Makefile

# ============================================================
# AykenOS Build System
#  - x86_64 Kernel (ELF, higher-half)
#  - UEFI Bootloader (BOOTX64.EFI)
#  - EFI.img + QEMU run
# ============================================================

include mk/paths.mk

# ------------------------------------------------------------
# 1) Kernel toolchain
# ------------------------------------------------------------

KERNEL_CC_BIN = clang
KERNEL_CC = $(KERNEL_CC_BIN) --target=x86_64-elf
KERNEL_LD_BIN = ld.lld
KERNEL_LD = $(KERNEL_LD_BIN)

KERNEL_CFLAGS = -ffreestanding -m64 -Wall -Wextra -Ikernel/include
KERNEL_CFLAGS += -mcmodel=large -fno-pic -fno-omit-frame-pointer -fno-stack-protector
KERNEL_CFLAGS += -mno-red-zone
KERNEL_CFLAGS += -MMD -MP
KERNEL_ASMFLAGS = -Ikernel/include/generated/ -Ikernel/include/

# ------------------------------------------------------------
# Kernel profile and debug feature flags
# ------------------------------------------------------------
# Kernel profile (release | validation)
KERNEL_PROFILE ?= release
PROFILE_RELEASE_FLAGS :=
PROFILE_VALIDATION_FLAGS :=

ifneq ($(filter $(KERNEL_PROFILE),release validation),$(KERNEL_PROFILE))
$(error Invalid KERNEL_PROFILE='$(KERNEL_PROFILE)'. Use release or validation)
endif

VALIDATION_WERROR ?= 0
AYKEN_SCHED_FALLBACK ?= 0
AYKEN_INTENTIONAL_PERF_REGRESSION_MS ?= 0
AYKEN_MB_SELFTEST ?= 1
AYKEN_GATE4_POLICY_TEST ?= 0
AYKEN_GATE45_PROOF ?= 0
AYKEN_DETERMINISTIC_EXIT ?= 0
KERNEL_EXPORT_POLICY ?= 1
AYKEN_CR3_PCID ?= 0
AYKEN_C2_STRICT_MARKERS ?= 0
# Phase10-C1 default: strict mailbox-owner bootstrap (no transitional policy bridge).
AYKEN_SCHED_BOOTSTRAP_POLICY ?= 0
AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE ?= 0
AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST ?= 0
AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST ?= 0
AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST ?= 0
AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT ?= 2
AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST ?= 0
AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT ?= 2
AYKEN_ALIAS_PROOF_SELFTEST ?= 0
AYKEN_RING3_FETCH_PROBE ?= 0
AYKEN_RING3_SECOND_CANONICAL_PROBE ?= 0
AYKEN_RING3_FRESH_FRAME_PROBE ?= 0
AYKEN_RING3_IRETQ_DIAG_PROBE ?= 0
AYKEN_RING3_POST_CR3_TEXT_PROBE ?= 0
AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY ?= 0
AYKEN_RING3_ENTRY_GUARD ?= 0
AYKEN_SHARE_KERNEL_UPPER_HALF ?= 0
AYKEN_RING3_LOW_FETCH_STUB ?= 0
AYKEN_RING3_CANONICAL_FETCH_STUB ?= 0
AYKEN_RING3_SKIP_CR3_PIVOT ?= 0
AYKEN_RING3_SELF_RELOAD_CR3 ?= 0
AYKEN_RING3_IRETQ_HEAD_PAD ?= 0
AYKEN_RING3_IRETQ_MARKER_PREFIX ?= 0
AYKEN_RING3_SPLIT_IRETQ_PAGE ?= 0
AYKEN_RING3_SHIFT_CANONICAL_WINDOW ?= 0
AYKEN_RING3_ALT_STAGEB_SOURCE ?= 0
AYKEN_RING3_FORCE_KERNEL_CR3 ?= 0
AYKEN_RING3_STERILE_ALT_ROOT ?= 0
AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT ?= 0
AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF ?= 0
AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF ?= 0
AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM ?= 0
AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM ?= 0
AYKEN_RING3_STERILE_GRAFT_PD2 ?= 0
AYKEN_RING3_STERILE_GRAFT_PD3 ?= 0
AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY ?= 0
AYKEN_RING3_STERILE_GRAFT_TEXT ?= 0
AYKEN_RING3_STERILE_GRAFT_CANARY ?= 0
AYKEN_RING3_STERILE_GRAFT_STACK ?= 0
AYKEN_RING3_STERILE_GRAFT_STACK_TOP ?= 0
AYKEN_RING3_STERILE_GRAFT_STACK_LOW ?= 0
AYKEN_RING3_STERILE_GRAFT_MAILBOX ?= 0
AYKEN_RING3_STERILE_GRAFT_INBOX ?= 0
AYKEN_RING3_STERILE_GRAFT_PAYLOAD ?= 0
AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM ?= 0
AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT ?= 0
AYKEN_RING3_STERILE_GRAFT_UPPER_PD ?= 0
AYKEN_RING3_STERILE_GRAFT_UPPER_PT ?= 0

ifneq ($(filter $(AYKEN_SCHED_FALLBACK),0 1),$(AYKEN_SCHED_FALLBACK))
$(error Invalid AYKEN_SCHED_FALLBACK='$(AYKEN_SCHED_FALLBACK)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_MB_SELFTEST),0 1),$(AYKEN_MB_SELFTEST))
$(error Invalid AYKEN_MB_SELFTEST='$(AYKEN_MB_SELFTEST)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_GATE4_POLICY_TEST),0 1),$(AYKEN_GATE4_POLICY_TEST))
$(error Invalid AYKEN_GATE4_POLICY_TEST='$(AYKEN_GATE4_POLICY_TEST)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_GATE45_PROOF),0 1),$(AYKEN_GATE45_PROOF))
$(error Invalid AYKEN_GATE45_PROOF='$(AYKEN_GATE45_PROOF)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_DETERMINISTIC_EXIT),0 1),$(AYKEN_DETERMINISTIC_EXIT))
$(error Invalid AYKEN_DETERMINISTIC_EXIT='$(AYKEN_DETERMINISTIC_EXIT)'. Use 0 or 1)
endif

ifneq ($(filter $(KERNEL_EXPORT_POLICY),0 1),$(KERNEL_EXPORT_POLICY))
$(error Invalid KERNEL_EXPORT_POLICY='$(KERNEL_EXPORT_POLICY)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_CR3_PCID),0 1),$(AYKEN_CR3_PCID))
$(error Invalid AYKEN_CR3_PCID='$(AYKEN_CR3_PCID)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_C2_STRICT_MARKERS),0 1),$(AYKEN_C2_STRICT_MARKERS))
$(error Invalid AYKEN_C2_STRICT_MARKERS='$(AYKEN_C2_STRICT_MARKERS)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_SECOND_CANONICAL_PROBE),0 1),$(AYKEN_RING3_SECOND_CANONICAL_PROBE))
$(error Invalid AYKEN_RING3_SECOND_CANONICAL_PROBE='$(AYKEN_RING3_SECOND_CANONICAL_PROBE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_FRESH_FRAME_PROBE),0 1),$(AYKEN_RING3_FRESH_FRAME_PROBE))
$(error Invalid AYKEN_RING3_FRESH_FRAME_PROBE='$(AYKEN_RING3_FRESH_FRAME_PROBE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_IRETQ_DIAG_PROBE),0 1),$(AYKEN_RING3_IRETQ_DIAG_PROBE))
$(error Invalid AYKEN_RING3_IRETQ_DIAG_PROBE='$(AYKEN_RING3_IRETQ_DIAG_PROBE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_POST_CR3_TEXT_PROBE),0 1),$(AYKEN_RING3_POST_CR3_TEXT_PROBE))
$(error Invalid AYKEN_RING3_POST_CR3_TEXT_PROBE='$(AYKEN_RING3_POST_CR3_TEXT_PROBE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY),0 1),$(AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY))
$(error Invalid AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY='$(AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_ENTRY_GUARD),0 1),$(AYKEN_RING3_ENTRY_GUARD))
$(error Invalid AYKEN_RING3_ENTRY_GUARD='$(AYKEN_RING3_ENTRY_GUARD)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_SHARE_KERNEL_UPPER_HALF),0 1),$(AYKEN_SHARE_KERNEL_UPPER_HALF))
$(error Invalid AYKEN_SHARE_KERNEL_UPPER_HALF='$(AYKEN_SHARE_KERNEL_UPPER_HALF)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_LOW_FETCH_STUB),0 1),$(AYKEN_RING3_LOW_FETCH_STUB))
$(error Invalid AYKEN_RING3_LOW_FETCH_STUB='$(AYKEN_RING3_LOW_FETCH_STUB)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_CANONICAL_FETCH_STUB),0 1),$(AYKEN_RING3_CANONICAL_FETCH_STUB))
$(error Invalid AYKEN_RING3_CANONICAL_FETCH_STUB='$(AYKEN_RING3_CANONICAL_FETCH_STUB)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_SKIP_CR3_PIVOT),0 1),$(AYKEN_RING3_SKIP_CR3_PIVOT))
$(error Invalid AYKEN_RING3_SKIP_CR3_PIVOT='$(AYKEN_RING3_SKIP_CR3_PIVOT)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_SELF_RELOAD_CR3),0 1),$(AYKEN_RING3_SELF_RELOAD_CR3))
$(error Invalid AYKEN_RING3_SELF_RELOAD_CR3='$(AYKEN_RING3_SELF_RELOAD_CR3)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_IRETQ_HEAD_PAD),0 1),$(AYKEN_RING3_IRETQ_HEAD_PAD))
$(error Invalid AYKEN_RING3_IRETQ_HEAD_PAD='$(AYKEN_RING3_IRETQ_HEAD_PAD)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_IRETQ_MARKER_PREFIX),0 1),$(AYKEN_RING3_IRETQ_MARKER_PREFIX))
$(error Invalid AYKEN_RING3_IRETQ_MARKER_PREFIX='$(AYKEN_RING3_IRETQ_MARKER_PREFIX)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_SPLIT_IRETQ_PAGE),0 1),$(AYKEN_RING3_SPLIT_IRETQ_PAGE))
$(error Invalid AYKEN_RING3_SPLIT_IRETQ_PAGE='$(AYKEN_RING3_SPLIT_IRETQ_PAGE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_SHIFT_CANONICAL_WINDOW),0 1),$(AYKEN_RING3_SHIFT_CANONICAL_WINDOW))
$(error Invalid AYKEN_RING3_SHIFT_CANONICAL_WINDOW='$(AYKEN_RING3_SHIFT_CANONICAL_WINDOW)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_ALT_STAGEB_SOURCE),0 1),$(AYKEN_RING3_ALT_STAGEB_SOURCE))
$(error Invalid AYKEN_RING3_ALT_STAGEB_SOURCE='$(AYKEN_RING3_ALT_STAGEB_SOURCE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_FORCE_KERNEL_CR3),0 1),$(AYKEN_RING3_FORCE_KERNEL_CR3))
$(error Invalid AYKEN_RING3_FORCE_KERNEL_CR3='$(AYKEN_RING3_FORCE_KERNEL_CR3)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_ALT_ROOT),0 1),$(AYKEN_RING3_STERILE_ALT_ROOT))
$(error Invalid AYKEN_RING3_STERILE_ALT_ROOT='$(AYKEN_RING3_STERILE_ALT_ROOT)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT),0 1),$(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT))
$(error Invalid AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT='$(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF),0 1),$(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF='$(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF),0 1),$(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF='$(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM),0 1),$(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM='$(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM),0 1),$(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM='$(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_PD2),0 1),$(AYKEN_RING3_STERILE_GRAFT_PD2))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_PD2='$(AYKEN_RING3_STERILE_GRAFT_PD2)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_PD3),0 1),$(AYKEN_RING3_STERILE_GRAFT_PD3))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_PD3='$(AYKEN_RING3_STERILE_GRAFT_PD3)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY),0 1),$(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY='$(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_TEXT),0 1),$(AYKEN_RING3_STERILE_GRAFT_TEXT))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_TEXT='$(AYKEN_RING3_STERILE_GRAFT_TEXT)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_CANARY),0 1),$(AYKEN_RING3_STERILE_GRAFT_CANARY))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_CANARY='$(AYKEN_RING3_STERILE_GRAFT_CANARY)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_STACK),0 1),$(AYKEN_RING3_STERILE_GRAFT_STACK))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_STACK='$(AYKEN_RING3_STERILE_GRAFT_STACK)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_STACK_TOP),0 1),$(AYKEN_RING3_STERILE_GRAFT_STACK_TOP))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_STACK_TOP='$(AYKEN_RING3_STERILE_GRAFT_STACK_TOP)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_STACK_LOW),0 1),$(AYKEN_RING3_STERILE_GRAFT_STACK_LOW))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_STACK_LOW='$(AYKEN_RING3_STERILE_GRAFT_STACK_LOW)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_MAILBOX),0 1),$(AYKEN_RING3_STERILE_GRAFT_MAILBOX))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_MAILBOX='$(AYKEN_RING3_STERILE_GRAFT_MAILBOX)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_INBOX),0 1),$(AYKEN_RING3_STERILE_GRAFT_INBOX))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_INBOX='$(AYKEN_RING3_STERILE_GRAFT_INBOX)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_PAYLOAD),0 1),$(AYKEN_RING3_STERILE_GRAFT_PAYLOAD))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_PAYLOAD='$(AYKEN_RING3_STERILE_GRAFT_PAYLOAD)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM),0 1),$(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM='$(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT),0 1),$(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT='$(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_UPPER_PD),0 1),$(AYKEN_RING3_STERILE_GRAFT_UPPER_PD))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_UPPER_PD='$(AYKEN_RING3_STERILE_GRAFT_UPPER_PD)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_RING3_STERILE_GRAFT_UPPER_PT),0 1),$(AYKEN_RING3_STERILE_GRAFT_UPPER_PT))
$(error Invalid AYKEN_RING3_STERILE_GRAFT_UPPER_PT='$(AYKEN_RING3_STERILE_GRAFT_UPPER_PT)'. Use 0 or 1)
endif

ifeq ($(AYKEN_RING3_SECOND_CANONICAL_PROBE),1)
ifeq ($(AYKEN_RING3_FETCH_PROBE),0)
$(error AYKEN_RING3_SECOND_CANONICAL_PROBE=1 requires AYKEN_RING3_FETCH_PROBE=1)
endif
endif

ifeq ($(AYKEN_RING3_FRESH_FRAME_PROBE),1)
ifeq ($(AYKEN_RING3_FETCH_PROBE),0)
$(error AYKEN_RING3_FRESH_FRAME_PROBE=1 requires AYKEN_RING3_FETCH_PROBE=1)
endif
ifeq ($(AYKEN_RING3_SECOND_CANONICAL_PROBE),0)
$(error AYKEN_RING3_FRESH_FRAME_PROBE=1 requires AYKEN_RING3_SECOND_CANONICAL_PROBE=1)
endif
endif

ifeq ($(AYKEN_RING3_LOW_FETCH_STUB),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),1)
$(error AYKEN_RING3_LOW_FETCH_STUB=1 and AYKEN_RING3_CANONICAL_FETCH_STUB=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_SKIP_CR3_PIVOT),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_SKIP_CR3_PIVOT=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_SELF_RELOAD_CR3),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_SELF_RELOAD_CR3=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_IRETQ_HEAD_PAD),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_IRETQ_HEAD_PAD=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_IRETQ_MARKER_PREFIX),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_IRETQ_MARKER_PREFIX=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_SPLIT_IRETQ_PAGE),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_SPLIT_IRETQ_PAGE=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_SHIFT_CANONICAL_WINDOW),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_SHIFT_CANONICAL_WINDOW=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_ALT_STAGEB_SOURCE),1)
ifeq ($(AYKEN_RING3_SPLIT_IRETQ_PAGE),0)
$(error AYKEN_RING3_ALT_STAGEB_SOURCE=1 requires AYKEN_RING3_SPLIT_IRETQ_PAGE=1)
endif
endif

ifeq ($(AYKEN_RING3_SKIP_CR3_PIVOT),1)
ifeq ($(AYKEN_RING3_SELF_RELOAD_CR3),1)
$(error AYKEN_RING3_SKIP_CR3_PIVOT=1 and AYKEN_RING3_SELF_RELOAD_CR3=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_IRETQ_HEAD_PAD),1)
ifeq ($(AYKEN_RING3_IRETQ_DIAG_PROBE),1)
$(error AYKEN_RING3_IRETQ_HEAD_PAD=1 and AYKEN_RING3_IRETQ_DIAG_PROBE=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_IRETQ_MARKER_PREFIX),1)
ifeq ($(AYKEN_RING3_IRETQ_DIAG_PROBE),1)
$(error AYKEN_RING3_IRETQ_MARKER_PREFIX=1 and AYKEN_RING3_IRETQ_DIAG_PROBE=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_IRETQ_HEAD_PAD),1)
ifeq ($(AYKEN_RING3_IRETQ_MARKER_PREFIX),1)
$(error AYKEN_RING3_IRETQ_HEAD_PAD=1 and AYKEN_RING3_IRETQ_MARKER_PREFIX=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_SPLIT_IRETQ_PAGE),1)
ifeq ($(AYKEN_RING3_IRETQ_DIAG_PROBE),1)
$(error AYKEN_RING3_SPLIT_IRETQ_PAGE=1 and AYKEN_RING3_IRETQ_DIAG_PROBE=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_SPLIT_IRETQ_PAGE),1)
ifeq ($(AYKEN_RING3_IRETQ_HEAD_PAD),1)
$(error AYKEN_RING3_SPLIT_IRETQ_PAGE=1 and AYKEN_RING3_IRETQ_HEAD_PAD=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_SPLIT_IRETQ_PAGE),1)
ifeq ($(AYKEN_RING3_IRETQ_MARKER_PREFIX),1)
$(error AYKEN_RING3_SPLIT_IRETQ_PAGE=1 and AYKEN_RING3_IRETQ_MARKER_PREFIX=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_FORCE_KERNEL_CR3),1)
ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),0)
$(error AYKEN_RING3_FORCE_KERNEL_CR3=1 requires AYKEN_RING3_CANONICAL_FETCH_STUB=1)
endif
endif

ifeq ($(AYKEN_RING3_FORCE_KERNEL_CR3),1)
ifeq ($(AYKEN_RING3_SKIP_CR3_PIVOT),1)
$(error AYKEN_RING3_FORCE_KERNEL_CR3=1 and AYKEN_RING3_SKIP_CR3_PIVOT=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_FORCE_KERNEL_CR3),1)
ifeq ($(AYKEN_RING3_SELF_RELOAD_CR3),1)
$(error AYKEN_RING3_FORCE_KERNEL_CR3=1 and AYKEN_RING3_SELF_RELOAD_CR3=1 are mutually exclusive)
endif
endif

# Validation A/B lanes may pair sterile alt roots with the direct post-CR3
# iretq path to isolate canonical fetch stub behavior.

ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),1)
ifeq ($(AYKEN_RING3_SKIP_CR3_PIVOT),1)
$(error AYKEN_RING3_STERILE_ALT_ROOT=1 and AYKEN_RING3_SKIP_CR3_PIVOT=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),1)
ifeq ($(AYKEN_RING3_SELF_RELOAD_CR3),1)
$(error AYKEN_RING3_STERILE_ALT_ROOT=1 and AYKEN_RING3_SELF_RELOAD_CR3=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),1)
ifeq ($(AYKEN_RING3_FORCE_KERNEL_CR3),1)
$(error AYKEN_RING3_STERILE_ALT_ROOT=1 and AYKEN_RING3_FORCE_KERNEL_CR3=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_PD2),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_PD2=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_PD3),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_PD3=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_TEXT),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_TEXT=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_CANARY),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_CANARY=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_STACK),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_STACK=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_STACK_TOP),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_STACK_TOP=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_STACK_LOW),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_STACK_LOW=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_MAILBOX),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_MAILBOX=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_INBOX),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_INBOX=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_PAYLOAD),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_PAYLOAD=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_UPPER_PD),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_UPPER_PD=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_STERILE_GRAFT_UPPER_PT),1)
ifeq ($(AYKEN_RING3_STERILE_ALT_ROOT),0)
$(error AYKEN_RING3_STERILE_GRAFT_UPPER_PT=1 requires AYKEN_RING3_STERILE_ALT_ROOT=1)
endif
endif

ifeq ($(AYKEN_RING3_CANONICAL_FETCH_STUB),1)
ifeq ($(AYKEN_RING3_FETCH_PROBE),1)
$(error AYKEN_RING3_CANONICAL_FETCH_STUB=1 is incompatible with AYKEN_RING3_FETCH_PROBE=1)
endif
endif

ifneq ($(filter $(AYKEN_SCHED_BOOTSTRAP_POLICY),0 1),$(AYKEN_SCHED_BOOTSTRAP_POLICY))
$(error Invalid AYKEN_SCHED_BOOTSTRAP_POLICY='$(AYKEN_SCHED_BOOTSTRAP_POLICY)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE),0 1),$(AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE))
$(error Invalid AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE='$(AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST),0 1),$(AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST))
$(error Invalid AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST='$(AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST),0 1),$(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST))
$(error Invalid AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST='$(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST),0 1),$(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST))
$(error Invalid AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST='$(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST)'. Use 0 or 1)
endif

ifneq ($(filter $(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST),0 1),$(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST))
$(error Invalid AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST='$(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST)'. Use 0 or 1)
endif

ifeq ($(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST),1)
ifeq ($(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST),1)
$(error AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=1 and AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST),1)
ifeq ($(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST),1)
$(error AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=1 and AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST),1)
ifeq ($(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST),1)
$(error AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=1 and AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST=1 are mutually exclusive)
endif
endif

ifeq ($(AYKEN_SCHED_BOOTSTRAP_POLICY),0)
ifeq ($(AYKEN_SCHED_FALLBACK),1)
$(error AYKEN_SCHED_FALLBACK=1 is forbidden when AYKEN_SCHED_BOOTSTRAP_POLICY=0)
endif
endif

ifeq ($(AYKEN_SCHED_FALLBACK),1)
ifneq ($(KERNEL_PROFILE),validation)
$(error AYKEN_SCHED_FALLBACK=1 is only allowed with KERNEL_PROFILE=validation)
endif
endif

# Debug flags: set defaults based on profile, allow override via env
ifeq ($(KERNEL_PROFILE),validation)
PROFILE_VALIDATION_FLAGS := 1
AYKEN_VALIDATION := 1
AYKEN_DEBUG_IRQ ?= 1
AYKEN_DEBUG_SCHED ?= 1
KERNEL_CFLAGS += -O0 -g3 -DAYKEN_VALIDATION=1
ifeq ($(VALIDATION_WERROR),1)
KERNEL_CFLAGS += -Werror
endif
else
PROFILE_RELEASE_FLAGS := 1
AYKEN_DEBUG_IRQ ?= 0
AYKEN_DEBUG_SCHED ?= 0
KERNEL_CFLAGS += -O2 -g1
endif

ifeq ($(AYKEN_DEBUG_IRQ),1)
KERNEL_CFLAGS += -DAYKEN_DEBUG_IRQ=1
endif

ifeq ($(AYKEN_DEBUG_SCHED),1)
KERNEL_CFLAGS += -DAYKEN_DEBUG_SCHED=1
KERNEL_ASMFLAGS += -DAYKEN_DEBUG_SCHED=1
endif
KERNEL_CFLAGS += -DAYKEN_SCHED_FALLBACK=$(AYKEN_SCHED_FALLBACK)
KERNEL_CFLAGS += -DAYKEN_INTENTIONAL_PERF_REGRESSION_MS=$(AYKEN_INTENTIONAL_PERF_REGRESSION_MS)
KERNEL_CFLAGS += -DAYKEN_MB_SELFTEST=$(AYKEN_MB_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_GATE4_POLICY_TEST=$(AYKEN_GATE4_POLICY_TEST)
KERNEL_CFLAGS += -DAYKEN_GATE45_PROOF=$(AYKEN_GATE45_PROOF)
KERNEL_CFLAGS += -DAYKEN_DETERMINISTIC_EXIT=$(AYKEN_DETERMINISTIC_EXIT)
KERNEL_CFLAGS += -DAYKEN_CR3_PCID=$(AYKEN_CR3_PCID)
KERNEL_CFLAGS += -DAYKEN_C2_STRICT_MARKERS=$(AYKEN_C2_STRICT_MARKERS)
KERNEL_CFLAGS += -DAYKEN_SCHED_BOOTSTRAP_POLICY=$(AYKEN_SCHED_BOOTSTRAP_POLICY)
KERNEL_CFLAGS += -DAYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE=$(AYKEN_PHASE11_MAILBOX_CAPABILITY_ENFORCE)
KERNEL_CFLAGS += -DAYKEN_PHASE10B_FAIL_CLOSED_SELFTEST=$(AYKEN_PHASE10B_FAIL_CLOSED_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=$(AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=$(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT=$(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT)
KERNEL_CFLAGS += -DAYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST=$(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT=$(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT)
KERNEL_CFLAGS += -DAYKEN_ALIAS_PROOF_SELFTEST=$(AYKEN_ALIAS_PROOF_SELFTEST)
KERNEL_CFLAGS += -DAYKEN_RING3_FETCH_PROBE=$(AYKEN_RING3_FETCH_PROBE)
KERNEL_CFLAGS += -DAYKEN_RING3_SECOND_CANONICAL_PROBE=$(AYKEN_RING3_SECOND_CANONICAL_PROBE)
KERNEL_CFLAGS += -DAYKEN_RING3_FRESH_FRAME_PROBE=$(AYKEN_RING3_FRESH_FRAME_PROBE)
KERNEL_CFLAGS += -DAYKEN_RING3_IRETQ_DIAG_PROBE=$(AYKEN_RING3_IRETQ_DIAG_PROBE)
KERNEL_CFLAGS += -DAYKEN_RING3_POST_CR3_TEXT_PROBE=$(AYKEN_RING3_POST_CR3_TEXT_PROBE)
KERNEL_CFLAGS += -DAYKEN_RING3_MASK_IRQ0_FIRST_ENTRY=$(AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY)
KERNEL_CFLAGS += -DAYKEN_RING3_ENTRY_GUARD=$(AYKEN_RING3_ENTRY_GUARD)
KERNEL_CFLAGS += -DAYKEN_SHARE_KERNEL_UPPER_HALF=$(AYKEN_SHARE_KERNEL_UPPER_HALF)
KERNEL_CFLAGS += -DAYKEN_RING3_LOW_FETCH_STUB=$(AYKEN_RING3_LOW_FETCH_STUB)
KERNEL_CFLAGS += -DAYKEN_RING3_CANONICAL_FETCH_STUB=$(AYKEN_RING3_CANONICAL_FETCH_STUB)
KERNEL_CFLAGS += -DAYKEN_RING3_SKIP_CR3_PIVOT=$(AYKEN_RING3_SKIP_CR3_PIVOT)
KERNEL_CFLAGS += -DAYKEN_RING3_SELF_RELOAD_CR3=$(AYKEN_RING3_SELF_RELOAD_CR3)
KERNEL_CFLAGS += -DAYKEN_RING3_IRETQ_HEAD_PAD=$(AYKEN_RING3_IRETQ_HEAD_PAD)
KERNEL_CFLAGS += -DAYKEN_RING3_IRETQ_MARKER_PREFIX=$(AYKEN_RING3_IRETQ_MARKER_PREFIX)
KERNEL_CFLAGS += -DAYKEN_RING3_SPLIT_IRETQ_PAGE=$(AYKEN_RING3_SPLIT_IRETQ_PAGE)
KERNEL_CFLAGS += -DAYKEN_RING3_SHIFT_CANONICAL_WINDOW=$(AYKEN_RING3_SHIFT_CANONICAL_WINDOW)
KERNEL_CFLAGS += -DAYKEN_RING3_ALT_STAGEB_SOURCE=$(AYKEN_RING3_ALT_STAGEB_SOURCE)
KERNEL_CFLAGS += -DAYKEN_RING3_FORCE_KERNEL_CR3=$(AYKEN_RING3_FORCE_KERNEL_CR3)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_ALT_ROOT=$(AYKEN_RING3_STERILE_ALT_ROOT)
KERNEL_CFLAGS += -DAYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT=$(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD2=$(AYKEN_RING3_STERILE_GRAFT_PD2)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD3=$(AYKEN_RING3_STERILE_GRAFT_PD3)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY=$(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_TEXT=$(AYKEN_RING3_STERILE_GRAFT_TEXT)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_CANARY=$(AYKEN_RING3_STERILE_GRAFT_CANARY)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK=$(AYKEN_RING3_STERILE_GRAFT_STACK)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK_TOP=$(AYKEN_RING3_STERILE_GRAFT_STACK_TOP)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK_LOW=$(AYKEN_RING3_STERILE_GRAFT_STACK_LOW)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_MAILBOX=$(AYKEN_RING3_STERILE_GRAFT_MAILBOX)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_INBOX=$(AYKEN_RING3_STERILE_GRAFT_INBOX)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PAYLOAD=$(AYKEN_RING3_STERILE_GRAFT_PAYLOAD)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PDPT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PD=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PD)
KERNEL_CFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PT)
KERNEL_ASMFLAGS += -DAYKEN_CR3_PCID=$(AYKEN_CR3_PCID)
KERNEL_ASMFLAGS += -DAYKEN_RING3_FETCH_PROBE=$(AYKEN_RING3_FETCH_PROBE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_SECOND_CANONICAL_PROBE=$(AYKEN_RING3_SECOND_CANONICAL_PROBE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_FRESH_FRAME_PROBE=$(AYKEN_RING3_FRESH_FRAME_PROBE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_LOW_FETCH_STUB=$(AYKEN_RING3_LOW_FETCH_STUB)
KERNEL_ASMFLAGS += -DAYKEN_RING3_CANONICAL_FETCH_STUB=$(AYKEN_RING3_CANONICAL_FETCH_STUB)
KERNEL_ASMFLAGS += -DAYKEN_RING3_IRETQ_DIAG_PROBE=$(AYKEN_RING3_IRETQ_DIAG_PROBE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_POST_CR3_TEXT_PROBE=$(AYKEN_RING3_POST_CR3_TEXT_PROBE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_SKIP_CR3_PIVOT=$(AYKEN_RING3_SKIP_CR3_PIVOT)
KERNEL_ASMFLAGS += -DAYKEN_RING3_SELF_RELOAD_CR3=$(AYKEN_RING3_SELF_RELOAD_CR3)
KERNEL_ASMFLAGS += -DAYKEN_RING3_IRETQ_HEAD_PAD=$(AYKEN_RING3_IRETQ_HEAD_PAD)
KERNEL_ASMFLAGS += -DAYKEN_RING3_IRETQ_MARKER_PREFIX=$(AYKEN_RING3_IRETQ_MARKER_PREFIX)
KERNEL_ASMFLAGS += -DAYKEN_RING3_SPLIT_IRETQ_PAGE=$(AYKEN_RING3_SPLIT_IRETQ_PAGE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_SHIFT_CANONICAL_WINDOW=$(AYKEN_RING3_SHIFT_CANONICAL_WINDOW)
KERNEL_ASMFLAGS += -DAYKEN_RING3_ALT_STAGEB_SOURCE=$(AYKEN_RING3_ALT_STAGEB_SOURCE)
KERNEL_ASMFLAGS += -DAYKEN_RING3_FORCE_KERNEL_CR3=$(AYKEN_RING3_FORCE_KERNEL_CR3)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_ALT_ROOT=$(AYKEN_RING3_STERILE_ALT_ROOT)
KERNEL_ASMFLAGS += -DAYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT=$(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD2=$(AYKEN_RING3_STERILE_GRAFT_PD2)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD3=$(AYKEN_RING3_STERILE_GRAFT_PD3)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY=$(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_TEXT=$(AYKEN_RING3_STERILE_GRAFT_TEXT)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_CANARY=$(AYKEN_RING3_STERILE_GRAFT_CANARY)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK=$(AYKEN_RING3_STERILE_GRAFT_STACK)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK_TOP=$(AYKEN_RING3_STERILE_GRAFT_STACK_TOP)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_STACK_LOW=$(AYKEN_RING3_STERILE_GRAFT_STACK_LOW)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_MAILBOX=$(AYKEN_RING3_STERILE_GRAFT_MAILBOX)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_INBOX=$(AYKEN_RING3_STERILE_GRAFT_INBOX)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_PAYLOAD=$(AYKEN_RING3_STERILE_GRAFT_PAYLOAD)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PDPT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PD=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PD)
KERNEL_ASMFLAGS += -DAYKEN_RING3_STERILE_GRAFT_UPPER_PT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PT)
# For gdt_idt.c force kernel code model to avoid 32-bit relocations in higher half
KERNEL_CFLAGS_GDT := $(filter-out -mcmodel=large,$(KERNEL_CFLAGS)) -mcmodel=kernel

KERNEL_LDFLAGS = -nostdlib -z max-page-size=0x1000
KERNEL_MAP ?=

CTX_SWITCH_ASM = kernel/arch/x86_64/context_switch.asm
ABI_H = shared/abi/ayken_abi.h
ABI_INC = kernel/include/generated/ayken_abi.inc
RING0_SYMBOL_WHITELIST = scripts/ci/constitutional-ring0-symbol-whitelist.regex
RING0_EXPORT_MAP = kernel/include/generated/ring0.exports.map
KERNEL_LINK_EXTRA_FLAGS =
KERNEL_LINK_EXTRA_DEPS =

KERNEL_DIR = kernel
ARCH_DIR   = kernel/arch/x86_64

# Kernel kaynak dosyaları
ifeq ($(OS),Windows_NT)
define find_files
$(shell powershell -NoProfile -Command "Get-ChildItem -Path '$(1)' -Recurse -Filter $(2) -File | ForEach-Object { $$_.FullName }")
endef
else
define find_files
$(shell find $(1) -type f -name "$(2)")
endef
endif

KERNEL_C_SOURCES_ALL = $(call find_files,$(KERNEL_DIR),*.c)
KERNEL_C_TEST_SOURCES = $(filter %_test.c,$(KERNEL_C_SOURCES_ALL))
# Ring0 topology enforces mechanism/policy separation; no default source exclusion hacks.
# Phase 11: alias_proof_validation.c excluded from default build; included only under AYKEN_VALIDATION=1
KERNEL_C_EXCLUDE_SOURCES = kernel/tests/validation/alias_proof_validation.c
KERNEL_C_SOURCES = $(filter-out $(KERNEL_C_TEST_SOURCES) $(KERNEL_C_EXCLUDE_SOURCES),$(KERNEL_C_SOURCES_ALL))

# Phase 11: Include alias proof validation in validation builds
ifeq ($(AYKEN_VALIDATION),1)
KERNEL_C_SOURCES += kernel/tests/validation/alias_proof_validation.c
endif
KERNEL_ASM_SOURCES = $(call find_files,$(ARCH_DIR),*.asm)
KERNEL_S_SOURCES   = $(call find_files,$(ARCH_DIR),*.S)

# Phase 10: User binary embedding
USER_MINIMAL_DIR = userspace/minimal
USER_MINIMAL_ELF = $(USER_MINIMAL_DIR)/minimal.elf
USER_MINIMAL_BIN = $(USER_MINIMAL_DIR)/user.bin
USER_MINIMAL_BIN_SHA = $(USER_MINIMAL_DIR)/user.bin.sha256
USER_MINIMAL_DEFAULT_MODE := phase10a2
USER_MINIMAL_EFFECTIVE_MODE := $(if $(strip $(USER_MINIMAL_MODE)),$(strip $(USER_MINIMAL_MODE)),$(USER_MINIMAL_DEFAULT_MODE))
USER_MINIMAL_MODE_STAMP = $(USER_MINIMAL_DIR)/.mode.$(USER_MINIMAL_EFFECTIVE_MODE)
KERNEL_CFLAGS += -DAYKEN_USER_MINIMAL_MODE_STRING=\"$(USER_MINIMAL_EFFECTIVE_MODE)\"
USER_MINIMAL_SOURCES = $(wildcard $(USER_MINIMAL_DIR)/*.c) \
                       $(wildcard $(USER_MINIMAL_DIR)/*.S) \
                       $(USER_MINIMAL_DIR)/user.ld \
                       $(USER_MINIMAL_DIR)/Makefile
EMBED_ELF_TOOL = tools/embed_elf.py
EMBEDDED_ELF_HEADER = kernel/include/embedded_elf.h

# Kernel image contains Ring0 code only.
# Ring3 userspace components are built via separate userspace targets.
KERNEL_OBJS = $(KERNEL_C_SOURCES:.c=.o) $(KERNEL_ASM_SOURCES:.asm=.o) $(KERNEL_S_SOURCES:.S=.o)
KERNEL_DEPS = $(KERNEL_OBJS:.o=.d)
KERNEL_BUILD_FLAGS_STAMP = $(AYKEN_BUILD_DIR)/kernel-build-flags.stamp

ifeq ($(KERNEL_EXPORT_POLICY),1)
KERNEL_LINK_EXTRA_FLAGS += --version-script=$(RING0_EXPORT_MAP)
KERNEL_LINK_EXTRA_DEPS += $(RING0_EXPORT_MAP)
endif

# Rust workspace (userspace runtime/dispatcher)
USERSPACE_RUST_DIR = userspace
USERSPACE_RUNTIME_BIN = $(CARGO_TARGET_DIR)/debug/dispatcher

# CI evidence and boundary gate defaults
# Include per-process entropy to avoid evidence path collisions when multiple
# local make invocations start within the same second.
RUN_ID_NONCE := $(shell /bin/sh -c 'printf "%s" "$$$$"')
RUN_ID_DEFAULT := $(shell date -u +"%Y%m%dT%H%M%SZ")-$(shell git rev-parse --short HEAD 2>/dev/null || echo nogit)-$(RUN_ID_NONCE)
RUN_ID ?= $(RUN_ID_DEFAULT)
# Command-line RUN_ID= (empty) must not collapse evidence path to evidence/run-.
ifeq ($(strip $(RUN_ID)),)
override RUN_ID := $(RUN_ID_DEFAULT)
endif
RUN_ID := $(RUN_ID)
EVIDENCE_RUN_DIR := $(EVIDENCE_ROOT)/run-$(RUN_ID)
PHASE12_CLOSURE_RUN_DIR ?= $(EVIDENCE_ROOT)/run-run-local-phase12c-closure-2026-03-11
PHASE12_CLOSURE_OUTPUT_DIR ?= reports/phase12_official_closure_candidate
PHASE12_CLOSURE_ATTESTOR_NODE_ID ?=
PHASE12_CLOSURE_ATTESTOR_KEY_ID ?=
PHASE12_CLOSURE_ATTESTOR_PRIVATE_KEY ?=
PHASE12_CLOSURE_ATTESTED_AT_UTC ?=
PHASE12_CLOSURE_ATTESTOR_PUBLIC_KEY ?=
PHASE12_CLOSURE_PREFLIGHT_OUTPUT_DIR ?= reports/phase12_official_closure_preflight
PHASE12_CLOSURE_REMOTE_CI_WORKFLOW ?= ci-freeze
PHASE12_CLOSURE_REMOTE_CI_RUN_ID ?=
CI_TARGETS ?= $(KERNEL_ELF)
ABI_INIT_BASELINE ?= 0
ABI_DIFF_RANGE ?=
CONSTITUTIONAL_STRICT ?= 1
CONSTITUTIONAL_STRICT_FLAG = $(if $(filter 1,$(CONSTITUTIONAL_STRICT)),--strict,--no-strict)
GOVERNANCE_POLICY_KERNEL_PROFILE ?= validation
RUNTIME_MARKER_CONTRACT_ENFORCE ?= 1
BEHAVIORAL_SUITE_PHASE ?= 5
WORKSPACE_STRICT ?= 1
WORKSPACE_STRICT_FLAG = $(if $(filter 1,$(WORKSPACE_STRICT)),--strict,--no-strict)
PERF_INIT_BASELINE ?= 0
PERF_ENV_MISMATCH_POLICY ?= fail
PERF_QEMU_TIMEOUT ?= 30
PERF_KERNEL_PROFILE ?= validation
PERF_BASELINE_FILE ?= scripts/ci/perf-baseline.lock.json
PERF_LOCAL_BASELINE_FILE ?= scripts/ci/perf-baseline.local.lock.json
PERF_AUTHORITY_ENV_FILE ?= scripts/ci/perf_authority.env
PERF_BASELINE_AUTHORITY_DEFAULT := $(shell sed -n 's/^PERF_BASELINE_AUTHORITY=//p' $(PERF_AUTHORITY_ENV_FILE) 2>/dev/null | head -n1)
PERF_BASELINE_AUTHORITY ?= $(if $(PERF_BASELINE_AUTHORITY_DEFAULT),$(PERF_BASELINE_AUTHORITY_DEFAULT),github-hosted-ubuntu-24.04-x64)
PERF_REQUIRE_CI_FOR_BASELINE_INIT ?= 1
PERF_CI_IMAGE_DIGEST ?= unknown
PERF_LOCAL_BASELINE_AUTHORITY ?= local-dev-$(shell uname -s)-$(shell uname -m)
PERF_LOCAL_CI_IMAGE_DIGEST ?= local-$(shell hostname)-$(shell uname -r)
PERF_LOCAL_BOOT_THRESHOLD_PERCENT ?= 20
PERF_LOCAL_CONTEXT_THRESHOLD_PERCENT ?= 15
PERF_LOCAL_SYSCALL_THRESHOLD_PERCENT ?= 15
PERF_LOCAL_SAMPLE_SIZE ?= 5
PERF_LOCAL_WARMUP_RUNS ?= 1
PERF_LOCAL_AGGREGATION ?= median
PERF_LOCAL_OUTLIER_POLICY ?= none
PERF_PREEMPT_BUILD_DEBUG_SCHED ?=
PERF_PREEMPT_BUILD_DEBUG_IRQ ?=
PERF_STABILITY_CONTRACT_FILE ?= scripts/ci/perf-stability.contract.json
PERF_STABILITY_PROFILE ?= local-default
PERF_LEARNING_SOURCE_GLOB ?=
SYSCALL_V2_RUNTIME_KERNEL_PROFILE ?= validation
SYSCALL_V2_RUNTIME_WARMUP ?= 1
ifeq ($(PERF_BASELINE_MODE),provisional)
SYSCALL_V2_RUNTIME_RUNS ?= 3
SYSCALL_V2_RUNTIME_TIMEOUT ?= 40
SYSCALL_V2_RUNTIME_REQUIRED_SUCCESS_RATE ?= 60
else
SYSCALL_V2_RUNTIME_RUNS ?= 5
SYSCALL_V2_RUNTIME_TIMEOUT ?= 20
SYSCALL_V2_RUNTIME_REQUIRED_SUCCESS_RATE ?= 100
endif
RING0_EXPORT_MAX ?= 193
PERF_VARIANCE_RUNS ?= 5
PERF_VARIANCE_WARMUP ?= 1
PERF_VARIANCE_QEMU_TIMEOUT ?= 12
PERF_VARIANCE_STRICT_MARKERS ?= 1
PERF_VARIANCE_FORCE_EFI_REBUILD ?= 0
RING3_QEMU_TIMEOUT ?= 35
PHASE10B_MODE ?= negative
PHASE10B_A2_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2
PHASE10B_PROOF_QEMU_TIMEOUT ?= 20
PHASE10B_REQUIRE_COLOCATED_A2 ?= 1
LOW_HALF_KHEAP_A2_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2
LOW_HALF_KHEAP_EXIT_PROOF_QEMU_TIMEOUT ?= 35
LOW_HALF_KHEAP_MULTI_EXIT_PROOF_QEMU_TIMEOUT ?= 35
LOW_HALF_KHEAP_INTERLEAVING_PROOF_QEMU_TIMEOUT ?= 35
PHASE10C_REQUIRE_METADATA ?= 1
PHASE10C_A2_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2
PHASE11_LEDGER_A2_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2
PHASE11_LEDGER_REQUIRE_ETI ?= 0
PHASE11_LEDGER_ETI_EVENTS ?=
PHASE11_LEDGER_V1_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ledger-v1
PHASE11_DEOL_LEDGER_EVIDENCE_DIR ?= $(PHASE11_LEDGER_V1_EVIDENCE_DIR)
PHASE11_ETI_A2_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2
PHASE11_ETI_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/eti
PHASE11_LEDGER_ETI_EVIDENCE_DIR ?= $(PHASE11_ETI_EVIDENCE_DIR)
PHASE11_LEDGER_ETI_LEDGER_EVIDENCE_DIR ?= $(PHASE11_LEDGER_V1_EVIDENCE_DIR)
PHASE11_DLT_ETI_EVIDENCE_DIR ?= $(PHASE11_ETI_EVIDENCE_DIR)
PHASE11_DLT_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/dlt-monotonicity
PHASE11_ETI_DLT_EVIDENCE_DIR ?= $(PHASE11_ETI_EVIDENCE_DIR)
PHASE11_ETI_DLT_DLT_EVIDENCE_DIR ?= $(PHASE11_DLT_EVIDENCE_DIR)
PHASE11_DLT_DETERMINISM_ETI_EVIDENCE_DIR ?= $(PHASE11_ETI_EVIDENCE_DIR)
PHASE11_GCP_DLT_EVIDENCE_DIR ?= $(PHASE11_DLT_EVIDENCE_DIR)
PHASE11_GCP_PREVIOUS_SNAPSHOT ?=
PHASE11_ABDF_INPUT_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/input
PHASE11_ABDF_SNAPSHOT_BIN ?= $(PHASE11_ABDF_INPUT_EVIDENCE_DIR)/snapshot.abdf
PHASE11_ABDF_EXPECTED_HASH_FILE ?=
PHASE11_BCIB_EXECUTION_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/execution
PHASE11_BCIB_PLAN_BIN ?= $(PHASE11_BCIB_EXECUTION_EVIDENCE_DIR)/plan.bcib
PHASE11_BCIB_ETI_EVIDENCE_DIR ?= $(PHASE11_ETI_EVIDENCE_DIR)
PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE ?=
PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE ?=
PHASE11_REPLAY_ABDF_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/abdf-snapshot-identity
PHASE11_REPLAY_EXECUTION_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/execution-identity
PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE ?=
PHASE11_KPL_ABDF_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/abdf-snapshot-identity
PHASE11_KPL_EXECUTION_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/execution-identity
PHASE11_KPL_REPLAY_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/replay-v1
PHASE11_KPL_LEDGER_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/ledger-v1
PHASE11_KPL_ETI_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/eti
PHASE11_KPL_KERNEL_IMAGE_BIN ?= $(KERNEL_ELF)
PHASE11_KPL_CONFIG_JSON ?= $(EVIDENCE_RUN_DIR)/meta/run.json
PHASE11_KPL_INPUT_PROOF_MANIFEST ?=
PHASE11_KPL_EXPECTED_PROOF_HASH_FILE ?=
PHASE11_KPL_EXPECTED_FINAL_STATE_HASH_FILE ?=
PHASE11_BUNDLE_ABDF_EVIDENCE_DIR ?= $(PHASE11_KPL_ABDF_EVIDENCE_DIR)
PHASE11_BUNDLE_EXECUTION_EVIDENCE_DIR ?= $(PHASE11_KPL_EXECUTION_EVIDENCE_DIR)
PHASE11_BUNDLE_REPLAY_EVIDENCE_DIR ?= $(PHASE11_KPL_REPLAY_EVIDENCE_DIR)
PHASE11_BUNDLE_KPL_EVIDENCE_DIR ?= $(EVIDENCE_RUN_DIR)/gates/kpl-proof
PHASE11_BUNDLE_LEDGER_EVIDENCE_DIR ?= $(PHASE11_KPL_LEDGER_EVIDENCE_DIR)
PHASE11_BUNDLE_ETI_EVIDENCE_DIR ?= $(PHASE11_KPL_ETI_EVIDENCE_DIR)
PHASE11_BUNDLE_KERNEL_IMAGE_BIN ?= $(PHASE11_KPL_KERNEL_IMAGE_BIN)
PHASE11_BUNDLE_SUMMARY_JSON ?= $(EVIDENCE_RUN_DIR)/reports/summary.json
PHASE11_BUNDLE_META_RUN_JSON ?= $(EVIDENCE_RUN_DIR)/meta/run.json
# C2 activation default: enabled in freeze chain; can be disabled explicitly
# via `PHASE10C_ENFORCE=0 make ci-freeze`.
PHASE10C_ENFORCE ?= 1
PHASE10C_C2_STRICT ?= 0
PHASE10C_C2_OWNER_SET ?= 2
PHASE10C_C2_REQUIRE_CURSOR_MARKER ?= 1
PHASE10C_FREEZE_GATE = $(if $(filter 1,$(PHASE10C_ENFORCE)),ci-gate-scheduler-mailbox-phase10c,)
GATE45_QEMU_TIMEOUT ?= 20
GATE45_BOOTSTRAP_POLICY ?= 1
GATE45_MB_SELFTEST ?= 0
GATE45_C2_STRICT ?= 0
GATE45_C2_OWNER_PID ?= 2


# ------------------------------------------------------------
# 2) UEFI Bootloader toolchain
# ------------------------------------------------------------
# Burayı ortamına göre ayarlayacaksın:
# - Eğer clang kullanıyorsan: EFI_CC = clang
# - Eğer mingw-w64 kullanıyorsan: EFI_CC = x86_64-w64-mingw32-gcc
#
# Windows + WSL senaryosunda genelde clang daha rahat.

EFI_CC_BIN = clang
EFI_CC = $(EFI_CC_BIN)
EFI_LD_BIN = lld-link
EFI_LD = $(EFI_LD_BIN)

# gnu-efi veya EDK2 header dizinlerin varsa buraya ekle:
# Örn (Linux, gnu-efi için):
# EFI_INC = /usr/include/efi
# EFI_INC_ARCH = /usr/include/efi/x86_64
EFI_INC      = tools/gnu-efi/inc
EFI_INC_ARCH = tools/gnu-efi/inc/x86_64

EFI_CFLAGS = -ffreestanding -fshort-wchar -mno-red-zone -Wall -Wextra
EFI_CFLAGS += -I$(EFI_INC) -I$(EFI_INC_ARCH) -Ikernel/include
EFI_CFLAGS += -target x86_64-pc-win32-coff

EFI_LDFLAGS = /nodefaultlib /subsystem:efi_application /entry:efi_main /base:0x100000

BOOTLOADER_DIR = bootloader/efi

EFI_SRC = \
  $(BOOTLOADER_DIR)/efi_main.c \
  $(BOOTLOADER_DIR)/ayken_boot.c \
  $(BOOTLOADER_DIR)/elf_loader.c \
  $(BOOTLOADER_DIR)/paging.c \
  $(BOOTLOADER_DIR)/efistubs.c

EFI_ASM_SRC = \
  $(BOOTLOADER_DIR)/boot.S \
  $(BOOTLOADER_DIR)/boot_idt.S
EFI_ASM_OBJS = $(EFI_ASM_SRC:.S=.efi.o)

EFI_OBJS = $(EFI_SRC:.c=.efi.o) $(EFI_ASM_OBJS)

# ------------------------------------------------------------
# 3) Top-level hedefler
# ------------------------------------------------------------

all: check-deps guard-context-offsets $(USER_MINIMAL_BIN) $(EMBEDDED_ELF_HEADER) $(KERNEL_ELF) $(BOOT_EFI) $(LEGACY_KERNEL_ELF) $(LEGACY_BOOT_EFI)

kernel: check-deps guard-context-offsets $(USER_MINIMAL_BIN) $(EMBEDDED_ELF_HEADER) $(KERNEL_ELF) $(LEGACY_KERNEL_ELF)
bootloader: check-deps $(BOOT_EFI) $(LEGACY_BOOT_EFI)
user-minimal: $(USER_MINIMAL_BIN)
userspace-runtime:
	@cd $(USERSPACE_RUST_DIR) && cargo build -p bcib-runtime --bin dispatcher
release:
	@$(MAKE) KERNEL_PROFILE=release all
validation:
	@$(MAKE) KERNEL_PROFILE=validation all
validation-strict:
	@$(MAKE) KERNEL_PROFILE=validation VALIDATION_WERROR=1 all


# ------------------------------------------------------------
# 4) Kernel build
# ------------------------------------------------------------

$(PROFILE_STAMP): FORCE
	@mkdir -p $(dir $@)
	@if [ ! -f $(PROFILE_STAMP) ] || [ "$$(cat $(PROFILE_STAMP) 2>/dev/null)" != "$(KERNEL_PROFILE)" ]; then \
		echo "$(KERNEL_PROFILE)" > $(PROFILE_STAMP); \
	fi

$(KERNEL_OBJS): $(PROFILE_STAMP) $(EMBEDDED_ELF_HEADER)

$(KERNEL_ELF): $(KERNEL_OBJS) linker.ld $(PROFILE_STAMP) $(KERNEL_LINK_EXTRA_DEPS)
	@mkdir -p $(dir $@)
	$(KERNEL_LD) -T linker.ld $(KERNEL_LDFLAGS) $(KERNEL_LINK_EXTRA_FLAGS) $(if $(strip $(KERNEL_MAP)),-Map=$(KERNEL_MAP),) -o $@ $(KERNEL_OBJS)

kernel.elf: $(KERNEL_ELF)
	cp -f "$<" "$@"

# Generate NASM ABI include from single C ABI source.
.PHONY: generate-abi
generate-abi: $(ABI_INC)
	@echo "ABI include generated: $(ABI_INC)"

$(ABI_INC): $(ABI_H)
	@mkdir -p $(dir $@)
	@echo "; AUTO-GENERATED. DO NOT EDIT." > $@
	@echo "; Source: $(ABI_H)" >> $@
	@awk '\
		$$1 == "#define" && $$2 == "AYKEN_ABI_VERSION" { \
			val = $$3; gsub(/[uU]/, "", val); \
			printf("%%define AYKEN_ABI_VERSION %s\n", val); \
			next; \
		} \
		$$1 == "#define" && $$2 ~ /^(CTX_|IRQF_)/ { \
			val = $$3; gsub(/[uU]/, "", val); \
			printf("%%define %s %s\n", $$2, val); \
		}' $(ABI_H) >> $@

$(RING0_EXPORT_MAP): $(KERNEL_OBJS) $(RING0_SYMBOL_WHITELIST) scripts/ci/generate_ring0_export_map.py
	@mkdir -p $(dir $@)
	@python3 scripts/ci/generate_ring0_export_map.py \
		--whitelist "$(RING0_SYMBOL_WHITELIST)" \
		--output "$@" \
		--nm "nm" \
		--objects $(KERNEL_OBJS)

$(KERNEL_ASM_SOURCES:.asm=.o): $(ABI_INC)

# C -> .o
kernel/arch/x86_64/gdt_idt.o: KERNEL_CFLAGS := $(KERNEL_CFLAGS_GDT)
%.o: %.c
	$(KERNEL_CC) $(KERNEL_CFLAGS) -c $< -o $@

# asm -> .o (kernel/arch/x86_64/*.asm)
%.o: %.asm
	nasm -f elf64 $(KERNEL_ASMFLAGS) $< -o $@

# S -> .o (kernel/arch/x86_64/*.S) - GNU assembler
%.o: %.S
	$(KERNEL_CC) $(KERNEL_CFLAGS) -c $< -o $@

$(KERNEL_BUILD_FLAGS_STAMP): FORCE
	@mkdir -p $(dir $@)
	@tmp="$@.tmp"; \
	printf '%s\n' \
		'KERNEL_CC=$(KERNEL_CC)' \
		'KERNEL_CFLAGS=$(KERNEL_CFLAGS)' \
		'KERNEL_CFLAGS_GDT=$(KERNEL_CFLAGS_GDT)' \
		'KERNEL_ASMFLAGS=$(KERNEL_ASMFLAGS)' \
		'KERNEL_LDFLAGS=$(KERNEL_LDFLAGS)' \
		'KERNEL_LINK_EXTRA_FLAGS=$(KERNEL_LINK_EXTRA_FLAGS)' \
		'USER_MINIMAL_EFFECTIVE_MODE=$(USER_MINIMAL_EFFECTIVE_MODE)' \
		'AYKEN_VALIDATION=$(AYKEN_VALIDATION)' \
		'AYKEN_CR3_PCID=$(AYKEN_CR3_PCID)' \
		'AYKEN_RING3_FETCH_PROBE=$(AYKEN_RING3_FETCH_PROBE)' \
		'AYKEN_RING3_SECOND_CANONICAL_PROBE=$(AYKEN_RING3_SECOND_CANONICAL_PROBE)' \
		'AYKEN_RING3_FRESH_FRAME_PROBE=$(AYKEN_RING3_FRESH_FRAME_PROBE)' \
		'AYKEN_RING3_IRETQ_DIAG_PROBE=$(AYKEN_RING3_IRETQ_DIAG_PROBE)' \
		'AYKEN_RING3_POST_CR3_TEXT_PROBE=$(AYKEN_RING3_POST_CR3_TEXT_PROBE)' \
		'AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY=$(AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY)' \
		'AYKEN_SHARE_KERNEL_UPPER_HALF=$(AYKEN_SHARE_KERNEL_UPPER_HALF)' \
		'AYKEN_RING3_LOW_FETCH_STUB=$(AYKEN_RING3_LOW_FETCH_STUB)' \
		'AYKEN_RING3_CANONICAL_FETCH_STUB=$(AYKEN_RING3_CANONICAL_FETCH_STUB)' \
		'AYKEN_RING3_SKIP_CR3_PIVOT=$(AYKEN_RING3_SKIP_CR3_PIVOT)' \
		'AYKEN_RING3_SELF_RELOAD_CR3=$(AYKEN_RING3_SELF_RELOAD_CR3)' \
		'AYKEN_RING3_IRETQ_HEAD_PAD=$(AYKEN_RING3_IRETQ_HEAD_PAD)' \
		'AYKEN_RING3_IRETQ_MARKER_PREFIX=$(AYKEN_RING3_IRETQ_MARKER_PREFIX)' \
		'AYKEN_RING3_SPLIT_IRETQ_PAGE=$(AYKEN_RING3_SPLIT_IRETQ_PAGE)' \
		'AYKEN_RING3_SHIFT_CANONICAL_WINDOW=$(AYKEN_RING3_SHIFT_CANONICAL_WINDOW)' \
		'AYKEN_RING3_ALT_STAGEB_SOURCE=$(AYKEN_RING3_ALT_STAGEB_SOURCE)' \
		'AYKEN_RING3_FORCE_KERNEL_CR3=$(AYKEN_RING3_FORCE_KERNEL_CR3)' \
		'AYKEN_RING3_STERILE_ALT_ROOT=$(AYKEN_RING3_STERILE_ALT_ROOT)' \
		'AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT=$(AYKEN_RING3_HIGH_PHYS_STERILE_ALT_ROOT)' \
		'AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_LOWER_HALF)' \
		'AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF=$(AYKEN_RING3_STERILE_GRAFT_FULL_UPPER_HALF)' \
		'AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PML4_SEM)' \
		'AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM=$(AYKEN_RING3_STERILE_GRAFT_LOWER_PDPT_SEM)' \
		'AYKEN_RING3_STERILE_GRAFT_PD2=$(AYKEN_RING3_STERILE_GRAFT_PD2)' \
		'AYKEN_RING3_STERILE_GRAFT_PD3=$(AYKEN_RING3_STERILE_GRAFT_PD3)' \
		'AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY=$(AYKEN_RING3_STERILE_GRAFT_PD3_SEM_ONLY)' \
		'AYKEN_RING3_STERILE_GRAFT_TEXT=$(AYKEN_RING3_STERILE_GRAFT_TEXT)' \
		'AYKEN_RING3_STERILE_GRAFT_CANARY=$(AYKEN_RING3_STERILE_GRAFT_CANARY)' \
		'AYKEN_RING3_STERILE_GRAFT_STACK=$(AYKEN_RING3_STERILE_GRAFT_STACK)' \
		'AYKEN_RING3_STERILE_GRAFT_STACK_TOP=$(AYKEN_RING3_STERILE_GRAFT_STACK_TOP)' \
		'AYKEN_RING3_STERILE_GRAFT_STACK_LOW=$(AYKEN_RING3_STERILE_GRAFT_STACK_LOW)' \
		'AYKEN_RING3_STERILE_GRAFT_MAILBOX=$(AYKEN_RING3_STERILE_GRAFT_MAILBOX)' \
		'AYKEN_RING3_STERILE_GRAFT_INBOX=$(AYKEN_RING3_STERILE_GRAFT_INBOX)' \
		'AYKEN_RING3_STERILE_GRAFT_PAYLOAD=$(AYKEN_RING3_STERILE_GRAFT_PAYLOAD)' \
		'AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PML4_SEM)' \
		'AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PDPT)' \
		'AYKEN_RING3_STERILE_GRAFT_UPPER_PD=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PD)' \
		'AYKEN_RING3_STERILE_GRAFT_UPPER_PT=$(AYKEN_RING3_STERILE_GRAFT_UPPER_PT)' \
		> "$$tmp"; \
	if ! cmp -s "$$tmp" "$@"; then mv -f "$$tmp" "$@"; else rm -f "$$tmp"; fi

$(KERNEL_OBJS): $(KERNEL_BUILD_FLAGS_STAMP)

# Phase 10: User binary build and embedding
$(USER_MINIMAL_MODE_STAMP): FORCE
	@rm -f $(USER_MINIMAL_DIR)/.mode.*
	@printf "%s\n" "$(USER_MINIMAL_EFFECTIVE_MODE)" > "$@"

$(USER_MINIMAL_ELF): $(USER_MINIMAL_SOURCES) $(USER_MINIMAL_MODE_STAMP)
	@echo "[PHASE10] Building minimal user ELF..."
	@$(MAKE) -C $(USER_MINIMAL_DIR) MINIMAL_MODE="$(USER_MINIMAL_EFFECTIVE_MODE)" minimal.elf

$(USER_MINIMAL_BIN): $(USER_MINIMAL_ELF) $(USER_MINIMAL_MODE_STAMP)
	@echo "[PHASE10] Building minimal user binary..."
	@$(MAKE) -C $(USER_MINIMAL_DIR) MINIMAL_MODE="$(USER_MINIMAL_EFFECTIVE_MODE)" user.bin

$(EMBEDDED_ELF_HEADER): $(USER_MINIMAL_ELF) $(EMBED_ELF_TOOL)
	@echo "[PHASE10] Generating embedded ELF header..."
	@python3 $(EMBED_ELF_TOOL) --input $(USER_MINIMAL_ELF) --output $(EMBEDDED_ELF_HEADER)

-include $(KERNEL_DEPS)


# ------------------------------------------------------------
# 5) UEFI Bootloader build (BOOTX64.EFI)
# ------------------------------------------------------------

$(BOOT_EFI): $(EFI_OBJS)
	@mkdir -p $(dir $@)
	$(EFI_LD) $(EFI_LDFLAGS) /out:$@ $(EFI_OBJS)

bootloader/efi/BOOTX64.EFI: $(BOOT_EFI)
	cp -f "$<" "$@"

$(BOOTLOADER_DIR)/%.efi.o: $(BOOTLOADER_DIR)/%.c
	$(EFI_CC) $(EFI_CFLAGS) -c $< -o $@


# ------------------------------------------------------------
# 6) EFI disk image + QEMU
# ------------------------------------------------------------

$(EFI_IMG): $(KERNEL_ELF) $(BOOT_EFI)
	@mkdir -p $(dir $@) "$(AYKEN_LOG_DIR)"
	@if [ "$(OS)" = "Windows_NT" ]; then \
		powershell -ExecutionPolicy Bypass -File tools/build/make_efi_img.ps1; \
	else \
		EFI_IMG="$(EFI_IMG)" BOOT_EFI="$(BOOT_EFI)" KERNEL_ELF="$(KERNEL_ELF)" bash ./tools/build/make_efi_img.sh; \
	fi

EFI.img: $(EFI_IMG)
	cp -f "$<" "$@"

efi-img: $(EFI_IMG) $(LEGACY_KERNEL_ELF) $(LEGACY_BOOT_EFI) $(LEGACY_EFI_IMG)

run: efi-img
	@# CRITICAL: Use clean NVRAM to avoid BootOrder corruption
	mkdir -p "$(AYKEN_LOG_DIR)" "$(dir $(OVMF_VARS_RUN))"
	cp -f $(OVMF_VARS_CLEAN) $(OVMF_VARS_RUN)
	qemu-system-x86_64 \
		-machine q35 \
		-drive if=pflash,format=raw,readonly=on,file=$(OVMF_CODE) \
		-drive if=pflash,format=raw,file=$(OVMF_VARS_RUN) \
		-drive format=raw,file=$(EFI_IMG) \
		-boot order=c \
		-debugcon file:$(AYKEN_LOG_DIR)/debug_run.log \
		-global isa-debugcon.iobase=0xe9 \
		-nographic

run-preempt:
	@# Phase 4.5 deterministic preempt validation runner
	@$(MAKE) KERNEL_PROFILE=validation guard-context-offsets efi-img
	QEMU_TIMEOUT=12 ./run_preempt_test.sh

run-preempt-strict:
	@# Strict marker-mode preempt validation (no AB fallback)
	@$(MAKE) KERNEL_PROFILE=validation guard-context-offsets kernel bootloader
	QEMU_TIMEOUT=12 STRICT_MARKERS=1 FORCE_EFI_REBUILD=1 ./run_preempt_test.sh

clean:
	rm -f $(KERNEL_OBJS) $(KERNEL_DEPS) $(EFI_OBJS) $(ABI_INC) $(RING0_EXPORT_MAP) $(EMBEDDED_ELF_HEADER) $(USER_MINIMAL_DIR)/.mode.* kernel.elf EFI.img bootloader/efi/BOOTX64.EFI
	rm -rf $(AYKEN_BUILD_DIR) $(AYKEN_LOG_DIR)

clean-noimg:
	rm -f $(KERNEL_OBJS) $(KERNEL_DEPS) $(EFI_OBJS) $(ABI_INC) $(RING0_EXPORT_MAP) $(EMBEDDED_ELF_HEADER) $(USER_MINIMAL_DIR)/.mode.* kernel.elf bootloader/efi/BOOTX64.EFI
	rm -f $(KERNEL_ELF) $(BOOT_EFI) $(PROFILE_STAMP)

.PHONY: all clean run run-preempt run-preempt-strict efi-img kernel bootloader guard-context-offsets release validation validation-strict FORCE
FORCE:

# Enforce context ABI discipline: raw numeric offsets are forbidden in context_switch.asm.
guard-context-offsets:
	@echo "Checking context offset discipline..."
	@if grep -nE '^[[:space:]]*[^;].*\[(rdi|rsi)[^]]*\+[[:space:]]*[0-9]+' $(CTX_SWITCH_ASM) >/dev/null; then \
		echo "ERROR: Raw numeric context offsets found in $(CTX_SWITCH_ASM). Use CTX_* constants only."; \
		grep -nE '^[[:space:]]*[^;].*\[(rdi|rsi)[^]]*\+[[:space:]]*[0-9]+' $(CTX_SWITCH_ASM); \
		exit 1; \
	fi
	@if grep -nE '^[[:space:]]*[^;].*\[(rdi|rsi)[^]]*\+[[:space:]]*CTX_[^]]*[[:space:]]*[\+\-\*]' $(CTX_SWITCH_ASM) >/dev/null; then \
		echo "ERROR: Context offsets must be exact [rdi|rsi + CTX_*] (no arithmetic on CTX_*)."; \
		grep -nE '^[[:space:]]*[^;].*\[(rdi|rsi)[^]]*\+[[:space:]]*CTX_[^]]*[[:space:]]*[\+\-\*]' $(CTX_SWITCH_ASM); \
		exit 1; \
	fi
	@if awk '\
		/^[[:space:]]*;/ { next } \
		{ \
			line = $$0; \
			while (match(line, /\[(rdi|rsi)[^]]*\+[[:space:]]*[A-Za-z_][A-Za-z0-9_]*/)) { \
				expr = substr(line, RSTART, RLENGTH); \
				token = expr; \
				sub(/^.*\+[[:space:]]*/, "", token); \
				if (token !~ /^CTX_[A-Za-z0-9_]*$$/) { \
					print NR ":" $$0; \
					bad = 1; \
					break; \
				} \
				line = substr(line, RSTART + RLENGTH); \
			} \
		} \
		END { exit bad }' $(CTX_SWITCH_ASM); then :; else \
		echo "ERROR: Non-CTX_* context offset alias used in $(CTX_SWITCH_ASM)."; \
		exit 1; \
	fi
	@echo "Context offset guard: PASS"

# ------------------------------------------------------------
# 7) Validation and dependency checking targets
# ------------------------------------------------------------

# Check for required tools before building
check-deps:
	@echo "Checking build dependencies..."
	@missing_tools=""; \
	if ! command -v $(KERNEL_CC_BIN) >/dev/null 2>&1; then \
		missing_tools="$$missing_tools $(KERNEL_CC_BIN)"; \
	fi; \
	if ! command -v $(KERNEL_LD_BIN) >/dev/null 2>&1; then \
		missing_tools="$$missing_tools $(KERNEL_LD_BIN)"; \
	fi; \
	if ! command -v $(EFI_CC_BIN) >/dev/null 2>&1; then \
		missing_tools="$$missing_tools $(EFI_CC_BIN)"; \
	fi; \
	if ! command -v $(EFI_LD_BIN) >/dev/null 2>&1; then \
		missing_tools="$$missing_tools $(EFI_LD_BIN)"; \
	fi; \
	if ! command -v nasm >/dev/null 2>&1; then \
		missing_tools="$$missing_tools nasm"; \
	fi; \
	if ! command -v nm >/dev/null 2>&1; then \
		missing_tools="$$missing_tools nm"; \
	fi; \
	if ! command -v python3 >/dev/null 2>&1; then \
		missing_tools="$$missing_tools python3"; \
	fi; \
	if [ -n "$$missing_tools" ]; then \
		echo "ERROR: Missing required tools:$$missing_tools"; \
		echo "Run 'make setup' or 'make install-deps' to install dependencies"; \
		exit 1; \
	else \
		echo "All required build tools found"; \
	fi

# Install dependencies automatically
install-deps:
	@echo "Installing build dependencies..."
	@if command -v powershell >/dev/null 2>&1; then \
		echo "Using PowerShell for Windows dependency installation..."; \
		powershell -ExecutionPolicy Bypass -File tools/setup/setup_and_validate.ps1; \
	elif command -v apt >/dev/null 2>&1; then \
		echo "Using apt package manager..."; \
		sudo apt update && sudo apt install -y gcc-multilib nasm clang lld make qemu-system-x86; \
	elif command -v yum >/dev/null 2>&1; then \
		echo "Using yum package manager..."; \
		sudo yum install -y gcc nasm clang lld make qemu-system-x86; \
	elif command -v pacman >/dev/null 2>&1; then \
		echo "Using pacman package manager..."; \
		sudo pacman -S --noconfirm gcc nasm clang lld make qemu; \
	else \
		echo "No supported package manager found."; \
		echo "Please install dependencies manually or use WSL2 with Ubuntu."; \
		echo "See docs/development/BUILD_FIXES_COMPLETE.md for detailed instructions."; \
		exit 1; \
	fi

# Comprehensive validation
validate: validate-toolchain validate-build validate-qemu

validate-toolchain:
	@echo "Running toolchain validation..."
	@if command -v powershell >/dev/null 2>&1; then \
		powershell -ExecutionPolicy Bypass -File tools/validation/validate_toolchain.ps1; \
	else \
		./tools/validation/validate_toolchain.sh --skip-qemu; \
	fi

validate-build: check-deps
	@echo "Validating build system..."
	@echo "Testing clean build process..."
	@$(MAKE) clean >/dev/null 2>&1 || true
	@if $(MAKE) all >/dev/null 2>&1; then \
		echo "Build validation: PASS"; \
		if [ -f "$(KERNEL_ELF)" ] && [ -f "$(BOOT_EFI)" ]; then \
			echo "Build artifacts validation: PASS"; \
		else \
			echo "Build artifacts validation: FAIL - Missing output files"; \
			exit 1; \
		fi; \
	else \
		echo "Build validation: FAIL"; \
		exit 1; \
	fi

validate-qemu: efi-img
	@echo "Running QEMU validation..."
	@if ! command -v qemu-system-x86_64 >/dev/null 2>&1; then \
		echo "QEMU not found - skipping boot validation"; \
		echo "Install QEMU with: make install-deps"; \
	else \
		if command -v powershell >/dev/null 2>&1; then \
			powershell -ExecutionPolicy Bypass -File tools/qemu/qemu_test_runner.ps1; \
		else \
			./tools/qemu/qemu_test_runner.sh; \
		fi; \
	fi

# QEMU environment validation (Task 1.5.1.3)
validate-qemu-env:
	@echo "Running QEMU environment validation..."
	@if command -v powershell >/dev/null 2>&1; then \
		powershell -ExecutionPolicy Bypass -File tools/qemu/qemu_environment_validator.ps1; \
	else \
		bash tools/qemu/qemu_environment_validator.sh; \
	fi

# Comprehensive QEMU integration tests
validate-qemu-integration:
	@echo "Running QEMU integration tests..."
	@if command -v powershell >/dev/null 2>&1; then \
		powershell -ExecutionPolicy Bypass -File tools/qemu/qemu_integration_tests.ps1; \
	else \
		bash tools/qemu/qemu_integration_tests.sh; \
	fi

validate-full: clean validate-build validate-qemu
	@echo "Full validation completed successfully!"
	@echo "System is ready for development!"

# Development environment setup
setup:
	@echo "Setting up AykenOS development environment..."
	@if command -v powershell >/dev/null 2>&1; then \
		powershell -ExecutionPolicy Bypass -File tools/setup/setup_and_validate.ps1; \
	else \
		./tools/setup/setup_and_validate.sh; \
	fi

# Quick development workflow
dev: clean all validate-qemu
	@echo "Development build and test completed!"

# Continuous integration target (currently enforced gates)
ci: check-deps ci-gate-boundary ci-gate-hygiene validate-full
	@echo "CI validation completed successfully!"

# ================================================
# Pre-CI Discipline (Local Advisory Layer)
# ================================================
# Local fail-closed discipline check before CI.
# Does NOT replace CI. CI remains mandatory.
#
# Gates: 4 core discipline gates (~30-60s)
#   - ABI Stability
#   - Boundary Enforcement
#   - Hygiene
#   - Constitutional Compliance
#
# Runtime gates (Ring0 Exports, Workspace, Syscall v2, Sched Bridge,
# Policy Accept) run in CI only.

.PHONY: pre-ci
pre-ci:
	@bash scripts/ci/pre_ci_discipline.sh

# ================================================
# Freeze Suite (Constitutional Enforcement)
# ================================================
# Freeze suite target (strict): calls all declared freeze gates.
ci-freeze-guard:
	@if [ "$(AYKEN_SCHED_FALLBACK)" != "0" ]; then \
		echo "ERROR: ci-freeze requires AYKEN_SCHED_FALLBACK=0 (current=$(AYKEN_SCHED_FALLBACK))"; \
		exit 2; \
	fi
	@if [ "$(PHASE10C_ENFORCE)" != "1" ]; then \
		echo "ERROR: freeze targets require PHASE10C_ENFORCE=1 (current=$(PHASE10C_ENFORCE))"; \
		exit 2; \
	fi
	@if [ "$(AYKEN_CR3_PCID)" != "0" ]; then \
		echo "ERROR: ci-freeze requires AYKEN_CR3_PCID=0 (current=$(AYKEN_CR3_PCID))"; \
		exit 2; \
	fi
	@if [ "$(PHASE10C_ENFORCE)" = "1" ] && [ "$(AYKEN_SCHED_BOOTSTRAP_POLICY)" != "0" ]; then \
		echo "ERROR: ci-freeze with PHASE10C_ENFORCE=1 requires AYKEN_SCHED_BOOTSTRAP_POLICY=0 (current=$(AYKEN_SCHED_BOOTSTRAP_POLICY))"; \
		exit 2; \
	fi

preflight-mode-guard:
	@if [ -n "$${USER_MINIMAL_MODE+x}" ]; then \
		mode_val="$${USER_MINIMAL_MODE}"; \
		if [ -z "$$mode_val" ]; then mode_val="<empty>"; fi; \
		echo "ERROR: freeze chain forbids globally exported USER_MINIMAL_MODE (current=$$mode_val)."; \
		echo "ERROR: mode must be set only at gate call sites."; \
		exit 2; \
	fi

# Phase-13 kill-switch gate suite
# Enforces distributed verification boundaries, proof integrity,
# observability isolation, and reputation prohibition.
# These gates are CI cluster workloads - not run in pre-ci discipline.
ci-kill-switch-phase13: \
	ci-gate-proof-receipt \
	ci-gate-proof-verdict-binding \
	ci-gate-verifier-authority-resolution \
	ci-gate-cross-node-parity \
	ci-gate-proofd-service \
	ci-gate-proofd-schema-coverage \
	ci-gate-proofd-observability-boundary \
	ci-gate-graph-non-authoritative-contract \
	ci-gate-convergence-non-election-boundary \
	ci-gate-diagnostics-consumer-non-authoritative-contract \
	ci-gate-diagnostics-callsite-correlation \
	ci-gate-observability-routing-separation \
	ci-gate-verifier-reputation-prohibition
	@$(MAKE) ci-kill-switch-summary RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "Phase-13 kill-switch gates: ALL PASS"

# Phase-13 official closure prep
# Generates closure manifest + evidence index from a ci-kill-switch-phase13 run.
# Usage: make phase13-official-closure-prep RUN_ID=<run-id>
PHASE13_CLOSURE_RUN_DIR ?= $(EVIDENCE_RUN_DIR)
PHASE13_CLOSURE_OUTPUT_DIR ?= reports/phase13_official_closure_candidate

.PHONY: phase13-official-closure-prep
phase13-official-closure-prep:
	@echo "== PHASE-13 OFFICIAL CLOSURE PREP =="
	@echo "run_dir: $(PHASE13_CLOSURE_RUN_DIR)"
	@echo "output_dir: $(PHASE13_CLOSURE_OUTPUT_DIR)"
	@python3 tools/ci/generate_phase13_closure_bundle.py \
		--run-dir "$(PHASE13_CLOSURE_RUN_DIR)" \
		--output-dir "$(PHASE13_CLOSURE_OUTPUT_DIR)" \
		--current-phase-pointer 13
	@echo "OK: closure candidate at $(PHASE13_CLOSURE_OUTPUT_DIR)"

ci-freeze: PHASE10C_C2_STRICT=1
ci-freeze: ci-freeze-guard preflight-mode-guard ci-gate-abi ci-gate-boundary ci-gate-ring0-exports ci-gate-hygiene ci-gate-tooling-isolation ci-gate-constitutional ci-gate-governance-policy ci-gate-naming-convention ci-gate-drift-activation ci-gate-structural-abi ci-gate-runtime-marker-contract ci-gate-user-bin-lock ci-gate-embedded-elf-hash ci-gate-performance ci-gate-ring3-user-leaf-rule ci-gate-ring3-execution-phase10a2 ci-gate-syscall-semantics-phase10b ci-gate-low-half-kheap-scaffold $(PHASE10C_FREEZE_GATE) ci-gate-mailbox-capability-negative ci-gate-workspace ci-gate-syscall-v2-runtime ci-gate-sched-bridge-runtime ci-gate-behavioral-suite ci-gate-policy-accept ci-gate-alias-proof ci-kill-switch-phase13 ci-gate-determinism-replay-consistency ci-gate-bcib-v3-core ci-gate-toolchain-opcode-registry ci-gate-capability-manager ci-gate-proofd-observability-boundary ci-gate-dsl-bcib-contract ci-gate-semantic-cli-contract ci-gate-data-runtime-bcib ci-gate-ai-runtime-boundary
ci-freeze: ci-freeze-guard preflight-mode-guard ci-gate-abi ci-gate-boundary ci-gate-ring0-exports ci-gate-hygiene ci-gate-tooling-isolation ci-gate-constitutional ci-gate-governance-policy ci-gate-naming-convention ci-gate-drift-activation ci-gate-structural-abi ci-gate-runtime-marker-contract ci-gate-user-bin-lock ci-gate-embedded-elf-hash ci-gate-performance ci-gate-ring3-user-leaf-rule ci-gate-ring3-execution-phase10a2 ci-gate-syscall-semantics-phase10b ci-gate-low-half-kheap-scaffold $(PHASE10C_FREEZE_GATE) ci-gate-mailbox-capability-negative ci-gate-workspace ci-gate-syscall-v2-runtime ci-gate-sched-bridge-runtime ci-gate-behavioral-suite ci-gate-policy-accept ci-gate-alias-proof ci-kill-switch-phase13 ci-gate-determinism-replay-consistency ci-gate-bcib-v3-core ci-gate-toolchain-opcode-registry ci-gate-capability-manager ci-gate-proofd-observability-boundary ci-gate-dsl-bcib-contract ci-gate-semantic-cli-contract ci-gate-data-runtime-bcib ci-gate-ai-runtime-boundary
	@echo "Freeze CI suite completed successfully!"

# Local freeze (local performance authority; skip tooling-isolation/alias-proof/kill-switch)
ci-freeze-local: PHASE10C_C2_STRICT=0
ci-freeze-local: ci-freeze-guard preflight-mode-guard ci-gate-abi ci-gate-boundary ci-gate-ring0-exports ci-gate-hygiene ci-gate-constitutional ci-gate-governance-policy ci-gate-naming-convention ci-gate-drift-activation ci-gate-structural-abi ci-gate-runtime-marker-contract ci-gate-user-bin-lock ci-gate-embedded-elf-hash ci-gate-performance-local ci-gate-performance-stability ci-gate-ring3-user-leaf-rule ci-gate-ring3-execution-phase10a2 ci-gate-syscall-semantics-phase10b ci-gate-low-half-kheap-scaffold ci-gate-scheduler-mailbox-phase10c ci-gate-mailbox-capability-negative ci-gate-workspace ci-gate-syscall-v2-runtime ci-gate-sched-bridge-runtime ci-gate-behavioral-suite ci-gate-policy-accept ci-gate-determinism-replay-consistency
	@echo "Local freeze suite completed successfully (local performance authority active; tooling-isolation/alias-proof/kill-switch skipped)!"

# CI boundary gate with evidence collection
ci-evidence-dir:
	@mkdir -p "$(EVIDENCE_RUN_DIR)/meta"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/input"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/execution"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/artifacts"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/reports"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/abi"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/symbol-scan"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ring0-exports"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/hygiene"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/constitutional"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/governance-policy"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/naming-convention"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/drift-activation"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/structural-abi"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/runtime-marker-contract"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/test-naming"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/error-codes"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/kernel-test-pipeline"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/user-bin-lock"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/embedded-elf-hash"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/behavioral-suite"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/scheduler-mailbox-phase10c"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/mailbox-cap"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ledger-v1"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ledger-integrity"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/deol-sequence"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/eti"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ledger-eti-binding"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/transcript-integrity"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/dlt-monotonicity"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/eti-dlt-binding"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/dlt-determinism"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/gcp-finalization"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/abdf-snapshot-identity"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/execution-identity"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/replay-v1"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/kpl-proof"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/proof-bundle"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/workspace"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/syscall-v2-runtime"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/policy-accept"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/decision-switch-phase45"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/performance"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/logs"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/reports"
	@printf '{\n  "run_id": "%s",\n  "time_utc": "%s"\n}\n' \
		"$(RUN_ID)" "$$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > "$(EVIDENCE_RUN_DIR)/meta/run.json"
	@git rev-parse HEAD > "$(EVIDENCE_RUN_DIR)/meta/git.txt" 2>/dev/null || true
	@{ \
		echo "clang: $$(clang --version 2>/dev/null | head -n1 || echo NA)"; \
		echo "ld.lld: $$(ld.lld --version 2>/dev/null | head -n1 || echo NA)"; \
		echo "nasm: $$(nasm -v 2>/dev/null || echo NA)"; \
	} > "$(EVIDENCE_RUN_DIR)/meta/toolchain.txt"

ci-gate-boundary: ci-evidence-dir
	@echo "== CI GATE BOUNDARY =="
	@echo "run_id: $(RUN_ID)"
	@echo "targets: $(CI_TARGETS)"
	@if [ "$(PRE_CI_MODE)" = "1" ] && [ -f "$(KERNEL_ELF)" ]; then \
		echo "pre_ci_mode: SKIP rebuild (existing artifact: $(KERNEL_ELF))"; \
		mkdir -p "$(EVIDENCE_RUN_DIR)/logs"; \
		echo "PRE_CI_MODE=1: skipped kernel rebuild, using existing artifact" > "$(EVIDENCE_RUN_DIR)/logs/build.log"; \
	elif echo "$(MAKEFLAGS)" | grep -Eq '(^|[[:space:]])n($$|[[:space:]])|--just-print|--dry-run|--recon'; then \
		echo "DRY-RUN: skipping boundary kernel build invocation"; \
	else \
		rm -f "$(KERNEL_ELF)" "$(EVIDENCE_RUN_DIR)/artifacts/kernel.map"; \
		mkdir -p "$(EVIDENCE_RUN_DIR)/logs"; \
		$(MAKE) KERNEL_PROFILE=validation KERNEL_MAP="$(EVIDENCE_RUN_DIR)/artifacts/kernel.map" guard-context-offsets kernel > "$(EVIDENCE_RUN_DIR)/logs/build.log" 2>&1; \
	fi
	@printf '{\n  "run_id": "%s",\n  "time_utc": "%s"\n}\n' \
		"$(RUN_ID)" "$$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > "$(EVIDENCE_RUN_DIR)/meta/run.json"
	@git rev-parse HEAD > "$(EVIDENCE_RUN_DIR)/meta/git.txt" 2>/dev/null || true
	@{ \
		echo "clang: $$(clang --version 2>/dev/null | head -n1 || echo NA)"; \
		echo "ld.lld: $$(ld.lld --version 2>/dev/null | head -n1 || echo NA)"; \
		echo "nasm: $$(nasm -v 2>/dev/null || echo NA)"; \
	} > "$(EVIDENCE_RUN_DIR)/meta/toolchain.txt"
	@for target in $(CI_TARGETS); do \
		if [ -f "$$target" ]; then \
			base="$$(basename "$$target")"; \
			cp -f "$$target" "$(EVIDENCE_RUN_DIR)/artifacts/$$base"; \
			if command -v sha256sum >/dev/null 2>&1; then \
				sha256sum "$(EVIDENCE_RUN_DIR)/artifacts/$$base" | awk '{print $$1}' > "$(EVIDENCE_RUN_DIR)/artifacts/$$base.sha256"; \
			elif command -v shasum >/dev/null 2>&1; then \
				shasum -a 256 "$(EVIDENCE_RUN_DIR)/artifacts/$$base" | awk '{print $$1}' > "$(EVIDENCE_RUN_DIR)/artifacts/$$base.sha256"; \
			fi; \
		fi; \
	done
	@./tools/ci/symbol-scan.sh \
		--targets "$(CI_TARGETS)" \
		--deny tools/ci/deny.symbols \
		--allow tools/ci/allow.symbols \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/symbol-scan"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/symbol-scan/report.json" "$(EVIDENCE_RUN_DIR)/reports/symbol-scan.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ring0-exports: ci-evidence-dir
	@echo "== CI GATE RING0 EXPORTS =="
	@echo "run_id: $(RUN_ID)"
	@echo "ring0_export_max: $(RING0_EXPORT_MAX)"
	@./scripts/ci/check_ring0_exports.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ring0-exports" \
		--kernel-profile "validation" \
		--max-exports "$(RING0_EXPORT_MAX)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ring0-exports/report.json" "$(EVIDENCE_RUN_DIR)/reports/ring0-exports.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ring0-exports evidence at $(EVIDENCE_RUN_DIR)"

# Standalone summary verdict gate for existing run directory.
ci-summarize:
	@./tools/ci/summarize.sh --run-dir "$(EVIDENCE_RUN_DIR)"
	@python3 -c 'import json,sys; p=sys.argv[1]; v=json.load(open(p, encoding="utf-8")).get("verdict"); acceptable=("PASS","SKIP","WARN"); print(f"ERROR: summary verdict is {v} ({p})") if v not in acceptable else None; sys.exit(0 if v in acceptable else 2)' "$(EVIDENCE_RUN_DIR)/reports/summary.json"

ci-kill-switch-summary:
	@./tools/ci/summarize.sh --run-dir "$(EVIDENCE_RUN_DIR)" --require-kill-switch-completeness --show-kill-switch-summary
	@python3 -c 'import json,sys; p=sys.argv[1]; payload=json.load(open(p, encoding="utf-8")); ok=payload.get("coverage", {}).get("coverage_status") == "COMPLETE"; print(f"ERROR: kill-switch coverage incomplete ({p})") if not ok else None; sys.exit(0 if ok else 2)' "$(EVIDENCE_RUN_DIR)/reports/kill_switch_summary.json"

# ABI gate (implemented): deterministic generation + baseline lock compare.
ci-gate-abi: ci-evidence-dir
	@echo "== CI GATE ABI =="
	@echo "run_id: $(RUN_ID)"
	@echo "abi_diff_range: $(if $(strip $(ABI_DIFF_RANGE)),$(ABI_DIFF_RANGE),auto)"
	@if [ "$(ABI_INIT_BASELINE)" = "1" ]; then \
		ABI_DIFF_RANGE="$(ABI_DIFF_RANGE)" ./scripts/ci/gate_abi.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/abi" --init-baseline; \
	else \
		ABI_DIFF_RANGE="$(ABI_DIFF_RANGE)" ./scripts/ci/gate_abi.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/abi"; \
	fi
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/abi/report.json" "$(EVIDENCE_RUN_DIR)/reports/abi.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ABI evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-workspace: ci-evidence-dir
	@echo "== CI GATE WORKSPACE =="
	@echo "run_id: $(RUN_ID)"
	@./scripts/ci/gate_workspace.sh $(WORKSPACE_STRICT_FLAG) --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/workspace"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/workspace/report.json" "$(EVIDENCE_RUN_DIR)/reports/workspace.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: workspace evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-hygiene: ci-evidence-dir
	@echo "== CI GATE HYGIENE =="
	@echo "run_id: $(RUN_ID)"
	@./scripts/ci/gate_hygiene_simple.sh "$(EVIDENCE_RUN_DIR)/gates/hygiene"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/hygiene/report.json" "$(EVIDENCE_RUN_DIR)/reports/hygiene.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: hygiene evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-tooling-isolation: ci-evidence-dir
	@echo "== CI GATE TOOLING ISOLATION =="
	@echo "run_id: $(RUN_ID)"
ifeq ($(PERF_BASELINE_MODE),provisional)
	@echo "tooling-isolation: SKIPPED (provisional mode - mixed tooling/kernel changes allowed)"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation"
	@echo '{"gate":"tooling-isolation","verdict":"SKIP","reason":"provisional mode","violations_count":0}' > "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation/report.json" "$(EVIDENCE_RUN_DIR)/reports/tooling-isolation.json"
else
	@./scripts/ci/gate_tooling_isolation.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/tooling-isolation/report.json" "$(EVIDENCE_RUN_DIR)/reports/tooling-isolation.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: tooling-isolation evidence at $(EVIDENCE_RUN_DIR)"
endif

ci-gate-constitutional: ci-evidence-dir
	@echo "== CI GATE CONSTITUTIONAL =="
	@echo "run_id: $(RUN_ID)"
	@echo "ayken_sched_fallback: $(AYKEN_SCHED_FALLBACK)"
	@AYKEN_SCHED_FALLBACK="$(AYKEN_SCHED_FALLBACK)" ./scripts/ci/gate_constitutional.sh $(CONSTITUTIONAL_STRICT_FLAG) --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/constitutional"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/constitutional/report.json" "$(EVIDENCE_RUN_DIR)/reports/constitutional.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: constitutional evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-governance-policy: ci-evidence-dir
	@echo "== CI GATE GOVERNANCE POLICY =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: $(GOVERNANCE_POLICY_KERNEL_PROFILE)"
	@KERNEL_PROFILE="$(GOVERNANCE_POLICY_KERNEL_PROFILE)" ./scripts/ci/gate_governance_policy.sh --kernel-profile "$(GOVERNANCE_POLICY_KERNEL_PROFILE)" --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/governance-policy"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/governance-policy/report.json" "$(EVIDENCE_RUN_DIR)/reports/governance-policy.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: governance-policy evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-naming-convention: ci-evidence-dir
	@echo "== CI GATE NAMING CONVENTION =="
	@echo "run_id: $(RUN_ID)"
	@echo "naming_diff_range: $(if $(strip $(NAMING_DIFF_RANGE)),$(NAMING_DIFF_RANGE),auto)"
	@NAMING_DIFF_RANGE="$(NAMING_DIFF_RANGE)" ./scripts/ci/check_naming_convention.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/naming-convention"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/naming-convention/report.json" "$(EVIDENCE_RUN_DIR)/reports/naming-convention.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: naming-convention evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-test-naming: ci-evidence-dir
	@echo "== CI GATE TEST NAMING =="
	@echo "run_id: $(RUN_ID)"
	@python3 tools/ci/validate_test_naming.py --root "$(CURDIR)" --out "$(EVIDENCE_RUN_DIR)/gates/test-naming/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/test-naming/report.json" "$(EVIDENCE_RUN_DIR)/reports/test-naming.json"
	@echo "OK: test-naming evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-error-codes: ci-evidence-dir
	@echo "== CI GATE ERROR CODES =="
	@echo "run_id: $(RUN_ID)"
	@python3 tools/ci/validate_error_codes.py --root "$(CURDIR)" --error-db "docs/governance/error_codes.json" --out "$(EVIDENCE_RUN_DIR)/gates/error-codes/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/error-codes/report.json" "$(EVIDENCE_RUN_DIR)/reports/error-codes.json"
	@echo "OK: error-codes evidence at $(EVIDENCE_RUN_DIR)"

KERNEL_TEST_SCENARIO ?= tests/kernel/scenarios/ring3/AYK_SCN_KRN_RING3_FIRST_FETCH_BASE.json

ci-gate-kernel-test-pipeline: ci-evidence-dir
	@echo "== CI GATE KERNEL TEST PIPELINE =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_test_scenario: $(KERNEL_TEST_SCENARIO)"
	@python3 tools/test_runner/pipeline.py --scenario "$(KERNEL_TEST_SCENARIO)" --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/kernel-test-pipeline" --out "$(EVIDENCE_RUN_DIR)/gates/kernel-test-pipeline/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/kernel-test-pipeline/report.json" "$(EVIDENCE_RUN_DIR)/reports/kernel-test-pipeline.json"
	@echo "OK: kernel-test-pipeline evidence at $(EVIDENCE_RUN_DIR)"

ci-kernel-tests: ci-gate-test-naming ci-gate-error-codes ci-gate-kernel-test-pipeline
	@echo "Kernel external test stack completed successfully!"

ci-gate-drift-activation: ci-evidence-dir
	@echo "== CI GATE DRIFT ACTIVATION =="
	@echo "run_id: $(RUN_ID)"
	@./scripts/ci/gate_drift_activation.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/drift-activation"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/drift-activation/report.json" "$(EVIDENCE_RUN_DIR)/reports/drift-activation.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: drift-activation evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-structural-abi: ci-evidence-dir
	@echo "== CI GATE STRUCTURAL ABI =="
	@echo "run_id: $(RUN_ID)"
	@echo "abi_diff_range: $(if $(strip $(ABI_DIFF_RANGE)),$(ABI_DIFF_RANGE),auto)"
	@ABI_DIFF_RANGE="$(ABI_DIFF_RANGE)" ./scripts/ci/gate_structural_abi.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/structural-abi"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/structural-abi/report.json" "$(EVIDENCE_RUN_DIR)/reports/structural-abi.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: structural ABI evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-runtime-marker-contract: ci-evidence-dir
	@echo "== CI GATE RUNTIME MARKER CONTRACT =="
	@echo "run_id: $(RUN_ID)"
	@echo "enforced: $(RUNTIME_MARKER_CONTRACT_ENFORCE)"
	@echo "abi_diff_range: $(if $(strip $(ABI_DIFF_RANGE)),$(ABI_DIFF_RANGE),auto)"
	@RUNTIME_MARKER_CONTRACT_ENFORCE="$(RUNTIME_MARKER_CONTRACT_ENFORCE)" ABI_DIFF_RANGE="$(ABI_DIFF_RANGE)" ./scripts/ci/gate_runtime_marker_contract.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/runtime-marker-contract"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/runtime-marker-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/runtime-marker-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: runtime marker contract evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-user-bin-lock: ci-evidence-dir $(USER_MINIMAL_BIN)
	@echo "== CI GATE USER.BIN LOCK =="
	@echo "run_id: $(RUN_ID)"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/user-bin-lock"
	@set -e; \
		gate_dir="$(abspath $(EVIDENCE_RUN_DIR))/gates/user-bin-lock"; \
		cd "$(USER_MINIMAL_DIR)"; \
		if command -v sha256sum >/dev/null 2>&1; then \
			sha256sum user.bin > "$$gate_dir/user.bin.sha256.current"; \
		else \
			shasum -a 256 user.bin > "$$gate_dir/user.bin.sha256.current"; \
		fi; \
		if [ ! -f user.bin.sha256 ]; then \
			printf '%s\n' '{"gate":"user-bin-lock","verdict":"FAIL","violations_count":1,"violations":["missing_lock_file"]}' > "$$gate_dir/report.json"; \
			rm -f "$$gate_dir/user.bin.sha256.current"; \
			echo "ERROR: missing lock file userspace/minimal/user.bin.sha256"; \
			exit 2; \
		fi; \
		if ! diff -u user.bin.sha256 "$$gate_dir/user.bin.sha256.current" > "$$gate_dir/lock.diff" 2>&1; then \
			printf '%s\n' '{"gate":"user-bin-lock","verdict":"FAIL","violations_count":1,"violations":["user_bin_hash_drift"]}' > "$$gate_dir/report.json"; \
			rm -f "$$gate_dir/user.bin.sha256.current"; \
			echo "ERROR: user.bin hash drift (lock mismatch)"; \
			exit 2; \
		fi; \
		rm -f "$$gate_dir/user.bin.sha256.current" "$$gate_dir/lock.diff"; \
		printf '%s\n' '{"gate":"user-bin-lock","verdict":"PASS","violations_count":0,"violations":[]}' > "$$gate_dir/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/user-bin-lock/report.json" "$(EVIDENCE_RUN_DIR)/reports/user-bin-lock.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: user-bin-lock evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-embedded-elf-hash: ci-evidence-dir
	@echo "== CI GATE EMBEDDED ELF HASH =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 ./scripts/ci/gate_embedded_elf_hash.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/embedded-elf-hash" \
		--kernel-profile "validation" \
		--user-minimal-mode "phase10a2"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/embedded-elf-hash/report.json" "$(EVIDENCE_RUN_DIR)/reports/embedded-elf-hash.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: embedded-elf-hash evidence at $(EVIDENCE_RUN_DIR)"

# Backward-compatible composite alias.
ci-gate-structural-constitution: ci-gate-structural-abi ci-gate-runtime-marker-contract
	@echo "OK: structural constitution composite gate passed"

ci-gate-syscall-v2-runtime: ci-evidence-dir
	@echo "== CI GATE SYSCALL V2 RUNTIME =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: $(SYSCALL_V2_RUNTIME_KERNEL_PROFILE)"
	@echo "user_minimal_mode: syscall-v2-runtime (enforced)"
	@echo "ayken_ring3_mask_irq0_first_entry: 1 (enforced)"
	@echo "warmup_runs: $(SYSCALL_V2_RUNTIME_WARMUP)"
	@echo "measurement_runs: $(SYSCALL_V2_RUNTIME_RUNS)"
	@echo "timeout_seconds: $(SYSCALL_V2_RUNTIME_TIMEOUT)"
	@echo "required_success_rate: $(SYSCALL_V2_RUNTIME_REQUIRED_SUCCESS_RATE)"
	@USER_MINIMAL_MODE=syscall-v2-runtime AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY=1 ./scripts/ci/gate_syscall_v2_runtime.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/syscall-v2-runtime" \
		--kernel-profile "$(SYSCALL_V2_RUNTIME_KERNEL_PROFILE)" \
		--warmup-runs "$(SYSCALL_V2_RUNTIME_WARMUP)" \
		--measurement-runs "$(SYSCALL_V2_RUNTIME_RUNS)" \
		--timeout-seconds "$(SYSCALL_V2_RUNTIME_TIMEOUT)" \
		--required-success-rate "$(SYSCALL_V2_RUNTIME_REQUIRED_SUCCESS_RATE)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/syscall-v2-runtime/report.json" "$(EVIDENCE_RUN_DIR)/reports/syscall-v2-runtime.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: syscall-v2-runtime evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-sched-bridge-runtime: ci-evidence-dir
	@echo "== CI GATE SCHED BRIDGE RUNTIME =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@echo "ayken_mb_selftest: 1 (enforced)"
	@echo "ayken_sched_bootstrap_policy: $(AYKEN_SCHED_BOOTSTRAP_POLICY)"
	@echo "runtime_marker_contract_enforce: $(RUNTIME_MARKER_CONTRACT_ENFORCE)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_MB_SELFTEST=1 AYKEN_SCHED_BOOTSTRAP_POLICY="$(AYKEN_SCHED_BOOTSTRAP_POLICY)" RUNTIME_MARKER_CONTRACT_ENFORCE="$(RUNTIME_MARKER_CONTRACT_ENFORCE)" bash scripts/ci/gate_sched_bridge_runtime.sh
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: sched-bridge-runtime evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-behavioral-suite: ci-evidence-dir
	@echo "== CI GATE BEHAVIORAL SUITE =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "behavioral_suite_phase: $(BEHAVIORAL_SUITE_PHASE)"
	@RUN_ID=$(RUN_ID) KERNEL_PROFILE=validation BEHAVIORAL_SUITE_PHASE="$(BEHAVIORAL_SUITE_PHASE)" bash scripts/ci/gate_behavioral_suite.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/behavioral-suite" --phase "$(BEHAVIORAL_SUITE_PHASE)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/behavioral-suite/report.json" "$(EVIDENCE_RUN_DIR)/reports/behavioral-suite.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: behavioral-suite evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ring3-execution-phase10a2: ci-evidence-dir
	@echo "== CI GATE RING3 EXECUTION PHASE10-A2 =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@echo "ayken_cr3_pcid: 0 (enforced)"
	@echo "ayken_ring3_mask_irq0_first_entry: 1 (enforced)"
	@echo "qemu_timeout_seconds: $(RING3_QEMU_TIMEOUT)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_C2_STRICT_MARKERS="$(PHASE10C_C2_STRICT)" AYKEN_MB_SELFTEST="$(if $(filter 1,$(PHASE10C_C2_STRICT)),0,1)" AYKEN_GATE4_POLICY_TEST=0 AYKEN_SCHED_BOOTSTRAP_POLICY="$(AYKEN_SCHED_BOOTSTRAP_POLICY)" AYKEN_CR3_PCID=0 AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY=1 bash scripts/ci/gate_ring3_execution_phase10a2.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2" --qemu-timeout "$(RING3_QEMU_TIMEOUT)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ring3-execution-phase10a2/report.json" "$(EVIDENCE_RUN_DIR)/reports/ring3-execution-phase10a2.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ring3-execution-phase10a2 evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ring3-user-leaf-rule: ci-evidence-dir
	@echo "== CI GATE RING3 USER LEAF RULE =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "user_minimal_mode: phase10a2-text-witness-bp (enforced)"
	@echo "ayken_cr3_pcid: 0 (enforced)"
	@echo "ayken_ring3_post_cr3_text_probe: 1 (enforced)"
	@echo "ayken_ring3_mask_irq0_first_entry: 1 (enforced)"
	@echo "qemu_timeout_seconds: $(RING3_QEMU_TIMEOUT)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2-text-witness-bp KERNEL_PROFILE=validation AYKEN_CR3_PCID=0 AYKEN_RING3_POST_CR3_TEXT_PROBE=1 AYKEN_RING3_MASK_IRQ0_FIRST_ENTRY=1 bash scripts/ci/gate_ring3_user_leaf_rule.sh --evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ring3-user-leaf-rule" --qemu-timeout "$(RING3_QEMU_TIMEOUT)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ring3-user-leaf-rule/report.json" "$(EVIDENCE_RUN_DIR)/reports/ring3-user-leaf-rule.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ring3-user-leaf-rule evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-syscall-semantics-phase10b: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE SYSCALL SEMANTICS PHASE10-B =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase10b_mode: $(PHASE10B_MODE)"
	@echo "phase10b_a2_evidence: $(PHASE10B_A2_EVIDENCE_DIR)"
	@echo "phase10b_proof_qemu_timeout: $(PHASE10B_PROOF_QEMU_TIMEOUT)"
	@echo "phase10b_require_colocated_a2: $(PHASE10B_REQUIRE_COLOCATED_A2)"
	@RUN_ID=$(RUN_ID) PHASE10B_MODE="$(PHASE10B_MODE)" PHASE10B_PROOF_QEMU_TIMEOUT="$(PHASE10B_PROOF_QEMU_TIMEOUT)" PHASE10B_REQUIRE_COLOCATED_A2="$(PHASE10B_REQUIRE_COLOCATED_A2)" bash scripts/ci/gate_syscall_semantics_phase10b.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b" \
		--phase10a2-evidence "$(PHASE10B_A2_EVIDENCE_DIR)" \
		--mode "$(PHASE10B_MODE)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b/report.json" "$(EVIDENCE_RUN_DIR)/reports/syscall-semantics-phase10b.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b/fail-closed-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/phase10b-fail-closed-proof.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b/fail-closed-proof/replay_report.json" "$(EVIDENCE_RUN_DIR)/reports/phase10b-fail-closed-proof-replay.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/syscall-semantics-phase10b/fail-closed-proof/replay_manifest.json" "$(EVIDENCE_RUN_DIR)/reports/phase10b-fail-closed-proof-manifest.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: syscall-semantics-phase10b evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-scheduler-mailbox-phase10c: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE SCHEDULER MAILBOX PHASE10-C =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase10c_require_metadata: $(PHASE10C_REQUIRE_METADATA)"
	@echo "phase10c_c2_strict: $(PHASE10C_C2_STRICT)"
	@echo "phase10c_c2_owner_set: $(PHASE10C_C2_OWNER_SET)"
	@echo "phase10c_c2_require_cursor_marker: $(PHASE10C_C2_REQUIRE_CURSOR_MARKER)"
	@echo "phase10c_a2_evidence: $(PHASE10C_A2_EVIDENCE_DIR)"
	@RUN_ID=$(RUN_ID) PHASE10C_REQUIRE_METADATA="$(PHASE10C_REQUIRE_METADATA)" PHASE10C_C2_STRICT="$(PHASE10C_C2_STRICT)" PHASE10C_C2_OWNER_SET="$(PHASE10C_C2_OWNER_SET)" PHASE10C_C2_REQUIRE_CURSOR_MARKER="$(PHASE10C_C2_REQUIRE_CURSOR_MARKER)" bash scripts/ci/gate_scheduler_mailbox_phase10c.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/scheduler-mailbox-phase10c" \
		--phase10a2-evidence "$(PHASE10C_A2_EVIDENCE_DIR)" \
		--require-metadata "$(PHASE10C_REQUIRE_METADATA)" \
		--c2-strict "$(PHASE10C_C2_STRICT)" \
		--c2-owner-set "$(PHASE10C_C2_OWNER_SET)" \
		--c2-require-cursor-marker "$(PHASE10C_C2_REQUIRE_CURSOR_MARKER)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/scheduler-mailbox-phase10c/report.json" "$(EVIDENCE_RUN_DIR)/reports/scheduler-mailbox-phase10c.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: scheduler-mailbox-phase10c evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-low-half-kheap-scaffold: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE LOW-HALF KHEAP SCAFFOLD =="
	@echo "run_id: $(RUN_ID)"
	@echo "mode: allow"
	@echo "phase10a2_evidence: $(LOW_HALF_KHEAP_A2_EVIDENCE_DIR)"
	@bash scripts/ci/gate_low_half_kheap_scaffold.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-scaffold" \
		--phase10a2-evidence "$(LOW_HALF_KHEAP_A2_EVIDENCE_DIR)" \
		--mode allow
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-scaffold/report.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-scaffold.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-scaffold/runtime_proof.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-runtime-proof.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: low-half-kheap-scaffold evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-low-half-kheap-exit-proof: ci-evidence-dir
	@echo "== CI GATE LOW-HALF KHEAP EXIT PROOF =="
	@echo "run_id: $(RUN_ID)"
	@echo "qemu_timeout: $(LOW_HALF_KHEAP_EXIT_PROOF_QEMU_TIMEOUT)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_MB_SELFTEST=1 AYKEN_GATE4_POLICY_TEST=0 AYKEN_SCHED_BOOTSTRAP_POLICY="$(AYKEN_SCHED_BOOTSTRAP_POLICY)" AYKEN_CR3_PCID=0 AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=1 bash scripts/ci/gate_low_half_kheap_exit_proof.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-exit-proof" \
		--qemu-timeout "$(LOW_HALF_KHEAP_EXIT_PROOF_QEMU_TIMEOUT)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-exit-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-exit-proof.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-exit-proof/scaffold-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-exit-scaffold.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-exit-proof/scaffold-proof/runtime_proof.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-exit-runtime-proof.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: low-half-kheap-exit-proof evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-low-half-kheap-multi-exit-proof: ci-evidence-dir
	@echo "== CI GATE LOW-HALF KHEAP MULTI-EXIT PROOF =="
	@echo "run_id: $(RUN_ID)"
	@echo "qemu_timeout: $(LOW_HALF_KHEAP_MULTI_EXIT_PROOF_QEMU_TIMEOUT)"
	@echo "configured_exit_count: $(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_MB_SELFTEST=1 AYKEN_GATE4_POLICY_TEST=0 AYKEN_SCHED_BOOTSTRAP_POLICY="$(AYKEN_SCHED_BOOTSTRAP_POLICY)" AYKEN_CR3_PCID=0 AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=0 AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=1 AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT="$(AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT)" bash scripts/ci/gate_low_half_kheap_multi_exit_proof.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-multi-exit-proof" \
		--qemu-timeout "$(LOW_HALF_KHEAP_MULTI_EXIT_PROOF_QEMU_TIMEOUT)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-multi-exit-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-multi-exit-proof.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-multi-exit-proof/lineage_contract.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-multi-exit-lineage-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: low-half-kheap-multi-exit-proof evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-low-half-kheap-interleaving-proof: ci-evidence-dir
	@echo "== CI GATE LOW-HALF KHEAP INTERLEAVING PROOF =="
	@echo "run_id: $(RUN_ID)"
	@echo "qemu_timeout: $(LOW_HALF_KHEAP_INTERLEAVING_PROOF_QEMU_TIMEOUT)"
	@echo "configured_exit_count: $(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_MB_SELFTEST=1 AYKEN_GATE4_POLICY_TEST=0 AYKEN_SCHED_BOOTSTRAP_POLICY="$(AYKEN_SCHED_BOOTSTRAP_POLICY)" AYKEN_CR3_PCID=0 AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=0 AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=0 AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST=1 AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT="$(AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT)" bash scripts/ci/gate_low_half_kheap_interleaving_proof.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-interleaving-proof" \
		--qemu-timeout "$(LOW_HALF_KHEAP_INTERLEAVING_PROOF_QEMU_TIMEOUT)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-interleaving-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-interleaving-proof.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/low-half-kheap-interleaving-proof/interleaving_contract.json" "$(EVIDENCE_RUN_DIR)/reports/low-half-kheap-interleaving-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: low-half-kheap-interleaving-proof evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-alias-proof: ci-evidence-dir
	@echo "== CI GATE ALIAS PROOF (Phase 11 v1) =="
	@echo "run_id: $(RUN_ID)"
	@echo "qemu_timeout: 35"
	@echo "kernel_profile: validation (enforced)"
	@echo "user_minimal_mode: phase10a2 (enforced)"
	@echo "ayken_cr3_pcid: 0 (enforced)"
	@echo "ayken_mb_selftest: 1 (enforced)"
	@echo "ayken_gate4_policy_test: 0 (enforced)"
	@echo "ayken_sched_bootstrap_policy: 0 (enforced)"
	@echo "ayken_validation: 1 (enforced)"
	@echo "ayken_alias_proof_selftest: 1 (enforced)"
	@RUN_ID=$(RUN_ID) USER_MINIMAL_MODE=phase10a2 KERNEL_PROFILE=validation AYKEN_CR3_PCID=0 AYKEN_MB_SELFTEST=1 AYKEN_GATE4_POLICY_TEST=0 AYKEN_SCHED_BOOTSTRAP_POLICY=0 AYKEN_VALIDATION=1 AYKEN_ALIAS_PROOF_SELFTEST=1 bash scripts/ci/gate_alias_proof.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/alias-proof" \
		--qemu-timeout 35
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/alias-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/alias-proof.json" 2>/dev/null || true
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: alias-proof evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-no-low-half-kernel-dependency: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE NO LOW-HALF KERNEL DEPENDENCY =="
	@echo "run_id: $(RUN_ID)"
	@echo "mode: forbid"
	@echo "phase10a2_evidence: $(LOW_HALF_KHEAP_A2_EVIDENCE_DIR)"
	@bash scripts/ci/gate_low_half_kheap_scaffold.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/no-low-half-kernel-dependency" \
		--phase10a2-evidence "$(LOW_HALF_KHEAP_A2_EVIDENCE_DIR)" \
		--mode forbid
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/no-low-half-kernel-dependency/report.json" "$(EVIDENCE_RUN_DIR)/reports/no-low-half-kernel-dependency.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/no-low-half-kernel-dependency/runtime_proof.json" "$(EVIDENCE_RUN_DIR)/reports/no-low-half-kheap-runtime-proof.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: no-low-half-kernel-dependency evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-mailbox-capability-negative: ci-evidence-dir
	@echo "== CI GATE MAILBOX CAPABILITY NEGATIVE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_mailbox_capability_negative.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/mailbox-cap"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/mailbox-cap/report.json" "$(EVIDENCE_RUN_DIR)/reports/mailbox-capability-negative.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: mailbox-capability-negative evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ledger-completeness: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE LEDGER COMPLETENESS =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_ledger_a2_evidence: $(PHASE11_LEDGER_A2_EVIDENCE_DIR)"
	@echo "phase11_ledger_require_eti: $(PHASE11_LEDGER_REQUIRE_ETI)"
	@echo "phase11_ledger_eti_events: $(if $(PHASE11_LEDGER_ETI_EVENTS),$(PHASE11_LEDGER_ETI_EVENTS),<none>)"
	@PHASE11_LEDGER_REQUIRE_ETI="$(PHASE11_LEDGER_REQUIRE_ETI)" PHASE11_LEDGER_ETI_EVENTS="$(PHASE11_LEDGER_ETI_EVENTS)" \
		bash scripts/ci/gate_ledger_completeness.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ledger-v1" \
		--phase10a2-evidence "$(PHASE11_LEDGER_A2_EVIDENCE_DIR)" \
		--require-eti-binding "$(PHASE11_LEDGER_REQUIRE_ETI)" \
		--eti-events "$(PHASE11_LEDGER_ETI_EVENTS)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ledger-v1/report.json" "$(EVIDENCE_RUN_DIR)/reports/ledger-completeness.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ledger-completeness evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ledger-integrity: ci-gate-ledger-completeness
	@echo "== CI GATE LEDGER INTEGRITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_ledger_v1_evidence: $(PHASE11_LEDGER_V1_EVIDENCE_DIR)"
	@bash scripts/ci/gate_ledger_integrity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ledger-integrity" \
		--ledger-evidence "$(PHASE11_LEDGER_V1_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ledger-integrity/report.json" "$(EVIDENCE_RUN_DIR)/reports/ledger-integrity.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ledger-integrity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-hash-chain-validity: ci-gate-ledger-integrity
	@echo "OK: hash-chain-validity alias passed (ledger-integrity)"

ci-gate-deol-sequence: ci-evidence-dir
	@echo "== CI GATE DEOL SEQUENCE =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_deol_ledger_evidence: $(PHASE11_DEOL_LEDGER_EVIDENCE_DIR)"
	@bash scripts/ci/gate_deol_sequence.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/deol-sequence" \
		--ledger-evidence "$(PHASE11_DEOL_LEDGER_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/deol-sequence/report.json" "$(EVIDENCE_RUN_DIR)/reports/deol-sequence.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: deol-sequence evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-eti-sequence: ci-gate-ring3-execution-phase10a2
	@echo "== CI GATE ETI SEQUENCE =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_eti_a2_evidence: $(PHASE11_ETI_A2_EVIDENCE_DIR)"
	@bash scripts/ci/gate_eti_sequence.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/eti" \
		--phase10a2-evidence "$(PHASE11_ETI_A2_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/eti/report.json" "$(EVIDENCE_RUN_DIR)/reports/eti-sequence.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: eti-sequence evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-ledger-eti-binding: ci-gate-eti-sequence ci-gate-ledger-completeness
	@echo "== CI GATE LEDGER ETI BINDING =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_ledger_eti_ledger_evidence: $(PHASE11_LEDGER_ETI_LEDGER_EVIDENCE_DIR)"
	@echo "phase11_ledger_eti_evidence: $(PHASE11_LEDGER_ETI_EVIDENCE_DIR)"
	@bash scripts/ci/gate_ledger_eti_binding.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/ledger-eti-binding" \
		--ledger-evidence "$(PHASE11_LEDGER_ETI_LEDGER_EVIDENCE_DIR)" \
		--eti-evidence "$(PHASE11_LEDGER_ETI_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ledger-eti-binding/report.json" "$(EVIDENCE_RUN_DIR)/reports/ledger-eti-binding.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ledger-eti-binding evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-transcript-integrity: ci-gate-eti-sequence
	@echo "== CI GATE TRANSCRIPT INTEGRITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_eti_evidence: $(PHASE11_ETI_EVIDENCE_DIR)"
	@bash scripts/ci/gate_transcript_integrity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/transcript-integrity" \
		--eti-evidence "$(PHASE11_ETI_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/transcript-integrity/report.json" "$(EVIDENCE_RUN_DIR)/reports/transcript-integrity.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: transcript-integrity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-dlt-monotonicity: ci-gate-eti-sequence
	@echo "== CI GATE DLT MONOTONICITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_dlt_eti_evidence: $(PHASE11_DLT_ETI_EVIDENCE_DIR)"
	@bash scripts/ci/gate_dlt_monotonicity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/dlt-monotonicity" \
		--eti-evidence "$(PHASE11_DLT_ETI_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/dlt-monotonicity/report.json" "$(EVIDENCE_RUN_DIR)/reports/dlt-monotonicity.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: dlt-monotonicity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-eti-dlt-binding: ci-gate-dlt-monotonicity
	@echo "== CI GATE ETI DLT BINDING =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_eti_dlt_evidence: $(PHASE11_ETI_DLT_EVIDENCE_DIR)"
	@echo "phase11_eti_dlt_dlt_evidence: $(PHASE11_ETI_DLT_DLT_EVIDENCE_DIR)"
	@bash scripts/ci/gate_eti_dlt_binding.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/eti-dlt-binding" \
		--eti-evidence "$(PHASE11_ETI_DLT_EVIDENCE_DIR)" \
		--dlt-evidence "$(PHASE11_ETI_DLT_DLT_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/eti-dlt-binding/report.json" "$(EVIDENCE_RUN_DIR)/reports/eti-dlt-binding.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: eti-dlt-binding evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-dlt-determinism: ci-gate-dlt-monotonicity
	@echo "== CI GATE DLT DETERMINISM =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_dlt_determinism_eti_evidence: $(PHASE11_DLT_DETERMINISM_ETI_EVIDENCE_DIR)"
	@bash scripts/ci/gate_dlt_determinism.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/dlt-determinism" \
		--eti-evidence "$(PHASE11_DLT_DETERMINISM_ETI_EVIDENCE_DIR)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/dlt-determinism/report.json" "$(EVIDENCE_RUN_DIR)/reports/dlt-determinism.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: dlt-determinism evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-gcp-finalization: ci-gate-dlt-determinism
	@echo "== CI GATE GCP FINALIZATION =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_gcp_dlt_evidence: $(PHASE11_GCP_DLT_EVIDENCE_DIR)"
	@echo "phase11_gcp_previous_snapshot: $(if $(PHASE11_GCP_PREVIOUS_SNAPSHOT),$(PHASE11_GCP_PREVIOUS_SNAPSHOT),<none>)"
	@bash scripts/ci/gate_gcp_finalization.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/gcp-finalization" \
		--dlt-evidence "$(PHASE11_GCP_DLT_EVIDENCE_DIR)" $(if $(PHASE11_GCP_PREVIOUS_SNAPSHOT),--previous-gcp "$(PHASE11_GCP_PREVIOUS_SNAPSHOT)",)
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/gcp-finalization/report.json" "$(EVIDENCE_RUN_DIR)/reports/gcp-finalization.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: gcp-finalization evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-gcp-atomicity: ci-gate-gcp-finalization
	@echo "OK: gcp-atomicity alias passed (gcp-finalization bootstrap)"

ci-gate-gcp-ordering: ci-gate-gcp-finalization
	@echo "OK: gcp-ordering alias passed (gcp-finalization bootstrap)"

ci-gate-abdf-snapshot-identity: ci-evidence-dir
	@echo "== CI GATE ABDF SNAPSHOT IDENTITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_abdf_snapshot_bin: $(PHASE11_ABDF_SNAPSHOT_BIN)"
	@echo "phase11_abdf_expected_hash_file: $(if $(PHASE11_ABDF_EXPECTED_HASH_FILE),$(PHASE11_ABDF_EXPECTED_HASH_FILE),<none>)"
	@bash scripts/ci/gate_abdf_snapshot_identity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/abdf-snapshot-identity" \
		--snapshot-bin "$(PHASE11_ABDF_SNAPSHOT_BIN)" $(if $(PHASE11_ABDF_EXPECTED_HASH_FILE),--expected-hash-file "$(PHASE11_ABDF_EXPECTED_HASH_FILE)",)
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/abdf-snapshot-identity/report.json" "$(EVIDENCE_RUN_DIR)/reports/abdf-snapshot-identity.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: abdf-snapshot-identity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-bcib-trace-identity: ci-gate-eti-sequence
	@echo "== CI GATE BCIB TRACE IDENTITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_bcib_plan_bin: $(PHASE11_BCIB_PLAN_BIN)"
	@echo "phase11_bcib_eti_evidence: $(PHASE11_BCIB_ETI_EVIDENCE_DIR)"
	@echo "phase11_bcib_expected_plan_hash_file: $(if $(PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE),$(PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE),<none>)"
	@echo "phase11_bcib_expected_trace_hash_file: $(if $(PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE),$(PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE),<none>)"
	@bash scripts/ci/gate_bcib_trace_identity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/execution-identity" \
		--bcib-plan "$(PHASE11_BCIB_PLAN_BIN)" \
		--eti-evidence "$(PHASE11_BCIB_ETI_EVIDENCE_DIR)" $(if $(PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE),--expected-plan-hash-file "$(PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE)",) $(if $(PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE),--expected-trace-hash-file "$(PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE)",)
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/execution-identity/report.json" "$(EVIDENCE_RUN_DIR)/reports/bcib-trace-identity.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: bcib-trace-identity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-execution-identity: ci-gate-bcib-trace-identity
	@echo "OK: execution-identity alias passed (bcib-trace-identity bootstrap)"

ci-gate-replay-determinism: ci-gate-abdf-snapshot-identity ci-gate-execution-identity
	@echo "== CI GATE REPLAY DETERMINISM =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_replay_abdf_evidence: $(PHASE11_REPLAY_ABDF_EVIDENCE_DIR)"
	@echo "phase11_replay_execution_evidence: $(PHASE11_REPLAY_EXECUTION_EVIDENCE_DIR)"
	@echo "phase11_replay_expected_final_state_hash_file: $(if $(PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE),$(PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE),<none>)"
	@bash scripts/ci/gate_replay_determinism.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/replay-v1" \
		--abdf-evidence "$(PHASE11_REPLAY_ABDF_EVIDENCE_DIR)" \
		--execution-evidence "$(PHASE11_REPLAY_EXECUTION_EVIDENCE_DIR)" $(if $(PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE),--expected-final-state-hash-file "$(PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE)",)
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/replay-v1/report.json" "$(EVIDENCE_RUN_DIR)/reports/replay-determinism.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/replay-v1/replay_report.json" "$(EVIDENCE_RUN_DIR)/reports/replay-report.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: replay-determinism evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-replay-v1: ci-gate-replay-determinism
	@echo "OK: replay-v1 alias passed (replay-determinism bootstrap)"

ci-gate-kpl-proof-verify: ci-gate-replay-determinism ci-gate-ledger-integrity ci-gate-eti-sequence ci-gate-no-low-half-kernel-dependency
	@echo "== CI GATE KPL PROOF VERIFY =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_kpl_abdf_evidence: $(PHASE11_KPL_ABDF_EVIDENCE_DIR)"
	@echo "phase11_kpl_execution_evidence: $(PHASE11_KPL_EXECUTION_EVIDENCE_DIR)"
	@echo "phase11_kpl_replay_evidence: $(PHASE11_KPL_REPLAY_EVIDENCE_DIR)"
	@echo "phase11_kpl_ledger_evidence: $(PHASE11_KPL_LEDGER_EVIDENCE_DIR)"
	@echo "phase11_kpl_eti_evidence: $(PHASE11_KPL_ETI_EVIDENCE_DIR)"
	@echo "phase11_kpl_kernel_image_bin: $(PHASE11_KPL_KERNEL_IMAGE_BIN)"
	@echo "phase11_kpl_config_json: $(PHASE11_KPL_CONFIG_JSON)"
	@echo "phase11_kpl_input_proof_manifest: $(if $(PHASE11_KPL_INPUT_PROOF_MANIFEST),$(PHASE11_KPL_INPUT_PROOF_MANIFEST),<none>)"
	@echo "phase11_kpl_expected_proof_hash_file: $(if $(PHASE11_KPL_EXPECTED_PROOF_HASH_FILE),$(PHASE11_KPL_EXPECTED_PROOF_HASH_FILE),<none>)"
	@echo "phase11_kpl_expected_final_state_hash_file: $(if $(PHASE11_KPL_EXPECTED_FINAL_STATE_HASH_FILE),$(PHASE11_KPL_EXPECTED_FINAL_STATE_HASH_FILE),<none>)"
	@bash scripts/ci/gate_kpl_proof_verify.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/kpl-proof" \
		--abdf-evidence "$(PHASE11_KPL_ABDF_EVIDENCE_DIR)" \
		--execution-evidence "$(PHASE11_KPL_EXECUTION_EVIDENCE_DIR)" \
		--replay-evidence "$(PHASE11_KPL_REPLAY_EVIDENCE_DIR)" \
		--ledger-evidence "$(PHASE11_KPL_LEDGER_EVIDENCE_DIR)" \
		--eti-evidence "$(PHASE11_KPL_ETI_EVIDENCE_DIR)" \
		--kernel-image-bin "$(PHASE11_KPL_KERNEL_IMAGE_BIN)" \
		--config-json "$(PHASE11_KPL_CONFIG_JSON)" $(if $(PHASE11_KPL_INPUT_PROOF_MANIFEST),--in-proof-manifest-json "$(PHASE11_KPL_INPUT_PROOF_MANIFEST)",) $(if $(PHASE11_KPL_EXPECTED_PROOF_HASH_FILE),--expected-proof-hash-file "$(PHASE11_KPL_EXPECTED_PROOF_HASH_FILE)",) $(if $(PHASE11_KPL_EXPECTED_FINAL_STATE_HASH_FILE),--expected-final-state-hash-file "$(PHASE11_KPL_EXPECTED_FINAL_STATE_HASH_FILE)",)
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/kpl-proof/report.json" "$(EVIDENCE_RUN_DIR)/reports/kpl-proof-verify.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/kpl-proof/proof_verify.json" "$(EVIDENCE_RUN_DIR)/reports/kpl-proof-verify-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: kpl-proof-verify evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-manifest: ci-gate-kpl-proof-verify
	@echo "OK: proof-manifest alias passed (kpl-proof-verify bootstrap)"

ci-gate-proof-bundle: ci-gate-kpl-proof-verify
	@echo "== CI GATE PROOF BUNDLE =="
	@echo "run_id: $(RUN_ID)"
	@echo "phase11_bundle_abdf_evidence: $(PHASE11_BUNDLE_ABDF_EVIDENCE_DIR)"
	@echo "phase11_bundle_execution_evidence: $(PHASE11_BUNDLE_EXECUTION_EVIDENCE_DIR)"
	@echo "phase11_bundle_replay_evidence: $(PHASE11_BUNDLE_REPLAY_EVIDENCE_DIR)"
	@echo "phase11_bundle_kpl_evidence: $(PHASE11_BUNDLE_KPL_EVIDENCE_DIR)"
	@echo "phase11_bundle_ledger_evidence: $(PHASE11_BUNDLE_LEDGER_EVIDENCE_DIR)"
	@echo "phase11_bundle_eti_evidence: $(PHASE11_BUNDLE_ETI_EVIDENCE_DIR)"
	@echo "phase11_bundle_kernel_image_bin: $(PHASE11_BUNDLE_KERNEL_IMAGE_BIN)"
	@echo "phase11_bundle_summary_json: $(PHASE11_BUNDLE_SUMMARY_JSON)"
	@echo "phase11_bundle_meta_run_json: $(PHASE11_BUNDLE_META_RUN_JSON)"
	@bash scripts/ci/gate_proof_bundle.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-bundle" \
		--abdf-evidence "$(PHASE11_BUNDLE_ABDF_EVIDENCE_DIR)" \
		--execution-evidence "$(PHASE11_BUNDLE_EXECUTION_EVIDENCE_DIR)" \
		--replay-evidence "$(PHASE11_BUNDLE_REPLAY_EVIDENCE_DIR)" \
		--kpl-evidence "$(PHASE11_BUNDLE_KPL_EVIDENCE_DIR)" \
		--ledger-evidence "$(PHASE11_BUNDLE_LEDGER_EVIDENCE_DIR)" \
		--eti-evidence "$(PHASE11_BUNDLE_ETI_EVIDENCE_DIR)" \
		--kernel-image-bin "$(PHASE11_BUNDLE_KERNEL_IMAGE_BIN)" \
		--summary-json "$(PHASE11_BUNDLE_SUMMARY_JSON)" \
		--meta-run-json "$(PHASE11_BUNDLE_META_RUN_JSON)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle/bundle_verify.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle-verify.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-bundle evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-portability: ci-gate-proof-bundle
	@echo "OK: proof-portability alias passed (proof-bundle bootstrap)"

ci-gate-proof-producer-schema: ci-evidence-dir
	@echo "== CI GATE PROOF PRODUCER SCHEMA =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode producer-schema \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-producer-schema"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-producer-schema/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-producer-schema.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-producer-schema/producer_schema_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-producer-schema-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-producer-schema evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-signature-envelope: ci-gate-proof-producer-schema
	@echo "== CI GATE PROOF SIGNATURE ENVELOPE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode signature-envelope \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-signature-envelope"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-signature-envelope/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-signature-envelope.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-signature-envelope/signature_envelope_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-signature-envelope-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-signature-envelope evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-bundle-v2-schema: ci-gate-proof-signature-envelope
	@echo "== CI GATE PROOF BUNDLE V2 SCHEMA =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode bundle-v2-schema \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-schema"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-schema/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle-v2-schema.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-schema/bundle_schema_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle-v2-schema-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-bundle-v2-schema evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-bundle-v2-compat: ci-gate-proof-bundle-v2-schema
	@echo "== CI GATE PROOF BUNDLE V2 COMPAT =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode bundle-v2-compat \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-compat"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-compat/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle-v2-compat.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-bundle-v2-compat/compatibility_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-bundle-v2-compat-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-bundle-v2-compat evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-signature-verify: ci-gate-proof-bundle-v2-compat
	@echo "== CI GATE PROOF SIGNATURE VERIFY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode signature-verify \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-signature-verify"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-signature-verify/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-signature-verify.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-signature-verify/signature_verify.json" "$(EVIDENCE_RUN_DIR)/reports/proof-signature-verify-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-signature-verify evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-registry-resolution: ci-gate-proof-signature-verify
	@echo "== CI GATE PROOF REGISTRY RESOLUTION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode registry-resolution \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-registry-resolution"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-registry-resolution/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-registry-resolution.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-registry-resolution/registry_resolution_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/proof-registry-resolution-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-registry-resolution evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-key-rotation: ci-gate-proof-registry-resolution
	@echo "== CI GATE PROOF KEY ROTATION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_phase12_harness.sh \
		--mode key-rotation \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-key-rotation"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-key-rotation/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-key-rotation.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-key-rotation/rotation_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/proof-key-rotation-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-key-rotation evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-verifier-core: ci-gate-proof-key-rotation
	@echo "== CI GATE PROOF VERIFIER CORE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_verifier_core.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-core"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-core/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verifier-core.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-core/verifier_core_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verifier-core-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-verifier-core evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-trust-policy: ci-gate-proof-verifier-core
	@echo "== CI GATE PROOF TRUST POLICY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_trust_policy.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-trust-policy"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-trust-policy/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-trust-policy.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-trust-policy/policy_hash_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-trust-policy-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-trust-policy evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-verdict-binding: ci-gate-proof-trust-policy
	@echo "== CI GATE PROOF VERDICT BINDING =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_verdict_binding.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-verdict-binding"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verdict-binding/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verdict-binding.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verdict-binding/verdict_binding_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verdict-binding-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-verdict-binding evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-verifier-cli: ci-gate-proof-verdict-binding
	@echo "== CI GATE PROOF VERIFIER CLI =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_verifier_cli.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-cli"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-cli/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verifier-cli.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-cli/cli_output_contract.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verifier-cli-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-verifier-cli/cli_smoke_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-verifier-cli-smoke.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-verifier-cli evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-receipt: ci-gate-proof-verifier-cli
	@echo "== CI GATE PROOF RECEIPT =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_receipt.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-receipt"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-receipt/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-receipt.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-receipt/receipt_emit_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-receipt-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-receipt evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-audit-ledger: ci-gate-proof-receipt
	@echo "== CI GATE PROOF AUDIT LEDGER =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_audit_ledger.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-audit-ledger"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-audit-ledger/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-audit-ledger.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-audit-ledger/audit_integrity_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-audit-ledger-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-audit-ledger evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-exchange: ci-gate-proof-audit-ledger
	@echo "== CI GATE PROOF EXCHANGE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_exchange.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-exchange"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-exchange/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-exchange.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-exchange/exchange_contract_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-exchange-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-exchange/transport_mutation_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/proof-exchange-matrix.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-exchange evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-verifier-authority-resolution: ci-gate-proof-exchange
	@echo "== CI GATE VERIFIER AUTHORITY RESOLUTION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_verifier_authority_resolution.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/verifier-authority-resolution"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-authority-resolution/report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-authority-resolution.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-authority-resolution/authority_resolution_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-authority-resolution-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: verifier-authority-resolution evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-cross-node-parity: ci-gate-verifier-authority-resolution
	@echo "== CI GATE CROSS-NODE PARITY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_cross_node_parity.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/cross-node-parity"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/cross-node-parity/report.json" "$(EVIDENCE_RUN_DIR)/reports/cross-node-parity.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/cross-node-parity/parity_report.json" "$(EVIDENCE_RUN_DIR)/reports/cross-node-parity-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/cross-node-parity/parity_closure_audit_report.json" "$(EVIDENCE_RUN_DIR)/reports/cross-node-parity-closure-audit.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: cross-node-parity evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proofd-service: ci-evidence-dir
	@echo "== CI GATE PROOFD SERVICE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proofd_service.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proofd-service"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-service.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_service_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-service-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_receipt_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-receipt-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_endpoint_contract.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-endpoint-contract.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_verify_request.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-verify-request.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_verify_response.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-verify-response.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_run_manifest.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-run-manifest.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_receipt_verification_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-receipt-verification.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-service/proofd_repeated_execution_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-repeated-execution.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proofd-service evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proofd-schema-coverage: ci-gate-proofd-service
	@echo "== CI GATE PROOFD SCHEMA COVERAGE =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proofd_schema_coverage.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proofd-schema-coverage" \
		--source-gate-dir "$(EVIDENCE_RUN_DIR)/gates/proofd-service"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-schema-coverage/report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-schema-coverage.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-schema-coverage/proofd_schema_coverage_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-schema-coverage-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proofd-schema-coverage evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proofd-observability-boundary: ci-evidence-dir
	@echo "== CI GATE PROOFD OBSERVABILITY BOUNDARY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proofd_observability_boundary.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proofd-observability-boundary"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-observability-boundary/report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-observability-boundary.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-observability-boundary/proofd_observability_boundary_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-observability-boundary-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proofd-observability-boundary/proofd_observability_negative_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-observability-negative-matrix.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proofd-observability-boundary evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-graph-non-authoritative-contract: ci-evidence-dir
	@echo "== CI GATE GRAPH NON-AUTHORITATIVE CONTRACT =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_graph_non_authoritative_contract.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/graph-non-authoritative-contract"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/graph-non-authoritative-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/graph-non-authoritative-contract.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/graph-non-authoritative-contract/graph_non_authoritative_report.json" "$(EVIDENCE_RUN_DIR)/reports/graph-non-authoritative-contract-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: graph-non-authoritative-contract evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-convergence-non-election-boundary: ci-evidence-dir
	@echo "== CI GATE CONVERGENCE NON-ELECTION BOUNDARY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_convergence_non_election_boundary.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/convergence-non-election-boundary"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/convergence-non-election-boundary/report.json" "$(EVIDENCE_RUN_DIR)/reports/convergence-non-election-boundary.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/convergence-non-election-boundary/convergence_non_election_report.json" "$(EVIDENCE_RUN_DIR)/reports/convergence-non-election-boundary-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: convergence-non-election-boundary evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-diagnostics-consumer-non-authoritative-contract: ci-evidence-dir
	@echo "== CI GATE DIAGNOSTICS CONSUMER NON-AUTHORITATIVE CONTRACT =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_diagnostics_consumer_non_authoritative_contract.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/diagnostics-consumer-non-authoritative-contract"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/diagnostics-consumer-non-authoritative-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/diagnostics-consumer-non-authoritative-contract.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/diagnostics-consumer-non-authoritative-contract/diagnostics_consumer_contract_report.json" "$(EVIDENCE_RUN_DIR)/reports/diagnostics-consumer-non-authoritative-contract-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: diagnostics-consumer-non-authoritative-contract evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-diagnostics-callsite-correlation: ci-evidence-dir
	@echo "== CI GATE DIAGNOSTICS CALLSITE CORRELATION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_diagnostics_callsite_correlation.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/diagnostics-callsite-correlation"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/diagnostics-callsite-correlation/report.json" "$(EVIDENCE_RUN_DIR)/reports/diagnostics-callsite-correlation.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/diagnostics-callsite-correlation/diagnostics_callsite_correlation_report.json" "$(EVIDENCE_RUN_DIR)/reports/diagnostics-callsite-correlation-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: diagnostics-callsite-correlation evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-observability-routing-separation: ci-evidence-dir
	@echo "== CI GATE OBSERVABILITY ROUTING SEPARATION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_observability_routing_separation.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/observability-routing-separation"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/observability-routing-separation/report.json" "$(EVIDENCE_RUN_DIR)/reports/observability-routing-separation.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/observability-routing-separation/observability_routing_separation_report.json" "$(EVIDENCE_RUN_DIR)/reports/observability-routing-separation-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/observability-routing-separation/observability_routing_negative_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/observability-routing-negative-matrix.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: observability-routing-separation evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-verification-diversity-floor: ci-evidence-dir
	@echo "== CI GATE VERIFICATION DIVERSITY FLOOR =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_verification_diversity_floor.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor" \
		--artifact-root "$(EVIDENCE_RUN_DIR)/artifacts"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/verification_diversity_floor_report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/vdl_window.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-vdl-window.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/diversity_metrics.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-metrics.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/lineage_distribution.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-lineage-distribution.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/cluster_distribution.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-cluster-distribution.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/dominance_analysis.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-dominance-analysis.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-diversity-floor/entropy_report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-floor-entropy-report.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: verification-diversity-floor evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-verifier-cartel-correlation: ci-evidence-dir
	@echo "== CI GATE VERIFIER CARTEL CORRELATION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_verifier_cartel_correlation.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation" \
		--artifact-root "$(EVIDENCE_RUN_DIR)/artifacts"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/verifier_cartel_correlation_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/cartel_correlation_metrics.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-metrics.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/pairwise_correlation_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-pairwise.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/lineage_correlation_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-lineage.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/authority_chain_correlation_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-authority-chain.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/cluster_overlap_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-cluster-overlap.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-cartel-correlation/correlation_stability_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-cartel-correlation-stability.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: verifier-cartel-correlation evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-authority-sinkhole-absorption: ci-evidence-dir
	@echo "== CI GATE AUTHORITY SINKHOLE ABSORPTION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_authority_sinkhole_absorption.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption" \
		--artifact-root "$(EVIDENCE_RUN_DIR)/artifacts"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/authority_sinkhole_absorption_report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/vdl_window.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-vdl-window.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/dominance_analysis.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-dominance-analysis.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/authority_chain_flow_report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-flow.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/basin_absorption_report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-basin.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/basin_window_series.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-series.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/authority-sinkhole-absorption/cross_surface_basin_alignment_report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-absorption-cross-surface.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: authority-sinkhole-absorption evidence at $(EVIDENCE_RUN_DIR)"

ci-produce-verification-diversity-ledger: ci-evidence-dir
	@echo "== CI PRODUCE VERIFICATION DIVERSITY LEDGER =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/produce_verification_diversity_ledger.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/producers/verification-diversity-ledger" \
		--artifact-root "$(EVIDENCE_RUN_DIR)/artifacts"
	@cp -f "$(EVIDENCE_RUN_DIR)/producers/verification-diversity-ledger/report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-ledger-producer.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/producers/verification-diversity-ledger/verification_diversity_ledger_append_report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-ledger-producer-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/producers/verification-diversity-ledger/verification_diversity_ledger.json" "$(EVIDENCE_RUN_DIR)/reports/verification-diversity-ledger-snapshot.json"
	@echo "OK: verification-diversity-ledger producer evidence at $(EVIDENCE_RUN_DIR)"

ci-produce-authority-sinkhole-companion-flows: ci-evidence-dir
	@echo "== CI PRODUCE AUTHORITY SINKHOLE COMPANION FLOWS =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/produce_authority_sinkhole_companion_flows.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows" \
		--artifact-root "$(EVIDENCE_RUN_DIR)/artifacts" \
		--replay-source "$(EVIDENCE_RUN_DIR)/gates/proofd-service/replay_boundary_flow_source.json" \
		--trust-source "$(EVIDENCE_RUN_DIR)/gates/proofd-service/trust_reuse_flow_source.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-companion-flow-producer.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/authority_sinkhole_companion_flow_materialization_report.json" "$(EVIDENCE_RUN_DIR)/reports/authority-sinkhole-companion-flow-producer-details.json"
	@if [ -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/replay_boundary_flow_report.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/replay_boundary_flow_report.json" "$(EVIDENCE_RUN_DIR)/reports/replay-boundary-flow-report.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/trust_reuse_flow_report.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/producers/authority-sinkhole-companion-flows/trust_reuse_flow_report.json" "$(EVIDENCE_RUN_DIR)/reports/trust-reuse-flow-report.json"; fi
	@echo "OK: authority-sinkhole companion flow producer evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-verification-determinism-contract: ci-evidence-dir
	@echo "== CI GATE VERIFICATION DETERMINISM CONTRACT =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_verification_determinism_contract.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/verification-determinism-contract"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-determinism-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-determinism-contract.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verification-determinism-contract/verification_determinism_contract_report.json" "$(EVIDENCE_RUN_DIR)/reports/verification-determinism-contract-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: verification-determinism-contract evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-determinism-replay-consistency: ci-gate-proofd-service ci-gate-verification-determinism-contract
	@echo "== CI GATE DETERMINISM REPLAY CONSISTENCY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_determinism_replay_consistency.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/report.json" "$(EVIDENCE_RUN_DIR)/reports/determinism-replay-consistency.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/determinism_replay_consistency_report.json" "$(EVIDENCE_RUN_DIR)/reports/determinism-replay-consistency-details.json"
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/internal_replay_output.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/internal_replay_output.json" "$(EVIDENCE_RUN_DIR)/reports/determinism-replay-output.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_verify_request.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_verify_request.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-verify-request.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_verify_response.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_verify_response.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-verify-response.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_run_manifest.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/proofd_run_manifest.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-run-manifest.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_contract.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_contract.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-contract-artifact.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_replay_report.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_replay_report.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-replay-report.json"; fi
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_incident.json" ]; then cp -f "$(EVIDENCE_RUN_DIR)/gates/determinism-replay-consistency/verification_determinism_incident.json" "$(EVIDENCE_RUN_DIR)/reports/proofd-determinism-incident.json"; fi
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: determinism-replay-consistency evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-verifier-reputation-prohibition: ci-evidence-dir
	@echo "== CI GATE VERIFIER REPUTATION PROHIBITION =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_verifier_reputation_prohibition.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/verifier-reputation-prohibition"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-reputation-prohibition/report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-reputation-prohibition.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/verifier-reputation-prohibition/reputation_prohibition_report.json" "$(EVIDENCE_RUN_DIR)/reports/verifier-reputation-prohibition-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: verifier-reputation-prohibition evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-multisig-quorum: ci-gate-cross-node-parity ci-gate-proofd-service
	@echo "== CI GATE PROOF MULTISIG QUORUM =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_multisig_quorum.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-multisig-quorum"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-multisig-quorum/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-multisig-quorum.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-multisig-quorum/quorum_matrix.json" "$(EVIDENCE_RUN_DIR)/reports/proof-multisig-quorum-matrix.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-multisig-quorum/quorum_evaluator_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-multisig-quorum-details.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-multisig-quorum evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-replay-admission-boundary: ci-gate-proof-multisig-quorum
	@echo "== CI GATE PROOF REPLAY ADMISSION BOUNDARY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_replay_admission_boundary.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-replay-admission-boundary"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replay-admission-boundary/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-replay-admission-boundary.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replay-admission-boundary/replay_admission_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-replay-admission-boundary-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replay-admission-boundary/boundary_contract.json" "$(EVIDENCE_RUN_DIR)/reports/proof-replay-admission-boundary-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-replay-admission-boundary evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-proof-replicated-verification-boundary: ci-gate-proof-replay-admission-boundary
	@echo "== CI GATE PROOF REPLICATED VERIFICATION BOUNDARY =="
	@echo "run_id: $(RUN_ID)"
	@bash scripts/ci/gate_proof_replicated_verification_boundary.sh \
		--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/proof-replicated-verification-boundary"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replicated-verification-boundary/report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-replicated-verification-boundary.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replicated-verification-boundary/phase13_bridge_report.json" "$(EVIDENCE_RUN_DIR)/reports/proof-replicated-verification-boundary-details.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/proof-replicated-verification-boundary/research_boundary_note.md" "$(EVIDENCE_RUN_DIR)/reports/proof-replicated-verification-boundary-note.md"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: proof-replicated-verification-boundary evidence at $(EVIDENCE_RUN_DIR)"

phase12-official-closure-prep:
	@echo "== PHASE12 OFFICIAL CLOSURE PREP =="
	@python3 tools/ci/generate_phase12_closure_bundle.py \
		--run-dir "$(PHASE12_CLOSURE_RUN_DIR)" \
		--output-dir "$(PHASE12_CLOSURE_OUTPUT_DIR)" \
		$(if $(PHASE12_CLOSURE_ATTESTOR_NODE_ID),--attestor-node-id "$(PHASE12_CLOSURE_ATTESTOR_NODE_ID)") \
		$(if $(PHASE12_CLOSURE_ATTESTOR_KEY_ID),--attestor-key-id "$(PHASE12_CLOSURE_ATTESTOR_KEY_ID)") \
		$(if $(PHASE12_CLOSURE_ATTESTOR_PRIVATE_KEY),--attestor-private-key "$(PHASE12_CLOSURE_ATTESTOR_PRIVATE_KEY)") \
		$(if $(PHASE12_CLOSURE_ATTESTED_AT_UTC),--attested-at-utc "$(PHASE12_CLOSURE_ATTESTED_AT_UTC)")
	@echo "OK: phase12 official closure candidate at $(PHASE12_CLOSURE_OUTPUT_DIR)"

phase12-closure: phase12-official-closure-prep
	@echo "OK: phase12-closure alias passed"

phase12-official-closure-preflight:
	@echo "== PHASE12 OFFICIAL CLOSURE PREFLIGHT =="
	@python3 tools/ci/generate_phase12_official_closure_preflight.py \
		--candidate-dir "$(PHASE12_CLOSURE_OUTPUT_DIR)" \
		--output-dir "$(PHASE12_CLOSURE_PREFLIGHT_OUTPUT_DIR)" \
		--remote-ci-workflow "$(PHASE12_CLOSURE_REMOTE_CI_WORKFLOW)" \
		$(if $(PHASE12_CLOSURE_ATTESTOR_PUBLIC_KEY),--attestor-public-key "$(PHASE12_CLOSURE_ATTESTOR_PUBLIC_KEY)") \
		$(if $(PHASE12_CLOSURE_REMOTE_CI_RUN_ID),--remote-ci-run-id "$(PHASE12_CLOSURE_REMOTE_CI_RUN_ID)")
	@echo "OK: phase12 official closure preflight at $(PHASE12_CLOSURE_PREFLIGHT_OUTPUT_DIR)"

phase12-official-closure-execute: phase12-official-closure-prep
	@echo "== PHASE12 OFFICIAL CLOSURE EXECUTE =="
	@python3 tools/ci/generate_phase12_official_closure_preflight.py \
		--candidate-dir "$(PHASE12_CLOSURE_OUTPUT_DIR)" \
		--output-dir "$(PHASE12_CLOSURE_PREFLIGHT_OUTPUT_DIR)" \
		--remote-ci-workflow "$(PHASE12_CLOSURE_REMOTE_CI_WORKFLOW)" \
		--fail-on-blockers \
		$(if $(PHASE12_CLOSURE_ATTESTOR_PUBLIC_KEY),--attestor-public-key "$(PHASE12_CLOSURE_ATTESTOR_PUBLIC_KEY)") \
		$(if $(PHASE12_CLOSURE_REMOTE_CI_RUN_ID),--remote-ci-run-id "$(PHASE12_CLOSURE_REMOTE_CI_RUN_ID)")
	@echo "OK: phase12 official closure local execution is ready"

ci-gate-policy-accept: ci-evidence-dir
	@echo "== CI GATE POLICY ACCEPT =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@RUN_ID=$(RUN_ID) KERNEL_PROFILE=validation bash scripts/ci/gate_4_policy_accept.sh
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/policy-accept"
	@cp -f "evidence/gate-4-policy-accept/$(RUN_ID)/report.json" "$(EVIDENCE_RUN_DIR)/gates/policy-accept/report.json"
	@cp -f "evidence/gate-4-policy-accept/$(RUN_ID)/violations.txt" "$(EVIDENCE_RUN_DIR)/gates/policy-accept/violations.txt"
	@cp -f "evidence/gate-4-policy-accept/$(RUN_ID)/report.json" "$(EVIDENCE_RUN_DIR)/reports/policy-accept.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: policy-accept evidence at evidence/gate-4-policy-accept/$(RUN_ID)"

ci-gate-decision-switch-phase45: ci-evidence-dir
	@echo "== CI GATE DECISION SWITCH PHASE4.5 =="
	@echo "run_id: $(RUN_ID)"
	@echo "kernel_profile: validation (enforced)"
	@echo "qemu_timeout_seconds: $(GATE45_QEMU_TIMEOUT)"
	@echo "gate4_bootstrap_policy: $(GATE45_BOOTSTRAP_POLICY)"
	@echo "gate4_mb_selftest: $(GATE45_MB_SELFTEST)"
	@echo "gate45_c2_strict: $(GATE45_C2_STRICT)"
	@echo "gate45_c2_owner_pid: $(GATE45_C2_OWNER_PID)"
	@RUN_ID=$(RUN_ID) KERNEL_PROFILE=validation QEMU_TIMEOUT="$(GATE45_QEMU_TIMEOUT)" GATE4_BOOTSTRAP_POLICY="$(GATE45_BOOTSTRAP_POLICY)" GATE4_MB_SELFTEST="$(GATE45_MB_SELFTEST)" GATE45_C2_STRICT="$(GATE45_C2_STRICT)" GATE45_C2_OWNER_PID="$(GATE45_C2_OWNER_PID)" bash scripts/ci/gate_4_5_decision_switch_proof.sh
	@cp -f "evidence/gate-4.5-decision-switch-proof/$(RUN_ID)/report.json" "$(EVIDENCE_RUN_DIR)/gates/decision-switch-phase45/report.json"
	@cp -f "evidence/gate-4.5-decision-switch-proof/$(RUN_ID)/violations.txt" "$(EVIDENCE_RUN_DIR)/gates/decision-switch-phase45/violations.txt"
	@cp -f "evidence/gate-4.5-decision-switch-proof/$(RUN_ID)/report.json" "$(EVIDENCE_RUN_DIR)/reports/decision-switch-phase45.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: decision-switch-phase45 evidence at evidence/gate-4.5-decision-switch-proof/$(RUN_ID)"

ci-gate-policy-proof-regression: ci-kill-switch-phase13 ci-gate-policy-accept ci-gate-decision-switch-phase45
	@echo "OK: policy-proof regression suite passed (Gate-4 + Gate-4.5)"

ci-gate-performance: ci-evidence-dir
	@echo "== CI GATE PERFORMANCE =="
	@echo "run_id: $(RUN_ID)"
	@echo "perf_baseline_authority: $(PERF_BASELINE_AUTHORITY)"
	@echo "perf_ci_image_digest: $(PERF_CI_IMAGE_DIGEST)"
	@echo "perf_require_ci_for_baseline_init: $(PERF_REQUIRE_CI_FOR_BASELINE_INIT)"
	@echo "ayken_sched_fallback: $(AYKEN_SCHED_FALLBACK)"
	@if [ "$(PERF_INIT_BASELINE)" = "1" ]; then \
		AYKEN_SCHED_FALLBACK="$(AYKEN_SCHED_FALLBACK)" \
		PERF_BASELINE_AUTHORITY="$(PERF_BASELINE_AUTHORITY)" \
		PERF_REQUIRE_CI_FOR_BASELINE_INIT="$(PERF_REQUIRE_CI_FOR_BASELINE_INIT)" \
		PERF_CI_IMAGE_DIGEST="$(PERF_CI_IMAGE_DIGEST)" \
		./scripts/ci/gate_performance.sh \
			--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/performance" \
			--kernel-profile "$(PERF_KERNEL_PROFILE)" \
			--qemu-timeout "$(PERF_QEMU_TIMEOUT)" \
			--env-mismatch-policy "$(PERF_ENV_MISMATCH_POLICY)" \
				--baseline-file "$(PERF_BASELINE_FILE)" \
				--init-baseline; \
	else \
		AYKEN_SCHED_FALLBACK="$(AYKEN_SCHED_FALLBACK)" \
		PERF_BASELINE_AUTHORITY="$(PERF_BASELINE_AUTHORITY)" \
		PERF_REQUIRE_CI_FOR_BASELINE_INIT="$(PERF_REQUIRE_CI_FOR_BASELINE_INIT)" \
		PERF_CI_IMAGE_DIGEST="$(PERF_CI_IMAGE_DIGEST)" \
		PERF_PREEMPT_BUILD_DEBUG_SCHED="$(PERF_PREEMPT_BUILD_DEBUG_SCHED)" \
		PERF_PREEMPT_BUILD_DEBUG_IRQ="$(PERF_PREEMPT_BUILD_DEBUG_IRQ)" \
		./scripts/ci/gate_performance.sh \
			--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/performance" \
			--kernel-profile "$(PERF_KERNEL_PROFILE)" \
			--qemu-timeout "$(PERF_QEMU_TIMEOUT)" \
			--env-mismatch-policy "$(PERF_ENV_MISMATCH_POLICY)" \
			--baseline-file "$(PERF_BASELINE_FILE)"; \
	fi
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/performance/report.json" "$(EVIDENCE_RUN_DIR)/reports/performance.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: performance evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-performance-local: ci-evidence-dir
	@echo "== CI GATE PERFORMANCE LOCAL =="
	@echo "run_id: $(RUN_ID)"
	@echo "perf_local_baseline_file: $(PERF_LOCAL_BASELINE_FILE)"
	@echo "perf_local_baseline_authority: $(PERF_LOCAL_BASELINE_AUTHORITY)"
	@echo "perf_local_ci_image_digest: $(PERF_LOCAL_CI_IMAGE_DIGEST)"
	@PERF_LOCAL_BASELINE_AUTHORITY="$(PERF_LOCAL_BASELINE_AUTHORITY)" \
		PERF_LOCAL_CI_IMAGE_DIGEST="$(PERF_LOCAL_CI_IMAGE_DIGEST)" \
		PERF_LOCAL_BOOT_THRESHOLD_PERCENT="$(PERF_LOCAL_BOOT_THRESHOLD_PERCENT)" \
		PERF_LOCAL_CONTEXT_THRESHOLD_PERCENT="$(PERF_LOCAL_CONTEXT_THRESHOLD_PERCENT)" \
		PERF_LOCAL_SYSCALL_THRESHOLD_PERCENT="$(PERF_LOCAL_SYSCALL_THRESHOLD_PERCENT)" \
		PERF_LOCAL_SAMPLE_SIZE="$(PERF_LOCAL_SAMPLE_SIZE)" \
		PERF_LOCAL_WARMUP_RUNS="$(PERF_LOCAL_WARMUP_RUNS)" \
		PERF_LOCAL_AGGREGATION="$(PERF_LOCAL_AGGREGATION)" \
		PERF_LOCAL_OUTLIER_POLICY="$(PERF_LOCAL_OUTLIER_POLICY)" \
		PERF_PREEMPT_BUILD_DEBUG_SCHED="$(PERF_PREEMPT_BUILD_DEBUG_SCHED)" \
		PERF_PREEMPT_BUILD_DEBUG_IRQ="$(PERF_PREEMPT_BUILD_DEBUG_IRQ)" \
		PERF_KERNEL_PROFILE="$(PERF_KERNEL_PROFILE)" \
		PERF_QEMU_TIMEOUT="$(PERF_QEMU_TIMEOUT)" \
		AYKEN_SCHED_FALLBACK="$(AYKEN_SCHED_FALLBACK)" \
		./scripts/ci/gate_performance_local.sh \
			--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/performance" \
			--kernel-profile "$(PERF_KERNEL_PROFILE)" \
			--qemu-timeout "$(PERF_QEMU_TIMEOUT)" \
			--baseline-file "$(PERF_LOCAL_BASELINE_FILE)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/performance/report.json" "$(EVIDENCE_RUN_DIR)/reports/performance.json"
	@if [ -f "$(EVIDENCE_RUN_DIR)/gates/performance-local-init/init-report.json" ]; then \
		cp -f "$(EVIDENCE_RUN_DIR)/gates/performance-local-init/init-report.json" "$(EVIDENCE_RUN_DIR)/reports/performance-local-init.json"; \
	fi
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: local performance evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-performance-stability: ci-evidence-dir
	@echo "== CI GATE PERFORMANCE STABILITY =="
	@echo "run_id: $(RUN_ID)"
	@echo "perf_stability_contract_file: $(PERF_STABILITY_CONTRACT_FILE)"
	@echo "perf_stability_profile: $(PERF_STABILITY_PROFILE)"
	@PERF_STABILITY_PROFILE="$(PERF_STABILITY_PROFILE)" \
		./scripts/ci/gate_performance_stability.sh \
			--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/performance-stability" \
			--source-gate-dir "$(EVIDENCE_RUN_DIR)/gates/performance" \
			--contract-file "$(PERF_STABILITY_CONTRACT_FILE)" \
			--contract-profile "$(PERF_STABILITY_PROFILE)"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/performance-stability/report.json" "$(EVIDENCE_RUN_DIR)/reports/performance-stability.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: performance-stability evidence at $(EVIDENCE_RUN_DIR)"

ci-gate-performance-learning-review: ci-evidence-dir
	@echo "== CI GATE PERFORMANCE LEARNING REVIEW =="
	@echo "run_id: $(RUN_ID)"
	@echo "perf_learning_source_glob: $(PERF_LEARNING_SOURCE_GLOB)"
	@PERF_LEARNING_SOURCE_GLOB="$(PERF_LEARNING_SOURCE_GLOB)" \
		./scripts/ci/gate_performance_learning_review.sh \
			--evidence-dir "$(EVIDENCE_RUN_DIR)/gates/performance-learning"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/performance-learning/report.json" "$(EVIDENCE_RUN_DIR)/reports/performance-learning.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: performance-learning evidence at $(EVIDENCE_RUN_DIR)"

perf-preempt-variance-local:
	@echo "== LOCAL PREEMPT VARIANCE =="
	@./scripts/ci/local_preempt_variance.sh \
		--runs "$(PERF_VARIANCE_RUNS)" \
		--warmup "$(PERF_VARIANCE_WARMUP)" \
		--qemu-timeout "$(PERF_VARIANCE_QEMU_TIMEOUT)" \
		--kernel-profile "$(PERF_KERNEL_PROFILE)" \
		--strict-markers "$(PERF_VARIANCE_STRICT_MARKERS)" \
		--force-efi-rebuild "$(PERF_VARIANCE_FORCE_EFI_REBUILD)"

# ============================================================
# Phase-15 BCIB Execution Engine v3 — Per-Workstream CI Gates
# Requirements: 13.3
# Each gate is independently runnable; PASS required before merge.
# Closure authority: only remote GitHub Actions ci-freeze PASS + HEAD SHA.
# ============================================================

# WS 3.1 — BCIB v3 Core: determinism + fail-closed + memory model
ci-gate-bcib-v3-core: ci-evidence-dir
	@echo "== CI GATE BCIB V3 CORE (WS 3.1) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: determinism + fail-closed + memory model + state machine + lifecycle"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/bcib-v3-core"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p bcib-runtime --lib -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/bcib-v3-core/test.log"'
	@echo '{"gate":"bcib-v3-core","workstream":"WS3.1","verdict":"PASS","scope":"determinism+fail-closed+memory-model"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/bcib-v3-core/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/bcib-v3-core/report.json" "$(EVIDENCE_RUN_DIR)/reports/bcib-v3-core.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: bcib-v3-core evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.9 — Toolchain/Opcode Registry: opcode ID lock + golden fixture
ci-gate-toolchain-opcode-registry: ci-evidence-dir
	@echo "== CI GATE TOOLCHAIN OPCODE REGISTRY (WS 3.9) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: opcode ID lock + golden fixture + version compatibility"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/toolchain-opcode-registry"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p bcib-runtime opcode -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/toolchain-opcode-registry/opcode.log"'
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p bcib-runtime compat -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/toolchain-opcode-registry/compat.log"'
	@echo '{"gate":"toolchain-opcode-registry","workstream":"WS3.9","verdict":"PASS","scope":"opcode-id-lock+golden-fixture"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/toolchain-opcode-registry/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/toolchain-opcode-registry/report.json" "$(EVIDENCE_RUN_DIR)/reports/toolchain-opcode-registry.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: toolchain-opcode-registry evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.7 — Capability Manager: token-based, no bypass
ci-gate-capability-manager: ci-evidence-dir
	@echo "== CI GATE CAPABILITY MANAGER (WS 3.7) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: token-based capability enforcement, no kernel bypass"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/capability-manager"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p bcib-runtime capability -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/capability-manager/test.log"'
	@echo '{"gate":"capability-manager","workstream":"WS3.7","verdict":"PASS","scope":"token-based+no-bypass"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/capability-manager/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/capability-manager/report.json" "$(EVIDENCE_RUN_DIR)/reports/capability-manager.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: capability-manager evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.2 — DSL → BCIB IR golden fixture contract
ci-gate-dsl-bcib-contract: ci-evidence-dir
	@echo "== CI GATE DSL BCIB CONTRACT (WS 3.2) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: DSL -> BCIB IR golden fixture"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/dsl-bcib-contract"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p dsl-parser -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/dsl-bcib-contract/test.log"'
	@echo '{"gate":"dsl-bcib-contract","workstream":"WS3.2","verdict":"PASS","scope":"dsl-to-bcib-ir-golden-fixture"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/dsl-bcib-contract/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/dsl-bcib-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/dsl-bcib-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: dsl-bcib-contract evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.3 — Semantic CLI → DSL regression contract
ci-gate-semantic-cli-contract: ci-evidence-dir
	@echo "== CI GATE SEMANTIC CLI CONTRACT (WS 3.3) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: CLI -> DSL regression"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/semantic-cli-contract"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p semantic-cli -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/semantic-cli-contract/test.log"'
	@echo '{"gate":"semantic-cli-contract","workstream":"WS3.3","verdict":"PASS","scope":"cli-to-dsl-regression"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/semantic-cli-contract/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/semantic-cli-contract/report.json" "$(EVIDENCE_RUN_DIR)/reports/semantic-cli-contract.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: semantic-cli-contract evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.5 — Data Runtime: BCIB-mediated data query
ci-gate-data-runtime-bcib: ci-evidence-dir
	@echo "== CI GATE DATA RUNTIME BCIB (WS 3.5) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: data query via BCIB execution engine"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/data-runtime-bcib"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p bcib-runtime data -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/data-runtime-bcib/test.log"'
	@echo '{"gate":"data-runtime-bcib","workstream":"WS3.5","verdict":"PASS","scope":"bcib-data-query"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/data-runtime-bcib/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/data-runtime-bcib/report.json" "$(EVIDENCE_RUN_DIR)/reports/data-runtime-bcib.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: data-runtime-bcib evidence at $(EVIDENCE_RUN_DIR)"

# WS 3.6 — AI Runtime: suggestion-only, capability-gated boundary
ci-gate-ai-runtime-boundary: ci-evidence-dir
	@echo "== CI GATE AI RUNTIME BOUNDARY (WS 3.6) =="
	@echo "run_id: $(RUN_ID)"
	@echo "scope: suggestion-only, capability-gated, no decision authority"
	@mkdir -p "$(EVIDENCE_RUN_DIR)/gates/ai-runtime-boundary"
	@bash -lc 'set -euo pipefail; cd "$(CURDIR)/$(USERSPACE_RUST_DIR)" && cargo test -p ai-runtime -- --test-threads=1 2>&1 | tee "$(abspath $(EVIDENCE_RUN_DIR))/gates/ai-runtime-boundary/test.log"'
	@echo '{"gate":"ai-runtime-boundary","workstream":"WS3.6","verdict":"PASS","scope":"suggestion-only+capability-gated"}' \
		> "$(EVIDENCE_RUN_DIR)/gates/ai-runtime-boundary/report.json"
	@cp -f "$(EVIDENCE_RUN_DIR)/gates/ai-runtime-boundary/report.json" "$(EVIDENCE_RUN_DIR)/reports/ai-runtime-boundary.json"
	@$(MAKE) ci-summarize RUN_ID=$(RUN_ID) EVIDENCE_ROOT=$(EVIDENCE_ROOT)
	@echo "OK: ai-runtime-boundary evidence at $(EVIDENCE_RUN_DIR)"

# Phase-15 workstream gate suite (all WS gates, excluding ci-freeze governance)
ci-gate-phase15-workstreams: \
	ci-gate-bcib-v3-core \
	ci-gate-toolchain-opcode-registry \
	ci-gate-capability-manager \
	ci-gate-proofd-observability-boundary \
	ci-gate-dsl-bcib-contract \
	ci-gate-semantic-cli-contract \
	ci-gate-data-runtime-bcib \
	ci-gate-ai-runtime-boundary \
	ci-gate-workspace
	@echo "== Phase-15 workstream gates: ALL PASS =="

# Stability and safety targets
freeze-stable:
	@echo "Creating stable checkpoint..."
	@git tag -a "phase2-stable-$(shell date +%Y%m%d)" -m "Phase 2 stable checkpoint"
	@git branch stable-phase2-backup 2>/dev/null || true
	@echo "Stable checkpoint created. Use 'make restore-stable' to rollback if needed."

restore-stable:
	@echo "Restoring to last stable checkpoint..."
	@git checkout stable-phase2-backup
	@echo "Restored to stable state."

validate-stability: validate-build validate-qemu
	@echo "Running stability validation..."
	@echo "Boot sequence: Testing..."
	@$(MAKE) run > stability_test.log 2>&1 &
	@sleep 5
	@pkill qemu-system-x86_64 2>/dev/null || true
	@if grep -q "Kernel loaded" stability_test.log; then \
		echo "Stability validation: PASS - Boot sequence stable"; \
	else \
		echo "Stability validation: FAIL - Boot issues detected"; \
		exit 1; \
	fi

# Help target
help:
	@echo "AykenOS Build System - Available targets:"
	@echo ""
	@echo "Build targets:"
	@echo "  all          - Build kernel and bootloader"
	@echo "  kernel       - Build kernel only"
	@echo "  bootloader   - Build UEFI bootloader only"
	@echo "  release      - Build all with KERNEL_PROFILE=release"
	@echo "  validation   - Build all with KERNEL_PROFILE=validation"
	@echo "  validation-strict - Validation build with -Werror"
	@echo "  userspace-runtime - Build userspace dispatcher (bcib-runtime/bin/dispatcher)"
	@echo "  efi-img      - Create EFI disk image"
	@echo "  clean        - Clean build artifacts"
	@echo ""
	@echo "Development targets:"
	@echo "  dev          - Quick build and test cycle"
	@echo "  run          - Build and run in QEMU"
	@echo "  run-preempt  - Validation profile preempt test runner"
	@echo "  run-preempt-strict - Validation preempt runner with STRICT_MARKERS=1"
	@echo "  setup        - Set up development environment"
	@echo ""
	@echo "Validation targets:"
	@echo "  validate               - Run all validations"
	@echo "  validate-toolchain     - Check required tools"
	@echo "  validate-build         - Test build system"
	@echo "  validate-qemu          - Test QEMU boot"
	@echo "  validate-qemu-env      - QEMU environment validation (Task 1.5.1.3)"
	@echo "  validate-qemu-integration - Comprehensive QEMU integration tests"
	@echo "  validate-full          - Complete validation suite"
	@echo ""
	@echo "Dependency targets:"
	@echo "  check-deps   - Check for required tools"
	@echo "  install-deps - Install missing dependencies"
	@echo ""
	@echo "CI/CD targets:"
	@echo "  pre-ci       - Local discipline check (4 gates, ~30-60s)"
	@echo "                 Core: ABI, Boundary, Hygiene, Constitutional"
	@echo "                 Advisory only. CI remains mandatory."
	@echo "  ci           - Current CI chain (boundary + hygiene + validate-full)"
	@echo "  ci-freeze    - Strict freeze suite (all implemented gates)"
	@echo "  phase12-official-closure-prep - Generate Phase-12 official closure candidate artifacts"
	@echo "  phase12-official-closure-preflight - Validate local official closure readiness and write blocker report"
	@echo "  phase12-official-closure-execute - Fail-closed local official closure execution preflight"
	@echo "    (hard guard: AYKEN_SCHED_FALLBACK must be 0)"
	@echo "  ci-gate-boundary - Boundary symbol scan gate with evidence output"
	@echo "  ci-gate-ring0-exports - Link-time Ring0 export surface gate (nm + whitelist + max count)"
	@echo "  ci-gate-hygiene - Repo hygiene gate with evidence output"
	@echo "  ci-gate-tooling-isolation - Fail-closed guard: perf/preempt tooling PRs cannot touch kernel/"
	@echo "  ci-gate-constitutional - Constitutional freeze gate (ABI/boundary/export/contracts hard-lock)"
	@echo "  ci-gate-governance-policy - Policy gate (source deny + AHS thresholds + waiver audit)"
	@echo "    (profile selector: GOVERNANCE_POLICY_KERNEL_PROFILE=validation)"
	@echo "  ci-gate-naming-convention - Diff-scoped naming freeze gate for new execution-path additions"
	@echo "    (diff selector: NAMING_DIFF_RANGE=<git-range>, skips when no scoped changes exist)"
	@echo "  ci-gate-drift-activation - Phase-9 drift blocking activation requirement enforcement"
	@echo "  ci-gate-structural-abi - Gate-5A permanent ABI constitution lock (layout + semver policy)"
	@echo "  ci-gate-runtime-marker-contract - Gate-5B phase-scoped marker contract lock (format + anchors + semver)"
	@echo "    (toggle: RUNTIME_MARKER_CONTRACT_ENFORCE=0 to disable phase-scoped marker lock)"
	@echo "  ci-gate-user-bin-lock - Generated userspace binary hash-lock gate (user.bin drift detection)"
	@echo "  ci-gate-embedded-elf-hash - Embedded ELF SHA256 consistency gate (header hash == built ELF hash)"
	@echo "  ci-gate-structural-constitution - Composite alias: structural-abi + runtime-marker-contract"
	@echo "    (override strict locally: CONSTITUTIONAL_STRICT=0)"
	@echo "  ci-gate-behavioral-suite - Gate-6 behavioral proof suite (phase-driven)"
	@echo "    (phase selector: BEHAVIORAL_SUITE_PHASE=5 by default)"
	@echo "  ci-gate-ring3-execution-phase10a2 - Strict Phase10 scheduler+syscall+Ring3 marker-order gate"
	@echo "  ci-gate-ring3-user-leaf-rule - Deterministic executable-leaf witness/probe/source guard gate"
	@echo "    (controls: RING3_QEMU_TIMEOUT, enforced: AYKEN_CR3_PCID=0)"
	@echo "    (bootstrap mode: AYKEN_SCHED_BOOTSTRAP_POLICY=0 strict default, 1 transitional override)"
	@echo "  ci-gate-syscall-semantics-phase10b - Phase10-B syscall boundary semantic state-machine gate"
	@echo "    (controls: PHASE10B_MODE=negative|positive)"
	@echo "    (A2 evidence override: PHASE10B_A2_EVIDENCE_DIR=<path>)"
	@echo "    (note: positive mode requires a CAP-free runtime scenario)"
	@echo "  ci-gate-low-half-kheap-scaffold - Phase10 visibility gate for the temporary low-half kernel-heap compatibility mirror"
	@echo "    (PASS-while-active only if the scaffold remains explicit, bounded, documented, and proven by same-run multi-point A2 runtime evidence)"
	@echo "    (override: LOW_HALF_KHEAP_A2_EVIDENCE_DIR=<path>)"
	@echo "  ci-gate-low-half-kheap-exit-proof - Validation-only terminal exit proof for the low-half scaffold temporal runtime contract"
	@echo "    (builds with AYKEN_LOW_HALF_KHEAP_EXIT_PROOF_SELFTEST=1 and requires exit_teardown_pre/post runtime evidence)"
	@echo "    (timeout override: LOW_HALF_KHEAP_EXIT_PROOF_QEMU_TIMEOUT=<sec>)"
	@echo "  ci-gate-low-half-kheap-multi-exit-proof - Validation-only multi-exit coverage proof for low-half scaffold teardown lineage"
	@echo "    (builds with AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_SELFTEST=1 and requires authoritative lineage witnesses for each exit_pid)"
	@echo "    (override count: AYKEN_LOW_HALF_KHEAP_MULTI_EXIT_PROOF_COUNT=<n>; default 2)"
	@echo "    (timeout override: LOW_HALF_KHEAP_MULTI_EXIT_PROOF_QEMU_TIMEOUT=<sec>)"
	@echo "  ci-gate-low-half-kheap-interleaving-proof - Validation-only overlap-pressure proof for precreated low-half scaffold teardown lineage"
	@echo "    (builds with AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_SELFTEST=1 and requires every exit_pid to be prepared before first lineage)"
	@echo "    (override count: AYKEN_LOW_HALF_KHEAP_INTERLEAVING_PROOF_COUNT=<n>; default 2)"
	@echo "    (timeout override: LOW_HALF_KHEAP_INTERLEAVING_PROOF_QEMU_TIMEOUT=<sec>)"
	@echo "  ci-gate-scheduler-mailbox-phase10c - Phase10-C scheduler mailbox policy/mechanism gate (draft)"
	@echo "    (controls: PHASE10C_REQUIRE_METADATA=0|1, PHASE10C_C2_STRICT=0|1, PHASE10C_C2_OWNER_SET=csv, PHASE10C_C2_REQUIRE_CURSOR_MARKER=0|1)"
	@echo "    (A2 evidence override: PHASE10C_A2_EVIDENCE_DIR=<path>)"
	@echo "    (ci-freeze default: PHASE10C_ENFORCE=1 + PHASE10C_C2_STRICT=1; local freeze default: PHASE10C_C2_STRICT=0)"
	@echo "  ci-gate-no-low-half-kernel-dependency - Phase11 closure blocker for any active low-half kernel-heap scaffold"
	@echo "    (hard-fails while the temporary scaffold remains active; consumes same-run A2 runtime evidence)"
	@echo "    (override: LOW_HALF_KHEAP_A2_EVIDENCE_DIR=<path>)"
	@echo "  ci-gate-mailbox-capability-negative - P11-01 mailbox capability fail-closed negative matrix gate"
	@echo "    (artifacts: negative_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-ledger-completeness - P11-02 decision ledger completeness/materialization gate"
	@echo "    (controls: PHASE11_LEDGER_REQUIRE_ETI=0|1, PHASE11_LEDGER_ETI_EVENTS=<path>)"
	@echo "    (artifacts: decision_ledger.bin, decision_ledger.jsonl, report.json, violations.txt)"
	@echo "    (note: set PHASE11_LEDGER_REQUIRE_ETI=1 after ETI integration (#43))"
	@echo "  ci-gate-ledger-integrity - P11-03 ledger hash-chain integrity gate"
	@echo "    (artifacts: chain_verify.json, tamper_test.json, report.json, violations.txt)"
	@echo "  ci-gate-hash-chain-validity - Alias of ci-gate-ledger-integrity"
	@echo "  ci-gate-deol-sequence - P11-10 DEOL bootstrap ordering gate"
	@echo "    (controls: PHASE11_DEOL_LEDGER_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: event_seq.jsonl, sequence_report.json, report.json, violations.txt)"
	@echo "  ci-gate-eti-sequence - P11-13 ETI bootstrap transcript gate"
	@echo "    (controls: PHASE11_ETI_A2_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: eti_transcript.bin, eti_transcript.jsonl, eti_chain_verify.json, eti_diff.txt, report.json, violations.txt)"
	@echo "  ci-gate-ledger-eti-binding - P11-13 strict ledger<->ETI event_seq/ltick binding gate"
	@echo "    (controls: PHASE11_LEDGER_ETI_LEDGER_EVIDENCE_DIR=<path>, PHASE11_LEDGER_ETI_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: binding_report.json, report.json, violations.txt)"
	@echo "  ci-gate-transcript-integrity - P11-13 transcript integrity gate"
	@echo "    (controls: PHASE11_ETI_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: report.json, violations.txt)"
	@echo "  ci-gate-dlt-monotonicity - P11-14 DLT bootstrap ltick monotonicity gate"
	@echo "    (controls: PHASE11_DLT_ETI_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: ltick_trace.jsonl, report.json, violations.txt)"
	@echo "  ci-gate-eti-dlt-binding - P11-14 strict ETI<->DLT source event_seq/ltick binding gate"
	@echo "    (controls: PHASE11_ETI_DLT_EVIDENCE_DIR=<path>, PHASE11_ETI_DLT_DLT_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: binding_report.json, report.json, violations.txt)"
	@echo "  ci-gate-dlt-determinism - P11-14 bootstrap reproducibility gate (same ETI -> same DLT trace hash)"
	@echo "    (controls: PHASE11_DLT_DETERMINISM_ETI_EVIDENCE_DIR=<path>)"
	@echo "    (artifacts: ltick_trace_a.jsonl, ltick_trace_b.jsonl, dlt_determinism_report.json, report.json, violations.txt)"
	@echo "  ci-gate-gcp-finalization - P11-15 GCP bootstrap finalization contract gate"
	@echo "    (controls: PHASE11_GCP_DLT_EVIDENCE_DIR=<path>, PHASE11_GCP_PREVIOUS_SNAPSHOT=<path>)"
	@echo "    (artifacts: gcp_snapshot.json, gcp_record.json, gcp_consistency_report.json, report.json, violations.txt)"
	@echo "  ci-gate-gcp-atomicity - Alias of ci-gate-gcp-finalization"
	@echo "  ci-gate-gcp-ordering - Alias of ci-gate-gcp-finalization"
	@echo "  ci-gate-abdf-snapshot-identity - P11-17 ABDF replay snapshot identity gate"
	@echo "    (controls: PHASE11_ABDF_SNAPSHOT_BIN=<path>, PHASE11_ABDF_EXPECTED_HASH_FILE=<path>)"
	@echo "    (artifacts: abdf_snapshot_hash.txt, snapshot_identity_report.json, snapshot_identity_consistency.json, report.json, violations.txt)"
	@echo "  ci-gate-bcib-trace-identity - P11-18 BCIB plan + execution trace identity gate"
	@echo "    (controls: PHASE11_BCIB_PLAN_BIN=<path>, PHASE11_BCIB_ETI_EVIDENCE_DIR=<path>, PHASE11_BCIB_EXPECTED_PLAN_HASH_FILE=<path>, PHASE11_BCIB_EXPECTED_TRACE_HASH_FILE=<path>)"
	@echo "    (artifacts: bcib_plan_hash.txt, execution_trace.jsonl, execution_trace_hash.txt, trace_verify.json, report.json, violations.txt)"
	@echo "  ci-gate-execution-identity - Alias of ci-gate-bcib-trace-identity"
	@echo "  ci-gate-replay-determinism - P11-04 replay parity gate over ABDF+BCIB execution identity"
	@echo "    (controls: PHASE11_REPLAY_ABDF_EVIDENCE_DIR=<path>, PHASE11_REPLAY_EXECUTION_EVIDENCE_DIR=<path>, PHASE11_REPLAY_EXPECTED_FINAL_STATE_HASH_FILE=<path>)"
	@echo "    (artifacts: replay_trace.jsonl, replay_trace_hash.txt, replay_report.json, event_diff.txt, ltick_diff.txt, report.json, violations.txt)"
	@echo "  ci-gate-replay-v1 - Alias of ci-gate-replay-determinism"
	@echo "  ci-gate-kpl-proof-verify - P11-11 KPL bootstrap proof manifest verification gate"
	@echo "    (controls: PHASE11_KPL_* vars for abdf/execution/replay/ledger/eti evidence, kernel image, config, expected proof/final-state hashes)"
	@echo "    (artifacts: proof_manifest.json, proof_verify.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-manifest - Alias of ci-gate-kpl-proof-verify"
	@echo "  ci-gate-proof-bundle - P11-42 bootstrap proof bundle portability gate"
	@echo "    (controls: PHASE11_BUNDLE_* vars for identity/replay/kpl evidence, kernel image, summary, meta)"
	@echo "    (artifacts: proof_bundle/, bundle_verify.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-portability - Alias of ci-gate-proof-bundle"
	@echo "  ci-gate-proof-producer-schema - P12-01 producer identity schema gate"
	@echo "    (artifacts: producer_schema_report.json, producer_identity_examples.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-signature-envelope - P12-02 detached signature envelope schema gate"
	@echo "    (artifacts: signature_envelope_report.json, identity_stability_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-bundle-v2-schema - P12-03 bundle v2 layout/schema gate"
	@echo "    (artifacts: bundle_schema_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-bundle-v2-compat - P12-03 bundle v2 compatibility gate"
	@echo "    (artifacts: compatibility_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-signature-verify - P12-04 detached signature verification gate"
	@echo "    (artifacts: signature_verify.json, registry_resolution_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-registry-resolution - P12-05 registry resolution gate"
	@echo "    (artifacts: registry_snapshot.json, registry_resolution_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-key-rotation - P12-06 key rotation/revocation gate"
	@echo "    (artifacts: rotation_matrix.json, revocation_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-verifier-core - P12-07 verifier core determinism gate"
	@echo "    (artifacts: verifier_core_report.json, determinism_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-trust-policy - P12-08 trust policy schema/hash gate"
	@echo "    (artifacts: policy_schema_report.json, policy_hash_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-verdict-binding - P12-09 verdict subject binding gate"
	@echo "    (artifacts: verdict_binding_report.json, verdict_subject_examples.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-verifier-cli - P12-10 thin offline verifier CLI gate"
	@echo "    (artifacts: cli_smoke_report.json, cli_output_contract.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-receipt - P12-11 signed verification receipt gate"
	@echo "    (artifacts: receipt_schema_report.json, receipt_emit_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-audit-ledger - P12-12 append-only verification audit ledger gate"
	@echo "    (artifacts: verification_audit_ledger.jsonl, audit_integrity_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-exchange - P12-13 proof bundle exchange transport contract gate"
	@echo "    (artifacts: exchange_contract_report.json, transport_mutation_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-verifier-authority-resolution - P12 authority graph / deterministic authority resolution gate"
	@echo "    (artifacts: authority_resolution_report.json, authority_chain_report.json, report.json, violations.txt)"
	@echo "  ci-gate-cross-node-parity - P12 distributed parity failure-matrix gate"
	@echo "    (artifacts: parity_report.json, parity_closure_audit_report.json, failure_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-proofd-service - P12-16 read-only proofd diagnostics service gate"
	@echo "    (artifacts: proofd_service_report.json, proofd_receipt_report.json, proofd_endpoint_contract.json, proofd_verify_request.json, proofd_verify_response.json, proofd_run_manifest.json, proofd_receipt_verification_report.json, proofd_repeated_execution_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proofd-schema-coverage - Phase14 gate requiring explicit schema coverage declarations for public proofd diagnostics endpoints"
	@echo "    (artifacts: proofd_schema_coverage_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proofd-observability-boundary - Phase13 boundary gate locking proofd diagnostics namespace"
	@echo "    (artifacts: proofd_observability_boundary_report.json, proofd_observability_negative_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-graph-non-authoritative-contract - Phase13 boundary gate blocking graph truth inference"
	@echo "    (artifacts: graph_non_authoritative_report.json, report.json, violations.txt)"
	@echo "  ci-gate-convergence-non-election-boundary - Phase13 boundary gate blocking convergence election semantics"
	@echo "    (artifacts: convergence_non_election_report.json, report.json, violations.txt)"
	@echo "  ci-gate-diagnostics-consumer-non-authoritative-contract - Phase13 boundary gate blocking descriptive diagnostics from becoming execution input"
	@echo "    (artifacts: diagnostics_consumer_contract_report.json, report.json, violations.txt)"
	@echo "  ci-gate-diagnostics-callsite-correlation - Phase13 boundary gate blocking descriptive diagnostics from flowing into decision call sites"
	@echo "    (artifacts: diagnostics_callsite_correlation_report.json, report.json, violations.txt)"
	@echo "  ci-gate-observability-routing-separation - Phase13 boundary gate enforcing routing blindness against observability artifacts"
	@echo "    (artifacts: observability_routing_separation_report.json, observability_routing_negative_matrix.json, report.json, violations.txt)"
	@echo "  ci-gate-verification-determinism-contract - Phase13 gate blocking ambient verifier dependencies"
	@echo "    (artifacts: verification_determinism_contract_report.json, report.json, violations.txt)"
	@echo "  ci-gate-determinism-replay-consistency - Phase14 proofd replay consistency gate enforcing determinism contract vs internal replay"
	@echo "    (artifacts: determinism_replay_consistency_report.json, internal_replay_output.json, report.json, violations.txt)"
	@echo "  ci-gate-verifier-reputation-prohibition - Phase13 boundary gate blocking hidden verifier scoring"
	@echo "    (artifacts: reputation_prohibition_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-multisig-quorum - P12-15 multisignature / N-of-M quorum gate"
	@echo "    (artifacts: quorum_matrix.json, quorum_evaluator_report.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-replay-admission-boundary - P12-17 replay admission boundary gate"
	@echo "    (artifacts: replay_admission_report.json, boundary_contract.json, report.json, violations.txt)"
	@echo "  ci-gate-proof-replicated-verification-boundary - P12-18 replicated verification boundary gate"
	@echo "    (artifacts: research_boundary_note.md, phase13_bridge_report.json, report.json, violations.txt)"
	@echo "  phase12-official-closure-prep - Generate closure manifest + evidence index for the Phase-12 local closure-ready run"
	@echo "    (controls: PHASE12_CLOSURE_RUN_DIR, PHASE12_CLOSURE_OUTPUT_DIR, PHASE12_CLOSURE_ATTESTOR_*)"
	@echo "  phase12-closure - Alias for phase12-official-closure-prep"
	@echo "  ci-gate-workspace - Workspace determinism/repro/linkset gate (override: WORKSPACE_STRICT=0)"
	@echo "  ci-gate-syscall-v2-runtime - Runtime syscall v2 contract gate (Ring3 -> int80 -> Ring0)"
	@echo "    (controls: SYSCALL_V2_RUNTIME_* vars)"
	@echo "  ci-gate-policy-accept - Gate-4 isolated policy accept proof gate"
	@echo "  ci-gate-decision-switch-phase45 - Gate-4.5 decision->switch proof gate"
	@echo "    (controls: GATE45_QEMU_TIMEOUT, GATE45_BOOTSTRAP_POLICY, GATE45_MB_SELFTEST, GATE45_C2_STRICT=0|1, GATE45_C2_OWNER_PID=<pid>)"
	@echo "  ci-gate-policy-proof-regression - Composite regression suite: Gate-4 then Gate-4.5"
	@echo "  ci-summarize - Summarize discovered gate reports, emit kill-switch category summary, and enforce PASS"
	@echo "  ci-kill-switch-summary - Require full architectural kill-switch gate coverage for an existing run"
	@echo "  ci-gate-verification-diversity-floor - Collapse-horizon harness over Verification Diversity Ledger evidence"
	@echo "  ci-gate-verifier-cartel-correlation - Stage-1 collapse-horizon harness for verifier independence and cartel correlation"
	@echo "  ci-gate-authority-sinkhole-absorption - Stage-1 collapse-horizon harness for authority basin absorption and sinkhole drift"
	@echo "  ci-produce-verification-diversity-ledger - Produce / append canonical VDL entries from verifier audit evidence"
	@echo "  ci-produce-authority-sinkhole-companion-flows - Materialize canonical replay-boundary and trust-reuse Stage-2 sinkhole companion flow reports"
	@echo "  ci-gate-abi - ABI drift gate (use ABI_INIT_BASELINE=1 for explicit first baseline write)"
	@echo "  ci-gate-performance - Performance baseline/env hash gate"
	@echo "    (use PERF_INIT_BASELINE=1 for first baseline write)"
	@echo "    (authority/digest: PERF_BASELINE_AUTHORITY, PERF_CI_IMAGE_DIGEST)"
	@echo "    (intentional regression test only: AYKEN_INTENTIONAL_PERF_REGRESSION_MS=<ms>)"
	@echo "    (scheduler fallback policy: AYKEN_SCHED_FALLBACK=0 for freeze)"
	@echo "  ci-gate-performance-local - Local performance gate with auto-init local baseline authority"
	@echo "    (sampling overrides: PERF_LOCAL_SAMPLE_SIZE, PERF_LOCAL_WARMUP_RUNS, PERF_LOCAL_AGGREGATION, PERF_LOCAL_OUTLIER_POLICY)"
	@echo "  ci-gate-performance-stability - Stability gate over sampled performance-local evidence"
	@echo "    (contract overrides: PERF_STABILITY_CONTRACT_FILE, PERF_STABILITY_PROFILE)"
	@echo "  ci-gate-performance-learning-review - Non-authoritative split-metric learning review over clean performance reports"
	@echo "    (source glob: PERF_LEARNING_SOURCE_GLOB)"
	@echo "  Linker export policy: KERNEL_EXPORT_POLICY=1 (default, constitutional mode)"
	@echo "  perf-preempt-variance-local - Local preempt determinism harness (mean/stdev/cv)"
	@echo "    (overrides: PERF_VARIANCE_* vars, PERF_KERNEL_PROFILE)"
	@echo "  help         - Show this help message"

.PHONY: check-deps install-deps validate validate-toolchain validate-build validate-qemu validate-qemu-env validate-qemu-integration validate-full setup dev ci ci-freeze ci-freeze-local ci-freeze-guard preflight-mode-guard ci-evidence-dir ci-gate-boundary ci-gate-ring0-exports ci-summarize ci-kill-switch-summary ci-gate-abi ci-gate-workspace ci-gate-hygiene ci-gate-tooling-isolation ci-gate-constitutional ci-gate-governance-policy ci-gate-naming-convention ci-gate-test-naming ci-gate-error-codes ci-gate-kernel-test-pipeline ci-kernel-tests ci-gate-drift-activation ci-gate-structural-abi ci-gate-runtime-marker-contract ci-gate-user-bin-lock ci-gate-embedded-elf-hash ci-gate-structural-constitution ci-gate-syscall-v2-runtime ci-gate-sched-bridge-runtime ci-gate-behavioral-suite ci-gate-ring3-user-leaf-rule ci-gate-ring3-execution-phase10a2 ci-gate-syscall-semantics-phase10b ci-gate-low-half-kheap-scaffold ci-gate-low-half-kheap-exit-proof ci-gate-low-half-kheap-multi-exit-proof ci-gate-low-half-kheap-interleaving-proof ci-gate-scheduler-mailbox-phase10c ci-gate-no-low-half-kernel-dependency ci-gate-mailbox-capability-negative ci-gate-ledger-completeness ci-gate-ledger-integrity ci-gate-hash-chain-validity ci-gate-deol-sequence ci-gate-eti-sequence ci-gate-ledger-eti-binding ci-gate-transcript-integrity ci-gate-dlt-monotonicity ci-gate-eti-dlt-binding ci-gate-dlt-determinism ci-gate-gcp-finalization ci-gate-gcp-atomicity ci-gate-gcp-ordering ci-gate-abdf-snapshot-identity ci-gate-bcib-trace-identity ci-gate-execution-identity ci-gate-replay-determinism ci-gate-replay-v1 ci-gate-kpl-proof-verify ci-gate-proof-manifest ci-gate-proof-bundle ci-gate-proof-portability ci-gate-proof-producer-schema ci-gate-proof-signature-envelope ci-gate-proof-bundle-v2-schema ci-gate-proof-bundle-v2-compat ci-gate-proof-signature-verify ci-gate-proof-registry-resolution ci-gate-proof-key-rotation ci-gate-proof-verifier-core ci-gate-proof-trust-policy ci-gate-proof-verdict-binding ci-gate-proof-verifier-cli ci-gate-proof-receipt ci-gate-proof-audit-ledger ci-gate-proof-exchange ci-gate-verifier-authority-resolution ci-gate-cross-node-parity ci-gate-proofd-service ci-gate-proofd-schema-coverage ci-gate-proofd-observability-boundary ci-gate-graph-non-authoritative-contract ci-gate-convergence-non-election-boundary ci-gate-diagnostics-consumer-non-authoritative-contract ci-gate-diagnostics-callsite-correlation ci-gate-observability-routing-separation ci-gate-verification-diversity-floor ci-gate-verifier-cartel-correlation ci-gate-authority-sinkhole-absorption ci-produce-verification-diversity-ledger ci-produce-authority-sinkhole-companion-flows ci-gate-verification-determinism-contract ci-gate-determinism-replay-consistency ci-gate-verifier-reputation-prohibition ci-gate-proof-multisig-quorum ci-gate-proof-replay-admission-boundary ci-gate-proof-replicated-verification-boundary phase12-official-closure-prep phase12-official-closure-preflight phase12-official-closure-execute phase12-closure ci-gate-policy-accept ci-gate-decision-switch-phase45 ci-gate-policy-proof-regression ci-gate-performance ci-gate-performance-local ci-gate-performance-stability ci-gate-performance-learning-review perf-preempt-variance-local generate-abi help ci-gate-bcib-v3-core ci-gate-toolchain-opcode-registry ci-gate-capability-manager ci-gate-dsl-bcib-contract ci-gate-semantic-cli-contract ci-gate-data-runtime-bcib ci-gate-ai-runtime-boundary ci-gate-phase15-workstreams

# UEFI bootloader assembly sources (.S)
$(BOOTLOADER_DIR)/%.efi.o: $(BOOTLOADER_DIR)/%.S
	$(EFI_CC) $(EFI_CFLAGS) -c $< -o $@