Add v1.0 enterprise features, desktop integration, and tooling

MUST features:
- install.sh: Full installation script with all components
- scripts/cloud-sync-status: Health check command with JSON output
- systemd/cloud-sync-watchdog.*: Error recovery timer/service

SHOULD features:
- selinux/: Full SELinux policy module (rclone_t confined domain)
- audit/: auditd rules for enterprise compliance logging
- overlay-daemon/: Rust daemon for file manager sync status
- tray-daemon/: System tray daemon with notifications
- nautilus-extension/: Nautilus sync status emblems
- dolphin-extension/: Dolphin context menu actions

Tooling:
- justfile: Comprehensive recipes including cookbooks
- config/schema.ncl: Nickel configuration schema
- .laminar/: CI integration for laminar
- tests/: Ada test runner and SPARK formal verification

Documentation:
- README.adoc: Updated with v1.0 features section

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.laminar/cloud-sync-tuner.run

@@ -0,0 +1,49 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Laminar CI job for cloud-sync-tuner
+# Place in /var/lib/laminar/cfg/jobs/
+
+set -euo pipefail
+
+echo "=== Cloud Sync Tuner CI ==="
+echo "Commit: ${GIT_COMMIT:-unknown}"
+echo "Branch: ${GIT_BRANCH:-unknown}"
+echo ""
+
+# Checkout
+cd "$WORKSPACE"
+git fetch --all
+git checkout "${GIT_COMMIT:-HEAD}"
+
+# Build
+echo "=== Building ==="
+just build
+
+# Lint
+echo "=== Linting ==="
+just lint
+
+# Test
+echo "=== Testing ==="
+just test
+
+# Security scan
+echo "=== Security Scan ==="
+if command -v cargo-audit &>/dev/null; then
+    cd overlay-daemon && cargo audit
+    cd ../tray-daemon && cargo audit
+    cd ..
+fi
+
+# Build SELinux policy (don't fail if selinux-devel missing)
+echo "=== SELinux Policy ==="
+just build-selinux || echo "SELinux build skipped (missing deps)"
+
+# Package
+echo "=== Packaging ==="
+VERSION=$(grep -oP 'Version : constant String := "\K[^"]+' src/cloud_sync_tuner.adb)
+just release "$VERSION"
+
+echo ""
+echo "=== CI Complete ==="
+echo "Artifact: dist/cloud-sync-tuner-${VERSION}.tar.gz"

README.adoc

@@ -220,6 +220,57 @@ This tool complements https://github.com/hyperpolymath/laminar[laminar] for clou
 |Android |- |✓ |✓ |- |No mounts, remote ops only
 |===
 
+== v1.0 Features
+
+=== Smart Sync
+
+[cols="1,2"]
+|===
+|Feature |Description
+
+|Cache size limits |Auto-evict old files when cache exceeds threshold
+|Min free space |Emergency eviction when disk runs low
+|Write-back buffering |Buffer writes locally before uploading
+|Pinned folders |Mark folders for offline access (like native clients)
+|Bandwidth scheduling |Time-based bandwidth limits
+|Conflict resolution |Configurable strategy (newer/older/larger/path1)
+|===
+
+=== Desktop Integration
+
+* **System tray daemon** (`cloud-sync-tray`) - Real-time sync status icon
+* **Nautilus extension** - Sync status emblems in GNOME Files
+* **Dolphin service menu** - Context menu actions in KDE
+* **Desktop notifications** - Alerts for sync events
+
+=== Enterprise Features
+
+* **SELinux policy** - Confined `rclone_t` domain
+* **Auditd rules** - File access logging for compliance
+* **Health check** - `cloud-sync-status` command for monitoring
+* **Watchdog timer** - Automatic service recovery
+
+=== Just Recipes
+
+[source,bash]
+----
+just cookbook-dropbox-fix      # Fix Dropbox rate limiting
+just cookbook-offline-setup    # Setup offline folders
+just cookbook-max-performance  # Maximum caching
+just cookbook-enterprise       # Enable SELinux + audit
+----
+
+== Installation (v1.0)
+
+[source,bash]
+----
+git clone https://github.com/hyperpolymath/cloud-sync-tuner
+cd cloud-sync-tuner
+just install
+----
+
+See `justfile` for all available recipes.
+
 == License
 
 AGPL-3.0-or-later

audit/cloud-sync-tuner.rules

@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# auditd rules for cloud-sync-tuner
+# Enterprise compliance logging for cloud file access
+
+# Rule identification key
+-k cloud-sync
+
+########################################
+# Monitor rclone binary execution
+########################################
+-w /home/hyper/.local/bin/rclone -p x -k cloud-sync-exec
+-w /usr/bin/rclone -p x -k cloud-sync-exec
+
+########################################
+# Monitor configuration changes
+########################################
+-w /home/hyper/.config/rclone/rclone.conf -p wa -k cloud-sync-config
+-w /home/hyper/.config/cloud-sync-tuner/ -p wa -k cloud-sync-config
+
+########################################
+# Monitor mount point access
+# Note: Excessive logging may occur - tune for your needs
+########################################
+
+# Dropbox mount - file modifications only (not reads)
+-w /run/media/hyper/eclipse/Cloud/Dropbox -p wa -k cloud-sync-dropbox
+
+# Google Drive mount - file modifications only
+-w /run/media/hyper/eclipse/Cloud/GoogleDrive -p wa -k cloud-sync-gdrive
+
+# OneDrive mount - file modifications only
+-w /run/media/hyper/eclipse/Cloud/OneDrive -p wa -k cloud-sync-onedrive
+
+########################################
+# Monitor cache directory for debugging
+# Uncomment for troubleshooting only
+########################################
+# -w /home/hyper/.cache/rclone -p wa -k cloud-sync-cache
+
+########################################
+# Monitor offline sync directory
+########################################
+-w /home/hyper/Offline -p wa -k cloud-sync-offline
+
+########################################
+# Monitor systemd service changes
+########################################
+-w /home/hyper/.config/systemd/user/rclone-dropbox.service -p wa -k cloud-sync-service
+-w /home/hyper/.config/systemd/user/rclone-gdrive.service -p wa -k cloud-sync-service
+-w /home/hyper/.config/systemd/user/rclone-onedrive.service -p wa -k cloud-sync-service
+
+########################################
+# Monitor credential access
+########################################
+-w /home/hyper/.config/rclone/rclone.conf -p r -k cloud-sync-cred-access
+
+########################################
+# FUSE device access
+########################################
+-a always,exit -F arch=b64 -S open,openat -F path=/dev/fuse -k cloud-sync-fuse

config/schema.ncl

@@ -0,0 +1,179 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Cloud Sync Tuner - Nickel Configuration Schema
+# Validates and generates TOML configuration
+
+let CacheMode = [| 'Off, 'Minimal, 'Writes, 'Full |] in
+
+let ConflictStrategy = [| 'None, 'Newer, 'Older, 'Larger, 'Smaller, 'Path1, 'Path2 |] in
+
+let RateLimiting = {
+  tps_limit | Number | default = 4
+    | doc "Transactions per second (1-100)",
+  tps_burst | Number | default = 1
+    | doc "Burst allowance (1-10)",
+  chunk_size_mb | Number | default = 32
+    | doc "Read chunk size in MB (1-512)",
+  cache_age_hours | Number | default = 72
+    | doc "Cache entry max age in hours (1-168)",
+  dir_cache_min | Number | default = 5
+    | doc "Directory cache time in minutes (1-60)",
+} in
+
+let SmartSync = {
+  cache_max_size_gb | Number | default = 10
+    | doc "Maximum cache size in GB (0 = unlimited)",
+  min_free_space_gb | Number | default = 5
+    | doc "Minimum free disk space in GB",
+  write_back_sec | Number | default = 5
+    | doc "Write-back delay in seconds (1-60)",
+  poll_interval_min | Number | default = 1
+    | doc "Remote change poll interval in minutes (1-60)",
+  buffer_size_mb | Number | default = 16
+    | doc "Buffer size in MB (1-128)",
+  transfers | Number | default = 4
+    | doc "Concurrent transfers (1-32)",
+  checkers | Number | default = 8
+    | doc "Concurrent checkers (1-64)",
+} in
+
+let ScheduleEntry = {
+  start | Number
+    | doc "Start hour (0-23)",
+  end | Number
+    | doc "End hour (0-23)",
+  limit_kbps | Number
+    | doc "Bandwidth limit in KB/s (0 = unlimited)",
+} in
+
+let Bandwidth = {
+  enabled | Bool | default = false
+    | doc "Enable bandwidth scheduling",
+  schedule | Array ScheduleEntry | default = []
+    | doc "Schedule entries",
+} in
+
+let Service = {
+  name | String
+    | doc "Display name",
+  remote | String
+    | doc "rclone remote name (e.g., 'dropbox:')",
+  mount_point | String
+    | doc "Local mount path",
+  service_name | String
+    | doc "systemd service name",
+  enabled | Bool | default = true
+    | doc "Whether service is enabled",
+  rc_port | Number | optional
+    | doc "rclone RC port for this service",
+
+  # Service-specific overrides
+  tps_limit | Number | optional,
+  tps_burst | Number | optional,
+  chunk_size_mb | Number | optional,
+} in
+
+let PinnedFolder = {
+  service | String
+    | doc "Service name (dropbox, gdrive, onedrive)",
+  remote_path | String
+    | doc "Path on remote (e.g., 'Documents/Important')",
+  local_path | String
+    | doc "Local sync path (e.g., '~/Offline/Dropbox/Documents')",
+  enabled | Bool | default = true
+    | doc "Whether folder is pinned",
+} in
+
+let Config = {
+  general | {
+    cache_mode | CacheMode | default = 'Writes
+      | doc "VFS cache mode",
+    desktop_notify | Bool | default = true
+      | doc "Desktop notifications",
+    tray_icon | Bool | default = true
+      | doc "System tray icon",
+    offline_dir | String | default = "~/Offline"
+      | doc "Offline sync directory",
+  },
+
+  rate_limiting | RateLimiting | default = {},
+  smart_sync | SmartSync | default = {},
+
+  conflict_resolution | {
+    strategy | ConflictStrategy | default = 'Newer
+      | doc "Conflict resolution strategy",
+  } | default = {},
+
+  bandwidth | Bandwidth | default = {},
+
+  services | Array Service | default = [],
+  pinned_folders | Array PinnedFolder | default = [],
+} in
+
+# Presets
+let presets = {
+  dropbox = {
+    general.cache_mode = 'Writes,
+    rate_limiting = {
+      tps_limit = 4,
+      tps_burst = 1,
+      chunk_size_mb = 32,
+    },
+  },
+
+  gdrive = {
+    general.cache_mode = 'Writes,
+    rate_limiting = {
+      tps_limit = 8,
+      tps_burst = 2,
+      chunk_size_mb = 64,
+    },
+  },
+
+  onedrive = {
+    general.cache_mode = 'Writes,
+    rate_limiting = {
+      tps_limit = 6,
+      tps_burst = 2,
+      chunk_size_mb = 32,
+    },
+  },
+
+  minimal = {
+    general.cache_mode = 'Writes,
+    smart_sync = {
+      cache_max_size_gb = 2,
+      transfers = 2,
+      checkers = 4,
+      buffer_size_mb = 8,
+    },
+  },
+
+  performance = {
+    general.cache_mode = 'Full,
+    smart_sync = {
+      cache_max_size_gb = 50,
+      transfers = 8,
+      checkers = 16,
+      buffer_size_mb = 64,
+    },
+  },
+} in
+
+# Export schema and presets
+{
+  Config,
+  presets,
+
+  # Validation function
+  validate = fun config =>
+    let valid_tps = config.rate_limiting.tps_limit >= 1
+                  && config.rate_limiting.tps_limit <= 100 in
+    let valid_burst = config.rate_limiting.tps_burst >= 1
+                    && config.rate_limiting.tps_burst <= 10 in
+    let valid_chunk = config.rate_limiting.chunk_size_mb >= 1
+                    && config.rate_limiting.chunk_size_mb <= 512 in
+    valid_tps && valid_burst && valid_chunk,
+
+  # Generate TOML output
+  to_toml = fun config => std.serialize 'Toml config,
+}

dolphin-extension/README.md

@@ -0,0 +1,36 @@
+# Dolphin Integration
+
+## Service Menu (Context Menu)
+
+Install the service menu for right-click actions:
+
+```bash
+mkdir -p ~/.local/share/kservices5/ServiceMenus/
+cp cloud_sync_overlay.desktop ~/.local/share/kservices5/ServiceMenus/
+```
+
+## Overlay Icons
+
+Dolphin supports overlay icons via the `fileoverlaysplugin`. The cloud-sync-overlay
+daemon exposes status via D-Bus which Dolphin can query.
+
+For KDE Plasma 6+, install the overlay plugin:
+
+```bash
+# Fedora
+sudo dnf install dolphin-plugins
+
+# The daemon must be running:
+systemctl --user start cloud-sync-overlay
+```
+
+## Alternative: Using .directory Files
+
+For directories, you can set emblems via `.directory` files:
+
+```ini
+[Desktop Entry]
+Icon=folder-cloud
+```
+
+The daemon can automatically manage these files for cloud directories.