Phase 0: Guardrails & baseline (Taskfile, golangci-lint v2, coverage plumbing)

[grubmeshi]

Phase 0 of the single-Go-binary refactor (PLAN_DETAIL_00_guardrails.md). Behavior-neutral: no production code path changes, no frozen contract touched (D9/D10). Squash-merges to one commit.

What lands

• Taskfile (D14): root Taskfile.yml replaces the Makefile 1:1 except vet (now inside task lint via govet). Adds task coverage. flake.nix gains pkgs.go-task. READMEs updated (make → task).
• golangci-lint v2: one root .golangci.yml (provider-parity linter set incl. govet, gci localmodule ordering, per-module strict depguard) serving all three modules.
• Coverage plumbing (D6, not yet gating): tools/coverage/check.sh + thresholds.txt + exclusions.txt (both ship empty). Phase 1 flips the gate on by adding one threshold line — no further CI change.
• CI (additive, §5.5): go-runners-ci writes coverage.out, runs check.sh (report-only), uploads coverage-<app> artifacts.

Lint-adoption rule (§5.3)

• Category 1 (fixed): provably inert only — gci ordering, godot comment periods, misspell (comments), unconvert, staticcheck QF-series (tagged-switch, embedded-selector). Diff audit: no executed production logic changed.
• Category 2 (pinned, not fixed): errcheck/forcetypeassert/nilerr/makezero/ineffassign/unparam in production files silenced via commented exclusions.rules blocks (tfrun → phase 2/2b; run-controller+go-meshapi-client → phase 3). Verified load-bearing (errcheck reports the sites without the config; full config → 0 issues). The swallowed workspace-select error (tfcmd.go:232-234) stays intact for phase-1 pinning (D13).

Sanctioned deltas (flagged)

• go-meshapi-client CI matrix leg added — the one sanctioned exception to D14 "CI functionally untouched until phase 7" (§5.5/§11): a shared module the refactor leans on should not go unguarded. Coverage upload uses SHA-pinned actions/upload-artifact.
• Makefile deleted, tasks renamed to colon-namespaced (start:run-controller, etc.) — acceptable per §5.1 (nothing outside README referenced the old names; cross-repo grep clean).

Gates (all green)

• task lint → 0 issues in all three modules.
• task test → all pass.
• task coverage reproduces the §3 baseline: go-meshapi-client 53.3%, run-controller 22.6%, tf-block-runner 56.6% (tfrun 59.4%). Gate mechanism proven (temp threshold above baseline → check.sh fails, then reverted).

Baseline (§3)

Module	Coverage
go-meshapi-client	53.3% (crypto 71.4%, meshapi 39.3%)
run-controller	22.6% (controller 24.2%)
tf-block-runner	56.6% (tfrun 59.4%)

local-dev-stack safety net (§6 step 9)

Verified against this branch (PHASE0_LOCAL_DEV_STACK_VERIFICATION.md): compose stack (mariadb/ravendb/keycloak/mux) + meshfed services + manual (gradle) & tf (go run .) runners up; readiness markers and claim/poll observed. One honest gap: a fully HTTP-triggered live run to a terminal status was not produced (needs a keycloak dev credential absent from reachable docs); the claim/poll contract + acceptance-testing skill were used as substitute evidence.

Notes for reviewer

• Dependency files (go.mod/go.sum/go.work.sum) were reverted to main: a sibling's task tidy/work-sync had bumped indirect deps (e.g. run-controller golang.org/x/net 0.39→0.56). Out of scope for a behavior-neutral phase (§2); reverting keeps the phase minimal and matches main. Build/lint/tests all green afterward.
• The three research .md docs are committed to the code branch (rather than only the plan branch / PR description as §2/§8 preferred) to preserve completed work and serve plan-01's A4/A7 verification steps; documentation-only, no contract impact.

🤖 Generated with Claude Code

[grubmeshi]

Superseded by #65, which consolidates the plan + all phases 0→7 + the phase-3/5 remediation into a single reviewable PR (with all plan/run artifacts and a code-verified FOLLOW_UP.md). Closing in favor of #65.