Taskfile.yml

version: '3'

env:
  GOFLAGS: -tags=duckdb_arrow

tasks:
  nix:build:
    desc: Build the sandboxed native Nix application and deployment CLI
    cmds:
      - nix build --no-update-lock-file .#leapview --out-link result-app

  nix:image:
    desc: Build the Nix container archive for Docker, Compose and Kamal
    cmds:
      - nix build --no-update-lock-file .#leapview-image --out-link result-image

  nix:cli:
    desc: Build CGO-disabled Linux deployment controller candidates for AMD64 and ARM64
    cmds:
      - nix build --no-update-lock-file .#leapviewctl-linux-amd64 --out-link result-cli-amd64
      # Nix adds the selected output's -arm64 suffix to this prefix.
      - nix build --no-update-lock-file .#leapviewctl-linux-arm64 --out-link result-cli

  nix:compose:controllers:
    desc: Build release-compatible controller candidates for Compose bundle assembly
    cmds:
      - nix build --no-update-lock-file .#leapviewctl-compose-linux-amd64 --out-link result-compose-cli-amd64
      - nix build --no-update-lock-file .#leapviewctl-compose-linux-arm64 --out-link result-compose-cli

  nix:qualify:
    desc: Qualify the Nix image through the existing production deployment checks
    cmds:
      - task: nix:build
      - task: nix:image
      - nix develop --no-update-lock-file -c bash scripts/check_nix_image.sh result-image result-app

  nix:check:
    desc: Check the locked Nix toolchain and real browser integration
    cmds:
      - nix flake check --no-update-lock-file
      - nix develop --no-update-lock-file -c task nix:smoke

  nix:smoke:
    desc: Exercise the Go toolchains and pinned Chromium inside nix develop
    deps: [node:deps]
    cmds:
      - node scripts/check_nix_development.mjs

  nix:ci:
    desc: Run the existing PR contract inside the locked Nix development environment
    cmds:
      - nix develop --no-update-lock-file -c task ci

  dev:
    desc: Start the managed LeapView dev server with real local authentication
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: bootstrap
      - task: map-assets:install
      - ./scripts/dev-server.sh start

  playground:
    desc: Start the standalone component and chart playground (no application services)
    cmds:
      - task: visualization-ir:generate
      - task: layout-contract:generate
      - task: lucide-icons:generate
      - bun run playground

  dev:reset-login:
    desc: Explicitly restore the private local development login and restart the managed server
    cmds:
      - LEAPVIEW_DEV_RESET_LOGIN=1 LEAPVIEW_DEV_RESTART=1 task dev

  dev:bypass:
    desc: Start the managed dev server with explicit local authentication bypass
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: bootstrap
      - task: map-assets:install
      - LEAPVIEW_DEV_AUTH_BYPASS=true LEAPVIEW_LOCAL_AUTH=false ./scripts/dev-server.sh start

  dev:movielens:
    desc: Seed and run the MovieLens 32M fixture with explicit auth bypass
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: bootstrap:movielens
      - LEAPVIEW_DEV_AUTH_BYPASS=true LEAPVIEW_LOCAL_AUTH=false LEAPVIEW_DEV_RESTART=1 LEAPVIEW_DEV_READY_ATTEMPTS=1800 LEAPVIEW_DEV_MCP_MODEL_QUERY=movie_ratings LEAPVIEW_DEV_MCP_METRIC=rating_count ./scripts/dev-server.sh start dashboards/experiments/movielens movielens .data/movielens

  dev:cfo:
    desc: Seed and run the CFO finance fixture with explicit auth bypass
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: bootstrap:cfo
      - task: map-assets:install
      - LEAPVIEW_DEV_AUTH_BYPASS=true LEAPVIEW_LOCAL_AUTH=false LEAPVIEW_DEV_RESTART=1 LEAPVIEW_DEV_READY_ATTEMPTS=1800 LEAPVIEW_DEV_MCP_MODEL_QUERY=finance LEAPVIEW_DEV_MCP_METRIC=net_sales ./scripts/dev-server.sh start dashboards/experiments/cfo-demo finance_files .data/cfo-demo

  dbt:warehouse:build:
    desc: Build and verify the pinned dbt-duckdb warehouse-boundary Parquet publication
    sources:
      - examples/dbt-warehouse-boundary/dbt/**/*.sql
      - examples/dbt-warehouse-boundary/dbt/**/*.yml
      - examples/dbt-warehouse-boundary/dbt/**/*.csv
      - examples/dbt-warehouse-boundary/dbt/requirements.txt
      - scripts/dbt-warehouse-boundary.sh
    generates:
      - examples/dbt-warehouse-boundary/published/dim_customers.parquet
      - examples/dbt-warehouse-boundary/published/fct_orders.parquet
    cmds:
      - ./scripts/dbt-warehouse-boundary.sh build

  dbt:warehouse:proof:
    desc: Prove independent physical producers and upstream dbt packages close into one Project
    cmds:
      - ./scripts/dbt-warehouse-boundary.sh proof

  dbt:warehouse:qualify:
    desc: Run the physical dbt Parquet publication through the ordinary headless LeapView candidate lifecycle
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: map-assets:install
      - task: dbt:warehouse:build
      - ./scripts/dev-server.sh once examples/dbt-warehouse-boundary/leapview warehouse examples/dbt-warehouse-boundary/published

  dbt:warehouse:
    desc: Build the dbt-duckdb showcase and start LeapView through the managed development flow
    cmds:
      - task: postgres:dev:up
      - task: generate
      - task: build
      - task: map-assets:install
      - task: dbt:warehouse:build
      - ./scripts/dev-server.sh start examples/dbt-warehouse-boundary/leapview warehouse examples/dbt-warehouse-boundary/published

  bootstrap:
    desc: Download/sync Olist CSVs if missing
    cmds:
      - go run ./internal/app/tools/bootstrapolist --shared-cache --out .data/olist

  map-style:generate:
    desc: Generate the pinned renderer-owned MapLibre style
    deps:
      - node:deps
    sources:
      - scripts/generate_map_style.ts
      - package.json
      - bun.lock
    generates:
      - static/map-assets/leapview-streets/style.json
    cmds:
      - bun scripts/generate_map_style.ts

  map-assets:install:
    desc: Install the pinned local PMTiles, glyph, and sprite assets used by development
    cmds:
      - go run ./internal/app/tools/mapassets --shared-cache --out .data/map-assets

  map-assets:publish:
    desc: Publish the verified content-addressed map package to managed S3 storage and optionally verify its public delivery
    requires:
      vars: [MAP_ASSET_S3_BUCKET]
    cmds:
      - >-
        go run ./internal/app/tools/mapassets
        --out .data/map-assets
        --shared-cache
        --publish-s3-bucket {{.MAP_ASSET_S3_BUCKET | quote}}
        --publish-s3-prefix {{default "map-assets" .MAP_ASSET_S3_PREFIX | quote}}
        {{if .MAP_ASSET_S3_REGION}}--publish-s3-region {{.MAP_ASSET_S3_REGION | quote}}{{end}}
        {{if .MAP_ASSET_S3_ENDPOINT}}--publish-s3-endpoint {{.MAP_ASSET_S3_ENDPOINT | quote}}{{end}}
        {{if .MAP_ASSET_S3_PATH_STYLE}}--publish-s3-path-style{{end}}
        {{if .MAP_ASSET_BASE_URL}}--verify-base-url {{.MAP_ASSET_BASE_URL | quote}}{{end}}

  map-assets:verify:
    desc: Verify the complete map package through its same-origin production delivery path
    requires:
      vars: [MAP_ASSET_BASE_URL]
    cmds:
      - >-
        go run ./internal/app/tools/mapassets
        --out .data/map-assets
        --shared-cache
        --verify-base-url {{.MAP_ASSET_BASE_URL | quote}}

  site:map-assets:smoke:
    desc: Verify a running public site serves every basemap file its pages reference (SITE_BASE_URL defaults to production)
    cmds:
      - go run ./cmd/leapview-site/smoke --base-url {{default "https://leapview.dev" .SITE_BASE_URL | quote}}

  bootstrap:movielens:
    desc: Download/sync MovieLens 32M CSVs if missing
    cmds:
      - go run ./internal/app/tools/bootstrapmovielens --shared-cache --out .data/movielens

  bootstrap:cfo:
    desc: Download/sync the pinned Microsoft Financial Sample workbook if missing
    cmds:
      - go run ./internal/app/tools/bootstrapfinance --shared-cache --out .data/cfo-demo

  dev:stop:
    desc: Stop the managed LeapView dev server for this worktree
    cmds:
      - ./scripts/dev-server.sh stop

  dev:status:
    desc: Show managed LeapView dev server status
    cmds:
      - ./scripts/dev-server.sh status

  dev:credentials:
    desc: Show the private local development login after task dev has initialized it
    cmds:
      - ./scripts/dev-server.sh credentials

  dev:auth-smoke:
    desc: Verify real login, group role activation after release, and revocation
    cmds:
      - ./scripts/dev-server.sh auth-smoke

  dev:publish:
    desc: Publish the current development candidate with real scoped authority
    cmds:
      - LEAPVIEW_DEV_SKIP_DATA_SYNC=1 ./scripts/dev-server.sh publish

  dev:logs:
    desc: Tail managed LeapView dev server logs
    cmds:
      - ./scripts/dev-server.sh logs

  postgres:dev:up:
    desc: Provision the loopback-only PostgreSQL 18 development databases and roles
    cmds:
      - ./scripts/postgres-dev.sh up

  postgres:dev:
    desc: Provision the local PostgreSQL development databases and roles
    cmds:
      - task: postgres:dev:up

  postgres:dev:down:
    desc: Stop the local PostgreSQL development service (retains its volume)
    cmds:
      - ./scripts/postgres-dev.sh down

  postgres:dev:status:
    desc: Show the local PostgreSQL development service status
    cmds:
      - ./scripts/postgres-dev.sh status

  postgres:dev:env:
    desc: Print the path to the mode-0600 local PostgreSQL runtime environment file
    cmds:
      - ./scripts/postgres-dev.sh env

  postgres:dev:check:
    desc: Verify local PostgreSQL database and runtime-role isolation
    cmds:
      - ./scripts/postgres-dev.sh check

  postgres:test:up:
    desc: Provision an isolated PostgreSQL 18 test service on a worktree-scoped port
    env:
      LEAPVIEW_POSTGRES_PROJECT_SUFFIX: -test
      LEAPVIEW_POSTGRES_TEST_MODE: "1"
      LEAPVIEW_POSTGRES_DEV_ENV_FILE: "{{.ROOT_DIR}}/.tmp/postgres-test.env"
    cmds:
      - ./scripts/postgres-dev.sh up

  postgres:test:
    desc: Provision the isolated PostgreSQL test databases and roles
    cmds:
      - task: postgres:test:up

  postgres:test:down:
    desc: Stop the isolated PostgreSQL test service (retains its volume)
    env:
      LEAPVIEW_POSTGRES_PROJECT_SUFFIX: -test
      LEAPVIEW_POSTGRES_TEST_MODE: "1"
      LEAPVIEW_POSTGRES_DEV_ENV_FILE: "{{.ROOT_DIR}}/.tmp/postgres-test.env"
    cmds:
      - ./scripts/postgres-dev.sh down

  postgres:test:check:
    desc: Verify isolated PostgreSQL test database and runtime-role isolation
    env:
      LEAPVIEW_POSTGRES_PROJECT_SUFFIX: -test
      LEAPVIEW_POSTGRES_TEST_MODE: "1"
      LEAPVIEW_POSTGRES_DEV_ENV_FILE: "{{.ROOT_DIR}}/.tmp/postgres-test.env"
    cmds:
      - ./scripts/postgres-dev.sh check

  test:qualification:native-postgres:
    desc: Run native PostgreSQL topology, bundled retry, and cold restore regressions
    env:
      LEAPVIEW_TEST_CONTAINERS: "1"
      LEAPVIEW_TEST_BUNDLED_POSTGRES_DOCKER: "1"
    cmds:
      - task: generate
      - go test ./internal/app/cli/composectl -run '^TestQualificationNativePostgresTopologyContainerBackedContract$' -count=1 -v
      - go test ./internal/app/cli/composectl -run '^TestBundledPostgresPrepareSeedsAppEnvBeforeCompose$' -count=1 -v
      - go test ./internal/app/cli/composectl -run '^TestBundledPostgresDockerResumesProvisioningAndPreservesVolume$' -count=1 -v
      - go test ./internal/app/cli/composectl -run '^TestBundledPostgresDockerStopsGracefully$' -count=1 -v
      - go test ./internal/app/cli/composectl -run '^TestBundledPostgresColdSnapshotRestoreQualification$' -count=1 -v

  test:qualification:managed-replacement:
    desc: Qualify the restored application component in the managed-recovery Nix shell
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "true"
    preconditions:
      - test -x "$LEAPVIEW_TEST_MANAGED_RESTIC"
      - test -x "$LEAPVIEW_TEST_MANAGED_POSTGRES_BIN/pg_ctl"
      - test -x "$LEAPVIEW_TEST_MANAGED_PGBACKREST"
      - test -x "$LEAPVIEW_TEST_MANAGED_BWRAP"
    cmds:
      - task: ci:prepare
      - go test ./internal/app -run '^TestManagedRecoveryReplacementApplication$' -count=1 -timeout=10m -v
      - python3 -B -m unittest discover -s deploy/managed/nixos/tests -p postgres_restore_test.py

  test:qualification:demo-host-recovery:
    desc: Run isolated host recovery and migration-boundary qualification with synthetic disposable fixtures
    cmds:
      - task generate
      - go run ./internal/app/tools/securitypolicy -root .
      - go test -race ./internal/app/cli/hostinstall -count=1
      - PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s scripts/tests -p 'test_demo*.py'
      - |
        set -eu
        migration_tests="$(go test -list '^Test(DemoUpgrade|HostUpgrade|UpgradeBoundary)' ./internal/platform/postgres/migrations)"
        for test_name in \
          TestDemoUpgradePostgreSQL18 \
          TestDemoUpgradePartialMigrationPostgreSQL18RequiresRecovery \
          TestHostUpgradeFutureRevisionUsesSameExecutor \
          TestUpgradeBoundaryRejectsUnknownTransitionsBeforeMigration \
          TestUpgradeBoundaryRequiresCompleteHistoricalPrefix \
          TestUpgradeBoundaryRejectsPartialAndPrematureCandidate \
          TestUpgradeBoundaryAllowsCompleteFutureAndPolicyOnlyTransitions; do
          if ! printf '%s\n' "$migration_tests" | grep -Fx "$test_name" >/dev/null; then
            printf 'required migration qualification test missing: %s\n' "$test_name" >&2
            exit 1
          fi
        done
        LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED=true \
          go test ./internal/platform/postgres/migrations \
            -run '^Test(DemoUpgrade|HostUpgrade|UpgradeBoundary)' -count=1 -timeout=5m -v
      - |
        set -eu
        recovery_tests="$(go test -list '^Test(ColdPostgreSQLPairRecovery|InternalNetworkRecoveryRelay|VolumeTLSMountQualification|AgentProviderPrivateConfigContainer)$' ./internal/app/cli/hostinstall)"
        for test_name in TestColdPostgreSQLPairRecovery TestInternalNetworkRecoveryRelay TestVolumeTLSMountQualification TestAgentProviderPrivateConfigContainer; do
          if ! printf '%s\n' "$recovery_tests" | grep -Fx "$test_name" >/dev/null; then
            printf 'required physical recovery test missing: %s\n' "$test_name" >&2
            exit 1
          fi
        done
        CGO_ENABLED=0 LEAPVIEW_HOST_UPGRADE_QUALIFICATION=1 \
          go test ./internal/app/cli/hostinstall \
            -run '^Test(ColdPostgreSQLPairRecovery|InternalNetworkRecoveryRelay|VolumeTLSMountQualification|AgentProviderPrivateConfigContainer)$' \
            -count=1 -timeout=10m -v

  test:qualification:historical-transition:
    desc: Run the required schema-32 to typed-access transition against a pinned predecessor and exact candidate image
    cmds:
      - |
        set -eu
        test "${LEAPVIEW_HISTORICAL_TRANSITION_REQUIRED:-}" = 1 || {
          printf 'LEAPVIEW_HISTORICAL_TRANSITION_REQUIRED=1 is required for the historical transition lane\n' >&2
          exit 64
        }
        test -n "${LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_IMAGE:-}" || {
          printf 'candidate image identity is required\n' >&2
          exit 64
        }
        test -n "${LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_REVISION:-}" || {
          printf 'candidate source revision is required\n' >&2
          exit 64
        }
        test -n "${LEAPVIEW_HISTORICAL_TRANSITION_EVIDENCE:-}" || {
          printf 'private transition receipt path is required\n' >&2
          exit 64
        }
        if [ "${LEAPVIEW_HISTORICAL_TRANSITION_FINAL_ARTIFACT:-0}" = 1 ]; then
          test -n "${LEAPVIEW_HISTORICAL_TRANSITION_ADMISSION:-}" || {
            printf 'final-artifact qualification requires OCI admission evidence\n' >&2
            exit 64
          }
        fi
        task generate
        go run ./internal/app/tools/securitypolicy -root .
        go test ./internal/app/cli/composectl \
          -run '^TestQualificationHistoricalTransitionInputsFailClosed$' \
          -count=1
        transition_tests="$(go test ./internal/app/cli/composectl -list '^TestQualificationHistoricalTransitionEndToEnd$' -count=1)"
        printf '%s\n' "${transition_tests}" | grep -Fx 'TestQualificationHistoricalTransitionEndToEnd' >/dev/null || {
          printf 'required historical transition end-to-end test is missing\n' >&2
          exit 1
        }
        go test ./internal/app/cli/composectl \
          -run '^TestQualificationHistoricalTransitionEndToEnd$' \
          -count=1 -timeout=110m -v

  test:qualification:historical-transition:local:
    desc: Build a local candidate image and run the mandatory historical transition fixture
    cmds:
      - |
        set -euo pipefail
        if [ -n "$(git status --porcelain=v1 --untracked-files=all)" ]; then
          printf 'local historical-transition image requires a clean Git source tree; commit or export an immutable snapshot first\n' >&2
          exit 64
        fi
        task generate
        revision="$(git rev-parse HEAD)"
        [[ "${revision}" =~ ^[0-9a-f]{40}$ ]]
        if [ -n "$(git status --porcelain=v1 --untracked-files=all)" ]; then
          printf 'generation changed the source tree; refusing to label a mutable tree as the exact historical-transition candidate\n' >&2
          exit 64
        fi
        build_time="$(git show -s --format=%cI "${revision}")"
        tag="leapview:historical-transition-${revision:0:12}"
        docker buildx build --load --platform linux/amd64 --file Dockerfile \
          --tag "${tag}" \
          --build-arg BUILD_VERSION=historical-transition \
          --build-arg BUILD_REVISION="${revision}" \
          --build-arg BUILD_TIME="${build_time}" \
          --build-arg BUILD_DIRTY=false \
          --build-arg BUILD_RELEASE=false .
        image="$(docker image inspect "${tag}" --format '{{"{{"}}.Id{{"}}"}}')"
        [[ "${image}" =~ ^sha256:[0-9a-f]{64}$ ]]
        evidence_dir="$(mktemp -d "${TMPDIR:-/tmp}/leapview-historical-transition.XXXXXX")"
        LEAPVIEW_HISTORICAL_TRANSITION_REQUIRED=1 \
          LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_IMAGE="${image}" \
          LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_REVISION="${revision}" \
          LEAPVIEW_HISTORICAL_TRANSITION_EVIDENCE="${evidence_dir}/transition.json" \
          LEAPVIEW_HISTORICAL_TRANSITION_FINAL_ARTIFACT=0 \
          task test:qualification:historical-transition

  test:qualification:authoring-package:
    desc: Verify the released authoring archive qualification contract without Docker
    cmds:
      - go test ./deploy/local -run '^TestReleasedAuthoringQualification' -count=1

  qa:authoring-package:
    desc: Qualify an exact released authoring archive and retain bounded evidence
    requires:
      vars: [LEAPVIEW_AUTHORING_ARCHIVE]
    cmds:
      - >-
        ./deploy/local/qualification/qualify.sh
        --archive "{{.LEAPVIEW_AUTHORING_ARCHIVE}}"
        --evidence-dir "{{.LEAPVIEW_AUTHORING_EVIDENCE_DIR | default .ROOT_DIR}}/.tmp/qualification/authoring-package"
        {{if .LEAPVIEW_AUTHORING_REQUIRED}}--required{{end}}
        {{if .LEAPVIEW_AUTHORING_RUN_LIFECYCLE}}--run-lifecycle --docker-host "{{.LEAPVIEW_AUTHORING_DOCKER_HOST}}"{{end}}

  test:qualification:postgres-ha:
    desc: Run the bounded disposable same-host PostgreSQL 18 Patroni HA qualification
    cmds:
      - timeout --signal=TERM --kill-after=30s 10m ./deploy/postgres/ha/run.sh

  node:deps:
    desc: Install JavaScript dependencies with Bun
    # Nested dependency paths must share one writer to this checkout's tree.
    # Verify the frozen graph on every Task invocation; a binary's presence
    # cannot establish that the complete installed dependency tree is sound.
    run: once
    cmds:
      - bun install --frozen-lockfile

  build:
    desc: Build browser assets
    deps:
      - node:deps
      - layout-contract:generate
    cmds:
      - bun run build

  desktop:deps:
    desc: Install the pinned LeapView Desktop dependencies
    dir: desktop
    cmds:
      - bun install --frozen-lockfile

  desktop:test:
    desc: Run LeapView Desktop discovery, profile, UI, and shared security contracts
    deps:
      - desktop:deps
    dir: desktop
    cmds:
      - bun run typecheck:tests
      - bun run test
      - bun run build

  desktop:start:
    desc: Start the unpackaged LeapView Desktop client
    deps:
      - desktop:deps
    dir: desktop
    cmds:
      - bun run start

  desktop:package:
    desc: Build an unpackaged LeapView Desktop application for the current platform
    deps:
      - desktop:deps
    dir: desktop
    env:
      LEAPVIEW_DESKTOP_DISTRIBUTION: preview
    cmds:
      - bun run package

  desktop:make:
    desc: Build and verify the native LeapView Desktop installer for the current platform
    deps:
      - desktop:deps
    dir: desktop
    env:
      LEAPVIEW_DESKTOP_DISTRIBUTION: preview
    cmds:
      - bun run make
      - bun run evidence

  site:build:
    desc: Build the LeapView public site assets from generated contracts
    cmds:
      - task: ui-signals:generate
      - task: visualization-ir:generate
      - task: layout-contract:generate
      - task: node:deps
      - bun run build:site

  ci:prepare:frontend:
    desc: Generate only the contracts and assets required by frontend CI
    cmds:
      - task: api:generate
      - task: ui-signals:generate
      - task: visualization-ir:generate
      - task: build

  ci:test:docs-site:
    desc: Prepare and validate complete documentation and site coverage independently
    cmds:
      - task: ci:prepare
      - task: ci:test:docs
      - task: ci:test:frontend:site

  ci:test:docs:
    desc: Validate documentation generation, snapshots, observation and site Go contracts on prepared assets
    cmds:
      - |
        bash scripts/check_generated_snapshots.sh \
          .env.example \
          docs/api/openapi.yaml \
          docs/llms.txt \
          docs/reference/agent-tools \
          docs/articles/reference/data-resource-connectors.md \
          internal/agent/contracts \
          internal/project/contracts \
          api/gen/data-resources-ir.json \
          web/generated/data-resources \
          schemas/config \
          schemas/desktop \
          schemas/json \
          -- task --force docs:generate
      - task: site:observation:test
      - task: docs:check
      - go test ./cmd/leapview-site ./docs ./site ./internal/app/site/...

  audit:inventory:
    desc: Inventory tracked files, feature declarations and frontend CI registration without running product tests
    deps: [node:deps]
    cmds:
      - node scripts/audit_inventory.mjs {{.CLI_ARGS}}

  audit:controller-catalogs:
    desc: Inventory explicit controller commands for both shipped builds without executing them
    deps:
      - node:deps
      - db:generate
      - config:generate
      - api:generate
      - ui-signals:generate
    cmds:
      # Bind the source before compilation as well as during construction.
      - node scripts/controller_catalogs.mjs {{.CLI_ARGS}}

  audit:go-receipt:
    desc: Capture bounded fresh named Go executions and bind their source, inputs, command and raw logs
    deps: [node:deps]
    cmds:
      # Prepare generated sources before capturing; keep logs in ignored/external storage.
      - node scripts/go_receipts.mjs {{.CLI_ARGS}}

  ci:test:frontend:core:
    desc: Run global browser contracts, typechecks, and core application tests
    cmds:
      - python3 -B -m unittest discover -s scripts -p reference_library_test.py
      - PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s scripts/tests -p test_dashboard_design_trials.py
      - bun test scripts/generated_snapshot_check.test.ts
      - node --test scripts/ci_watchdog.test.mjs
      - node --test scripts/browser_test_diagnostics.test.mjs
      - node --test desktop/scripts/lifecycle-probe-policy.test.mjs desktop/scripts/lifecycle-probe-cdp.test.mjs
      - node --test scripts/run_performance_comparison.test.mjs
      - bun test scripts/performance_comparison_workflow.test.ts
      - node --test deploy/compose/qualification/performance-resources.test.mjs
      - node --test scripts/performance_baseline_review.test.mjs scripts/qualify_performance_reference.test.mjs
      - node --test scripts/audit_inventory.test.mjs scripts/controller_catalogs.test.mjs scripts/go_receipt_index.test.mjs scripts/go_receipts.test.mjs scripts/performance_ci_events.test.mjs
      - bun test scripts/ci_optimization_contract.test.ts
      - bun test scripts/frontend_ci_contract.test.ts
      - bun test scripts/release_cli_lifecycle_gate.test.ts
      - bun test scripts/frontend_test_registration.test.ts && bun scripts/frontend_test_registration.mjs
      - bun test scripts/nix_ci_contract.test.ts scripts/ci_dependency_acquisition_contract.test.ts
      - bun test scripts/ci_docker_contract.test.ts
      - bun test scripts/released_predecessor_gate.test.ts
      - python3 -m unittest discover -s scripts/tests -p test_prepare_sqlc_modules.py
      - python3 -m unittest discover -s scripts/tests -p test_prepare_ci_fixture_images.py
      - bun test scripts/nix_desktop_candidate_contract.test.ts
      - bun test scripts/nix_compose_candidate_contract.test.ts
      - bun test scripts/managed_admission_contract.test.ts
      - bun test scripts/managed_application_contract.test.ts
      - python3 -m unittest discover -s scripts/tests -p test_managed_admission_handoff.py
      - python3 -m unittest discover -s scripts/tests -p test_managed_application_inputs.py
      - python3 -m unittest discover -s scripts/tests -p test_managed_recovery_inventory.py
      - python3 -m unittest discover -s scripts/tests -p test_ci_docker_credentials.py
      - python3 -m unittest discover -s deploy/managed/nixos/tests -p 'managed_application*_test.py'
      - python3 -B -m unittest discover -s deploy/managed/nixos/tests -p 'postgres_*_test.py'
      - python3 -m unittest discover -s scripts/tests -p test_qualification_release.py
      - python3 -m unittest discover -s scripts/tests -p 'test_performance_*.py'
      - node --test scripts/performance_build_inputs.test.mjs
      - python3 -m unittest discover -s scripts/tests -p test_ci_sqlc_layer_screen.py
      - python3 -m unittest discover -s scripts/tests -p 'test_ci_sqlc_hosted_*.py'
      - bun test scripts/sqlc_hosted_contract.test.ts
      - python3 -m unittest discover -s scripts/tests -p test_package_compose_bundle.py
      - python3 -m unittest discover -s scripts/tests -p test_release_image_promotion.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_ci_environment.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_cli_compatibility.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_candidate_manifest.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_desktop_qualification.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_desktop_attestation.py
      - python3 -m unittest discover -s scripts/tests -p 'test_nix_desktop_lifecycle*.py'
      - python3 -m unittest discover -s scripts/tests -p test_nix_desktop_preview_inputs.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_native_inventory.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_oci_content.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_registry_content.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_signed_evidence.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_candidate_publication.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_candidate_artifacts.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_candidate_authorization.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_release_inputs.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_release_verification.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_admission_handoff.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_cli_publication.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_archive_go_evidence.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_cli_go_evidence.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_qualification.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_controller_evidence.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_helper_images.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_helper_image_probe.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_host_guest.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_docker_readiness.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_bundled_postgres.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_installer_diagnostics.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_compose_guest_launcher.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_runtime_security.py
      - python3 -m unittest discover -s scripts/tests -p test_nix_site_image.py
      - bun test scripts/node_deps_contract.test.ts
      - bun test scripts/contract_projection_fixture.test.ts
      - bun test scripts/agent_e2e_config.test.ts
      - bun test scripts/ensure_playwright.test.ts
      - bun run test:primer-primitives
      - bun run test:primer-alignment
      - bun run test:theme
      - bun run test:datastar-lit
      - bun test web/components/shared/clipboard.test.ts web/components/shared/code-theme-contrast.test.ts web/components/shared/datastar-runtime.test.ts web/components/shared/datastar-runtime-error.test.ts web/components/shared/lazy-import.test.ts web/components/shared/markdown-render.test.ts
      - bun run test:ui-command-boundaries
      - bun run test:command-failure
      - bun test web/components/shared/command-failure-guard.test.ts web/components/shared/page-stream-recovery.test.ts
      - node scripts/ensure_playwright.mjs && bun test web/components/shared/command.dom.test.ts
      - node scripts/ensure_playwright.mjs && bun test web/components/shared/page-stream-recovery.dom.test.ts
      - bun test web/components/shared/field-types.test.ts web/components/chat/agent-availability.test.ts web/components/admin/settings-surfaces.helpers.test.ts web/components/admin/settings-audit-view-model.test.ts web/components/dashboard/visualization/adapters/maplibre/lifecycle.test.ts
      - bun test web/components/shared/drawer.focus.test.ts
      - bun run test:app-shell
      - bun run test:settings
      - bun run typecheck:app
      - bun run typecheck:playground
      - bun run typecheck:contracts
      - bun run typecheck:tests
      - bun run test:production-assets
      - bun run test:movielens-performance-harness
      - bun test scripts/performance_browser_profile.test.ts
      - bun run test:viewport-qualification-harness
      - bun run test:public-site-smoke

  ci:test:frontend:reports:
    desc: Run dashboard, visualization, and report browser tests
    cmds:
      - task: ci:test:frontend:reports:viewer
      - task: ci:test:frontend:reports:playground
      - task: ci:test:frontend:reports:builder

  ci:test:frontend:reports:viewer:
    desc: Run dashboard viewer and table browser tests
    cmds:
      - bun run test:visualization-ir
      - bun run test:table-selection
      - bun run test:interaction-selection
      - bun run test:record-table
      - bun run test:visual-modal
      - bun run test:catalog-page
      - bun run test:dashboard-page
      - bun run test:date-picker
      - bun run test:windowed-table
      - bun run test:filter-menu

  ci:test:frontend:reports:playground:
    desc: Run standalone visual preview and report browser tests
    cmds:
      - bun run test:playground

  ci:test:frontend:reports:builder:
    desc: Run dashboard builder browser tests
    cmds:
      - bun run test:dashboard-builder

  ci:test:frontend:chat:
    desc: Run chat and shared content browser tests
    cmds:
      - bun run test:chat-composer
      - bun run test:chat-page
      - bun run test:chat-thread
      - bun run test:code-block
      - bun run test:markdown-view

  ci:test:frontend:data:
    desc: Run administration and data browser tests
    cmds:
      - task: ci:test:frontend:data:explorer
      - task: ci:test:frontend:data:pages

  ci:test:frontend:data:explorer:
    desc: Run governed Explorer browser tests
    cmds:
      - bun run test:data-explorer

  ci:test:frontend:data:pages:
    desc: Run administration and data page browser tests
    cmds:
      - bun run test:project-page
      - bun run test:admin-page
      - bun run test:code-editor
      - bun run test:login-page
      - bun run test:asset-lineage
      - bun run test:semantic-model-graph
      - bun run test:datastar-inspector
      - bun run test:topology-background

  ci:test:frontend:site:
    desc: Run public documentation and site browser tests
    cmds:
      - bun run test:docs-diagrams
      # ci:pr builds the embedded site tree before starting concurrent lanes.
      # Rebuilding here would delete site/static while Go packages compile it.
      - bun run test:site:prepared
      # Each Playwright site file owns a browser and server, so it runs in its own process.
      - bun test site/site-interactions.dom.test.ts

  site:binary:
    desc: Build the independently deployable public site from generated documentation
    cmds:
      - task: generate
      - task: site:build
      - go build -o bin/leapview-site ./cmd/leapview-site

  site:image:
    desc: Build the production LeapView public site OCI image
    cmds:
      - docker build --file Dockerfile.site --tag leapview-site:local .

  site:dev:
    desc: Start the public site from generated documentation on http://localhost:8081
    cmds:
      - task: generate
      - task: site:build
      - go run ./cmd/leapview-site

  site:product-screenshot:
    desc: Refresh light and dark homepage screenshots from the deployed Visual Showcase
    deps:
      - postgres:dev:up
    cmds:
      - task: generate
      - task: build
      - bun scripts/capture_site_product.ts

  quality:budget:check:
    desc: Enforce ratcheting maintainability and engineering-quality budgets
    cmds:
      - go run ./internal/app/tools/qualitybudget

  quality:budget:update:
    desc: Tighten quality-budget baselines after maintainability improvements
    cmds:
      - go run ./internal/app/tools/qualitybudget --write

  quality:critical:coverage:
    desc: Enforce coverage floors for critical packages
    cmds:
      - go run ./internal/app/tools/criticalquality --mode coverage

  quality:critical:race:
    desc: Race-qualify every critical package in the full merge lane
    cmds:
      - go run ./internal/app/tools/criticalquality --mode race

  quality:exceptions:check:
    desc: Validate owned and time-bounded engineering exceptions
    cmds:
      - go run ./internal/app/tools/exceptionquality

  deadexports:check:
    desc: Reject exported Go declarations without repository references
    deps:
      - generate
    cmds:
      - go run ./internal/app/tools/deadexports --root {{.ROOT_DIR | quote}} --allowlist {{.ROOT_DIR}}/.quality/dead-exports.json

  quality:trends:report:
    desc: Report structural complexity and ownership-change concentration
    cmds:
      - go run ./internal/app/tools/qualitytrends

  bench:arrow:quick:
    desc: Run the bounded Arrow evidence benchmark matrix for local iteration
    cmds:
      - go test ./pkg/arrowresult -run '^$' -bench '^BenchmarkArrow(CaptureCopy|IPCExistingDashboardString|IPCNativeReference)$/(narrow|wide|dictionary)/(rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/analytics/arrowdecode -run '^$' -bench '^BenchmarkArrowDecodeRows$/(narrow|wide|dictionary)/(rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/analytics/resultcache -run '^$' -bench '^BenchmarkWarmArrowCacheLookupLease$/(narrow|wide)/(rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/dashboard/arrowbench -run '^$' -bench '^BenchmarkDashboard(RowShaping|StringProjection)$/(narrow|wide)/(rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/dashboard/runtime -run '^$' -bench '^BenchmarkDashboardWarmShapingStages$/(kpi|wide_chart|table_window_narrow|table_window_wide)/(rows_1|rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/dashboard/http -run '^TestDashboard(Baseline|Warm)' -bench '^BenchmarkDashboardBaseline(EndToEnd|Stages)$/(detail_narrow|detail_wide|matrix|pivot)/(rows_50|rows_1000)$' -benchmem -benchtime=100ms -count=3 -cpu=1
      - go test ./internal/dashboard/http -run '^TestDashboardWarm' -bench '^BenchmarkDashboardWarmCacheConcurrency$/(kpi|chart_bundle|wide_chart|table_window_arrow)/(users_1|users_20)$' -benchmem -benchtime=1x -count=3 -cpu=1
      - go test ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardWarmSerializationStages$' -benchmem -benchtime=100ms -count=3 -cpu=1

  bench:arrow:full:
    desc: Run all Arrow evidence workloads with comparison-grade sample counts
    cmds:
      - go test ./pkg/arrowresult -run '^$' -bench '^BenchmarkArrow(CaptureCopy|IPCExistingDashboardString|IPCNativeReference)$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/analytics/arrowdecode -run '^$' -bench '^BenchmarkArrowDecodeRows$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/analytics/resultcache -run '^$' -bench '^BenchmarkWarmArrowCacheLookupLease$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/dashboard/arrowbench -run '^$' -bench '^BenchmarkDashboard(RowShaping|StringProjection)$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/dashboard/runtime -run '^$' -bench '^BenchmarkDashboardWarmShapingStages$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/dashboard/http -run '^TestDashboard(Baseline|Warm)' -bench '^BenchmarkDashboardBaseline' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test ./internal/dashboard/http -run '^TestDashboardWarm' -bench '^BenchmarkDashboardWarmCacheConcurrency$' -benchmem -benchtime=250ms -count=10 -cpu=1
      - go test ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardWarmSerializationStages$' -benchmem -benchtime=500ms -count=10 -cpu=1

  test:arrow:direct-streaming-experiment:
    desc: Run the isolated FAI-543 governed native-v1 prototype contracts
    cmds:
      - go test -tags=fai543experiment ./internal/dashboard/http -run '^(TestDashboardNativeArrowContract|TestDashboardDirectArrowExperiment)' -count=1
      - go test -tags=fai543experiment ./internal/dashboard/queryauthz -run '^(TestDashboardNativeArrowContract|TestDirectArrowExperiment)' -count=1
      - go test ./internal/dashboard/semanticapi -run '^(TestSemanticArrowSink|TestWriteSemanticArrowResponse)' -count=1

  bench:arrow:direct-streaming-experiment:
    desc: Compare current api_direct with the isolated FAI-543 governed native-v1 prototype
    cmds:
      - go test -tags=fai543experiment ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardDirectArrowExperiment$' -benchmem -benchtime=500ms -count=10 -cpu=1

  test:arrow:direct-streaming-qualification:
    desc: Run the isolated FAI-544 real-DuckDB and HTTP qualification contracts
    cmds:
      - go test -tags='fai543experiment duckdb_arrow' ./internal/dashboard/http -run '^TestDashboardDirectArrowQualification' -count=1

  bench:arrow:direct-streaming-qualification:quick:
    desc: Run a bounded local sample of the FAI-544 qualification workloads
    cmds:
      - go test -tags='fai543experiment duckdb_arrow' ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardDirectArrowQualification$' -benchmem -benchtime=100ms -count=1 -cpu=1
      - go test -tags='fai543experiment duckdb_arrow' ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardDirectArrowQualificationConcurrency$' -benchmem -benchtime=100ms -count=1 -cpu=1

  bench:arrow:direct-streaming-qualification:
    desc: Run comparison-grade FAI-544 real-DuckDB and HTTP qualification workloads
    cmds:
      - go test -tags='fai543experiment duckdb_arrow' ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardDirectArrowQualification$' -benchmem -benchtime=1s -count=10 -cpu=1,4
      - go test -tags='fai543experiment duckdb_arrow' ./internal/dashboard/http -run '^$' -bench '^BenchmarkDashboardDirectArrowQualificationConcurrency$' -benchmem -benchtime=1s -count=10 -cpu=1,4

  bench:cache:cutover:quick:
    desc: Smoke-test cache cutover latency and retention benchmarks
    cmds:
      - go test -p 1 -tags=duckdb_arrow ./internal/analytics/resultcache ./internal/analytics/materialize -run '^$' -bench '^BenchmarkCacheCutover' -benchmem -benchtime=100ms -count=3 -cpu=1

  bench:cache:cutover:full:
    desc: Capture comparison-grade cache cutover benchmark evidence
    cmds:
      - go test -p 1 -tags=duckdb_arrow ./internal/analytics/resultcache ./internal/analytics/materialize -run '^$' -bench '^BenchmarkCacheCutover' -benchmem -benchtime=500ms -count=10 -cpu=1

  bench:cache:admission:quick:
    desc: Smoke-test the FAI-535 LRU and frequency-aware admission comparison
    cmds:
      - go test -p 1 ./internal/analytics/resultcache -run '^TestAdmissionWorkload' -bench '^BenchmarkCacheAdmissionWorkload$' -benchmem -benchtime=100ms -count=3 -cpu=1

  bench:cache:admission:full:
    desc: Capture comparison-grade FAI-535 cache admission evidence
    cmds:
      - go test -p 1 ./internal/analytics/resultcache -run '^TestAdmissionWorkload' -bench '^BenchmarkCacheAdmissionWorkload/lru$' -benchmem -benchtime=500ms -count=10 -cpu=1
      - go test -p 1 ./internal/analytics/resultcache -run '^TestAdmissionWorkload' -bench '^BenchmarkCacheAdmissionWorkload/frequency_aware$' -benchmem -benchtime=500ms -count=10 -cpu=1

  bench:datastar-bridge:
    desc: Benchmark legacy, Ignition, and DatastarLit bridges in Chromium
    deps:
      - node:deps
    cmds:
      - bun run bench:datastar-bridge

  qa:ui-framework:
    desc: Run browser QA for the stream-first DatastarLit UI framework
    deps:
      - node:deps
    cmds:
      - bun test scripts/qa_ui_framework_config.test.ts
      - bun scripts/qa_ui_framework.ts

  qa:ui-framework:visual:update:
    desc: Review and refresh the UI framework visual-regression baselines
    deps:
      - node:deps
    cmds:
      - bun test scripts/qa_ui_framework_config.test.ts
      - LEAPVIEW_UI_QA_SCOPE=visual LEAPVIEW_UPDATE_VISUAL_BASELINES=1 bun scripts/qa_ui_framework.ts

  qa:movielens-performance:
    desc: Run the local/nightly dashboard performance runner with the MovieLens scenario (not part of CI)
    deps:
      - node:deps
    cmds:
      - bun run qa:movielens-performance

  qa:dashboard-performance:
    desc: Run a configured local/nightly performance scenario against a running dev server (not part of CI)
    deps:
      - node:deps
    cmds:
      - bun run qa:dashboard-performance

  test:viewport-qualification-harness:
    desc: Test fail-closed viewport qualification evidence contracts
    deps:
      - node:deps
    cmds:
      - bun run test:viewport-qualification-harness

  qa:viewport-qualification:
    desc: Capture paired local eager/deferred dashboard viewport evidence (not part of CI)
    deps:
      - node:deps
    cmds:
      - bun run qa:viewport-qualification

  generate:
    desc: Generate all checked-out derived code needed for local development
    cmds:
      - task: go:deps
      - task: adr0016-conformance:generate
      - task: duckdbsql:generate
      - task: db:generate
      - task: config:generate
      - task: permission-contracts:generate
      - task: api:generate
      - task: agent-contracts:generate
      - task: ui-signals:generate
      - task: schema:generate
      - task: data-resource-contracts:generate
      - task: desktop-discovery:generate
      - task: visualization-ir:generate
      - task: exploration-contracts:generate
      - task: dashboard-contracts:generate
      - task: pipeline-contracts:generate
      - task: layout-contract:generate
      - task: map-style:generate
      - task: lucide-icons:generate
      - task: cli-docs:generate
      - task: agent-tool-docs:generate
      - task: permission-docs:generate
      - task: node:deps
      - task: docs:render

  adr0016-conformance:generate:
    desc: Generate the ADR-0016 standards conformance matrix from its reviewed profile registry
    sources:
      - adr/specifications/standards-conformance-profiles.json
      - internal/app/tools/adr0016conformance/**/*.go
      - internal/project/contractodcs/schema/odcs-json-schema-v3.1.0.json
      - internal/refresh/openlineage/schema/OpenLineage.json
    generates:
      - adr/specifications/standards-conformance-matrix.md
    cmds:
      - go run ./internal/app/tools/adr0016conformance

  adr0016-conformance:check:
    desc: Verify the ADR-0016 profile registry and generated conformance matrix
    cmds:
      - go run ./internal/app/tools/adr0016conformance --check

  duckdbsql:generate:
    desc: Generate pinned DuckDB SQL runtime, AST, enum, and documentation metadata
    cmds:
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqlgen
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqldocsgen

  duckdbsql:generated:check:
    desc: Verify pinned DuckDB SQL metadata is current without network access
    cmds:
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqlgen -check
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqldocsgen -check

  duckdbsql:source:check:
    desc: Verify generated DuckDB SQL metadata against the exact pinned source checkout
    requires:
      vars: [DUCKDB_SOURCE]
    cmds:
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqlgen -check -source {{.DUCKDB_SOURCE | quote}}
      - go run ./pkg/duckdbsql/internal/cmd/duckdbsqldocsgen -check -source {{printf "%s/extension/core_functions" .DUCKDB_SOURCE | quote}}

  duckdbsql:qualification:
    desc: Run the independent Phase-1 DuckDB SQL qualification lane
    cmds:
      - task: duckdbsql:generated:check
      - go test ./pkg/duckdbsql -count=1 -run '^(TestPhase1QualificationCorpus|TestQualification|TestPinnedDuckDBModifierAST|TestDuckDBSQLArchitectureBoundary)$'
      - go test -race ./pkg/duckdbsql -count=1 -run '^(TestPhase1QualificationCorpus|TestQualification|TestPinnedDuckDBModifierAST|TestDuckDBSQLArchitectureBoundary)$'
      - go test ./pkg/duckdbsql -run '^$' -fuzz=FuzzDecodeDocumentQualification -fuzztime=2s -count=1

  lucide-icons:generate:
    desc: Generate the canonical Lucide icon catalog and server validator
    deps:
      - node:deps
    method: checksum
    sources:
      - scripts/generate_lucide_icon_catalog.ts
      - package.json
      - bun.lock
    generates:
      - web/generated/lucide-icon-catalog.ts
      - internal/dashboard/appearance/icons_gen.go
    cmds:
      - bun scripts/generate_lucide_icon_catalog.ts

  docs:generate:
    desc: Generate reference documentation, the unified catalog, and the search index
    cmds:
      - task: schema:generate
      - task: data-resource-contracts:generate
      - task: cli-docs:generate
      - task: agent-tool-docs:generate
      - task: permission-docs:generate
      - task: node:deps
      - task: docs:render

  docs:render:
    internal: true
    method: checksum
    deps:
      - visual-docs:generate
      - agent-tool-docs:generate
    sources:
      - Taskfile.yml
      - docs/navigation.yaml
      - docs/*.md
      - docs/articles/**/*.md
      - docs/guides/**/*.md
      - docs/api/*.md
      - docs/api/catalog.json
      - docs/api/operations.json
      - docs/reference/cli/*.md
      - docs/reference/cli/catalog.json
      - docs/reference/cli/manifest.json
      - docs/reference/agent-tools/*.md
      - docs/reference/agent-tools/catalog.json
      - docs/reference/agent-tools/manifest.json
      - docs/reference/config/*.md
      - docs/reference/config/catalog.json
      - docs/visuals/*.md
      - docs/visuals/catalog.json
      - internal/app/tools/docsitegen/**/*.go
    generates:
      - docs/catalog.json
      - docs/llms.txt
      - docs/search-index.json
    cmds:
      - bun run docs:validate-diagrams
      - go run ./internal/app/tools/docsitegen

  docs:check:
    desc: Verify the unified documentation catalog and search index are current
    deps:
      - node:deps
      - ci:extensions:prepare
    cmds:
      - bun run docs:validate-diagrams
      - go run ./internal/app/tools/agenttooldocgen --check
      - go run ./internal/app/tools/permissiondocgen --check
      - go run -tags=duckdb_arrow ./internal/app/tools/visualdocgen --check
      - go run ./internal/app/tools/docsitegen --check
      - go test ./internal/app/site/http -run '^TestEveryRenderedDocumentationLinkResolves$' -count=1

  visual-docs:generate:
    desc: Compile executable visual documentation examples into browser payloads
    deps:
      - db:generate
      - config:generate
      - api:generate
      - ui-signals:generate
      - data-resource-contracts:generate
      - ci:extensions:prepare
    method: checksum
    sources:
      - Taskfile.yml
      - docs/visuals/*.md
      - docs/visuals/catalog.json
      - internal/app/tools/visualdocgen/**/*.go
      - internal/app/tools/visualdocgen/testdata/**/*
      - internal/app/site/visualdocs/**/*.go
      - internal/dashboard/**/*.go
      - internal/analytics/**/*.go
      - internal/project/compiler/**/*.go
    generates:
      - docs/visuals/examples.gen.json
    cmds:
      - go run -tags=duckdb_arrow ./internal/app/tools/visualdocgen

  cli-docs:generate:
    desc: Generate public CLI reference documentation from Cobra commands
    deps:
      - db:generate
      - config:generate
      - api:generate
      - ui-signals:generate
    method: checksum
    sources:
      - internal/platform/clidoc/**/*.go
      - Taskfile.yml
      - internal/app/cli/**/*.go
      - internal/admin/cli/**/*.go
      - internal/access/cli/**/*.go
      - internal/agent/cli/**/*.go
      - internal/dashboard/cli/**/*.go
      - internal/manageddata/cli/**/*.go
      - internal/project/cli/**/*.go
      - internal/app/tools/clidocgen/**/*.go
    generates:
      - docs/reference/cli/catalog.json
      - docs/reference/cli/manifest.json
    cmds:
      - go run ./internal/app/tools/clidocgen

  agent-tool-docs:generate:
    desc: Generate the public agent tool reference from the canonical runtime catalog
    deps:
      - api:generate
      - agent-contracts:generate
    method: checksum
    sources:
      - Taskfile.yml
      - api/dashboard/**/*.tsp
      - api/visualization/**/*.tsp
      - internal/agent/contracts/typespec/**/*.tsp
      - api/typespec/**/*.tsp
      - internal/agent/contracts/**/*.go
      - internal/app/api/gen/**/*.go
      - internal/agent/tools/**/*.go
      - internal/app/tools/agenttooldocgen/**/*.go
    generates:
      - docs/reference/agent-tools/*.md
      - docs/reference/agent-tools/catalog.json
      - docs/reference/agent-tools/manifest.json
    cmds:
      - go run ./internal/app/tools/agenttooldocgen

  permission-docs:generate:
    desc: Generate the public typed permission and role reference from the canonical Go catalog
    method: checksum
    sources:
      - Taskfile.yml
      - internal/access/permission_catalog.go
      - internal/access/permission_roles.go
      - internal/app/tools/permissiondocgen/**/*.go
    generates:
      - docs/articles/reference/permissions.md
    cmds:
      - go run ./internal/app/tools/permissiondocgen

  permission-docs:check:
    desc: Verify the public typed permission and role reference is current
    cmds:
      - go run ./internal/app/tools/permissiondocgen --check

  permission-contracts:generate:
    desc: Generate typed permission transport, catalog, and PostgreSQL contracts
    method: checksum
    sources:
      - Taskfile.yml
      - internal/access/permission_catalog.go
      - internal/access/permission_roles.go
      - internal/app/tools/permissioncontractgen/**/*.go
    generates:
      - api/typespec/generated/permissions.tsp
      - internal/access/generated/permission_catalog.json
      - internal/access/postgres/permission_contract.sql
    cmds:
      - go run ./internal/app/tools/permissioncontractgen

  permission-contracts:check:
    desc: Verify generated typed permission contracts are current
    cmds:
      - go run ./internal/app/tools/permissioncontractgen --check

  db:generate:
    desc: Generate PostgreSQL adapter code from checked-in schemas and queries
    method: checksum
    sources:
      - Taskfile.yml
      - sqlc.yaml
      - internal/**/*.sql
    generates:
      - internal/**/internal/db/*.go
      - internal/project/postgres/internal/db/*.go
      - internal/access/postgres/internal/db/*.go
      - internal/platform/operation/postgres/internal/db/*.go
      - internal/platform/http/cursorsigning/postgres/internal/db/*.go
      - internal/manageddata/postgres/internal/db/*.go
      - internal/platform/events/postgres/internal/db/*.go
    # Match setup-ci's HTTP/1.1 workaround for checksum-service HTTP/2 stream
    # failures; transport only, with sqlc checksums and TLS integrity unchanged.
    cmds:
      - GODEBUG=http2client=0 GOTOOLCHAIN=go1.26.10 go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.31.1 generate --no-remote

  db:verify:
    desc: Compile generated PostgreSQL sqlc packages and audit handwritten SQL boundaries
    cmds:
      - GODEBUG=http2client=0 GOTOOLCHAIN=go1.26.10 go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.31.1 vet --no-remote
      - GODEBUG=http2client=0 GOTOOLCHAIN=go1.26.10 go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.31.1 diff --no-remote
      - |
        packages="$(
          find internal -type f -name '*.go' -print |
            while IFS= read -r file; do
              IFS= read -r first_line <"$file" || true
              if [ "$first_line" = '// Code generated by sqlc. DO NOT EDIT.' ]; then
                dirname "$file"
              fi
            done |
            sort -u |
            sed 's#^#./#'
        )"
        if [ -z "$packages" ]; then
          printf '%s\n' 'sqlc generation produced no Go packages' >&2
          exit 1
        fi
        # Compile the generated leaves here. Aggregate consumers compile after
        # the independent APIGen/signal build inputs are prepared by task ci.
        go test -run '^$' $packages
      - go run ./internal/app/tools/sqlcaudit --root {{.ROOT_DIR | quote}}

  db:prepare:
    desc: Prepare every PostgreSQL sqlc query against the clean PostgreSQL 18 baseline
    # The baseline package composes capability schemas whose domain packages
    # consume APIGen types. A clean checkout must create those independent Go
    # build inputs before compiling the PostgreSQL 18 prepare harness.
    deps:
      - api:generate
    cmds:
      - >-
        LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED=true
        go test ./internal/app/postgresbaseline
        -run '^TestSQLCVetPreparesAgainstBaselinePostgreSQL18$'
        -count=1 -timeout=10m

  db:check:
    desc: Regenerate pinned sqlc output, reject tracked drift, compile consumers, and audit SQL
    cmds:
      - |
        tracked_sqlc="$(
          git ls-files '*.go' |
            while IFS= read -r file; do
              [ -f "$file" ] || continue
              IFS= read -r first_line <"$file" || true
              if [ "$first_line" = '// Code generated by sqlc. DO NOT EDIT.' ]; then
                printf '%s\n' "$file"
              fi
            done
        )"
        if [ -n "$tracked_sqlc" ]; then
          printf '%s\n%s\n' 'sqlc output is a build input and must not be tracked:' "$tracked_sqlc" >&2
          exit 1
        fi
        before="$(mktemp)"
        after="$(mktemp)"
        generated_after="$(mktemp)"
        generated_repeat="$(mktemp)"
        trap 'rm -f "$before" "$after" "$generated_after" "$generated_repeat"' EXIT
        generated_snapshot() {
          find . -type f -name '*.go' \
            -not -path './.git/*' -not -path './node_modules/*' -not -path './.tmp/*' -print |
            sort |
            while IFS= read -r file; do
              if grep -q -F 'Code generated by sqlc' "$file"; then sha256sum "$file"; fi
            done
        }
        git diff --binary -- '*.go' >"$before"
        GODEBUG=http2client=0 GOTOOLCHAIN=go1.26.10 go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.31.1 generate --no-remote
        generated_snapshot >"$generated_after"
        git diff --binary -- '*.go' >"$after"
        if ! cmp -s "$before" "$after"; then
          printf '%s\n' 'sqlc generation changed tracked source files:' >&2
          git diff --stat -- '*.go' >&2 || true
          exit 1
        fi
        # A second local generation catches nondeterministic or newly emitted
        # untracked sqlc files without rejecting the intentionally build-only
        # output created by a clean checkout.
        GODEBUG=http2client=0 GOTOOLCHAIN=go1.26.10 go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.31.1 generate --no-remote
        generated_snapshot >"$generated_repeat"
        cmp -s "$generated_after" "$generated_repeat" || {
          printf '%s\n' 'sqlc generation is nondeterministic across generated Go outputs' >&2
          diff -u "$generated_after" "$generated_repeat" >&2 || true
          exit 1
        }
      - task: db:verify
      - task: db:prepare

  config:generate:
    desc: Generate runtime configuration, reference documentation, example environment, and schema
    method: checksum
    sources:
      - Taskfile.yml
      - internal/app/config/spec/spec.go
      - internal/app/tools/configgen/main.go
    generates:
      - internal/app/config/config_gen.go
      - internal/app/config/spec/names_gen.go
      - docs/configuration.md
      - .env.example
      - schemas/config/environment.schema.json
    cmds:
      - go run ./internal/app/tools/configgen

  config:check:
    desc: Verify generated configuration artifacts are current
    cmds:
      - go run ./internal/app/tools/configgen --check

  apigen:test:
    desc: Test the vendored APIGen Go module and TypeSpec library
    cmds:
      - go -C pkg/apigen test ./...
      - npm --prefix pkg/apigen/typespec ci
      - npm --prefix pkg/apigen/typespec test
      - npm --prefix pkg/apigen/typespec run typecheck
      - npm --prefix pkg/apigen/typespec run check:dist

  apigen:build:
    desc: Build the vendored APIGen TypeSpec emitter used by generation
    method: checksum
    run: once
    sources:
      - pkg/apigen/typespec/src/**/*.ts
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
      - pkg/apigen/typespec/tsconfig.json
    generates:
      - pkg/apigen/typespec/dist/src/**/*.js
      - pkg/apigen/typespec/dist/src/**/*.d.ts
    cmds:
      - npm --prefix pkg/apigen/typespec ci
      - npm --prefix pkg/apigen/typespec run build

  generated:check:
    desc: Verify intentional public contract snapshots are current
    cmds:
      - |
        bash scripts/check_generated_snapshots.sh \
          .env.example \
          adr/specifications/standards-conformance-matrix.md \
          docs/api/openapi.yaml \
          docs/llms.txt \
          docs/reference/agent-tools \
          docs/articles/reference/data-resource-connectors.md \
          docs/articles/reference/permissions.md \
          api/typespec/generated/permissions.tsp \
          internal/access/generated/permission_catalog.json \
          internal/access/postgres/permission_contract.sql \
          internal/agent/contracts \
          internal/project/contracts \
          internal/project/ui/signals/models.gen.go \
          api/gen/data-resources-ir.json \
          api/gen/pipeline-ir.json \
          web/generated/data-resources \
          web/generated/pipeline \
          schemas/config \
          schemas/desktop \
          schemas/json \
          pkg/duckdbsql/metadata_generated.go \
          pkg/duckdbsql/ast_schema_generated.go \
          pkg/duckdbsql/function_docs_generated.go \
          pkg/duckdbsql/upstream.lock.json \
          pkg/duckdbsql/internal/cmd/duckdbsqlgen/ast_schema_snapshot.json \
          pkg/duckdbsql/internal/cmd/duckdbsqlgen/enum_schema_snapshot.json \
          pkg/duckdbsql/internal/upstream/function_docs.lock.json \
          -- task --force generate
      - task: adr0016-conformance:check
      - task: duckdbsql:generated:check
      - task: generated:git-check
      - task: config:check
      - task: permission-contracts:check

  generated:git-check:
    desc: Verify build-only generated code is not tracked by Git
    cmds:
      - |
        tracked="$(
          git ls-files '*.go' | while IFS= read -r file; do
            [ -f "$file" ] || continue
            first_line="$(sed -n '1p' "$file")"
            if [ "$first_line" = '// Code generated by sqlc. DO NOT EDIT.' ]; then
              printf '%s\n' "$file"
            fi
          done
        )"
        test -z "$tracked" || { printf 'build-only sqlc output is tracked:\n%s\n' "$tracked" >&2; exit 1; }

  api:generate:
    desc: Generate headless API contract artifacts and APIGen Go surfaces
    deps:
      - apigen:build
      - dashboard-contracts:generate
      - permission-contracts:generate
    method: checksum
    run: once
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/typespec/**/*.tsp
      - api/exploration/**/*.tsp
      - api/visualization/**/*.tsp
      - schemas/json/dashboard-document.schema.json
      - internal/app/tools/openapidocgen/**/*.go
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/json-ir.json
      - api/gen/openapi.yaml
      - internal/access/api/gen/request_models.gen.go
      - internal/access/api/gen/server.apigen.gen.go
      - internal/access/api/gen/client.apigen.gen.go
      - internal/agent/api/gen/request_models.gen.go
      - internal/agent/api/gen/server.apigen.gen.go
      - internal/agent/api/gen/client.apigen.gen.go
      - internal/analytics/api/gen/request_models.gen.go
      - internal/analytics/api/gen/server.apigen.gen.go
      - internal/analytics/api/gen/client.apigen.gen.go
      - internal/credential/api/gen/request_models.gen.go
      - internal/credential/api/gen/server.apigen.gen.go
      - internal/credential/api/gen/client.apigen.gen.go
      - internal/dashboard/api/gen/request_models.gen.go
      - internal/dashboard/api/gen/server.apigen.gen.go
      - internal/dashboard/api/gen/client.apigen.gen.go
      - internal/deployment/api/gen/request_models.gen.go
      - internal/deployment/api/gen/server.apigen.gen.go
      - internal/deployment/api/gen/client.apigen.gen.go
      - internal/manageddata/api/gen/request_models.gen.go
      - internal/manageddata/api/gen/server.apigen.gen.go
      - internal/manageddata/api/gen/client.apigen.gen.go
      - internal/app/api/aggregate/server.apigen.gen.go
      - internal/app/api/gen/request_models.gen.go
      - internal/app/api/gen/server.apigen.gen.go
      - internal/app/cli/gen/apigen_registry.gen.go
      - internal/platform/http/api/gen/request_models.gen.go
      - internal/project/api/gen/request_models.gen.go
      - internal/project/api/gen/server.apigen.gen.go
      - internal/project/api/gen/client.apigen.gen.go
      - internal/refresh/api/gen/request_models.gen.go
      - internal/refresh/api/gen/server.apigen.gen.go
      - internal/refresh/api/gen/client.apigen.gen.go
      - internal/release/api/gen/request_models.gen.go
      - internal/release/api/gen/server.apigen.gen.go
      - internal/release/api/gen/client.apigen.gen.go
      - web/generated/api/failures.ts
      - docs/api/catalog.json
      - docs/api/openapi.yaml
      - docs/api/operations.json
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target leapview-v1
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target leapview-v1
      - go run ./internal/app/tools/apigenpatch
      - go run ./internal/app/tools/openapidocgen

  agent-contracts:generate:
    desc: Generate compact agent-tool DTOs and JSON Schemas
    deps:
      - apigen:build
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/dashboard/**/*.tsp
      - api/visualization/**/*.tsp
      - internal/agent/contracts/typespec/**/*.tsp
      - internal/agent/contracts/generate/**/*.go
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - internal/agent/contracts/gen/agent-tools-ir.json
      - internal/agent/contracts/gen/agent-tools.schema.json
      - internal/agent/contracts/models.gen.go
      - internal/agent/contracts/schemas.gen.go
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target agent-tool-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target agent-tool-contracts
      - go run ./internal/agent/contracts/generate

  data-resource-contracts:generate:
    desc: Generate strict Connection, Source, Model, and SemanticModel DTOs and connector registry
    deps:
      - apigen:build
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/data-resources/**/*.tsp
      - internal/project/contractprojection/exclusions.json
      - internal/project/contractprojection/manifest.go
      - internal/project/contracts/generate/**/*.go
      - internal/analytics/connectors/**/*.go
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/data-resources-ir.json
      - internal/project/contracts/gen/data-resources.schema.json
      - internal/project/contracts/models.gen.go
      - internal/project/contracts/registry.gen.go
      - internal/project/contracts/path_options.gen.go
      - web/generated/data-resources/index.ts
      - docs/articles/reference/data-resource-connectors.md
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target data-resource-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target data-resource-contracts
      - go run ./internal/project/contracts/generate

  desktop-discovery:generate:
    desc: Generate the public desktop discovery and failure contracts
    deps:
      - apigen:build
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/desktop-discovery/**/*.tsp
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/desktop-discovery-ir.json
      - schemas/desktop/discovery.schema.json
      - internal/app/desktopdiscovery/models.gen.go
      - desktop/src/generated/desktop-discovery.ts
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target desktop-discovery-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target desktop-discovery-contracts

  schema:generate:
    desc: Generate JSON Schema artifacts for LeapView YAML contracts
    deps:
      - db:generate
      - config:generate
      - api:generate
      - ui-signals:generate
    method: checksum
    sources:
      - Taskfile.yml
      - cmd/leapview/**/*.go
      - internal/app/cli/**/*.go
      - internal/project/developmentprofile/**/*.go
      - internal/project/developmentinput/**/*.go
      - api/data-resources/**/*.tsp
      - internal/project/contracts/**/*.go
      - internal/project/contracts/gen/**/*.json
      - internal/project/schema/**/*.go
      - internal/project/schema/**/*.cue
      - internal/dashboard/report/**/*.go
      - internal/semantic/**/*.go
      - internal/app/tools/schemadocgen/**/*.go
      - dashboards/**/*.yaml
    generates:
      - schemas/json/analytics-development-profile.schema.json
      - schemas/json/analytics-development-inputs.schema.json
      - schemas/json/connection.schema.json
      - schemas/json/source.schema.json
      - schemas/json/model.schema.json
      - schemas/json/semantic-model.schema.json
      - schemas/json/pipeline.schema.json
      - schemas/json/dashboard-document.schema.json
      - docs/reference/config/catalog.json
    cmds:
      - go run ./cmd/leapview schema export --format json-schema --out schemas/json
      - go run ./internal/app/tools/schemadocgen

  # APIGen materializes one bundled TypeSpec package in the user cache.
  # Initialize it through the canonical API target before another target can
  # enter the compiler on a cold machine.
  ui-signals:generate:
    desc: Generate UI signal Go and TypeScript contracts from TypeSpec
    deps:
      - api:generate
      - exploration-contracts:generate
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/exploration/**/*.tsp
      - api/signals/**/*.tsp
      - api/visualization/**/*.tsp
      - internal/app/tools/signalcontracts/**/*.go
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/ui-signals-ir.json
      - internal/access/ui/signals/models.gen.go
      - internal/admin/ui/signals/models.gen.go
      - internal/agent/ui/signals/models.gen.go
      - internal/dashboard/ui/signals/models.gen.go
      - internal/project/ui/signals/models.gen.go
      - web/generated/signals/index.ts
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target ui-signals
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target ui-signals
      - go run ./internal/app/tools/signalcontracts

  visualization-ir:generate:
    desc: Generate renderer-independent visualization IR contracts from TypeSpec
    # API and exploration generation share this cold-cache initializer.
    # Deduplicate it even when checksum checks are bypassed with --force.
    run: once
    deps:
      - node:deps
      - apigen:build
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/visualization/**/*.tsp
      - scripts/generate_visualization_validator.ts
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/visualization-ir.json
      - internal/dashboard/visualization/ir/models.gen.go
      - internal/dashboard/visualization/ir/schema_version.gen.go
      - web/generated/visualization/index.ts
      - web/generated/visualization/schema-version.ts
      - web/generated/visualization/validate.ts
      - api/gen/visualization.schema.json
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target visualization-ir
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target visualization-ir
      - bun scripts/generate_visualization_validator.ts

  exploration-contracts:generate:
    desc: Generate the canonical renderer-neutral ExplorationSpec contract
    deps:
      - node:deps
      - apigen:build
      # This target runs alongside api:generate under ui-signals:generate.
      # Wait for the shared TypeSpec cache install before starting its compiler.
      - visualization-ir:generate
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/exploration/**/*.tsp
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/src/**/*.ts
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/exploration-ir.json
      - internal/analytics/exploration/models.gen.go
      - web/generated/exploration/index.ts
      - api/gen/exploration.schema.json
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target exploration-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target exploration-contracts

  dashboard-contracts:generate:
    desc: Generate the canonical Dashboard authoring document contract
    deps:
      - node:deps
      - apigen:build
      - visualization-ir:generate
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/dashboard/**/*.tsp
      - api/visualization/**/*.tsp
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/src/**/*.ts
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/dashboard-ir.json
      - internal/dashboard/document/models.gen.go
      - web/generated/dashboard/index.ts
      - schemas/json/dashboard-document.schema.json
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target dashboard-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target dashboard-contracts

  pipeline-contracts:generate:
    desc: Generate the canonical asset-selected Pipeline authoring contract
    deps:
      - apigen:build
    method: checksum
    sources:
      - Taskfile.yml
      - api/apigen.yaml
      - api/pipeline/**/*.tsp
      - pkg/apigen/**/*.go
      - pkg/apigen/typespec/dist/src/**/*
      - pkg/apigen/typespec/lib/**/*.tsp
      - pkg/apigen/typespec/package.json
      - pkg/apigen/typespec/package-lock.json
    generates:
      - api/gen/pipeline-ir.json
      - internal/project/contracts/pipeline_models.gen.go
      - web/generated/pipeline/index.ts
      - schemas/json/pipeline.schema.json
    cmds:
      - go -C pkg/apigen run ./cmd/apigen typespec-compile -manifest ../../api/apigen.yaml -target pipeline-contracts
      - go -C pkg/apigen run ./cmd/apigen all -manifest ../../api/apigen.yaml -target pipeline-contracts

  layout-contract:generate:
    desc: Generate the browser responsive-widget layout contract
    method: checksum
    sources:
      - Taskfile.yml
      - internal/dashboard/layoutcontract/contracts.json
      - internal/app/tools/layoutcontractgen/**/*.go
    generates:
      - web/generated/dashboard-layout/contracts.json
    cmds:
      - go run ./internal/app/tools/layoutcontractgen

  ci:
    desc: Run the fast pull-request contract on the current machine
    cmds:
      - task: ci:pr

  managed:check:
    desc: Validate the managed scaffold without cloud credentials or live deployment
    cmds:
      - task: managed:infrastructure:check
      - task: managed:hosts:check
      - task: managed:kamal:check

  managed:infrastructure:check:
    desc: Validate OpenTofu and run mocked provider plans
    dir: deploy/managed/hetzner
    cmds:
      - tofu init -backend=false -input=false -lockfile=readonly
      - tofu fmt -check -recursive
      - tofu validate
      - tofu test

  managed:hosts:check:
    desc: Build both locked NixOS hosts, deploy-rs checks and host-role assertions
    dir: deploy/managed/nixos
    cmds:
      - nix fmt -- --check flake.nix inventory.example.nix modules/*.nix tests/*.nix
      - nix build .#nixosConfigurations.example-app.config.system.build.toplevel --no-link --no-update-lock-file --max-jobs 1 --cores 2 -L
      - nix build .#nixosConfigurations.example-database.config.system.build.toplevel --no-link --no-update-lock-file --max-jobs 1 --cores 2 -L
      - nix build .#checks.x86_64-linux.host-contracts .#checks.x86_64-linux.deploy-schema .#checks.x86_64-linux.deploy-activate --no-link --no-update-lock-file --max-jobs 1 --cores 2 -L

  managed:hosts:boot-test:
    desc: Exercise managed-host updates and rollback plus network and GRUB reboot checks in NixOS guests
    cmds:
      - nix build path:./deploy/managed/nixos#boot-test --no-link --no-update-lock-file -L

  managed:hosts:fresh-install-test:
    desc: Format fresh isolated disks and boot the common OS through BIOS and UEFI GRUB
    cmds:
      - nix build path:./deploy/managed/nixos#fresh-install-bios path:./deploy/managed/nixos#fresh-install-uefi --no-link --no-update-lock-file --max-jobs 1 --cores 2 -L

  managed:hosts:coordinator-test:
    desc: Exercise actual installed coordinator restore, completed retry and independent admission using a private production-publication fixture
    cmds:
      - nix develop --no-update-lock-file .#managed-recovery -c bash scripts/qualify_managed_coordinator_ci.sh

  managed:postgres:bootstrap-test:
    desc: Verify fresh native PostgreSQL bootstrap and privilege boundaries in the managed-recovery Nix shell
    preconditions:
      - test -x "$LEAPVIEW_TEST_MANAGED_POSTGRES_BIN/psql"
    cmds:
      - POSTGRES_BIN="$LEAPVIEW_TEST_MANAGED_POSTGRES_BIN" python3 -B -m unittest discover -s deploy/managed/postgres -p '*_test.py'

  managed:hosts:postgres-promotion-test:
    desc: Exercise actual installed PostgreSQL promotion module, private TLS and exact reboot retry in disposable guests
    cmds:
      - nix build path:./deploy/managed/nixos#postgres-promotion-test --no-link --no-update-lock-file --max-jobs 1 --cores 1 -L

  managed:hosts:network-test:
    desc: Exercise IPv4/IPv6 Docker ingress in fresh kernel namespaces (requires sudo)
    cmds:
      - sudo unshare --mount --net --fork python3 deploy/managed/nixos/tests/docker_firewall_test.py

  managed:hosts:docker-test:
    desc: Exercise real Docker forwarding and restart in isolated namespaces (requires sudo)
    cmds:
      - python3 deploy/managed/nixos/tests/namespace_test.py
      - |
        probe_image="$(nix build path:./deploy/managed/nixos#port-probe --no-link --no-update-lock-file --print-out-paths)"
        docker_package="$(nix build path:./deploy/managed/nixos#nixosConfigurations.example-app.config.virtualisation.docker.package --no-link --no-update-lock-file --print-out-paths)"
        sudo python3 deploy/managed/nixos/tests/docker_daemon_test.py "$probe_image" --docker-package "$docker_package"

  managed:kamal:check:
    desc: Parse the application template with locked Kamal dependencies (no SSH)
    dir: deploy/managed/kamal
    cmds:
      - bundle exec ruby config_test.rb
      - bundle exec ruby maintenance_test.rb

  managed:kamal:transport-test:
    desc: Exercise pinned Kamal, Docker and TLS in isolated namespaces (requires sudo; transport evidence only)
    cmds:
      - python3 deploy/managed/nixos/tests/kamal_transport_contract_test.py
      - bash deploy/managed/nixos/tests/run-kamal-transport.sh

  managed:application:qualify:
    desc: Qualify real admitted image enrollment, handoff and offline recovery in private namespaces (requires sudo)
    cmds:
      - bash deploy/managed/nixos/tests/run-managed-application.sh {{.CLI_ARGS}}

  observability:check:
    desc: Validate all repository-owned Prometheus rules and fixtures
    cmds:
      - task: observability:alerts:check
      - task: observability:sli:check

  observability:alerts:check:
    desc: Validate repository-owned Prometheus alert rules and fixtures
    cmds:
      - ./scripts/promtool.sh check rules deploy/observability/prometheus/leapview-alerts.yaml
      - ./scripts/promtool.sh test rules deploy/observability/prometheus/testdata/leapview-alerts.test.yaml

  observability:sli:check:
    desc: Validate repository-owned Prometheus SLI recording rules and fixtures
    cmds:
      - ./scripts/promtool.sh check rules deploy/observability/prometheus/leapview-recording-rules.yaml
      - ./scripts/promtool.sh test rules deploy/observability/prometheus/testdata/leapview-recording-rules.test.yaml

  image:qualify:production:
    desc: Qualify an immutable LeapView production image
    requires:
      vars: [IMAGE]
    cmds:
      - task: db:generate
      - task: api:generate
      - task: ui-signals:generate
      - mkdir -p {{.ROOT_DIR}}/.tmp/qualification/tmp
      - >-
        env TMPDIR={{.ROOT_DIR}}/.tmp/qualification/tmp
        LEAPVIEWCTL_ROOT={{.ROOT_DIR}}/deploy/compose
        go run ./cmd/leapviewctl qualify image
        --image {{.IMAGE | quote}}
        --require-immutable
        --evidence-dir {{.ROOT_DIR}}/.tmp/qualification/production-image

  image:qualify:site:
    desc: Qualify an immutable LeapView public-site image
    requires:
      vars: [IMAGE]
    cmds:
      - task: db:generate
      - task: api:generate
      - task: ui-signals:generate
      - >-
        env LEAPVIEWCTL_ROOT={{.ROOT_DIR}}/deploy/compose
        go run ./cmd/leapviewctl qualify site-image
        --image {{.IMAGE | quote}}

  qualify:ubdr:managed-data-s3-dr:
    desc: Capture the managed-data S3 disaster-recovery seed evidence without restoring it
    deps:
      - db:generate
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
      LEAPVIEW_TEST_UBDR_MANAGED_DATA_S3_DR_EVIDENCE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr/managed-data-s3"
    cmds:
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr/managed-data-s3"
      - >-
        go test -race -tags='duckdb_arrow fai520qualification'
        ./internal/recoveryset/postgres
        -run '^TestFAI520ManagedDataS3DRSeedQualification$'
        -count=1 -timeout=15m -v

  qualify:ubdr:recovery-ledger-postgres:
    desc: Qualify durable PostgreSQL recovery scheduling, fencing, publication retry, and retention
    deps:
      - db:generate
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
      LEAPVIEW_TEST_FAI1001_RECOVERY_LEDGER_EVIDENCE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr/recovery-ledger-postgres"
    cmds:
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr/recovery-ledger-postgres"
      - >-
        go test -race -tags='fai1001qualification'
        ./internal/refresh/postgres
        -run '^TestFAI1001PostgresRecoveryLedgerQualification$'
        -count=1 -timeout=15m -v

  qualify:ubdr:migration-interruption:
    desc: Qualify transition interruption, stopped-target restart, fencing, and PostgreSQL-ledger resume
    deps:
      - db:generate
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
      LEAPVIEW_TEST_FAI519_INTERRUPTION_EVIDENCE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr/migration-interruption"
    cmds:
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr/migration-interruption"
      - >-
        go test -race -tags='duckdb_arrow fai518qualification fai519qualification'
        ./internal/recoveryset/postgres
        -run '^TestFAI519TransitionAndStoppedTargetInterruptionQualification$'
        -count=1 -timeout=30m -v

  qualify:ubdr:provider-restore:
    desc: Qualify coordinated provider restoration and its replacement-host handoff
    deps:
      - db:generate
    vars:
      PROVIDER_HOST:
        sh: ip route get 1.1.1.1 | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}'
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
      TESTCONTAINERS_RYUK_DISABLED: "true"
      LEAPVIEW_TEST_FAI981_PROVIDER_RESTORE_EVIDENCE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr/provider-restore"
      LEAPVIEW_TEST_FAI981_HANDOFF_PRIVATE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr-private/provider-restore"
      LEAPVIEW_TEST_FAI981_RESOURCE_MANIFEST: "{{.ROOT_DIR}}/.tmp/qualification/ubdr-resources/provider-restore.json"
      LEAPVIEW_TEST_FAI981_HANDOFF_IMAGE: "ghcr.io/flidai/leapview@sha256:5b0cec900c5182f42654d07e58ca4ea9911ab1200f410670628601ab66085b85"
      LEAPVIEW_TEST_FAI981_HANDOFF_REVISION: "69652fb20101de80497cbf47ecfb402f700d6552"
      LEAPVIEW_TEST_FAI981_PROVIDER_HOST: "{{.PROVIDER_HOST}}"
    cmds:
      - task: qualify:ubdr:provider-restore:cleanup
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr/provider-restore"
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr-private/provider-restore"
      - >-
        go test -race -tags='fai981qualification'
        ./internal/app/providerrestore
        -run '^TestFAI981CoordinatedProviderRestoreQualification$'
        -count=1 -timeout=15m -v
      - >-
        go test -race -tags='fai981qualification'
        ./internal/app/providerrestore
        -run '^TestFAI981DownstreamHandoffSurvivesProducerExit$'
        -count=1 -timeout=10m -v

  qualify:ubdr:provider-restore:cleanup:
    desc: Remove provider resources retained for the FAI-981 downstream handoff
    vars:
      MANIFEST: "{{.ROOT_DIR}}/.tmp/qualification/ubdr-resources/provider-restore.json"
    cmds:
      - >-
        test ! -f "{{.MANIFEST}}" ||
        jq -r '.resources[] | select(.kind == "container") | .id' "{{.MANIFEST}}" |
        while IFS= read -r id; do
        if docker inspect "$id" >/dev/null 2>&1; then docker rm -f "$id"; fi;
        done
      - >-
        test ! -f "{{.MANIFEST}}" ||
        jq -r '.resources[] | select(.kind == "network") | .id' "{{.MANIFEST}}" |
        while IFS= read -r id; do
        if docker network inspect "$id" >/dev/null 2>&1; then docker network rm "$id"; fi;
        done
      - rm -f "{{.MANIFEST}}"
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr-private/provider-restore"

  qualify:ubdr:release-transition-preflight:
    desc: Qualify authoritative PostgreSQL-era transition resolution without executing a transition
    deps:
      - db:generate
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
    cmds:
      - >-
        go test -race -tags='fai518qualification'
        ./internal/recoveryset/postgres
        -run '^(TestFAI518AuthoritativeTransitionPreflightQualification|TestFAI518PublishedRecoveryFrontierRejectsTargetAndTamperedValidation|TestFAI518ProductionPreflightCompositionUsesAuthoritativeV2Evidence)$'
        -count=1 -timeout=10m -v

  qualify:ubdr:release-transition:
    desc: Qualify the forward-only PostgreSQL-era transition, restart, and durable readback contract
    deps:
      - db:generate
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
      LEAPVIEW_TEST_FAI518_RELEASE_TRANSITION_EVIDENCE_DIR: "{{.ROOT_DIR}}/.tmp/qualification/ubdr/release-transition"
    cmds:
      - rm -rf "{{.ROOT_DIR}}/.tmp/qualification/ubdr/release-transition"
      - >-
        go test -race -tags='duckdb_arrow fai518qualification'
        ./internal/recoveryset/postgres
        -run '^TestFAI518Revision019To020TransitionQualification$'
        -count=1 -timeout=30m -v
      - >-
        go test -race -tags='duckdb_arrow fai518qualification'
        ./internal/recoveryset/postgres
        -run '^TestFAI518ForwardOnlyReleaseTransitionQualification$'
        -count=1 -timeout=30m -v

  qualify:ubdr:release-transition-artifact:
    desc: Qualify live-admitted predecessor and candidate distributions through the revision-019 forward transition
    deps:
      - db:generate
    cmds:
      - bash scripts/qualify_fai518_real_artifact.sh

  test:go:
    desc: Run Go tests with bounded package parallelism and stable application shards
    cmds:
      - task: generate
      - task: test:go:prepared

  test:go:prepared:
    internal: true
    desc: Run Go tests after shared generated inputs are ready
    cmds:
      - task --parallel test:go:packages test:go:app:shards
      - task: test:go:external

  test:go:app:shards:
    desc: Run stable application shards with three-process parallelism
    cmds:
      - task: go:deps
      - task --parallel --concurrency 3 test:go:app:0 test:go:app:1 test:go:app:2 test:go:app:3

  go:deps:
    desc: Prepare the locked module graph before parallel test compilation
    run: once
    cmds:
      # Match sqlc's proxy transport setting only for module acquisition.
      # Test processes retain the caller's GODEBUG and HTTP/2 behavior.
      - GODEBUG=http2client=0 go mod download

  test:go:packages:
    cmds:
      - task: go:deps
      # Container-backed PostgreSQL tests are run once, fail closed, by the
      # dedicated conformance lane. Derive the exclusion by source so a new
      # harness user cannot silently run in both lanes. App tests use the same
      # skip flag in their stable shards below.
      - |
        set -eu
        export LEAPVIEW_POSTGRES_CONFORMANCE_SKIP=1
        inventory_file="$(mktemp)"
        trap 'rm -f "$inventory_file"' EXIT
        bash scripts/postgres-conformance-tests.sh list >"$inventory_file"
        test -s "$inventory_file"
        all_packages="$(go list ./...)"
        printf '%s\n' "$all_packages" |
          grep -v '/internal/app$' |
          grep -Fvx -f "$inventory_file" |
          xargs -r go test -p 2

  test:cache:qualification:
    desc: Race-qualify stable cache cutover, generation execution, and bounded cache observers
    cmds:
      - go test -race -tags=duckdb_arrow -p 1 ./internal/analytics/resultcache ./internal/analytics/materialize ./internal/analytics/module ./internal/dashboard/observability -count=1

  test:cache:rollout:
    desc: Enforce repeated correctness, metrics, and race-stability cache cutover gates
    cmds:
      - go test -tags=duckdb_arrow ./internal/analytics/resultcache ./internal/analytics/materialize ./internal/analytics/module ./internal/dashboard/observability -run 'CutoverQualification|CacheCutoverRolloutMetrics|CacheCutoverReuseMetric' -count=100
      - go test -race -tags=duckdb_arrow -p 1 ./internal/analytics/resultcache ./internal/analytics/materialize ./internal/analytics/module ./internal/dashboard/observability -run 'CutoverQualification|CacheCutoverRolloutMetrics|CacheCutoverReuseMetric' -count=20

  test:go:app:0:
    cmds:
      - |
        pattern="$(go run ./internal/app/tools/testshard --package ./internal/app --shard-index 0 --shard-count 4)"
        LEAPVIEW_POSTGRES_CONFORMANCE_SKIP=1 go test ./internal/app -run "$pattern" -skip '^TestMinIOParquetSourceRefreshContract$'

  test:go:app:1:
    cmds:
      - |
        pattern="$(go run ./internal/app/tools/testshard --package ./internal/app --shard-index 1 --shard-count 4)"
        LEAPVIEW_POSTGRES_CONFORMANCE_SKIP=1 go test ./internal/app -run "$pattern" -skip '^TestMinIOParquetSourceRefreshContract$'

  test:go:app:2:
    cmds:
      - |
        pattern="$(go run ./internal/app/tools/testshard --package ./internal/app --shard-index 2 --shard-count 4)"
        LEAPVIEW_POSTGRES_CONFORMANCE_SKIP=1 go test ./internal/app -run "$pattern" -skip '^TestMinIOParquetSourceRefreshContract$'

  test:go:app:3:
    cmds:
      - |
        pattern="$(go run ./internal/app/tools/testshard --package ./internal/app --shard-index 3 --shard-count 4)"
        LEAPVIEW_POSTGRES_CONFORMANCE_SKIP=1 go test ./internal/app -run "$pattern" -skip '^TestMinIOParquetSourceRefreshContract$'

  test:go:external:
    desc: Run container-backed external-service integration tests serially
    cmds:
      - bash scripts/prepare_ci_fixture_images.sh minio
      - go test -tags integration ./internal/platform/testminio -count=1
      - go test ./internal/app -run '^TestMinIOParquetSourceRefreshContract$' -count=1
      - task: test:go:postgres-conformance

  test:go:postgres-conformance:
    desc: Run every source-inventoried PostgreSQL container suite once, fail closed, under the pinned PostgreSQL 18 harness
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
    cmds:
      - bash scripts/postgres-conformance-tests.sh run

  test:go:postgres-multinode-qualification:
    desc: Run the FAI-572 independent PostgreSQL multi-node fencing qualification suites
    env:
      LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED: "1"
    cmds:
      - bash scripts/prepare_ci_fixture_images.sh postgres
      - |
        output="$$(mktemp)"
        trap 'rm -f "$$output"' EXIT
        status=0
        go test -tags 'integration duckdb_arrow' -p 1 -count=1 -v -run '^TestPostgreSQL18MultiNode.*Qualification$$' ./internal/platform/jobs/module ./internal/deployment/postgres >"$$output" 2>&1 || status=$$?
        cat "$$output"
        test "$$status" -eq 0
        grep -Eq '^=== RUN   TestPostgreSQL18MultiNodeRiverQualification$$' "$$output"
        grep -Eq '^=== RUN   TestPostgreSQL18MultiNodeActivationServingStateQualification$$' "$$output"

  test:workload:qualify:
    desc: Qualify the reusable workload scheduler independently of LeapView
    cmds:
      - go test ./pkg/workload -count=1
      - go test -race ./pkg/workload -count=1
      - go test ./pkg/workload -run '^$' -fuzz '^FuzzQualificationConfigValidation$' -fuzztime=3s
      - go test ./pkg/workload -run '^$' -fuzz '^FuzzQualificationIdentityCanonicalization$' -fuzztime=3s
      - go test ./pkg/workload -run '^$' -fuzz '^FuzzQualificationRequestValidation$' -fuzztime=3s
      - go test ./pkg/workload -run '^$' -fuzz '^FuzzQualificationBoundedSchedulerOperation$' -fuzztime=3s
      - go test ./pkg/workload -run '^$' -bench 'Workload$' -benchmem -benchtime=100ms -count=1

  test:go:minio-conformance:
    desc: Run the object-backed shared-pool and GC namespace MinIO conformance tests
    deps:
      - db:generate
      - api:generate
    env:
      LEAPVIEW_MINIO_CONFORMANCE_REQUIRED: "1"
      LEAPVIEW_CONFORMANCE_EVIDENCE_OUT: "{{.ROOT_DIR}}/.tmp/minio-conformance/shared-pool-evidence.json"
    cmds:
      - rm -f "{{.ROOT_DIR}}/.tmp/minio-conformance/shared-pool-evidence.json"
      - bash scripts/prepare_ci_fixture_images.sh minio
      - go test -tags 'duckdb_arrow ducklake_minio' -count=1 -run '^TestSharedPoolConformanceMinIOLane$' -v ./internal/analytics/ducklake

  test:go:plan-gc-conformance:
    desc: Run the maintained native-delivery lifecycle, retention, concurrency, and provenance matrix
    deps:
      - db:generate
      - api:generate
      - config:generate
      - ui-signals:generate
    cmds:
      # The deployment subtree owns the maintained plan/build/seal/publication,
      # restart, crash, fencing, lease/retirement, and GC race matrix. Keep
      # this package-wide so adding a reviewed failure boundary cannot silently
      # leave the release gate running a stale selective subset.
      - go test ./internal/deployment/... -count=1 -v
      - go test ./internal/app/runtimefactory -count=1 -v
      # Recovery and physical-pool retention stay in their owning native
      # PostgreSQL/runtime packages; no legacy audit/repair path is composed.
      - go test ./internal/admin/offline ./internal/admin/cli ./internal/app/adminpostgres ./internal/app/gcadapter ./internal/platform/architecture -count=1 -v
      # Protected targets must prove that source ownership and retained
      # attestations are enforced, rather than trusting client provenance text.
      - go test ./internal/project/module -run '^(TestCandidateSourceSynchronizerAuthorizesOnlyPlannedOwnerUploads|TestCandidateSourceSynchronizerRetainsActivePlanAcrossRestart)$' -count=1 -v

  ci:lane:go:
    desc: Run the bounded Go unit and integration lane
    cmds:
      # Local PR/full CI enters through this aggregate lane rather than the
      # hosted package shard, so retain the SQL quality gate here as well.
      - task: db:check
      - task: apigen:test
      - task: ci:controller:builds
      - task: test:go:prepared
      # Keep the documented local contract aligned with the quality checks
      # enforced by the hosted package lane without invoking that lane twice.
      - task: quality:budget:check
      - task: quality:exceptions:check
      - task: quality:trends:report
      - task: quality:critical:coverage
      - task: deadexports:check

  odcs:oracle:
    desc: Validate ODCS 3.1 golden exports with the pinned independent CI-only CLI
    cmds:
      - bash scripts/validate_odcs_oracle.sh

  ci:lane:go:packages:
    desc: Run non-application Go package tests
    cmds:
      # Keep the SQL generation, PostgreSQL conformance, and audit gate out
      # of the watchdog-wrapped shared preparation. It runs once here after
      # preparation instead of being repeated on every preparation retry.
      - task: db:check
      - task: quality:budget:check
      - task: quality:exceptions:check
      - task: quality:trends:report
      - task: quality:critical:coverage
      - task: deadexports:check
      - task: ci:controller:builds
      - task: test:go:packages

  ci:controller:builds:
    desc: Compile the conventional Compose controller for every release platform (requires generated inputs)
    cmds:
      - |
        set -eu
        controller_build_dir="$(mktemp -d)"
        trap 'rm -rf "$controller_build_dir"' EXIT
        for platform in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
          echo "Building Compose controller for $platform"
          CGO_ENABLED=0 GOOS="${platform%/*}" GOARCH="${platform#*/}" \
            go build -trimpath -o "$controller_build_dir/leapviewctl" ./cmd/leapviewctl
        done

  ci:lane:quality:
    desc: Run cross-language quality and architecture contracts
    cmds:
      - task: quality:budget:check
      - task: quality:exceptions:check
      - task: quality:trends:report
      - task: deadexports:check
      - go test ./internal/platform/architecture -count=1

  ci:lane:go:apigen:
    desc: Run the vendored APIGen Go module and TypeSpec tests
    cmds:
      - task: apigen:test

  ci:lane:go:application:
    desc: Run sharded application and external-service Go tests
    cmds:
      - task: test:go:app:shards
      - task: test:go:external

  ci:lane:frontend:
    desc: Run every bounded frontend shard sequentially on a shared local machine
    cmds:
      - task: ci:lane:frontend:shard
        vars: { SHARD: core }
      - task: ci:lane:frontend:shard
        vars: { SHARD: reports }
      - task: ci:lane:frontend:shard
        vars: { SHARD: chat }
      - task: ci:lane:frontend:shard
        vars: { SHARD: data }
      - task: ci:lane:frontend:shard
        vars: { SHARD: site }

  ci:lane:frontend:shard:
    desc: Run one isolated frontend shard with the hosted-CI hang watchdog
    requires:
      vars:
        - name: SHARD
          enum: [core, reports, chat, data, site]
    cmds:
      # Bound a single unit of work, not the cumulative runtime of all five.
      # Hosted CI gives each shard its own runner; local CI avoids CPU contention.
      # Reports retains every viewer, playground, and builder test, with
      # independent bounds for each suite rather than a cumulative timeout.
      # Data keeps Explorer and the remaining pages under separate bounds.
      - |
        {{if eq .SHARD "reports"}}
        task ci:lane:frontend:reports
        {{else if eq .SHARD "data"}}
        task ci:lane:frontend:data
        {{else}}
        node scripts/ci_watchdog.mjs --timeout-seconds 180 --attempts 2 -- task ci:test:frontend:{{.SHARD}}
        {{end}}

  ci:lane:frontend:reports:
    desc: Run independently bounded viewer, playground, and builder validation
    cmds:
      - node scripts/ci_watchdog.mjs --timeout-seconds 300 --attempts 2 -- task ci:test:frontend:reports:viewer
      - node scripts/ci_watchdog.mjs --timeout-seconds 300 --attempts 2 -- task ci:test:frontend:reports:playground
      - node scripts/ci_watchdog.mjs --timeout-seconds 300 --attempts 2 -- task ci:test:frontend:reports:builder

  ci:lane:frontend:data:
    desc: Run independently bounded Explorer and data page validation
    cmds:
      - node scripts/ci_watchdog.mjs --timeout-seconds 180 --attempts 2 -- task ci:test:frontend:data:explorer
      - node scripts/ci_watchdog.mjs --timeout-seconds 180 --attempts 2 -- task ci:test:frontend:data:pages

  ci:lane:frontend:local:
    desc: Run the frontend lane locally with the hosted-CI hang watchdog
    cmds:
      - task: ci:lane:frontend

  ci:prepare:
    desc: Generate and build the shared inputs required by every CI validation lane
    cmds:
      - task: go:deps
      - task: ci:extensions:prepare
      - task: generate
      - task: build
      - task: site:build

  ci:extensions:prepare:
    desc: Provision CI fixtures and validate the production offline supply contract
    cmds:
      - go run ./internal/app/tools/ducklakeprepare
      - task: extension-supply:check

  extension-supply:check:
    desc: Check generated connector/format requirements and exact supply admission contracts
    cmds:
      - go test ./internal/project/contracts ./internal/deployment/extensionsupply ./internal/app/tools/extensionsupply

  ci:pr:
    desc: Run the fast required contract for every pull-request update
    cmds:
      - task: generated:check
      - task: ci:prepare
      # Hosted CI runs these lanes in parallel on separate runners. Keep local
      # execution sequential: concurrent Go builds can make Bun's bundler spin,
      # costing more time than the overlap saves on a shared workstation.
      - task: ci:lane:go
      - task: ci:lane:frontend:local
      - task: generated:check

  ci:full:
    desc: Run deterministic validation for the exact merge-queue candidate
    cmds:
      - task: ci:pr
      - task: ci:full:extras

  ci:full:extras:
    desc: Run merge-only validation sequentially on prepared inputs for local and nightly CI
    cmds:
      - task: desktop:test
      - task: ci:full:extras:static
      - task: ci:full:extras:runtime:multinode
      - task: qa:ui-framework
      - task: ci:full:extras:runtime:tail
      - task: test:qualification:demo-host-recovery
      - task: test:qualification:historical-transition:local

  ci:full:extras:static:
    internal: true
    desc: Run static merge-only validation
    cmds:
      - go vet ./...
      - go test -race ./pkg/...
      - task: quality:critical:race
      - task: test:workload:qualify

  ci:full:extras:runtime:
    internal: true
    desc: Run runtime merge-only validation
    cmds:
      - task: ci:full:extras:runtime:multinode
      - task: ci:full:extras:runtime:tail

  ci:full:extras:parallel:
    internal: true
    desc: Run independent static and runtime validation concurrently
    deps:
      - task: ci:full:extras:static
      - task: ci:full:extras:runtime

  ci:full:extras:runtime:multinode:
    internal: true
    desc: Run container-backed PostgreSQL multinode validation
    cmds:
      - task: test:go:postgres-multinode-qualification

  ci:full:extras:runtime:tail:
    internal: true
    desc: Run deployment and object-backed runtime validation
    cmds:
      - task: deploy:check
      - task: test:go:minio-conformance
      - task: test:go:plan-gc-conformance

  ci:full:extras:hosted:
    desc: Run merge-only validation with bounded hosted parallelism
    cmds:
      - task: desktop:test
      - task: ci:full:extras:parallel

  ci:nightly:
    desc: Run exhaustive scheduled validation, including dependency security scans
    cmds:
      - task: ci:full
      - task: ci:nightly:extras

  ci:nightly:extras:
    desc: Run the security scans added by the nightly CI tier
    cmds:
      - task: generate
      - task: security:check
      - task: dependency-security

  dependency-security:
    desc: Prepare and scan every checked-in JavaScript and Go dependency graph
    cmds:
      # Recreate each package-manager graph from its checked-in lockfile before
      # generation. The security lane must not inherit an incomplete workspace.
      - task: node:deps
      - task: desktop:deps
      - npm --prefix pkg/apigen/typespec ci
      - task: generate
      - task: node:audit
      - task: desktop:audit
      - task: apigen:audit
      - task: vuln

  security:report:
    desc: Generate content-bound dependency clearance evidence from a clean checkout
    deps:
      - dependency-security
    cmds:
      - mkdir -p .tmp/release-security
      - >-
        go run ./internal/app/tools/dependencyreport report
        --output .tmp/release-security/dependency-clearance.json

  security:report:check:
    desc: Re-scan and validate retained dependency clearance evidence
    cmds:
      - >-
        go run ./internal/app/tools/dependencyreport check
        --input .tmp/release-security/dependency-clearance.json

  ci:local:
    desc: Compatibility alias for the full current-environment contract
    cmds:
      - task: ci:full

  deploy:check:
    desc: Validate product and public-site deployment contracts
    deps:
      - db:generate
      - api:generate
    cmds:
      - go test ./cmd/leapviewctl ./internal/app/cli/composectl ./internal/app/cli/hostinstall ./deploy/compose ./deploy/host
      - bash scripts/prepare_ci_fixture_images.sh docker-client
      - LEAPVIEW_TEST_CONTAINERS=1 go test ./internal/app/cli/composectl -run '^TestQualification(ContainerRuntimeLifecycle|HistoricalDockerClientPortable)$'
      - go test ./deploy/hetzner
      - go test ./deploy/hetzner-site
      - PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s deploy/kamal-site -p 'test_*.py'
      - terraform fmt -check -recursive deploy/hetzner
      - terraform -chdir=deploy/hetzner init -backend=false -input=false -lockfile=readonly
      - terraform -chdir=deploy/hetzner validate
      - terraform -chdir=deploy/hetzner test
      - terraform fmt -check -recursive deploy/hetzner-site
      - terraform -chdir=deploy/hetzner-site init -backend=false -input=false -lockfile=readonly
      - terraform -chdir=deploy/hetzner-site validate
      - terraform -chdir=deploy/hetzner-site test

  site:deploy:
    desc: Run the manual public-site operator (pass commands after --)
    cmds:
      - python3 -B deploy/kamal-site/deploy.py {{.CLI_ARGS}}

  site:access-check:
    desc: Inspect the public-site host over the operator's pinned SSH connection
    cmds:
      - python3 -B deploy/kamal-site/deploy.py status

  site:observe:
    desc: Run or inspect the read-only public-site observation
    cmds:
      - python3 -B deploy/kamal-site/observe.py {{.CLI_ARGS}}

  site:acceptance:
    desc: Freeze or verify observation and public adoption smoke evidence
    cmds:
      - python3 -B deploy/kamal-site/acceptance.py {{.CLI_ARGS}}

  site:observation:test:
    desc: Test the public-site observer and acceptance gates with local fixtures
    cmds:
      - python3 -B -m unittest discover -s deploy/kamal-site -p 'test_observe.py'
      - python3 -B -m unittest discover -s deploy/kamal-site -p 'test_acceptance.py'

  node:audit:
    desc: Scan JavaScript dependencies for known vulnerabilities
    deps:
      - node:deps
    cmds:
      - bun audit

  desktop:audit:
    desc: Scan LeapView Desktop dependencies for known vulnerabilities
    deps:
      - desktop:deps
    dir: desktop
    cmds:
      - bun audit

  apigen:audit:
    desc: Scan the vendored APIGen TypeSpec dependencies for known vulnerabilities
    cmds:
      - npm --prefix pkg/apigen/typespec ci
      - npm --prefix pkg/apigen/typespec audit

  vuln:
    desc: Scan Go dependencies and call paths for known vulnerabilities
    env:
      GOMEMLIMIT: 4GiB
    cmds:
      - go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...

  security:policy:
    desc: Validate security coverage, updater ownership, exceptions, and pinned actions
    cmds:
      - go test ./internal/app/securitypolicy ./internal/app/tools/securitycontracts ./internal/app/tools/securityresults ./internal/app/tools/securitysast
      - go run ./internal/app/tools/securitypolicy -root .

  security:sast:prepare:
    desc: Prepare generated source in this SAST runner without building release assets
    env:
      NPM_CONFIG_AUDIT: "false"
    cmds:
      - task: go:deps
      - task: db:generate
      - task: config:generate
      - task: api:generate
      - task: ui-signals:generate
      - task: agent-contracts:generate
      - task: data-resource-contracts:generate
      - task: pipeline-contracts:generate
      - task: desktop-discovery:generate
      - task: layout-contract:generate
      - task: map-style:generate
      - task: lucide-icons:generate
      - task: visual-docs:generate

  security:sast:typescript:
    desc: Check maintained TypeScript graphs against prepared SAST source
    cmds:
      - ./node_modules/.bin/tsc --noEmit --project tsconfig.app.json
      - ./node_modules/.bin/tsc --noEmit --project tsconfig.contracts.json
      - ./node_modules/.bin/tsc --noEmit --project tsconfig.test.json
      - ./node_modules/.bin/tsc --noEmit --project tsconfig.playground.json
      - npm --prefix pkg/apigen/typespec run typecheck
      - task: desktop:deps
      - ./desktop/node_modules/.bin/tsc --noEmit --project desktop/tsconfig.json
      - ./desktop/node_modules/.bin/tsc --noEmit --project desktop/tsconfig.test.json

  security:dependencies:
    desc: Evaluate .security/javascript-vulnerability-evidence.json offline and run live source-aware Go dependency checks
    cmds:
      - go run ./internal/app/tools/securitydependencies -root .

  security:dependencies:evidence:refresh:
    desc: Refresh the checked-in JavaScript vulnerability evidence from live registries
    deps:
      - ci:prepare
    cmds:
      - go run ./internal/app/tools/securitydependencies -root . -refresh-javascript-evidence

  security:source:
    desc: Scan secrets, infrastructure, Dockerfiles, and workflows with pinned tools
    cmds:
      - go run ./internal/app/tools/securitysource -root .

  security:oci-contracts:
    desc: Exercise fail-closed OCI provenance and promotion admission contracts
    cmds:
      - go test ./internal/app/tools/ociadmission

  security:promotion-contracts:
    desc: Exercise OCI and Desktop promotion admission contracts
    cmds:
      - task: security:oci-contracts
      - node --test desktop/scripts/workflow-contract.test.mjs

  security:governance:test:
    desc: Exercise the read-only repository governance audit
    cmds:
      - go test ./internal/app/tools/governanceaudit

  security:governance:
    desc: Audit live GitHub rulesets and protected deployment environments read-only
    cmds:
      - go run ./internal/app/tools/governanceaudit --live --repo flidai/leapview

  security:test:
    desc: Run hermetic security and provenance contract tests
    cmds:
      - task: security:policy
      - go test ./internal/app/tools/securitydependencies ./internal/app/tools/securitysource
      - task: security:promotion-contracts
      - task: security:governance:test

  security:check:
    desc: Run all required security gates for the current candidate
    cmds:
      - task: security:test
      - task: security:dependencies
      - task: security:source

  agent:e2e:
    desc: Run opt-in OpenAI-compatible headless agent E2E
    deps:
      - postgres:dev:up
    cmds:
      - bash scripts/agent_e2e.sh