1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
:
PREFIX ?=
BIN_DIR :=
:
:
: # The disclosure scan (bl-816b, from the rust-bootstrap template):
# scripts/leak-rules.sh is the table, leak-scan.sh the mechanism. --self-test
# first, because a leak gate dies by silently matching nothing. A step of
# `check`, of the pre-commit chain and of ci.yml (bl-4423), and sub-second, so
# it runs before anything that compiles. The machine-global balls plugin
# bl-leak-gate runs this same scanner over the TASK STORE before every publish,
# and .github/workflows/store-scan.yml re-judges the published balls/tasks ref.
:
# THE blessed doc build (bl-3d09) — the only invocation this repo's docs are
# guaranteed warning-clean under, so it is the one to run and the one to trust.
#
# --document-private-items the docs are a connected map: a module note links
# to the private helper carrying the reasoning, so
# the private items must be in the rendered graph.
# -D warnings every rustdoc warning is an error. A broken link is
# a build failure, not a line lost in the scroll —
# which is the whole point (68 private-link warnings
# used to bury the real ones).
:
# The whole suite: core + every shipped sibling plugin. A core-only install
# leaves `bl` resolving no `bl-tracker`/`bl-delivery` beside it (Edge::resolve
# looks beside the bl binary), so `bl prime` founds stealth-only and federation
# silently never engages. Installing the plugins next to bl is what wires them.
:
# Seat one built binary in BIN_DIR WITHOUT ever truncating a running one.
# `install`(1) opens the destination `O_TRUNC`, which is ETXTBSY against a
# binary a fleet of agents is executing right now — and a `bl` that fails to
# install mid-fleet is every agent's claim and close, not just this one's.
# Write a temp name in the SAME directory and rename(2) it into place: an
# executing process keeps its own inode, and every later exec gets whole-new.
# The same move `scripts/deploy/seat.sh` and `cargo install` both make.
define seat_bin
endef
# Just the bl core binary + the `balls` alias.
: # Each plugin is a sibling binary dropped beside bl in BIN_DIR; that adjacency
# is the whole wiring (§6 subprocess-uniform, resolved by Edge::resolve).
: : # §10 guarded-mint primitive (opt-in). Shipped beside bl like any plugin; wire
# it per checkout with `bl conf prepend claim.post bl-chore`.
: # Verdict-cache edge (bl-1263, design bl-24e7). Consulted by scripts/pre-commit
# via PATH; fail-open, so installing it only ever removes redundant gate runs.
: :
# Continuous deployment for THIS box (bl-4316): seat the systemd user timer
# that reconciles `bl` and its plugin set against crates.io hourly, then run
# the first reconcile synchronously so seating ends with an answer rather than
# a promise. Local-only and deliberately so — `bl` is reached at a prompt, and
# the box somebody is sitting at cannot ssh to itself. Reasoning lives in
# `scripts/deploy/seat.sh` and README "Keeping this box current".
:
# A read: what is installed, what the registry offers, whether the timer is
# armed. Installs nothing.
:
# The real reconciler under fake curl/cargo shims, both directions. A step of
# `check`, because a reconciler that installs on every tick is as broken as one
# that never does and neither shows up in an exit code.
:
# Install the repo-local pre-commit hook (line-length + clippy + tests
# + 100% coverage). Run once per clone; not part of `make install`
# because a user installing the binary should not have hooks wired
# into whatever repo they happen to be in.
:
: