cambios-sprouty
TERMINAL_WINDOW_DIR := user/terminal-window
TERMINAL_WINDOW_ELF := $(TERMINAL_WINDOW_DIR)/target/x86_64-unknown-none/release/cambios-terminal-window
AUDIT_TAIL_DIR := user/audit-tail
AUDIT_TAIL_ELF := $(AUDIT_TAIL_DIR)/target/x86_64-unknown-none/release/cambios-audit-tail
FDE_MOUNT_DIR := user/fde-mount
FDE_MOUNT_ELF := $(FDE_MOUNT_DIR)/target/x86_64-unknown-none/release/cambios-fde-mount

# User-space ELF binaries (RISC-V)
FS_SERVICE_ELF_RISCV64 := $(FS_SERVICE_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-fs-service
KS_SERVICE_ELF_RISCV64 := $(KS_SERVICE_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-key-store-service
BLK_DRIVER_ELF_RISCV64 := $(BLK_DRIVER_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-virtio-blk
USB_HOST_ELF_RISCV64 := $(USB_HOST_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-usb-host
CCID_ELF_RISCV64 := $(CCID_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-ccid
NET_DRIVER_ELF_RISCV64 := $(NET_DRIVER_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-virtio-net
UDP_STACK_ELF_RISCV64 := $(UDP_STACK_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-udp-stack
SHELL_ELF_RISCV64 := $(SHELL_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-shell
POLICY_SERVICE_ELF_RISCV64 := $(POLICY_SERVICE_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-policy-service

# RISC-V initrd artifacts
INITRD_RISCV64 := initrd-riscv64.img
MKINITRD_DIR := tools/mkinitrd
MKINITRD := $(MKINITRD_DIR)/target/aarch64-apple-darwin/release/mkinitrd

# User-space ELF binaries (AArch64)
USER_ELF_AARCH64 := user/hello-aarch64.elf
USER_SRC_AARCH64 := user/hello-aarch64.S
USER_LD_AARCH64  := user/user-aarch64.ld
FS_SERVICE_ELF_AARCH64 := $(FS_SERVICE_DIR)/target/aarch64-unknown-none/release/cambios-fs-service
KS_SERVICE_ELF_AARCH64 := $(KS_SERVICE_DIR)/target/aarch64-unknown-none/release/cambios-key-store-service
NET_DRIVER_ELF_AARCH64 := $(NET_DRIVER_DIR)/target/aarch64-unknown-none/release/cambios-virtio-net
BLK_DRIVER_ELF_AARCH64 := $(BLK_DRIVER_DIR)/target/aarch64-unknown-none/release/cambios-virtio-blk
USB_HOST_ELF_AARCH64 := $(USB_HOST_DIR)/target/aarch64-unknown-none/release/cambios-usb-host
CCID_ELF_AARCH64 := $(CCID_DIR)/target/aarch64-unknown-none/release/cambios-ccid
I219_DRIVER_ELF_AARCH64 := $(I219_DRIVER_DIR)/target/aarch64-unknown-none/release/cambios-i219-net
UDP_STACK_ELF_AARCH64 := $(UDP_STACK_DIR)/target/aarch64-unknown-none/release/cambios-udp-stack
SHELL_ELF_AARCH64 := $(SHELL_DIR)/target/aarch64-unknown-none/release/cambios-shell
POLICY_SERVICE_ELF_AARCH64 := $(POLICY_SERVICE_DIR)/target/aarch64-unknown-none/release/cambios-policy-service
FB_DEMO_ELF_AARCH64 := $(FB_DEMO_DIR)/target/aarch64-unknown-none/release/cambios-fb-demo
COMPOSITOR_ELF_AARCH64 := $(COMPOSITOR_DIR)/target/aarch64-unknown-none/release/cambios-compositor
SCANOUT_LIMINE_ELF_AARCH64 := $(SCANOUT_LIMINE_DIR)/target/aarch64-unknown-none/release/cambios-scanout-limine
SCANOUT_VGPU_ELF_AARCH64 := $(SCANOUT_VGPU_DIR)/target/aarch64-unknown-none/release/cambios-scanout-virtio-gpu
VIRTIO_INPUT_ELF_AARCH64 := $(VIRTIO_INPUT_DIR)/target/aarch64-unknown-none/release/cambios-virtio-input
HELLO_WINDOW_ELF_AARCH64 := $(HELLO_WINDOW_DIR)/target/aarch64-unknown-none/release/cambios-hello-window
TREE_ELF_AARCH64 := $(TREE_DIR)/target/aarch64-unknown-none/release/cambios-tree
WORM_ELF_AARCH64 := $(WORM_DIR)/target/aarch64-unknown-none/release/cambios-worm
PING_ELF_AARCH64 := $(PING_DIR)/target/aarch64-unknown-none/release/cambios-ping
SPROUTY_ELF_AARCH64 := $(SPROUTY_DIR)/target/aarch64-unknown-none/release/cambios-sprouty
TERMINAL_WINDOW_ELF_AARCH64 := $(TERMINAL_WINDOW_DIR)/target/aarch64-unknown-none/release/cambios-terminal-window
AUDIT_TAIL_ELF_AARCH64 := $(AUDIT_TAIL_DIR)/target/aarch64-unknown-none/release/cambios-audit-tail
FDE_MOUNT_ELF_AARCH64 := $(FDE_MOUNT_DIR)/target/aarch64-unknown-none/release/cambios-fde-mount

# User-space ELF binaries (RISC-V) — scanout + input extension for Scanout-4.c
SCANOUT_VGPU_ELF_RISCV64 := $(SCANOUT_VGPU_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-scanout-virtio-gpu
VIRTIO_INPUT_ELF_RISCV64 := $(VIRTIO_INPUT_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-virtio-input

# User-space ELF binaries (RISC-V) — GUI stack (ADR-011). libgui is
# arch-agnostic; each app ships a link-riscv64.ld matching the
# virtio-net riscv64 shape. Runtime requires kernel ECAM PCI + a
# virtio-gpu-pci QEMU device; build infra lands first so the cross-
# arch port is unblocked.
COMPOSITOR_ELF_RISCV64 := $(COMPOSITOR_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-compositor
HELLO_WINDOW_ELF_RISCV64 := $(HELLO_WINDOW_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-hello-window
TREE_ELF_RISCV64 := $(TREE_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-tree
WORM_ELF_RISCV64 := $(WORM_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-worm
PING_ELF_RISCV64 := $(PING_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-ping
SPROUTY_ELF_RISCV64 := $(SPROUTY_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-sprouty
TERMINAL_WINDOW_ELF_RISCV64 := $(TERMINAL_WINDOW_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-terminal-window
AUDIT_TAIL_ELF_RISCV64 := $(AUDIT_TAIL_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-audit-tail
FDE_MOUNT_ELF_RISCV64 := $(FDE_MOUNT_DIR)/target/riscv64gc-unknown-none-elf/release/cambios-fde-mount

# ELF signing tool
SIGN_ELF_DIR := tools/sign-elf
SIGN_ELF := $(SIGN_ELF_DIR)/target/aarch64-apple-darwin/release/sign-elf

# Dev-PIV keypair generator (host-side). Derives Ed25519+X25519 keys from a
# persistent per-developer seed; writes dev_bootstrap_pubkey.bin (consumed by
# the kernel under --features dev-piv) and user/key-store-service/
# dev_piv_secret.bin (consumed by SwPivBackend under --features dev-piv).
GEN_DEV_PIV_DIR := tools/gen-dev-piv-keys
GEN_DEV_PIV := $(GEN_DEV_PIV_DIR)/target/aarch64-apple-darwin/release/gen-dev-piv-keys
DEV_BOOTSTRAP_PUBKEY := dev_bootstrap_pubkey.bin
DEV_PIV_SECRET := user/key-store-service/dev_piv_secret.bin

# Format-volume host tool (stream A A-v.e). Writes a fresh signed
# ADR-032 § 4 volume header to a raw disk image file using the
# DPIV bundle gen-dev-piv-keys produced. Sibling to sign-elf.
FORMAT_VOLUME_DIR := tools/format-volume
FORMAT_VOLUME := $(FORMAT_VOLUME_DIR)/target/aarch64-apple-darwin/release/format-volume

# Signing mode: "yubikey" (default) or "seed" (for CI/testing without hardware key)
SIGN_MODE ?= seed

# Bootstrap seed hex — only used when SIGN_MODE=seed (for dev/CI builds)
BOOTSTRAP_SEED_HEX := 4172634f532d426f6f7473747261702d4964656e746974792d50686173653021

# Resolve sign-elf flags based on signing mode
ifeq ($(SIGN_MODE),seed)
  SIGN_FLAGS := --seed $(BOOTSTRAP_SEED_HEX)
else ifeq ($(SIGN_MODE),dev-piv)
  # Sign ELFs with the dev-PIV slot-9C Ed25519 seed (matches the
  # bootstrap pubkey baked into a kernel built with `--features
  # dev-piv`). Requires `make gen-dev-piv-keys` to have produced
  # dev_slot_9c_seed.bin. NOTE: this is the *derived* slot-9C
  # seed (blake3(.dev-seed.bin || "cambios-dev-piv:slot-9c-
  # ed25519")), not .dev-seed.bin itself — the bootstrap pubkey
  # under `--features dev-piv` is the slot-9C public key, so
  # sign-elf needs the slot-9C secret to produce signatures the
  # kernel accepts.
  DEV_PIV_SEED_HEX := $(shell xxd -p -c 32 dev_slot_9c_seed.bin)
  SIGN_FLAGS := --seed $(DEV_PIV_SEED_HEX)
else
  SIGN_FLAGS :=
endif

.PHONY: all kernel iso run run-gui run-uefi test clean symbols img-x86 run-img-x86 img-usb run-img-usb usb verify-usb disk-img kernel-aarch64 img-aarch64 run-aarch64 run-aarch64-gui kernel-riscv64 img-riscv64 run-riscv64 check-all check-stable check-x86 check-aarch64 check-riscv64 check-adrs check-index-isolation check-deferrals update-deferrals-baseline claude-preflight sync-site sync-site-check user-elf fs-service key-store-service virtio-net virtio-blk virtio-input usb-host ccid i219-net udp-stack shell policy-service fb-demo compositor scanout-limine scanout-virtio-gpu hello-window tree worm ping sprouty terminal-window audit-tail fde-mount user-elf-aarch64 fs-service-aarch64 key-store-service-aarch64 virtio-net-aarch64 virtio-blk-aarch64 usb-host-aarch64 ccid-aarch64 i219-net-aarch64 udp-stack-aarch64 shell-aarch64 policy-service-aarch64 fb-demo-aarch64 compositor-aarch64 scanout-limine-aarch64 scanout-virtio-gpu-aarch64 virtio-input-aarch64 hello-window-aarch64 tree-aarch64 worm-aarch64 ping-aarch64 sprouty-aarch64 terminal-window-aarch64 audit-tail-aarch64 fde-mount-aarch64 fs-service-riscv64 key-store-service-riscv64 virtio-blk-riscv64 usb-host-riscv64 ccid-riscv64 virtio-net-riscv64 udp-stack-riscv64 shell-riscv64 policy-service-riscv64 scanout-virtio-gpu-riscv64 virtio-input-riscv64 compositor-riscv64 hello-window-riscv64 tree-riscv64 worm-riscv64 ping-riscv64 sprouty-riscv64 terminal-window-riscv64 audit-tail-riscv64 fde-mount-riscv64 sign-tool mkinitrd gen-dev-piv-keys format-volume bake-font export-pubkey kernel-dev-piv key-store-service-dev-piv iso-dev-piv run-quiet-dev-piv

all: iso

kernel:
	cargo build --target x86_64-unknown-none --release

# Kernel built with `--features dev-piv` — replaces the committed
# bootstrap pubkey with the per-developer dev one from
# tools/gen-dev-piv-keys/.dev-seed.bin. Used end-to-end by
# `run-dev-piv` for the stream A FDE unlock smoke test.
kernel-dev-piv:
	cargo build --target x86_64-unknown-none --release --features dev-piv

# Key-store-service built with `--features dev-piv` — loads
# SwPivBackend with the slot-9C/9D keys from
# user/key-store-service/dev_piv_secret.bin so the kernel's PIV
# IPC clients can talk to a virtual YubiKey without real hardware.
key-store-service-dev-piv:
	@echo "=== Building Key Store service (--features dev-piv) ==="
	cd $(KS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release --features dev-piv
	@echo "=== Key Store service ready (dev-piv) ==="

user-elf:
	@echo "=== Building user-space ELF ==="
	clang -target x86_64-unknown-none -nostdlib -ffreestanding -c $(USER_SRC) -o user/hello.o
	ld.lld -T $(USER_LD) -nostdlib --no-dynamic-linker -static user/hello.o -o $(USER_ELF)
	@echo "=== $(USER_ELF) ready ==="

fs-service:
	@echo "=== Building FS service ==="
	cd $(FS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== FS service ready ==="

key-store-service:
	@echo "=== Building Key Store service ==="
	cd $(KS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== Key Store service ready ==="

virtio-net:
	@echo "=== Building Virtio-Net driver ==="
	cd $(NET_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== Virtio-Net driver ready ==="

virtio-blk:
	@echo "=== Building Virtio-Blk driver ==="
	cd $(BLK_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== Virtio-Blk driver ready ==="

usb-host:
	@echo "=== Building USB-Host driver ==="
	cd $(USB_HOST_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== USB-Host driver ready ==="

ccid:
	@echo "=== Building CCID class driver ==="
	cd $(CCID_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== CCID class driver ready ==="

i219-net:
	@echo "=== Building Intel I219-LM driver ==="
	cd $(I219_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== I219-LM driver ready ==="

udp-stack:
	@echo "=== Building UDP stack ==="
	cd $(UDP_STACK_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== UDP stack ready ==="

shell:
	@echo "=== Building Shell ==="
	cd $(SHELL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== Shell ready ==="

policy-service:
	@echo "=== Building Policy service ==="
	cd $(POLICY_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== Policy service ready ==="

fb-demo:
	@echo "=== Building fb-demo (Phase GUI-1) ==="
	cd $(FB_DEMO_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== fb-demo ready ==="

audit-tail:
	@echo "=== Building audit-tail (ADR-023) ==="
	cd $(AUDIT_TAIL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== audit-tail ready ==="

fde-mount:
	@echo "=== Building fde-mount (ADR-032 § Architecture, stream A A-v.a) ==="
	cd $(FDE_MOUNT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== fde-mount ready ==="

compositor:
	@echo "=== Building compositor (Phase Scanout-1, ADR-014) ==="
	cd $(COMPOSITOR_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== compositor ready ==="

scanout-limine:
	@echo "=== Building scanout-limine (Phase Scanout-2, ADR-014) ==="
	cd $(SCANOUT_LIMINE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== scanout-limine ready ==="

scanout-virtio-gpu:
	@echo "=== Building scanout-virtio-gpu (Phase Scanout-4.a, ADR-014) ==="
	cd $(SCANOUT_VGPU_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== scanout-virtio-gpu ready ==="

virtio-input:
	@echo "=== Building virtio-input (ADR-012 Input-1) ==="
	cd $(VIRTIO_INPUT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== virtio-input ready ==="

hello-window:
	@echo "=== Building hello-window (Phase Scanout-3, ADR-011) ==="
	cd $(HELLO_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== hello-window ready ==="

tree:
	@echo "=== Building tree (first-party app, ADR-011 / ADR-012) ==="
	cd $(TREE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== tree ready ==="

worm:
	@echo "=== Building worm (first-party app, ADR-011 / ADR-012) ==="
	cd $(WORM_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== worm ready ==="

ping:
	@echo "=== Building ping (first-party app, ADR-011 / ADR-012) ==="
	cd $(PING_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== ping ready ==="

sprouty:
	@echo "=== Building sprouty (first-party app, ADR-011 / ADR-012) ==="
	cd $(SPROUTY_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== sprouty ready ==="

terminal-window:
	@echo "=== Building terminal-window (GUI shell host) ==="
	cd $(TERMINAL_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --release
	@echo "=== terminal-window ready ==="

# AArch64 user-space build targets
user-elf-aarch64:
	@echo "=== Building user-space ELF (AArch64) ==="
	clang -target aarch64-unknown-none -nostdlib -ffreestanding -c $(USER_SRC_AARCH64) -o user/hello-aarch64.o
	ld.lld -T $(USER_LD_AARCH64) -nostdlib --no-dynamic-linker -static user/hello-aarch64.o -o $(USER_ELF_AARCH64)
	@echo "=== $(USER_ELF_AARCH64) ready ==="

fs-service-aarch64:
	@echo "=== Building FS service (AArch64) ==="
	cd $(FS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== FS service (AArch64) ready ==="

key-store-service-aarch64:
	@echo "=== Building Key Store service (AArch64) ==="
	cd $(KS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== Key Store service (AArch64) ready ==="

virtio-net-aarch64:
	@echo "=== Building Virtio-Net driver (AArch64) ==="
	cd $(NET_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== Virtio-Net driver (AArch64) ready ==="

virtio-blk-aarch64:
	@echo "=== Building Virtio-Blk driver (AArch64) ==="
	cd $(BLK_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== Virtio-Blk driver (AArch64) ready ==="

usb-host-aarch64:
	@echo "=== Building USB-Host driver (AArch64) ==="
	cd $(USB_HOST_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== USB-Host driver (AArch64) ready ==="

ccid-aarch64:
	@echo "=== Building CCID class driver (AArch64) ==="
	cd $(CCID_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== CCID class driver (AArch64) ready ==="

i219-net-aarch64:
	@echo "=== Building Intel I219-LM driver (AArch64) ==="
	cd $(I219_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== I219-LM driver (AArch64) ready ==="

udp-stack-aarch64:
	@echo "=== Building UDP stack (AArch64) ==="
	cd $(UDP_STACK_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== UDP stack (AArch64) ready ==="

shell-aarch64:
	@echo "=== Building Shell (AArch64) ==="
	cd $(SHELL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== Shell (AArch64) ready ==="

policy-service-aarch64:
	@echo "=== Building Policy service (AArch64) ==="
	cd $(POLICY_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== Policy service (AArch64) ready ==="

fb-demo-aarch64:
	@echo "=== Building fb-demo (AArch64) ==="
	cd $(FB_DEMO_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== fb-demo (AArch64) ready ==="

audit-tail-aarch64:
	@echo "=== Building audit-tail (AArch64) ==="
	cd $(AUDIT_TAIL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== audit-tail (AArch64) ready ==="

fde-mount-aarch64:
	@echo "=== Building fde-mount (AArch64) ==="
	cd $(FDE_MOUNT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== fde-mount (AArch64) ready ==="

compositor-aarch64:
	@echo "=== Building compositor (AArch64) ==="
	cd $(COMPOSITOR_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== compositor (AArch64) ready ==="

scanout-limine-aarch64:
	@echo "=== Building scanout-limine (AArch64) ==="
	cd $(SCANOUT_LIMINE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== scanout-limine (AArch64) ready ==="

scanout-virtio-gpu-aarch64:
	@echo "=== Building scanout-virtio-gpu (AArch64, Scanout-4.c ADR-014) ==="
	cd $(SCANOUT_VGPU_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== scanout-virtio-gpu (AArch64) ready ==="

virtio-input-aarch64:
	@echo "=== Building virtio-input (AArch64, ADR-012 Input-1) ==="
	cd $(VIRTIO_INPUT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== virtio-input (AArch64) ready ==="

hello-window-aarch64:
	@echo "=== Building hello-window (AArch64) ==="
	cd $(HELLO_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== hello-window (AArch64) ready ==="

tree-aarch64:
	@echo "=== Building tree (AArch64) ==="
	cd $(TREE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== tree (AArch64) ready ==="

worm-aarch64:
	@echo "=== Building worm (AArch64) ==="
	cd $(WORM_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== worm (AArch64) ready ==="

ping-aarch64:
	@echo "=== Building ping (AArch64) ==="
	cd $(PING_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== ping (AArch64) ready ==="

sprouty-aarch64:
	@echo "=== Building sprouty (AArch64) ==="
	cd $(SPROUTY_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== sprouty (AArch64) ready ==="

terminal-window-aarch64:
	@echo "=== Building terminal-window (AArch64) ==="
	cd $(TERMINAL_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-aarch64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target aarch64-unknown-none --release
	@echo "=== terminal-window (AArch64) ready ==="

# RISC-V user-space build targets (R-6 / ADR-013)
# Services build with the same CARGO_ENCODED_RUSTFLAGS shape as x86_64/aarch64;
# only the linker script and target triple differ.
fs-service-riscv64:
	@echo "=== Building FS service (RISC-V) ==="
	cd $(FS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== FS service (RISC-V) ready ==="

key-store-service-riscv64:
	@echo "=== Building Key Store service (RISC-V) ==="
	cd $(KS_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== Key Store service (RISC-V) ready ==="

virtio-blk-riscv64:
	@echo "=== Building Virtio-Blk driver (RISC-V) ==="
	cd $(BLK_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== Virtio-Blk driver (RISC-V) ready ==="

usb-host-riscv64:
	@echo "=== Building USB-Host driver (RISC-V) ==="
	cd $(USB_HOST_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== USB-Host driver (RISC-V) ready ==="

ccid-riscv64:
	@echo "=== Building CCID class driver (RISC-V) ==="
	cd $(CCID_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== CCID class driver (RISC-V) ready ==="

virtio-net-riscv64:
	@echo "=== Building Virtio-Net driver (RISC-V) ==="
	cd $(NET_DRIVER_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== Virtio-Net driver (RISC-V) ready ==="

udp-stack-riscv64:
	@echo "=== Building UDP stack (RISC-V) ==="
	cd $(UDP_STACK_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== UDP stack (RISC-V) ready ==="

shell-riscv64:
	@echo "=== Building Shell (RISC-V) ==="
	cd $(SHELL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== Shell (RISC-V) ready ==="

policy-service-riscv64:
	@echo "=== Building Policy service (RISC-V) ==="
	cd $(POLICY_SERVICE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== Policy service (RISC-V) ready ==="

audit-tail-riscv64:
	@echo "=== Building audit-tail (RISC-V) ==="
	cd $(AUDIT_TAIL_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== audit-tail (RISC-V) ready ==="

fde-mount-riscv64:
	@echo "=== Building fde-mount (RISC-V) ==="
	cd $(FDE_MOUNT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== fde-mount (RISC-V) ready ==="

scanout-virtio-gpu-riscv64:
	@echo "=== Building scanout-virtio-gpu (RISC-V, Scanout-4.c ADR-014) ==="
	cd $(SCANOUT_VGPU_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== scanout-virtio-gpu (RISC-V) ready ==="

virtio-input-riscv64:
	@echo "=== Building virtio-input (RISC-V, ADR-012 Input-1) ==="
	cd $(VIRTIO_INPUT_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== virtio-input (RISC-V) ready ==="

compositor-riscv64:
	@echo "=== Building compositor (RISC-V, ADR-014) ==="
	cd $(COMPOSITOR_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== compositor (RISC-V) ready ==="

hello-window-riscv64:
	@echo "=== Building hello-window (RISC-V, ADR-011) ==="
	cd $(HELLO_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== hello-window (RISC-V) ready ==="

tree-riscv64:
	@echo "=== Building tree (RISC-V, ADR-011/012) ==="
	cd $(TREE_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== tree (RISC-V) ready ==="

worm-riscv64:
	@echo "=== Building worm (RISC-V, ADR-011/012) ==="
	cd $(WORM_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== worm (RISC-V) ready ==="

ping-riscv64:
	@echo "=== Building ping (RISC-V, ADR-011/012) ==="
	cd $(PING_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== ping (RISC-V) ready ==="

sprouty-riscv64:
	@echo "=== Building sprouty (RISC-V, ADR-011/012) ==="
	cd $(SPROUTY_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== sprouty (RISC-V) ready ==="

terminal-window-riscv64:
	@echo "=== Building terminal-window (RISC-V) ==="
	cd $(TERMINAL_WINDOW_DIR) && CARGO_ENCODED_RUSTFLAGS=$$(printf '%s\x1f%s\x1f%s\x1f%s' \
		'-Clink-arg=--script=link-riscv64.ld' '-Clink-arg=-z' '-Clink-arg=noexecstack' \
		'-Crelocation-model=static') cargo build --target riscv64gc-unknown-none-elf --release
	@echo "=== terminal-window (RISC-V) ready ==="

sign-tool:
	@echo "=== Building ELF signing tool ==="
	cd $(SIGN_ELF_DIR) && cargo build --release
	@echo "=== sign-elf ready ==="

mkinitrd:
	@echo "=== Building mkinitrd host tool ==="
	cd $(MKINITRD_DIR) && cargo build --release
	@echo "=== mkinitrd ready ==="

# Builds the gen-dev-piv-keys tool (idempotent; rebuilds only on source
# change) and runs it. Idempotent at the file-output level: same seed →
# byte-identical dev_bootstrap_pubkey.bin and dev_piv_secret.bin.
# Required before any build with `--features dev-piv` enabled.
gen-dev-piv-keys:
	@echo "=== Building dev-PIV keypair generator ==="
	cd $(GEN_DEV_PIV_DIR) && cargo build --release
	@echo "=== Generating dev-PIV keypair files ==="
	$(GEN_DEV_PIV)
	@echo "=== dev-PIV keypair files ready ==="

# Builds the format-volume host tool. Doesn't run it — invoke
# directly with a disk image path (e.g.,
# `$(FORMAT_VOLUME) disk.img`). Requires gen-dev-piv-keys to have
# run at least once (consumes user/key-store-service/dev_piv_secret.bin).
format-volume:
	@echo "=== Building format-volume host tool ==="
	cd $(FORMAT_VOLUME_DIR) && cargo build --release
	@echo "=== format-volume ready: $(FORMAT_VOLUME) ==="

# Re-bake the JetBrains Mono Regular TTF in assets/fonts/ into the
# antialiased glyph table consumed by user/libgui at compile time. Run
# only when the font, target cell size, or pixel height changes — the
# generated file is checked in. Bake parameters live here as the source
# of truth (the tool's CLI lets you override at the command line).
JBM_PX_HEIGHT := 24
JBM_CELL := 16x32
bake-font:
	@echo "=== Building bake-font host tool ==="
	cd tools/bake-font && cargo build --release
	@echo "=== Re-baking JetBrains Mono into user/libgui/src/font_jbmono_data.rs ==="
	./tools/bake-font/target/aarch64-apple-darwin/release/bake-font \
	    assets/fonts/JetBrainsMono-Regular.ttf \
	    user/libgui/src/font_jbmono_data.rs \
	    --px $(JBM_PX_HEIGHT) --cell $(JBM_CELL) --const-prefix JBM
	@echo "=== bake-font ready ==="

# Export the bootstrap public key from the signing source.
# Run this once after setting up your YubiKey to generate bootstrap_pubkey.bin.
# Usage: make export-pubkey                   (from YubiKey)
#        make export-pubkey SIGN_MODE=seed    (from seed, for dev)
export-pubkey: sign-tool
	$(SIGN_ELF) $(SIGN_FLAGS) --export-pubkey bootstrap_pubkey.bin

# Auto-clone Limine if $(LIMINE_DIR) was cleaned or partially nibbled.
# rm -rf before clone defends against the macOS /tmp daily-cleanup case
# that prompted the move out of /tmp: per-file atime cleanup can leave
# the dir present but missing key files (e.g., BOOTX64.EFI gone while
# BOOTAA64.EFI survives), and `git clone` refuses a non-empty target.
$(LIMINE_DIR)/BOOTX64.EFI $(LIMINE_DIR)/BOOTAA64.EFI:
	@echo "=== Cloning Limine $(LIMINE_BRANCH) ==="
	rm -rf $(LIMINE_DIR)
	mkdir -p $(dir $(LIMINE_DIR))
	git clone $(LIMINE_REPO) --branch=$(LIMINE_BRANCH) --depth=1 $(LIMINE_DIR)

# Upstream's `limine-binary` branch ships the pre-built EFI stages but
# NOT the compiled macOS host tool `limine` (the `xxx bios-install $(ISO)`
# call at the bottom of `iso:`). The clone includes the single-file
# `limine.c` source; compile it in-place. Depends on BOOTX64.EFI to
# guarantee the clone has run.
$(LIMINE_DIR)/limine: $(LIMINE_DIR)/BOOTX64.EFI
	@echo "=== Building Limine host tool ==="
	$(MAKE) -C $(LIMINE_DIR)

limine: $(LIMINE_DIR)/BOOTX64.EFI $(LIMINE_DIR)/limine

# `iso-dev-piv` produces the same ISO as `iso`, but with the kernel
# and key-store-service binaries built under `--features dev-piv`
# (stream A FDE end-to-end). Approach: build the dev-piv variants
# first, then re-invoke `iso` with `--assume-old` so make doesn't
# clobber them with the default (non-dev-piv) cargo build.
iso-dev-piv: kernel-dev-piv key-store-service-dev-piv gen-dev-piv-keys format-volume fde-mount sign-tool
	@echo "=== Re-assembling ISO with --features dev-piv binaries ==="
	$(MAKE) --assume-old=kernel --assume-old=key-store-service SIGN_MODE=dev-piv iso

iso: kernel fs-service key-store-service virtio-blk virtio-net udp-stack virtio-input usb-host ccid shell policy-service fb-demo compositor scanout-virtio-gpu tree worm ping sprouty terminal-window audit-tail fde-mount sign-tool limine
	@echo "=== Building ISO (signing mode: $(SIGN_MODE)) ==="
	rm -rf iso_root
	mkdir -p iso_root/boot
	mkdir -p iso_root/boot/limine
	mkdir -p iso_root/EFI/BOOT
	# Copy kernel binary
	cp $(KERNEL) iso_root/boot/cambios_microkernel
	# Copy + sign boot modules (must match limine.conf module order).
	# scanout-limine is not loaded in the default manifest as of
	# Scanout-4.b — kept buildable out-of-tree for non-virtio-gpu
	# hosts. The default `run` / `run-gui` targets include
	# -device virtio-gpu-pci so scanout-virtio-gpu is the driver.
	cp $(POLICY_SERVICE_ELF) iso_root/boot/policy-service.elf
	cp $(KS_SERVICE_ELF) iso_root/boot/key-store-service.elf
	cp $(FS_SERVICE_ELF) iso_root/boot/fs-service.elf
	cp $(BLK_DRIVER_ELF) iso_root/boot/virtio-blk.elf
	cp $(USB_HOST_ELF) iso_root/boot/usb-host.elf
	cp $(CCID_ELF) iso_root/boot/ccid.elf
	cp $(NET_DRIVER_ELF) iso_root/boot/virtio-net.elf
	cp $(UDP_STACK_ELF) iso_root/boot/udp-stack.elf
	cp $(SHELL_ELF) iso_root/boot/shell.elf
	cp $(FB_DEMO_ELF) iso_root/boot/fb-demo.elf
	cp $(COMPOSITOR_ELF) iso_root/boot/compositor.elf
	cp $(SCANOUT_VGPU_ELF) iso_root/boot/scanout-virtio-gpu.elf
	cp $(VIRTIO_INPUT_ELF) iso_root/boot/virtio-input.elf
	cp $(TERMINAL_WINDOW_ELF) iso_root/boot/terminal-window.elf
	cp $(PING_ELF) iso_root/boot/ping.elf
	cp $(SPROUTY_ELF) iso_root/boot/sprouty.elf
	cp $(TREE_ELF) iso_root/boot/tree.elf
	cp $(WORM_ELF) iso_root/boot/worm.elf
	cp $(AUDIT_TAIL_ELF) iso_root/boot/audit-tail.elf
	cp $(FDE_MOUNT_ELF) iso_root/boot/fde-mount.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/policy-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/key-store-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/fs-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/virtio-blk.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/usb-host.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/ccid.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/virtio-net.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/udp-stack.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/shell.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/fb-demo.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/compositor.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/scanout-virtio-gpu.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/virtio-input.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/terminal-window.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/ping.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/sprouty.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/tree.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/worm.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/audit-tail.elf
	$(SIGN_ELF) $(SIGN_FLAGS) iso_root/boot/fde-mount.elf
	# Copy Limine config (root + standard location)
	cp limine.conf iso_root/limine.conf
	cp limine.conf iso_root/boot/limine/limine.conf
	# Copy Limine BIOS files
	cp $(LIMINE_DIR)/limine-bios.sys iso_root/boot/limine/
	cp $(LIMINE_DIR)/limine-bios-cd.bin iso_root/boot/limine/
	# Copy Limine UEFI files
	cp $(LIMINE_DIR)/BOOTX64.EFI iso_root/EFI/BOOT/
	cp $(LIMINE_DIR)/BOOTIA32.EFI iso_root/EFI/BOOT/
	# Create ISO
	xorriso -as mkisofs \
		-b boot/limine/limine-bios-cd.bin \
		-no-emul-boot -boot-load-size 4 -boot-info-table \
		--efi-boot EFI/BOOT/BOOTX64.EFI \
		-efi-boot-part --efi-boot-image --protective-msdos-label \
		iso_root -o $(ISO) 2>&1
	# Install Limine BIOS stages
	$(LIMINE_DIR)/limine bios-install $(ISO)
	rm -rf iso_root
	@echo "=== $(ISO) ready ==="

# Persistent backing file for the virtio-blk device. 64 MiB is enough for
# the Phase 4a.i DiskObjectStore with 4096-slot capacity (~32 MiB used) plus
# room to grow. The image file persists across `make run` invocations, which
# is the whole point — reboot-cycle testing needs the bytes to survive.
DISK_IMG := cambios-disk.img
DISK_SIZE_MB := 64

disk-img:
	@if [ ! -f $(DISK_IMG) ]; then \
		echo "=== Creating $(DISK_IMG) ($(DISK_SIZE_MB) MiB) ==="; \
		qemu-img create -f raw $(DISK_IMG) $(DISK_SIZE_MB)M; \
	else \
		echo "=== $(DISK_IMG) already exists; leaving it alone ==="; \
	fi

# `-vga virtio` replaces QEMU's default cirrus VGA with virtio-vga.
# virtio-vga is a virtio-gpu device (vendor 0x1AF4, device 0x1050,
# probed identically to virtio-gpu-pci) plus a VGA compatibility
# mode Limine uses for its boot framebuffer. With default `-vga std`
# + a *separate* `-device virtio-gpu-pci`, the Cocoa window shows
# the primary cirrus adapter — nobody writes to it in Scanout-4.b
# and the window is black. Unifying the adapter means what our
# driver programs (SET_SCANOUT / TRANSFER / FLUSH) is what Cocoa
# displays.
run: iso disk-img
	qemu-system-x86_64 \
		-cdrom $(ISO) \
		-serial mon:stdio \
		-smp 2 \
		-m 4G \
		-netdev user,id=net0 \
		-device virtio-net-pci,netdev=net0 \
		-drive file=$(DISK_IMG),if=none,format=raw,id=cambios-disk0 \
		-device virtio-blk-pci,drive=cambios-disk0 \
		-device qemu-xhci,id=xhci0 \
		-device usb-ccid,bus=xhci0.0 \
		-vga virtio \
		-no-reboot

# Filtered `run`: streams kernel output through tools/qemu-run-quiet.py,
# suppressing memory-map / Limine noise and exiting with a status code
# that reflects outcome (0 = success sentinel seen, 1 = panic/exception,
# 2 = hang). Default success sentinel is `cambios> ` (full boot to shell);
# override for pre-shell testing:  make run-quiet SUCCESS="virtio-net ready"
# Keep this QEMU command in sync with `run:` above.
run-quiet: iso disk-img
	python3 tools/qemu-run-quiet.py \
		$(if $(TIMEOUT),--timeout $(TIMEOUT),) \
		$(if $(SUCCESS),--success "$(SUCCESS)",) \
		-- qemu-system-x86_64 \
			-cdrom $(ISO) \
			-serial mon:stdio \
			-smp 2 \
			-m 4G \
			-netdev user,id=net0 \
			-device virtio-net-pci,netdev=net0 \
			-drive file=$(DISK_IMG),if=none,format=raw,id=cambios-disk0 \
			-device virtio-blk-pci,drive=cambios-disk0 \
			-device qemu-xhci,id=xhci0 \
			-device usb-ccid,bus=xhci0.0 \
			-vga virtio \
			-no-reboot

# Quiet run under `--features dev-piv` — the stream A FDE end-to-end
# smoke test. Formats the disk image with a fresh signed volume
# header (idempotent under a constant master via --master-key-hex
# would be possible, but the default random master is what matches
# production semantics). Boots; fde-mount unwraps the master key
# via SwPivBackend; SYS_INSTALL_MASTER_KEY installs
# EncryptedBlockDevice<VirtioBlkDevice> as OBJECT_STORE; substrate
# now lives on XTS-AES-256. Success sentinel default
# `cambios> ` indicates the boot reached the shell.
run-quiet-dev-piv: iso-dev-piv disk-img
	@echo "=== Zeroing substrate superblock (LBA 4) for fresh-wrap detection ==="
	@# format-volume randomizes the master key each invocation, so any
	@# substrate state at LBA 4+ from a prior boot decrypts to garbage
	@# under the new master — kernel's open_strict refuses (correct
	@# wrong-master behavior, see A-v.d.4 design). Smoke test wants the
	@# fresh-wrap → format() path each run, so we zero just LBA 4 (the
	@# substrate's SUPERBLOCK_LBA after the FDE_SUBSTRATE_LBA_OFFSET = 4
	@# shift) to force the kernel's `is_fresh_wrap` check to fire.
	@# Leaves LBA 5+ untouched; persistence semantics are unchanged when
	@# the master is held stable (e.g., via --master-key-hex).
	dd if=/dev/zero of=$(DISK_IMG) bs=4096 count=1 seek=4 conv=notrunc status=none
	@echo "=== Formatting cambios-disk.img with fresh signed FDE header ==="
	$(FORMAT_VOLUME) $(DISK_IMG)
	python3 tools/qemu-run-quiet.py \
		$(if $(TIMEOUT),--timeout $(TIMEOUT),) \
		$(if $(SUCCESS),--success "$(SUCCESS)",) \
		-- qemu-system-x86_64 \
			-cdrom $(ISO) \
			-serial mon:stdio \
			-smp 2 \
			-m 4G \
			-netdev user,id=net0 \
			-device virtio-net-pci,netdev=net0 \
			-drive file=$(DISK_IMG),if=none,format=raw,id=cambios-disk0 \
			-device virtio-blk-pci,drive=cambios-disk0 \
			-device qemu-xhci,id=xhci0 \
			-device usb-ccid,bus=xhci0.0 \
			-vga virtio \
			-no-reboot

# Same as `run`, plus a graphical QEMU window (macOS Cocoa backend) so
# compositor / scanout output is visible. Use for Scanout-3+ visual
# verification; `run` stays headless (serial-only) for CI / text-mode
# workflows. For Linux change `cocoa` to `gtk`; for remote sessions
# swap to `-vnc :0` and connect via Screen Sharing.
run-gui: iso disk-img
	qemu-system-x86_64 \
		-cdrom $(ISO) \
		-serial mon:stdio \
		-smp 2 \
		-m 4G \
		-netdev user,id=net0 \
		-device virtio-net-pci,netdev=net0 \
		-drive file=$(DISK_IMG),if=none,format=raw,id=cambios-disk0 \
		-device virtio-blk-pci,drive=cambios-disk0 \
		-device virtio-keyboard-pci \
		-device virtio-mouse-pci \
		-device qemu-xhci,id=xhci0 \
		-device usb-ccid,bus=xhci0.0 \
		-vga virtio \
		-no-reboot \
		-display cocoa

run-uefi: iso
	@cp $(EFI_VARS_X86) /tmp/cambios-efivars.fd
	qemu-system-x86_64 \
		-cdrom $(ISO) \
		-drive if=pflash,format=raw,readonly=on,file=$(EFI_FW_X86) \
		-drive if=pflash,format=raw,file=/tmp/cambios-efivars.fd \
		-serial mon:stdio \
		-m 4G \
		-no-reboot

# x86_64 FAT32 UEFI image — for USB boot on bare-metal x86_64 hardware.
# Usage: make img-x86 && sudo dd if=cambios-x86.img of=/dev/diskN bs=1M
IMG_X86 := cambios-x86.img

img-x86: kernel user-elf fs-service key-store-service virtio-net i219-net udp-stack shell policy-service virtio-blk compositor audit-tail sign-tool limine
	@echo "=== Building x86_64 FAT boot image (signing mode: $(SIGN_MODE)) ==="
	rm -f $(IMG_X86)
	dd if=/dev/zero of=$(IMG_X86) bs=1M count=64
	mformat -i $(IMG_X86) -F ::
	mmd -i $(IMG_X86) ::/EFI
	mmd -i $(IMG_X86) ::/EFI/BOOT
	mmd -i $(IMG_X86) ::/boot
	mmd -i $(IMG_X86) ::/boot/limine
	mcopy -i $(IMG_X86) $(LIMINE_DIR)/BOOTX64.EFI ::/EFI/BOOT/BOOTX64.EFI
	mcopy -i $(IMG_X86) $(KERNEL) ::/boot/cambios_microkernel
	# Copy + sign all x86_64 user-space modules
	cp $(USER_ELF) /tmp/hello-signed.elf
	cp $(KS_SERVICE_ELF) /tmp/key-store-service-signed.elf
	cp $(FS_SERVICE_ELF) /tmp/fs-service-signed.elf
	cp $(NET_DRIVER_ELF) /tmp/virtio-net-signed.elf
	cp $(I219_DRIVER_ELF) /tmp/i219-net-signed.elf
	cp $(UDP_STACK_ELF) /tmp/udp-stack-signed.elf
	cp $(SHELL_ELF) /tmp/shell-signed.elf
	cp $(POLICY_SERVICE_ELF) /tmp/policy-service-signed.elf
	cp $(BLK_DRIVER_ELF) /tmp/virtio-blk-signed.elf
	cp $(COMPOSITOR_ELF) /tmp/compositor-signed.elf
	cp $(AUDIT_TAIL_ELF) /tmp/audit-tail-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/hello-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/key-store-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/fs-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/virtio-net-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/i219-net-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/udp-stack-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/shell-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/policy-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/virtio-blk-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/compositor-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/audit-tail-signed.elf
	mcopy -i $(IMG_X86) /tmp/hello-signed.elf ::/boot/hello.elf
	mcopy -i $(IMG_X86) /tmp/key-store-service-signed.elf ::/boot/key-store-service.elf
	mcopy -i $(IMG_X86) /tmp/fs-service-signed.elf ::/boot/fs-service.elf
	mcopy -i $(IMG_X86) /tmp/virtio-net-signed.elf ::/boot/virtio-net.elf
	mcopy -i $(IMG_X86) /tmp/i219-net-signed.elf ::/boot/i219-net.elf
	mcopy -i $(IMG_X86) /tmp/udp-stack-signed.elf ::/boot/udp-stack.elf
	mcopy -i $(IMG_X86) /tmp/shell-signed.elf ::/boot/shell.elf
	mcopy -i $(IMG_X86) /tmp/policy-service-signed.elf ::/boot/policy-service.elf
	mcopy -i $(IMG_X86) /tmp/virtio-blk-signed.elf ::/boot/virtio-blk.elf
	mcopy -i $(IMG_X86) /tmp/compositor-signed.elf ::/boot/compositor.elf
	mcopy -i $(IMG_X86) /tmp/audit-tail-signed.elf ::/boot/audit-tail.elf
	rm -f /tmp/hello-signed.elf /tmp/key-store-service-signed.elf /tmp/fs-service-signed.elf /tmp/virtio-net-signed.elf /tmp/i219-net-signed.elf /tmp/udp-stack-signed.elf /tmp/shell-signed.elf /tmp/policy-service-signed.elf /tmp/virtio-blk-signed.elf /tmp/compositor-signed.elf /tmp/audit-tail-signed.elf
	mcopy -i $(IMG_X86) limine.conf ::/limine.conf
	mcopy -i $(IMG_X86) limine.conf ::/boot/limine/limine.conf
	@echo "=== $(IMG_X86) ready ==="
	@echo "To write to USB: sudo dd if=$(IMG_X86) of=/dev/diskN bs=1M"

# UEFI firmware paths (resolved via Homebrew Cellar for QEMU 10.x)
# QEMU 10.x requires pflash loading (not -bios) per firmware/*.json descriptors.
EFI_FW_X86 := $(shell find /opt/homebrew/Cellar/qemu -name 'edk2-x86_64-code.fd' 2>/dev/null | head -1)
EFI_VARS_X86 := $(shell find /opt/homebrew/Cellar/qemu -name 'edk2-i386-vars.fd' 2>/dev/null | head -1)

# Test x86_64 FAT image in QEMU UEFI (validates the image before writing to USB)
run-img-x86: img-x86
	@cp $(EFI_VARS_X86) /tmp/cambios-efivars.fd
	qemu-system-x86_64 \
		-drive file=$(IMG_X86),format=raw \
		-drive if=pflash,format=raw,readonly=on,file=$(EFI_FW_X86) \
		-drive if=pflash,format=raw,file=/tmp/cambios-efivars.fd \
		-serial mon:stdio \
		-smp 2 \
		-m 4G \
		-netdev user,id=net0 \
		-device virtio-net-pci,netdev=net0 \
		-no-reboot

# ============================================================================
# USB boot image (GPT-partitioned, UEFI-bootable)
# ============================================================================
#
# Builds a GPT-partitioned disk image with a single EFI System Partition
# (ESP) containing all kernel + signed user-space modules. Suitable for
# `dd`-ing to a USB stick and booting on bare-metal UEFI systems.
#
# Layout:
#   LBA 0:        Protective MBR (created by sgdisk)
#   LBA 1:        Primary GPT header
#   LBA 2..33:    Primary GPT partition table
#   LBA 2048:     ESP partition start (FAT32, type C12A7328-...)
#   LBA -33..-1:  Backup GPT (header + table)
#
# Requires sgdisk (gptfdisk). Install via: brew install gptfdisk
#
# Usage:
#   make img-usb               # Build the image
#   make run-img-usb           # Test in QEMU UEFI
#   make usb DEVICE=/dev/diskN # Write to USB (with confirmation)
#   make verify-usb DEVICE=/dev/diskN # Read back and compare

IMG_USB := cambios-usb.img
IMG_USB_SIZE_MB := 96
ESP_SIZE_MB := 64

img-usb: img-x86
	@command -v sgdisk >/dev/null 2>&1 || { \
		echo "ERROR: sgdisk not found. Install with: brew install gptfdisk"; \
		exit 1; \
	}
	@echo "=== Building GPT-partitioned USB image ==="
	rm -f $(IMG_USB)
	# Create blank disk image
	dd if=/dev/zero of=$(IMG_USB) bs=1M count=$(IMG_USB_SIZE_MB) status=none
	# Create GPT with a single ESP partition starting at LBA 2048 (1 MiB).
	# Partition type C12A7328-F81F-11D2-BA4B-00A0C93EC93B = EFI System Partition.
	sgdisk --clear \
		--new=1:2048:+$(ESP_SIZE_MB)M \
		--typecode=1:EF00 \
		--change-name=1:"CambiOS ESP" \
		$(IMG_USB) >/dev/null
	# Embed the FAT32 ESP image at LBA 2048 (offset = 2048 * 512 = 1 MiB).
	dd if=$(IMG_X86) of=$(IMG_USB) bs=1M seek=1 conv=notrunc status=none
	@echo "=== $(IMG_USB) ready ($(IMG_USB_SIZE_MB) MiB, GPT + FAT32 ESP) ==="
	@echo "Test in QEMU:    make run-img-usb"
	@echo "Write to USB:    make usb DEVICE=/dev/diskN"

# Test the GPT image in QEMU UEFI (validates before writing to USB)
run-img-usb: img-usb
	@cp $(EFI_VARS_X86) /tmp/cambios-efivars.fd
	qemu-system-x86_64 \
		-drive file=$(IMG_USB),format=raw \
		-drive if=pflash,format=raw,readonly=on,file=$(EFI_FW_X86) \
		-drive if=pflash,format=raw,file=/tmp/cambios-efivars.fd \
		-serial mon:stdio \
		-smp 2 \
		-m 4G \
		-netdev user,id=net0 \
		-device virtio-net-pci,netdev=net0 \
		-no-reboot

# Write the GPT image to a USB stick (with safety prompt).
# Usage: make usb DEVICE=/dev/diskN
usb: img-usb
	@if [ -z "$(DEVICE)" ]; then \
		echo "ERROR: specify the target device:"; \
		echo "  make usb DEVICE=/dev/diskN"; \
		echo ""; \
		echo "Available external disks:"; \
		diskutil list external 2>/dev/null || diskutil list; \
		exit 1; \
	fi
	@if [ ! -b "$(DEVICE)" ] && [ ! -c "$(DEVICE)" ]; then \
		echo "ERROR: $(DEVICE) is not a block/character device"; \
		exit 1; \
	fi
	@echo ""
	@echo "============================================================"
	@echo "  WARNING: This will OVERWRITE all data on $(DEVICE)"
	@echo "============================================================"
	@diskutil info $(DEVICE) 2>/dev/null | grep -E "(Device.*Identifier|Media Name|Disk Size|Protocol)" || true
	@echo ""
	@printf "Type 'yes' to continue: "
	@read confirm && [ "$$confirm" = "yes" ] || { echo "Aborted."; exit 1; }
	@echo "Unmounting $(DEVICE)..."
	@diskutil unmountDisk $(DEVICE) 2>/dev/null || true
	@echo "Writing $(IMG_USB) to $(DEVICE) (this may take a minute)..."
	sudo dd if=$(IMG_USB) of=$(DEVICE) bs=1M
	sync
	@echo "Ejecting $(DEVICE)..."
	@diskutil eject $(DEVICE) 2>/dev/null || true
	@echo ""
	@echo "✓ USB ready. Boot the target machine from this device."

# Verify a USB stick by reading it back and comparing to the source image.
# Usage: make verify-usb DEVICE=/dev/diskN
verify-usb:
	@if [ -z "$(DEVICE)" ]; then \
		echo "ERROR: specify the device: make verify-usb DEVICE=/dev/diskN"; \
		exit 1; \
	fi
	@if [ ! -f $(IMG_USB) ]; then \
		echo "ERROR: $(IMG_USB) not found. Run 'make img-usb' first."; \
		exit 1; \
	fi
	@echo "Reading $(IMG_USB_SIZE_MB) MiB from $(DEVICE)..."
	@diskutil unmountDisk $(DEVICE) 2>/dev/null || true
	sudo dd if=$(DEVICE) of=/tmp/cambios-usb-readback.img bs=1M count=$(IMG_USB_SIZE_MB) status=progress
	@echo "Comparing to $(IMG_USB)..."
	@if cmp -s /tmp/cambios-usb-readback.img $(IMG_USB); then \
		echo "✓ USB matches source image (verified $(IMG_USB_SIZE_MB) MiB)"; \
		rm -f /tmp/cambios-usb-readback.img; \
	else \
		echo "✗ MISMATCH: USB does not match $(IMG_USB)"; \
		echo "  Readback saved to /tmp/cambios-usb-readback.img for inspection"; \
		exit 1; \
	fi

test:
	RUST_MIN_STACK=8388608 cargo test --lib --target x86_64-apple-darwin

# =============================================================================
# make verify — run Kani formal-verification proofs.
#
# Proofs live in `verification/<crate>/` and reuse kernel source via
# `#[path]` includes (no copy, no fork). Kani uses its own bundled
# nightly toolchain, so this works regardless of `rust-toolchain.toml`.
#
# Run after any change to a proven module (currently: BuddyAllocator).
# A proof failure means the property no longer holds — investigate before
# committing.
# =============================================================================
.PHONY: verify
verify:
	@echo "=== Kani proofs: BuddyAllocator ==="
	cd verification/buddy-proofs && cargo kani
	@echo "=== Kani proofs: ELF parser ==="
	cd verification/elf-proofs && cargo kani
	@echo "=== Kani proofs: FrameAllocator ==="
	cd verification/frame-proofs && cargo kani
	@echo "=== Kani proofs: CapabilityManager ==="
	cd verification/capability-proofs && cargo kani

# =============================================================================
# make stats — derive canonical counts from source code.
#
# CLAUDE.md and STATUS.md must not hardcode these numbers; they drift
# silently and become load-bearing lies. Run this target when a count
# actually matters. Intentionally cheap (no full build required for
# syscall/LOC counts; test count uses `--list` which only needs compiled
# test binaries).
# =============================================================================
.PHONY: stats
stats:
	@echo "=== CambiOS stats (derived from source) ==="
	@printf "Syscalls:        "
	@sed -n '/^pub enum SyscallNumber/,/^}/p' cambios-abi/src/lib.rs | grep -Ec '^[[:space:]]+[A-Z][A-Za-z]+ = [0-9]+,'
	@printf "Kernel .rs:      "
	@find src -name '*.rs' | wc -l | tr -d ' '
	@printf "Userspace .rs:   "
	@find user -name '*.rs' -not -path '*/target/*' | wc -l | tr -d ' '
	@printf "Tests (lib):     "
	@RUST_MIN_STACK=8388608 cargo test --lib --target x86_64-apple-darwin -- --list 2>/dev/null | awk '/^[0-9]+ tests?,/ {print $$1; found=1; exit} END {if (!found) print "(build first: make test)"}'

# Generate machine-readable symbol index for AI-assisted development.
# Output: .symbols (gitignored). Read by Claude Code at session start
# to avoid repeated grep calls for symbol locations and line numbers.
symbols:
	python3 tools/gen-symbols.py

# Verify ADR cross-references and regenerate docs/adr/INDEX.md.
# Exit nonzero if any ADR references a missing or superseded ADR, or
# if two ADRs share a number. Run after any ADR edit or addition.
check-adrs:
	python3 tools/check-adrs.py

# Mirror kernel ADRs to the cambios-site repo. Reads tools/sync-to-site.toml
# for the slug map (kernel ADR stem -> site URL slug) and cross-doc reference
# maps. Idempotent: re-running on a synced state writes nothing. Override
# the site path with CAMBIOS_SITE_DIR or the script's --site-dir flag; the
# default in the toml assumes a sibling layout.
sync-site:
	python3 tools/sync-to-site.py

# Dry-run companion to `sync-site`: prints the would-update / would-create
# plan and writes nothing. Useful as a pre-commit sanity check, and as the
# smoke test after editing tools/sync-to-site.toml.
sync-site-check:
	python3 tools/sync-to-site.py --check

# Enforce STATUS.md commit-isolation (see tools/check-index-isolation.py).
# Rejects commits that bundle a structural STATUS.md change (> 20 lines
# changed) with any *.rs source file. Small Post-Change Review Step 8 row
# updates are unaffected. Wired into .githooks/pre-commit; also runnable
# manually via `make check-index-isolation`. Rationale: 2026-04-21 Tree v0
# incident — parallel sessions both touched STATUS.md and one bundled the
# other's restructure into a feature commit, requiring soft-reset + split.
check-index-isolation:
	@python3 tools/check-index-isolation.py

# Enforce that paths deleted from git stay deleted on disk (see
# tools/check-banned-paths.py and tools/banned-paths.txt). A `git rm
# --cached`, conflict-resolved merge, or cross-clone cherry-pick can
# leave a file in the working tree after the deletion commit lands;
# this lint catches the divergence at the commit boundary. Wired into
# .githooks/pre-commit; also runnable as `make check-banned-paths`.
# Rationale: 2026-04-21 third-strike recurrence — user/hello-riscv64.S
# and user/user-riscv64.ld survived afc4b11's deletion on disk and sat
# untracked for two days before a rebase surfaced them.
check-banned-paths:
	@python3 tools/check-banned-paths.py

# Surface every new (crate, version) pair pulled into Cargo.lock by this
# commit (or, when run between commits, since HEAD). Advisory — does not
# block. The point is visibility: build.rs and proc macros run with full
# host privileges before any signature is checked, so a poisoned
# transitive dep is the highest-yield supply-chain attack on a Rust
# project. T-1 in docs/threat-model.md. Wired into .githooks/pre-commit;
# also runnable as `make check-lockfile`.
check-lockfile:
	@python3 tools/check-lockfile-additions.py

# STATUS.md freshness gate — warn (advisory only) when the file's
# `last_synced_to_code:` is more than 7 days behind today. Fires on
# pre-commit so per-landing increments stay cheaper than the catch-up
# sync that recovers from prolonged drift. Tightens to a hard block
# (exit 1) once the warn cycle proves it does not change behavior;
# see tools/check-status-freshness.py for the trigger and rationale.
check-status-freshness:
	@python3 tools/check-status-freshness.py

# Pre-edit audit for a file. Run before the first Edit on any file per
# session — especially under parallel-thread development. Surfaces
# uncommitted changes (HEAD commit, status, full diff) so the caller
# can distinguish "mine" (proceed) from "parallel session" (stop, ask
# the user to commit first). File-scoped `git add <file>` doesn't
# protect against within-file multi-authorship; this gate catches it
# at edit time. See CLAUDE.md § Stop-and-Ask Gate "Pre-edit audit"
# bullet and tools/claude-preflight.py.
# Usage: make claude-preflight FILE=<path>
claude-preflight:
	@test -n "$(FILE)" || { echo "usage: make claude-preflight FILE=<path>" >&2; exit 1; }
	@python3 tools/claude-preflight.py "$(FILE)"

# Install the tracked pre-commit hook by pointing core.hooksPath at
# .githooks/. Run once per clone. Future hook changes propagate via
# `git pull` — no re-install needed. See .githooks/pre-commit.
install-hooks:
	@git config core.hooksPath .githooks
	@echo "=== core.hooksPath -> .githooks (pre-commit + commit-msg hooks active) ==="

# Enforce CLAUDE.md Development Convention 9 (every deferral is a
# conscious deferral). Scans kernel source + design docs for deferral
# tokens (TODO/FIXME/eventually/placeholder/TBD/for-now/etc.) and flags
# any without a Revisit when: / Replace when: / named-concept trigger
# within 3 lines. Baseline exemptions in tools/check-deferrals-baseline.txt.
# The goal is to not grow the baseline; don't treat clearing it as a
# session-end imperative. Exits nonzero on new violations.
check-deferrals:
	python3 tools/check-deferrals.py

# Regenerate the deferrals baseline from scratch. Use when you've
# intentionally added a deferral that carries a real (but unrecognized)
# trigger, or when a legitimate cleanup removed pre-existing entries.
# Review the diff before committing.
update-deferrals-baseline:
	python3 tools/check-deferrals.py --update-baseline

# Enforce CLAUDE.md Development Convention 8 (every numeric bound is
# a conscious bound). Scans src/**/*.rs for `const NAME: <numeric> = …`
# declarations and flags any whose preceding 10 lines don't carry one
# of SCAFFOLDING / ARCHITECTURAL / HARDWARE / TUNING. Baseline
# exemptions in tools/check-assumptions-baseline.txt. The goal is to
# not grow the baseline. Exits nonzero on new violations.
check-assumptions:
	python3 tools/check-assumptions.py

# Regenerate the assumptions baseline from scratch. Use when you've
# intentionally added a tagged bound the lint didn't recognize, or
# when a cleanup removed pre-existing entries. Review the diff.
update-assumptions-baseline:
	python3 tools/check-assumptions.py --update-baseline

# Enforce ADR-021 Phase C — no `.expect()` / `panic!()` /
# `unimplemented!()` / `todo!()` in boot-path init code. Scans a
# curated list of files (src/boot/**/*.rs, src/interrupts/mod.rs,
# arch init modules). Runtime fault handlers are out of scope
# (deferred per ADR-019). Baseline exemptions in
# tools/check-boot-panics-baseline.txt; expected empty after
# 021.B.1-B.3 migrations. Exits nonzero on any new site.
check-boot-panics:
	python3 tools/check-boot-panics.py

# Regenerate the boot-panics baseline. Use only to acknowledge a
# regression you're intentionally accepting — review the diff and
# the justification before committing.
update-boot-panics-baseline:
	python3 tools/check-boot-panics.py --update-baseline

# Enforce CLAUDE.md Development Convention 1: every `unsafe { ... }`
# block must carry a `// SAFETY:` comment in its preceding comment
# block. Comment-block-aware scanner; cluster + assignment-continuation
# + attribute-line aware. Baseline at
# tools/check-unsafe-coverage-baseline.txt; expected empty after E1
# (prancy-manatee Tier 1 E1 + E3). Exits nonzero on any new site.
check-unsafe-coverage:
	python3 tools/check-unsafe-coverage.py

# Regenerate the unsafe-coverage baseline. Use only to acknowledge a
# regression you're intentionally accepting — review the diff and
# the justification before committing.
update-unsafe-coverage-baseline:
	python3 tools/check-unsafe-coverage.py --update-baseline

# AArch64 targets
KERNEL_AARCH64 := target/aarch64-unknown-none/release/cambios_microkernel
IMG_AARCH64 := cambios-aarch64.img
EFI_FW_AARCH64 := $(shell find /opt/homebrew/Cellar/qemu -name 'edk2-aarch64-code.fd' 2>/dev/null | head -1)

kernel-aarch64:
	cargo build --target aarch64-unknown-none --release

img-aarch64: kernel-aarch64 fs-service-aarch64 key-store-service-aarch64 virtio-blk-aarch64 usb-host-aarch64 ccid-aarch64 virtio-net-aarch64 udp-stack-aarch64 shell-aarch64 policy-service-aarch64 scanout-virtio-gpu-aarch64 virtio-input-aarch64 compositor-aarch64 tree-aarch64 worm-aarch64 ping-aarch64 sprouty-aarch64 terminal-window-aarch64 audit-tail-aarch64 sign-tool limine
	@echo "=== Building AArch64 FAT boot image (signing mode: $(SIGN_MODE)) ==="
	rm -f $(IMG_AARCH64)
	dd if=/dev/zero of=$(IMG_AARCH64) bs=1M count=64
	mformat -i $(IMG_AARCH64) -F ::
	mmd -i $(IMG_AARCH64) ::/EFI
	mmd -i $(IMG_AARCH64) ::/EFI/BOOT
	mmd -i $(IMG_AARCH64) ::/boot
	mmd -i $(IMG_AARCH64) ::/boot/limine
	mcopy -i $(IMG_AARCH64) $(LIMINE_DIR)/BOOTAA64.EFI ::/EFI/BOOT/BOOTAA64.EFI
	mcopy -i $(IMG_AARCH64) $(KERNEL_AARCH64) ::/boot/cambios_microkernel
	# Copy + sign AArch64 boot modules (must match limine.conf module order)
	cp $(POLICY_SERVICE_ELF_AARCH64) /tmp/policy-service-signed.elf
	cp $(KS_SERVICE_ELF_AARCH64) /tmp/key-store-service-signed.elf
	cp $(FS_SERVICE_ELF_AARCH64) /tmp/fs-service-signed.elf
	cp $(BLK_DRIVER_ELF_AARCH64) /tmp/virtio-blk-signed.elf
	cp $(USB_HOST_ELF_AARCH64) /tmp/usb-host-signed.elf
	cp $(CCID_ELF_AARCH64) /tmp/ccid-signed.elf
	cp $(NET_DRIVER_ELF_AARCH64) /tmp/virtio-net-signed.elf
	cp $(UDP_STACK_ELF_AARCH64) /tmp/udp-stack-signed.elf
	cp $(SCANOUT_VGPU_ELF_AARCH64) /tmp/scanout-virtio-gpu-signed.elf
	cp $(VIRTIO_INPUT_ELF_AARCH64) /tmp/virtio-input-signed.elf
	cp $(COMPOSITOR_ELF_AARCH64) /tmp/compositor-signed.elf
	cp $(TERMINAL_WINDOW_ELF_AARCH64) /tmp/terminal-window-signed.elf
	cp $(TREE_ELF_AARCH64) /tmp/tree-signed.elf
	cp $(WORM_ELF_AARCH64) /tmp/worm-signed.elf
	cp $(PING_ELF_AARCH64) /tmp/ping-signed.elf
	cp $(SPROUTY_ELF_AARCH64) /tmp/sprouty-signed.elf
	cp $(SHELL_ELF_AARCH64) /tmp/shell-signed.elf
	cp $(AUDIT_TAIL_ELF_AARCH64) /tmp/audit-tail-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/policy-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/key-store-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/fs-service-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/virtio-blk-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/usb-host-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/ccid-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/virtio-net-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/udp-stack-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/scanout-virtio-gpu-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/virtio-input-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/compositor-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/terminal-window-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/tree-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/worm-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/ping-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/sprouty-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/shell-signed.elf
	$(SIGN_ELF) $(SIGN_FLAGS) /tmp/audit-tail-signed.elf
	mcopy -i $(IMG_AARCH64) /tmp/policy-service-signed.elf ::/boot/policy-service.elf
	mcopy -i $(IMG_AARCH64) /tmp/key-store-service-signed.elf ::/boot/key-store-service.elf
	mcopy -i $(IMG_AARCH64) /tmp/fs-service-signed.elf ::/boot/fs-service.elf
	mcopy -i $(IMG_AARCH64) /tmp/virtio-blk-signed.elf ::/boot/virtio-blk.elf
	mcopy -i $(IMG_AARCH64) /tmp/usb-host-signed.elf ::/boot/usb-host.elf
	mcopy -i $(IMG_AARCH64) /tmp/ccid-signed.elf ::/boot/ccid.elf
	mcopy -i $(IMG_AARCH64) /tmp/virtio-net-signed.elf ::/boot/virtio-net.elf
	mcopy -i $(IMG_AARCH64) /tmp/udp-stack-signed.elf ::/boot/udp-stack.elf
	mcopy -i $(IMG_AARCH64) /tmp/scanout-virtio-gpu-signed.elf ::/boot/scanout-virtio-gpu.elf
	mcopy -i $(IMG_AARCH64) /tmp/virtio-input-signed.elf ::/boot/virtio-input.elf
	mcopy -i $(IMG_AARCH64) /tmp/compositor-signed.elf ::/boot/compositor.elf
	mcopy -i $(IMG_AARCH64) /tmp/terminal-window-signed.elf ::/boot/terminal-window.elf
	mcopy -i $(IMG_AARCH64) /tmp/tree-signed.elf ::/boot/tree.elf
	mcopy -i $(IMG_AARCH64) /tmp/worm-signed.elf ::/boot/worm.elf
	mcopy -i $(IMG_AARCH64) /tmp/ping-signed.elf ::/boot/ping.elf
	mcopy -i $(IMG_AARCH64) /tmp/sprouty-signed.elf ::/boot/sprouty.elf
	mcopy -i $(IMG_AARCH64) /tmp/shell-signed.elf ::/boot/shell.elf
	mcopy -i $(IMG_AARCH64) /tmp/audit-tail-signed.elf ::/boot/audit-tail.elf
	rm -f /tmp/policy-service-signed.elf /tmp/key-store-service-signed.elf /tmp/fs-service-signed.elf /tmp/virtio-blk-signed.elf /tmp/usb-host-signed.elf /tmp/ccid-signed.elf /tmp/virtio-net-signed.elf /tmp/udp-stack-signed.elf /tmp/scanout-virtio-gpu-signed.elf /tmp/virtio-input-signed.elf /tmp/compositor-signed.elf /tmp/terminal-window-signed.elf /tmp/tree-signed.elf /tmp/worm-signed.elf /tmp/ping-signed.elf /tmp/sprouty-signed.elf /tmp/shell-signed.elf /tmp/audit-tail-signed.elf
	mcopy -i $(IMG_AARCH64) limine-aarch64.conf ::/limine.conf
	mcopy -i $(IMG_AARCH64) limine-aarch64.conf ::/boot/limine/limine.conf
	@echo "=== $(IMG_AARCH64) ready ==="

# Serial-only run (no virtio-gpu device attached). Matches the pre-GUI
# aarch64 flow; the kernel + shell still boot, just with no scanout
# device for the compositor to bind to — compositor's handshake blocks
# indefinitely, which is expected in this mode.
run-aarch64: img-aarch64
	qemu-system-aarch64 \
		-machine virt,gic-version=3 \
		-cpu cortex-a72 \
		-smp 2 \
		-m 4G \
		-serial mon:stdio \
		-display none \
		-device qemu-xhci,id=xhci0 \
		-device usb-ccid,bus=xhci0.0 \
		-no-reboot \
		-bios $(EFI_FW_AARCH64) \
		-drive file=$(IMG_AARCH64),format=raw

# GUI-on-aarch64 run: attaches virtio-gpu-pci as the scanout carrier and
# virtio-keyboard-pci as an input carrier. The kernel's ECAM enumerator
# (src/pci/mod.rs `mod ecam`) discovers both; scanout-virtio-gpu +
# virtio-input + compositor + worm bind through them. `-display cocoa`
# opens a macOS window; on Linux swap for `-display gtk` or `sdl`.
run-aarch64-gui: img-aarch64
	qemu-system-aarch64 \
		-machine virt,gic-version=3 \
		-cpu cortex-a72 \
		-smp 2 \
		-m 4G \
		-serial mon:stdio \
		-display cocoa \
		-device virtio-gpu-pci \
		-device virtio-keyboard-pci \
		-device qemu-xhci,id=xhci0 \
		-device usb-ccid,bus=xhci0.0 \
		-no-reboot \
		-bios $(EFI_FW_AARCH64) \
		-drive file=$(IMG_AARCH64),format=raw

# ---------------------------------------------------------------------------
# RISC-V (riscv64gc) targets — Phase R-N (see docs/adr/013, plan file)
#
# Bootloader model: OpenSBI (M-mode) ships with QEMU via `-bios default`
# and hands control to our kernel in S-mode. The kernel's S-mode boot
# stub (src/boot/riscv.rs — Phase R-1) parses the DTB that OpenSBI
# passes in a1 and populates BootInfo. No Limine on RISC-V.
#
# Per the approved plan, hardware is TBD (CambiOS-designed); development
# target is QEMU `-machine virt` as the canonical standards-compliant
# RISC-V machine (NS16550 UART at 0x10000000, PLIC, CLINT, virtio-mmio).
# ---------------------------------------------------------------------------
KERNEL_RISCV64 := target/riscv64gc-unknown-none-elf/release/cambios_microkernel

kernel-riscv64:
	cargo build --target riscv64gc-unknown-none-elf --release

# Build + sign all RISC-V boot modules and pack them into the initrd the
# kernel parses at boot (see src/boot/initrd.rs + src/boot/riscv.rs
# /chosen walker). Produces $(INITRD_RISCV64) in the repo root; QEMU
# passes this via `-initrd`.
#
# Deferred: terminal-window (the GUI shell host) is intentionally NOT in
# the riscv64 initrd. It calls `GuiBackend::open()` before
# `sys::module_ready()`, which would block indefinitely on RISC-V because
# the riscv64 initrd ships no compositor / scanout-virtio-gpu /
# virtio-input — the boot-module release chain would stall and `shell`
# (downstream) would never start. The crate itself builds cleanly via
# `terminal-window-riscv64` so `make check-all` stays green.
# Why: HN demo target is x86_64 + aarch64 only (per plan
# `~/.claude/plans/hi-let-s-talk-about-scalable-sketch.md` § Verification:
# "RISC-V GUI parity is post-HN").
# Revisit when: compositor + scanout-virtio-gpu + virtio-input are
# shipping in the riscv64 initrd (i.e., when GUI parity for riscv64
# becomes a goal). At that point: add terminal-window-riscv64 to the
# img-riscv64 deps, copy + sign + --module here, and pick the right
# slot in BOOT_MODULE_ORDER (between compositor's last GUI dep and
# shell, mirroring x86_64).
img-riscv64: policy-service-riscv64 key-store-service-riscv64 fs-service-riscv64 virtio-blk-riscv64 usb-host-riscv64 ccid-riscv64 virtio-net-riscv64 udp-stack-riscv64 shell-riscv64 audit-tail-riscv64 sign-tool mkinitrd
	@echo "=== Building RISC-V initrd (signing mode: $(SIGN_MODE)) ==="
	rm -rf initrd_root_riscv64
	mkdir -p initrd_root_riscv64
	cp $(POLICY_SERVICE_ELF_RISCV64) initrd_root_riscv64/policy-service.elf
	cp $(KS_SERVICE_ELF_RISCV64)     initrd_root_riscv64/key-store-service.elf
	cp $(FS_SERVICE_ELF_RISCV64)     initrd_root_riscv64/fs-service.elf
	cp $(BLK_DRIVER_ELF_RISCV64)     initrd_root_riscv64/virtio-blk.elf
	cp $(USB_HOST_ELF_RISCV64)       initrd_root_riscv64/usb-host.elf
	cp $(CCID_ELF_RISCV64)           initrd_root_riscv64/ccid.elf
	cp $(NET_DRIVER_ELF_RISCV64)     initrd_root_riscv64/virtio-net.elf
	cp $(UDP_STACK_ELF_RISCV64)      initrd_root_riscv64/udp-stack.elf
	cp $(SHELL_ELF_RISCV64)          initrd_root_riscv64/shell.elf
	cp $(AUDIT_TAIL_ELF_RISCV64)     initrd_root_riscv64/audit-tail.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/policy-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/key-store-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/fs-service.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/virtio-blk.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/usb-host.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/ccid.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/virtio-net.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/udp-stack.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/shell.elf
	$(SIGN_ELF) $(SIGN_FLAGS) initrd_root_riscv64/audit-tail.elf
	# Module order matches limine.conf on x86_64/aarch64 — the kernel's
	# BOOT_MODULE_ORDER release chain is positional, so the service
	# roster must be identical across arches (future ADR-018 manifest
	# will make this explicit).
	$(MKINITRD) --out $(INITRD_RISCV64) \
		--module policy-service=initrd_root_riscv64/policy-service.elf \
		--module key-store-service=initrd_root_riscv64/key-store-service.elf \
		--module fs-service=initrd_root_riscv64/fs-service.elf \
		--module virtio-blk=initrd_root_riscv64/virtio-blk.elf \
		--module usb-host=initrd_root_riscv64/usb-host.elf \
		--module ccid=initrd_root_riscv64/ccid.elf \
		--module virtio-net=initrd_root_riscv64/virtio-net.elf \
		--module udp-stack=initrd_root_riscv64/udp-stack.elf \
		--module audit-tail=initrd_root_riscv64/audit-tail.elf \
		--module shell=initrd_root_riscv64/shell.elf
	rm -rf initrd_root_riscv64
	@echo "=== $(INITRD_RISCV64) ready ==="

# Boot the RISC-V kernel in QEMU virt under OpenSBI, with the R-6
# signed boot modules delivered through -initrd.
run-riscv64: kernel-riscv64 img-riscv64
	qemu-system-riscv64 \
		-machine virt \
		-cpu rv64 \
		-smp 2 \
		-m 4G \
		-serial mon:stdio \
		-display none \
		-device qemu-xhci,id=xhci0 \
		-device usb-ccid,bus=xhci0.0 \
		-no-reboot \
		-bios default \
		-kernel $(KERNEL_RISCV64) \
		-initrd $(INITRD_RISCV64)

# ---------------------------------------------------------------------------
# Tri-architecture regression gate. Any commit that breaks any arch is
# blocked. Tracks ADR-013's "Tri-Architecture Regression Discipline".
#
# R-6 landed 2026-04-19 — riscv64 now boots to shell end-to-end under
# QEMU virt. check-all is the permanent gate; check-stable is retained
# only as an escape hatch for future temporary backend breakage during
# deep refactors.
#
#   - check-all: x86_64 + aarch64 + riscv64. The gate every commit
#     must pass.
#
#   - check-stable: x86_64 + aarch64 only. Use ONLY when deliberately
#     in the middle of a refactor that intentionally breaks riscv64,
#     and name the fact in the commit message.
#
# The discipline is the same either way — no commits that regress any
# *currently buildable* architecture.
# ---------------------------------------------------------------------------
check-all: check-x86 check-aarch64 check-riscv64
	@echo "=== All three architectures build cleanly ==="

check-stable: check-x86 check-aarch64
	@echo "=== x86_64 + aarch64 build cleanly (RISC-V intentionally excluded — see Makefile comment) ==="

check-x86:
	cargo build --target x86_64-unknown-none --release

check-aarch64:
	cargo build --target aarch64-unknown-none --release

check-riscv64:
	cargo build --target riscv64gc-unknown-none-elf --release

# ---------------------------------------------------------------------------
# Fuzzing — Tier 1 step B (~/.claude/plans/scope-tier-2-also-prancy-manatee.md)
#
# x86_64-apple-darwin matches `cargo test --lib`'s host triple and avoids
# the aarch64 backend's inline asm that references labels in
# `cfg(not(any(test, fuzzing)))` global_asm blocks. Switching to an
# aarch64 host (default on Apple Silicon) requires `fuzz_asm_stubs` for
# the aarch64 backend — currently only the x86_64 backend has those.
#
# `make fuzz-syscall-dispatcher` smoke-runs for 60 s; pass extra
# libfuzzer args via FUZZ_ARGS, e.g.
#   make fuzz-syscall-dispatcher FUZZ_ARGS="-max_total_time=86400"
# for a 24 h run.
.PHONY: fuzz-build fuzz-syscall-dispatcher
FUZZ_ARGS ?= -max_total_time=60 -print_final_stats=1
fuzz-build:
	cargo +nightly fuzz build --fuzz-dir fuzz --target x86_64-apple-darwin

fuzz-syscall-dispatcher:
	cargo +nightly fuzz run --fuzz-dir fuzz --target x86_64-apple-darwin \
		fuzz_syscall_dispatcher -- $(FUZZ_ARGS)

# ---------------------------------------------------------------------------
# Kani proofs — Tier 1 step D (UserSlice invariants) plus the four prior
# proof crates. Each proof crate is workspace-excluded; cargo-kani uses its
# own pinned nightly toolchain. Run individual proof crates from this
# wrapper rather than `cd`-ing into each one.
.PHONY: verify-userslice verify-capability verify-elf verify-frame verify-buddy verify-all
verify-userslice:
	cd verification/userslice-proofs && cargo kani

verify-capability:
	cd verification/capability-proofs && cargo kani

verify-elf:
	cd verification/elf-proofs && cargo kani

verify-frame:
	cd verification/frame-proofs && cargo kani

verify-buddy:
	cd verification/buddy-proofs && cargo kani

verify-all: verify-buddy verify-elf verify-frame verify-capability verify-userslice
	@echo "=== All proof crates verified ==="

clean:
	cargo clean
	rm -f $(ISO) $(IMG_X86) $(IMG_AARCH64) $(INITRD_RISCV64)
	rm -rf iso_root initrd_root_riscv64