Merge remote-tracking branch 'upstream/main'

# Conflicts:
#	.github/workflows/ci.yml

Author: chazmaniandinkle

.github/workflows/ci.yml

@@ -1,29 +1,12 @@
 name: CI
-
-on: [push, pull_request]
-
-permissions:
-  contents: read
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
 
 jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-      - run: go vet ./...
-      - run: go test -race ./...
-      - run: go build ./...
-
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-      - uses: golangci/golangci-lint-action@v6
-        with:
-          version: latest
+  go:
+    uses: cogos-dev/.github/.github/workflows/go-ci.yml@main
+    with:
+      go-version: '1.24'

README.md

@@ -1,5 +1,8 @@
 # Constellation Protocol — Proof of Concept
 
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Go Report Card](https://goreportcard.com/badge/github.com/cogos-dev/constellation)](https://goreportcard.com/report/github.com/cogos-dev/constellation)
+
 A distributed identity protocol where trust is earned through temporal consistency, not granted by authority.
 
 Each node maintains a hash-chained event ledger in a git repository, broadcasts signed state snapshots to peers, and derives trust from behavioral history rather than certificate authority. Stolen keys are insufficient for impersonation because trust is coupled to the full event chain, not just a credential.

heartbeat.go

@@ -158,7 +158,7 @@ func sendHeartbeat(nodeName, addr string, hb *Heartbeat) {
 		log.Printf("[%s] Heartbeat to %s failed: %v", nodeName, addr, err)
 		return
 	}
-	resp.Body.Close()
+	_ = resp.Body.Close()
 }
 
 func sendJoinRequest(node *Node, addr string) error {
@@ -185,7 +185,7 @@ func sendJoinRequest(node *Node, addr string) error {
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("join request returned %d", resp.StatusCode)

identity.go

@@ -49,7 +49,7 @@ func SaveIdentity(id *NodeIdentity, dir string) error {
 	if err != nil {
 		return fmt.Errorf("create key file: %w", err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	return pem.Encode(f, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
 }

node.go

@@ -132,7 +132,9 @@ func (n *Node) Stop() {
 	if n.server != nil {
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
-		n.server.Shutdown(ctx)
+		if err := n.server.Shutdown(ctx); err != nil {
+			log.Printf("[%s] Shutdown error: %v", n.Name, err)
+		}
 	}
 }
 

protocol.go

@@ -98,7 +98,9 @@ func handlePeers(node *Node) http.HandlerFunc {
 		}
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(node.Peers.Summarize())
+		if err := json.NewEncoder(w).Encode(node.Peers.Summarize()); err != nil {
+			log.Printf("[%s] Failed to encode peers response: %v", node.Name, err)
+		}
 	}
 }
 
@@ -125,10 +127,12 @@ func handleChallenge(node *Node) http.HandlerFunc {
 		}
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{
+		if err := json.NewEncoder(w).Encode(map[string]any{
 			"events":    events,
 			"coherence": ValidateCoherence(events),
-		})
+		}); err != nil {
+			log.Printf("[%s] Failed to encode challenge response: %v", node.Name, err)
+		}
 	}
 }
 
@@ -171,10 +175,12 @@ func handleJoin(node *Node) http.HandlerFunc {
 		}
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{
+		if err := json.NewEncoder(w).Encode(map[string]any{
 			"status": "accepted",
 			"peers":  peerAddrs,
-		})
+		}); err != nil {
+			log.Printf("[%s] Failed to encode join response: %v", node.Name, err)
+		}
 	}
 }
 
@@ -195,7 +201,9 @@ func handleHealth(node *Node) http.HandlerFunc {
 		if !report.Pass {
 			w.WriteHeader(http.StatusServiceUnavailable)
 		}
-		json.NewEncoder(w).Encode(report)
+		if err := json.NewEncoder(w).Encode(report); err != nil {
+			log.Printf("[%s] Failed to encode health response: %v", node.Name, err)
+		}
 	}
 }
 
@@ -213,10 +221,12 @@ func handleState(node *Node) http.HandlerFunc {
 		}
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{
+		if err := json.NewEncoder(w).Encode(map[string]any{
 			"state": state,
 			"peers": node.Peers.Summarize(),
-		})
+		}); err != nil {
+			log.Printf("[%s] Failed to encode state response: %v", node.Name, err)
+		}
 	}
 }
 
@@ -245,7 +255,7 @@ func issueChallenge(node *Node, peer *PeerState) {
 		log.Printf("[%s] Challenge to %s failed: %v", node.Name, FormatNodeID(peer.NodeID), err)
 		return
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	var result struct {
 		Events    []*EventEnvelope `json:"events"`

run.go

@@ -69,7 +69,7 @@ func cmdNode() {
 			name = args[i]
 		case "--port":
 			i++
-			fmt.Sscanf(args[i], "%d", &port)
+			_, _ = fmt.Sscanf(args[i], "%d", &port)
 		case "--peers":
 			i++
 			peersStr = args[i]
@@ -145,8 +145,10 @@ func cmdInject() {
 		fmt.Fprintf(os.Stderr, "inject failed: %v\n", err)
 		os.Exit(1)
 	}
-	defer resp.Body.Close()
-	io.Copy(os.Stdout, resp.Body)
+	defer func() { _ = resp.Body.Close() }()
+	if _, err := io.Copy(os.Stdout, resp.Body); err != nil {
+		fmt.Fprintf(os.Stderr, "read response failed: %v\n", err)
+	}
 	fmt.Println()
 }
 
@@ -173,7 +175,7 @@ func cmdTamper() {
 		fmt.Fprintf(os.Stderr, "get state failed: %v\n", err)
 		os.Exit(1)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	var state struct {
 		State struct {
@@ -213,21 +215,27 @@ func cmdStatus() {
 		fmt.Fprintf(os.Stderr, "get state failed: %v\n", err)
 		os.Exit(1)
 	}
-	defer stateResp.Body.Close()
+	defer func() { _ = stateResp.Body.Close() }()
 
 	var stateData json.RawMessage
-	json.NewDecoder(stateResp.Body).Decode(&stateData)
+	if err := json.NewDecoder(stateResp.Body).Decode(&stateData); err != nil {
+		fmt.Fprintf(os.Stderr, "decode state failed: %v\n", err)
+		os.Exit(1)
+	}
 
 	// Get health.
 	healthResp, err := client.Get(fmt.Sprintf("%s/health", target))
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "get health failed: %v\n", err)
 		os.Exit(1)
 	}
-	defer healthResp.Body.Close()
+	defer func() { _ = healthResp.Body.Close() }()
 
 	var healthData json.RawMessage
-	json.NewDecoder(healthResp.Body).Decode(&healthData)
+	if err := json.NewDecoder(healthResp.Body).Decode(&healthData); err != nil {
+		fmt.Fprintf(os.Stderr, "decode health failed: %v\n", err)
+		os.Exit(1)
+	}
 
 	output := map[string]json.RawMessage{
 		"state":  stateData,
@@ -236,5 +244,8 @@ func cmdStatus() {
 
 	enc := json.NewEncoder(os.Stdout)
 	enc.SetIndent("", "  ")
-	enc.Encode(output)
+	if err := enc.Encode(output); err != nil {
+		fmt.Fprintf(os.Stderr, "encode output failed: %v\n", err)
+		os.Exit(1)
+	}
 }