Rust CLI for the Niobium Fog "jobs-as-a-service" replay path. Behavioral drop-in for the vendor's scripts/fog Python CLI: same REST contract, same ~/.fog INI config and credentials files, same FOG_* and NBCC_FHETCH_* environment variables, same submit → long-poll → env handoff → child-exec model.

Commands

fogrs init                     write ~/.fog/config with defaults
fogrs login [-u EMAIL] [-n NAME]  provision a named API key (echo-off
                                  password prompt; token to stdout)
fogrs submit ./app --target=T ...   provision a job, run your OpenFHE app
fogrs submit --target=T ...         exec the transport client directly
fogrs list                     all your jobs (table)
fogrs get ID [ID...]           full JSON per job
fogrs cancel ID [ID...]        cancel/release jobs
fogrs cancel --pending         cancel every in-flight job

Driver mode: when invoked with a leading option (no subcommand word) it behaves as submit — that is how OpenFHE replay() spawns $NBCC_FHETCH_REPLAY.

Build (canonical)

OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu OPENSSL_INCLUDE_DIR=/usr/include \
    cargo build --release --locked
cargo test --locked               # regression: creds created at 0600
# OPENSSL_* vars: Ubuntu multiarch puts libssl.so in the triplet dir,
# which openssl-sys does not probe by default. Set once per shell or
# stick `export` lines in your profile.

TLS is provided by the SYSTEM OpenSSL (dynamic link) — ldd fogrs | grep ssl shows libssl.so.3 / libcrypto.so.3. Requires libssl-dev at build time and a compatible libssl.so.3 at runtime (true for all standard Debian/Ubuntu installs; a scratch copy to a machine without it will fail to load — acceptable for our single workstation, document before redistributing).

Install: copy target/release/fogrs to ~/.local/bin/ (keep the vendor fog intact; both can coexist on PATH).

Dependencies (intentionally minimal)

• ureq 3.4, default-features = false, features = ["native-tls"] — https-only TLS through the system OpenSSL stack; no gzip/charset extras.
• serde_json 1.0 — the Fog API speaks JSON end to end.

34 crate instances total — TLS crypto comes from the OS package, not cargo. Going smaller would mean dropping certificate verification entirely, which we won't do for a token-bearing client.

Security notes

• Credentials (~/.fog/credentials) are created mode 0600 atomically — the token is never group/world-readable, even momentarily.
• Login reads the password from /dev/tty with terminal echo disabled (getpass-equivalent; warns and falls back to stdin only when no tty).
• NBCC_FHETCH_SERVER is always https, and NBCC_FHETCH_REPLAY is always an absolute path (the child may change cwd).

Verified

• Gate A: fogrs list byte-column-identical to vendor output; fogrs get jq -S-canonical-identical; clean 404 path.
• Gate B: real Fog roundtrips — job d910f7e3 ("milk") and job b0bcdeac era ("tokyo") submitted via fogrs submit, decrypted [PASS], job status completed verified by both CLIs.

License

BSD-3-Clause — see LICENSE.