feat: add xtask for parameterized task workflows

.cargo/config.toml

@@ -6,3 +6,6 @@
 # the header lives in /usr/include/z3/ rather than /usr/include/. The extra -I
 # is harmless on systems where the path doesn't exist.
 BINDGEN_EXTRA_CLANG_ARGS = "-I/usr/include/z3"
+
+[alias]
+xtask = "run --package xtask --"

crates/xtask/Cargo.toml

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "xtask"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+publish = false
+
+[dependencies]

crates/xtask/scripts/machine/development/centos-stream.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Installing OpenShell development dependencies on CentOS Stream"
+sudo dnf install -y \
+	ca-certificates \
+	clang \
+	clang-devel \
+	cmake \
+	curl \
+	gcc \
+	gcc-c++ \
+	git \
+	jq \
+	make \
+	openssh-clients \
+	openssl-devel \
+	pkgconf-pkg-config \
+	python3 \
+	rsync \
+	socat \
+	unzip \
+	xz \
+	zstd
+
+z3_version="4.16.0"
+case "$(uname -m)" in
+	aarch64)
+		z3_asset="z3-${z3_version}-arm64-glibc-2.38.zip"
+		z3_sha256="87fcd963d3eecb0f12cf1c3ef0ad74e84a3a7bd3caed5d94445645ef94ae6274"
+		;;
+	x86_64)
+		z3_asset="z3-${z3_version}-x64-glibc-2.39.zip"
+		z3_sha256="7288c49a5bd6dbafd7b0b0d1f65956b91672da24b08f09242919af159be3418e"
+		;;
+	*)
+		echo "unsupported architecture for Z3: $(uname -m)" >&2
+		exit 1
+		;;
+esac
+
+if pkg-config --atleast-version="${z3_version}" z3 2>/dev/null; then
+	echo "==> Z3 $(pkg-config --modversion z3) is already installed"
+else
+	echo "==> Installing Z3 ${z3_version} for OpenShell development"
+	work_dir="$(mktemp -d)"
+	trap 'rm -rf "${work_dir}"' EXIT
+	archive="${work_dir}/${z3_asset}"
+	curl -fL \
+		"https://github.com/Z3Prover/z3/releases/download/z3-${z3_version}/${z3_asset}" \
+		-o "${archive}"
+	printf '%s  %s\n' "${z3_sha256}" "${archive}" | sha256sum --check --status
+	unzip -q "${archive}" -d "${work_dir}"
+	z3_dir="${work_dir}/${z3_asset%.zip}"
+
+	sudo install -D -m 0755 "${z3_dir}/bin/z3" /usr/local/bin/z3
+	sudo install -D -m 0755 "${z3_dir}/bin/libz3.so" /usr/local/lib/libz3.so
+	sudo install -d -m 0755 /usr/local/include
+	sudo install -m 0644 "${z3_dir}"/include/*.h /usr/local/include/
+	sudo install -d -m 0755 /usr/lib64/pkgconfig
+	sudo tee /usr/lib64/pkgconfig/z3.pc >/dev/null <<EOF
+prefix=/usr/local
+libdir=\${prefix}/lib
+includedir=\${prefix}/include
+
+Name: z3
+Description: The Z3 theorem prover
+Version: ${z3_version}
+Libs: -L\${libdir} -lz3
+Cflags: -I\${includedir}
+EOF
+	echo /usr/local/lib | sudo tee /etc/ld.so.conf.d/z3.conf >/dev/null
+	sudo ldconfig
+
+	test "$(pkg-config --modversion z3)" = "${z3_version}"
+	z3 --version
+	rm -rf "${work_dir}"
+	trap - EXIT
+fi

crates/xtask/scripts/machine/development/common.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Installing mise"
+curl -fsSL https://mise.run | MISE_VERSION=v2026.4.25 sh

crates/xtask/scripts/machine/development/ubuntu.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Installing OpenShell development dependencies on Ubuntu"
+sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y \
+	build-essential \
+	ca-certificates \
+	clang \
+	cmake \
+	curl \
+	git \
+	jq \
+	libclang-dev \
+	libssl-dev \
+	libz3-dev \
+	musl-tools \
+	openssh-client \
+	pkg-config \
+	python3 \
+	python3-venv \
+	rsync \
+	socat \
+	unzip \
+	xz-utils \
+	zstd

crates/xtask/scripts/machine/os/centos-stream.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+if [ ! -r /etc/os-release ]; then
+	echo "cannot detect guest OS: /etc/os-release is missing" >&2
+	exit 1
+fi
+
+# shellcheck disable=SC1091
+. /etc/os-release
+
+if [ "${ID:-}" != "centos" ] || [[ "${VERSION_ID:-}" != 10* ]]; then
+	echo "expected a CentOS Stream 10 guest, found ${PRETTY_NAME:-unknown}" >&2
+	exit 1
+fi
+
+echo "==> Preparing ${PRETTY_NAME:-CentOS Stream 10}"
+sudo dnf install -y \
+	audit \
+	libselinux-utils \
+	policycoreutils
+
+selinux_mode="$(getenforce)"
+echo "==> SELinux mode: ${selinux_mode}"
+if [ "${selinux_mode}" != "Enforcing" ]; then
+	echo "SELinux must be Enforcing for the CentOS Stream 10 e2e target" >&2
+	exit 1
+fi
+
+sudo systemctl enable auditd
+if ! sudo systemctl is-active --quiet auditd; then
+	sudo service auditd start
+fi
+sudo systemctl is-active --quiet auditd

crates/xtask/scripts/machine/os/ubuntu.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+if [ ! -r /etc/os-release ]; then
+	echo "cannot detect guest OS: /etc/os-release is missing" >&2
+	exit 1
+fi
+
+# shellcheck disable=SC1091
+. /etc/os-release
+
+if [ "${ID:-}" != "ubuntu" ]; then
+	echo "expected an Ubuntu guest, found ${ID:-unknown}" >&2
+	exit 1
+fi
+
+echo "==> Preparing Ubuntu ${VERSION_ID:-unknown}"
+sudo apt-get update

crates/xtask/scripts/machine/suites/podman/centos-stream.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Installing rootless Podman on CentOS Stream"
+sudo dnf install -y podman

crates/xtask/scripts/machine/suites/podman/common.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Configuring rootless Podman"
+containers_config_dir="${HOME}/.config/containers"
+containers_config_drop_in_dir="${containers_config_dir}/containers.conf.d"
+mkdir -p "${containers_config_dir}" "${containers_config_drop_in_dir}"
+cat >"${containers_config_dir}/containers.conf" <<'EOF'
+[containers]
+# Use file-backed logs so Docker-compatible log reads work reliably.
+log_driver = "k8s-file"
+
+[engine]
+# Use file-backed events so open Libpod streams receive lifecycle events reliably.
+events_logger = "file"
+EOF
+# CentOS Stream ships a containers.conf.d vendor fragment that selects
+# journald after the regular user configuration has been merged. A later user
+# drop-in overrides it; keeping the regular file also supports older Podman
+# releases that do not load per-user drop-ins.
+install -m 0644 \
+	"${containers_config_dir}/containers.conf" \
+	"${containers_config_drop_in_dir}/99-openshell.conf"
+
+echo "==> Enabling the rootless Podman socket"
+sudo loginctl enable-linger "$USER"
+systemctl --user daemon-reload
+systemctl --user enable --now podman.socket
+if ! systemctl --user is-active --quiet podman.socket; then
+	echo "rootless Podman socket did not become active" >&2
+	systemctl --user status --no-pager podman.socket >&2 || true
+	exit 1
+fi
+
+require_podman_info() {
+	local format="$1"
+	local expected="$2"
+	local description="$3"
+	local actual
+
+	if ! actual="$(podman info --format "${format}")"; then
+		echo "could not inspect Podman ${description}" >&2
+		podman info >&2 || true
+		exit 1
+	fi
+	if [ "${actual}" != "${expected}" ]; then
+		echo "expected Podman ${description} to be ${expected}, found ${actual:-<empty>}" >&2
+		exit 1
+	fi
+}
+
+require_podman_info '{{.Host.Security.Rootless}}' true "rootless mode"
+require_podman_info '{{.Host.LogDriver}}' k8s-file "log driver"
+require_podman_info '{{.Host.EventLogger}}' file "event logger"

crates/xtask/scripts/machine/suites/podman/ubuntu.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+echo "==> Installing rootless Podman on Ubuntu"
+sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y \
+	ca-certificates \
+	curl \
+	podman

crates/xtask/scripts/machine/validation/selinux-audit.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -Eeuo pipefail
+
+: "${OPENSHELL_SELINUX_AUDIT_START:?OPENSHELL_SELINUX_AUDIT_START must mark the e2e audit window}"
+
+echo "==> Checking for SELinux AVC denials since ${OPENSHELL_SELINUX_AUDIT_START}"
+audit_log="$(mktemp)"
+trap 'rm -f "${audit_log}"' EXIT
+# The temporary output file is owned by this user; only reading the audit log
+# through ausearch requires elevated privileges.
+# shellcheck disable=SC2024
+sudo ausearch \
+	-m avc,user_avc \
+	-ts "${OPENSHELL_SELINUX_AUDIT_START}" \
+	--raw >"${audit_log}" 2>/dev/null || true
+
+if grep -q '^type=' "${audit_log}"; then
+	echo "SELinux denied one or more operations during the e2e suite:" >&2
+	cat "${audit_log}" >&2
+	exit 1
+fi
+
+echo "==> No SELinux AVC denials recorded"