Adopt repo standards: scaffold, policies, lint-clean (closes #1)

Standard scaffold: script/ entrypoints with the Makefile as thin shims, a Dockerfile whose lint and test phases gate the build, a Gitea CI workflow running script/cibuild, REPO_POLICIES.md, TODO.md, .editorconfig, .dockerignore, LICENSE, wider .gitignore. .golangci.yml is byte-identical to the canonical copy in the prompts repo.

211 lint findings fixed in code: package globals became functions/fields and a cobra command constructor, magic numbers became named constants, ctx is threaded into the probes, monitor loops split. Tests moved to external _test packages with export_test.go. Behavior unchanged.

Readers will trip over: make lint/test/check now need a Docker daemon; the personal rsync copy/run targets are gone and make run runs locally.
Disclosure: four //nolint:gosec remain on the fixed-argv ping/curl calls and the operator-chosen log file, as the reference repo annotates the same class.
Disclosure: module path left as-is.

Model: opus-4-8 (implementation); fable-5-1 (merge)

internal/cli/export_test.go

@@ -0,0 +1,8 @@
+//go:build linux
+
+package cli
+
+import "github.com/spf13/cobra"
+
+// NewRootCmd exposes newRootCmd for external tests.
+func NewRootCmd() *cobra.Command { return newRootCmd() }

internal/cli/root.go

@@ -1,6 +1,6 @@
 //go:build linux
-// +build linux
 
+// Package cli wires command-line flags to the network monitor and runs it.
 package cli
 
 import (
@@ -15,8 +15,8 @@ import (
 	"git.eeqj.de/sneak/rtnetmon/internal/monitor"
 )
 
-// Config holds the application configuration
-type Config struct {
+// config holds the application configuration.
+type config struct {
 	IfaceA  string
 	LabelA  string
 	IfaceB  string
@@ -25,94 +25,104 @@ type Config struct {
 	LogFile string
 }
 
-var (
-	cfg     Config
-	rootCmd = &cobra.Command{
-		Use:   "rtnetmon",
-		Short: "Real-time network monitoring dashboard",
-		Long: `rtnetmon is a dual-interface network monitoring dashboard that provides
-real-time visibility into network health, packet loss, and latency.`,
-		RunE: runMonitor,
-	}
-)
-
-// Default hosts for monitoring
-var (
-	defaultReachabilityHosts = []string{
+// defaultReachabilityHosts is the default reachability host list.
+func defaultReachabilityHosts() []string {
+	return []string{
 		"8.8.8.8", "8.8.4.4", "google.com", "github.com",
 		"console.aws.amazon.com", "console.cloud.google.com",
 		"fast.com", "datavi.be", "captive.apple.com",
 	}
+}
 
-	defaultPacketLossHosts = []string{
-		"github.com", "google.com", "8.8.8.8", "captive.apple.com", "62.115.190.68",
+// defaultPacketLossHosts is the default packet-loss host list.
+func defaultPacketLossHosts() []string {
+	return []string{
+		"github.com", "google.com", "8.8.8.8",
+		"captive.apple.com", "62.115.190.68",
 	}
+}
 
-	defaultTCPHosts = []string{
+// defaultTCPHosts is the default TCP connect host:port list.
+func defaultTCPHosts() []string {
+	return []string{
 		"datavi.be:443", "fast.com:443",
 		"console.aws.amazon.com:443", "console.cloud.google.com:443",
 		"captive.apple.com:80", "google.com:443",
 	}
-)
-
-func init() {
-	// Define flags
-	rootCmd.Flags().StringVar(&cfg.IfaceA, "ifaceA", "gu0", "primary network interface")
-	rootCmd.Flags().StringVar(&cfg.LabelA, "labelA", "gu LAN - VPN outbound", "label for ifaceA")
-	rootCmd.Flags().StringVar(&cfg.IfaceB, "ifaceB", "backhaul0", "secondary network interface")
-	rootCmd.Flags().StringVar(&cfg.LabelB, "labelB", "Cox cable direct", "label for ifaceB")
-	rootCmd.Flags().StringSliceVar(&cfg.Hosts, "hosts", defaultReachabilityHosts, "comma-separated reachability hosts")
-	rootCmd.Flags().StringVar(&cfg.LogFile, "logfile", "/tmp/rtnetmon.log", "path to log file")
-
-	// Bind flags to viper
-	_ = viper.BindPFlag("ifaceA", rootCmd.Flags().Lookup("ifaceA"))
-	_ = viper.BindPFlag("labelA", rootCmd.Flags().Lookup("labelA"))
-	_ = viper.BindPFlag("ifaceB", rootCmd.Flags().Lookup("ifaceB"))
-	_ = viper.BindPFlag("labelB", rootCmd.Flags().Lookup("labelB"))
-	_ = viper.BindPFlag("hosts", rootCmd.Flags().Lookup("hosts"))
-	_ = viper.BindPFlag("logfile", rootCmd.Flags().Lookup("logfile"))
 }
 
-func runMonitor(cmd *cobra.Command, args []string) error {
+// newRootCmd builds the cobra root command with its flags bound.
+func newRootCmd() *cobra.Command {
+	cfg := &config{}
+	cmd := &cobra.Command{
+		Use:   "rtnetmon",
+		Short: "Real-time network monitoring dashboard",
+		Long: `rtnetmon is a dual-interface network monitoring dashboard that provides
+real-time visibility into network health, packet loss, and latency.`,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			return runMonitor(cfg)
+		},
+	}
+	registerFlags(cmd, cfg)
+
+	return cmd
+}
+
+// registerFlags defines and viper-binds the command's flags.
+func registerFlags(cmd *cobra.Command, cfg *config) {
+	f := cmd.Flags()
+	f.StringVar(&cfg.IfaceA, "ifaceA", "gu0", "primary network interface")
+	f.StringVar(&cfg.LabelA, "labelA", "gu LAN - VPN outbound", "label for ifaceA")
+	f.StringVar(&cfg.IfaceB, "ifaceB", "backhaul0", "secondary network interface")
+	f.StringVar(&cfg.LabelB, "labelB", "Cox cable direct", "label for ifaceB")
+	f.StringSliceVar(&cfg.Hosts, "hosts", defaultReachabilityHosts(),
+		"comma-separated reachability hosts")
+	f.StringVar(&cfg.LogFile, "logfile", "/tmp/rtnetmon.log", "path to log file")
+
+	for _, name := range []string{
+		"ifaceA", "labelA", "ifaceB", "labelB", "hosts", "logfile",
+	} {
+		_ = viper.BindPFlag(name, f.Lookup(name))
+	}
+}
+
+// runMonitor constructs and runs the monitor from cfg.
+func runMonitor(cfg *config) error {
 	monitor.Logf(cfg.LogFile, "Starting rtnetmon")
-	monitor.Logf(cfg.LogFile, "Monitoring interfaces %s and %s", cfg.IfaceA, cfg.IfaceB)
+	monitor.Logf(cfg.LogFile, "Monitoring interfaces %s and %s",
+		cfg.IfaceA, cfg.IfaceB)
 
-	// Create the monitor
-	mon := monitor.NewMonitor(cfg.IfaceA, cfg.LabelA, cfg.IfaceB, cfg.LabelB, cfg.LogFile)
+	mon := monitor.NewMonitor(cfg.IfaceA, cfg.LabelA, cfg.IfaceB, cfg.LabelB,
+		cfg.LogFile)
 
-	// Add reachability hosts
 	for _, host := range cfg.Hosts {
 		mon.AddReachabilityHost(host)
 	}
 
-	// Add packet loss hosts
-	for _, host := range defaultPacketLossHosts {
+	for _, host := range defaultPacketLossHosts() {
 		mon.AddPacketLossHost(host)
 	}
 
-	// Add TCP hosts
-	for _, host := range defaultTCPHosts {
+	for _, host := range defaultTCPHosts() {
 		mon.AddTCPHost(host)
 	}
 
-	// Create context with signal handling
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	// Handle signals
 	sig := make(chan os.Signal, 1)
 	signal.Notify(sig, os.Interrupt, syscall.SIGTERM)
+
 	go func() {
 		s := <-sig
 		monitor.Logf(cfg.LogFile, "Signal received: %v", s)
 		cancel()
 	}()
 
-	// Run the monitor
 	return mon.Run(ctx)
 }
 
-// Execute runs the root command
+// Execute builds the root command and runs it.
 func Execute() error {
-	return rootCmd.Execute()
+	return newRootCmd().Execute()
 }

internal/cli/root_test.go

@@ -1,36 +1,25 @@
 //go:build linux
-// +build linux
 
-package cli
+package cli_test
 
 import (
 	"testing"
+
+	"git.eeqj.de/sneak/rtnetmon/internal/cli"
 )
 
-// TestExecute tests that the CLI can be initialized
-func TestExecute(t *testing.T) {
-	// This is a simple compilation test to ensure the CLI package compiles
-	// We can't easily test the full Execute() function as it starts the UI
+func TestNewRootCmd(t *testing.T) {
+	t.Parallel()
 
-	// Test that rootCmd is properly initialized
-	if rootCmd == nil {
-		t.Fatal("rootCmd is nil")
+	cmd := cli.NewRootCmd()
+	if cmd.Use != "rtnetmon" {
+		t.Errorf("Use = %q, want %q", cmd.Use, "rtnetmon")
 	}
 
-	if rootCmd.Use != "rtnetmon" {
-		t.Errorf("Expected rootCmd.Use to be 'rtnetmon', got '%s'", rootCmd.Use)
-	}
-
-	// Test that default configuration is set
-	if len(defaultReachabilityHosts) == 0 {
-		t.Error("defaultReachabilityHosts is empty")
-	}
-
-	if len(defaultPacketLossHosts) == 0 {
-		t.Error("defaultPacketLossHosts is empty")
-	}
-
-	if len(defaultTCPHosts) == 0 {
-		t.Error("defaultTCPHosts is empty")
+	names := []string{"ifaceA", "labelA", "ifaceB", "labelB", "hosts", "logfile"}
+	for _, name := range names {
+		if cmd.Flags().Lookup(name) == nil {
+			t.Errorf("flag %q not registered", name)
+		}
 	}
 }