feat: provision-set mint/realign/check for the estate provisioning canon

.github/workflows/launcher-artefacts.yml

@@ -122,6 +122,33 @@ jobs:
           fi
           exit 0
 
+      - name: Install just (the provisioning engine's runner)
+        # tests/provisioning_fixtures.rs drives the real engine, which needs
+        # just >= 1.42 and fails loudly without it. A release tarball pinned by
+        # sha256 (casey/just SHA256SUMS) adds no action to pin.
+        shell: bash
+        env:
+          JUST_VERSION: "1.56.0"
+          JUST_SHA256: fa2a8ec1015d9df5330941ade12437488fc40d33f9c9f8cd4eb70a26de11b639
+        run: |
+          set +e
+          . "$RUNNER_TEMP/annotate.sh"
+          tgz="$RUNNER_TEMP/just.tar.gz"
+          curl -fsSL -o "$tgz" \
+            "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+            > "$RUNNER_TEMP/just.log" 2>&1 \
+            && echo "${JUST_SHA256}  $tgz" | sha256sum -c - >> "$RUNNER_TEMP/just.log" 2>&1 \
+            && mkdir -p "$RUNNER_TEMP/bin" \
+            && tar -xzf "$tgz" -C "$RUNNER_TEMP/bin" just >> "$RUNNER_TEMP/just.log" 2>&1
+          STATUS=$?
+          if [ "$STATUS" -ne 0 ]; then
+            annotate "installing just ${JUST_VERSION} failed" "$RUNNER_TEMP/just.log" 20
+            exit "$STATUS"
+          fi
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/bin/just" --version
+          exit $?
+
       - name: Build every target
         shell: bash
         run: |
@@ -178,6 +205,13 @@ jobs:
             echo "::error::$FAILED test(s) failed"
             exit 1
           fi
+          # rust-ci.yml skips `needs_just::` (its runner has no just); this job
+          # is the only place they run, so their absence here is a failure.
+          NEEDS_JUST=$(grep -cE '^test (.*::)?needs_just::.* \.\.\. ok$' "$LOG")
+          if [ "$NEEDS_JUST" -lt 16 ]; then
+            echo "::error title=needs_just tests::only $NEEDS_JUST of 16 needs_just:: tests passed here, and rust-ci skips them, so nothing else runs them"
+            exit 1
+          fi
           if [ "$PASSED" -lt "$TEST_COUNT_FLOOR" ]; then
             echo "::error title=test-count floor::only $PASSED tests ran; the floor is $TEST_COUNT_FLOOR. A suite that collects nothing exits 0, so this gate is what makes green mean ran (#45 AC6)."
             exit 1

.github/workflows/rust-ci.yml

@@ -19,7 +19,8 @@
 #   check  → cargo check --locked --all-targets
 #            cargo fmt --all -- --check
 #            cargo clippy --locked --all-targets -- -D warnings
-#   test   → cargo test --locked --all-targets
+#   test   → cargo test --locked --all-targets, skipping `needs_just::`
+#            (run with just installed by launcher-artefacts.yml)
 #
 # The job names below are static and unmatrixed on purpose (#45 AC3): the
 # rendered check names ("rust-ci / Cargo test" and friends) have to be stable
@@ -42,3 +43,7 @@ permissions:
 jobs:
   rust-ci:
     uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    with:
+      # The provisioning engine tests (module `needs_just`) need `just`, which
+      # this runner lacks; launcher-artefacts.yml installs it and runs them.
+      test_args: "--all-targets -- --skip needs_just::"

.gitignore

@@ -47,4 +47,8 @@ deps/
 .elixir_ls/
 .cache/
 build/
+# The provisioning canon vendors build/just/ engine files, and its fixtures
+# mirror a repo root; both are source here, not build output.
+!standards/provisioning/templates/build/
+!crates/launcher-common/tests/fixtures/provisioning/**/build/
 dist/

.machine_readable/contractiles/Justfile

@@ -73,29 +73,47 @@ smoke-mint:
     @echo "Smoke test: mint produced /tmp/stapeln-launcher.sh"
 
 # Mint a launcher in-place. Pass the path to an <app>.launcher.a2ml file.
-# Example:  just mint /var/mnt/eclipse/repos/aerie/aerie.launcher.a2ml
+# Example:  just mint ../aerie/aerie.launcher.a2ml
 mint config:
     cargo run --locked --release -p launch-scaffolder -- mint {{config}}
 
-# Re-mint every scaffolder-managed launcher in the estate. Edit the list
-# when adding/removing managed repos. Exceptions live in
+# Re-mint every scaffolder-managed launcher found under ROOT (the directory
+# holding your clones; nothing machine-specific is assumed). Each managed
+# config must resolve to exactly one file: a missing or duplicated clone is
+# an error naming the candidates, never a guess. Edit the list when
+# adding/removing managed repos. Exceptions live in
 # docs/launcher-exceptions-2026-04-10.adoc.
-mint-all:
+mint-all root:
     #!/usr/bin/env bash
     set -euo pipefail
     BIN="./target/release/launch-scaffolder"
+    [ -d "{{root}}" ] || { echo "✗ {{root}} is not a directory" >&2; exit 2; }
     [ -x "$BIN" ] || cargo build --locked --release
-    for cfg in \
-        /var/mnt/eclipse/repos/aerie/aerie.launcher.a2ml \
-        /var/mnt/eclipse/repos/developer-ecosystem/burble/burble.launcher.a2ml \
-        /var/mnt/eclipse/repos/fleet-ecosystem/game-server-admin/game-server-admin.launcher.a2ml \
-        /var/mnt/eclipse/repos/developer-ecosystem/nextgen-databases/nqc/nqc.launcher.a2ml \
-        /var/mnt/eclipse/repos/verification-ecosystem/panll/panll.launcher.a2ml \
-        /var/mnt/eclipse/repos/project-wharf/project-wharf.launcher.a2ml \
-        /var/mnt/eclipse/repos/fleet-ecosystem/stapeln/stapeln.launcher.a2ml ; do
-        "$BIN" mint "$cfg"
+    status=0 n=0
+    for rel in \
+        aerie/aerie.launcher.a2ml \
+        burble/burble.launcher.a2ml \
+        game-server-admin/game-server-admin.launcher.a2ml \
+        nqc/nqc.launcher.a2ml \
+        panll/panll.launcher.a2ml \
+        project-wharf/project-wharf.launcher.a2ml \
+        stapeln/stapeln.launcher.a2ml ; do
+        mapfile -d '' hits < <(find "{{root}}" -path '*/worktrees' -prune -o -path '*/archive' -prune \
+            -o -path "*/$rel" -type f -print0)
+        if [ "${#hits[@]}" -ne 1 ]; then
+            echo "✗ $rel: ${#hits[@]} matches under {{root}} (need exactly one)" >&2
+            for h in "${hits[@]}"; do echo "    $h" >&2; done
+            status=1; continue
+        fi
+        if "$BIN" mint "${hits[0]}"; then
+            n=$((n + 1))
+        else
+            echo "✗ $rel: mint failed" >&2
+            status=1
+        fi
     done
-    echo "✓ Estate re-mint complete (7 launchers)"
+    echo "Estate re-mint: $n of 7 launchers"
+    exit "$status"
 
 # Generate cargo docs
 doc:

Justfile

@@ -73,29 +73,47 @@ smoke-mint:
     @echo "Smoke test: mint produced /tmp/stapeln-launcher.sh"
 
 # Mint a launcher in-place. Pass the path to an <app>.launcher.a2ml file.
-# Example:  just mint /var/mnt/eclipse/repos/aerie/aerie.launcher.a2ml
+# Example:  just mint ../aerie/aerie.launcher.a2ml
 mint config:
     cargo run --locked --release -p launch-scaffolder -- mint {{config}}
 
-# Re-mint every scaffolder-managed launcher in the estate. Edit the list
-# when adding/removing managed repos. Exceptions live in
+# Re-mint every scaffolder-managed launcher found under ROOT (the directory
+# holding your clones; nothing machine-specific is assumed). Each managed
+# config must resolve to exactly one file: a missing or duplicated clone is
+# an error naming the candidates, never a guess. Edit the list when
+# adding/removing managed repos. Exceptions live in
 # docs/launcher-exceptions-2026-04-10.adoc.
-mint-all:
+mint-all root:
     #!/usr/bin/env bash
     set -euo pipefail
     BIN="./target/release/launch-scaffolder"
+    [ -d "{{root}}" ] || { echo "✗ {{root}} is not a directory" >&2; exit 2; }
     [ -x "$BIN" ] || cargo build --locked --release
-    for cfg in \
-        /var/mnt/eclipse/repos/aerie/aerie.launcher.a2ml \
-        /var/mnt/eclipse/repos/developer-ecosystem/burble/burble.launcher.a2ml \
-        /var/mnt/eclipse/repos/fleet-ecosystem/game-server-admin/game-server-admin.launcher.a2ml \
-        /var/mnt/eclipse/repos/developer-ecosystem/nextgen-databases/nqc/nqc.launcher.a2ml \
-        /var/mnt/eclipse/repos/verification-ecosystem/panll/panll.launcher.a2ml \
-        /var/mnt/eclipse/repos/project-wharf/project-wharf.launcher.a2ml \
-        /var/mnt/eclipse/repos/fleet-ecosystem/stapeln/stapeln.launcher.a2ml ; do
-        "$BIN" mint "$cfg"
+    status=0 n=0
+    for rel in \
+        aerie/aerie.launcher.a2ml \
+        burble/burble.launcher.a2ml \
+        game-server-admin/game-server-admin.launcher.a2ml \
+        nqc/nqc.launcher.a2ml \
+        panll/panll.launcher.a2ml \
+        project-wharf/project-wharf.launcher.a2ml \
+        stapeln/stapeln.launcher.a2ml ; do
+        mapfile -d '' hits < <(find "{{root}}" -path '*/worktrees' -prune -o -path '*/archive' -prune \
+            -o -path "*/$rel" -type f -print0)
+        if [ "${#hits[@]}" -ne 1 ]; then
+            echo "✗ $rel: ${#hits[@]} matches under {{root}} (need exactly one)" >&2
+            for h in "${hits[@]}"; do echo "    $h" >&2; done
+            status=1; continue
+        fi
+        if "$BIN" mint "${hits[0]}"; then
+            n=$((n + 1))
+        else
+            echo "✗ $rel: mint failed" >&2
+            status=1
+        fi
     done
-    echo "✓ Estate re-mint complete (7 launchers)"
+    echo "Estate re-mint: $n of 7 launchers"
+    exit "$status"
 
 # Generate cargo docs
 doc:

crates/launcher-common/src/lib.rs

@@ -29,6 +29,7 @@ pub mod integration;
 pub mod integrity;
 pub mod metadata_block;
 pub mod platform;
+pub mod provisioning;
 pub mod standard;
 pub mod template;