bring the repo up to repo standards (closes #1)

Adopt the standard tooling from sneak/prompts: the Makefile and script/
entrypoints, lint and test stages in one Dockerfile, the canonical lint
config, the CI workflow and the formatter settings. Change the module
path to sneak.berlin/go/dcf.

Fix the lint findings in pkg/dcf in place. DCFStore becomes Store and
DCFObject becomes Object. One behaviour changes: an error listing mount
points is now returned, where a typo used to drop it.

Replace the placeholder test with real tests. Move the README into the
required sections. make build now compiles the library; it pointed at a
command that does not exist.

Model: opus-5-5

Dockerfile

@@ -1,7 +1,10 @@
-# Lint phase. The linter is invoked directly rather than through `make
+# Lint phase. The tools are invoked directly rather than through `make
 # lint` or `script/lint`, which are themselves a docker build and would
 # recurse into a daemon that does not exist in a build step.
 #
+# golangci-lint does not check formatting under the canonical config, so
+# gofmt runs here too.
+#
 # golangci/golangci-lint:v2.12.2, 2026-11-02
 FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 
@@ -12,15 +15,14 @@ RUN go mod download
 
 COPY . .
 
+RUN test -z "$(gofmt -l .)" || { echo "gofmt needed on:"; gofmt -l .; exit 1; }
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Test phase, invoked directly for the same reason. The Debian image has
-# the C compiler the race detector needs.
+# Test phase, invoked directly for the same reason. The Debian image is
+# used because the race detector needs glibc.
 #
-# golang:1.27.3-trixie, 2026-11-02. It carries the Go that
-# script/bootstrap installs on the host; change both together, and the
-# same image in the last stage.
-FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385 AS test
+# golang:1.26.2-trixie, 2026-11-02
+FROM golang@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873 AS test
 
 WORKDIR /src
 
@@ -39,20 +41,20 @@ RUN go test -count=1 -timeout 90s -race -cover ./... || \
 # this image cannot be produced unless lint and test passed. A stage
 # appended after this one would drop all three out of a plain build.
 #
-# golang:1.27.3-trixie, 2026-11-02
-FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385
+# golang:1.26.2-trixie, 2026-11-02
+FROM golang@sha256:4a7137ea573f79c86ae451ff05817ed762ef5597fcf732259e97abeb3108d873
 
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
 
 WORKDIR /src
 
-# script/bootstrap finds its pinned Go already in this image. It installs
-# the Go modules and the tools for formatting Markdown. Debian is used
-# here because the node it installs needs glibc.
+# script/bootstrap installs the tools for formatting Markdown. Debian is
+# used here because the node it installs needs glibc.
 COPY script/ script/
 COPY package.json yarn.lock go.mod go.sum ./
 RUN script/bootstrap
+RUN go mod download
 
 COPY . .
 

README.md

@@ -64,27 +64,20 @@ standard. Each entrypoint is a POSIX sh script in `script/`. Use these instead
 of running the underlying tools directly.
 
 - `script/bootstrap` (`make bootstrap`) installs the tools the host needs. It
-  does not install docker or the linter. It installs:
-    - `make` and git
-    - Go into `~/.local/go`, at the version in the `Dockerfile`, unless the `go`
-      on the `PATH` is already that version
-    - the Go modules
-    - node and yarn
-    - `prettier`
+  does not install Go or the linter.
 - `script/setup` (`make setup`) runs `script/bootstrap` and then installs the
   git pre-commit hook.
 - `script/test` (`make test`) runs the tests by building the `test` stage of the
   `Dockerfile`.
 - `script/lint` (`make lint`) checks the Go code by building the `lint` stage of
-  the `Dockerfile`.
-- `script/fmt` (`make fmt`) rewrites the Go code with `go fmt` and the Markdown
-  files with `prettier`.
-- `script/fmt-check` (`make fmt-check`) checks the same formatting and changes
-  nothing.
+  the `Dockerfile`. The stage fails on Go code that `gofmt` would change.
+- `script/fmt` (`make fmt`) rewrites the Markdown files with `prettier`. It does
+  not format Go code.
+- `script/fmt-check` (`make fmt-check`) checks the Markdown formatting and
+  changes nothing.
 - `script/check` (`make check`) runs the tests, then the linter, then the
-  formatting check.
-- `script/build` (`make build`) compiles every package. It needs the Go that
-  `script/bootstrap` installs.
+  Markdown check.
+- `script/build` (`make build`) compiles every package. It needs Go on the host.
 - `script/docker` (`make docker`) builds the development image, tagged `dcf`.
 - `script/cibuild` runs the whole CI build. The Gitea workflow runs it on every
   push.

script/bootstrap

@@ -2,26 +2,14 @@
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Go is
-# installed at the version the Dockerfile's Go image carries, from the
-# official release archive, into ~/.local/go, and then the Go modules.
-# Node is used directly if installed; otherwise it is installed at a
-# pinned version via nvm (installing nvm itself first, from a
-# hash-verified release archive, never curl | sh).
+# or apk (detected in that order); assumes nothing is present. Node is
+# used directly if installed; otherwise it is installed at a pinned
+# version via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Must match the Go in the Dockerfile's golang image; the sha256 of each
-# archive is in install_go.
-GO_VERSION="1.27.3"
-
-# This script cannot change its caller's PATH, so script/fmt,
-# script/fmt-check and script/build put this directory first on their
-# own PATH, as is done here.
-GO_DIR="$HOME/.local/go"
-PATH="$GO_DIR/bin:$PATH"
-
 # Pinned versions, 2026-07-06
 NODE_VERSION="22.17.0"
 NVM_VERSION="0.40.3"
@@ -51,9 +39,6 @@ detect_pkgmgr() {
         if [ "$(id -u)" != "0" ]; then
             SUDO="sudo"
         fi
-        # This runs once, before the first install: a fresh host or
-        # runner image has no package lists yet.
-        $SUDO apt-get update
     fi
 }
 
@@ -87,52 +72,6 @@ verify_sha256() {
     fi
 }
 
-# True when the go first on PATH reports exactly GO_VERSION. No go, a go
-# that fails, or any other output is a mismatch.
-go_version_matches() {
-    out="$(go version 2>/dev/null)" || return 1
-    case "$out" in
-        "go version go$GO_VERSION "*) return 0 ;;
-        *) return 1 ;;
-    esac
-}
-
-install_go() {
-    # sha256 of the go1.27.3 archives at https://go.dev/dl/, 2026-11-02
-    case "$(uname -s)-$(uname -m)" in
-        Linux-x86_64)
-            platform="linux-amd64"
-            sha256="65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40"
-            ;;
-        Linux-aarch64)
-            platform="linux-arm64"
-            sha256="a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49"
-            ;;
-        Darwin-x86_64)
-            platform="darwin-amd64"
-            sha256="b6f8e931e4ab497fcde6da8ae4499a58f9d258e55c8a80824a516eae5950a750"
-            ;;
-        Darwin-arm64)
-            platform="darwin-arm64"
-            sha256="dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2"
-            ;;
-        *)
-            echo "bootstrap: no Go archive pinned for $(uname -s) $(uname -m)" >&2
-            exit 1
-            ;;
-    esac
-    if missing curl; then pkg_install curl curl curl curl; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/go.tar.gz" \
-        "https://go.dev/dl/go${GO_VERSION}.${platform}.tar.gz"
-    verify_sha256 "$tmp/go.tar.gz" "$sha256"
-    # An archive unpacked over an older Go leaves a broken tree.
-    rm -rf "$GO_DIR"
-    mkdir -p "$GO_DIR"
-    tar -xzf "$tmp/go.tar.gz" -C "$GO_DIR" --strip-components=1
-    rm -rf "$tmp"
-}
-
 # nvm is a bash script; run a command in a bash with nvm loaded
 nvm_sh() {
     bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
@@ -187,18 +126,6 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing git; then pkg_install git git git git; fi
 
-    if ! go_version_matches; then
-        install_go
-        hash -r
-        if ! go_version_matches; then
-            echo "bootstrap: $(command -v go) is not go$GO_VERSION after installing it" >&2
-            exit 1
-        fi
-    fi
-    go version
-
-    go mod download
-
     ensure_node
     ensure_yarn
     install_js_deps

script/build

@@ -1,15 +1,11 @@
 #!/bin/sh
 # script/build: compile every package. dcf is a library, so this checks
-# that it compiles and writes no binary. It needs the Go that
-# script/bootstrap installs, and the final stage of the Dockerfile runs
-# it too.
+# that it compiles and writes no binary. It needs Go on the host, and the
+# final stage of the Dockerfile runs it too.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Where script/bootstrap installs Go; it cannot put it on our PATH.
-PATH="$HOME/.local/go/bin:$PATH"
-
 main() {
     cd "$ROOT"
     CGO_ENABLED=0 go build ./...

script/fmt

@@ -1,13 +1,9 @@
 #!/bin/sh
-# script/fmt: format all files (writes): the Go code with go fmt, then
-# the Markdown files with prettier.
+# script/fmt: format all files (writes).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Where script/bootstrap installs Go; it cannot put it on our PATH.
-PATH="$HOME/.local/go/bin:$PATH"
-
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
@@ -29,8 +25,6 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn.
-    go fmt ./...
     run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 

script/fmt-check

@@ -1,13 +1,9 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
+# script/fmt-check: check formatting (read-only).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Where script/bootstrap installs Go; it cannot put it on our PATH.
-PATH="$HOME/.local/go/bin:$PATH"
-
 # Must match the pin in script/bootstrap.
 NODE_VERSION="22.17.0"
 
@@ -29,14 +25,6 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn. On
-    # its own line so that set -e stops here if gofmt fails or is missing.
-    unformatted="$(gofmt -l .)"
-    if [ -n "$unformatted" ]; then
-        echo "fmt-check: run make fmt; gofmt would change:" >&2
-        echo "$unformatted" >&2
-        exit 1
-    fi
     run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }