Taskfile.yml

version: '3'

vars:
  BINARY: ceo-packet
  PKG: ./cmd/ceo-packet
  VERSION:
    sh: git describe --tags --always --dirty 2>/dev/null || printf dev
  COMMIT:
    sh: git rev-parse --short HEAD 2>/dev/null || printf local

tasks:
  default:
    desc: Run the standard local verification gate
    cmds:
      - task: ci

  fmt:
    desc: Format Go files with gofmt
    cmds:
      - gofmt -w ./cmd ./internal

  test:
    desc: Run the unit and integration test suite
    cmds:
      - go test ./... -count=1

  test:race:
    desc: Run tests with the race detector and shuffled order
    cmds:
      - go test -race -shuffle=on -count=1 ./...

  vet:
    desc: Run go vet
    cmds:
      - go vet ./...

  strict:
    desc: Run stricter optional local gates when installed
    cmds:
      - sh scripts/strict-checks.sh

  secret:scan:
    desc: Scan source, docs, scripts, and workflows for committed secret values
    cmds:
      - sh scripts/secret-scan.sh

  smoke:
    desc: Run the local CLI smoke check
    cmds:
      - sh scripts/smoke.sh

  dogfood:
    desc: Drive the real CLI through happy, failed-check, patch, and needs-input paths
    cmds:
      - sh scripts/dogfood.sh

  build:
    desc: Build the local binary
    cmds:
      - mkdir -p bin
      - go build -trimpath -ldflags="-X ceoharness/internal/cli.Version={{.VERSION}} -X ceoharness/internal/cli.Commit={{.COMMIT}}" -o bin/{{.BINARY}} {{.PKG}}

  release:local:
    desc: Build local release archives and checksums
    cmds:
      - sh scripts/release-local.sh

  release:signatures:
    desc: Sign local release archives with RELEASE_SIGNING_KEY
    cmds:
      - sh scripts/release-signatures.sh --dist dist --private-key "$RELEASE_SIGNING_KEY"

  release:homebrew-formula:
    desc: Write dist/homebrew/ceo-packet.rb with public release archive URLs
    cmds:
      - sh scripts/release-homebrew-formula.sh --dist dist --repo-url "$REPO_URL" --homebrew-archive-base-url "$HOMEBREW_ARCHIVE_BASE_URL"

  release:preflight:
    desc: Check whether local artifacts are ready for a public release claim
    cmds:
      - sh scripts/release-preflight.sh dist

  release:bootstrap:
    desc: Write the public release bootstrap packet without publishing
    cmds:
      - sh scripts/release-bootstrap.sh --dist dist --output-dir .omo/evidence/release-bootstrap

  release:readiness:
    desc: Write a public release readiness evidence packet without publishing
    cmds:
      - sh scripts/release-readiness.sh --dist dist --output-dir .omo/evidence/release-readiness

  provider:setup-preflight:
    desc: Check paid HTTP provider env readiness without printing or saving secret values
    cmds:
      - sh scripts/provider-setup-preflight.sh --output-dir .omo/evidence/provider-setup-preflight

  production:readiness:
    desc: Write the full production-readiness evidence packet without publishing or calling paid providers
    cmds:
      - sh scripts/production-readiness.sh --dist dist --output-dir .omo/evidence/production-readiness

  production:finalize:
    desc: Run the guarded final production evidence sequence without publishing or printing secrets
    cmds:
      - sh scripts/production-finalize.sh --dist dist --output-dir .omo/evidence/production-finalize

  production:local-gate:
    desc: Fail only when local production readiness regresses; public blockers are allowed
    cmds:
      - sh scripts/production-local-gate.sh --dist dist --output-dir .omo/evidence/production-local-gate

  eval:nightly:
    desc: Run the no-key nightly eval proof suite
    cmds:
      - mkdir -p bin
      - go build -trimpath -o bin/ceo-packet ./cmd/ceo-packet
      - go run ./cmd/ceo-eval --benchmark-fixtures --tasks evals/tasks --output-dir .omo/evidence/nightly/benchmark-fixtures
      - go run ./cmd/ceo-packet gauntlet --suite cross-language-core --agents ceo_harness --ceo-binary ./bin/ceo-packet --tasks evals/tasks --output-dir .omo/evidence/nightly/cross-language-core --timeout-seconds 120 --concurrency 2 --ceo-benchmark-mode model-command --ceo-benchmark-model-command-json '["sh","{{.ROOT_DIR}}/scripts/benchmark-model-command.sh"]'
      - sh scripts/dogfood-real.sh --repo "ceo-harness:{{.ROOT_DIR}}" --repeat 2 --timeout-ms 250 --output-dir .omo/evidence/nightly/dogfood-real

  eval:endurance:
    desc: Run repeated no-key eval loops for endurance evidence
    cmds:
      - sh scripts/endurance.sh --iterations 3 --output-dir .omo/evidence/endurance-local-r1

  eval:provider:kimi:
    desc: Run the Kimi-backed real-provider proof suite
    cmds:
      - sh scripts/provider-proof.sh --provider kimi --output-dir .omo/evidence/provider-proof-kimi

  eval:provider:codex:
    desc: Run the Codex-backed real-provider proof suite
    cmds:
      - sh scripts/provider-proof.sh --provider codex --output-dir .omo/evidence/provider-proof-codex

  eval:provider:openai:
    desc: Run the OpenAI HTTP-provider proof suite
    cmds:
      - sh scripts/provider-proof.sh --provider openai --output-dir .omo/evidence/provider-proof-openai

  eval:provider:openrouter:
    desc: Run the OpenRouter HTTP-provider proof suite
    cmds:
      - sh scripts/provider-proof.sh --provider openrouter --output-dir .omo/evidence/provider-proof-openrouter

  eval:provider:moonshot:
    desc: Run the Moonshot HTTP-provider proof suite
    cmds:
      - sh scripts/provider-proof.sh --provider moonshot --output-dir .omo/evidence/provider-proof-moonshot

  ci:
    desc: Run the productization gate used before handoff
    cmds:
      - task: fmt
      - task: test
      - task: vet
      - task: smoke
      - task: dogfood
      - task: build