Pin host Go tools by commit hash with go install (closes #37)

Writes sneak's 2026-09-09 ruling ("commit pinned installation, not pulled into deps") into the `prompts/REPO_POLICIES.md` bullet that says `script/bootstrap` installs a pinned tool by comparing versions: a Go tool a repo needs on the host is installed with `go install` pinned to a commit hash, naming the tool's main package, and is never tracked as a `go.mod` tool dependency or through a `tools.go` file, either of which pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.

golangci-lint is unchanged: no repo installs it on the host, and it stays pinned by its image digest.

Model: opus-5-5

.dockerignore

@@ -44,7 +44,9 @@
 **/[iI][dD]_[rR][sS][aA]
 **/[iI][dD]_[dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 **/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
 
 # Dependencies: restored inside the image, never copied in.
 **/node_modules

.gitignore

@@ -42,4 +42,6 @@ node_modules/
 [iI][dD]_[rR][sS][aA]
 [iI][dD]_[dD][sS][aA]
 [iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 [iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]

TODO.md

@@ -21,15 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-10-04: Fixed the server lifecycle example in
-  `prompts/GO_HTTP_SERVER_CONVENTIONS.md` (issue 86). Only fx handles SIGINT and
-  SIGTERM, and `Run()` in `main` exits with the shutdown's exit code. A listen
-  error asks fx to shut down with exit code 1 through `fx.Shutdowner`; a Sentry
-  start failure is returned from the server's start hook instead of calling
-  `os.Exit` from a goroutine, so the stop hooks of what had started still run.
-  The server's stop hook shuts the HTTP server down within 5 seconds and fails
-  when requests are still running. A new paragraph says who owns signals and the
-  exit code.
+- 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
+  is pinned (issue 37): installed with `go install` pinned to a commit hash,
+  never tracked as a `go.mod` tool dependency or through a `tools.go` file.
+  golangci-lint is unaffected, since no repo installs it on the host.
+- 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out
+  `id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes
+  for keys backed by a hardware security key (issue 81). Their `.pub` halves
+  stay trackable.
 - 2026-10-04: `package.json` now has `"license": "MIT"`, matching `LICENSE`, so
   yarn no longer prints "No license field" when `script/bootstrap` runs it
   inside the Docker phases (issue 76). That was the only yarn warning there.

prompts/GO_HTTP_SERVER_CONVENTIONS.md

@@ -106,9 +106,6 @@ project-root/
 package main
 
 import (
-    "os/signal"
-    "syscall"
-
     "yourproject/internal/config"
     "yourproject/internal/database"
     "yourproject/internal/globals"
@@ -129,9 +126,6 @@ func main() {
     globals.Appname = Appname
     globals.Version = Version
 
-    // A write to a closed stdout or stderr must not end the process.
-    signal.Ignore(syscall.SIGPIPE)
-
     fx.New(
         fx.Provide(
             config.New,
@@ -204,8 +198,7 @@ Providers are resolved automatically by fx, but conceptually follow this order:
    Database)
 6. `middleware.New` - Middleware (depends on Logger, Globals, Config)
 7. `handlers.New` - Handlers (depends on Logger, Globals, Database, Healthcheck)
-8. `server.New` - Server (depends on all above, and on `fx.Shutdowner`, which fx
-   provides itself)
+8. `server.New` - Server (depends on all above)
 
 ---
 
@@ -224,14 +217,16 @@ type ServerParams struct {
     Config     *config.Config
     Middleware *middleware.Middleware
     Handlers   *handlers.Handlers
-    Shutdowner fx.Shutdowner
 }
 
 type Server struct {
     startupTime   time.Time
     port          int
+    exitCode      int
     sentryEnabled bool
     log           *slog.Logger
+    ctx           context.Context
+    cancelFunc    context.CancelFunc
     httpServer    *http.Server
     router        *chi.Mux
     params        ServerParams
@@ -253,15 +248,13 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
     lc.Append(fx.Hook{
         OnStart: func(ctx context.Context) error {
             s.startupTime = time.Now()
-            if err := s.enableSentry(); err != nil {
-                return err
-            }
-            s.SetupRoutes()
-            s.httpServer = s.newHTTPServer()
-            go s.serveUntilShutdown()
+            go s.Run()
+            return nil
+        },
+        OnStop: func(ctx context.Context) error {
+            // Server shutdown logic
             return nil
         },
-        OnStop: s.cleanShutdown,
     })
     return s, nil
 }
@@ -271,25 +264,23 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 
 ```go
 // internal/server/http.go
-func (s *Server) newHTTPServer() *http.Server {
-    return &http.Server{
-        Addr:           fmt.Sprintf(":%d", s.params.Config.Port),
+func (s *Server) serveUntilShutdown() {
+    listenAddr := fmt.Sprintf(":%d", s.params.Config.Port)
+    s.httpServer = &http.Server{
+        Addr:           listenAddr,
         ReadTimeout:    10 * time.Second,
         WriteTimeout:   10 * time.Second,
         MaxHeaderBytes: 1 << 20,
         Handler:        s,
     }
-}
 
-// serveUntilShutdown returns when the stop hook shuts the HTTP server down.
-// If it stops for any other reason, such as its port being taken, it asks fx
-// to shut down with exit code 1.
-func (s *Server) serveUntilShutdown() {
-    s.log.Info("http begin listen", "listenaddr", s.httpServer.Addr)
+    s.SetupRoutes()
+
+    s.log.Info("http begin listen", "listenaddr", listenAddr)
     if err := s.httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
         s.log.Error("listen error", "error", err)
-        if err := s.params.Shutdowner.Shutdown(fx.ExitCode(1)); err != nil {
-            s.log.Error("shutdown request failed", "error", err)
+        if s.cancelFunc != nil {
+            s.cancelFunc()
         }
     }
 }
@@ -301,30 +292,43 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 ## Signal Handling and Graceful Shutdown
 
-fx owns SIGINT, SIGTERM and the exit code. `Run()` in `main` waits for one of
-those signals or for a call to `Shutdown()` on `fx.Shutdowner`, runs the stop
-hooks, and exits 0 after a signal, or with the code the call gave in
-`fx.ExitCode`. It exits 1 instead when a start hook or a stop hook returns an
-error; when a start hook fails, fx first runs the stop hooks of everything
-already started. No other code calls `signal.Notify` or `os.Exit`: the listen
-error above asks fx to shut down with `fx.ExitCode(1)`, and a Sentry start
-failure is returned from the start hook. Each component releases its own
-resources in its own stop hook, which fx runs in the reverse order of start.
-
 ```go
-// cleanShutdown is the server's stop hook. It fails when requests are still
-// running after 5 seconds.
-func (s *Server) cleanShutdown(ctx context.Context) error {
-    ctxShutdown, shutdownCancel := context.WithTimeout(ctx, 5*time.Second)
-    defer shutdownCancel()
-    err := s.httpServer.Shutdown(ctxShutdown)
+func (s *Server) serve() int {
+    s.ctx, s.cancelFunc = context.WithCancel(context.Background())
+
+    // Signal watcher
+    go func() {
+        c := make(chan os.Signal, 1)
+        signal.Ignore(syscall.SIGPIPE)
+        signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+        sig := <-c
+        s.log.Info("signal received", "signal", sig)
+        if s.cancelFunc != nil {
+            s.cancelFunc()
+        }
+    }()
+
+    go s.serveUntilShutdown()
+
+    for range s.ctx.Done() {
+    }
+    s.cleanShutdown()
+    return s.exitCode
+}
+
+func (s *Server) cleanShutdown() {
+    s.exitCode = 0
+    ctxShutdown, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
+    if err := s.httpServer.Shutdown(ctxShutdown); err != nil {
+        s.log.Error("server clean shutdown failed", "error", err)
+    }
+    if shutdownCancel != nil {
+        shutdownCancel()
+    }
+    s.cleanupForExit()
     if s.sentryEnabled {
         sentry.Flush(2 * time.Second)
     }
-    if err != nil {
-        return fmt.Errorf("http server shutdown: %w", err)
-    }
-    return nil
 }
 ```
 
@@ -1156,11 +1160,11 @@ s.router.Get("/.well-known/healthcheck", s.h.HandleHealthCheck())
 Sentry is conditionally enabled based on `SENTRY_DSN` environment variable:
 
 ```go
-func (s *Server) enableSentry() error {
+func (s *Server) enableSentry() {
     s.sentryEnabled = false
 
     if s.params.Config.SentryDSN == "" {
-        return nil
+        return
     }
 
     err := sentry.Init(sentry.ClientOptions{
@@ -1168,17 +1172,15 @@ func (s *Server) enableSentry() error {
         Release: fmt.Sprintf("%s-%s", s.params.Globals.Appname, s.params.Globals.Version),
     })
     if err != nil {
-        return fmt.Errorf("sentry init failure: %w", err)
+        s.log.Error("sentry init failure", "error", err)
+        os.Exit(1)
+        return
     }
     s.log.Info("sentry error reporting activated")
     s.sentryEnabled = true
-    return nil
 }
 ```
 
-The server's start hook calls `enableSentry()` and returns its error, so a DSN
-Sentry rejects stops startup and fx exits 1.
-
 Sentry middleware with repanic (bubbles panics to chi's Recoverer):
 
 ```go
@@ -1190,7 +1192,7 @@ if s.sentryEnabled {
 }
 ```
 
-Flush Sentry in the server's stop hook, `cleanShutdown()`:
+Flush Sentry on shutdown:
 
 ```go
 if s.sentryEnabled {

prompts/REPO_POLICIES.md

@@ -495,6 +495,11 @@ style conventions are in separate documents:
 
     Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
+
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).