SHELL := /usr/bin/env bash
.DEFAULT_GOAL := help

# Operator age public key — used as bundle encryption recipient
OPERATOR_AGE_PUBKEY := $(shell cat keys/age.pub 2>/dev/null | tr -d '[:space:]')
SECURITY_BOOTSTRAP_METADATA ?= $(if $(METADATA),$(METADATA),.local/security-bootstrap.json)
SECURITY_BOOTSTRAP_HOST ?= $(if $(HOST),$(HOST),127.0.0.1)
SECURITY_BOOTSTRAP_PORT ?= $(if $(PORT),$(PORT),8876)
OPENBAO_RESTORE_EVIDENCE ?= /tmp/netkingdom-openbao-restore-drill/evidence.json
OPENBAO_EMERGENCY_EVIDENCE ?= /tmp/netkingdom-openbao-emergency-drill/evidence.json
BOOTSTRAP_CLEANUP_EVIDENCE ?= /tmp/netkingdom-bootstrap-cleanup/evidence.json
LIFECYCLE_FLOW_EVIDENCE ?= /tmp/netkingdom-lifecycle-flow/evidence.json
ONBOARDING_DRY_RUN_EVIDENCE ?= /tmp/netkingdom-onboarding-dry-run/evidence.json
RAILIANCE_PLATFORM_PATH ?= ../railiance-platform
KEY_CAPE_PATH ?= ../key-cape
CUSTODY_ROSTER ?= .local/custody-roster.json
CUSTODY_ROSTER_SIGNATURE ?= .local/custody-roster.json.sig
CUSTODY_ROSTER_ALLOWED_SIGNERS ?= .local/custody-roster.allowed_signers
CUSTODY_ROSTER_SIGNING_KEY ?= $(HOME)/.ssh/id_custodian_agent
CUSTODY_ROSTER_SIGNING_PRINCIPAL ?= platform-custodian

# ── Help ──────────────────────────────────────────────────────────────────────
help: ## Show this help
	@echo "net-kingdom — available targets"
	@echo ""
	@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) \
	  | sort \
	  | awk 'BEGIN {FS = ":.*?## "}; {printf "  %-28s %s\n", $$1, $$2}'

# ── Git hooks ─────────────────────────────────────────────────────────────────
hooks: ## Configure git to use repo-local hooks (.githooks)
	@mkdir -p .githooks
	git config core.hooksPath .githooks
	@test -f .githooks/pre-commit \
	  || (echo "ERROR: .githooks/pre-commit not found"; exit 1)
	chmod +x .githooks/pre-commit
	@echo "✔ git hooks enabled (.githooks/pre-commit is active)"

hooks-test: ## Test that the pre-commit hook blocks plaintext secrets
	@mkdir -p sso-mfa/bootstrap/secrets/_hooktest
	@printf '%s=%s\n' PI_SECRET_KEY deadbeef > sso-mfa/bootstrap/secrets/_hooktest/test.env
	@git add sso-mfa/bootstrap/secrets/_hooktest/test.env 2>/dev/null || true
	@if git commit -m "TEST: hook must block this" 2>/dev/null; then \
	  echo "FAIL: hook did NOT block plaintext commit"; \
	  git reset --soft HEAD~1 2>/dev/null || true; \
	else \
	  echo "✔ Hook blocked plaintext as expected"; \
	fi
	@git restore --staged sso-mfa/bootstrap/secrets/_hooktest/test.env 2>/dev/null || true
	@rm -rf sso-mfa/bootstrap/secrets/_hooktest

# ── SOPS / age ────────────────────────────────────────────────────────────────
sops-setup: ## Validate the registered public age recipient; never install a private key
	@python3 sso-mfa/bootstrap/sops-private.py setup

# Raw values prevent both Make-function evaluation and shell interpolation.
unexport FILE INPUT OUTPUT COMMAND OPERATOR_AGE_PUBKEY
sops-edit sops-encrypt sops-decrypt sops-rotate: export NK_SOPS_FILE := $(value FILE)
sops-edit: export NK_SOPS_INPUT := $(value INPUT)
sops-decrypt: export NK_SOPS_OUTPUT := $(value OUTPUT)

sops-edit: ## Replace encrypted content from private INPUT outside Git; explicit custody required
	@python3 sso-mfa/bootstrap/sops-write.py edit

sops-encrypt: ## Encrypt private, untracked FILE in place with the registered public recipient
	@python3 sso-mfa/bootstrap/sops-write.py encrypt

sops-decrypt: ## Decrypt age-only JSON/YAML to new private OUTPUT outside Git; explicit custody required
	@python3 sso-mfa/bootstrap/sops-private.py decrypt

sops-rotate: ## Rotate the SOPS data key; recipient changes require a separate reviewed procedure
	@python3 sso-mfa/bootstrap/sops-write.py rotate

sops-custody-check sops-custody-shell sops-custody-run: export NK_CUSTODY_RECIPIENT := $(value OPERATOR_AGE_PUBKEY)
sops-custody-run: export NK_CUSTODY_COMMAND := $(value COMMAND)

sops-custody-check: ## Validate a custody age key without keeping it on disk
	@bash sso-mfa/bootstrap/sops-custody-unlock.sh \
	  --expected-recipient "$$NK_CUSTODY_RECIPIENT" --check-only

sops-custody-shell: ## Open a shell with a temporary SOPS_AGE_KEY_FILE from custody material
	@bash sso-mfa/bootstrap/sops-custody-unlock.sh \
	  --expected-recipient "$$NK_CUSTODY_RECIPIENT"

sops-custody-run: ## Run COMMAND inside the temporary custody handoff
	@[[ -n "$$NK_CUSTODY_COMMAND" ]] || (echo "Usage: make sops-custody-run COMMAND='<approved command>'"; exit 1)
	@bash sso-mfa/bootstrap/sops-custody-unlock.sh \
	  --expected-recipient "$$NK_CUSTODY_RECIPIENT" -- bash -lc "$$NK_CUSTODY_COMMAND"

check-secrets: ## Fail if any file under secrets/ is not SOPS-encrypted
	@echo "Checking for unencrypted files under secrets/..."
	@bad=0; \
	while IFS= read -r f; do \
	  [[ -z "$$f" ]] && continue; \
	  if grep -qE '^[[:space:]]*sops:[[:space:]]*$$|"sops"[[:space:]]*:' "$$f" 2>/dev/null; then \
	    continue; \
	  fi; \
	  case "$$f" in *.age|*.gpg) continue ;; esac; \
	  echo "  UNENCRYPTED: $$f"; bad=1; \
	done < <(git ls-files --others --cached 'secrets' 2>/dev/null | grep -v '/$$'); \
	if [[ "$$bad" -ne 0 ]]; then \
	  echo ""; \
	  echo "ERROR: Unencrypted file detected. For private untracked input: make sops-encrypt FILE=<file>; tracked plaintext requires incident review."; \
	  exit 1; \
	fi; \
	echo "✔ All secrets/ files appear SOPS-encrypted"

# ── Credential lifecycle ──────────────────────────────────────────────────────
creds-init: sops-setup hooks ## One-time setup: verify prerequisites, configure SOPS and git hooks
	@echo "=== creds-init: checking prerequisites ==="
	@command -v age  >/dev/null 2>&1 || (echo "ERROR: age not installed  (apt install age)"; exit 1)
	@command -v sops >/dev/null 2>&1 || (echo "ERROR: sops not installed (see https://github.com/getsops/sops/releases)"; exit 1)
	@command -v kubectl >/dev/null 2>&1 \
	  && echo "✔ kubectl found" \
	  || echo "WARN: kubectl not found (required for creds-apply/verify)"
	@echo ""
	@echo "✔ creds-init complete. Next: make creds-generate"

creds-generate: ## Generate private service files for public-recipient encryption
	@command -v openssl >/dev/null 2>&1 || (echo "ERROR: openssl not found"; exit 1)
	cd sso-mfa/bootstrap && bash gen-secrets.sh
	@sed -i "s|^generated_at: .*|generated_at: $$(date -Iseconds)|" sso-mfa/bootstrap/creds-state.yaml
	@echo ""
	@echo "State: generated_at updated in sso-mfa/bootstrap/creds-state.yaml"
	@echo "Next : encrypt to the registered public recipient; never copy values into transcripts."
	@echo "       Run 'make creds-bundle' to create an encrypted offsite backup."

creds-bundle: ## Age-encrypt the ops bundle for offsite storage
	@[[ -n "$(OPERATOR_AGE_PUBKEY)" ]] \
	  || (echo "ERROR: keys/age.pub not found — cannot determine encryption recipient"; exit 1)
	@[[ -d sso-mfa/bootstrap/secrets ]] \
	  || (echo "ERROR: sso-mfa/bootstrap/secrets/ not found — run 'make creds-generate' first"; exit 1)
	cd sso-mfa/bootstrap && bash pack-bundle.sh secrets "$(OPERATOR_AGE_PUBKEY)"
	@sed -i "s|^bundle_at: .*|bundle_at: $$(date -Iseconds)|" sso-mfa/bootstrap/creds-state.yaml
	@echo ""
	@echo "State: bundle_at updated in sso-mfa/bootstrap/creds-state.yaml"
	@echo "Store the .tar.age bundle offsite (external drive, encrypted cloud, second location)."

creds-apply: ## Apply all create-secrets.sh scripts to the cluster in dependency order
	bash sso-mfa/bootstrap/creds-apply.sh

creds-verify: ## Observe current Secret presence without rewriting native acceptance
	bash sso-mfa/bootstrap/creds-verify.sh

creds-status: ## Print human-readable credential state from creds-state.yaml
	bash sso-mfa/bootstrap/creds-status.sh

creds-rotate: export SECRET := $(SECRET)
creds-rotate: ## Guided rotation for one secret: make creds-rotate SECRET=<name>
	@bash sso-mfa/bootstrap/creds-rotate.sh

## ── Agent-driven credential lifecycle (NK-WP-0005) ──────────────────────────

creds-agent-init: ## Attended bootstrap using the public recipient and encrypted recovery handoff
	@bash sso-mfa/bootstrap/creds-bootstrap-agent.sh

creds-agent-status: ## Show current v2 bootstrap state (agent mode)
	@bash sso-mfa/bootstrap/creds-status.sh --v2

creds-emergency-reprint: ## Print the non-secret recovery guide; no keys or passwords are read
	@bash sso-mfa/bootstrap/emergency-bundle.sh --reprint

openbao-init-unseal: ## SOPS-held OpenBao init/unseal (NET-WP-0020 T2; requires sops-held-automation model selected)
	@bash sso-mfa/bootstrap/openbao-init-unseal.sh

openbao-init-unseal-dry-run: ## Dry-run the SOPS-held OpenBao init/unseal path
	@bash sso-mfa/bootstrap/openbao-init-unseal.sh --dry-run

RTUT_HOME ?= $(HOME)/runbook-tutorials

runbooks-validate: ## Validate runbook packs under runbooks/ with the runbook-tutorials engine
	PYTHONPATH=$(RTUT_HOME) python3 -m rtut validate .

iam-profile-conformance-test: ## Run current IAM Profile conformance fixture tests
	python3 -m pytest tools/iam-profile-conformance/tests

playbook-contract-test: ## Run Playbook Capability Contract fixture tests
	python3 -m pytest tools/playbook-capability-contract/tests

security-scenario-composer-test: ## Run deterministic security scenario composer tests
	python3 -m pytest tools/security-scenario-composer/tests

security-scenario-compose-c0: ## Compose the plan-only C0 local-identity reference
	python3 tools/security-scenario-composer/security_scenario_composer.py \
	  --scenario examples/security-scenarios/c0-local-identity.yaml \
	  capabilities/playbooks/net-kingdom.local-identity.yaml

security-scenario-compose-lightweight: ## Compose plan-only KeyCape C1+C2b from owner declarations
	python3 tools/security-scenario-composer/security_scenario_composer.py \
	  --scenario examples/security-scenarios/c1-c2b-key-cape.yaml \
	  $(KEY_CAPE_PATH)/capabilities/playbooks/key-cape.lightweight-sso.yaml \
	  $(KEY_CAPE_PATH)/capabilities/playbooks/key-cape.privacyidea-token-authority.yaml

posture-feedback-test: ## Run deterministic posture-feedback tests
	python3 -m pytest tools/posture-feedback/tests tools/tenancy-posture/test_validate.py

custody-record-test: ## Run custody-record schema/validator tests (NK-WP-0045-T03)
	python3 -m pytest tools/custody-record/tests

service-identity-test: ## Run service-identity schema/validator tests (NK-WP-0054-T03)
	python3 -m pytest tools/service-identity/tests

service-identity-check: ## Evaluate the checked-in service identity declarations (read-only, offline)
	python3 tools/service-identity/validate.py tools/service-identity/declarations/*.yaml

bounded-execution-admission-test: ## Run bounded-execution admission validator tests (NK-WP-0056-T01)
	python3 -m pytest tools/bounded-execution-admission/tests

bounded-execution-admission-check: ## Validate the example admissions (read-only, offline)
	python3 tools/bounded-execution-admission/validate.py validate examples/bounded-execution-admission/*.yaml

bounded-executor-test: ## Bounded executor RBAC and declaration tests; the pilot admission inside its declared grants (NK-WP-0056-T03)
	python3 -m pytest sso-mfa/k8s/bounded-executor bounded-executor/tests tests/test_executor_lanes.py
	python3 tools/service-identity/validate.py tools/service-identity/declarations/bounded-executor.yaml \
	  --admissions examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml

bind-split-test: ## LLDAP bind-split helper tests on a throwaway pinned LLDAP (NK-WP-0054-T05; needs docker)
	uv run --with pytest --with ldap3 --with pyyaml python -m pytest sso-mfa/k8s/lldap/test_bind_split.py sso-mfa/k8s/lldap/test_identity_provisioner_reconcile.py

rotation-lanes-test: ## Run rotation-lane register tests (NK-WP-0055-T15)
	python3 -m pytest tools/rotation-lanes/tests

rotation-lanes-check: ## Check every known credential has a rotation lane (read-only, offline)
	python3 tools/rotation-lanes/check.py

security-tools: ## List the security tools, what each answers, and whether an agent may run it
	python3 tools/security_tools.py

posture-feedback-reference: ## Emit the proposal-only reference report at its fixed example time
	python3 tools/posture-feedback/posture_feedback.py \
	  --as-of 2026-08-23T12:00:00Z \
	  --horizon-days 14 \
	  --fail-on none \
	  examples/posture-feedback/expired-e2.yaml

emission-cadence-profile-test: ## Run NetKingdom emission-cadence profile tests
	python3 -m pytest tools/emission-cadence-profile/tests

security-bootstrap-console-test: ## Run automated tests for bootstrap console UI/sections/runbooks (NET-WP-0018-T07)
	python3 -m pytest tools/security-bootstrap-console/tests

# Syntax check for key bootstrap helper scripts (part of T07 layered tests)
security-bootstrap-scripts-syntax: ## Shell syntax check for bootstrap scripts
	bash -n sso-mfa/k8s/lldap/dry-run-nonroot-user.sh
	bash -n sso-mfa/k8s/lldap/create-user.sh
	bash -n sso-mfa/k8s/lldap/break-glass.sh
	@echo "✔ bootstrap scripts syntax OK"

security-bootstrap-validate-keycape-client: ## Validate KeyCape OpenBao client definition+deployment (T08)
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  validate-keycape-client || true

security-bootstrap-console: security-bootstrap-metadata-init ## Show guided security bootstrap status and safe actions
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  status

security-bootstrap-king-kit: ## Print the king credential kit checklist
	python3 tools/security-bootstrap-console/security_bootstrap_console.py king-kit

security-bootstrap-validate-kit: ## Validate non-secret king credential metadata
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  validate-king-kit

security-bootstrap-validate-t02: ## Validate NET-WP-0017-T02 OpenBao audit/recovery gates
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  validate-t02 \
	  --railiance-path "$(RAILIANCE_PLATFORM_PATH)" \
	  --restore-evidence "$(OPENBAO_RESTORE_EVIDENCE)" \
	  --emergency-evidence "$(OPENBAO_EMERGENCY_EVIDENCE)" \
	  --custody-roster "$(CUSTODY_ROSTER)" \
	  --custody-roster-signature "$(CUSTODY_ROSTER_SIGNATURE)" \
	  --custody-roster-allowed-signers "$(CUSTODY_ROSTER_ALLOWED_SIGNERS)"

security-bootstrap-validate-cleanup: ## Validate NET-WP-0017-T03/T04 cleanup and taint evidence
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  validate-cleanup \
	  --evidence "$(BOOTSTRAP_CLEANUP_EVIDENCE)"

security-bootstrap-validate-lifecycle-flow: ## Validate NET-WP-0017-T05 lifecycle operator-flow evidence
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  validate-lifecycle-flow \
	  --evidence "$(LIFECYCLE_FLOW_EVIDENCE)"

security-bootstrap-validate-onboarding-dry-run: ## Validate NET-WP-0017-T06 non-root onboarding dry-run evidence
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  validate-onboarding-dry-run \
	  --evidence "$(ONBOARDING_DRY_RUN_EVIDENCE)"

security-bootstrap-custody-roster-template: ## Print a non-secret two-of-three custody roster template
	python3 tools/security-bootstrap-console/security_bootstrap_console.py custody-roster-template

security-bootstrap-cleanup-evidence-template: ## Print non-secret NET-WP-0017-T03/T04 cleanup and taint evidence JSON template
	python3 tools/security-bootstrap-console/security_bootstrap_console.py cleanup-evidence-template

security-bootstrap-lifecycle-flow-template: ## Print non-secret NET-WP-0017-T05 lifecycle operator-flow evidence JSON template
	python3 tools/security-bootstrap-console/security_bootstrap_console.py lifecycle-flow-template

security-bootstrap-lifecycle-guide: ## Print the practical T05 operator flow guide (onboard/lock/offboard/review/fabric-admin with previews + commands)
	python3 tools/security-bootstrap-console/security_bootstrap_console.py lifecycle-guide

security-bootstrap-onboarding-dry-run-template: ## Print non-secret NET-WP-0017-T06 onboarding dry-run evidence JSON template (use to start T06 evidence after running the lifecycle flow)
	python3 tools/security-bootstrap-console/security_bootstrap_console.py onboarding-dry-run-template

security-bootstrap-onboarding-dry-run: ## Retired: see docs/legacy-lldap-lifecycle-retirement.md
	@bash sso-mfa/k8s/lldap/dry-run-nonroot-user.sh

security-bootstrap-lifecycle-cleanup-dryrun-users: ## Retired: see docs/legacy-lldap-lifecycle-retirement.md
	@bash sso-mfa/k8s/lldap/dry-run-nonroot-user.sh

security-bootstrap-validate-custody-roster: ## Validate and verify the signed local custody roster
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  validate-custody-roster \
	  --roster "$(CUSTODY_ROSTER)" \
	  --signature "$(CUSTODY_ROSTER_SIGNATURE)" \
	  --allowed-signers "$(CUSTODY_ROSTER_ALLOWED_SIGNERS)"

security-bootstrap-sign-custody-roster: ## Sign the ignored local custody roster with an SSH signing key
	@mkdir -p "$$(dirname "$(CUSTODY_ROSTER_ALLOWED_SIGNERS)")"
	@printf '%s ' "$(CUSTODY_ROSTER_SIGNING_PRINCIPAL)" > "$(CUSTODY_ROSTER_ALLOWED_SIGNERS)"
	@cat "$(CUSTODY_ROSTER_SIGNING_KEY).pub" >> "$(CUSTODY_ROSTER_ALLOWED_SIGNERS)"
	ssh-keygen -Y sign \
	  -f "$(CUSTODY_ROSTER_SIGNING_KEY)" \
	  -n netkingdom-custody-roster \
	  "$(CUSTODY_ROSTER)"
	@if [[ "$(CUSTODY_ROSTER_SIGNATURE)" != "$(CUSTODY_ROSTER).sig" ]]; then \
	  cp "$(CUSTODY_ROSTER).sig" "$(CUSTODY_ROSTER_SIGNATURE)"; \
	fi

security-bootstrap-approve-custody: ## Approve custody mode metadata: make security-bootstrap-approve-custody ARGS="--mfa-enrolled-confirmed --mfa-enrollment-source identity-provider --recovery-confirmed --custody-packet-prepared --no-secret-capture-confirmed"
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  approve-custody-mode \
	  --mode "$(if $(MODE),$(MODE),temporary-single-king)" \
	  $(ARGS)

security-bootstrap-custody-packet: ## Print a blank offline custody packet template
	python3 tools/security-bootstrap-console/security_bootstrap_console.py custody-packet

security-bootstrap-openbao-preflight: ## Show safe OpenBao preflight commands
	python3 tools/security-bootstrap-console/security_bootstrap_console.py openbao-preflight \
	  --railiance-path ../railiance-platform

security-bootstrap-openbao-unseal-custody-models: ## List OpenBao unseal custody models and implementation status
	python3 tools/security-bootstrap-console/security_bootstrap_console.py openbao-unseal-custody-models

security-bootstrap-select-openbao-unseal-custody-model: security-bootstrap-metadata-init ## Select implemented unseal model (blocks planned): make ... MODEL=sops-held-automation
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  select-openbao-unseal-custody-model \
	  --model "$(if $(MODEL),$(MODEL),sops-held-automation)"

security-bootstrap-select-deployment-profile: security-bootstrap-metadata-init ## Select deployment profile (production blocks sops-held-automation): make ... PROFILE=production
	@[[ -n "$(PROFILE)" ]] || (echo "Usage: make security-bootstrap-select-deployment-profile PROFILE=lab|production"; exit 1)
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  select-deployment-profile --profile "$(PROFILE)"

security-bootstrap-openbao-ceremony-record-template: ## Print non-secret attended OpenBao ceremony record template
	python3 tools/security-bootstrap-console/security_bootstrap_console.py openbao-ceremony-record-template

security-bootstrap-validate-openbao-ceremony-record: ## Validate non-secret attended ceremony record: make ... [EVIDENCE=.local/openbao-ceremony-record.json]
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  validate-openbao-ceremony-record \
	  --evidence "$(if $(EVIDENCE),$(EVIDENCE),.local/openbao-ceremony-record.json)"

security-bootstrap-metadata-init: ## Create durable local non-secret bootstrap metadata if missing
	@mkdir -p "$$(dirname "$(SECURITY_BOOTSTRAP_METADATA)")"
	@if [[ -f "$(SECURITY_BOOTSTRAP_METADATA)" ]]; then \
	  echo "✔ Metadata already exists: $(SECURITY_BOOTSTRAP_METADATA)"; \
	elif [[ -f /tmp/net-kingdom-security-bootstrap.json ]]; then \
	  cp /tmp/net-kingdom-security-bootstrap.json "$(SECURITY_BOOTSTRAP_METADATA)"; \
	  echo "✔ Imported previous /tmp bootstrap metadata to $(SECURITY_BOOTSTRAP_METADATA)"; \
	else \
	  python3 tools/security-bootstrap-console/security_bootstrap_console.py metadata-template \
	    > "$(SECURITY_BOOTSTRAP_METADATA)"; \
	  echo "✔ Created metadata: $(SECURITY_BOOTSTRAP_METADATA)"; \
	fi

security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody approval UI on localhost:8876: make security-bootstrap-ui
	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
	  web-ui \
	  --host "$(SECURITY_BOOTSTRAP_HOST)" \
	  --port "$(SECURITY_BOOTSTRAP_PORT)"

.PHONY: runbooks-validate bind-split-test rotation-lanes-test rotation-lanes-check help hooks hooks-test sops-setup sops-edit sops-encrypt sops-decrypt sops-rotate \
        check-secrets creds-init creds-generate creds-bundle creds-apply creds-verify \
        creds-status creds-rotate \
        creds-agent-init creds-agent-status creds-emergency-reprint \
        openbao-init-unseal openbao-init-unseal-dry-run \
        iam-profile-conformance-test playbook-contract-test posture-feedback-test \
        custody-record-test service-identity-test service-identity-check security-tools \
        bounded-execution-admission-test bounded-execution-admission-check bounded-executor-test \
        emission-cadence-profile-test \
        posture-feedback-reference security-scenario-compose-lightweight \
        security-bootstrap-console-test security-bootstrap-scripts-syntax \
        security-bootstrap-console security-bootstrap-king-kit \
        security-bootstrap-validate-kit security-bootstrap-validate-t02 \
        security-bootstrap-validate-cleanup \
        security-bootstrap-validate-lifecycle-flow \
        security-bootstrap-validate-onboarding-dry-run \
        security-bootstrap-validate-keycape-client \
        security-bootstrap-custody-roster-template \
        security-bootstrap-cleanup-evidence-template \
        security-bootstrap-lifecycle-flow-template \
        security-bootstrap-lifecycle-guide \
        security-bootstrap-onboarding-dry-run-template \
        security-bootstrap-onboarding-dry-run \
        security-bootstrap-lifecycle-cleanup-dryrun-users \
        security-bootstrap-validate-custody-roster \
        security-bootstrap-sign-custody-roster \
        security-bootstrap-approve-custody \
        security-bootstrap-custody-packet security-bootstrap-openbao-preflight \
        security-bootstrap-openbao-unseal-custody-models \
        security-bootstrap-select-openbao-unseal-custody-model \
        security-bootstrap-select-deployment-profile \
        security-bootstrap-openbao-ceremony-record-template \
        security-bootstrap-validate-openbao-ceremony-record \
        security-bootstrap-metadata-init security-bootstrap-ui \
        security-bootstrap-console-test security-bootstrap-scripts-syntax \
        security-bootstrap-validate-keycape-client

# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
.PHONY: generated-work-records generated-work-records-check
generated-work-records:
	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
generated-work-records-check:
	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check

.PHONY: coordination-frame-staged coordination-frame-staged-check
coordination-frame-staged:
	python3 tools/coordination-frame/staged.py --repo .
coordination-frame-staged-check:
	python3 tools/coordination-frame/staged.py --repo . --check