[Mimic890]

Stage 1 from CLAUDE.md: skeleton.

What

• Config from env for every variable in SPEC → Configuration. All errors are reported at once. Messages name variables, never values. Secrets must be ≥ 32 bytes; S3_ENDPOINT must be HTTPS. A bad config logs ERROR and exits 1.
• log/slog with LOG_LEVEL / LOG_FORMAT. Each record has a component field.
• HTTP server with the SPEC timeouts and a 16 KB header limit. Middleware: security headers, panic recovery (500 + ERROR), DEBUG request log with request_id. Shuts down cleanly on SIGTERM.
• GET /healthz (200 ok / 503 not ready), plus a healthcheck subcommand for Compose.
• Dockerfile: golang:1.27.3 builder, static -trimpath binary, distroless static (Debian 13) nonroot runtime, user 10001. Base images are pinned by digest. Image size is about 17 MB.
• docker-compose.yml follows SPEC → Container. Also adds .env.example, .gitignore and .dockerignore.
• CI: gofmt, vet, staticcheck, govulncheck, go test -race, docker build. Also CodeQL, a tag-triggered release (GHCR + actions/attest, semver tags only) and Dependabot. All actions are pinned to commit SHAs.
• Adds SPEC.md, SPEC.ru.md and CLAUDE.md, which were not committed before.
• SECURITY.md + SECURITY.ru.md: report vulnerabilities through GitHub private vulnerability reporting.

Decisions (recorded in both SPEC files and the decision log)

• Defaults the SPEC did not set: POLL_INTERVAL 60s (min 10s), READING_WPM 200, LOG_LEVEL info, LOG_FORMAT json, DATA_DIR /data, VAULT_DIR /vault, ALTCHA_MAX_NUMBER 100000, S3_REGION garage.
• New log component main for startup, config and shutdown.
• Fixed listen port 8080, with no env variable.

Notes

• /healthz reports ready right after startup for now. Stage 2 will gate it on the first sync.
• The release job sets create-storage-record: false because storage records need an org-owned repo.
• The host ./data and ./vault folders must be writable by uid 10001. README (stage 6) will cover this.

Checked

go vet, staticcheck, govulncheck, go test -race, a 15 s fuzz of ParseRate, actionlint. Docker smoke test: healthz 200, POST 405, healthcheck exits 0, SIGTERM exits 0, bad config exits 1.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.