cmd/

Command acceptance-guard-preflight is the activation entry point for internal/acceptanceharness's ambient-credential guard: run it before any acceptance suite starts (see mise.toml's test-acceptance-fast task).

Command acceptance-style-guard fails if any acceptance_test.go or *_acceptance_test.go under the module root does not import github.com/onsi/ginkgo/v2 and reference a Ginkgo suite/spec API, except an explicit allowlist (see internal/acceptancestyle).

Command coach is the composition-root CLI for the coach project.

Command coach-api is the composition-root HTTP service for the coach platform: it wires internal/authn (Coach JWT auth, optional GitHub OAuth login, config-gated test mint) and internal/coachapi (POST /v1/jobs, GET /v1/jobs/{id}, GET /v1/jobs/{id}/report) behind a live authz.RepoAuthorizer and a Redis Streams queue.TaskQueue into one runnable server.

Command coach-worker claims work through queue.TaskQueue, persists claim/heartbeat/fenced writes via coachapi.WorkerJobStore, and runs the repo_baseline_scan handler.

Command codesignal-report reads a batch of NDJSON lines from stdin, accumulates a single codesignal.Input, and writes exactly one JSON codesignal.Report to stdout.

Command fakegithub-server runs internal/fakegithub as a standalone HTTP process, packaging the issue #79 Task 0.3 thin-offline-proof fixture (internal/acceptanceharness/thinproof) as an internal-network Compose service rather than an in-process httptest.Server.

Command model-stub serves the compose OpenAI-compatible HTTP stub from internal/modelgateway so core smoke can exercise worker → Envoy AI Gateway → backend without model weights.

Command platform-smoke is the end-to-end credential-free smoke for the local platform compose stack (Baseline Scan Story 4 / Task 10): mint → submit repo_baseline_scan → poll → assert provenance-tagged report.

Command semantics-json exposes internal/jsbridge as a long-running newline-delimited-JSON server on stdin/stdout, so non-Go hosts (the js/semantics package) can call pkg/semantics without linking CGO themselves.

Stub entry point so `go build ./...` / `go vet ./...` on native platforms don't fail with "build constraints exclude all Go files".

Command source-layout-guard fails if any Go file under the module root is named, or declares identifiers named, by position or hash rather than by responsibility (see internal/sourcelayout and ADR-007).

Command thinproof-preflight is the no-pull/offline Compose preflight for issue #79's Task 0.3 thin offline proof (see docs/architecture/acceptance-harness.md section 2's binding contract): it checks, via `docker image inspect`, that the two local images deploy/compose/thinproof's docker-compose.yml expects already exist, before any `docker compose up` runs.

Command thinproof-runner is the external test-runner container for issue #79's Task 0.3 thin offline proof: it exercises the fake-GitHub -> pkg/githubingest -> pkg/semantics -> pkg/codesignal path against a fake GitHub service reachable only at FAKE_GITHUB_BASE_URL (e.g.