Feature/hardening backlog

.github/actions/build-frontend/action.yml

@@ -0,0 +1,25 @@
+name: Build explorer frontend
+description: >-
+  Builds the explorer-web SvelteKit app into gateway/explorer/web/dist,
+  which gateway/explorer embeds via //go:embed all:web/dist.
+  Required before any `go build`/`go test` of the root module in CI,
+  because dist/ is gitignored.
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: 20
+        cache: npm
+        cache-dependency-path: explorer-web/package-lock.json
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: explorer-web
+      run: npm ci
+
+    - name: Build frontend
+      shell: bash
+      working-directory: explorer-web
+      run: npm run build

.github/workflows/ci-bench.yml

@@ -0,0 +1,37 @@
+# XC-002: benchmark suite CI wiring. Manual or weekly run;
+# results land as artifacts for benchstat comparison across runs.
+name: Benchmarks
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '23 4 * * 1'  # weekly Monday
+
+permissions:
+  contents: read
+
+jobs:
+  bench:
+    name: go test -bench
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build explorer frontend
+        uses: ./.github/actions/build-frontend
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run benchmarks
+        run: |
+          go test -run '^$' -bench . -benchmem -benchtime=2s ./core/chunk/ ./core/store/ ./core/erasure/ ./gateway/memgate_v2/ | tee bench.txt
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: bench-${{ github.run_number }}
+          path: bench.txt
+          retention-days: 90

.github/workflows/ci-chaos.yml

@@ -0,0 +1,66 @@
+# XC-007: multi-node chaos/e2e matrix (nightly).
+# v1 chaos = node-kill mid-transfer on a 3-node swarm.
+# Network-level packet loss/latency (toxiproxy) tracked in finding.txt.
+name: Chaos E2E
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '41 3 * * *'  # nightly
+
+permissions:
+  contents: read
+
+jobs:
+  chaos:
+    name: 3-node swarm survives node kill
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build daemon binary (linux/amd64)
+        run: go build -trimpath -o membuss ./cmd/membuss
+
+      - name: Build container image
+        run: docker build -t membuss:local .
+
+      - name: Start 3-node swarm
+        run: docker compose -f docker-compose.multi.yml up -d --wait || docker compose -f docker-compose.multi.yml ps
+
+      - name: Wait for nodes to settle
+        run: sleep 20
+
+      - name: Seed content on node 1, fetch from node 2
+        id: happy
+        run: |
+          set -e
+          head -c 1048576 /dev/urandom > /tmp/chaos.bin
+          docker cp /tmp/chaos.bin membuss-1:/tmp/chaos.bin
+          OUT=$(docker exec membuss-1 /usr/local/bin/membuss add /tmp/chaos.bin)
+          MID=$(echo "$OUT" | grep -oE '[a-z0-9]{59,}' | head -1)
+          echo "mid=$MID" >> "$GITHUB_OUTPUT"
+          sleep 10   # announce + propagation
+          docker exec membuss-2 /usr/local/bin/membuss cat "$MID" > /tmp/out.bin
+          cmp /tmp/out.bin /tmp/chaos.bin
+
+
+      - name: Chaos — kill node 1 (seed node)
+        if: steps.happy.outcome == 'success'
+        run: docker stop membuss-1
+
+      - name: Refetch from node 2 after seed death
+        if: steps.happy.outcome == 'success'
+        run: |
+          set -e
+          MID="${{ steps.happy.outputs.mid }}"
+          docker exec membuss-2 /usr/local/bin/membuss cat "$MID" > /tmp/out2.bin
+          cmp /tmp/out2.bin /tmp/chaos.bin
+
+      - name: Teardown (always)
+        if: always()
+        run: docker compose -f docker-compose.multi.yml down -v || true

.github/workflows/ci.yml

@@ -0,0 +1,184 @@
+name: CI
+
+on:
+  push:
+    branches: [master, features]
+  pull_request:
+    branches: [master]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint (golangci-lint)
+    # Reporting-only until the pre-existing staticcheck/unused debt
+    # is burned down (finding.txt XC-004 burn-down list).
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build explorer frontend
+        uses: ./.github/actions/build-frontend
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - uses: golangci/golangci-lint-action@v8
+        with:
+          version: latest
+          args: --timeout=10m
+
+  govulncheck:
+    name: Vulnerabilities (govulncheck)
+    # Reporting-only until the 14 called vulnerabilities (5 modules +
+    # stdlib, found 2026-08-22) are triaged: Go toolchain bump to
+    # 1.25.13, grpc v1.82.1, x/text v0.39.0, pion/dtls v3.1.4,
+    # webtransport-go v0.11.1. One finding has no fix available yet.
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run govulncheck
+        # @latest: outside-module invocation; plain `go run pkg` would
+        # error "no required module provides package".
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build explorer frontend
+        uses: ./.github/actions/build-frontend
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Test (race on unix, plain on windows)
+        shell: bash
+        run: |
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then
+            go test ./...
+          else
+            CGO_ENABLED=1 go test -race -timeout 20m ./...
+          fi
+
+  coverage:
+    name: Coverage report
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build explorer frontend
+        uses: ./.github/actions/build-frontend
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Test with coverage
+        run: go test -covermode=atomic -coverpkg=./... -coverprofile=coverage.out ./...
+
+      - name: Coverage summary
+        if: always()
+        run: go run golang.org/x/tools/cmd/cover@latest -html=coverage.out -o coverage.html; go tool cover -func=coverage.out | tail -1 | tee -a "$GITHUB_STEP_SUMMARY" || true
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: |
+            coverage.out
+            coverage.html
+          retention-days: 7
+
+  build:
+    name: Build ${{ matrix.goos }}-${{ matrix.goarch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { goos: linux,   goarch: amd64 }
+          - { goos: linux,   goarch: arm64 }
+          - { goos: darwin,  goarch: amd64 }
+          - { goos: darwin,  goarch: arm64 }
+          - { goos: windows, goarch: amd64 }
+          - { goos: windows, goarch: arm64 }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build explorer frontend
+        uses: ./.github/actions/build-frontend
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build daemon binary
+        shell: bash
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: 0
+        run: |
+          go build -trimpath -ldflags "-s -w" -o "bin/membuss$( [ "${{ matrix.goos }}" = "windows" ] && echo '.exe' )" ./cmd/membuss
+
+      - name: Smoke-test cross-compiled binary (native only)
+        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
+        run: ./bin/membuss --help > /dev/null && echo "binary runs"
+
+  modules:
+    name: Build submodule ${{ matrix.module }}
+    # XC-005: root API changes must not silently break the desktop
+    # module (replace => ../). memgit/memploy are separate projects,
+    # NOT part of this repo — never add them here.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [desktop]
+    defaults:
+      run:
+        working-directory: ${{ matrix.module }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ matrix.module }}/go.mod
+          cache: true
+          cache-dependency-path: ${{ matrix.module }}/go.sum
+
+      - name: Build desktop frontend (wails embed target)
+        working-directory: ${{ matrix.module }}/frontend
+        run: |
+          npm ci
+          npm run build
+
+      - run: go build ./...
+      - run: go vet ./...

.gitignore

@@ -83,6 +83,7 @@ Screenshot 2026-07-17 105706.png
 records.txt
 finding.txt
 
-# Standalone Memploy project
+# Standalone projects
 /memploy/
 membussmobo
+/memgit/

.golangci.yml

@@ -0,0 +1,23 @@
+version: "2"
+
+run:
+  timeout: 10m
+
+linters:
+  # Standard set: errcheck, govet, ineffassign, staticcheck, default: standard
+  default: standard
+  settings:
+    staticcheck:
+      checks:
+        - all
+        # ST1000 package-comment + ST1003 naming too disruptive for existing codebase.
+        - -ST1000
+        - -ST1003
+  exclusions:
+    # Skip files carrying "// Code generated ... DO NOT EDIT." header (rpc/proto/*.pb.go).
+    generated: lax
+    rules:
+      # Tests routinely ignore returned errors on purpose.
+      - path: _test\.go
+        linters:
+          - errcheck