Plan Phase 5: per-machine targeting with only/never labels.

Machine identity = hostname + os:<GOOS> + arch:<GOARCH> + tag:<name>.
Entry-level only/never fields for selective restore/checkpoint.
Local tags file for machine-specific labels. Steps 28–32 planned.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

PROJECT_PLAN.md

@@ -276,9 +276,45 @@ Depends on Steps 17, 18.
 - [x] E2e test: integration/phase4_test.go covering TLS + encryption + locked files + push/pull
 - [x] Verify: all tests pass, lint clean, both binaries compile
 
-## Phase 5: Multi-Repo + Per-Machine Inclusion
+## Phase 5: Per-Machine Targeting
 
-(To be planned)
+### Step 28: Machine Identity + Targeting Core
+
+- [ ] `manifest/manifest.go`: add `Only []string` and `Never []string` to Entry (yaml tags `only,omitempty` / `never,omitempty`)
+- [ ] `garden/identity.go`: `Identity(repoRoot string) []string` — returns machine's label set: short hostname, `os:<GOOS>`, `arch:<GOARCH>`, `tag:<name>` from `<repo>/tags`
+- [ ] `garden/targeting.go`: `EntryApplies(entry, labels) bool` — match logic: `only` → any match, `never` → no match, error if both set
+- [ ] `garden/tags.go`: `LoadTags(repoRoot)`, `SaveTag(repoRoot, tag)`, `RemoveTag(repoRoot, tag)` — read/write `<repo>/tags` file
+- [ ] `garden/garden.go`: `Init` appends `tags` to `.gitignore`
+- [ ] Tests: identity computation, tag load/save, matching (only, never, both-error, bare hostname, os:, arch:, tag:, neither)
+
+### Step 29: Operations Respect Targeting
+
+- [ ] `garden/garden.go`: `Checkpoint` skips entries where `!EntryApplies`
+- [ ] `garden/garden.go`: `Restore` skips entries where `!EntryApplies`
+- [ ] `garden/garden.go`: `Status` reports `skipped` for non-matching entries (or omits them — TBD)
+- [ ] `garden/garden.go`: `Add` accepts `Only`/`Never` in `AddOptions`
+- [ ] Tests: checkpoint/restore/status skip non-matching, add with targeting
+
+### Step 30: Targeting CLI Commands
+
+- [ ] `cmd/sgard/tag.go`: `sgard tag add <name>`, `sgard tag remove <name>`, `sgard tag list`
+- [ ] `cmd/sgard/identity.go`: `sgard identity` — print full label set
+- [ ] `cmd/sgard/add.go`: `--only` and `--never` flags (comma-separated or repeated)
+- [ ] `cmd/sgard/target.go`: `sgard target <path> --only <labels>`, `--never <labels>`, `--clear`
+- [ ] Tests: tag file CRUD, identity output
+
+### Step 31: Proto + Sync Update
+
+- [ ] `proto/sgard/v1/sgard.proto`: add `repeated string only` and `repeated string never` to ManifestEntry
+- [ ] `server/convert.go`: update proto ↔ manifest conversion
+- [ ] Regenerate proto: `make proto`
+- [ ] Tests: round-trip conversion with targeting fields
+
+### Step 32: Phase 5 Polish
+
+- [ ] Update ARCHITECTURE.md, README.md, CLAUDE.md, PROGRESS.md
+- [ ] E2e test: add entries with targeting, push/pull, restore on different identity
+- [ ] Verify: all tests pass, lint clean, both binaries compile
 
 ## Phase 6: Manifest Signing