Taskfile.yml

# The repository entry point. Every gate below keeps the exact command
# sequence it had under the Makefile this replaced (#757); only the entry
# point changed.
#
# Descriptions live on the tasks, so go-task remains their source of truth.
# `task --list` emits the complete flat inventory; bare `task` and `task help`
# present that same JSON inventory in bounded contributor-facing groups. The
# Makefile carried three hand-maintained copies of the gate set — `.PHONY`,
# `VERIFY_TARGETS`, and a `help` printf block — none of which could disagree
# loudly. `clean` had already drifted out of the help block.
version: "3"

vars:
  KOFUN: ./bin/kofun

tasks:

  # #1424. `task task-help` proves a new task is *classified*; nothing proved
  # any task was ever *run*, and three gates I merged this week were classified,
  # green, and invoked by nothing. This is the missing counterpart.
  gate-reachability:
    desc: "Refuse a gate that verify, CI, another task, and every script all fail to run"
    cmds:
      - "node tooling/gate-reachability/check.mjs"

  graphify-setup:
    desc: "Install graphify and register its skill with Claude, Copilot and Codex"
    cmds:
      - "sh scripts/graphify.sh setup"

  graphify-update:
    desc: "Upgrade graphify, refresh the skill, and update the knowledge graph"
    cmds:
      - "sh scripts/graphify.sh update"

  # `default` deliberately has no desc, so the official `task --list` does not
  # show a redundant alias. The task-help gate permits this one hidden row and
  # requires every visible task to have a description and exactly one group.
  default:
    silent: true
    cmds:
      - task: help

  help:
    desc: "Show the grouped contributor task guide"
    silent: true
    cmds:
      - "node tooling/task-help.mjs"

  task-help:
    desc: "Verify grouped task help, descriptions, and complete classification"
    cmds:
      - "sh tests/tooling/task-help/check.sh"

  compiler:
    desc: "Build the Python-free Kofun compiler seed"
    cmds:
      - cmd: "{{.KOFUN}} --version"
        silent: true

  test:
    desc: "Exercise build/run/check/test"
    deps: [compiler]
    cmds:
      - "sh tests/cli.sh"
      - "sh tests/cli_stage2_outcomes.sh"
      - "sh tests/conformance/capabilities_test.sh"
      - "sh tests/conformance/modules/lexical-scopes/run.sh"
      - "sh tests/conformance/modules/shadowing/run.sh"
      - "{{.KOFUN}} test tests/conformance/numeric"
      - "{{.KOFUN}} test tests/conformance/functions"
      - "{{.KOFUN}} test tests/conformance/list"
      - "{{.KOFUN}} test tests/conformance/text"

  diagnostics:
    desc: "Verify must-fail diagnostic goldens"
    cmds:
      - "sh tests/diagnostics/run.sh"

  fuzz:
    desc: "Run deterministic grammar and semantic fuzz smoke tests"
    cmds:
      - "sh tests/fuzz/grammar.sh"
      - "sh tests/fuzz/semantic_protocol_test.sh"
      - "sh tests/fuzz/semantic_differential.sh"
      - "sh tests/fuzz/semantic_cold_toolchain_test.sh"
      - "sh tests/fuzz/value_if.sh"
      - "sh tests/fuzz/match_guard.sh"
      - "sh tests/fuzz/match_value.sh"
      - "sh tests/fuzz/match_value_invalid.sh"
      - "sh tests/fuzz/enum_match.sh"
      - "sh tests/fuzz/optional_narrowing.sh"
      - "sh tests/fuzz/visibility-artifacts.sh"

  unicode:
    desc: "Verify Unicode identifiers, security, text, and width"
    cmds:
      - "sh tests/unicode/run.sh"

  check:
    desc: "Check canonical bootstrap sources"
    deps: [compiler]
    cmds:
      - "{{.KOFUN}} check bootstrap/fixtures/answer.kofun"

  bootstrap:
    desc: "Verify the Stage 1 seed path"
    cmds:
      - "sh bootstrap/stage1/check.sh"

  selfhost-profile:
    desc: "Verify the frozen first self-host source profile"
    cmds:
      - "sh bootstrap/selfhost/check-profile.sh"
      - "sh bootstrap/selfhost/frontend/check-frontend.sh"
      - "sh bootstrap/selfhost/c11/check-c11.sh"

  selfhost-hir-identifiers:
    desc: "Prove selfhost HIR retains complete identifier spellings and spans"
    cmds:
      - "sh tests/selfhost-hir-identifiers/check.sh"

  selfhost-self-compile:
    desc: "Compile canonical S with A1 and verify deterministic strict-C11 C2"
    cmds:
      - "sh bootstrap/selfhost/check-compiler-driver.sh"

  selfhost-driver-diagnostics:
    desc: "Gate the 62-case Stage 1/A1 refusal contract"
    cmds:
      - "sh bootstrap/selfhost/check-driver-diagnostics.sh"

  # These two write their outputs under an explicit directory argument rather
  # than deriving one, so the repository's `KOFUN_GATE_WORK_NAMESPACE`
  # convention is applied here instead of inside the scripts — a caller that
  # sets it (spec/roadmap-31-34/verify-current-gates.sh does) still isolates
  # them.
  #
  # `run: once` so the fixed-point dependency and the aggregate `verify`
  # listing resolve to a single bundle build instead of two racing ones.
  selfhost-generations:
    desc: "Produce the C1/A1 and C2/A2 generations twice and gate reproducibility"
    run: once
    vars:
      BUNDLE: 'build/{{if .KOFUN_GATE_WORK_NAMESPACE}}{{.KOFUN_GATE_WORK_NAMESPACE}}/{{end}}selfhost-generations'
    cmds:
      - "sh bootstrap/selfhost/build-a1-a2.sh {{.BUNDLE}}"
      - "sh bootstrap/selfhost/check-a1-a2.sh {{.BUNDLE}}"

  # Consumes the bundle the dependency just produced and validated; the gate
  # re-validates it and writes only under its own output directory. Run
  # standalone (one argument) it rebuilds the bundle itself.
  selfhost-fixed-point:
    desc: "Prove the three-generation C11 fixed point: C2 == C3 and A2 == A3"
    deps: [selfhost-generations]
    vars:
      NAMESPACE: '{{if .KOFUN_GATE_WORK_NAMESPACE}}{{.KOFUN_GATE_WORK_NAMESPACE}}/{{end}}'
    cmds:
      - "sh bootstrap/selfhost/check-fixed-point.sh build/{{.NAMESPACE}}selfhost-fixed-point build/{{.NAMESPACE}}selfhost-generations"

  # B7 (#1136). The chain gates above pin artifacts against checked-in
  # evidence, and that evidence was recorded by one toolchain — so a payload
  # present when it was recorded is pinned along with it and reproduces
  # forever. This gate is the one that runs a toolchain which did not produce
  # the baseline. It does not close B6: both chains share a machine, a libc,
  # and a kernel.
  selfhost-diverse-double-compilation:
    desc: "Prove two diverse host C compilers build Kofun compilers that emit the same bytes"
    vars:
      NAMESPACE: '{{if .KOFUN_GATE_WORK_NAMESPACE}}{{.KOFUN_GATE_WORK_NAMESPACE}}/{{end}}'
    cmds:
      - "sh bootstrap/selfhost/check-diverse-double-compilation.sh build/{{.NAMESPACE}}selfhost-ddc"
      - "sh bootstrap/selfhost/check-diverse-double-compilation-refusals.sh build/{{.NAMESPACE}}selfhost-ddc-refusals"

  # The acquisition set an independent builder needs, and the two refusals that
  # keep it honest. This is the producer-owned half of B6 (#1114); the
  # reproduction by a builder that did not produce the evidence stays #274.
  #
  # The third command is the one that closes the direction the first two
  # cannot: they prove the manifest describes the checkout, and it proves the
  # manifest is enough to build from. Before it existed the set was accurate
  # and insufficient — 59 files declared, 70 needed.
  selfhost-declared-inputs:
    desc: "Declare every reproduction input, refuse drift, and prove the set is enough to rebuild from"
    vars:
      NAMESPACE: '{{if .KOFUN_GATE_WORK_NAMESPACE}}{{.KOFUN_GATE_WORK_NAMESPACE}}/{{end}}'
    cmds:
      - "sh bootstrap/selfhost/declare-inputs.sh build/{{.NAMESPACE}}selfhost-inputs"
      - "sh bootstrap/selfhost/check-declared-inputs.sh build/{{.NAMESPACE}}selfhost-inputs"
      - "sh bootstrap/selfhost/check-inputs-sufficient.sh build/{{.NAMESPACE}}selfhost-inputs"

  # The packet an independent builder is handed, and the validator a reviewer
  # runs on what comes back. Mechanics only: it records a builder's identity
  # and basis, states that it cannot authenticate them, and does not close B6.
  selfhost-b6-report:
    desc: "Run the delegated reproduction command and validate its canonical report"
    cmds:
      - "sh bootstrap/selfhost/check-b6-report.sh"

  # #1290. `selfhost-b6-report` answers "is this report well-formed"; this one
  # answers "does it qualify as a B6 attestation", which is a different
  # question with a different answer for the same file. The packet's own
  # report.tsv is valid and is refused here, and that refusal is the gate's
  # standing negative rather than a fixture that can rot.
  selfhost-b6-policy:
    desc: "Check the B6 independence policy and refuse reports that do not qualify as attestations"
    cmds:
      - "sh bootstrap/selfhost/check-b6-policy.sh"

  selfhost-b6-acquisition-identity:
    desc: "Prove the B6 acquisition identity is non-self-referential and policy-bound"
    cmds:
      - "sh bootstrap/selfhost/check-b6-policy.sh --identity-contract"

  # RFC-0001 stage 1. The canonical contract and its bounded Stage 2
  # projection, pinned against each other. The seed grants no capability;
  # the gate refuses one appearing.
  alloc-contract:
    desc: "Pin the canonical stdlib/alloc contract to its bounded Stage 2 projection"
    cmds:
      - "sh tests/stdlib/alloc/check.sh"




  selfhost-native:
    desc: "Prove the self-host Core reaches a native ELF via two backends"
    cmds:
      - "sh bootstrap/selfhost/native/check-native-corpus.sh"

  stage2:
    desc: "Verify the Stage 2 semantic frontend checkpoint"
    cmds:
      - "sh bootstrap/stage2/check.sh"

  # The path-log self-test runs FIRST and costs under a second: it exercises the
  # #1504 recorder directly instead of through a `stage2-events` run that builds
  # five binaries and drives four hundred companions. A check that can only run
  # inside a ten-minute gate is one nobody runs while changing what it checks.
  stage2-events:
    desc: "Verify bounded complete/partial semantic events"
    cmds:
      - "sh tests/typed-sidecar/path-log-self-test.sh"
      - "sh tests/typed-sidecar/stage2-events.sh"
      - "sh tests/typed-sidecar/stage2-event-stream.sh"

  patterns:
    desc: "Verify lossless general Pattern syntax trees"
    cmds:
      - "sh tests/conformance/patterns/run.sh"

  adt:
    desc: "Verify bounded nominal ADT typed frontend"
    cmds:
      - "sh tests/conformance/adt/run.sh"

  records:
    desc: "Verify bounded nominal records and the mixed C11 aggregate bridge"
    deps: [aggregate-bridge]
    cmds:
      - "sh tests/conformance/records/run.sh"

  aggregate-bridge:
    desc: "Prove the bounded mixed Text/List[Int]/Int record bridge in C11"
    run: once
    cmds:
      - "sh tests/conformance/aggregate-bridge/run.sh"

  generics:
    desc: "Verify explicit generic function typing"
    cmds:
      - "sh tests/conformance/generics/run.sh"

  const-generics:
    desc: "Verify literal Int type arguments and their per-literal identity"
    cmds:
      - "sh tests/conformance/const-generics/run.sh"

  hm-levels:
    desc: "Verify bounded Algorithm J inference for local lambdas"
    cmds:
      - "sh tests/conformance/inference/hm-levels/run.sh"
      - "KOFUN_HM_LEVELS_CASES=128 sh tests/fuzz/hm_levels.sh"

  effect-inference:
    desc: "Verify bounded pure/io inference across the Stage 2 call graph"
    cmds:
      - "sh tests/conformance/effects/pure-io/run.sh"
      - "KOFUN_PURE_IO_CASES=96 sh tests/fuzz/pure_io.sh"

  pure-boundary:
    desc: "Verify the source-level `pure fn` boundary over inferred effects"
    cmds:
      - "sh tests/conformance/effects/pure-boundary/run.sh"

  traits:
    desc: "Verify the bounded trait declaration frontend and dictionary shape"
    cmds:
      - "sh tests/conformance/traits/run.sh"

  trait-dictionary-c11:
    desc: "Execute the bounded one-method Equal[Int] dictionary in C11"
    cmds:
      - "sh tests/conformance/trait-dictionary-c11/run.sh"

  optional:
    desc: "Verify the bounded null/T? frontend"
    cmds:
      - "sh tests/conformance/optional/run.sh"

  optional-narrowing:
    desc: "Verify flow-sensitive narrowing of direct Optional bindings"
    cmds:
      - "sh tests/conformance/optional-narrowing/run.sh"

  optional-construction:
    desc: "Verify executable Optional(Int) construction and lowered narrowing"
    cmds:
      - "sh tests/conformance/optional-construction/run.sh"

  optional-coalescing:
    desc: "Verify lazy Optional(Int) coalescing in the Stage 2 C11 backend"
    cmds:
      - "sh tests/conformance/run.sh tests/conformance/optional-coalescing"
      - "sh tests/conformance/optional-coalescing/run.sh"

  optional-pair:
    desc: "Require Optional(Int) semantic-family parity in the canonical compiler pair"
    cmds:
      - "sh tests/stage2/optional-pair/run.sh"

  # #1662. The part of spec/result-propagation-v1.md Stage 2 reaches before a
  # `Result` type exists: postfix `?` parsed as a typed scope-HIR node and
  # refused as E2S189/E2S190/E2S191. #1250 adds the positive lowering here.
  result-propagation:
    desc: "Verify postfix ? parsing and the result-propagation refusals in the Stage 2 pair"
    cmds:
      - "sh tests/conformance/result-propagation/run.sh"

  text-results:
    desc: "Verify bounded Stage 2 Text results, conversion, and concatenation"
    cmds:
      - "sh tests/conformance/text-results/run.sh"

  # RFC-0013 (#1348). The eight bit operations on `Int`, spelled as postfix
  # methods. The gate is written so a wrong implementation produces a different
  # number rather than a crash: C leaves a shift by the operand width undefined
  # and a signed right shift implementation-defined, and the reason these were
  # named at all was to give them answers the language states.
  int-bits:
    desc: "Verify the eight Int bit operations, their traps, and their refusals"
    cmds:
      - "sh tests/conformance/int-bits/run.sh"

  # #1383. RFC-0013 step 3. The eight operations exist on the canonical pair
  # and nowhere else, and before this the other backends refused them without
  # saying so: the native wording named a `print` that was not the problem and
  # the wasm32 one named no token at all. This registers the operations as a
  # backend-differential corpus, so `capabilities.tsv` has to carry a row per
  # declared backend, and holds each `unsupported` row to an actual refusal
  # that names the operation.
  int-bits-lowering:
    desc: "Verify every declared backend lowers the eight Int bit operations or refuses them by name"
    cmds:
      - "sh tests/conformance/int-bits-lowering/check.sh"

  # #1174. Statement-position `else if` chains. The corpus exists mainly for
  # one property that a passing program cannot show: a later condition must be
  # evaluated only when every earlier one was false, so the gate puts a
  # trapping index in a later condition and requires the trap in exactly one of
  # two otherwise identical runs.
  else-if-chain:
    desc: "Execute else-if chains and prove later conditions are skipped"
    cmds:
      - "sh tests/stage2/else-if-chain/run.sh"

  # #1128. `while` became a Core statement, so an iterative scan over an
  # indexed List[Int] executes — binary search, linear search, two-pointer
  # walks. The corpus is bounded by a wall clock, because the regression this
  # slice can introduce is a loop that never returns rather than a wrong answer.
  while-list-int:
    desc: "Execute iterative while loops over an indexed List[Int]"
    cmds:
      - "sh tests/stage2/while-list-int/run.sh"

  list-int-values:
    desc: "Verify bounded Stage 2 List[Int] locals, len, and indexing"
    cmds:
      - "sh tests/stage2/list-int-values/run.sh"

  unused-function:
    desc: "Verify an uncalled function builds under the strict emitted-C flags"
    cmds:
      - "sh tests/stage2/unused-function/run.sh"

  text-escapes:
    desc: "Verify the closed Text literal escape set and its refusals"
    cmds:
      - "sh tests/stage2/text-escapes/run.sh"

  record-values:
    desc: "Verify a Stage 2 binding inferred from a record-returning call"
    cmds:
      - "sh tests/stage2/record-values/run.sh"

  list-int-signatures:
    desc: "Verify bounded Stage 2 List[Int] parameters and results"
    cmds:
      - "sh tests/stage2/list-int-signatures/run.sh"

  adt-exhaustiveness:
    desc: "Verify resolved flat-ADT match diagnostics"
    cmds:
      - "sh tests/conformance/adt-exhaustiveness/run.sh"

  adt-usefulness-v2:
    desc: "Verify the bounded recursive pattern-matrix usefulness oracle"
    cmds:
      - "sh tests/conformance/adt-usefulness-v2/run.sh"

  enum-match-value:
    desc: "Verify a concrete-enum match producing one Int in value position"
    cmds:
      - "sh tests/enum-match-value/check.sh"

  module-constants:
    desc: "Verify top-level integer module constants and their refusals"
    cmds:
      - "sh tests/module-constants/check.sh"

  # #1421. The producer for the inventory `imports_qualified` consumes. Nothing
  # computed those identities before it, which is why every conformance harness
  # writes `1111…` placeholders; the gate checks them against the specification's
  # own reference vector and runs a two-module program to a result.
  # #1422. `extern "C" fn` on the path a user runs: resolve, emit a prototype
  # the linker satisfies, link a real library, run. The trust half is gated by
  # `raw-imports`; this one exists because evidence collected under a
  # conformance harness is evidence about a different program.
  extern-c:
    desc: "Link and run an extern \"C\" module program through bin/kofun"
    cmds:
      - "sh tests/modules/extern-c/check.sh"

  module-inventory:
    desc: "Check inventory identities against the specification and resolve a two-module program"
    cmds:
      - "sh tests/modules/inventory/check.sh"

  module-symbols:
    desc: "Verify stable top-level declaration collection"
    cmds:
      - "sh tests/conformance/modules/top-level-declarations/run.sh"

  imports-qualified:
    desc: "Verify qualified same-package module imports"
    cmds:
      - "sh tests/conformance/modules/imports-qualified/run.sh"

  import-aliases:
    desc: "Verify local aliases for qualified module imports"
    cmds:
      - "sh tests/conformance/modules/import-aliases/run.sh"

  # #1215. RFC-0012 step 3. Admission across a trust boundary: a `raw-foreign`
  # module is reachable only through `trusted import`, and the marker is
  # refused on an ordinary module so it cannot become decorative. The decision
  # is taken from the serialized trust class and the resolved ModuleId.
  # #1216. RFC-0012 step 4. A facade may export what it owns; it may not pass a
  # raw-foreign origin on. Transitive by induction: every link is checked where
  # it is written, so a chain ending in raw is refused at its first link.
  raw-re-exports:
    desc: "Verify every re-export of a raw-foreign origin is refused"
    cmds:
      - "sh tests/conformance/modules/raw-re-exports/run.sh"

  raw-imports:
    desc: "Verify trusted and ordinary imports of a raw-foreign module"
    cmds:
      - "sh tests/conformance/modules/raw-imports/run.sh"

  imports-selective:
    desc: "Verify selective same-package name imports"
    cmds:
      - "sh tests/conformance/modules/imports-selective/run.sh"

  re-exports:
    desc: "Verify explicit public facade forwarding and KIF facts"
    cmds:
      - "sh tests/conformance/modules/re-exports/run.sh"

  kif-v1:
    desc: "Verify authoritative compiled interfaces"
    cmds:
      - "sh tests/conformance/modules/kif-v1/run.sh"

  kif-generics-codec:
    desc: "Verify the KIF generics v3 codec, corpus, and adversarial model"
    cmds:
      - "sh spec/kif-generics-v1/check.sh"

  stage2-kif-producer:
    desc: "Verify committed Stage 2 declarations publish KIF"
    cmds:
      - "sh tests/conformance/modules/stage2-kif-producer/run.sh"

  visibility-filtering:
    desc: "Verify compiler-produced public and package-internal KIF views"
    cmds:
      - "sh tests/interfaces/visibility-filtering.sh"

  visibility-api-leaks:
    desc: "Verify source-located API visibility leak diagnostics"
    cmds:
      - "sh tests/diagnostics/visibility-api-leaks.sh"

  module-interface-artifact:
    desc: "Verify hidden interface identities fail closed"
    cmds:
      - "sh tests/security/module-interface-artifact.sh"

  incremental:
    desc: "Verify semantic invalidation and reuse decisions"
    cmds:
      - "sh tests/conformance/incremental/run.sh"

  decimal:
    desc: "Verify native Decimal runtime, rounding, formatting, and stdlib"
    cmds:
      - "sh tests/conformance/decimal/run.sh"
      - "sh stdlib/decimal/tests/verify.sh"

  decimal-arithmetic:
    desc: "Verify Stage 2 C11 Decimal/Float arithmetic and rounding"
    cmds:
      - "sh tests/conformance/run.sh tests/conformance/decimal-arithmetic"

  decimal-fixed-runtime:
    desc: "Verify Fixed[S] runtime construct, clone, move, and drop under allocation refusal"
    cmds:
      - "sh tests/conformance/decimal-fixed/runtime/check.sh"

  date-time:
    desc: "Verify bounded date/time values, failures, arithmetic, and RFC 3339"
    cmds:
      - "sh stdlib/date_time/tests/verify.sh"

  tzdb:
    desc: "Verify bounded injected-Bytes tzdb lookup, gap/fold resolution, and provenance"
    cmds:
      - "sh tests/stdlib/tzdb/check.sh"

  discovery:
    desc: "Verify the developer discovery v1 request/result contract"
    cmds:
      - "sh tests/conformance/discovery/run.sh"

  discovery-sanitizer-reuse:
    desc: "Verify discovery-private ASan/UBSan object reuse and argv census"
    cmds:
      - "sh tests/tooling/discovery-sanitizer-reuse/check.sh"

  stage1-adapter:
    desc: "Verify the c11-stage1 conformance backend runs only the Stage 1 seed"
    cmds:
      - "sh tests/conformance/stage1-adapter/check.sh"

  native:
    desc: "Build and execute the Kofun-emitted ELF64 fixture"
    cmds:
      - "sh bootstrap/native/check.sh"

  native-host-evidence:
    desc: "Verify the pinned six-target matching-host observations"
    cmds:
      - "sh tests/native-host-evidence/check.sh"

  wasm:
    desc: "Build and execute the wasm32 arithmetic Core"
    cmds:
      - "sh bootstrap/wasm/check.sh"

  examples:
    desc: "Verify every example is bound to the check that owns it"
    cmds:
      - "sh examples/check.sh"

  tour:
    desc: "Verify the no-install browser learning tour"
    cmds:
      - "sh docs/tour/check.sh"

  c-abi:
    desc: "Verify explicit dynamic C ABI interoperability"
    cmds:
      - "sh bootstrap/c_abi/check.sh"

  bindgen-c:
    desc: "Verify audited raw C bindings generated from the Clang AST"
    cmds:
      - "sh tests/interop/bindgen-c/check.sh"

  bindgen-c-import-boundary:
    desc: "Verify generated raw bindings are reachable only through a reviewed facade"
    cmds:
      - "sh tests/interop/bindgen-c/import-boundary/run.sh"

  optional-tool-skips:
    desc: "Verify the readelf-dependent gates announce a skip or refuse by name"
    cmds:
      - "sh tests/tooling/optional-tool-skips/check.sh"

  rust-shim:
    desc: "Verify the vendored Rust crate shim offline"
    cmds:
      - "sh examples/rust-shim/check.sh"

  http:
    desc: "Verify the first-party HTTP/API framework"
    cmds:
      - "sh tests/http/check.sh"

  # The client-side reference model for #644. Executable specification evidence
  # over a scripted transport: no socket, no capability, and no claim that a
  # client exists.
  http-client-model:
    desc: "Verify the deterministic HTTP/1.1 reference model and its corpus"
    cmds:
      - "sh tests/http/client-model/run.sh"

  cli-framework:
    desc: "Verify the direct-static native CLI framework"
    cmds:
      - "sh framework/cli/check.sh"

  tui-framework:
    desc: "Verify the shared terminal UI framework"
    cmds:
      - "sh framework/tui/check.sh"

  stdlib:
    desc: "Verify the Kofun syscall/stdlib contracts"
    cmds:
      - "sh stdlib/tests/verify.sh"

  kotest:
    desc: "Verify the kotest unit-test framework, runner, and stdlib samples"
    cmds:
      - "sh tests/stdlib/kotest/check.sh"

  clock-adapters:
    desc: "Verify explicit clock identities, fake time, and Linux integration"
    cmds:
      - "sh tests/stdlib/clock-adapters/check.sh"
      - "sh tests/stdlib/clock-adapters/check-linux-x86_64.sh"

  scoped-parallelism:
    desc: "Verify the scoped spawn/join ownership contract and its bounded model"
    cmds:
      - "sh spec/concurrency/scoped-parallelism-v1/check.sh"

  concurrency-hir:
    desc: "Verify production scoped-parallel identities in the analysis-only HIR v2"
    cmds:
      - "node tests/concurrency/hir/check.mjs"

  concurrency-places:
    desc: "Verify compiler-resolved checked places, slice bounds and explicit unknowns"
    cmds:
      - "node tests/concurrency/places/check.mjs"

  concurrency-captures:
    desc: "Verify checked call summaries, recursive capture propagation and actual-place substitution"
    cmds:
      - "node tests/concurrency/captures/check.mjs"

  concurrency-captures-direct:
    desc: "Verify checked lexical captures, ownership modes, source origins and bounds"
    cmds:
      - "node tests/concurrency/captures-direct/check.mjs"

  concurrency-capture-events:
    desc: "Verify compiler capture facts through complete KSE2 transactions into typed-sidecar v2"
    cmds:
      - "node tests/concurrency/capture-events/check.mjs"

  concurrency-ownership:
    desc: "Verify production scoped-parallel ownership decisions against the accepted model"
    cmds:
      - "sh tests/conformance/concurrency/ownership/run.sh"

  concurrency-runtime:
    desc: "Verify the scoped-parallel scheduler, scope-exit drain, and panic precedence under ThreadSanitizer"
    cmds:
      - "sh tests/conformance/concurrency/runtime/run.sh"

  concurrency-capture-contract:
    desc: "Verify the versioned scoped-capture HIR, KSE2, and sidecar contract"
    cmds:
      - "sh spec/concurrency/scoped-captures-v1/check.sh"

  schedule-trace:
    desc: "Verify deterministic scoped-concurrency schedule traces and replay"
    cmds:
      - "sh spec/concurrency/schedule-trace/check.sh"

  type-reduction-trace:
    desc: "Verify deterministic type-level reduction traces and replay"
    cmds:
      - "sh spec/type-reduction-trace/check.sh"

  affine-resumption:
    desc: "Verify the one-shot affine-resumption contract and runtime backstop"
    cmds:
      - "sh spec/effects/affine-resumption/check.sh"

  affine-resource-handle:
    desc: "Verify the bounded affine resource-handle protocol and runtime backstop"
    cmds:
      - "sh tests/ownership/affine-resource-handle/check.sh"

  example-law-evidence:
    desc: "Bind example law evidence to its exact source and honest status"
    cmds:
      - "sh examples/check-law-evidence.sh"

  benchmark-summary:
    desc: "Verify deterministic benchmark quantiles and MAD"
    cmds:
      - "sh tests/stdlib/benchmark-summary/check.sh"

  benchmark-report:
    desc: "Verify the bounded C11 benchmark report model, Bytes codec, comparison, and production composition"
    cmds:
      - task: benchmark-report-spec
      - task: benchmark-report-model
      - task: benchmark-report-codec
      - task: benchmark-report-comparison
      - "sh tests/stdlib/benchmark-report/check.sh"

  benchmark-report-spec:
    desc: "Verify the canonical benchmark-report v1 contract and vectors"
    cmds:
      - "sh spec/benchmark-report-v1/check.sh"

  benchmark-report-model:
    desc: "Verify the bounded benchmark report model, segments, and refusals"
    cmds:
      - "sh tests/stdlib/benchmark-report-model/check.sh"

  benchmark-report-codec:
    desc: "Verify canonical benchmark report Bytes, exact outcomes, and transactional encoding"
    cmds:
      - "sh tests/stdlib/benchmark-report-codec/check.sh"

  kofun-digest-model:
    desc: "Verify SHA-256 in Kofun against NIST vectors and the C oracle"
    cmds:
      - "sh tests/stdlib/kofun-digest-model/check.sh"

  # The model above proves a Kofun SHA-256 exists. This proves the compiler
  # can reach one: the digest now lives in both halves of the Stage 2 pair
  # and in `sha256.c`, and three copies are safe only while something
  # compares them.
  sha256-pair:
    desc: "Verify both halves of the Stage 2 pair digest identically to the C oracle"
    cmds:
      - "sh tests/stage2/sha256-pair/check.sh"

  benchmark-report-comparison:
    desc: "Verify deterministic threshold comparison, rounding, and precedence"
    cmds:
      - "sh tests/stdlib/benchmark-report-model/compare.sh"

  move-assertion:
    desc: "Verify the unstable compile-time move assertion and its erasure"
    cmds:
      - "sh tests/move-assertion/check.sh"

  usability-corpus:
    desc: "Verify the usability comparison corpus and its review rubric"
    cmds:
      - "sh tests/usability/check.sh"

  preflight:
    desc: "Report every structural obligation a new task or fixture carries, in one run"
    cmds:
      # The self-test first: a preflight that could not refuse would report
      # `PASS` for six obligations it had stopped checking, which is worse than
      # not having one. It writes into its own scratch directory, not `build/`.
      - "sh tests/preflight/check.sh --prove"
      - "sh tests/preflight/check.sh"

  capabilities:
    desc: "Verify the standard library capability matrix states and evidence"
    cmds:
      - "sh stdlib/check-capabilities.sh"

  build-system:
    desc: "Verify direct/Frost builds and shared Stage 2 compiler reuse"
    cmds:
      - "sh tests/build_system.sh"
      - "sh tests/tooling/stage2-build-reuse/check.sh"

  verify-object-reuse:
    desc: "Verify runner-scoped semantic and strict-O2 common object reuse"
    cmds:
      - "sh tests/tooling/verify-object-reuse/check.sh"

  compile-census:
    desc: "Assert the repeated-compile count of a full run against its ledger"
    cmds:
      - "sh tooling/compile-census/check.sh"

  fuzz-sanitizer-reuse:
    desc: "Verify runner-scoped fuzz sanitizer compiler object reuse"
    cmds:
      - "sh tests/tooling/fuzz-sanitizer-reuse/check.sh"

  packages:
    desc: "Verify locked package fetch and offline use"
    cmds:
      - "sh tests/package_manager.sh"

  package-roots:
    desc: "Verify package-root specification examples"
    cmds:
      - "sh spec/package-roots/check.sh"

  source-file-mapping:
    desc: "Verify source/module identity examples"
    cmds:
      - "sh spec/source-file-mapping/check.sh"

  namespaces:
    desc: "Verify semantic namespace and lookup examples"
    cmds:
      - "sh spec/namespaces/check.sh"

  module-identity:
    desc: "Verify stable IDs and interface digest examples"
    cmds:
      - "sh spec/module-identity/check.sh"

  semantic-identity:
    desc: "Verify bounded typed-Core identities, caches, and structural diffs"
    cmds:
      - "sh spec/semantic-identity/check.sh"

  visibility-spec:
    desc: "Verify declaration-visibility specification examples"
    cmds:
      - "sh spec/visibility/check.sh"

  visibility-syntax:
    desc: "Verify executable function visibility syntax"
    cmds:
      - "sh tests/conformance/modules/visibility-syntax/run.sh"

  visibility-access:
    desc: "Verify identity-only visibility enforcement"
    cmds:
      - "sh tests/conformance/modules/visibility-access/run.sh"

  re-exports-spec:
    desc: "Verify explicit non-widening re-export design"
    cmds:
      - "sh spec/re-exports/check.sh"

  aggregate-layout:
    desc: "Verify AggregateLayout v1 descriptors and vectors"
    cmds:
      - "sh spec/aggregate-layout-v1/check.sh"

  reuse-candidate:
    desc: "Verify ReuseCandidate v1 layout and uniqueness evidence"
    cmds:
      - "sh spec/reuse-candidate-v1/check.sh"

  wasm-host-abi:
    desc: "Verify wasm32 host ABI v1 vectors and instantiation refusals"
    cmds:
      - "sh spec/wasm-host-abi-v1/check.sh"

  wasm-host-profile:
    desc: "Verify wasm32 host-profile activation and legacy ABI identification"
    cmds:
      - "sh spec/wasm-host-profile-v1/check.sh"

  # #1293. #1098 froze the host-facing side and deliberately left the source
  # side unstated. This is that side as a pure model: which checked operation
  # reaches which import, and how a program's imports are derived. No compiler
  # change and no runtime.
  wasi-command-projection-contract:
    desc: "Check the wasm32-wasi-command1 source/runtime projection against its pure model"
    cmds:
      - "sh spec/wasi-command-projection-v1/check.sh"
  # #1317. The AtomicWriteAuthority contract as a pure model: no compiler
  # carrier, no runtime authority, no syscall. It exists before the
  # implementation so the reservation and one-shot rules can be mutated and
  # argued while changing them is still cheap.
  atomic-write-authority-contract:
    desc: "Check the AtomicWriteAuthority v1 profile against its pure state and reservation model"
    cmds:
      - "sh spec/atomic-write-authority-v1/check.sh"
  # #1294. The host matrix is a policy plus a manifest plus an offline
  # validator. It decides which two maintained hosts execute the profile; it
  # installs nothing and runs no module, which is a later child of #26.
  # #1281. The ten ADT match v2 decisions as an executable profile. Most of
  # them read as obviously right and have two plausible implementations, so
  # the model exists to make each one a thing a mutation can break. No
  # compiler change; #1282 and the later children implement against it.
  adt-match-v2-contract:
    desc: "Check the ADT match v2 profile against its pure model"
    cmds:
      - "sh spec/adt-match-v2/check.sh"

  wasi-host-matrix-policy:
    desc: "Validate the pinned wasm32-wasi-command1 host matrix and its refusals"
    cmds:
      - "sh spec/wasi-host-matrix-v1/check.sh"

  # #1296. The wasm32-wasi-command1 minimal command shape: exported memory,
  # `_start`, and — the load-bearing part — no import section at all, because
  # #1293's contract says a program reaching no checked operation emits none.
  # The gate decodes the binary, runs it on a Preview 1 host, and validates it
  # with #1098's own validator rather than my reading of the profile.
  wasi-command-backend-shell:
    desc: "Verify the wasm32-wasi-command1 command module shape, and run it on a Preview 1 host"
    cmds:
      - "sh tests/wasm/wasi-command/check.sh"

  # #1297. The adapter-private command memory the WASI operation slices hand
  # to Preview 1: byte sequences, pointer and iovec vectors, checked UTF-8
  # conversion, and the command-lifetime allocator. The gate drives the
  # runtime under a real engine with canaries, computes the layout three ways,
  # and shows each of four emitter seams caught by its own property. Not a
  # capability and not the public Bytes identity; no operation is implemented.
  wasi-command-memory:
    desc: "Verify the wasm32-wasi-command1 command-memory carriers, allocator, and UTF-8 conversion under the engine"
    cmds:
      - "sh tests/wasm/wasi-command-memory/check.sh"

  wasi-command-profile:
    desc: "Verify the reserved WASI command capability profile and reference host"
    cmds:
      - "sh spec/wasi-command-profile-v1/check.sh"

  native-toolchain-contract:
    desc: "Verify the Kofun-only native toolchain and all accepted decision profiles"
    # The contract states an end state and this check proves the contract still
    # says so. On its own that reads as progress toward a target nobody is
    # measuring (#1451), so the census of what the tree actually requires runs
    # with it and the two are reported together. `run: once` on the census means
    # naming it here and in `verify` still runs it exactly once.
    deps: [forbidden-requirements-census]
    cmds:
      - "sh spec/native-toolchain-v1/check.sh all"

  forbidden-requirements-census:
    desc: "Census every forbidden core build requirement in use, failing in both directions"
    run: once
    cmds:
      - "node tooling/forbidden-requirements/self-test.mjs"
      - "node tooling/forbidden-requirements/check.mjs"

  # #1472. The sibling census, for a different property: not what the build
  # requires, but which of its bounds can change their answer because the box
  # is busy. Both fail in both directions, and both report the number that
  # matters rather than the total.
  machine-dependent-bounds:
    desc: "Ledger every bound whose verdict can depend on the machine, failing in both directions"
    cmds:
      - "sh tooling/machine-dependent/check.sh"

  kif-module-trust-profile:
    desc: "Verify explicit ordinary/raw-foreign KIF module-trust bytes"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh kif-module-trust"

  environment-authority-compiler-contract:
    desc: "Verify the bounded environment authority compiler profile"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh environment-authority"

  host-process-authority-contract:
    desc: "Verify bounded process spawn, capture, wait, and authority decisions"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh process-authority"

  directory-authority-contract:
    desc: "Verify bounded directory enumeration and path authority decisions"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh directory-authority"

  stdlib-partial-target-support-decision:
    desc: "Verify universal portable rows and bounded target checkpoints remain distinct"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs stdlib-partial-target-support"

  workspace-upgrade-transaction-decision:
    desc: "Verify the single-file apply, recovery, authority, and undo decision"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs workspace-upgrade-transaction"

  process-capture-carrier-decision:
    desc: "Verify the bounded C11 process-capture carrier and termination decision"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs process-capture-carrier"

  directory-enumeration-carrier-decision:
    desc: "Verify the packed directory snapshot, provider, and Linux lookup decision"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs directory-enumeration-carrier"

  stage2-pair-refresh:
    desc: "Regenerate the Unicode projection, pair checksums, and manifest seed digest"
    cmds:
      - "node bootstrap/stage2/generate-xid.mjs"
      - "node bootstrap/stage2/generate-scoped-unicode.mjs"
      - "node bootstrap/stage2/refresh-pair.mjs"

  stage2-pair-host-primitives:
    desc: "Execute both Stage 2 halves across private Unicode and file-identity boundaries"
    cmds:
      - "node bootstrap/stage2/generate-xid.mjs --check"
      - "node tests/stage2/host-primitives/check.mjs"

  stage2-pair-host-primitives-decision:
    desc: "Verify compiler-private Unicode scalar and file-identity host primitives"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs stage2-pair-host-primitives"

  native-cli-action-binding-decision:
    desc: "Verify static typed native CLI action binding and publication"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs native-cli-action-binding"

  live-https-get-adapter-decision:
    desc: "Verify the bounded explicit-authority live HTTPS GET adapter decision"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs live-https-get-adapter"

  atomic-publish-if-absent-decision:
    desc: "Verify Linux no-replace atomic publication and ownership outcomes"
    cmds:
      - "node spec/decision-profiles-v1/check.mjs atomic-publish-if-absent"

  fixed-decimal-profile:
    desc: "Verify the Decimal-backed Fixed[S] carrier and conversion profile"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh fixed-decimal"

  decimal-backend-profiles:
    desc: "Verify Decimal/Float profiles for C11, direct ELF, and wasm"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh decimal-backends"

  http-carrier-profile:
    desc: "Verify the bounded generic HTTP/1.1 scripted carrier profile"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh http-carrier"

  generics-execution-profile:
    desc: "Verify rank-1 specialization and static dictionary decisions"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh generics"

  kif-generics-profile:
    desc: "Verify source-free KIF generics v3 records and boundaries"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh kif-generics"

  generic-proof-kernel-profile:
    desc: "Verify the trusted generic proof-kernel decision boundary"
    cmds:
      - "sh spec/native-toolchain-v1/check.sh generic-proof-kernel"

  wasm-object-arena:
    desc: "Verify the bounded wasm32-hostabi1 object arena and u64 headers"
    cmds:
      - "sh bootstrap/wasm/object_arena_check.sh"

  wasm-list-v1:
    desc: "Verify bounded wasm32-hostabi1 List values, indexing, and host output"
    cmds:
      - "sh tests/wasm-list-v1/check.sh"

  typed-sidecar-spec:
    desc: "Verify bounded complete/partial tooling artifacts"
    cmds:
      - "sh spec/typed-sidecar/check.sh"

  typed-sidecar-codec:
    desc: "Verify production reader/writer and atomic replacement"
    cmds:
      - "sh tests/typed-sidecar/codec.sh"
      - "sh tests/typed-sidecar/atomic-write.sh"
      - "sh tests/typed-sidecar/authority-boundary.sh"

  typed-sidecar-captures:
    desc: "Verify the KSE2 capture codec and typed-sidecar v2 capture projection"
    cmds:
      - "sh tests/typed-sidecar/captures.sh"

  typed-sidecar-projector:
    desc: "Verify Stage 2 event projection and single-file CLI emission"
    cmds:
      - "sh tests/typed-sidecar/stage2-projector.sh"
      - "sh tests/typed-sidecar/cli.sh"
      - "sh tests/typed-sidecar/producer-races.sh"

  upgrade-patch:
    desc: "Verify typed upgrade relations, frontiers, previews, and atomicity"
    cmds:
      - "sh spec/tooling/upgrade-patch/check.sh"

  documentation-index:
    desc: "Verify disclosure-safe typed-sidecar documentation indexes"
    cmds:
      - "sh tests/docs/documentation-index.sh"

  # Holds the prose surfaces against the roadmap (#1138): while "audited
  # bootstrap chain" is an open M4 deliverable, no document may describe the
  # bootstrap artifacts as already audited. Closing the deliverable relaxes the
  # gate in the same commit, so the two cannot drift apart again.
  audited-claim:
    desc: "Refuse an audited-bootstrap claim while that deliverable is open"
    cmds:
      - "sh tests/docs/audited-claim.sh"
      # The prose scan above reads Markdown. The claim also lives in JSON that
      # no line-oriented scan reaches, and which tooling quotes onward (#1170):
      # #1156 found the seed called an "audited C11 artifact" in the manifest,
      # three lines below `bootstrap_model: trusted-c11-seed`. Both halves key
      # off the same audit record, so they cannot disagree about whether the
      # word is available.
      - "node tests/docs/audited-claim-metadata.mjs"

  ownership-view:
    desc: "Verify bounded current-file ScopeId and BindingId ownership views"
    cmds:
      - "sh tests/tooling/ownership-view/run.sh"

  artifact-qualification:
    desc: "Qualify KIF and typed-sidecar compatibility, trust, and budgets"
    cmds:
      - "sh tests/artifact-qualification/check.sh"

  lsp:
    desc: "Verify the stdio language server and editor client"
    cmds:
      - "sh tests/lsp/check.sh"

  roadmap:
    desc: "Verify the executable issues 31-34 roadmap"
    cmds:
      - "sh spec/roadmap-31-34/verify-current-gates.sh"

  syntax:
    desc: "Verify syntax contracts for issues 35-60"
    cmds:
      - "sh tests/conformance/syntax/issues_35_47/run.sh"
      - "sh tests/conformance/syntax/issues_48_60/run.sh"

  digest:
    desc: "Verify the repository's own SHA-256 against published vectors"
    cmds:
      - "sh tests/digest/check.sh"

  digest-command:
    desc: "Build the Kofun digest command without the wrapper and verify the tracked manifests"
    cmds:
      - "sh tests/digest/command.sh"

  tests-kofun:
    desc: "Verify the tests/kofun corpus runs or refuses as recorded"
    cmds:
      - "sh tests/kofun/check.sh"

  call-arguments-spec:
    desc: "Verify labelled call binding and the single trailing-lambda form"
    cmds:
      - "sh spec/syntax/call-arguments/check.sh"

  authority-type-carrier:
    desc: "Verify the three RFC-0002 authority types are opaque, affine, and unforgeable"
    cmds:
      - "sh tests/conformance/authority-carrier/run.sh"

  bytes-carrier:
    desc: "Verify tracked Bytes[65536] owner cleanup, transfer, and refusal paths"
    cmds:
      - "sh tests/conformance/bytes-carrier/run.sh"

  bytes-mutation:
    desc: "Verify bounded Bytes[65536] mutation, growth, and range refusals"
    cmds:
      - "sh tests/conformance/bytes-mutation/run.sh"

  bytes-read-file:
    desc: "Verify a compiled program reads a file into Bytes[65536] and digests it, refusing over-bound and unreadable paths by name"
    cmds:
      - "sh tests/conformance/bytes-read-file/run.sh"

  # #1667. The chunked read past the 65,536-byte read_file ceiling, from a
  # named file or from standard input, with end of input an observable
  # zero-byte chunk and a failure an Int status the program continues past.
  bytes-read-stream:
    desc: "Verify a compiled program digests any-length input in bounded chunks, from a file or standard input, observing failed reads as statuses"
    cmds:
      - "sh tests/conformance/bytes-read-stream/run.sh"

  command-operands:
    desc: "Verify a compiled program receives its operands and writes a line to standard error"
    cmds:
      - "sh tests/conformance/command-operands/run.sh"

  # #1694. A `Bytes` field in a nominal record: the AggregateLayout kind and
  # drop class #1258's Q4 fixed, with the borrowed `read` view the owner chose.
  record-bytes-fields:
    desc: "Verify a Bytes field in a nominal record constructs, reads as a borrowed view, moves whole, and refuses a copy"
    cmds:
      - "sh tests/conformance/record-bytes-fields/run.sh"

  # #1695. A bounded list of nominal records at capacity 128, the per-element
  # profile row #1258 Q3(a) chose.
  record-list:
    desc: "Verify a bounded list of nominal records at capacity 128 constructs, indexes, moves whole, and refuses a copy"
    cmds:
      - "sh tests/conformance/record-list/run.sh"

  # #1322. The Text bridge over the carrier: a Text in as its exact bytes, a
  # checked range out as Text, with range, limit, NUL, and UTF-8 refusals
  # named at runtime and the exact tag/detail contract proved in the emitted C.
  bytes-text:
    desc: "Verify the Bytes[65536] Text bridge: exact assignment, checked UTF-8 range conversion, and its five named refusals"
    cmds:
      - "sh tests/conformance/bytes-text/run.sh"

  http-client-carriers:
    desc: "Verify the HTTP client carriers on C11 Stage 2 (#1258): headers, and the origin and error children as they land"
    cmds:
      - task: http-client-headers

  http-client-headers:
    desc: "Verify Header and a bounded List[Header] at 128: append, read, index, lookup, move, and the R038 refusal"
    cmds:
      - "sh tests/conformance/http-client-headers/run.sh"

  bounded-bytes:
    desc: "Verify the fixture-bounded Bytes[65536] carrier, mutation, file-read, stream-read, and Text-bridge checkpoint"
    cmds:
      - task: bytes-carrier
      - task: bytes-mutation
      - task: bytes-read-file
      - task: bytes-read-stream
      - task: bytes-text

  call-arguments:
    desc: "Verify labelled-call binding and source order across C11, native, and wasm32"
    cmds:
      - "sh tests/conformance/call-arguments/run.sh"

  # Split from `call-arguments-spec` on purpose. That gate holds the accepted
  # decision to what #625 chose and must stay runnable with no implementation
  # behind it; this one holds a parser and formatter to the grammar, the
  # ambiguity boundary, and the canonical shape. Merging them would mean the
  # next contract that lands ahead of its implementation has nowhere to live.
  call-arguments-surface:
    desc: "Verify the call-argument parser, canonical formatter, and ambiguity corpus"
    cmds:
      - "sh spec/syntax/call-arguments/check-surface.sh"

  # The only recipe that is not a verbatim copy of its Makefile original, and
  # the reason is a real shell difference rather than a preference. go-task
  # runs commands through mvdan/sh, which does not negate a *pipeline* with a
  # leading `!` the way the system shell does: `! false` is negated but
  # `! find ... | grep -q .` is not. Under a verbatim copy both checks below
  # would invert, so they are written as an explicit `if ... then exit 1`,
  # which both shells agree on. The observation is unchanged: the gate fails
  # when a match exists.
  repository-check:
    desc: "Require .kofun sources and the Kofun toolchain"
    cmds:
      - cmd: |-
          if find . -path './.git' -prune -o -path './build' -prune -o \
            -type f \( -name '*.py' -o -name '*.pyc' -o -name '*.pyo' \) -print | grep -q .
          then exit 1; fi
        silent: true
      - cmd: |-
          if find . -path './.git' -prune -o -path './build' -prune -o \
            -type f -name '*.kf' -print | grep -q .
          then exit 1; fi
        silent: true
      - cmd: "test ! -e pyproject.toml"
        silent: true
      - cmd: "printf '%s\\n' 'PASS: .kofun sources only; no Python implementation'"
        silent: true
      # hjosugi/kofun#861 moved the editor surfaces to hjosugi/kofun-vscode and
      # hjosugi/tree-sitter-kofun. Nothing stopped them coming back: #872, a
      # pull request about examples, re-added three build outputs under
      # editor/vscode/server/generated/ — two generated .mjs files and an
      # x86-64 ELF shared object — because the path was not ignored and a
      # `git add -A` swept them in. A split that only happens once is a move; a
      # split that is checked is a boundary.
      - cmd: |-
          returned=$(git ls-files editor tree-sitter-kofun)
          if test -n "$returned"; then
            printf '%s\n' 'FAIL: these paths moved to their own repositories and came back:' "$returned" >&2
            exit 1
          fi
          printf 'PASS: the editor and grammar surfaces stay in their own repositories\n'
        silent: true
      # scripts/verify_repository.kofun cannot run: it is written against
      # read_text, which the Core does not implement. Nothing invoked it, so
      # its file list rotted twice unnoticed — a deleted Makefile, and then
      # three editor/vscode paths that survived the split to
      # hjosugi/kofun-vscode. Until the Core can read files, at least keep the
      # list honest: every path it names must exist here and be non-empty.
      - cmd: |-
          missing=$(grep -E '^[[:space:]]*"[^"]*",?$' scripts/verify_repository.kofun \
            | tr -d ' ",' | sort -u \
            | while read -r path; do test -s "$path" || printf '  %s\n' "$path"; done)
          if test -n "$missing"; then
            printf '%s\n' 'FAIL: scripts/verify_repository.kofun names files that are not here:' "$missing" >&2
            exit 1
          fi
          count=$(grep -cE '^[[:space:]]*"[^"]*",?$' scripts/verify_repository.kofun)
          printf 'PASS: all %s paths named by verify_repository.kofun exist\n' "$count"
        silent: true
      # `bin/kofun --version` used to print a literal, and it drifted eleven
      # tags behind the repository while `tests/cli.sh` asserted the stale
      # string -- two copies of one fact, with the test pinning the wrong one.
      # VERSION is now the only place the number is written; this refuses a
      # second copy coming back and refuses a shape no tag can be made from.
      - cmd: |-
          version=$(cat VERSION 2>/dev/null || true)
          if test -z "$version"; then
            printf '%s\n' 'FAIL: VERSION is missing or empty' >&2
            exit 1
          fi
          case $version in
            *[!0-9.a-z-]* | *' '*)
              printf '%s\n' "FAIL: VERSION \`$version\` is not a tag-shaped version" >&2
              exit 1 ;;
          esac
          reported=$(./bin/kofun --version)
          if test "$reported" != "Kofun Stage 1 $version"; then
            printf '%s\n' "FAIL: \`kofun --version\` reports \`$reported\`, not VERSION \`$version\`" >&2
            exit 1
          fi
          literals=$(git grep -nE '[0-9]+\.[0-9]+\.[0-9]+-seed' -- bin tests/cli.sh || true)
          if test -n "$literals"; then
            printf '%s\n' 'FAIL: a version literal is written outside VERSION:' "$literals" >&2
            exit 1
          fi
          printf 'PASS: VERSION is the only version literal, and the CLI reports it\n'
        silent: true

  move-call-crossings:
    desc: "Verify bounded positional take moves, BindingId invalidation and trivial-record edit refusals"
    cmds:
      - "sh tests/conformance/move-call-crossings/run.sh"

  # #1243. A nominal record or ADT that can contain an authority is Owned; a
  # copy, an equality, or a mode-less parameter head of one refuses E353, and
  # the move and edit rules that already fire for a Managed record fire for it
  # too. The gate pins the RFC-0004 causal path it renders and the Managed
  # controls that must not move.
  authority-structural-kind:
    desc: "Verify Owned/Managed structural classification and the E353/E2S123/E2S181 refusals for Owned composites"
    cmds:
      - "sh tests/conformance/authority-structural-kind/run.sh"

  authority-affine-state:
    desc: "Verify the E355 direct-return escape of a read/edit authority parameter"
    cmds:
      - "sh tests/conformance/authority-affine-state/run.sh"

  # A gate that fails without printing anything turns a specific defect into a
  # bare exit code, and #814 counted 460 assertions that do exactly that. This
  # holds every script to a recorded budget in both directions, so the number
  # can only fall while that work is in flight.
  assertions:
    desc: "Hold every gate to its recorded silent-assertion budget"
    cmds:
      - "sh tests/assertions/check.sh"

  # The same both-directions idiom, applied to where a Stage 2 pair divergence
  # can hide. `compiler.kofun` and its hand-maintained `compiler.c`
  # transliteration are compared only through emitted C, so a disagreement
  # survives exactly on branches no input takes -- #1315's leak lived in
  # `lower_body`, still the largest untaken region in the file (#1401, #1408).
  #
  # DELIBERATELY NOT IN `verify`. It rebuilds `compiler.c` under `--coverage` at
  # -O0 and drives the pinned corpus and the gate set; the measured cost is in
  # the ledger header. Adding those serialized coverage measurements to
  # `verify` buys a slower gate for a number that moves when someone edits the
  # compiler, not every commit.
  # `prove.sh` runs here without `--tree`, which costs nothing: its cases
  # feed check.sh a measurement through the seam instead of taking one. So this
  # task both checks the ledger and demonstrates that the gate can refuse, which
  # is the standing rule here -- a gate nobody has watched fail is not evidence.
  # `--tree` stays out: it performs another multi-hour pair measurement; the
  # ledger header records the corresponding baseline measurement's cost.
  stage2-pair-coverage:
    desc: "Hold the Stage 2 pair's undefended-branch ledger exact in both directions"
    vars:
      NAMESPACE: '{{if .KOFUN_GATE_WORK_NAMESPACE}}{{.KOFUN_GATE_WORK_NAMESPACE}}/{{end}}'
    cmds:
      - "sh tests/pair-coverage/check.sh"
      - "sh tests/pair-coverage/prove.sh build/{{.NAMESPACE}}pair-coverage-proof"

  # Every call in the Stage 2 pair's Kofun half names something that exists.
  # Cheap -- two files of text, no build -- so unlike its `stage2-pair-coverage`
  # neighbour it belongs in `verify` rather than in
  # tooling/gate-reachability/unreachable.tsv. It also demonstrates that it can
  # refuse on every run: the ledger it holds records two live defects, so
  # "green" here would otherwise say nothing.
  stage2-pair-calls:
    desc: "Resolve every call in bootstrap/stage2/compiler.kofun, or record why not"
    cmds:
      - "sh tests/pair-coverage/calls.sh"
      - "sh tests/pair-coverage/calls.sh --prove"

  # Every name READ in the Stage 2 pair's Kofun half is introduced by it.
  # `stage2-pair-calls` resolves call targets and says in its own header that a
  # bare read is not a call; this is the other half of that sentence. Cheap --
  # two files of text, no build -- so it belongs in `verify` beside its two
  # siblings rather than in tooling/gate-reachability/unreachable.tsv. Its
  # ledger is EMPTY, so unlike `stage2-pair-calls` it cannot demonstrate a
  # refusal from the tree; `--prove` supplies ten cases that can, including the
  # `lambda_scope` shape it was written for.
  stage2-pair-bindings:
    desc: "Introduce every name read in bootstrap/stage2/compiler.kofun, or record why not"
    cmds:
      - "sh tests/pair-coverage/bindings.sh"
      - "sh tests/pair-coverage/bindings.sh --prove"

  # Which ledger functions the Kofun half mirrors at all, and under what name.
  # #1401's work-list assumes both halves implement the function; for 24 of 361
  # they do not. Cheap -- two files of text, no build -- so it belongs in
  # `verify` beside `stage2-pair-calls` rather than in
  # tooling/gate-reachability/unreachable.tsv.
  stage2-pair-mirror:
    desc: "Hold the map of which Stage 2 pair functions the Kofun half mirrors"
    cmds:
      - "sh tests/pair-coverage/mirror.sh"
      - "sh tests/pair-coverage/mirror.sh --prove"

  # The two halves spell the same DECISIONS separately — a type set, a table
  # size, a seed constant, a declared arity — and the three siblings above read
  # none of them: one resolves call targets, one resolves reads, one says a
  # counterpart exists. Six defects in one week were exactly this, five of them
  # literal values sitting in source in both files. Cheap — two files of text,
  # no build, 86ms and 673ms on an 8-core x86-64 Linux box — so it belongs in
  # `verify` beside its siblings rather than in
  # tooling/gate-reachability/unreachable.tsv.
  stage2-pair-decisions:
    desc: "Hold both halves of the Stage 2 pair to the decisions they spell separately"
    cmds:
      - "sh tests/pair-coverage/decisions.sh"
      - "sh tests/pair-coverage/decisions.sh --prove"

  # If `bin/kofun build` does not refuse a program with an `error[...]`
  # diagnostic, the C it wrote must compile. Every gate that compiles emitted C
  # does so over hand-written fixtures; the grammar fuzzer generates malformed
  # programs and never runs a host C compiler. NOT in `verify`: 249 seconds over
  # 1320 tracked programs on an 8-core x86-64 Linux box, against a suite that
  # runs in about seventeen minutes. Recorded with that reason in
  # tooling/gate-reachability/unreachable.tsv.
  emission-compiles:
    desc: "Check that every program Stage 2 accepts emits C that compiles"
    cmds:
      - "sh tests/emission/check.sh --prove"
      - "sh tests/emission/check.sh"

  # An issue's state is carried twice, as a label and as the `State:` line in
  # its body, and nothing held the two together until this. Reads the committed
  # snapshot only, so it stays hermetic and belongs in `verify`.
  backlog:
    desc: "Bind each issue's state label to the State line in its body"
    cmds:
      - "sh tests/backlog/check.sh"

  # The network lane: refresh the snapshot from GitHub and run the same rules
  # against live issue state, plus the evidence stamps, which need the full git
  # history. The committed snapshot is a fixture, not a claim about now —
  # issues change every few minutes, so requiring a commit to match them would
  # be permanently red.
  backlog-refresh:
    desc: "Refresh the backlog snapshot and check the live backlog"
    cmds:
      - "node tests/backlog/refresh.mjs"
      - "sh tests/backlog/check.sh"
      - "sh tests/backlog/check-stamps.sh"

  # The fast structural lane: does every published capability still join the
  # evidence that bounds it? This reads the repository and never runs a gate, so
  # it belongs beside the other cheap checks in `verify`.
  release-claims:
    desc: "Join published capability claims to their evidence"
    cmds:
      - "sh tests/release/check-claims.sh"

  # The procedure is a document, and a document cannot be run -- so the checks
  # inside it were trusted rather than checked, and one of them printed PASS for
  # a tag that did not exist (#1603). This extracts every `sh` block from
  # `docs/RELEASING.md`, requires each to open with the fail-closed guard and
  # every check in it to carry its own failure action, and then *runs* the guard
  # in each available shell instead of only finding it.
  #
  # #1685 moved steps 2-5 into `release/prepare.sh` and step 4's publication
  # block into `release/verify-publication.sh`, so this target also runs both
  # commands' refusal proofs. Moving a check out of the document must not move
  # it out of the proving: the self-tests drive scratch fixtures and assert
  # each refusal, and that the honest paths pass.
  release-procedure:
    desc: "Prove docs/RELEASING.md's blocks cannot report PASS while failing"
    cmds:
      - "node tests/release/procedure-blocks.mjs"
      - "sh tests/release/prepare-self-test.sh"
      - "sh tests/release/publication-self-test.sh"

  # `docs/RELEASING.md` steps 2-5 as one command. It refreshes the evidence
  # pack, writes VERSION, re-binds the pack to the new number, commits the two
  # reviewable commits and runs `task repository-check`. It never pushes, so
  # step 6's push stays the one deliberate act that crosses to the remote.
  # Invoke as `RELEASE_VERSION=0.13.3-seed task release-prepare`.
  release-prepare:
    desc: "RELEASING.md steps 2-5: VERSION, evidence binding, repository-check"
    cmds:
      - 'sh release/prepare.sh "${RELEASE_VERSION:?set RELEASE_VERSION to the version, e.g. 0.13.3-seed}"'

  # `docs/RELEASING.md` step 4's publication verification as one command: local
  # HEAD, remote main and the remote tag agree on the release commit, the
  # release is a nondraft pre-release with exactly nine expected assets, and
  # both digest manifests verify the seven payloads. It creates and pushes
  # nothing; placing the tag stays a deliberate act in the document.
  release-verify-publication:
    desc: "RELEASING.md step 4: verify the published release, assets and digests"
    cmds:
      - "sh release/verify-publication.sh"

  # The release lane: regenerate the reviewable pack. `release-claims` then fails
  # until the regenerated pack is committed, so the two cannot diverge.
  release-evidence:
    desc: "Regenerate the reviewable release evidence pack"
    cmds:
      - "node tests/release/validate-claims.mjs evidence artifacts/release-evidence"

  # Keeps accepted, implemented, enabled and amended apart in the decision
  # ledger. Like `release-claims` this only reads the repository, so it belongs
  # in the fast lane.
  rfc-registry:
    desc: "Check the language decision ledger"
    cmds:
      - "sh tests/rfc/check-registry.sh"

  clean:
    desc: "Remove build/ and scratch directories"
    cmds:
      - "rm -rf build .tmp-*"

  # Every gate in `deps` is independent, so they run concurrently rather than
  # asking the caller to remember a flag. Override with `task -C 1 verify` to
  # bisect a failure without interleaved output.
  #
  # `deps` replaces the Makefile's hand-maintained VERIFY_TARGETS string: a
  # task named here that does not exist is an error, where a stale name in
  # that string was not.
  verify:
    desc: "Run every available gate"
    cmds:
      # Every gate here is independent, so run them concurrently — but
      # *bounded*. `-C` only limits concurrency; go-task needs `--parallel`
      # to execute multiple command-line tasks concurrently at all. Three
      # workers keep the previous resource-exhaustion failure bounded while
      # allowing the long diagnostics, Stage 2, and fuzz gates to overlap.
      #
      # Override with `VERIFY_JOBS=1 task verify` to bisect a failure
      # without interleaved output.
      - cmd: |-
          sh "$PWD/bootstrap/stage2/verify-runner.sh" \
            "$PWD" "${VERIFY_JOBS:-3}" \
            verify-shards \
            test \
            diagnostics \
            fuzz \
            unicode \
            check \
            bootstrap \
            selfhost-profile \
            selfhost-hir-identifiers \
            selfhost-self-compile \
            selfhost-driver-diagnostics \
            selfhost-generations \
            selfhost-fixed-point \
            selfhost-diverse-double-compilation \
            selfhost-declared-inputs \
            selfhost-b6-report \
            selfhost-b6-policy \
            selfhost-b6-acquisition-identity \
            selfhost-native \
            stage2 \
            stage2-events \
            stage2-pair-calls \
            stage2-pair-bindings \
            stage2-pair-mirror \
            stage2-pair-decisions \
            stage2-pair-host-primitives-decision \
            stage2-pair-host-primitives \
            patterns \
            adt \
            records \
            move-call-crossings \
            authority-structural-kind \
            authority-affine-state \
            aggregate-bridge \
            generics \
            const-generics \
            hm-levels \
            effect-inference \
            pure-boundary \
            traits \
            optional \
            optional-narrowing \
            optional-construction \
            optional-coalescing \
            optional-pair \
            result-propagation \
            text-results \
            int-bits \
            int-bits-lowering \
            list-int-values \
            record-values \
            text-escapes \
            unused-function \
            authority-type-carrier \
            bounded-bytes \
            http-client-carriers \
            command-operands \
            record-bytes-fields \
            record-list \
            while-list-int \
            else-if-chain \
            list-int-signatures \
            adt-exhaustiveness \
            adt-usefulness-v2 \
            enum-match-value \
            module-constants \
            extern-c \
            module-inventory \
            module-symbols \
            imports-qualified \
            import-aliases \
            imports-selective \
            raw-imports \
            raw-re-exports \
            re-exports \
            kif-v1 \
            kif-generics-codec \
            stage2-kif-producer \
            visibility-filtering \
            visibility-api-leaks \
            module-interface-artifact \
            incremental \
            decimal \
            decimal-arithmetic \
            decimal-fixed-runtime \
            date-time \
            tzdb \
            discovery \
            stage1-adapter \
            native \
            native-host-evidence \
            wasm \
            examples \
            tour \
            c-abi \
            bindgen-c \
            bindgen-c-import-boundary \
            optional-tool-skips \
            rust-shim \
            http \
            http-client-model \
            cli-framework \
            native-cli-action-binding-decision \
            tui-framework \
            stdlib \
            alloc-contract \
            kotest \
            clock-adapters \
            scoped-parallelism \
            concurrency-capture-contract \
            concurrency-hir \
            concurrency-places \
            concurrency-captures-direct \
            concurrency-captures \
            concurrency-capture-events \
            concurrency-ownership \
            concurrency-runtime \
            schedule-trace \
            type-reduction-trace \
            affine-resumption \
            affine-resource-handle \
            example-law-evidence \
            benchmark-summary \
            benchmark-report \
            kofun-digest-model \
            sha256-pair \
            move-assertion \
            usability-corpus \
            capabilities \
            stdlib-partial-target-support-decision \
            build-system \
            packages \
            package-roots \
            source-file-mapping \
            namespaces \
            module-identity \
            semantic-identity \
            visibility-spec \
            visibility-syntax \
            visibility-access \
            re-exports-spec \
            aggregate-layout \
            reuse-candidate \
            wasm-host-abi \
            wasm-host-profile \
            wasi-command-profile \
            wasi-command-backend-shell \
            wasi-command-memory \
            adt-match-v2-contract \
            wasi-host-matrix-policy \
            wasi-command-projection-contract \
            atomic-write-authority-contract \
            gate-reachability \
            native-toolchain-contract \
            forbidden-requirements-census \
            machine-dependent-bounds \
            wasm-object-arena \
            wasm-list-v1 \
            typed-sidecar-spec \
            typed-sidecar-codec \
            typed-sidecar-captures \
            typed-sidecar-projector \
            upgrade-patch \
            workspace-upgrade-transaction-decision \
            process-capture-carrier-decision \
            directory-enumeration-carrier-decision \
            live-https-get-adapter-decision \
            atomic-publish-if-absent-decision \
            documentation-index \
            audited-claim \
            ownership-view \
            artifact-qualification \
            syntax \
            digest \
            digest-command \
            tests-kofun \
            call-arguments \
            call-arguments-spec \
            call-arguments-surface \
            task-help \
            trait-dictionary-c11 \
            repository-check \
            assertions \
            backlog \
            release-claims \
            release-procedure \
            rfc-registry

  # #1684. The bidirectional shard ledger and the per-shard entry point.
  # `verify-shards` is in `verify`'s declared set, so CI enforces that every
  # task verify runs is assigned to exactly one shard. `verify-shard` is not:
  # it is how a shard is executed, never a gate in its own right.
  verify-shards:
    desc: "Bind every task verify runs to exactly one shard"
    cmds:
      - "sh tests/verify-shards/check.sh --prove"

  verify-shard:
    desc: "Run one shard of task verify (KOFUN_VERIFY_SHARD=i)"
    cmds:
      - "sh tests/verify-shards/run-shard.sh"