- Add canonical .golangci.yml (v2 schema, default: all, project
thresholds for lll/funlen/cyclop/dupl)
- Bump golangci-lint pins from v2.0.2 to v2.12.2 in Makefile
(go install, new /v2 module path) and Dockerfile (tagged+digest
Debian image pin)
- Fix all lint findings surfaced by the new linter set across
cmd/mfer, internal/bork, internal/cli, internal/log, and mfer:
static sentinel errors (err113), context-aware HTTP and exec
(noctx), guarded integer conversions and stricter permissions
(gosec), named constants (mnd, goconst), function decomposition
(funlen, cyclop, gocognit, nestif), declaration ordering
(funcorder), t.Parallel/t.TempDir/t.Setenv adoption in tests
(paralleltest, usetesting), protobuf getters (protogetter), plus
formatting and style cleanups (wsl_v5, nlreturn, lll, revive,
testifylint, and others)
- Serialize CLI runs in tests behind a mutex so parallel tests do
not cross-wire the process-global logger's captured output
The decompositions are behavior-preserving. In particular:
- REPO_POLICIES.md is untouched and stays byte-identical to the
authoritative copy in the prompts repo
- the mfer.manifest type stays unexported; whether to export it is an
open owner design question (README question 13)
- directories created by fetch keep mode 0755, because fetched trees
are content meant to be readable by other uids
- an absent MFFilePath.Mtime is handled explicitly and identically in
freshen, list, and export rather than being read as the Unix epoch,
which would classify every entry as changed and rewrite the manifest
on every freshen
- every user-visible error message renders byte-identically to what it
did before, with the err113 sentinels wrapped mid-sentence where
needed; the rendered strings are now pinned by tests
Also fixes an argument-injection defect the lint pass surfaced: key IDs
reach gpg as bare positional arguments, so a key ID beginning with "-"
was parsed by gpg as an option. All positional arguments now follow an
explicit "--" end-of-options marker.
The symlink-escape gap in fetch's path handling, which sanitizePath
does not and cannot address, is filed separately as #86.
## Summary
Performs a design and status review of the codebase and adds a comprehensive TODO section to `README.md` listing remaining work for a 1.0 release.
### What changed
- **README.md**: Added a `TODO: Remaining Work for 1.0` section covering:
- **7 design questions** requiring @sneak's input before implementation (manifest type export, Go module path, GPG vs pure-Go crypto, format framing, etc.) — each with an answer field for inline decisions
- **Implementation tasks** organized by category: repo infrastructure, format & correctness, library, CLI, testing & robustness, documentation, and release checklist
- Updated build status section (removed stale Drone CI badge, replaced with description of current Docker-based CI)
- **TODO.md**: Removed — items integrated into README TODO section
- **AGENTS.md**: Updated reference from `TODO.md` to README TODO section
### Design review findings
**What works well:**
- Core library (Builder, Scanner, Checker) is solid with good test coverage
- Format specification is well-designed (protobuf + zstd, multihash, deterministic serialization)
- CLI covers all major operations (gen, check, list, export, freshen, fetch)
- Test suite is thorough — builder, scanner, checker, GPG, CLI integration, corruption detection
- afero abstraction enables clean testing without filesystem side effects
**Key gaps for 1.0:**
- Missing repo infrastructure (`.golangci.yml`, `.editorconfig`, CI workflow)
- `manifest` type is unexported — consumers can't use it in their own type declarations
- GPG signing shells out to `gpg` subprocess — fragile and may not be installed
- Go module path inconsistency between `go.mod` and proto `go_package`
- `fetch` command lacks retry logic and has no HTTP timeout
- Missing fuzz tests for untrusted input deserialization
- Freshen CLI command has incomplete integration test coverage
closes#47closes#50
Co-authored-by: user <user@Mac.lan guest wan>
Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #54
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
