Reference

Commands

Every make target, script subcommand, and CLI flag in the IRIN repo, tagged by who it is for. Snap your fingers wisely.

The root Makefile

Run these from the IRIN repository root. Operator tags are for the human running the gauntlet; Engineering tags are for the humans building it.

Setup and proof

make help

OperatorPrints the target list. The gauntlet's own table of contents.

make setup

OperatormacOS only. Prepares private config and signing material, builds and starts Council, War Room Web, and Gateway, enables login recovery, then prints your service URLs. Preserves operator-owned values you already set.

make setup-prepare

OperatorPrepares config and signing material only. No services are built or started.

make app-install

OperatormacOS only. Builds, atomically installs, and launches the native desktop shell. It reuses the runtime make setup already started; it never starts a competing backend.

make verify
make verify-down

OperatorThe proof lane. Runs the Sentinel-to-signed-directive path end to end in an isolated stack: no provider keys, no hardware arming, own ports, own volumes. Knobs: DEMO_ALLOW_BUILD=1, DEMO_PULL=1, DEMO_GW_PORT=28080, DEMO_COUNCIL_PORT=28765, DEMO_POLL_TIMEOUT=90. Details on the Ceremony page.

Managed runtime

make runtime-up

OperatorStarts the managed runtime: Council, War Room Web, and Gateway under the supervisor.

make runtime-down

OperatorStops the managed runtime.

make runtime-restart

OperatorRestarts the managed runtime.

make runtime-status

OperatorPrints per-service status for the managed runtime.

make docker-cache-prune

OperatorOps hygiene. Prunes build cache while keeping images, containers, and volumes intact.

War Room and engineering

make warroom

OperatormacOS and Ubuntu. Builds and starts Council plus War Room Web in the foreground on loopback; stop with Ctrl+C. Knobs: COUNCIL_PORT, WARROOM_WEB_PORT, WARROOM_ADOPT=1.

make warroom-tauri
make warroom-tauri-build

EngineeringDev lane for the native desktop shell: run it live, or build the bundle.

make release-check

EngineeringThe release gate. Runs the checks a release must pass.

make worktree BRANCH=feat/example [DEST=path]

EngineeringCreates an isolated worktree runtime. BRANCH= is required, DEST= is optional.

make build
make test

EngineeringBuilds the workspace and runs the test suites.

The runtime supervisor: scripts/irin-runtime.sh

One script rules the managed runtime. The make runtime-* targets are thin wrappers around these subcommands.

Subcommand

What it does

start

Starts the stack. Asserts the git origin is irinityhq/irin; the canonical profile must be on a clean main.

stop

Stops the stack and verifies all ports are released.

restart

Stops, then starts.

status

Reports UP, DEGRADED, or DOWN per service, plus the PRIVATE_PHONE url.

boot

The login and post-reboot path.

serve

Internal. Runs in the foreground under launchd. Not an operator command.

install-login
uninstall-login

Installs or removes the LaunchAgent com.irinity.irin-runtime.login.

reload-local-config

Reloads local config with no rebuild and no Gateway disturbance.

reload-gateway-config

Recreates only the edge container.

Supervisor knobs

Variable

Default and meaning

IRIN_COUNCIL_PORTdefault 8765

Council listen port.

IRIN_WEB_PORTdefault 3010

War Room Web listen port.

IRIN_GATEWAY_PORTdefault 18080

Gateway listen port.

IRIN_TAILSCALE_HTTPS_PORTdefault 443

Tailscale Serve HTTPS port.

IRIN_RUNTIME_PROFILEcanonical | worktree

Which runtime profile the supervisor manages.

IRIN_TAILSCALE_SERVEauto | 0 | 1

Whether to publish the private Tailscale Serve endpoint.

IRIN_GATEWAY_ENV~/.config/irin/gateway.env

Path to the Gateway environment file.

IRIN_RUNTIME_STATE_DIR~/.local/state/irin/runtime

Runtime state directory.

IRIN_DOCKER_WAIT_SECSdefault 180

How long to wait for Docker before giving up.

Component targets

Each component keeps its own Makefile. One line each; the stones do not ramble.

council-rs

Target

What it does

warroom-browser

Runs the browser War Room.

warroom-dev

Dev-mode War Room run.

warroom-build

Builds the War Room.

warroom-sign

Signs the War Room build. macOS only.

warroom-export

Exports the War Room build.

warroom-check

Checks the War Room build.

audit-rust

Audits the Rust dependency tree.

check-no-legacy-reqwest

Fails if the legacy reqwest usage creeps back in.

gateway

Target

What it does

up / down / logs

Runs the Gateway docker stack, stops it, or tails its logs.

ledger-key-dev

Generates a 32-byte key with mode 0600 at LEDGER_KEY_PATH (default ~/.irin/ledger_key.pem). Never overwrites an existing key. Dev and CI only.

provision-key

Provisions a key. BUDGET= is required; TIER= defaults to default; RPM= defaults to 600.

ledger-verify

Verifies the ledger.

ledger-fsck

Filesystem-checks the ledger database at LEDGER_DB_PATH (default ledger.db).

validate

Validates the Gateway configuration.

smoke

Smoke-tests the stack.

smoke-phase3 family

The phase 3 smoke tests.

metrics-contract

Checks the metrics contract.

security-test

Runs the security tests.

contract-check

Checks the wire contracts.

models-validate

Validates the model configuration.

lua-unit

Runs the Lua unit tests.

test-rust-suites

Runs the Rust test suites.

test-rust-security

Runs the Rust security tests.

test-triad

Runs the triad test. Aliases: triad-test, triad-smoke.

prove-provenance

Proves provenance for the build.

Council CLI flags

The Council binary takes its own flags for seats, modes, rounds, and chairs. They are documented flag by flag on the Council stone page.

Surface

Where documented

Council CLI

Every flag, with defaults and examples, lives on the Council page.

Where things listen

Everything binds to loopback. The only way out is the private Tailscale endpoint, and that is yours alone.

Surface

Address and notes

War Room Web

127.0.0.1:3010

Council

127.0.0.1:8765: REST at /api/health, stream at /ws.

Gateway

127.0.0.1:18080: /health, /watch, /admin/keys, /ledger/verify, /metrics, /v1/models.

CLI adapters

Claude proxy :9090, Codex proxy :9091.

Tailscale Serve

:443: maps / to Web, /api and /ws to Council, /watch and /health to Gateway.

Isolated verify stack

Gateway 28080, Council stub 28765. Compose project irin-demo.

Worktree runtimes

Council 20000+slot, Web 22000+slot, Gateway 24000+slot, where slot is cksum mod 1000.

Platform split

Not every stone fits every gauntlet. Check the platform before you snap.

macOS only

make setup, setup-prepare, app-install, and warroom-sign. The whole irin-runtime.sh supervisor is macOS-shaped: launchctl, lockf, ~/Library/LaunchAgents.

macOS and Ubuntu

make warroom, make verify and verify-down, the Gateway docker stack, and cargo build / cargo test.

Fine print, read before you snap

The managed runtime enforces the canonical origin (irinityhq/irin) as a source-provenance boundary.
Fork contributors can build, test, and verify, but cannot launch the managed runtime from a fork.
Neither make verify nor make runtime-status proves a paid provider call or an armed action path.