tools/

Command agentsmap regenerates the repository's AGENTS.md map: one root page carrying docs/STANDARD.md whole, plus a page per big tree, each a table of directory → purpose → guarding test → one command.

Command benchstandard is the acceptance WITNESS for a Linux bench: it checks the bench it runs on against the standard and prints one DRIFT line per finding.

Command ci holds the verbs this repository's own CI and Makefile call: the programs that were shell steps and scripts, in Go, each with a test that pins what it does.

clidoc rewrites the reference blocks between docs/CLI.md's clidoc markers from the built tools' own help, so the reference cannot drift from the binaries it documents.

Command fardelay makes a TCP server, usually a store, look far away, as a process: a TCP proxy that listens on the loopback, forwards every connection to a target, and holds each write of the client back by a fixed delay before it forwards it.

Command functionalrun runs the functional tier (the tests behind `//go:build functional`) inside ONE container per run, so every dependency a test starts (redis-server, postgres, a built binary) lives and dies with the container.

Command ghrelease holds the verbs a GitHub release runs: the ldflags a build is stamped with, the build of every shipped tool for one platform, the checksums over the whole shipped set, the assertion that every binary reports the tag it was built from, the gate that asks whether a green certification run vouches for a commit, and the upload that attaches the set to a release draft and never to a published release.

Command notes20261002 writes the notes of 2026-10-02 into nova-config: the reason each route the first real sprint disabled was disabled, and why one machine is held, as the `note` of the row (pkg/config, migration 0015; docs/SPEC-CONFIG.md, "The note").

Command preflight is the standard check before a card is submitted or a pull request is opened: gofmt, go vet, and the unit tests through `make test-full`, in that order, stopping at the first that fails.

Command sandboxcheck is the darwin profile check of nova-sandbox: it fills profiles/darwin.sb.tmpl for a scratch write set, then runs, INSIDE the wall and by ABSOLUTE path, the things a swarm worker does in its first second, and asserts that a write outside, a read of the named secret, a listing of an ancestor, a connect to a socket outside the write set and a nested sandbox all FAIL, each with a control run outside the wall so that a check cannot pass by being impossible.

Command sessiontrace captures bounded shell executions and validates them against TableSession with an installed TLC jar.

Command testmanifest runs an exact list of Go tests and refuses missing, duplicate, skipped, or failed results.

Command tlacheck runs the TLA+ model checks of this repository: the declared cases of tla/CASES.tsv with their run records, the table model's suites, the replay of the table model's findings against a table.lua, and the execution replay of table.lua receipts against EpochMemberTable.