quire-cli/Makefile at main · agent-ix/quire-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# =============================================================================
# quire-cli Makefile
# =============================================================================

CARGO ?= cargo

.PHONY: help
help:
	@echo "Available targets:"
	@echo "  make fmt              - Format with rustfmt"
	@echo "  make fmt-check        - Verify formatting (CI gate)"
	@echo "  make lint             - Clippy with -D warnings"
	@echo "  make test             - cargo test"
	@echo "  make build            - Release build"
	@echo "  make clean            - cargo clean"
	@echo "  make deny             - cargo deny check licenses"
	@echo "  make audit-unsafe     - Enforce // SAFETY: comments on unsafe blocks"
	@echo "  make bench            - Latency budget (NFR-001): p95 of a quire invocation ≤ 50 ms (needs hyperfine)"
	@echo "  make ci               - All CI gates locally (fmt-check + lint + test + deny + audit-unsafe)"

# =============================================================================
# Format / Lint / Test
# =============================================================================

.PHONY: fmt
fmt:
	$(CARGO) fmt --all

.PHONY: fmt-check
fmt-check:
	$(CARGO) fmt --all -- --check

.PHONY: lint
lint:
	$(CARGO) clippy --all-targets -- -D warnings

.PHONY: test
test:
	$(CARGO) test

.PHONY: build
build:
	$(CARGO) build --release

.PHONY: clean
clean:
	$(CARGO) clean

# =============================================================================
# Supply chain & safety
# =============================================================================

.PHONY: deny
deny:
	$(CARGO) deny check licenses

.PHONY: cargo-audit
cargo-audit:
	$(CARGO) audit

.PHONY: audit-unsafe
audit-unsafe:
	bash scripts/check_unsafe_comments.sh

# =============================================================================
# Composite
# =============================================================================

.PHONY: audit-thin-boundary
audit-thin-boundary:
	bash scripts/check_thin_boundary.sh

.PHONY: deny-bans
deny-bans:
	$(CARGO) deny check bans

# =============================================================================
# Latency budget (NFR-001)
# =============================================================================
# p95 wall-clock of a representative `quire` invocation (validate a conformant
# ISO doc against the bundled module) must stay within the 50 ms budget. Uses
# hyperfine to measure the real release binary end-to-end (process spawn + module
# load + parse + validate), then gates on the computed p95.

BENCH_P95_MS ?= 50

.PHONY: bench
bench:
	$(CARGO) build --release
	hyperfine --shell=none --warmup 5 --runs 50 --export-json /tmp/quire-cli-bench.json \
		'$(CURDIR)/target/release/quire validate $(CURDIR)/tests/fixtures/iso-docs/FR-valid.md --module $(CURDIR)/tests/fixtures/iso'
	@python3 -c "import json; \
r=json.load(open('/tmp/quire-cli-bench.json'))['results'][0]['times']; \
r.sort(); \
p95=r[max(0,int(len(r)*0.95)-1)]*1000.0; \
print(f'p95={p95:.2f}ms (budget {$(BENCH_P95_MS)}ms, n={len(r)})'); \
exit(0 if p95 <= $(BENCH_P95_MS) else 1)"

# =============================================================================
# Fixtures
# =============================================================================

QUIRE_RS_ISO ?= ../quire-rs/tests/fixtures/modules/iso

.PHONY: refresh-fixtures
refresh-fixtures:
	@if [ ! -d "$(QUIRE_RS_ISO)" ]; then \
		echo "upstream ISO fixtures not found at $(QUIRE_RS_ISO); set QUIRE_RS_ISO=" >&2; exit 1; \
	fi
	rm -rf tests/fixtures/iso
	mkdir -p tests/fixtures/iso
	cp -r $(QUIRE_RS_ISO)/. tests/fixtures/iso/
	@echo "refreshed tests/fixtures/iso from $(QUIRE_RS_ISO)"

# =============================================================================
# Composite
# =============================================================================

.PHONY: ci
ci: fmt-check lint test deny deny-bans audit-unsafe audit-thin-boundary