feat(core): bootstrap the FinalWeave Go project

.github/dependabot.yml

@@ -1,13 +1,37 @@
 version: 2
 
 updates:
-  - package-ecosystem: github-actions
+  - package-ecosystem: gomod
     directory: /
     schedule:
       interval: weekly
       day: monday
       time: "03:00"
       timezone: Asia/Shanghai
+    # Routine version PRs stay disabled so security fixes remain focused.
+    # GitHub applies a separate limit to Dependabot security updates.
+    open-pull-requests-limit: 0
+    rebase-strategy: auto
+    labels:
+      - dependencies
+      - go
+    commit-message:
+      prefix: "fix(deps)"
+    allow:
+      - dependency-type: all
+    groups:
+      security-patches:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:15"
+      timezone: Asia/Shanghai
     open-pull-requests-limit: 5
     rebase-strategy: auto
     labels:

.github/pull_request_template.md

@@ -38,6 +38,11 @@ For every unchecked box or affected boundary, explain the ADR, proof obligation,
 
 - [ ] `git diff --check`
 - [ ] `python3 scripts/check_docs.py`
+- [ ] `go mod verify` and a clean `go mod tidy` diff
+- [ ] `go vet ./...`
+- [ ] `go test -count=1 -mod=readonly ./...`
+- [ ] `go test -race -count=1 -mod=readonly ./...`
+- [ ] `python3 scripts/check_go_architecture.py`
 - [ ] Relevant unit, race, property, fuzz, vector, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance checks
 - [ ] Negative tests cover malformed, conflicting, stale, replayed, oversized, and partially durable inputs where applicable
 

.github/workflows/ci.yml

@@ -114,3 +114,143 @@ jobs:
 
       - name: Validate documentation tree and local links
         run: python3 scripts/check_docs.py
+
+  go-quality:
+    name: Go quality
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Check formatting
+        shell: bash
+        run: |
+          unformatted="$(gofmt -l $(git ls-files '*.go'))"
+          if [ -n "$unformatted" ]; then
+            printf '%s\n' "$unformatted"
+            echo "::error::run gofmt on the listed files"
+            exit 1
+          fi
+
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Verify module dependencies
+        run: go mod verify
+
+      - name: Check module tidiness
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Enforce Go architecture boundaries
+        run: python3 scripts/check_go_architecture.py
+
+  go-unit:
+    name: Go unit tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Run unit tests
+        run: go test -count=1 -mod=readonly ./...
+
+  go-race:
+    name: Go race tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Run race tests
+        run: go test -race -count=1 -mod=readonly ./...
+
+  go-build:
+    name: Go build (linux/${{ matrix.arch }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - amd64
+          - arm64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Enforce architecture boundaries for target
+        env:
+          GOOS: linux
+          GOARCH: ${{ matrix.arch }}
+          CGO_ENABLED: "0"
+        run: python3 scripts/check_go_architecture.py
+
+      - name: Build finalweave-node
+        env:
+          GOOS: linux
+          GOARCH: ${{ matrix.arch }}
+          CGO_ENABLED: "0"
+        run: go build -trimpath -o "${RUNNER_TEMP}/finalweave-node-${GOARCH}" ./cmd/finalweave-node
+
+  go-ci:
+    name: Go CI
+    if: always()
+    needs:
+      - go-quality
+      - go-unit
+      - go-race
+      - go-build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Require every Go gate
+        shell: bash
+        env:
+          QUALITY_RESULT: ${{ needs['go-quality'].result }}
+          UNIT_RESULT: ${{ needs['go-unit'].result }}
+          RACE_RESULT: ${{ needs['go-race'].result }}
+          BUILD_RESULT: ${{ needs['go-build'].result }}
+        run: |
+          for result in "$QUALITY_RESULT" "$UNIT_RESULT" "$RACE_RESULT" "$BUILD_RESULT"; do
+            if [ "$result" != "success" ]; then
+              echo "::error::one or more Go gates did not succeed"
+              exit 1
+            fi
+          done

.gitignore

@@ -5,3 +5,6 @@ __pycache__/
 *.py[cod]
 *.log
 *.tmp
+/bin/
+/dist/
+coverage*.out

CONTRIBUTING.md

@@ -81,6 +81,8 @@ PR 描述必须：
 
 没有关联 Issue 的紧急修复必须解释原因，并在合并后补齐记录。
 
+由 GitHub Dependabot App 自动创建的依赖和安全更新 PR 不要求另建 Issue，也不要求人工改写其生成的分支名或正文；Dependabot alert、advisory 和生成的变更记录承担追踪作用。这类 PR 仍必须通过全部 required checks、依赖审查和项目规定的审批/合并规则，人工追加的非依赖改动必须另开 Issue 和 PR。
+
 ### 提交格式
 
 ```text
@@ -118,13 +120,20 @@ git config commit.template .github/commit_message_template.txt
 
 ### 验证门
 
-当前仓库处于规范阶段，所有改动至少运行：
+当前仓库处于规范与代码 Bootstrap 阶段，所有改动至少运行：
 
 ```bash
 git diff --check
 python3 scripts/check_docs.py
+go mod verify
+go vet ./...
+go test -count=1 -mod=readonly ./...
+go test -race -count=1 -mod=readonly ./...
+python3 scripts/check_go_architecture.py
 ```
 
+修改 Go module 后还必须运行 `go mod tidy` 并确认 `go.mod`、`go.sum` 没有非预期差异。涉及尚未落地的协议、存储、网络、执行或证明能力时，应按对应风险增加 property、Fuzz、向量、模型、Byzantine、网络分区、崩溃恢复、Chaos 或性能门禁；当前 Bootstrap 不能替代这些检查。
+
 文档或 ADR 变更还必须检查：
 
 - 所有相对链接和文档入口有效。
@@ -180,6 +189,8 @@ The `dependabot/` namespace is reserved for the GitHub Dependabot App.
 - PR bodies link the issue, summarize impact, cover all relevant safety and compatibility boundaries, list validation, and describe risk and rollback.
 - Security vulnerabilities use the private process in [SECURITY.md](SECURITY.md), not public issues.
 
+Dependency and security-update PRs authored by the GitHub Dependabot App are exempt from a separate issue and from manually rewriting the generated branch or body. The alert, advisory, and generated update record provide traceability. These PRs still require every required check, dependency review, and normal approval/merge control; unrelated human-authored changes require their own issue and PR.
+
 ### Safety review
 
 Review every relevant change against quorum and epoch rules, BatchAC meaning, deterministic ordering, serial-equivalent execution, exact finality-proof binding, canonical encoding, durable recovery, bounded Byzantine work, compatibility, and rollback.
@@ -188,11 +199,16 @@ No optimization may trade away safety, determinism, verifiability, or recoverabi
 
 ### Validation
 
-The current specification repository requires at least:
+The repository is now in the specification and code-bootstrap phase. Every change requires at least:
 
 ```bash
 git diff --check
 python3 scripts/check_docs.py
+go mod verify
+go vet ./...
+go test -count=1 -mod=readonly ./...
+go test -race -count=1 -mod=readonly ./...
+python3 scripts/check_go_architecture.py
 ```
 
-As implementation code lands, each PR must add and run the applicable unit, race, property, fuzz, cross-implementation vector, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance gates. Document every skipped relevant check and its residual risk.
+After changing module dependencies, run `go mod tidy` and review every `go.mod` and `go.sum` change. Each PR must add and run the applicable property, fuzz, cross-implementation vector, model, Byzantine, partition, crash-recovery, snapshot, chaos, and performance gates as implementation code lands. Document every skipped relevant check and its residual risk; the bootstrap gates do not replace feature-specific validation.

README.md

@@ -1,9 +1,9 @@
 # FinalWeave
 
-[![Docs CI](https://github.com/wowtrust/final-weave/actions/workflows/ci.yml/badge.svg)](https://github.com/wowtrust/final-weave/actions/workflows/ci.yml)
+[![CI](https://github.com/wowtrust/final-weave/actions/workflows/ci.yml/badge.svg)](https://github.com/wowtrust/final-weave/actions/workflows/ci.yml)
 [![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL--3.0--only-blue.svg)](LICENSE)
 
-[文档中心](doc/README.md) · [学习路线](doc/tutorial/00-learning-path.md) · [系统架构](doc/01-system-architecture.md) · [协议规范](doc/protocol/README.md) · [工程规范](doc/engineering/README.md) · [贡献指南](CONTRIBUTING.md)
+[文档中心](doc/README.md) · [学习路线](doc/tutorial/00-learning-path.md) · [系统架构](doc/01-system-architecture.md) · [代码架构](doc/07-code-architecture.md) · [协议规范](doc/protocol/README.md) · [工程规范](doc/engineering/README.md) · [贡献指南](CONTRIBUTING.md)
 
 > **FinalWeave — Parallel by design, final by proof.**
 >
@@ -12,7 +12,7 @@
 FinalWeave 是一套面向多组织协作场景的许可型、多账本、确定性最终性 BlockDAG 区块链设计。它把并行数据可用性、直接 DAG 排序、确定性并行执行和可独立验证的最终性证明组合成一条完整链路。
 
 > [!IMPORTANT]
-> FinalWeave 当前处于**架构设计与协议规范阶段**。本仓库尚不包含可运行节点、CLI、SDK、容器镜像或正式版本，也没有 FinalWeave 自身的生产 TPS、延迟或稳定性数据。文档中的命令、目录和接口属于目标设计，不能视为已经交付的能力。
+> FinalWeave 当前处于**架构设计、协议规范与代码 Bootstrap 阶段**。仓库已经包含 Go module、`finalweave-node version` 诊断命令、构建信息和 v1 quorum 参数校验，但尚无可运行的共识节点、业务 CLI、SDK、API、容器镜像或正式版本，也没有 FinalWeave 自身的生产 TPS、延迟或稳定性数据。除明确标记为已实现的 Bootstrap 能力外，文档中的命令、目录和接口均属于目标设计，不能视为已经交付。
 
 ## FinalWeave 解决什么问题
 
@@ -110,19 +110,24 @@ FinalWeave 面向高持续写入、多机构 Byzantine 信任边界、可恢复
 
 完整目录、统一术语、文档优先级和推荐路线见[文档中心](doc/README.md)。
 
-## 本地阅读与校验
+## 本地构建与校验
 
 ```bash
 git clone https://github.com/wowtrust/final-weave.git
 cd final-weave
+go mod download
+go test ./...
+go run ./cmd/finalweave-node version
+go run ./cmd/finalweave-node version --output json
 python3 scripts/check_docs.py
+python3 scripts/check_go_architecture.py
 ```
 
-已配置 GitHub SSH key 的开发者也可以使用 `git@github.com:wowtrust/final-weave.git`。文档采用普通 Markdown 和内嵌 Mermaid，不需要专用站点生成器；校验脚本仅依赖 Python 3 标准库。
+当前二进制只提供可复用、可测试的版本诊断入口，不会启动网络、监听端口或运行共识。完整本地门禁还包括 `go vet ./...` 和 `go test -race ./...`。已配置 GitHub SSH key 的开发者也可以使用 `git@github.com:wowtrust/final-weave.git`。文档采用普通 Markdown 和内嵌 Mermaid，不需要专用站点生成器；两个校验脚本仅依赖 Python 3 标准库，其中代码架构检查会调用 Go 工具链。
 
 ## 当前路线
 
-当前仓库交付的是阶段性设计与协议规范文档，其中既有 Accepted ADR 和规范性协议，也有仍需实现与验证的工程设计。实施按依赖关系推进：
+当前仓库交付阶段性设计与协议规范文档，以及一套最小 Go Bootstrap。Bootstrap 不是实施路线的阶段 0 完成声明；确定性模拟器、稳定错误模型、日志与指标、SBOM、跨实现向量等门禁仍需按独立 Issue 落地。后续实现按依赖关系推进：
 
 ```text
 schema 与测试向量

cmd/finalweave-node/main.go

@@ -0,0 +1,16 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/wowtrust/final-weave/internal/buildinfo"
+	"github.com/wowtrust/final-weave/internal/cli"
+)
+
+func main() {
+	if err := cli.NewNodeCommand(os.Stdout, os.Stderr, buildinfo.Current()).Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}