chore: promote dev to main (top-down dep tree sweep)

.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  push:
+    branches: [dev, main]
+  pull_request:
+    branches: [dev, main]
+
+permissions:
+  contents: read
+
+env:
+  GOFLAGS: -buildvcs=false
+  GOWORK: "off"
+  GOPROXY: "direct"
+  GOSUMDB: "off"
+
+jobs:
+  test:
+    name: Test + Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test with coverage
+        working-directory: go
+        run: go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: go/coverage.out
+          flags: unittests
+          fail_ci_if_error: false
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          working-directory: go
+          args: --timeout=5m --tests=false
+
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test for coverage
+        working-directory: go
+        run: go test -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@v6
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=dappcore
+            -Dsonar.projectKey=dappcore_config
+            -Dsonar.sources=go
+            -Dsonar.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/*_test.go
+            -Dsonar.tests=go
+            -Dsonar.test.inclusions=**/*_test.go
+            -Dsonar.go.coverage.reportPaths=go/coverage.out

.gitmodules

@@ -0,0 +1,12 @@
+[submodule "external/go"]
+	path = external/go
+	url = https://github.com/dappcore/go.git
+	branch = dev
+[submodule "external/io"]
+	path = external/io
+	url = https://github.com/dappcore/go-io.git
+	branch = dev
+[submodule "external/log"]
+	path = external/log
+	url = https://github.com/dappcore/go-log.git
+	branch = dev

.woodpecker.yml

@@ -14,7 +14,7 @@ steps:
       GOFLAGS: -buildvcs=false
       GOWORK: "off"
     commands:
-      - golangci-lint run --timeout=5m ./...
+      - cd go && golangci-lint run --timeout=5m ./...
 
   - name: go-test
     image: golang:1.26-alpine
@@ -25,7 +25,7 @@ steps:
       CGO_ENABLED: "1"
     commands:
       - apk add --no-cache git build-base
-      - go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - cd go && go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
   - name: sonar
     image: sonarsource/sonar-scanner-cli:latest
     depends_on: [go-test]

AGENTS.md

@@ -1,49 +1,32 @@
-# Agent Guide
+# Agent Notes
 
-This repository is the `dappco.re/go/config` consumer module for Core
-configuration. Work here should follow the current `dappco.re/go` conventions:
-public operations return `core.Result`, tests use the Core assertion helpers,
-and examples print through `core.Println`.
+This repository is the `dappco.re/go/config` module. It provides layered
+configuration, manifest loading, discovery, feature flags, XDG paths, and the
+Core framework service adapter used by other Core projects.
 
-## Repository Shape
+When changing code here, keep the public API aligned with `dappco.re/go` v0.9
+patterns. Use the Core wrappers for formatting, JSON, filesystem paths,
+environment reads, and assertions in tests. Do not add direct imports of the
+stdlib packages banned by the upgrade audit, and do not create compatibility
+packages that shadow those stdlib names.
 
-- `config.go` contains the `Config` type, functional options, file loading,
-  typed retrieval, persistence, and legacy `Load` / `Save` helpers.
-- `env.go` contains environment scanning helpers. It maps prefixed variables to
-  lower-case dot keys without importing banned stdlib packages directly.
-- `service.go` wraps `Config` as a Core lifecycle service.
-- Each production file has a matching `_test.go` and `_example_test.go` sibling.
-  Keep tests next to their source file; do not create aggregate compliance
-  files.
-- `docs/` contains the human-facing architecture and development notes.
+Tests are source-file aware. Public symbols in `config.go` are tested in
+`config_test.go`, public symbols in `resolve.go` are tested in
+`resolve_test.go`, and so on. Each public symbol needs the Good, Bad, and Ugly
+triplet in that sibling file plus a runnable example in the matching
+`*_example_test.go` file. Supplemental tests may exist, but their names should
+describe the behaviour they cover rather than pretending to be another
+symbol's canonical triplet.
 
-## Compliance Rules
-
-The audit script is the work provider:
+The normal verification gate for this repository is:
 
 ```bash
+GOWORK=off go mod tidy
+GOWORK=off go vet ./...
+GOWORK=off go test -count=1 ./...
+gofmt -l .
 bash /Users/snider/Code/core/go/tests/cli/v090-upgrade/audit.sh .
 ```
 
-Do not stop on partial progress. A compliant run has every counter at `0` and
-prints `verdict: COMPLIANT`.
-
-The important local patterns are:
-
-- Use `core.Result` with `core.Ok`, `core.Fail`, or `core.ResultOf`.
-- Do not import banned stdlib packages such as `fmt`, `os`, `strings`,
-  `path/filepath`, or `encoding/json` in this consumer module.
-- Use `core.Path*`, `core.Environ`, `core.SplitN`, `core.Replace`, and
-  `core.Sprintf` instead of direct stdlib helpers.
-- Public symbols require `Good`, `Bad`, and `Ugly` tests in the matching source
-  test file.
-- Public symbols require examples in the matching source example file.
-
-## Editing Notes
-
-Keep the dual-view config invariant intact. File-backed and explicitly set
-values belong in `Config.file`; the read view in `Config.full` is rebuilt from
-file settings, environment variables, and explicit overrides. That separation is
-what prevents environment-derived secrets from being written during `Commit`.
-
-Do not edit `BRIEF.md`, `.git`, `.codex`, or any `third_party` directory.
+`BRIEF.md` is a local work brief and should be left untracked. Do not edit
+`third_party/`, `.git/`, or `.codex/` while applying compliance changes.

CLAUDE.md

@@ -1,59 +1,100 @@
 # CLAUDE.md
 
-This file gives Claude Code agents repository-specific context for
-`dappco.re/go/config`.
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Repo Layout
+
+```text
+core/config/
+├── go/
+│   ├── *.go                      ← Go source files moved from repository root
+│   ├── tests/                    ← Go CLI tests moved from repository root
+│   ├── go.mod
+│   ├── go.sum
+│   ├── README.md -> ../README.md  ← symlink
+│   ├── CLAUDE.md -> ../CLAUDE.md  ← symlink
+│   ├── AGENTS.md -> ../AGENTS.md  ← symlink
+│   └── docs -> ../docs            ← symlink
+├── docs/
+├── schema/
+├── README.md
+├── CLAUDE.md
+├── AGENTS.md
+├── LICENSE/
+├── SONAR-project files
+└── other non-Go/cross-language assets
+```
+
+The Go module path remains `dappco.re/go/config`; only repository layout changed.
+
+## Go Resolution Modes
+
+This repository is module-local under `go/` and does not use a local workspace file in this module root. Consumer commands should either:
 
-## Commands
+1. Run from `go/` directly.
+2. Prefix Go commands with `cd go &&` when executed from repository root.
 
-Use the explicit verification commands from the compliance brief:
+Examples:
 
 ```bash
-GOWORK=off go mod tidy
-GOWORK=off go vet ./...
-GOWORK=off go test -count=1 ./...
-gofmt -l .
-bash /Users/snider/Code/core/go/tests/cli/v090-upgrade/audit.sh .
+cd go && go test ./...
+cd go && golangci-lint run ./...
+cd go && core go qa
 ```
 
-The audit script is the completion contract. The repository is not complete
-until every audit counter is `0` and the verdict is `COMPLIANT`.
+For CI-style reproducible builds, force module-only behavior:
 
-## Architecture
+```bash
+GOWORK=off go test ./...
+GOFLAGS=-mod=mod go vet ./...
+```
 
-`Config` uses two Viper instances:
+## Build & Test Commands
 
-- `file` stores values loaded from config files and values explicitly set at
-  runtime. This is the only source written by `Commit`.
-- `full` is the read view. It is rebuilt from file settings, environment
-  variables, and explicit overrides.
+This project uses the Core CLI (`core` binary), not `go` directly.
 
-This shape keeps environment-derived secrets out of persisted YAML while still
-letting `Get` and `All` see the effective runtime configuration.
+```bash
+cd go && go test ./...                                    # run all tests
+cd go && GOWORK=off go test -run TestConfig_Get_Good ./...  # run a single test
+cd go && GOWORK=off go test -cover ./...                   # test with coverage
+
+cd go && core go qa                            # format, vet, lint, test
+cd go && core go qa full                       # adds race detector, vuln scan, security audit
+
+cd go && core go fmt                           # format
+cd go && core go vet                           # vet
+cd go && core go lint                          # lint
+```
+
+This is a library package — there is no binary to build or run.
+
+## Architecture
 
-## API Conventions
+**Dual-Viper pattern**: `Config` holds two `*viper.Viper` instances:
+- `v` (full) — file + env + defaults; used for all reads (`Get`, `All`)
+- `f` (file-only) — file + explicit `Set()` calls; used for persistence (`Commit`)
 
-This consumer repo follows `dappco.re/go` v0.9.0 conventions:
+This prevents environment variables from leaking into saved config files. When implementing new features, maintain this invariant: writes go to both `v` and `f`; reads come from `v`; persistence comes from `f`.
 
-- Public operations return `core.Result`.
-- Callers branch on `r.OK` and read `r.Value` or `r.Error()`.
-- Use `core.Ok`, `core.Fail`, and `core.ResultOf` rather than struct literals.
-- Do not import banned stdlib packages directly. Reach through Core wrappers
-  such as `core.PathExt`, `core.PathDir`, `core.Environ`, `core.SplitN`,
-  `core.Replace`, `core.NewReader`, and `core.Sprintf`.
+**Resolution priority** (ascending): defaults → file → env vars (`CORE_CONFIG_*`) → `Set()`
 
-## Tests And Examples
+**Service wrapper**: `Service` in `service.go` wraps `Config` with framework lifecycle (`core.Startable`). Both `Config` and `Service` satisfy `core.Config`, enforced by compile-time assertions.
 
-Each production file with public symbols has a sibling test file and a sibling
-example file. Keep coverage file-aware:
+**Storage abstraction**: All file I/O goes through `coreio.Medium` (from `go-io`). Tests use `coreio.NewMockMedium()` with an in-memory `Files` map — never touch the real filesystem.
 
-- `config.go` -> `config_test.go` and `config_example_test.go`
-- `env.go` -> `env_test.go` and `env_example_test.go`
-- `service.go` -> `service_test.go` and `service_example_test.go`
+## Conventions
 
-Tests use `*core.T`, dot-import `dappco.re/go`, and the Core assertion helpers.
-Triplets are named `Test<File>_<Symbol>_{Good,Bad,Ugly}`. Examples use
-`core.Println`, not `fmt.Println`.
+- **UK English** in comments and documentation (colour, organisation, centre)
+- **Error wrapping**: `coreerr.E(caller, message, underlying)` from `go-log`
+- **Test naming**: `_Good` (happy path), `_Bad` (expected errors), `_Ugly` (panics/edge cases)
+- **Functional options**: `New()` takes `...Option` (e.g. `WithMedium`, `WithPath`, `WithEnvPrefix`)
+- **Conventional commits**: `type(scope): description`
+- **Go workspace**: no per-repo `go.work`; this module resolves with `GOWORK=off`
 
-## Do Not Touch
+## Dependencies
 
-Do not edit `BRIEF.md`, `.git`, `.codex`, or any `third_party` directory.
+- `dappco.re/go/core/io` — `Medium` interface for storage
+- `dappco.re/go/core/log` — `coreerr.E()` error helper
+- `dappco.re/go/core` — `core.Core`, `core.Startable`, `core.ServiceRuntime`, primitives
+- `github.com/spf13/viper` — configuration engine
+- `github.com/stretchr/testify` — test assertions