lint: clean up 75 pre-existing golangci-lint v2.12.2 issues

core/codegen.go

@@ -168,7 +168,7 @@ func emitInterface(t reflect.Type, name string) string {
 				optional = true
 			}
 		}
-		nullable := f.Type.Kind() == reflect.Ptr
+		nullable := f.Type.Kind() == reflect.Pointer
 		tsTypeStr := tsType(f.Type)
 
 		marker := ": "
@@ -199,7 +199,7 @@ func emitInterface(t reflect.Type, name string) string {
 //   - interface{}         -> unknown
 func tsType(t reflect.Type) string {
 	switch t.Kind() {
-	case reflect.Ptr:
+	case reflect.Pointer:
 		return tsType(t.Elem())
 	case reflect.Bool:
 		return "boolean"

internal/adapter/dolt/supervisor/supervisor.go

@@ -129,7 +129,7 @@ type Supervisor struct {
 	// "ready then went sideways → restarting" lane.
 	starting atomic.Bool
 
-	done    chan struct{}      // closed when the supervisor permanently fails
+	done    chan struct{} // closed when the supervisor permanently fails
 	doneErr atomic.Pointer[error]
 
 	cancel context.CancelFunc // cancels the supervisor goroutines
@@ -563,7 +563,7 @@ func pickFreePort(host string) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	defer l.Close()
+	defer func() { _ = l.Close() }()
 	addr, ok := l.Addr().(*net.TCPAddr)
 	if !ok {
 		return 0, fmt.Errorf("unexpected listener addr type %T", l.Addr())

internal/adapter/dolt/supervisor/unix.go

@@ -4,6 +4,7 @@ package supervisor
 
 import (
 	"bufio"
+	"context"
 	"io"
 	"log/slog"
 	"os/exec"
@@ -45,7 +46,7 @@ func pipeToSlog(r io.ReadCloser, log *slog.Logger, level slog.Level, source stri
 	buf := make([]byte, 0, 64*1024)
 	scanner.Buffer(buf, 1024*1024)
 	for scanner.Scan() {
-		log.Log(nil, level, "dolt subprocess output",
+		log.Log(context.Background(), level, "dolt subprocess output",
 			"source", source, "line", scanner.Text())
 	}
 }

internal/adapter/firecracker/firecracker.go

@@ -135,7 +135,7 @@ type VM struct {
 	// applier during Start. Empty when egress enforcement was not
 	// configured (no provider attached) or when the fallback path
 	// ran. Stop reads it to drive teardownEgressRules.
-	egressTable string
+	egressTable string //nolint:unused // referenced only by firecracker_linux.go
 }
 
 // validate enforces the minimal Spec contract shared by every backend.
@@ -228,7 +228,7 @@ func mergeSecrets(vaultSecrets, explicit map[string]string) map[string]string {
 // errAlreadyStopped is returned by the internal stop path when a VM
 // has already been torn down. Promoted to a no-op nil return at the
 // public Supervisor.Stop boundary so callers can stop idempotently.
-var errAlreadyStopped = errors.New("firecracker: vm already stopped")
+var errAlreadyStopped = errors.New("firecracker: vm already stopped") //nolint:unused // referenced only by firecracker_linux.go
 
 // newVMID generates a per-VM identifier of the shape
 // "ws-<workspace>-<8hex>". Uses crypto/rand so concurrent VMs from

internal/adapter/firecracker/firecracker_linux.go

@@ -404,4 +404,3 @@ func generateMAC(id string) string {
 	return fmt.Sprintf("02:%02x:%02x:%02x:%02x:%02x",
 		h[0], h[1], h[2], h[3], h[4])
 }
-

internal/auth/oauth/oauth.go

@@ -228,8 +228,8 @@ func (o *OAuth) CallbackHandler() http.HandlerFunc {
 	return func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(map[string]any{
-			"status":   "ok",
-			"flow":     "device",
+			"status":    "ok",
+			"flow":      "device",
 			"client_id": o.ClientID(),
 		})
 	}

internal/auth/oauth/oauth_github.go

@@ -262,8 +262,8 @@ func matchesTeam(teams []ghTeam, allowed []string) bool {
 // broader tenant-config refactor; this in-memory store mirrors the
 // SQLStore + MemStore split tenant.Store uses today.
 type OrgGateStore struct {
-	mu     sync.RWMutex
-	gates  map[string]OrgGate
+	mu    sync.RWMutex
+	gates map[string]OrgGate
 }
 
 // NewOrgGateStore returns an empty in-memory store.

internal/cli/admin_backup.go

@@ -68,10 +68,10 @@ func newAdminCmd() *cobra.Command {
 }
 
 type backupFlags struct {
-	out         string
-	dataDir     string
-	auditLog    string
-	version     string
+	out          string
+	dataDir      string
+	auditLog     string
+	version      string
 	skipDoltDump bool
 }
 
@@ -105,10 +105,10 @@ with 'gemba admin restore --from <path>'.`,
 }
 
 type restoreFlags struct {
-	from    string
-	dataDir string
+	from     string
+	dataDir  string
 	auditLog string
-	force   bool
+	force    bool
 }
 
 func newAdminRestoreCmd() *cobra.Command {
@@ -234,7 +234,7 @@ func runAdminRestore(out io.Writer, flags restoreFlags) error {
 	if err != nil {
 		return fmt.Errorf("gzip reader: %w", err)
 	}
-	defer gz.Close()
+	defer func() { _ = gz.Close() }()
 	tr := tar.NewReader(gz)
 
 	auditOut := flags.auditLog

internal/cli/admin_backup_test.go

@@ -147,11 +147,10 @@ func TestAdminBackup_RequiresFlags(t *testing.T) {
 	if err := runAdminBackup(&buf, backupFlags{dataDir: t.TempDir()}); err == nil {
 		t.Fatalf("expected error for missing --out")
 	}
-	if err := runAdminBackup(&buf, backupFlags{out: filepath.Join(t.TempDir(), "x.tgz")}); err == nil {
-		// This may not surface here because the cobra layer validates;
-		// runAdminBackup itself attempts to read data-dir which is "".
-		// Either way, the absence of a tar.gz is the failure mode.
-	}
+	// Missing data-dir: runAdminBackup itself may not surface this (cobra
+	// validates at a higher layer); the absence of a tar.gz is the actual
+	// failure mode. Call it for coverage; ignore the result.
+	_ = runAdminBackup(&buf, backupFlags{out: filepath.Join(t.TempDir(), "x.tgz")})
 }
 
 // TestAdminRestore_RejectsTampered verifies that a backup whose

internal/cli/bead_crud.go

@@ -32,8 +32,8 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/GembaCore/gemba-core/core"
-	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 	"github.com/GembaCore/gemba-core/internal/cli/serverconfig"
+	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 )
 
 // clientFactory is the seam tests use to inject a pre-baked typed
@@ -477,4 +477,3 @@ Server-side this targets POST /api/work-items/{id}/notes, which is a
 	cmd.Flags().StringVar(&note, "note", "", "note text (alternative to positional)")
 	return cmd
 }
-

internal/cli/login.go

@@ -30,8 +30,8 @@ import (
 	"golang.org/x/term"
 
 	"github.com/GembaCore/gemba-core/internal/auth/credstore"
-	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 	"github.com/GembaCore/gemba-core/internal/cli/serverconfig"
+	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 )
 
 // whoamiResponse mirrors internal/server/whoami.go's wire shape.
@@ -253,7 +253,7 @@ func promptForTokenMasked(out io.Writer) (string, error) {
 		return "", fmt.Errorf("open /dev/tty: %w (use --token or --token-stdin)", err)
 	}
 	defer tty.Close()
-	fmt.Fprint(out, "Enter personal access token: ")
+	_, _ = fmt.Fprint(out, "Enter personal access token: ")
 	b, err := term.ReadPassword(int(tty.Fd()))
 	fmt.Fprintln(out)
 	if err != nil {
@@ -399,4 +399,3 @@ func printNotLoggedIn(out io.Writer, asJSON bool, server string) error {
 	fmt.Fprintln(out, "not logged in")
 	return nil
 }
-

internal/cli/logs.go

@@ -50,8 +50,8 @@ going, up to --max-retries times.`,
 			if !follow {
 				return errors.New(
 					"transcript replay not yet implemented (server " +
-						"lacks GET /api/runs/{id}/transcript). Use -f " +
-						"to attach to the live stream instead.")
+						"lacks GET /api/runs/{id}/transcript); use -f " +
+						"to attach to the live stream instead")
 			}
 			return runLogsFollow(cmd, args[0])
 		},

internal/cli/run.go

@@ -119,7 +119,8 @@ func runRunCmd(cmd *cobra.Command, beadID string) error {
 			"detached. resume with: gemba logs -f %s\n", runID)
 		// Cobra eats os.Exit-equivalent codes; the parent process gets
 		// 130 by exiting directly. This is the SIGINT convention.
-		os.Exit(exitCodeDetached)
+		stop()
+		os.Exit(exitCodeDetached) //nolint:gocritic // intentional: SIGINT exit convention after manual stop()
 	}
 	return nil
 }

internal/cli/run_client.go

@@ -19,8 +19,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 	"github.com/GembaCore/gemba-core/internal/cli/serverconfig"
+	gembaclient "github.com/GembaCore/gemba-core/internal/client"
 )
 
 // runClientFactory builds a typed client bound to server. Tests

internal/cli/serve.go

@@ -41,13 +41,13 @@ import (
 	"github.com/GembaCore/gemba-core/internal/persona"
 	"github.com/GembaCore/gemba-core/internal/personas/onboarder"
 	"github.com/GembaCore/gemba-core/internal/server"
-	"github.com/GembaCore/gemba-core/internal/tenant"
 	"github.com/GembaCore/gemba-core/internal/server/metrics"
 	"github.com/GembaCore/gemba-core/internal/shader"
 	"github.com/GembaCore/gemba-core/internal/shader/gastown"
 	"github.com/GembaCore/gemba-core/internal/skills/bootstrap_review"
 	"github.com/GembaCore/gemba-core/internal/skills/epic_order"
 	"github.com/GembaCore/gemba-core/internal/skills/escalation_handoff"
+	"github.com/GembaCore/gemba-core/internal/tenant"
 	"github.com/GembaCore/gemba-core/internal/transport/api"
 	"github.com/GembaCore/gemba-core/internal/walk"
 	walksources "github.com/GembaCore/gemba-core/internal/walk/sources"

internal/cli/serve_embedded_dolt.go

@@ -162,7 +162,7 @@ func bootstrapEmbeddedDoltSchema(ctx context.Context, sup *supervisor.Supervisor
 	if err != nil {
 		return fmt.Errorf("embedded dolt: mkdtemp for bd init: %w", err)
 	}
-	defer os.RemoveAll(tmpDir)
+	defer func() { _ = os.RemoveAll(tmpDir) }()
 
 	bdCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
 	defer cancel()

internal/cli/spec.go

@@ -1,11 +1,12 @@
 // gemba spec — ASDD interception layer command tree.
 //
 // Subcommands:
-//   spec new <slug>     Scaffold a new spec directory (and optionally Kit files).
-//   spec init           Seed ASDD project artifacts (constitution, hooks, CLAUDE.md).
-//   spec hook           PreToolUse hook handlers (Write/Edit/NotebookEdit, Bash).
-//   spec preflight      Refuse /implement when tasks.md still exists.
-//   spec reconcile      Stub — to be implemented by the analyzer (gm-v0sp.21).
+//
+//	spec new <slug>     Scaffold a new spec directory (and optionally Kit files).
+//	spec init           Seed ASDD project artifacts (constitution, hooks, CLAUDE.md).
+//	spec hook           PreToolUse hook handlers (Write/Edit/NotebookEdit, Bash).
+//	spec preflight      Refuse /implement when tasks.md still exists.
+//	spec reconcile      Stub — to be implemented by the analyzer (gm-v0sp.21).
 package cli
 
 import (
@@ -127,9 +128,9 @@ func newSpecInitCmd() *cobra.Command {
 				return err
 			}
 			opts := scaffold.Options{
-				WriteHooks:        asdd,
-				WriteConstitution: asdd,
-				UpdateClaudeMD:    asdd || updateClaudeMD,
+				WriteHooks:         asdd,
+				WriteConstitution:  asdd,
+				UpdateClaudeMD:     asdd || updateClaudeMD,
 				WriteSlashCommands: asdd,
 			}
 			r, err := scaffold.Apply(root, opts)

internal/cli/spec_analyze.go

@@ -164,7 +164,7 @@ func renderProposal(w io.Writer, p *analyzer.Proposal) {
 		fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\n",
 			b.LocalRef, b.Kind, dashIfEmpty(b.Parent), dashIfEmpty(b.Priority), b.Title)
 	}
-	tw.Flush()
+	_ = tw.Flush()
 }
 
 func dashIfEmpty(s string) string {

internal/cli/spec_diff.go

@@ -20,11 +20,11 @@ import (
 // newSpecDiffCmd wires `gemba spec diff <spec.md>`.
 //
 // It is a pure planner — no bd mutations, no disk writes. The CLI:
-//   1. parses spec.md,
-//   2. loads the sibling .spec.lock.json (if any),
-//   3. calls reconcile.Diff with either the real bd lister or a test stub
-//      (--bd-stub <path-to-json>),
-//   4. emits either a human table or JSON.
+//  1. parses spec.md,
+//  2. loads the sibling .spec.lock.json (if any),
+//  3. calls reconcile.Diff with either the real bd lister or a test stub
+//     (--bd-stub <path-to-json>),
+//  4. emits either a human table or JSON.
 func newSpecDiffCmd() *cobra.Command {
 	var jsonOut bool
 	var label string
@@ -146,7 +146,7 @@ func renderPlanTable(cmd *cobra.Command, plan *reconcile.Plan) error {
 	emit(plan.Creates)
 	emit(plan.Updates)
 	emit(plan.Orphans)
-	tw.Flush()
+	_ = tw.Flush()
 	fmt.Fprintf(out, "summary: %d create, %d update, %d orphan\n",
 		len(plan.Creates), len(plan.Updates), len(plan.Orphans))
 	return nil

internal/cli/spec_lint.go

@@ -59,7 +59,7 @@ func newSpecLintCmd() *cobra.Command {
 						}
 						fmt.Fprintf(tw, "%s\t%s\t%s\t%s\n", sev, f.Rule, f.Anchor, f.Message)
 					}
-					tw.Flush()
+					_ = tw.Flush()
 				}
 			}
 			if strict {

internal/cli/spec_promote.go

@@ -115,7 +115,7 @@ func newSpecPromoteCmd() *cobra.Command {
 				return nil
 			}
 
-			fmt.Fprint(cmd.OutOrStdout(), diff)
+			_, _ = fmt.Fprint(cmd.OutOrStdout(), diff)
 			return nil
 		},
 	}

internal/cli/status.go

@@ -211,7 +211,9 @@ func fetchStatus(ctx context.Context, c *gembaclient.Client, srv string) (status
 	if err != nil {
 		// Some adaptors won't recognize "open" as a status; that's
 		// fine — fall back to ready+in_progress as the floor.
-		openItems = append(ready, inflight...)
+		openItems = make([]core.WorkItem, 0, len(ready)+len(inflight))
+		openItems = append(openItems, ready...)
+		openItems = append(openItems, inflight...)
 	}
 	closedToday := 0
 	if closed, err := c.ListWorkItemsByStatus(ctx, "closed"); err == nil {
@@ -352,7 +354,7 @@ func renderAdHoc(w io.Writer, p statusPayload) {
 			fmt.Fprintf(tw, "  ○\t%s\t%s\t%s\n",
 				string(wi.ID), priorityBadge(wi.Priority), wi.Title)
 		}
-		tw.Flush()
+		_ = tw.Flush()
 	}
 	fmt.Fprintln(w)
 
@@ -382,7 +384,7 @@ func renderAdHoc(w io.Writer, p statusPayload) {
 			fmt.Fprintf(tw, "  ◐\t%s\t%s\t%s%s\n",
 				string(wi.ID), priorityBadge(wi.Priority), wi.Title, suffix)
 		}
-		tw.Flush()
+		_ = tw.Flush()
 	}
 	fmt.Fprintln(w)
 
@@ -438,4 +440,3 @@ func humanDuration(d time.Duration) string {
 		return fmt.Sprintf("%dd", int(d.Hours()/24))
 	}
 }
-

internal/client/client_test.go

@@ -283,4 +283,3 @@ func indexOf(s, sub string) int {
 	}
 	return -1
 }
-

internal/client/status.go

@@ -90,6 +90,7 @@ func (c *Client) WorkspaceStatus(ctx context.Context, wsid string) (*WorkspaceSt
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return nil, mapErr(resp, raw)
 	}