Publish srcux candidate 0000000796-20261022-152902HEADdevelop

9 files changed, 344 insertions, 0 deletions

diff --git a/app-admin/keepassxc/Manifest b/app-admin/keepassxc/Manifest
index 06f99e1d9877..fdf03a034cf2 100644
--- a/app-admin/keepassxc/Manifest
+++ b/app-admin/keepassxc/Manifest
@@ -1,2 +1,3 @@
+DIST keepassxc-2.8.0_beta1.gh.tar.gz 14174746 BLAKE2B 2c71308a71010edab72171aca525178572c0c7ef4d81281db8e88870d5861392821db10f59728da2502ce5d2a47d531c114c8eef7ff746a40ce378f55e29b16a SHA512 7da0314ece6f7d53d483e635389f582e1932b038a368a8304c167cccce0b18f18feffe862d5f3efcb8a570bcd07eb31c58054621900e10abd0d7bfc947696e3b
 DIST keepassxc-2.8.0_pre20260504.tar.gz 13908020 BLAKE2B 739d25c24291c2daf833541c11447c9983c031926843976299a6a5e1d4be5a681e13aa551ffeecd03aa0d610d96275bba23f679be4ecd30b2d269ffda76143db SHA512 20fefe6d7363d80965c119f83afb8c73e4c9f2b7075b39f0501d6d42d7d1f35df0c8388b6aa4a3c8ed851f92472ec668aefd0d20de6a1dfc80e2a2e5858350fe
 DIST keepassxc-2.8.0_pre20260629.tar.gz 13931714 BLAKE2B 0df94fc7d7040da805f681f8c8c7f46faf260dfbaabf616f2e3375f59ff4ae5c39b15ac9a291371bf3e1fad11344c68937d1dbf813351f22bd6c92f77ddf9005 SHA512 5e811b6cbe30466b5b2e6129510b8f9f49910081db421a02494a1920dadbf5fbd39c5a524ab6f48e2bc01a0703c2fc2edf77a8fa0b1773f8b1f91ea67cecaf42
diff --git a/app-admin/keepassxc/keepassxc-2.8.0_beta1.ebuild b/app-admin/keepassxc/keepassxc-2.8.0_beta1.ebuild
new file mode 100644
index 000000000000..6afc98e9b748
--- /dev/null
+++ b/app-admin/keepassxc/keepassxc-2.8.0_beta1.ebuild
@@ -0,0 +1,109 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake xdg
+
+DESCRIPTION="KeePassXC - KeePass Cross-platform Community Edition"
+HOMEPAGE="https://keepassxc.org"
+
+if [[ "${PV}" = *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_BRANCH="develop"
+	EGIT_REPO_URI="https://github.com/keepassxreboot/${PN}"
+else
+	if [[ "${PV}" == *_beta* ]] ; then
+		SRC_URI="https://github.com/keepassxreboot/${PN}/archive/${PV/_/-}.tar.gz
+			-> ${P}.gh.tar.gz"
+		S="${WORKDIR}/${P/_/-}"
+	else
+		SRC_URI="https://github.com/keepassxreboot/${PN}/archive/${PV}.tar.gz
+			-> ${P}.gh.tar.gz"
+	fi
+
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv ~x86"
+fi
+
+# COPYING order
+LICENSE="|| ( GPL-2 GPL-3 ) BSD LGPL-2.1 MIT LGPL-2 CC0-1.0 Apache-2.0 GPL-2+ BSD-2"
+SLOT="0"
+IUSE="X browser doc +keyring +network +ssh-agent test"
+
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/botan:3=
+	dev-libs/libusb:1
+	>=dev-libs/zxcvbn-c-2.6
+	dev-qt/qtbase:6[concurrent,dbus,network]
+	dev-qt/qtsvg:6
+	media-gfx/qrencode:=
+	sys-apps/pcsc-lite
+	sys-apps/keyutils:=
+	sys-libs/readline:=
+	virtual/minizip:=
+	virtual/zlib:=
+	X? (
+		dev-qt/qtbase:6[X]
+		x11-libs/libXext
+		x11-libs/libX11
+		x11-libs/libXi
+		x11-libs/libXtst
+	)
+"
+DEPEND="
+	${RDEPEND}
+"
+BDEPEND="
+	dev-qt/qttools:6[linguist]
+	doc? (
+		dev-ruby/asciidoctor
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.8.0-cmake_minimum.patch"
+)
+
+CMAKE_SKIP_TESTS=(
+	testcli
+)
+
+src_prepare() {
+	if ! [[ "${PV}" =~ _beta|9999 ]]; then
+		echo "${PV}" > .version || die
+	fi
+
+	# Unbundle zxcvbn, bug 958062
+	rm -r ./src/thirdparty/zxcvbn || die
+
+	cmake_src_prepare
+}
+
+src_configure() {
+	local -a mycmakeargs=(
+		# Gentoo users enable ccache via e.g. FEATURES=ccache or
+		# other means. We don't want the build system to enable it for us.
+		-DWITH_CCACHE="OFF"
+		-DWITH_GUI_TESTS="OFF"
+		-DKPXC_FEATURE_UPDATES="OFF"
+
+		-DWITH_TESTS="$(usex test)"
+		-DKPXC_FEATURE_BROWSER="$(usex browser)"
+		-DKPXC_FEATURE_DOCS="$(usex doc)"
+		-DKPXC_FEATURE_FDOSECRETS="$(usex keyring)"
+		-DKPXC_FEATURE_NETWORK="$(usex network)"
+		-DKPXC_FEATURE_SSHAGENT="$(usex ssh-agent)"
+		-DWITH_X11="$(usex X)"
+	)
+
+	if [[ "${PV}" == *_beta* ]] ; then
+		mycmakeargs+=(
+			-DOVERRIDE_VERSION="${PV/_/-}"
+		)
+	fi
+
+	cmake_src_configure
+}
diff --git a/app-misc/smith/Manifest b/app-misc/smith/Manifest
index a1ba2fc024ee..241a9984204a 100644
--- a/app-misc/smith/Manifest
+++ b/app-misc/smith/Manifest
@@ -265,3 +265,4 @@ DIST zerovec-0.11.8.crate 130820 BLAKE2B 4022c968fb9676ed10b2108b156326cdb178534
 DIST zerovec-derive-0.11.6.crate 23102 BLAKE2B 879195255bc944ccfb1a711d5f3056ef2161cc3a65b815b95eb58c5d83db624cc0d8187f9eaa558f76827bbf2286ba084207bb8155dda33872b2b13d303d3588 SHA512 3044c2bcbdb07df5a6e2b5ce3eb45defb21307ee1acb14d720cd4f0d343c384f70aeda22541f72c247fa1ec9ebacfa1c0f05e4c05f87ef166f97c23ac621859e
 DIST zmij-1.0.23.crate 28612 BLAKE2B 5b1fda50a365ae6bba79ed8444f15dd184d0ba0d7b993c8f119355029b5d7cf6a4fe5d9f36eec722221725ed747cad5108eb707ef14920670ffa45843edcbfec SHA512 12f8d9726b232b6be68cefbe294505debb7a98715c11b95d89682a596fe1a02d9d7b2a6cdba97f2e8d47fa947ffbce9506a18568f2cab749ca3d03121e5fb66d
 DIST smith-0.11.1.tar.gz 214524 BLAKE2B 25fc7748a1e911819b09606d4b7a3b48e2d1298ceec48563a164f97184560eecfdf0d8a1eef154e01968e2b4880cbc62f23c2818fbb0423f89b20312eda7081f SHA512 64f7de9081dd3ee77496597ced23f202b5554af6c1f2335ef46c2e2f533d225c6f1deacff73251dd0661f15c4bcf5845977b33af1fc037f090748419acb7f756
+DIST smith-0.13.0.tar.gz 221206 BLAKE2B 34b83778468f0697635606adeb7ce4b7b1f78fc1acc3d52262880be7204b6bc6dbb55fe921e82ba8140e89d487771496d3e79285285d9586e8f8785788e07adf SHA512 377478ff7960342814703d90557e12f1fec7967071b7a2648b360352294b9833eb7a0cfdf576b514436ca12e07aba899eaff0f485d79234e14450bdad8bea0fa
diff --git a/app-misc/smith/smith-0.13.0.ebuild b/app-misc/smith/smith-0.13.0.ebuild
new file mode 100644
index 000000000000..bae408aca3dd
--- /dev/null
+++ b/app-misc/smith/smith-0.13.0.ebuild
@@ -0,0 +1,64 @@
+EAPI=8
+
+inherit cmake flag-o-matic
+
+DESCRIPTION="Agent Smith: terminal assistant with tools on this host, sessions on alpha (C++)"
+HOMEPAGE="https://trunkmasters.com/smith"
+SRC_URI="https://www.srcux.com/distfiles/${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="server"
+
+DEPEND="
+	=dev-libs/boost-1.91.0*
+	=dev-libs/openssl-3.6.5*
+	>=dev-db/sqlite-3.53:3
+	=dev-cpp/nlohmann_json-3.12.0*
+	=dev-cpp/tomlplusplus-3.4.0*
+"
+# The client runs sandboxed commands in bubblewrap and logs in over OpenSSH. The
+# server runs as an existing `smith` account (on Alpha it predates any acct package).
+RDEPEND="
+	${DEPEND}
+	dev-vcs/git
+	net-misc/openssh
+	sys-apps/bubblewrap
+"
+BDEPEND="
+	dev-vcs/git
+	=dev-cpp/catch-3.15.3*
+	>=dev-lang/python-3.11
+"
+
+src_configure() {
+	# The project refuses in-source builds and requires an absolute build root.
+	export SMITH_CPP_BUILD_ROOT="${WORKDIR}/build"
+	local mycmakeargs=( -DSMITH_SANITIZER=none )
+	cmake_src_configure
+}
+
+src_test() {
+	# The end-to-end tests (sockets, TLS, a pty) run in CI, outside the Portage sandbox.
+	cmake_src_test -R '^unit$'
+}
+
+src_install() {
+	cmake_src_install
+	if use server; then
+		newinitd "${ED}"/usr/share/smith/openrc/smithd.initd smithd
+		newconfd "${ED}"/usr/share/smith/openrc/smithd.confd smithd
+	else
+		rm "${ED}"/usr/sbin/smithd "${ED}"/usr/libexec/smith/smith-mcp || die
+	fi
+}
+
+pkg_postinst() {
+	use server || return
+	elog "Server: needs the system account smith (and AIRouter's account in group of the"
+	elog "relay socket). Start from /usr/share/smith/server.toml.example as /etc/smith/server.toml"
+	elog "(root:smith 0640). AIRouter needs a smith principal, the smith role and a profile"
+	elog "pinned to it whose resource server is /usr/libexec/smith/smith-mcp with"
+	elog "SMITH_MCP_SOCKET=/run/smith/relay/relay.sock. Then: rc-service smithd start."
+}
diff --git a/net-misc/airouter/Manifest b/net-misc/airouter/Manifest
index 25bb7ba00823..b8ccf5e2bfd0 100644
--- a/net-misc/airouter/Manifest
+++ b/net-misc/airouter/Manifest
@@ -12,3 +12,4 @@ DIST airouter-0.1.2-r9.tar.zst 87680153 BLAKE2B 66cef0000fdb9101dec8c96aaefd5a90
 DIST mime_guess-2.0.5.crate 27166 BLAKE2B a8ec67e16a336e7d07c9aaa55025c24c3d4a62aae25213ce768786d9f292b76930132a880d662cd9a5d63aa899e9d488ab76fa9d99350e9f448ef484705ba4d9 SHA512 433c876e28394282cfbe14bb9543616cd296879f253ed331c15ace8a7d9f3629f5b596c2d5a64823a97ca9b774acc711b65006c46d54d1e9ee0553cbf1f13b7c
 DIST airouter-1.0.0_pre20261012.tar.gz 685451 BLAKE2B a07b1dd5d20ffc86d959394b74431cfc4bf3aee4d76a161e97ece035ba3460cded3cbd7df695e0b94956ae54cb4e5a9e98d47ee69277684664451a000b90d448 SHA512 c6110b5749cfc8ec7ab827303e537c0d5690ba803f022f1380de4d2fe5220590282d6d055e1de9f3809d00d1462c12d1ead276aabb09ecadb519bdaa8d005bb7
 DIST airouter-1.0.0_pre20261012_p6.tar.gz 796203 BLAKE2B c9f233815c85e3b17a10ba23d43f5e856f725b1e6222a8924b8d7a90bca2a72c26bda5a80c13f56ac458d7e350cd9f4f57cf2b2898bfbdbc4290005a34ed709d SHA512 b10b9433d04cc94c1ec13cb50c51bbacb27e3e5df813df351fad6788c3746e3dd5bfec980c45efbbc22ca81c2b33101a156a9bda337e417769cae1b4faba2e7f
+DIST airouter-1.0.0_pre20261022_p1.tar.gz 1190068 BLAKE2B 8df5da14210d801bb18046ce1eeb01b7c4fb9cf2275a806e922105fa192ddd7ba2c86d33f733566390661ddb113050a8e536b764246b016e3b37f35e350be5c5 SHA512 0ec3f3194d182035c0dbff883b69ce21f0edce98d89aeca7dc2110e608ceb21310285770be6c5cb28b341dc59bc14c03e7902d26b2af04ef1eb1793b4d4a706f
diff --git a/net-misc/airouter/airouter-1.0.0_pre20261022_p1.ebuild b/net-misc/airouter/airouter-1.0.0_pre20261022_p1.ebuild
new file mode 100644
index 000000000000..b68fda2cdd95
--- /dev/null
+++ b/net-misc/airouter/airouter-1.0.0_pre20261022_p1.ebuild
@@ -0,0 +1,78 @@
+EAPI=8
+
+inherit cmake flag-o-matic
+
+DESCRIPTION="AIRouter runtime (C++; replaces the Rust 0.1.x airouterd)"
+HOMEPAGE="https://trunkmasters.com/airouter"
+SRC_URI="https://www.srcux.com/distfiles/${P}.tar.gz"
+
+# Mirrors the Rust net-misc/airouter; the license declaration is an owner decision.
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# The build pins exact dependency versions (M0 host pins). Compiler pins are
+# enforced by CMake itself (GCC 14.4.1 or Clang 23.1.3).
+DEPEND="
+	=dev-libs/boost-1.91.0*
+	=dev-libs/openssl-3.6.5*
+	=dev-db/postgresql-18.6*
+	=dev-cpp/nlohmann_json-3.12.0*
+	=dev-cpp/tomlplusplus-3.4.0*
+	=dev-cpp/yaml-cpp-0.9.0*
+"
+# chronyc reports are parsed in their verified CSV shapes (ADR-05 [time]).
+RDEPEND="
+	${DEPEND}
+	>=acct-group/airouter-1
+	>=acct-user/airouter-1
+	app-admin/sudo
+	=net-misc/chrony-4.9*
+	>=dev-lang/python-3.11
+"
+BDEPEND="
+	=dev-cpp/catch-3.15.3*
+	>=dev-lang/python-3.11
+"
+
+src_configure() {
+	# The project refuses in-source builds and requires an absolute build root.
+	export AIROUTER_CPP_BUILD_ROOT="${WORKDIR}/build"
+	# GCC 14 at -O2 reports -Wmismatched-new-delete (a -Werror error here) inside
+	# Boost.Asio's recycling awaitable-frame allocator: operator new and operator delete
+	# are a matched pair, but GCC sees the inlined aligned_alloc. The CMake presets
+	# (-O0, -O3) do not trigger it. Only this one diagnostic is disabled; -Werror stays.
+	append-cxxflags -Wno-mismatched-new-delete
+	local mycmakeargs=( -DAIROUTER_SANITIZER=none )
+	cmake_src_configure
+}
+
+src_test() {
+	# Unit and digest-vector tests run here. The PostgreSQL/bwrap end-to-end and the
+	# install-layout tests run in CI, outside the Portage sandbox.
+	cmake_src_test -R '^m1-(unit|digest-vectors)$'
+}
+
+src_install() {
+	cmake_src_install
+	newinitd "${ED}"/usr/share/airouter/openrc/airouterd.initd airouterd
+	newconfd "${ED}"/usr/share/airouter/openrc/airouterd.confd airouterd
+	insinto /etc/airouter
+	newins packaging/airouterd.toml.example airouterd.toml.example
+	# /var/lib/airouter is the acct-user home (owned there); the service's
+	# start_pre creates its receipts, run and log directories with checkpath.
+}
+
+pkg_postinst() {
+	elog "Copy /etc/airouter/airouterd.toml.example to airouterd.toml,"
+	elog "apply the schema with airouter-migrate (as the migrator role, from"
+	elog "/usr/share/airouter/sql), keep execution.cgroup equal to AIROUTERD_CGROUP"
+	elog "in /etc/conf.d/airouterd (the service delegates it at start),"
+	elog "create the [history] directory on its own filesystem (for example a ZFS dataset"
+	elog "outside the database's snapshots and backups; the daemon refuses a shared one),"
+	elog "set [time] to the NTS-authenticated chronyd (its socket, uid, config, the"
+	elog "config's sha256sum and the addresses its NTS server name resolves to), install"
+	elog "/usr/share/airouter/sudoers.airouter as /etc/sudoers.d/airouterd with"
+	elog "those addresses (it lets the service read chronyd's reports as ntp),"
+	elog "then: rc-service airouterd start."
+}
diff --git a/profiles/package.mask/srcux-workarounds b/profiles/package.mask/srcux-workarounds
index c68e33da21d8..705ba0bef4fd 100644
--- a/profiles/package.mask/srcux-workarounds
+++ b/profiles/package.mask/srcux-workarounds
@@ -25,14 +25,24 @@
 # 2026-10-12: AIRouter C++ (replaces the Rust 0.1.2 line; runs on Alpha). Masked so
 # hosts with the Rust AIRouter are not upgraded by a world update; unmask per host
 # (bravo first, for the two-host qualification gate).
+# 2026-10-22: _pre20261022_p1 added (shared work briefing; schema 16, so migrations 9-16
+# from _p6; the same mask applies).
 =net-misc/airouter-1.0.0_pre20261012
 =net-misc/airouter-1.0.0_pre20261012_p6
+=net-misc/airouter-1.0.0_pre20261022_p1
 =acct-user/airouter-1
 =acct-group/airouter-1
 
 # 2026-10-18: smith C++ 0.11.x, now 0.11.1 (replaces the Rust 0.2.0 line; runs on Alpha and the
 # desktop). Masked so hosts with Rust smith are not upgraded by a world update; unmask
 # per host. USE=server also needs a smith account, a PKI and a local AIRouter node.
+# 2026-10-22: 0.13.0 added (`smith work` needs AIRouter >= _pre20261022, `shared_work = true` _p1).
 =app-misc/smith-0.11.1
+=app-misc/smith-0.13.0
 =acct-user/smith-0
 =acct-group/smith-0
+
+# 2026-10-22: Workbench C++ 1.0.8 (replaces the Rust 0.1.0 line; runs on Alpha). Masked so
+# hosts with the Rust Workbench are not upgraded by a world update (it also needs the masked
+# C++ AIRouter); unmask per host.
+=www-apps/workbench-1.0.8
diff --git a/www-apps/workbench/Manifest b/www-apps/workbench/Manifest
index 4ea2bcee2714..e2960094b65e 100644
--- a/www-apps/workbench/Manifest
+++ b/www-apps/workbench/Manifest
@@ -1,3 +1,5 @@
 DIST workbench-0.1.0.tar.zst 42553058 BLAKE2B c0e1787476d9afd60eea27ce0a74bc25ab07c11a18ebf8bcff635f771fb8f86854ccc3b8cc7c9248576a88dfffed6f2c88382eaf94f236b252917cba9eea3c8a SHA512 1300dfd982ec81ab8b460152d31e3a5fa1950f478dec7454d8ebd0be4f6b917d5e02763e90aa0ce2166a89bd7482443ee6dd7f328a3bfd10215a501e3ddb1bf8
 DIST workbench-0.1.0-r1.tar.zst 43089066 BLAKE2B 58494876b6d94cdc1b29326f7ad2c95e7eb890f20626bcc6a13fa5a42197c8624166a7aa42b25c8bd32d4341b896f6aba707bd497204ee2540cd625e3f973f4b SHA512 c7d0e436d11882027540b9fea2eea5c3931d3a797cf030ce24f1bc77f9298b63577c05b349fa6d9988272ceb6b8a17fc410f22a020e5a0e38bc011159de8d226
 DIST workbench-0.1.0-r2.tar.zst 43088702 BLAKE2B 3e724164f5c36682e8f474b3807a6e7c964e02dffeb1c27f716c1d5e6dddb5a3b1154c1199771e4b9f0d5a5f9265afa851d9021872ee99678a513d8b48f910a3 SHA512 5e495ceb33082471db8b33818432f06c2b69d1690036abb73df4e96d46a88a120986b61f340576056603f73a5d40437f2ed40540d0753404775bb88abd649f0c
+DIST airouter-1.0.0_pre20261022.tar.gz 1161236 BLAKE2B de9048a7b92a09831562dfb28fc55b8544e8ea0cd5435120aa607703acc6546a09d2a33588a0a130d595b54c2acd833601a302c2e2c1c0463f815d215fa16a03 SHA512 fe5b08a7c1c01fbf841eacecbaa041bc1d133742f24301a1e6e69a78f9b0d072c59560512b084178fe205323c7097123604a2fbe3b9631de9a68547c041f87b8
+DIST workbench-1.0.8.tar.gz 449768 BLAKE2B 660ac12ff294cc1556e47c16e66c36f7889fdfa5d919b9227aa9531dcb100c3165bab47680f4cbcc96b4f446fe9b06ae270a3262935437c741be2a50fedeb5ab SHA512 524d7b65eb208a6e0695e75e5201abd9b66874dd7410b6381931f6b1c3e40b2b9c138c3d71ab5681f5f0ada79ad99456d73a05b8f89b76c7661718f295513f6f
diff --git a/www-apps/workbench/workbench-1.0.8.ebuild b/www-apps/workbench/workbench-1.0.8.ebuild
new file mode 100644
index 000000000000..7eed086fd827
--- /dev/null
+++ b/www-apps/workbench/workbench-1.0.8.ebuild
@@ -0,0 +1,78 @@
+EAPI=8
+
+inherit cmake
+
+DESCRIPTION="Workbench: projects, conversations and agent runs through AIRouter (C++)"
+HOMEPAGE="https://trunkmasters.com/workbench"
+# The shared memory export compiles AIRouter's legacy-memory component from AIRouter's
+# own source archive (the same version as the AIRouter package it pairs with).
+AIROUTER_PV="1.0.0_pre20261022"
+SRC_URI="https://www.srcux.com/distfiles/${P}.tar.gz
+	https://www.srcux.com/distfiles/airouter-${AIROUTER_PV}.tar.gz"
+
+# The application carries no grant of an open-source license.
+LICENSE="all-rights-reserved"
+SLOT="0"
+KEYWORDS="~amd64"
+RESTRICT="mirror bindist"
+
+DEPEND="
+	=dev-libs/boost-1.91.0*
+	=dev-libs/openssl-3.6.5*
+	=dev-db/postgresql-18.6*
+	=dev-cpp/nlohmann_json-3.12.0*
+	=dev-cpp/tomlplusplus-3.4.0*
+	=dev-cpp/jsoncons-1.6.0*
+"
+# Runtime: the AIRouter API for turns, Citadel sign-in, the Codegraph engine (Node)
+# in bubblewrap, ffmpeg and the local whisper-server for voice input, sudo for the
+# admin tools and the root release executor, curl/runuser/prlimit for the verifiers.
+RDEPEND="
+	${DEPEND}
+	acct-user/workbench
+	acct-group/workbench
+	app-admin/sudo
+	>=net-misc/airouter-${AIROUTER_PV}
+	sys-auth/citadel
+	dev-util/codegraph
+	net-libs/nodejs
+	media-video/ffmpeg
+	app-accessibility/whisper-cpp
+	dev-vcs/git
+	net-misc/curl
+	sys-apps/acl
+	sys-apps/bubblewrap
+	sys-apps/util-linux
+"
+BDEPEND="
+	=dev-cpp/catch-3.15.3*
+	>=dev-lang/python-3.11
+"
+
+src_configure() {
+	# The project refuses in-source builds and requires an absolute build root.
+	export WORKBENCH_CPP_BUILD_ROOT="${WORKDIR}/build"
+	local mycmakeargs=(
+		-DWB_SANITIZER=none
+		-DWB_AIROUTER_MEMORY_SOURCE="${WORKDIR}/airouter-${AIROUTER_PV}"
+	)
+	cmake_src_configure
+}
+
+src_test() {
+	# The end-to-end tests need PostgreSQL and sockets; they run outside the sandbox.
+	cmake_src_test -R '^unit$'
+}
+
+src_install() {
+	cmake_src_install
+	newinitd "${ED}"/usr/share/workbench/openrc/workbenchd.initd workbenchd
+	newconfd "${ED}"/usr/share/workbench/openrc/workbenchd.confd workbenchd
+	# /var/lib/workbench (the workspaces, with their ACLs) is not the package's to set.
+}
+
+pkg_postinst() {
+	elog "workbenchd serves /run/workbench/http.socket (symlinked from /run/workbench.sock)"
+	elog "for Apache, AIRouter's wb-mcp and task gateways. It needs WB_SESSION_SECRET in"
+	elog "/etc/workbench/secrets.env and the workbench database. Then: rc-service workbenchd start."
+}