norrietaylor · Jul 14, 2026 · Jul 13, 2026 · Jul 14, 2026 · Jul 14, 2026
@@ -161,7 +161,7 @@ jobs:
         # into the CLI's default-features=false opt-out, linking libkrun into
         # `minimal` (the regression the macOS lane hit and now guards). The
         # CLI drives the unified session e2e in the test job.
-        run: cargo build -p minimal --bin minimal --locked
+        run: cargo build -p minimal --bin min --locked
 
       - name: Archive integration harnesses + stage the testbed
         # `cargo nextest archive` replaces the hand-rolled testbins.json
@@ -176,7 +176,7 @@ jobs:
           mkdir -p testbed
           cargo nextest archive -p minvmd --locked --archive-file testbed/nextest-archive.tar.zst
           cp target/debug/minvmd testbed/minvmd
-          cp target/debug/minimal testbed/minimal
+          cp target/debug/min testbed/min
           cp "$RUNNER_TEMP/initramfs.cpio" testbed/initramfs.cpio
           # Ship the exact libkrun prefix the binaries were linked against.
           tar czf testbed/libkrun-prefix.tgz -C "$LIBKRUN_PREFIX" .
@@ -257,7 +257,7 @@ jobs:
         run: |
           set -euo pipefail
           TESTBED="$RUNNER_TEMP/testbed"
-          chmod +x "$TESTBED/minvmd" "$TESTBED/minimal"
+          chmod +x "$TESTBED/minvmd" "$TESTBED/min"
           mkdir -p "$HOME/.krun"
           tar xzf "$TESTBED/libkrun-prefix.tgz" -C "$HOME/.krun"
           echo "$TESTBED" >> "$GITHUB_PATH"

@@ -103,9 +103,9 @@ jobs:
 
   native-daemon-e2e:
     # The unified session e2e (scripts/session-e2e.sh — the SAME proof every
-    # target lane runs) against the NATIVE minimald (DM2): `minimal activate`
+    # target lane runs) against the NATIVE minimald (DM2): `min activate`
     # auto-spawns `minimald run --detach`, creates a session for this repo's
-    # own project, `minimal attach --command` execs in the sandbox asserting
+    # own project, `min attach --command` execs in the sandbox asserting
     # stdout + exit status, then list/destroy/stop. Before this job, no CI
     # ran the daemon natively at all. The native target needs no E2E_* knobs:
     # host daemon, repo as the project.
@@ -138,7 +138,7 @@ jobs:
           key: native-e2e-minimal-cache-${{ hashFiles('.minimal/minimal.toml') }}
           restore-keys: native-e2e-minimal-cache-
       - name: Build minimal + minimald
-        run: cargo build -p minimald --bin minimald -p minimal --bin minimal --locked
+        run: cargo build -p minimald --bin minimald -p minimal --bin min --locked
       - name: Session e2e (native minimald)
         run: |
           export PATH="$PWD/target/debug:$PATH"

@@ -178,7 +178,7 @@ jobs:
         # retired standalone boot test and goes further (russh auth + exec,
         # stdout + exit status), so a passing session gates the boot. The
         # unified session e2e (scripts/session-e2e.sh) then covers the
-        # CLI proof and more: from a clean state `minimal activate` must
+        # CLI proof and more: from a clean state `min activate` must
         # auto-spawn minvmd and a real session exec must round-trip — the
         # macOS integration gate that no unit test can cover.
         # RUN_MACOS_CI is the kill-switch repo variable for taking the mini
@@ -243,13 +243,13 @@ jobs:
                   # name loaded from anywhere); our @rpath dylib turns it into
                   # dyld "Library not loaded" at autospawn, since minimal bakes
                   # no rpaths.
-                  cargo build -p minimal --bin minimal --locked
+                  cargo build -p minimal --bin min --locked
             - name: Verify minimal links only system libraries
               # The CLI spawns minvmd as a subprocess and calls no libkrun; a
               # krun load command means the feature unification above regressed.
               # Catch it here with a clear message, not as a dyld error mid-e2e.
               run: |
-                  bad="$(otool -L target/debug/minimal | tail -n +2 | awk '{print $1}' \
+                  bad="$(otool -L target/debug/min | tail -n +2 | awk '{print $1}' \
                     | grep -vE '^(/usr/lib/|/System/)' || true)"
                   if [ -n "$bad" ]; then
                     echo "::error::minimal links non-system libraries (feature unification with minvmd's libkrun?):" >&2
@@ -331,12 +331,12 @@ jobs:
             - name: Session e2e via the CLI (activate/exec/destroy; autospawns minvmd)
               # The unified session e2e (scripts/session-e2e.sh — the SAME
               # proof every target lane runs), here against the VM-backed
-              # daemon: from a clean state, `minimal activate` must auto-spawn
+              # daemon: from a clean state, `min activate` must auto-spawn
               # minvmd (found by name on PATH; the MINVMD_* env propagates
               # through the `minvmd run --detach` re-exec), boot the guest,
-              # create a session, and `minimal attach --command` must exec in
+              # create a session, and `min attach --command` must exec in
               # it over the vsock bridge. Replaces the old autospawn step,
-              # which only proved `minimal ls` cold/warm — this proves the
+              # which only proved `min ls` cold/warm — this proves the
               # full user path and subsumes it (the cold activate IS the
               # autospawn). Runs the prebuilt binaries directly (never
               # `cargo run`, which would relink and unsign minvmd).

@@ -103,7 +103,7 @@ jobs:
         # the CLI (the regression the macOS lane guards).
         run: |
           cargo build -p minvmd --bin minvmd --locked
-          cargo build -p minimal --bin minimal --locked
+          cargo build -p minimal --bin min --locked
       - name: Materialize guest kernel (raw Image)
         uses: ./.github/actions/materialize
         with:

@@ -84,7 +84,7 @@ jobs:
               run: |
                   cd target/x86_64-unknown-linux-musl/release
                   mv mip mip-linux-amd64
-                  mv minimal minimal-linux-amd64
+                  mv min minimal-linux-amd64
                   mv minimald minimald-linux-amd64
             - name: Upload binary (mip)
               uses: actions/upload-artifact@v7
@@ -157,7 +157,7 @@ jobs:
                   cross build --release \
                      --package minimal \
                      --target aarch64-unknown-linux-musl
-                  mv target/aarch64-unknown-linux-musl/release/minimal \
+                  mv target/aarch64-unknown-linux-musl/release/min \
                      target/aarch64-unknown-linux-musl/release/minimal-linux-arm64
             - name: Upload binary (minimal)
               uses: actions/upload-artifact@v7
@@ -226,14 +226,14 @@ jobs:
               # Separate cargo invocation from minvmd above, so its default
               # `libkrun` feature can't unify into the CLI (which opts out via
               # default-features = false). Gated next.
-              run: cargo build --release -p minimal --bin minimal
+              run: cargo build --release -p minimal --bin min
             - name: Verify minimal links only system libraries
               # The CLI calls no libkrun (it spawns minvmd as a subprocess), so
               # every dependency must be under /usr/lib or /System. A krun line
               # means the default-features = false opt-out regressed.
               run: |
-                  otool -L target/release/minimal
-                  bad="$(otool -L target/release/minimal | tail -n +2 | awk '{print $1}' \
+                  otool -L target/release/min
+                  bad="$(otool -L target/release/min | tail -n +2 | awk '{print $1}' \
                     | grep -vE '^(/usr/lib/|/System/)' || true)"
                   if [ -n "$bad" ]; then
                     echo "::error::minimal links non-system libraries (allowed: /usr/lib, /System):" >&2
@@ -245,7 +245,7 @@ jobs:
               # file must already carry the platform-suffixed name the release job expects.
               run: |
                   mv target/release/minvmd target/release/minvmd-macos-arm64
-                  mv target/release/minimal target/release/minimal-macos-arm64
+                  mv target/release/min target/release/minimal-macos-arm64
             - name: Codesign binaries with Developer ID
               # Sign the two shipped Mach-O binaries with the Developer ID
               # Application identity held in the runner's signing keychain. This

@@ -4,6 +4,16 @@ version = "0.0.1"
 edition.workspace = true
 publish.workspace = true
 
+# The user-facing command is `min` — clap has said so since the CLI was named
+# (`#[command(name = "min")]`), and the installer lays the binary down as
+# `bin/min`. Name the binary target to match so the dev build agrees with what
+# ships, instead of leaving `min` to be conjured by a rename at release time.
+# Declaring a [[bin]] disables autodiscovery, so `src/main.rs` is now built
+# ONLY as `min`; the `minimal` lib target is unaffected.
+[[bin]]
+name = "min"
+path = "src/main.rs"
+
 [features]
 # Off by default: gates the `mesh` and `ssh-forward` CLI subcommands. WireGuard
 # mesh (UC7 / UC2b-A) and the SSH port-forward fallback are deferred for now; the

@@ -5,7 +5,7 @@
 #
 # Try it:
 #   cargo build -p minimal -p minimald
-#   ./target/debug/minimal activate crates/sessions/example_project --attach
+#   ./target/debug/min activate crates/sessions/example_project --attach
 #
 # Then inside the session:
 #

@@ -18,7 +18,9 @@ rootfs      := scratch / "rootfs.img"
 initramfs   := scratch / "initramfs.cpio"
 gvproxy     := scratch / "gvproxy"
 minvmd-bin  := justfile_directory() / "target/debug/minvmd"
-minimal     := justfile_directory() / "target/debug/minimal"
+# The CLI's binary target is `min` (crates/minimal/Cargo.toml [[bin]]); the
+# crate it comes from is still `minimal`, hence `cargo build -p minimal`.
+min-bin     := justfile_directory() / "target/debug/min"
 
 # Re-run any time the entitlements file or binary changes. Ad-hoc signing
 # (`-s -`) requires no Apple Developer membership; the binary only runs on the
@@ -35,8 +37,8 @@ codesign-minvmd:
 # with full guest networking:
 #   1. materialize the guest kernel + generic rootfs into .scratch
 #   2. cross-compile minimald → initramfs /init WITH the networking features
-#   3. build minvmd (codesign on macOS), build the `minimal` CLI
-#   4. run `minimal ls`, which auto-spawns `minvmd run --detach`; minvmd boots
+#   3. build minvmd (codesign on macOS), build the `min` CLI
+#   4. run `min ls`, which auto-spawns `minvmd run --detach`; minvmd boots
 #      the microVM whose initramfs pid-1 is minimald, which serves the session
 #      over the host UDS bridge.
 #
@@ -47,8 +49,9 @@ codesign-minvmd:
 #            a Rust toolchain + protoc + jq + cpio. libkrun is fetched by `dm3`.
 # See crates/minvmd/README.md for the manual equivalent.
 
-# macOS: via the `minimal` shim (runs in a VM; --output must stay under the repo).
-# Linux: via fetch-artifact.sh (builds `minimal` from source, materializes natively).
+# macOS: via the `minimal` SHIM (~/.minimal/shim/bin/minimal — runs the CLI in a
+# VM; --output must stay under the repo). Distinct from the `min` binary this
+# repo builds. Linux: via fetch-artifact.sh (builds `mip` from source).
 
 # Materialize the guest kernel + generic rootfs into .scratch. Skips a fetch when
 # the artifact already exists; `just clean` first to force a refresh.
@@ -128,12 +131,12 @@ minvmd-build: libkrun
       *) echo "unsupported host $(uname -s)" >&2; exit 1 ;;
     esac
 
-# Build the `minimal` CLI (minimal crate).
+# Build the `min` CLI (from the `minimal` crate; its [[bin]] target is `min`).
 minimal-cli:
     cargo build -p minimal
 
-# Run the `minimal` CLI against the workspace's own debug build. Prepends
-# `target/debug/` to `$PATH` so `minimal`'s auto-spawn can find the sibling
+# Run the `min` CLI against the workspace's own debug build. Prepends
+# `target/debug/` to `$PATH` so `min`'s auto-spawn can find the sibling
 # `minimald` binary (it invokes it by name). Arguments after `just min` are
 # forwarded verbatim.
 #
@@ -143,11 +146,11 @@ minimal-cli:
 #   just min dirs
 min *args:
     cargo build -p minimal -p minimald
-    PATH="{{justfile_directory()}}/target/debug:$PATH" "{{minimal}}" {{args}}
+    PATH="{{justfile_directory()}}/target/debug:$PATH" "{{min-bin}}" {{args}}
 
 # Print `export` lines wiring the dev-built binaries and guest artifacts into
 # the environment — the same setup `dm1`/`dm3` do internally, for running
-# `minimal`/`minvmd` by hand against the built stack. Load into the current
+# `min`/`minvmd` by hand against the built stack. Load into the current
 # shell with:  eval "$(just env)"
 env:
     #!/usr/bin/env sh
@@ -208,15 +211,15 @@ test-installer:
 #      is the primary bring-up on macOS; on Linux it is a clean SKIP (use `dm3`
 #      for the native-Linux + VM equivalent over KVM).
 # DM2: native Linux, a host-native `minimald` (no VM), reachable over UDS at
-#      providers/local-0/ssh.sock — the same path the `minimal` CLI dials, so no
+#      providers/local-0/ssh.sock — the same path the `min` CLI dials, so no
 #      bridge is needed. Own-IP is rootless (hakoniwa RustSlirp builds the tap
 #      inside the sandbox's own user+net namespace — no setcap).
 # DM3: native Linux + one Linux VM (minimald as initramfs pid-1 in libkrun). The
 #      Linux CLI dials providers/local-0/ssh.sock, which minvmd binds directly
 #      (the socket/path coordination fix, #690) — no bridge/symlink needed. Run
 #      under `sg kvm` if the shell lacks the kvm group.
 
-# On Linux this is a clean SKIP (use `dm3`). minimal auto-spawns `minvmd run
+# On Linux this is a clean SKIP (use `dm3`). min auto-spawns `minvmd run
 # --detach`, so minvmd must be on PATH and the MINVMD_* artifact paths exported —
 # both are set here and inherited by the detached supervisor.
 
@@ -238,7 +241,7 @@ dm1:
     # PTasks). Best-effort — skipped if the binary is absent.
     export MINVMD_GVPROXY_BIN="{{gvproxy}}"
     export PATH="{{justfile_directory()}}/target/debug:$PATH"
-    "{{minimal}}" ls
+    "{{min-bin}}" ls
 
 # Build a host-native (glibc) minimald WITH the networking features, for DM2.
 minimald-build:
@@ -271,10 +274,10 @@ dm3: artifacts gvproxy initramfs minvmd-build minimal-cli
     # retry briefly rather than fail the recipe on that one-shot race.
     ok=0
     for _ in $(seq 1 5); do
-      if "{{minimal}}" ls; then ok=1; break; fi
+      if "{{min-bin}}" ls; then ok=1; break; fi
       sleep 2
     done
-    [ "$ok" = 1 ] || { echo "DM3: minimal ls failed after retries" >&2; exit 1; }
+    [ "$ok" = 1 ] || { echo "DM3: min ls failed after retries" >&2; exit 1; }
 
 # DM2 — native Linux, host-native minimald (no VM) over UDS. Runs minimald under
 # a dedicated state dir; the CLI reaches it with `--minimal-dir`, which (via the
@@ -303,9 +306,9 @@ dm2: minimald-build minimal-cli gvproxy
     fi
     [ -S "$sock" ] || { echo "DM2 minimald failed to bind $sock; see {{scratch}}/dm2-minimald.log" >&2; exit 1; }
     echo "DM2 up: host-native minimald at $sock (pid $(cat "$pidf"))"
-    echo "  own-IP: {{minimal}} --minimal-dir $dir activate -n net1 --network own-ip . && \\"
-    echo "          {{minimal}} --minimal-dir $dir attach net1   # curl http://example.com -> 200"
-    "{{minimal}}" --minimal-dir "$dir" ls
+    echo "  own-IP: {{min-bin}} --minimal-dir $dir activate -n net1 --network own-ip . && \\"
+    echo "          {{min-bin}} --minimal-dir $dir attach net1   # curl http://example.com -> 200"
+    "{{min-bin}}" --minimal-dir "$dir" ls
 
 # Stop the DM2 host-native minimald.
 dm2-down: