diff --git a/Makefile b/Makefile
index e299ee2..3478b0f 100644
--- a/Makefile
+++ b/Makefile
@@ -18,6 +18,7 @@
 # Makefile for testing JJB jobs in a virtualenv
 .PHONY: all clean help test
 .DEFAULT_GOAL := all
+# .DEFAULT_GOAL := lint-jjb
 
 ##-------------------##
 ##---]  GLOBALS  [---##
@@ -26,12 +27,10 @@
 MAKEDIR      ?= $(TOP)/makefiles
 export SHELL := bash -e -o pipefail
 
-NO-LINT-MAKE  := true
-NO-LINT-SHELL := true
-
 ##--------------------##
 ##---]  INCLUDES  [---##
 ##--------------------##
+-include config.mk
 include $(MAKEDIR)/include.mk
 
 VENV_DIR      ?= venv-jjb
@@ -43,6 +42,12 @@
 
 ## -----------------------------------------------------------------------
 ## -----------------------------------------------------------------------
+# lint : lint-jjb
+lint-tox:
+	tox -e py310
+
+## -----------------------------------------------------------------------
+## -----------------------------------------------------------------------
 .PHONY: test
 test: $(venv-activate-script) $(JOBCONFIG_DIR)
 	$(activate) \
diff --git a/config.mk b/config.mk
new file mode 100644
index 0000000..aff71b0
--- /dev/null
+++ b/config.mk
@@ -0,0 +1,25 @@
+# -*- makefile -*-
+# -----------------------------------------------------------------------
+# Copyright 2023 Open Networking Foundation (ONF) and the ONF Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# -----------------------------------------------------------------------
+
+##--------------------------------##
+##---]  Disable lint targets  [---##
+##--------------------------------##
+# NO-LINT-JJB   := false
+NO-LINT-MAKE  := true
+NO-LINT-SHELL := true
+
+# [EOF]
diff --git a/jjb/api-test.yaml b/jjb/api-test.yaml
index bcee9e6..5bccda3 100644
--- a/jjb/api-test.yaml
+++ b/jjb/api-test.yaml
@@ -65,6 +65,6 @@
     project-type: pipeline
     concurrent: true
 
-    dsl: !include-raw-escape: pipeline/{pipeline-script}
+    dsl: !include-raw: pipeline/{pipeline-script}
 
 # [EOF]
diff --git a/jjb/defaults.yaml b/jjb/defaults.yaml
index 38cfa54..6d4f97b 100644
--- a/jjb/defaults.yaml
+++ b/jjb/defaults.yaml
@@ -8,6 +8,8 @@
     # disabled: '{disable-job}'
     disable-job: false
 
+    # https://docs.releng.linuxfoundation.org/projects/lftools/en/latest/commands/version.html
+    # https://docs.releng.linuxfoundation.org/projects/lftools/en/latest/release-notes.html#v0-35-11-4
     # lftools
     lftools-version: '~=0.26.2'
 
diff --git a/makefiles/consts.mk b/makefiles/consts.mk
index 95d69a2..4e3e24d 100644
--- a/makefiles/consts.mk
+++ b/makefiles/consts.mk
@@ -1,6 +1,6 @@
 # -*- makefile -*-
 # -----------------------------------------------------------------------
-# Copyright 2022 Open Networking Foundation (ONF) and the ONF Contributors
+# Copyright 2022-2023 Open Networking Foundation (ONF) and the ONF Contributors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,30 +14,35 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-# SPDX-FileCopyrightText: 2022 Open Networking Foundation (ONF) and the ONF Contributors
+# SPDX-FileCopyrightText: 2022-2023 Open Networking Foundation (ONF) and the ONF Contributors
 # SPDX-License-Identifier: Apache-2.0
 # -----------------------------------------------------------------------
 
 $(if $(DEBUG),$(warning ENTER))
 
-null        :=#
-space       := $(null) $(null)
-dot         ?= .
+# include makefiles/constants.mk
+export dot          :=.
+export null         :=#
+export space        := $(null) $(null)
+export quote-single := $(null)"$(null)#"
+export quote-double := $(null)'$(null)#'
 
+# [DEBUG] make {target} HIDE=
 HIDE        ?= @
 
 env-clean   = /usr/bin/env --ignore-environment
 xargs-n1    := xargs -0 -t -n1 --no-run-if-empty
 
 ## -----------------------------------------------------------------------
-## Not recommended but support (-u)ndef-less shell for pyenv activate
-## TODO: declare a pyenv shell
+## Default shell:
+##   o set -e            enable error checking
+##   o set -u            report undefined errors
+##   o set -o pipefail   propogate shell pipeline failures.
 ## -----------------------------------------------------------------------
+SHELL ?= /bin/bash
 have-shell-bash := $(filter bash,$(subst /,$(space),$(SHELL)))
 $(if $(have-shell-bash),$(null),\
-  $(eval export SHELL := /bin/bash -euo pipefail))
-
-shell-pyenv := bash -eo pipefail
+  $(eval export SHELL := bash -euo pipefail))
 
 $(if $(DEBUG),$(warning LEAVE))
 
diff --git a/makefiles/git-submodules.mk b/makefiles/git-submodules.mk
index a96121c..79809c3 100644
--- a/makefiles/git-submodules.mk
+++ b/makefiles/git-submodules.mk
@@ -20,24 +20,35 @@
 
 $(if $(DEBUG),$(warning ENTER))
 
+GIT ?= git
+
 ## -----------------------------------------------------------------------
 ## Intent: Checkout submodules required by ci-management
 ## -----------------------------------------------------------------------
+submodule-repo := $(null)
+submodule-repo += global-jjb
+submodule-repo += lf-ansible
+submodule-repo += packer
+
 submodule-deps := $(null)
 submodule-deps += submodules#     # named pseudo target
-submodule-deps += global-jjb
-submodule-deps += lf-ansible
-submodule-deps += packer
+submodule-deps += $(submodule-repos)
 
 .PHONY: $(submodule-deps)
 $(submodule-deps):
-	git submodule init
-	git submodule update
+	$(GIT) submodule init
+	$(GIT) submodule update
 
 ## -----------------------------------------------------------------------
+## Intent: Revert sandbox to a pristine state.
 ## -----------------------------------------------------------------------
 sterile ::
-	$(RM) -r $(submodule-deps)
+	$(RM) -r $(submodule-repos)
+
+        # FIXME:
+        #   o restore hierarchy to avoid git status 'deleted:'
+        #   o remove: externals should not be under revision control
+	$(GIT) co $(submodule-repos)
 
 ## -----------------------------------------------------------------------
 ## -----------------------------------------------------------------------
diff --git a/makefiles/help/include.mk b/makefiles/help/include.mk
index 6e6ddff..4450784 100644
--- a/makefiles/help/include.mk
+++ b/makefiles/help/include.mk
@@ -21,11 +21,11 @@
 	@echo "Usage: $(MAKE) [options] [target] ..."
 	@echo
 	@echo '[VIEW]'
-	@echo '  reload         Setup to auto-reload sphinx doc changes in browser'
-	@echo '  view-html      View generated documentation'
+	@echo '  reload                 Setup to auto-reload sphinx doc changes in browser'
+	@echo '  view-html              View generated documentation'
 	@echo
 	@echo '[TEST]'
-	@echo '  test           make lint linkcheck'
-	@echo '  test-all       make all-generation-targets'
+	@echo '  test                   make lint linkcheck'
+	@echo '  test-all               make all-generation-targets'
 
 # [EOF]
diff --git a/makefiles/include.mk b/makefiles/include.mk
index 1fe87ab..73696d9 100644
--- a/makefiles/include.mk
+++ b/makefiles/include.mk
@@ -20,11 +20,16 @@
 
 $(if $(DEBUG),$(warning ENTER))
 
-ONF_MAKE ?= $(MAKEDIR)# fix this -- two distinct makefile imports needed
+# OPT_ROOT    ?= /opt/trainlab/current
+# OPT_MAKEDIR := $(OPT_ROOT)/makefiles
+# MAKEDIR     ?= $(OPT_MAKEDIR)
+
+ONF_MAKE ?= $(MAKEDIR)# fix this -- two distinct makefiles/ directories are needed
 ONF_MAKE ?= $(error ONF_MAKE= is required)
 
 include $(ONF_MAKE)/consts.mk
 include $(ONF_MAKE)/help/include.mk
+
 include $(ONF_MAKE)/lint/include.mk
 include $(ONF_MAKE)/virtualenv.mk
 include $(ONF_MAKE)/git-submodules.mk
diff --git a/makefiles/lint/include.mk b/makefiles/lint/include.mk
index 2a2d9ab..aa6867b 100644
--- a/makefiles/lint/include.mk
+++ b/makefiles/lint/include.mk
@@ -9,6 +9,7 @@
 	@echo
 	@echo "[LINT]"
 
+include $(ONF_MAKE)/lint/jjb.mk
 include $(ONF_MAKE)/lint/makefile.mk
 include $(ONF_MAKE)/lint/python.mk
 include $(ONF_MAKE)/lint/shell.mk
diff --git a/makefiles/lint/jjb.mk b/makefiles/lint/jjb.mk
new file mode 100644
index 0000000..c85b8b9
--- /dev/null
+++ b/makefiles/lint/jjb.mk
@@ -0,0 +1,56 @@
+# -*- makefile -*-
+# -----------------------------------------------------------------------
+# Copyright 2023 Open Networking Foundation (ONF) and the ONF Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# -----------------------------------------------------------------------
+
+##-------------------##
+##---]  GLOBALS  [---##
+##-------------------##
+
+##-------------------##
+##---]  TARGETS  [---##
+##-------------------##
+ifndef NO-LINT-JJB
+  lint : lint-jjb
+endif
+
+## -----------------------------------------------------------------------
+## Intent: Construct command line for linting jenkins-job-builder config
+## -----------------------------------------------------------------------
+
+ifdef DEBUG
+  lint-jjb-args += --log_level DEBUG#         # verbosity: high
+else
+  lint-jjb-args += --log_level INFO#          # verbosity: default
+endif
+lint-jjb-args += --ignore-cache
+lint-jjb-args += test#                        # command action
+lint-jjb-args += -o archives/job-configs#     # Generated jobs written here
+lint-jjb-args += --recursive
+lint-jjb-args += --config-xml#                # JJB v3.0 write to OUTPUT/jobname/config.xml
+lint-jjb-args += jjb/#                        # JJB config sources (input)
+
+lint-jjb:
+	jenkins-jobs $(lint-jjb-args)
+
+## -----------------------------------------------------------------------
+## -----------------------------------------------------------------------
+help ::
+	@echo '  lint-jjb               Validate jjb job generation'
+ifdef VERBOSE
+	@echo '1    DEBUG=1                lint-jjb --log_level=DEBUG'
+endif
+
+# [EOF]