Block a user
Clean up the Makefile: add make build, remove superseded targets
Shutdown is broken: os.Exit races fx OnStop hooks, losing buffered reports on every restart
Add tests for internal/storage — the backend abstraction has zero coverage
Add the canonical policy dotfiles: REPO_POLICIES.md, .editorconfig, .prettierrc, .prettierignore, and extend .gitignore
security: DEBUG hardcoded on — every generated recovery phrase is the public test phrase
Cobra prints full usage on internal failures, burying the actual error
Unit test coverage: wizard commands (game/wizard.go has zero tests)
Make the tagged-release path actually work on Gitea
Add .editorconfig and make .gitignore comprehensive
internal/state ships test-only constructors in the production build
Hash-pin every external reference in .gitea/workflows/deploy.yml
Adopt the org-standard .golangci.yml and golangci-lint v2.12.2
Escalation: the current config is not merely non-standard, it is invalid and silently inert
Follow-up audit found the problem is worse than a hash mismatch. backend/.golangci.yml declares…
snapshot list must list remote snapshots without requiring the private key
make check must not modify tracked files (ensure_pb regenerates mf.pb.go on mtime)
Unit test coverage: wands/staves (game/sticks.go, 534 lines, one test)
.gitignore does not exclude secrets, and .dockerignore does not exclude .git
internal/globals, internal/healthcheck, and internal/logger have no tests at all
Unit test coverage: rings (game/rings.go has zero tests)
Verify Go formatting with gofumpt, not gofmt, so fmt and check agree
No confirmation prompt on any destructive operation