forjar 1.20.1

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation
# forjar - Rust CLI Binary Makefile
# Generated by Pragmatic AI Labs MCP Agent Toolkit (pmat)

.PHONY: all check format lint test test-fast bench bench-update build build-release run clean install help coverage audit deny doc-test

# Default target: run all checks and build
all: format check lint test build

# Type check the code
check:
	cargo check

# Format code with rustfmt
format:
	cargo fmt --all

# Lint with clippy
lint:
	cargo clippy --all-targets -- -D warnings

# Run tests
test:
	cargo test

# Run fast tests (lib only, no integration tests)
test-fast:
	cargo test --lib

# Run benchmarks (Criterion, 95% confidence intervals)
bench:
	cargo bench

# Run benchmarks and update benchmarks/RESULTS.md
bench-update:
	cargo run --release --bin forjar -- bench --iterations 1000 --json \
		| python3 scripts/bench_update.py > benchmarks/RESULTS.md

# Build debug binary
build:
	cargo build

# Build release binary
build-release:
	cargo build --release

# Run the application
run:
	cargo run

# Clean build artifacts
clean:
	cargo clean

# Install the binary to cargo bin directory
install: build-release
	cargo install --path .

# Run coverage analysis
coverage:
	cargo llvm-cov --summary-only --fail-under-lines 95

.PHONY: coverage-check
coverage-check:
	@# The name the pre-release protocol looks for, and the gate it enforces.
	@#
	@# The floor is enforced by llvm-cov ITSELF via --fail-under-lines, never by
	@# parsing a percentage in shell. The protocol warns about precisely that
	@# shape, having watched it print a pass on a broken run:
	@#
	@#     if [ -n "$$COV" ] && [ "$$COV" -lt 95 ]; then fail; else PASS; fi
	@#
	@# An EMPTY percentage — broken instrumentation, a changed summary format,
	@# anything that stops TOTAL parsing — takes the else branch and reports
	@# success. Here an unmeasurable run is a non-zero exit from the tool that
	@# did the measuring, so "unmeasured" and "met" cannot be confused.
	@#
	@# No `|| true` on this line, and none on anything that produces the
	@# measurement: that is the other half of the same defect.
	cargo llvm-cov --summary-only --fail-under-lines 95

# Run security audit
audit:
	cargo audit
	cargo deny check

# Run doc tests
doc-test:
	cargo test --doc

# Show help
help:
	@echo "forjar - Available targets:"
	@echo "  all           - Run format, check, lint, test, and build"
	@echo "  check         - Type check the code"
	@echo "  format        - Format code with rustfmt"
	@echo "  lint          - Run clippy linter"
	@echo "  test          - Run tests"
	@echo "  test-fast     - Run fast tests (lib only)"
	@echo "  bench         - Run benchmarks"
	@echo "  bench-update  - Run benchmarks and update benchmarks/RESULTS.md"
	@echo "  build         - Build debug binary"
	@echo "  build-release - Build optimized release binary"
	@echo "  run           - Run the application"
	@echo "  clean         - Remove build artifacts"
	@echo "  install       - Install the binary"
	@echo "  coverage      - Run coverage analysis (95% minimum)"
	@echo "  coverage-check - Enforce the 95% floor (pre-release gate)"
	@echo "  audit         - Run security audit (cargo-audit + cargo-deny)"
	@echo "  doc-test      - Run documentation tests"
	@echo "  help          - Show this help message"

.PHONY: cb200-ratchet
cb200-ratchet:
	@# CB-200 (TDG Grade Gate) is a dated ratchet, not a suppression. The gate
	@# still reports the debt; this asserts it never GROWS. 61 was measured
	@# identical on origin/main and release/1.16.0 (2026-08-21), so this release
	@# introduced none of it. The count is COMPARED, not merely printed: a target
	@# that echoes a number is documentation, and documentation does not fail.
	@bash scripts/cb200-ratchet.sh