Improve Makefile: match jerboa-shell target structure

ober

a96078fb8c56c3bb98c3d23ac08c3b37c4e726d2

diff --git a/Makefile b/Makefile
index 45d8f31..a20649d 100644
--- a/Makefile
+++ b/Makefile
@@ -4,14 +4,19 @@ LIBDIRS = lib:$(JERBOA)
 NATIVE_RS ?= $(HOME)/mine/jerboa/jerboa-native-rs/target/release
 export LD_LIBRARY_PATH := $(NATIVE_RS):$(LD_LIBRARY_PATH)
 
-.PHONY: build clean test keygen agent collector analyze docker secmon-musl secmon-musl-local
+.PHONY: all build compile clean test keygen agent collector analyze docker secmon-musl secmon-musl-local verify-harden
 
-build:
+all: build
+
+# ─── Compilation ─────────────────────────────────────────────────────────────
+
+build: compile
+
+compile:
+	@echo "=== Compiling .sls → .so ==="
 	$(SCHEME) -q --libdirs $(LIBDIRS) --compile-imported-libraries < build-all.ss
 
-clean:
-	find lib -name '*.so' -delete
-	find lib -name '*.wpo' -delete
+# ─── Run Targets ─────────────────────────────────────────────────────────────
 
 keygen:
 	$(SCHEME) --libdirs $(LIBDIRS) --script bin/keygen.ss
@@ -25,19 +30,14 @@ collector:
 analyze:
 	$(SCHEME) --libdirs $(LIBDIRS) --script bin/analyze.ss $(ARGS)
 
-test:
-	@echo "Running tests..."
-	@for f in tests/*-test.ss; do \
-		echo "Testing $$f..."; \
-		$(SCHEME) --libdirs $(LIBDIRS) --script $$f || exit 1; \
-	done
-	@echo "All tests passed."
-
-# ─── musl Static Binary ──────────────────────────────────────────────────────
+# ─── musl Static Binary ─────────────────────────────────────────────────────
+# Default: build via Docker for reproducibility and correct toolchain deps.
+# Use `make secmon-musl-local` to build directly on the host (requires musl-gcc,
+# Rust musl target, and all dependencies installed locally).
 
 secmon-musl: docker
 
-secmon-musl-local: build
+secmon-musl-local: compile
 	@echo "=== Building static secmon-agent with musl (local) ==="
 	./build-secmon-musl.sh
 
@@ -54,3 +54,42 @@ docker:
 	@echo "=== Docker build complete ==="
 	@ls -lh secmon-agent
 	@file secmon-agent
+
+# ─── Hardening Verification ─────────────────────────────────────────────────
+
+verify-harden: secmon-agent
+	@echo "=== Verifying binary hardening ==="
+	@echo "--- Symbol check (should show 'stripped') ---"
+	@(file secmon-agent | grep -qE 'stripped|no section header') && echo "  PASS: binary is stripped" || echo "  FAIL: binary not stripped"
+	@echo "--- Build path leak check ---"
+	@if strings secmon-agent | grep -q "$(HOME)"; then \
+		echo "  WARN: home directory path found in binary"; \
+	else \
+		echo "  PASS: no home directory paths leaked"; \
+	fi
+	@echo "--- Integrity hash check ---"
+	@if [ -f secmon-agent.sha256 ]; then \
+		echo "  PASS: secmon-agent.sha256 exists ($$(wc -c < secmon-agent.sha256) bytes)"; \
+	else \
+		echo "  FAIL: secmon-agent.sha256 not found"; \
+	fi
+	@echo "=== Hardening verification complete ==="
+
+# ─── Testing ─────────────────────────────────────────────────────────────────
+
+test:
+	@echo "=== Running tests ==="
+	@for f in tests/*-test.ss; do \
+		echo "Testing $$f..."; \
+		$(SCHEME) --libdirs $(LIBDIRS) --script $$f || exit 1; \
+	done
+	@echo "All tests passed."
+
+# ─── Cleanup ─────────────────────────────────────────────────────────────────
+
+clean:
+	find lib -name '*.so' -delete
+	find lib -name '*.wpo' -delete
+	rm -f secmon-agent secmon-agent.sha256
+	rm -f secmon-program.c secmon-program.o secmon-agent.boot
+	rm -rf jerboa-stage/