Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Add the standard scaffold and bring the tree to a clean lint under the
vendored `default: all` config. New: `script/` Scripts-to-Rule-Them-All
entrypoints with the `Makefile` reduced to thin shims; a `Dockerfile`
whose `lint` and `test` phases gate the build (final stage depends on
both); a `.gitea/workflows/` CI running `script/cibuild`; the vendored
`.golangci.yml`; `REPO_POLICIES.md`; `.editorconfig`; `.dockerignore`; a
`LICENSE` (WTFPL) and `TODO.md`; and a comprehensive `.gitignore`.

The 211 lint findings were fixed, not suppressed: package-level state
became functions/fields/a command constructor, magic numbers became named
constants, `ctx` is threaded into the probes, the loop functions were
split to cut complexity, and the deprecated `+build` tags were dropped.
Behavior is unchanged. The only annotations are justified `//nolint:gosec`
on the `ping`/`curl` subprocess calls (G204, fixed argv) and the
operator-chosen log file (G304), matching the reference repos.

`make check` is green (lint and tests run in Docker).

Model: opus-4-8

internal/monitor/monitor.go

@@ -1,11 +1,14 @@
 //go:build linux
-// +build linux
 
+// Package monitor implements the dual-interface real-time network
+// monitoring dashboard: ICMP reachability, packet loss, TCP latency, and
+// the terminal UI that renders them.
 package monitor
 
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"net"
@@ -19,16 +22,48 @@ import (
 	tcell "github.com/gdamore/tcell/v2"
 )
 
-// Non-configurable constants (meter characters)
+// Meter glyphs used to render the ASCII loss meter.
 const (
-	// ASCII characters for the meter
 	MeterStart = '['
 	MeterEnd   = ']'
 	MeterFill  = '='
 	MeterEmpty = ' '
 )
 
-// Monitor represents the network monitoring system
+// Default monitor timing configuration.
+const (
+	defaultICMPTimeout      = 500 * time.Millisecond
+	defaultTCPTimeout       = 500 * time.Millisecond
+	defaultPacketLossPings  = 20
+	defaultPacketLossPeriod = 5 * time.Second
+	defaultStatsHistory     = 300
+	defaultScreenRefresh    = 500 * time.Millisecond
+)
+
+// Default display geometry (column widths and meter sizing).
+const (
+	defaultMeterWidth     = 7
+	defaultMeterFillWidth = 5
+	defaultMaxMeterValue  = 10
+	defaultHostWidth      = 30
+	defaultNumWidth       = 7
+	defaultStdWidth       = 8
+	defaultNWidth         = 6
+	defaultLostWidth      = 7
+)
+
+// Miscellaneous timing constants.
+const (
+	ipInfoTimeout    = 2 * time.Second
+	lossQueryTimeout = 3 * time.Second
+	uiUpdateBuffer   = 100
+	logFileMode      = 0o600
+)
+
+// errNoIPv4 is returned when an interface has no usable IPv4 address.
+var errNoIPv4 = errors.New("no IPv4 address on interface")
+
+// Monitor represents the network monitoring system.
 type Monitor struct {
 	// Configuration
 	ICMPTimeout      time.Duration
@@ -63,95 +98,95 @@ type Monitor struct {
 	// Runtime state
 	screen    tcell.Screen
 	startTime time.Time
+	uiUpdate  chan struct{}
 
 	// Synchronization
 	mu sync.RWMutex
 }
 
-// NewMonitor creates a new Monitor instance with default settings
+// NewMonitor creates a new Monitor instance with default settings.
 func NewMonitor(ifaceA, labelA, ifaceB, labelB, logFile string) *Monitor {
 	return &Monitor{
-		// Default timing configuration
-		ICMPTimeout:      500 * time.Millisecond,
-		TCPTimeout:       500 * time.Millisecond,
-		PacketLossPings:  20,
-		PacketLossPeriod: 5 * time.Second,
-		StatsHistory:     300,
-		ScreenRefresh:    500 * time.Millisecond,
+		ICMPTimeout:      defaultICMPTimeout,
+		TCPTimeout:       defaultTCPTimeout,
+		PacketLossPings:  defaultPacketLossPings,
+		PacketLossPeriod: defaultPacketLossPeriod,
+		StatsHistory:     defaultStatsHistory,
+		ScreenRefresh:    defaultScreenRefresh,
 
-		// Default display configuration
-		MeterWidth:     7,
-		MeterFillWidth: 5,
-		MaxMeterValue:  10,
-		HostWidth:      30,
-		NumWidth:       7,
-		StdWidth:       8,
-		NWidth:         6,
-		LostWidth:      7,
+		MeterWidth:     defaultMeterWidth,
+		MeterFillWidth: defaultMeterFillWidth,
+		MaxMeterValue:  defaultMaxMeterValue,
+		HostWidth:      defaultHostWidth,
+		NumWidth:       defaultNumWidth,
+		StdWidth:       defaultStdWidth,
+		NWidth:         defaultNWidth,
+		LostWidth:      defaultLostWidth,
 
-		// Initialize host lists
 		reachabilityHosts: []string{},
 		packetLossHosts:   []string{},
 		tcpHosts:          []string{},
 
-		// Initialize interfaces
 		interfaceA: NewInterfaceStatus(ifaceA, labelA),
 		interfaceB: NewInterfaceStatus(ifaceB, labelB),
 
-		// Logging
-		logFile: logFile,
-
+		logFile:   logFile,
 		startTime: time.Now(),
+		uiUpdate:  make(chan struct{}, uiUpdateBuffer),
 	}
 }
 
-// AddReachabilityHost adds a host for reachability monitoring
+// AddReachabilityHost adds a host for reachability monitoring.
 func (m *Monitor) AddReachabilityHost(host string) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
+
 	m.reachabilityHosts = append(m.reachabilityHosts, host)
 }
 
-// AddPacketLossHost adds a host for packet loss monitoring
+// AddPacketLossHost adds a host for packet loss monitoring.
 func (m *Monitor) AddPacketLossHost(host string) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
+
 	m.packetLossHosts = append(m.packetLossHosts, host)
 }
 
-// AddTCPHost adds a host:port for TCP connectivity monitoring
+// AddTCPHost adds a host:port for TCP connectivity monitoring.
 func (m *Monitor) AddTCPHost(hostPort string) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
+
 	m.tcpHosts = append(m.tcpHosts, hostPort)
 }
 
-// Run starts the monitoring system
+// Run starts the monitoring system.
 func (m *Monitor) Run(ctx context.Context) error {
 	m.logf("Starting monitor run")
-
-	// Initialize screen
 	m.logf("Initializing screen")
+
 	scr, err := tcell.NewScreen()
 	if err != nil {
 		m.logf("Error creating screen: %v", err)
+
 		return fmt.Errorf("error creating screen: %w", err)
 	}
-	if err = scr.Init(); err != nil {
+
+	err = scr.Init()
+	if err != nil {
 		m.logf("Error initializing screen: %v", err)
+
 		return fmt.Errorf("error initializing screen: %w", err)
 	}
+
 	m.screen = scr
 	m.logf("Screen initialized")
 
-	// Create cancellable context
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	// Handle keyboard events
 	go m.keyboardEventLoop(ctx, cancel)
 
-	// Start monitoring goroutines
 	m.logf("Starting monitoring goroutines")
 	m.mu.RLock()
 	reachHosts := append([]string{}, m.reachabilityHosts...)
@@ -166,7 +201,6 @@ func (m *Monitor) Run(ctx context.Context) error {
 	go m.tcpLoop(ctx, m.interfaceA, tcpHosts)
 	go m.tcpLoop(ctx, m.interfaceB, tcpHosts)
 
-	// Run UI loop
 	m.logf("Starting UI loop")
 	m.uiLoop(ctx)
 	m.logf("UI loop exited, monitor ending")
@@ -174,36 +208,49 @@ func (m *Monitor) Run(ctx context.Context) error {
 	return nil
 }
 
-// keyboardEventLoop handles keyboard input
-func (m *Monitor) keyboardEventLoop(ctx context.Context, cancel context.CancelFunc) {
-	m.logf("Starting keyboard event loop")
-	for {
-		if ev := m.screen.PollEvent(); ev != nil {
-			m.logf("Event received: %T", ev)
-			if ke, ok := ev.(*tcell.EventKey); ok {
-				m.logf("Key event: %v, rune: %c", ke.Key(), ke.Rune())
-				if ke.Key() == tcell.KeyCtrlC || ke.Rune() == 'q' {
-					m.logf("Quit key detected")
-					cancel()
-					return
-				}
-			}
-
-			// Trigger UI update on any event
-			select {
-			case UIUpdateChan <- struct{}{}:
-			default:
-			}
-		}
+// notifyUI requests a screen redraw without blocking if one is pending.
+func (m *Monitor) notifyUI() {
+	select {
+	case m.uiUpdate <- struct{}{}:
+	default:
 	}
 }
 
-// logf logs a formatted message
-func (m *Monitor) logf(format string, v ...interface{}) {
+// keyboardEventLoop handles keyboard input. The context is accepted for a
+// uniform loop signature; shutdown is driven by cancel on the quit key and
+// by the screen being finalized (PollEvent then returns nil).
+func (m *Monitor) keyboardEventLoop(_ context.Context, cancel context.CancelFunc) {
+	m.logf("Starting keyboard event loop")
+
+	for {
+		ev := m.screen.PollEvent()
+		if ev == nil {
+			continue
+		}
+
+		m.logf("Event received: %T", ev)
+
+		if ke, ok := ev.(*tcell.EventKey); ok {
+			m.logf("Key event: %v, rune: %c", ke.Key(), ke.Rune())
+
+			if ke.Key() == tcell.KeyCtrlC || ke.Rune() == 'q' {
+				m.logf("Quit key detected")
+				cancel()
+
+				return
+			}
+		}
+
+		m.notifyUI()
+	}
+}
+
+// logf logs a formatted message.
+func (m *Monitor) logf(format string, v ...any) {
 	Logf(m.logFile, format, v...)
 }
 
-// InterfaceStatus holds the runtime status for a network interface
+// InterfaceStatus holds the runtime status for a network interface.
 type InterfaceStatus struct {
 	Name, Label, IPInfo        string
 	Reachable                  map[string]bool
@@ -218,7 +265,7 @@ type InterfaceStatus struct {
 	mu                         sync.RWMutex
 }
 
-// NewInterfaceStatus creates a new interface status
+// NewInterfaceStatus creates a new interface status.
 func NewInterfaceStatus(name, label string) *InterfaceStatus {
 	return &InterfaceStatus{
 		Name:        name,
@@ -232,137 +279,164 @@ func NewInterfaceStatus(name, label string) *InterfaceStatus {
 	}
 }
 
-// ipInfoResp holds the IP info response
+// ipInfoResp holds the ipinfo.io response.
 type ipInfoResp struct {
 	IP       string `json:"ip"`
 	Hostname string `json:"hostname"`
 	Org      string `json:"org"`
 }
 
-// fetchIPInfo fetches IP information for an interface
+// fetchIPInfo fetches public IP information as seen from an interface.
 func fetchIPInfo(iface string) string {
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), ipInfoTimeout)
 	defer cancel()
-	out, _ := exec.CommandContext(ctx, "curl", "-s", "--interface", iface, "--max-time", "2", "ipinfo.io").Output()
+
+	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
+		ctx, "curl", "-s", "--interface", iface, "--max-time", "2", "ipinfo.io")
+
+	out, _ := cmd.Output()
+
 	var r ipInfoResp
+
 	_ = json.Unmarshal(out, &r)
 	if r.IP == "" {
 		return "(ipinfo error)"
 	}
+
 	return fmt.Sprintf("%s [%s] %s", r.IP, r.Hostname, r.Org)
 }
 
-// pingOnce performs a single ping
-func (m *Monitor) pingOnce(iface, host string) bool {
-	ctx, cancel := context.WithTimeout(context.Background(), m.ICMPTimeout)
+// pingOnce performs a single ping over the named interface.
+func (m *Monitor) pingOnce(ctx context.Context, iface, host string) bool {
+	ctx, cancel := context.WithTimeout(ctx, m.ICMPTimeout)
 	defer cancel()
-	return exec.CommandContext(ctx, "ping", "-I", iface, "-c1", "-W1", host).Run() == nil
+
+	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
+		ctx, "ping", "-I", iface, "-c1", "-W1", host)
+
+	return cmd.Run() == nil
 }
 
-// lossPercent calculates packet loss percentage
-func (m *Monitor) lossPercent(iface, host string) float64 {
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+// lossPercent measures the packet loss fraction (0..1) for a host.
+func (m *Monitor) lossPercent(ctx context.Context, iface, host string) float64 {
+	ctx, cancel := context.WithTimeout(ctx, lossQueryTimeout)
 	defer cancel()
-	out, err := exec.CommandContext(ctx, "ping", "-q", "-i", "0.05",
-		"-c", fmt.Sprint(m.PacketLossPings), "-W1", "-I", iface, host).CombinedOutput()
+
+	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
+		ctx, "ping", "-q", "-i", "0.05",
+		"-c", strconv.Itoa(m.PacketLossPings), "-W1", "-I", iface, host)
+
+	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return 1.0
 	}
+
 	for _, ln := range strings.Split(string(out), "\n") {
-		if strings.Contains(ln, "packet loss") {
-			for _, f := range strings.Fields(ln) {
-				if strings.HasSuffix(f, "%") {
-					p, _ := strconv.ParseFloat(strings.TrimSuffix(f, "%"), 64)
-					return p / 100.0
-				}
+		if !strings.Contains(ln, "packet loss") {
+			continue
+		}
+
+		for _, f := range strings.Fields(ln) {
+			before, ok := strings.CutSuffix(f, "%")
+			if !ok {
+				continue
 			}
+
+			p, _ := strconv.ParseFloat(before, 64)
+
+			return p / percentFull
 		}
 	}
+
 	return 1.0
 }
 
-// localAddr gets the local address for an interface
+// localAddr returns the first IPv4 address bound to an interface.
 func localAddr(iface string) (net.Addr, error) {
 	ifi, err := net.InterfaceByName(iface)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("interface %s: %w", iface, err)
 	}
+
 	add, _ := ifi.Addrs()
 	for _, a := range add {
 		if ipnet, ok := a.(*net.IPNet); ok && ipnet.IP.To4() != nil {
 			return &net.TCPAddr{IP: ipnet.IP}, nil
 		}
 	}
-	return nil, fmt.Errorf("no IPv4 on %s", iface)
+
+	return nil, fmt.Errorf("%w: %s", errNoIPv4, iface)
 }
 
-// tcpDuration measures TCP connection duration
+// tcpDuration measures how long a TCP connection to hp takes over iface.
 func (m *Monitor) tcpDuration(iface, hp string) time.Duration {
 	la, err := localAddr(iface)
 	if err != nil {
 		return m.TCPTimeout
 	}
+
 	d := net.Dialer{Timeout: m.TCPTimeout, LocalAddr: la}
 	st := time.Now()
+
 	c, err := d.Dial("tcp", hp)
 	if err != nil {
 		return m.TCPTimeout
 	}
-	c.Close()
+
+	_ = c.Close()
+
 	return time.Since(st)
 }
 
-// MinMaxAvgStd calculates min, max, average and standard deviation
-func MinMaxAvgStd(xs []float64) (min, max, avg, std float64) {
+// MinMaxAvgStd returns the minimum, maximum, mean and standard deviation.
+func MinMaxAvgStd(xs []float64) (float64, float64, float64, float64) {
 	if len(xs) == 0 {
-		return
+		return 0, 0, 0, 0
 	}
-	min, max = xs[0], xs[0]
+
+	mn, mx := xs[0], xs[0]
+
 	var sum float64
+
 	for _, v := range xs {
-		if v < min {
-			min = v
-		}
-		if v > max {
-			max = v
-		}
+		mn = min(mn, v)
+		mx = max(mx, v)
 		sum += v
 	}
-	avg = sum / float64(len(xs))
-	var vs float64
+
+	avg := sum / float64(len(xs))
+
+	var variance float64
+
 	for _, v := range xs {
-		d := v - avg
-		vs += d * d
+		variance += (v - avg) * (v - avg)
 	}
-	std = math.Sqrt(vs / float64(len(xs)))
-	return
+
+	return mn, mx, avg, math.Sqrt(variance / float64(len(xs)))
 }
 
-// Spin advances the spinner frame
+// Spin advances the spinner frame.
 func (st *InterfaceStatus) Spin() {
-	st.SpinFrame = (st.SpinFrame + 1) % len(Spins)
+	st.SpinFrame = (st.SpinFrame + 1) % len(spins())
 }
 
-// IsHealthy checks if the interface is healthy
+// IsHealthy reports whether the interface currently looks healthy.
 func (st *InterfaceStatus) IsHealthy(tcpTimeout time.Duration) bool {
 	st.mu.RLock()
 	defer st.mu.RUnlock()
 
-	// Check if there are any currently unreachable hosts
 	for _, ok := range st.Reachable {
 		if !ok {
 			return false
 		}
 	}
 
-	// Check if there's any current packet loss
 	for _, lp := range st.Loss {
 		if lp > 0 {
 			return false
 		}
 	}
 
-	// Check if there are any TCP timeouts
 	for _, hist := range st.TCP {
 		if len(hist) == 0 || hist[len(hist)-1] >= float64(tcpTimeout.Milliseconds()) {
 			return false
@@ -372,23 +446,29 @@ func (st *InterfaceStatus) IsHealthy(tcpTimeout time.Duration) bool {
 	return true
 }
 
-// Spinners and braille characters
-var (
-	Spins        = []rune{'|', '/', '-', '\\'}
-	BrailleSpins = []rune{
-		'⠉', '⠘', '⠰', '⠠', '⠄', '⠆', '⠇', '⠋',
-	}
-)
+// spins returns the ASCII spinner frames.
+func spins() []rune {
+	return []rune{'|', '/', '-', '\\'}
+}
 
-// Logf is a simple logging function
-func Logf(logFile string, format string, v ...interface{}) {
+// brailleSpins returns the braille clock spinner frames.
+func brailleSpins() []rune {
+	return []rune{'⠉', '⠘', '⠰', '⠠', '⠄', '⠆', '⠇', '⠋'}
+}
+
+// Logf appends a timestamped formatted message to logFile, if set.
+func Logf(logFile, format string, v ...any) {
 	if logFile == "" {
 		return
 	}
-	f, err := os.OpenFile(logFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+
+	f, err := os.OpenFile( //nolint:gosec // G304: operator --logfile path
+		logFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, logFileMode)
 	if err != nil {
 		return
 	}
-	defer f.Close()
-	fmt.Fprintf(f, time.Now().Format("2006-01-02 15:04:05.000 ")+format+"\n", v...)
+	defer func() { _ = f.Close() }()
+
+	_, _ = fmt.Fprintf(f,
+		time.Now().Format("2006-01-02 15:04:05.000 ")+format+"\n", v...)
 }