diff --git a/.github/justfile b/.github/justfile
new file mode 100644
index 0000000..27e0b1b
--- /dev/null
+++ b/.github/justfile
@@ -0,0 +1,89 @@
+# CI job bodies: each workflow job runs exactly one `gha::` recipe, so
+# `just ci` is exactly CI and the workflow files carry no logic beyond
+# environment setup (checkout, toolchains, caches). Step-level rationale
+# lives on the root-justfile recipes these compose.
+
+set working-directory := '..'
+
+# Wrap one recipe in a GitHub Actions log group (plain passthrough
+# locally).
+[private]
+_step recipe:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
+        echo "::group::just {{recipe}}"
+        status=0
+        just {{recipe}} || status=$?
+        echo "::endgroup::"
+        if [ $status -ne 0 ]; then
+            echo "::error title=just {{recipe}} failed::exit status $status"
+            exit $status
+        fi
+    else
+        just {{recipe}}
+    fi
+
+# Like _step, but failures are tolerated: the CI-side replacement for the
+# workflow-level `continue-on-error` the collapsed steps used to carry. A
+# failure surfaces as a ::warning annotation, never as a job failure.
+[private]
+_step-tolerated recipe:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
+        echo "::group::just {{recipe}} (non-blocking)"
+        status=0
+        just {{recipe}} || status=$?
+        echo "::endgroup::"
+        if [ $status -ne 0 ]; then
+            echo "::warning title=just {{recipe}} (non-blocking)::exit status $status — tolerated; see the recipe's comment for why"
+        fi
+    else
+        just {{recipe}} || echo "just {{recipe}}: FAILED (tolerated in CI; see the recipe's comment)"
+    fi
+
+# The required per-push/PR matrix job (ci.yml `core`).
+core:
+    @just gha::_step build
+    @just gha::_step test-rust
+    @just gha::_step shim
+    @just gha::_step fixtures
+    @just gha::_step corpus
+    @just gha::_step shells
+    @just gha::_step test-runtime
+    @just gha::_step test-wasi-shims
+    @just gha::_step test-ct-runner
+    @just gha::_step test-bundle
+    @just gha::_step conformance
+    @just gha::_step sched-seeds
+    @just gha::_step test-ports
+    @just gha::_step-tolerated test-webrtc
+
+# The post-merge browser job (ci.yml `browser`; gates the prerelease).
+browser:
+    @just gha::_step shim
+    @just gha::_step corpus
+    @just gha::_step "browsers-install --with-deps"
+    @just gha::_step "browser-lane chromium"
+    @just gha::_step "browser-lane firefox"
+    @just gha::_step-tolerated "browsers-install-webkit --with-deps"
+    @just gha::_step-tolerated "browser-lane webkit"
+
+# Never gates: the drivers themselves exit 0 on deviations, 2 on
+# infrastructure failure.
+# The findings-only canary lanes (canary.yml, x64 leg).
+canary:
+    @just gha::_step shim
+    @just gha::_step corpus
+    @just gha::_step "shell-lane sm-nightly --json sm-results.json"
+    @just gha::_step "shell-lane jsc-trunk --json jsc-results.json"
+    @just gha::_step "deno-canary --json deno-canary-results.json"
+
+# JSC trunk has no arm64 channel — the two lanes with arm64 coverage.
+# The findings-only canary lanes (canary.yml, arm64 leg).
+canary-arm:
+    @just gha::_step shim
+    @just gha::_step corpus
+    @just gha::_step "shell-lane sm-nightly --json sm-results.json"
+    @just gha::_step "deno-canary --json deno-canary-results.json"
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 3125f19..03539db 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -23,6 +23,7 @@ on:
 env:
   DENO_VERSION: "2.9.5"
   WASM_TOOLS_VERSION: "1.247.0"
+  JUST_VERSION: "1.54.0"
 
 jobs:
   shell-canaries:
@@ -38,36 +39,18 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
+          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
       - uses: denoland/setup-deno@v2
         with:
           deno-version: ${{ env.DENO_VERSION }}
 
-      - name: build the translator shim (wasm32)
-        run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
-      - name: generate the conformance corpus
-        working-directory: harness
-        run: deno task gen
-
       # Deliberately NO actions/cache for .shell-cache: trunk/nightly
       # builds change daily by design (fetching fresh IS the lane's
       # purpose), and a prefix-restored cache from a failed earlier run
       # can resurrect a broken extraction that fetch.ts's existence
       # check would then trust (bitten once: the first-run jsc layout
       # bug would have been pinned in place by exactly that).
-
-      - name: fetch SpiderMonkey nightly
-        run: deno run -A tools/shell/fetch.ts sm-nightly
-      - name: SpiderMonkey nightly lane
-        run: deno run -A tools/shell/run-lane.ts sm-nightly --json sm-results.json
-
-      - name: fetch JSC trunk (x86_64)
-        run: deno run -A tools/shell/fetch.ts jsc-trunk
-      - name: JSC trunk lane
-        run: deno run -A tools/shell/run-lane.ts jsc-trunk --json jsc-results.json
-
-      - name: Deno canary probe (V8-trailing-edge substitute for a d8 lane)
-        run: deno run -A tools/shell/deno-canary.ts --json deno-canary-results.json
+      - run: just gha::canary
 
       - name: upload results
         if: always()
@@ -114,31 +97,13 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
+          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
       - uses: denoland/setup-deno@v2
         with:
           deno-version: ${{ env.DENO_VERSION }}
 
-      - name: build the translator shim (wasm32)
-        run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
-      - name: generate the conformance corpus
-        working-directory: harness
-        run: deno task gen
-
-      # Deliberately NO actions/cache for .shell-cache: trunk/nightly
-      # builds change daily by design (fetching fresh IS the lane's
-      # purpose), and a prefix-restored cache from a failed earlier run
-      # can resurrect a broken extraction that fetch.ts's existence
-      # check would then trust (bitten once: the first-run jsc layout
-      # bug would have been pinned in place by exactly that).
-
-      - name: fetch SpiderMonkey nightly
-        run: deno run -A tools/shell/fetch.ts sm-nightly
-      - name: SpiderMonkey nightly lane
-        run: deno run -A tools/shell/run-lane.ts sm-nightly --json sm-results.json
-
-      - name: Deno canary probe
-        run: deno run -A tools/shell/deno-canary.ts --json deno-canary-results.json
+      # Deliberately NO actions/cache for .shell-cache: see the x64 job.
+      - run: just gha::canary-arm
 
       - name: upload results
         if: always()
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d17ac0..e3e9606 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ concurrency:
 env:
   DENO_VERSION: "2.9.5"
   WASM_TOOLS_VERSION: "1.247.0"
+  JUST_VERSION: "1.54.0"
 
 jobs:
   core:
@@ -33,111 +34,17 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
+          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
       - uses: denoland/setup-deno@v2
         with:
           deno-version: ${{ env.DENO_VERSION }}
 
-      # --- Rust suites -------------------------------------------------------
-      - name: cargo build (workspace)
-        run: cargo build --workspace
-      - name: cargo test (translator-shim, bindgen)
-        run: cargo test -p translator-shim -p bindgen
-      - name: build the translator shim (wasm32)
-        # Every Deno suite below loads this artifact; order matters.
-        run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
-
-      # --- Guest fixtures + corpus --------------------------------------------
-      - name: build example guest components
-        # examples/guests/build/ is gitignored; the runtime e2e suites and
-        # ct-runner's fixture tests need it. wasmtime CLI is optional in
-        # build.sh (smoke run only when present) and deliberately not
-        # installed here.
-        run: ./examples/build.sh
-      - name: generate the conformance corpus
-        # Rehearsal finding: 20 runtime e2e tests self-skip when
-        # harness/generated is absent — generation must precede the runtime
-        # suite (318/0/3 with it; 298/0/23 without).
-        working-directory: harness
-        run: deno task gen
-
-      # --- Pinned engine-shell lanes (required; issue #22 follow-up) ---------
-      # Per-push/PR SpiderMonkey + JSC coverage at fixed, sha256-verified
-      # pins (tools/shell/pins.json) — NOT the always-moving nightly/trunk
-      # channels, which stay findings-only canaries in canary.yml. Both are
-      # `required: true` overlays; a deviation here exits 1 and fails this
-      # job (tools/shell/run-lane.ts's `exp.required ? 1 : 0` tail).
-      - name: fetch SpiderMonkey pinned (Firefox 153.0 jsshell)
-        run: deno run -A tools/shell/fetch.ts sm-pinned
-      - name: SpiderMonkey pinned lane (required)
-        run: deno run -A tools/shell/run-lane.ts sm-pinned
-      - name: fetch JSC pinned (rev 318852@main, x64 only)
-        # No arm64 channel for jsc-built-products (or its repo-owned mirror
-        # of this exact rev) — fetch.ts refuses cleanly on other arches.
-        if: runner.arch == 'X64'
-        run: deno run -A tools/shell/fetch.ts jsc-pinned
-      - name: JSC pinned lane (required, x64 only)
-        if: runner.arch == 'X64'
-        run: deno run -A tools/shell/run-lane.ts jsc-pinned
-
-      # --- Deno suites -------------------------------------------------------
-      - name: runtime
-        working-directory: runtime
-        run: |
-          deno task check
-          deno task test
-      - name: wasi-shims
-        working-directory: wasi-shims
-        run: deno task test
-      - name: ct-runner
-        working-directory: ct-runner
-        run: deno task test
-      - name: release bundle (embedder artifact gate)
-        run: deno test -A tools/release-bundle/bundle_test.ts
-      - name: conformance (official CM suite, Deno lane)
-        working-directory: harness
-        run: deno task conformance
-
-      # --- Seeded scheduler runs (spec-allowed nondeterminism) ---------------
-      - name: runtime under DELTIC_SCHED_SEED=1
-        working-directory: runtime
-        run: deno task test
-        env:
-          DELTIC_SCHED_SEED: "1"
-      - name: runtime under DELTIC_SCHED_SEED=4242
-        working-directory: runtime
-        run: deno task test
-        env:
-          DELTIC_SCHED_SEED: "4242"
-      - name: conformance under DELTIC_SCHED_SEED=1
-        working-directory: harness
-        run: deno task conformance
-        env:
-          DELTIC_SCHED_SEED: "1"
-
-      # --- Ports (unit suites only; consumer conformance legs need the
-      # --- polymorph checkouts and are follow-up scope, issue #6) ------------
-      - name: ports/webcrypto
-        working-directory: ports/webcrypto
-        run: deno test --allow-read tests/
-      - name: ports/websocket
-        working-directory: ports/websocket
-        run: deno task test
-      - name: ports/webrtc
-        working-directory: ports/webrtc
-        # node-datachannel is a Node-API addon with linux prebuilds for both
-        # x64 and arm64 (arm64 proven on the dev box; see tools/probes).
-        # NON-BLOCKING for now: GH Actions runners give libdatachannel no
-        # usable ICE path for same-host loopback pairing — all
-        # connection-forming tests time out on BOTH arches while the addon
-        # loads and non-connection tests pass (first run: 1 passed /
-        # 8 timed-out). The dev-box lane remains the real gate; issue #21
-        # tracks the runner-networking fix (loopback candidates /
-        # bindAddress / werift).
-        continue-on-error: true
-        run: |
-          deno install --allow-scripts=npm:node-datachannel
-          deno test -A webrtc.test.ts
+      # The job body lives in the `gha` just module (one workflow job = one
+      # `gha::` recipe, so `just ci` is exactly CI); step-level rationale
+      # lives on the root-justfile recipes it composes. Suite order,
+      # arch-conditional lanes (jsc-pinned is x64-only) and the tolerated
+      # webrtc suite (issue #21) are all encoded there.
+      - run: just gha::core
 
   browser:
     runs-on: ubuntu-24.04
@@ -164,44 +71,24 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }}
+          tool: wasm-tools@${{ env.WASM_TOOLS_VERSION }},just@${{ env.JUST_VERSION }}
       - uses: denoland/setup-deno@v2
         with:
           deno-version: ${{ env.DENO_VERSION }}
 
-      - name: build the translator shim (wasm32)
-        run: cargo build -p translator-shim --target wasm32-unknown-unknown --release
-      - name: generate the conformance corpus
-        working-directory: harness
-        run: deno task gen
-
       - name: cache playwright browsers
         uses: actions/cache@v4
         with:
           # run-lane.ts pins playwright@1.62.1 and a REPO-LOCAL browser cache
           # (PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache) — cache that path,
-          # not ~/.cache/ms-playwright (rehearsal finding).
+          # not ~/.cache/ms-playwright (rehearsal finding). The recipe's
+          # install step below restores into it.
           path: .browser-cache
           key: playwright-1.62.1-${{ runner.os }}-${{ runner.arch }}
-      - name: install browsers (chromium, firefox)
-        run: PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install --with-deps chromium firefox
-
-      - name: chromium lane (required — expects exact Deno-lane parity)
-        run: deno run -A tools/browser/run-lane.ts chromium
-      - name: firefox lane (required — JSPI pref set by the driver)
-        run: deno run -A tools/browser/run-lane.ts firefox
 
-      # WebKit is best-effort per docs/architecture.md §3/§12 (issue #11): the
-      # lane's expectation overlay
-      # encodes JSC's missing multi-memory; GH's ubuntu-24.04 matches the ABI
-      # playwright's WebKit wants, so no library staging should be needed —
-      # but the lane stays non-blocking until it has a track record.
-      - name: install webkit (best-effort)
-        continue-on-error: true
-        run: PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install --with-deps webkit
-      - name: webkit lane (best-effort)
-        continue-on-error: true
-        run: deno run -A tools/browser/run-lane.ts webkit
+      # shim + corpus + browser install (--with-deps) + the chromium/firefox
+      # required lanes + the best-effort webkit lane, per the recipes.
+      - run: just gha::browser
 
   # Every GREEN main ref update ships a prerelease (issue #16's interim
   # scheme): tag pre-<shorthash>, shim artifacts + SHA256SUMS. Gated on this
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index db91d5b..8b41d62 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just@1.54.0
       - uses: denoland/setup-deno@v2
         with:
           deno-version: "2.9.5"
@@ -48,32 +51,12 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-      - name: build translator shim (release)
-        run: |
-          cargo build -p translator-shim --target wasm32-unknown-unknown --release
-          cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim.wasm
-
-      - name: build translator shim (size-tuned)
-        # Flags exactly as documented in crates/translator-shim/README.md
-        # (reproduces the published size figures without editing the
-        # workspace manifest).
-        run: |
-          cargo build -p translator-shim --release --target wasm32-unknown-unknown \
-            --config 'profile.release.opt-level="z"' \
-            --config profile.release.lto=true \
-            --config profile.release.codegen-units=1 \
-            --config 'profile.release.panic="abort"' \
-            --config 'profile.release.strip=true'
-          cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim-min.wasm
-
-      - name: build embedder bundle
-        # The consumer-facing platform-neutral ES module (browser pages/
-        # workers + plain Node): tools/release-bundle/entry.ts, gated by
-        # tools/release-bundle/bundle_test.ts in the core matrix.
-        run: deno run -A tools/release-bundle/build.ts --out deltic-embedder.mjs
-
-      - name: checksums
-        run: sha256sum deltic-translator-shim.wasm deltic-translator-shim-min.wasm deltic-embedder.mjs > SHA256SUMS
+      - name: build the release artifacts
+        # `just release-artifacts` (root justfile): the standard shim, the
+        # size-tuned shim (flags per crates/translator-shim/README.md), the
+        # embedder bundle (tools/release-bundle/entry.ts, gated by
+        # bundle_test.ts in the core matrix), and SHA256SUMS.
+        run: just release-artifacts
 
       - name: create prerelease
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index 6f1e546..8232945 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -23,28 +23,31 @@ implementation safe.
 
 ## Gates (exact commands)
 
-Run the ones your change can affect; a full pass before commit looks like:
+The justfile is the command surface: recipe bodies are the exact commands,
+and each CI job runs exactly one `gha::` recipe (`just ci` = exactly CI;
+`.github/justfile` holds the job bodies). Run the recipes your change can
+affect; the full pass before commit is:
 
 ```sh
-cargo build --workspace
-cargo test -p translator-shim -p bindgen -p testgen
-(cd runtime && deno task check && deno task test)
-(cd harness && deno task conformance)        # official CM suite, Deno lane
-(cd wasi-shims && deno task test)
-(cd ct-runner && deno task test)
-deno test -A tools/release-bundle/bundle_test.ts  # embedder-bundle release asset
-(cd ports/websocket && deno task test)       # + deno task conformance (spawns their echod)
-deno run --allow-read tools/smoke-tls/run.ts --exec  # polymorph-tls suite (issue #18)
-(cd ports/webcrypto && deno test --allow-read tests/)
-(cd ports/webrtc && deno test -A webrtc.test.ts)
-deno run -A tools/browser/run-lane.ts chromium   # firefox / webkit likewise
-deno run -A tools/shell/run-lane.ts sm-pinned    # pinned engine shells (required
-                                                 # gates; jsc-pinned is x64-only)
-deno run -A --unstable-net exams/iroh-endpoint/run.ts   # needs iroh-relay on PATH
+just gates    # everything below, in this order
 ```
 
-Scheduler-order sensitivity: rerun affected suites with `DELTIC_SCHED_SEED=1`
-and `=4242` (seeded-shuffle mode; FIFO when unset).
+```sh
+just build test-rust      # cargo build --workspace; translator-shim/bindgen/testgen tests
+just test-runtime         # runtime check + tests (deps: shim, fixtures, corpus)
+just test-wasi-shims test-ct-runner
+just test-bundle          # embedder-bundle release asset
+just conformance          # official CM suite, Deno lane
+just sched-seeds          # seeded-shuffle reruns: DELTIC_SCHED_SEED=1, =4242 (FIFO when unset)
+just test-ports           # ports/webcrypto + ports/websocket unit suites
+just test-webrtc          # non-blocking in CI (#21); the dev box is the real gate
+just shells               # pinned engine shells, required gates (jsc-pinned is x64-only)
+just browsers             # chromium + firefox lanes (`just browsers-install` once)
+just websocket-conformance  # their suite under this host (spawns their echod)
+just smoke-tls            # polymorph-tls suite (issue #18)
+just smoke-c0             # C0 smoke legs
+just iroh-exam            # needs iroh-relay on PATH
+```
 
 Conformance discipline: the harness fails loudly on unexpected failures *and*
 on stale xfails; per-browser deltas live in `harness/browser/expectations/`
diff --git a/README.md b/README.md
index 143a2c2..4d31ef2 100644
--- a/README.md
+++ b/README.md
@@ -49,13 +49,13 @@ Pre-1.0, but densely gated:
 ```sh
 git clone --recursive https://github.com/lann/deltic
 cd deltic
-cargo build -p translator-shim --target wasm32-unknown-unknown --release
-(cd runtime && deno task test)          # runtime suite
-(cd harness && deno task conformance)   # official CM suite on Deno
-deno run -A tools/browser/run-lane.ts chromium   # same corpus, real browser
+just test-runtime    # runtime suite (builds the shim + fixtures + corpus first)
+just conformance     # official CM suite on Deno
+just browsers-install && just browser-lane chromium   # same corpus, real browser
 ```
 
-Deno workspace (TS) + cargo workspace (Rust).
+Deno workspace (TS) + cargo workspace (Rust); [`just`](https://github.com/casey/just)
+is the command surface (`just --list`; recipe bodies are the exact commands).
 
 ## Documentation
 
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..8413ad8
--- /dev/null
+++ b/justfile
@@ -0,0 +1,186 @@
+# The orchestration surface: repo-wide recipes here, the CI job bodies in
+# .github/justfile (the `gha` module) — each CI job runs exactly one
+# `gha::` recipe, so `just ci` is exactly CI. Recipe bodies are the exact
+# commands (AGENTS.md "Gates" maps onto them 1:1); comments that used to
+# live on workflow steps live on the recipes now.
+
+mod gha '.github'
+
+default:
+    @just --list
+
+# The canary lanes are findings-only crons (`gha::canary`, `gha::canary-arm`).
+# Exactly the CI jobs: the required `core` matrix + the post-merge `browser` job.
+ci: (gha::core) (gha::browser)
+
+# Includes the consumer smokes and exams CI cannot run (they need the
+# polymorph checkouts and iroh-relay; docs/consumers.md).
+# The full pre-commit pass (AGENTS.md "Gates"): everything.
+gates: build test-rust test-runtime test-wasi-shims test-ct-runner test-bundle conformance sched-seeds test-ports test-webrtc shells browsers websocket-conformance smoke-tls smoke-c0 iroh-exam
+
+# Fast sanity: builds + native tests + type-checks, no suites.
+check: build test-rust
+    cd runtime && deno task check
+    cd wasi-shims && deno task check
+    cd ct-runner && deno task check
+
+# ----- builders ---------------------------------------------------------------
+
+build:
+    cargo build --workspace
+
+# The translator shim wasm: every Deno suite below loads this artifact.
+shim:
+    cargo build -p translator-shim --target wasm32-unknown-unknown --release
+
+# wasmtime CLI is optional in build.sh (smoke run only when present).
+# Guest fixture components (examples/guests/build/, gitignored): the
+# runtime e2e suites and ct-runner's fixture tests need them.
+fixtures:
+    ./examples/build.sh
+
+# Rehearsal finding: 20 runtime e2e tests self-skip when it is absent —
+# generation must precede the runtime suite (318/0/3 with; 298/0/23 without).
+# The conformance corpus (harness/generated/).
+corpus:
+    cd harness && deno task gen
+
+# ----- core suites ------------------------------------------------------------
+
+test-rust:
+    cargo test -p translator-shim -p bindgen -p testgen
+
+test-runtime: shim fixtures corpus
+    cd runtime && deno task check && deno task test
+
+test-wasi-shims:
+    cd wasi-shims && deno task test
+
+test-ct-runner: shim fixtures
+    cd ct-runner && deno task test
+
+# The embedder-bundle release-asset gate (deltic-embedder.mjs:
+# build + shape checks for tools/release-bundle/entry.ts).
+test-bundle: shim
+    deno test -A tools/release-bundle/bundle_test.ts
+
+# The harness task chains corpus generation and the shim check itself.
+# The official CM conformance suite, Deno lane.
+conformance:
+    cd harness && deno task conformance
+
+# Scheduler-order sensitivity (docs/architecture.md §6) — spec-allowed
+# nondeterminism; FIFO when DELTIC_SCHED_SEED is unset.
+# The affected suites re-run under seeded-shuffle scheduling.
+sched-seeds: shim fixtures corpus
+    cd runtime && DELTIC_SCHED_SEED=1 deno task test
+    cd runtime && DELTIC_SCHED_SEED=4242 deno task test
+    cd harness && DELTIC_SCHED_SEED=1 deno task conformance
+
+# Consumer conformance legs are separate (`websocket-conformance` below).
+# Ports unit suites.
+test-ports:
+    cd ports/webcrypto && deno test --allow-read tests/
+    cd ports/websocket && deno task test
+
+# node-datachannel is a Node-API addon with linux prebuilds for both x64
+# and arm64. GH Actions runners give libdatachannel no usable ICE path
+# for same-host loopback pairing — connection-forming tests time out on
+# both arches while the addon loads and non-connection tests pass; issue
+# #21 tracks the runner-networking fix (loopback candidates / bindAddress
+# / werift).
+# webrtc unit suite — NON-BLOCKING in CI (#21); the dev box is the real gate.
+test-webrtc:
+    cd ports/webrtc && deno install --allow-scripts=npm:node-datachannel && deno test -A webrtc.test.ts
+
+# ----- engine lanes -----------------------------------------------------------
+
+# Pinned lanes (sm-pinned, jsc-pinned) are required gates — a deviation
+# exits 1; sha256-verified fetches (tools/shell/pins.json). Nightly/trunk
+# lanes (sm-nightly, jsc-trunk) are findings-only — exit 0 even with
+# deviations; 2 is reserved for infrastructure failure.
+# One engine-shell lane: fetch (cached), then run.
+shell-lane lane *args: shim corpus
+    deno run -A tools/shell/fetch.ts {{lane}}
+    deno run -A tools/shell/run-lane.ts {{lane}} {{args}}
+
+# JSC has no arm64 channel (jsc-built-products is x86_64-only), so its
+# lane guards on the arch and skips cleanly elsewhere.
+# The per-push pinned shell gates: sm-pinned everywhere; jsc-pinned on x64.
+shells:
+    just shell-lane sm-pinned
+    @if [ "$(uname -m)" = "x86_64" ]; then just shell-lane jsc-pinned; else echo "jsc-pinned: skipped (no arm64 channel)"; fi
+
+# The Deno canary probe (V8-trailing-edge d8-lane substitute; findings-only).
+deno-canary *args:
+    deno run -A tools/shell/deno-canary.ts {{args}}
+
+# The repo-local cache is what run-lane.ts expects
+# (PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache — cache THAT path in CI,
+# not ~/.cache/ms-playwright). CI passes --with-deps for system
+# libraries; locally a plain `just browsers-install` usually suffices.
+# One-time browser provisioning (chromium + firefox) into .browser-cache/.
+browsers-install *flags:
+    PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install {{flags}} chromium firefox
+
+# WebKit stays non-blocking until it has a track record (issue #11): the
+# lane's expectation overlay encodes JSC's missing multi-memory, and GH's
+# ubuntu-24.04 matches the ABI playwright's WebKit wants (no library
+# staging expected).
+browsers-install-webkit *flags:
+    PLAYWRIGHT_BROWSERS_PATH=$PWD/.browser-cache deno run -A npm:playwright@1.62.1 install {{flags}} webkit
+
+# chromium and firefox are required (chromium expects exact Deno-lane
+# parity; the firefox driver sets the JSPI pref itself — shipped-channel
+# config, unlike the jsshell); webkit is best-effort per
+# docs/architecture.md §3/§12 (issue #11).
+# One browser lane (chromium / firefox / webkit).
+browser-lane lane *args: shim corpus
+    deno run -A tools/browser/run-lane.ts {{lane}} {{args}}
+
+# The post-merge browser gates.
+browsers:
+    just browser-lane chromium
+    just browser-lane firefox
+
+# ----- consumer smokes + exams (polymorph checkouts; docs/consumers.md) -------
+
+# Translate all eight targets, then execute the suites.
+# polymorph-tls conformance under deltic (issue #18).
+smoke-tls: shim
+    deno run --allow-read tools/smoke-tls/run.ts --exec
+
+# The C0 smoke legs (tools/smoke-c0/REPORT.md).
+smoke-c0: shim
+    cd tools/smoke-c0 && deno task leg1 && deno task leg2 && deno task leg3 && deno task leg4
+
+# Spawns their echod; DENO_CERT rides the task definition.
+# The consumer's REAL websocket conformance suite under this host.
+websocket-conformance: shim
+    cd ports/websocket && deno task conformance
+
+# The iroh endpoint exit exam (needs iroh-relay on PATH).
+iroh-exam: shim
+    deno run -A --unstable-net exams/iroh-endpoint/run.ts
+
+# ----- release ----------------------------------------------------------------
+
+# The standard shim (what every suite runs against), the size-tuned
+# variant (flags per crates/translator-shim/README.md — reproduces the
+# published size figures without editing the workspace manifest), the
+# embedder bundle, and SHA256SUMS — all written to the repo root. NOTE:
+# the size-tuned build leaves the MIN shim in target/; rerun `just shim`
+# before running test suites locally afterwards.
+# The release artifacts, exactly as the release workflow publishes them.
+release-artifacts:
+    cargo build -p translator-shim --target wasm32-unknown-unknown --release
+    cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim.wasm
+    cargo build -p translator-shim --release --target wasm32-unknown-unknown \
+        --config 'profile.release.opt-level="z"' \
+        --config profile.release.lto=true \
+        --config profile.release.codegen-units=1 \
+        --config 'profile.release.panic="abort"' \
+        --config 'profile.release.strip=true'
+    cp target/wasm32-unknown-unknown/release/translator_shim.wasm deltic-translator-shim-min.wasm
+    deno run -A tools/release-bundle/build.ts --out deltic-embedder.mjs
+    sha256sum deltic-translator-shim.wasm deltic-translator-shim-min.wasm deltic-embedder.mjs > SHA256SUMS