- tests/: offline tree validation plus rootfs smoke tests that assert the hardening guarantees (kptr_restrict, default-deny firewall, key-only ssh, no snapd/telemetry, btrfs tooling). - ci/: GitLab pipeline - validate, build matrix (server/workstation/ cloud), smoke tests, publish on tags.