Handle WSS shutdown and UDP buffer sizing - #108

Keep test execution reproducible without mutating the user's persistent Go environment, and expose race and formatting verification as explicit Make targets.

Constraint: Preserve the existing default goal, shell flags, formatting command, lint versions, and coverage-only clean scope.

Confidence: High; the old targets failed for the expected reasons, dry-run expansion matches the requested commands, and both WSL test targets pass with an isolated GOENV.

Scope-risk: Limited to local and CI Makefile entry points.

Tested: make dry runs; WSL Go 1.25.1 make test; WSL Go 1.25.1 make test-race; isolated GOENV absence check; git diff --check.

Not-tested: The write-capable make check-fmt target was intentionally not executed in the source worktree; only its dry-run expansion was verified.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Replace mutable and redundant action setup with least-privilege, cancellation-aware jobs for license checks, tests and lint, race detection, and cross-platform builds.

Constraint: Keep triggers limited to master, pin every action to a verified full commit SHA, grant OIDC only to the Codecov job, and do not change source or build scripts.

Confidence: High; the old workflow failed the policy probe for nine expected gaps, while the rewritten workflow passes the same policy, exact-SHA Codecov input validation, and actionlint.

Scope-risk: Limited to .github/workflows/github-actions.yml and the CI job topology it defines.

Tested: WSL Go 1.25.1 actionlint v1.7.12; policy red/green checks; Codecov action.yml and README input verification; git diff --check; cached diff check.

Not-tested: The GitHub-hosted jobs were not dispatched because this task does not authorize push.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Move coverage authentication into a dedicated job that only downloads the coverage artifact and invokes the pinned Codecov action, keeping PR-controlled Go and Make execution outside the OIDC boundary.

Constraint: Preserve the test, lint, race, and build commands; grant id-token write only to the coverage job; pin artifact actions and the Codecov CLI; do not change source or planning files.

Confidence: High; the prior workflow fails the targeted security policy, while the isolated workflow passes the OIDC boundary, action pinning, timeout, and actionlint checks.

Scope-risk: Limited to the CI coverage handoff and adds a one-day coverage artifact between jobs.

Tested: targeted security policy red and green checks; official Action and Codecov release metadata; WSL Go 1.25.1 actionlint v1.7.12; git diff and cached diff checks.

Not-tested: GitHub-hosted artifact transfer and Codecov upload will run only after an authorized push.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Remove the unnecessary contents read grant from the isolated coverage upload job so its explicit permissions contain only the OIDC capability required by Codecov.

Constraint: Do not change any job, step, action version, trigger, or command beyond the coverage permissions map.

Confidence: High; the baseline fails the exact-permission policy, while the one-line change passes that policy and actionlint.

Scope-risk: Limited to removing repository contents access from a job that does not checkout or call the GitHub contents API.

Tested: minimum-permission policy red and green checks; WSL Go 1.25.1 actionlint v1.7.12; git diff and cached diff checks.

Not-tested: GitHub-hosted execution remains assigned to the later workflow-run validation task.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Add branch and scheduled Go CodeQL analysis using the verified v3 action commit, minimal permissions, and the current official autobuild mode.

Constraint: Limit the commit to .github/workflows/codeql.yml and do not push.

Confidence: High; the policy checks and actionlint v1.7.12 pass in WSL.

Scope-risk: Low; this adds one isolated CI workflow.

Tested: WSL go1.25.1 actionlint v1.7.12 .github/workflows/*.yml; CodeQL policy checks; git diff --check.

Not-tested: GitHub-hosted CodeQL execution has not run because this commit is not pushed.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Configure weekly Go module updates and monthly GitHub Actions updates with bounded pull request limits and scoped commit prefixes.

Constraint: Limit the commit to .github/dependabot.yml and do not enable auto-merge, approvals, registries, ignore rules, groups, or additional ecosystems.

Confidence: High; strict YAML parsing and exact policy assertions pass under fixed WSL Go 1.25.0.

Scope-risk: Low; this adds only Dependabot scheduling metadata targeting master.

Tested: WSL Go 1.25.0 yaml.UnmarshalStrict validator; forbidden-key and exact-ecosystem policy; git diff --check.

Not-tested: GitHub-hosted Dependabot scheduling will begin only after an authorized push.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Replace the obsolete Travis badges with the repository GitHub Actions CI badge and remove the superseded Travis configuration now that formatting, tests, coverage, and race checks are provided by the maintained workflow.

Constraint: Limit the commit to README.md, README_CN.md, and .travis.yml; do not change other badges or CI behavior.

Confidence: High; the red/green policy, current-tree credential-shape scan, staged-scope gate, and diff checks pass.

Scope-risk: Low; this removes the current-tree legacy configuration only. Git history retains prior content, so historical credentials still require external rotation or revocation.

Tested: exact badge policy red and green checks; final workflow and Makefile command coverage; current-tree credential-shape filename and content scan; git diff --check; cached scope and diff checks.

Not-tested: GitHub-hosted badge rendering and workflow execution require an authorized push; external credential rotation is outside this commit.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Align the approved CI design and reproducible implementation plan with the formally reviewed five-job workflow, isolated coverage artifact handoff, current CodeQL shape, and final validation policy.

Constraint: Limit the commit to the two CI design and plan documents; do not modify workflows, Makefile, Dependabot, README files, Go source, branch protection, or the independent UDP P1.

Confidence: High; workflow snippets exactly match the final files, policy counts and OIDC assertions match the reviewed implementation, and document consistency checks pass.

Scope-risk: Low; this changes documentation only and preserves the approved goals, non-goals, and no-push boundary.

Tested: git diff --check; balanced Markdown fences; placeholder and stale-conflict scans; sensitive-value pattern scan; exact main CI and CodeQL snippet comparison; WSL actionlint v1.7.12 on all current workflows.

Not-tested: GitHub-hosted artifact transfer, Codecov upload, CodeQL execution, and branch-protection checks require a later authorized push and remote run.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Replace fragile PowerShell-to-WSL inline validation commands with auditable UTF-8 Base64 transport, preserve per-command raw evidence and exit propagation, and correct the Dependabot verification boundary.

Constraint: Limit the commit to the CI design and implementation plan; do not modify workflows, Makefile, Dependabot, README files, Go source, remote state, or the independent UDP P1.

Confidence: High; the harmless Base64 transport probe preserved Bash variables and exit 7, and all specified documentation consistency scans pass.

Scope-risk: Low; this changes documentation and future verification instructions only.

Tested: PowerShell-to-WSL UTF-8 Base64 harmless probe; git diff --check; Markdown fence balance; placeholder, forbidden evidence-write action, Dependabot boundary, and sensitive-value scans; cached scope and diff checks.

Not-tested: The full Go, race, lint, cross-build, GitHub Actions, Codecov, and CodeQL validation sequence remains a later execution step; Dependabot platform acceptance requires merge to the default branch.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Convert the remaining complex PowerShell-to-WSL workflow and policy examples to UTF-8 Base64 payload transport so Bash variables, arrays, command substitutions, heredocs, and exit codes reach /bin/bash intact.

Constraint: Limit the commit to the CI implementation plan; do not modify the design, workflows, Makefile, Dependabot, README files, Go source, evidence, or remote state.

Confidence: High; Windows PowerShell probes exercised command substitution, workflow-array actionlint enumeration, heredoc policy validation, and expected nonzero mutation exit capture through the documented transport.

Scope-risk: Low; this changes future verification commands only and preserves the approved CI behavior and no-push boundary.

Tested: four PowerShell UTF-8 Base64 to WSL probes; actionlint v1.7.12 over two enumerated workflows; pinned-action policy with 14 uses; mutation exit 9 capture; git diff --check; fence, placeholder, inline bash-lc, evidence-write, sensitive-value, and single-file scope scans.

Not-tested: The full Go, race, lint, cross-build, GitHub Actions, Codecov, CodeQL, and post-merge Dependabot sequence remains a later execution step.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Pin every direct setup-go use to the official v7.0.0 commit and align the approved CI design and implementation plan with that exact ref.

Retain the verified post-v0.8.0 SkyWalking Eyes commit because moving to the older release would undo action pinning and shell-input hardening.

Constraint: Limit this commit to the main workflow and the two CI design documents; do not push.

Confidence: High; actionlint and the workflow, documentation, scope, and diff policy gates pass.

Scope-risk: Low; setup-go v7 preserves the existing action interface and Node 24 runtime requirement.

Tested: actionlint v1.7.12 over all workflows; 6-job and 14-use policy; setup-go exact-SHA gate; Markdown fence, placeholder, secret, scope, and git diff checks.

Not-tested: GitHub-hosted workflow execution was not run because this commit is not pushed.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Run gofmt and imports-formatter only inside a tracked-file temporary mirror, then compare clean-filter-normalized Git object hashes so the format gate never rewrites the checked-out source.

Keep CRLF working trees compatible with core.autocrlf=true while still detecting independent gofmt and Getty import-order violations.

Constraint: Limit this commit to Makefile and the two CI design documents; do not modify workflows, Go source, other tracked files, or remote state.

Confidence: High; clean LF and CRLF probes pass without byte changes, both formatting mutations fail without source writes, and formatter failure propagates with temporary-directory cleanup.

Scope-risk: Low; the explicit make fmt target and imports-formatter v1.0.10 behavior remain unchanged, while check-fmt moves their writes to an isolated temporary mirror.

Tested: make check-fmt; CRLF clean-filter probe; gofmt-only mutation; import-order-only mutation; formatter failure/trap probe; actionlint v1.7.12; workflow and Makefile policy; go mod verify; Markdown fence, placeholder, secret, scope, and git diff checks.

Not-tested: GitHub-hosted workflow execution is not run because this commit is not pushed.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Write both NUL-delimited tracked-file manifests with ordinary commands before copy or formatter work so the recipe shell observes enumeration failures directly instead of accepting the consuming loop status.

Keep the manifests inside the disposable metadata directory so they are neither copied nor compared, and document the injected producer-failure gates alongside the existing read-only formatting probes.

Constraint: Limit this commit to Makefile and the two CI design documents; do not modify workflows, Go source, other tracked files, or remote state.

Confidence: High; both enumeration failures now propagate before formatter execution, and all clean, mutation, failure, policy, module, and scope gates pass without source or temporary-directory changes.

Scope-risk: Low; successful formatting behavior and the explicit write-capable fmt target remain unchanged while check-fmt now fails earlier on incomplete file discovery.

Tested: make check-fmt; enumeration exit 38 and 37 red-green probes; clean LF and CRLF probes; gofmt-only, import-only, and formatter-exit-23 probes; actionlint v1.7.12; workflow and Makefile policy; go mod verify; Markdown fence, placeholder, secret, scope, and git diff checks.

Not-tested: GitHub-hosted workflow execution was not run because this commit is not pushed.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Replace the WSS readiness poll with a verified TLS handshake, then exercise shutdown only after the secure listener has served a real client. Extend UDP limit coverage and drive handleUDPPackage through loopback sockets so the configured read size is observable at the Reader boundary.

Constraint: Test-only follow-up; production code and public behavior are unchanged.

Confidence: High; the boundary table fails for the expected current implementation while the real UDP path and WSS handshake tests pass independently.

Scope-risk: Low; changes are limited to two transport test files and use bounded cleanup.

Tested: WSL Go 1.25.1 targeted UDP red test, standalone UDP production-path test, standalone WSS test, gofmt, and git diff --check.

Not-tested: Full suite, because the new UDP boundary assertions are intentionally red until the production follow-up lands.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

Normalize non-positive and oversized SetMaxMsgLen inputs before storing the int32 session limit, then calculate UDP read capacity in int64 and cap it at the maximum useful datagram buffer size.

This keeps the existing no-limit meaning for non-positive values while preventing zero-length reads, negative allocations, int32 arithmetic wraparound, and oversized per-session buffers.

Constraint: Preserve the Session API and existing positive-limit sizing below 64 KiB; limit production changes to transport/session.go.

Confidence: High; the boundary and setter tests fail on the previous implementation, pass after the change, and the real UDP receive-path test kills the restored pre-PR allocation branch.

Scope-risk: Limited to UDP receive allocation and normalization of previously invalid SetMaxMsgLen values; TCP, WS, WSS, and handler control flow are unchanged.

Tested: WSL Go 1.25.1 targeted green tests; targeted race test; GOARCH=386 targeted tests; WSS panic mutation; UDP old-allocation mutation; gofmt; git diff and cached diff checks.

Not-tested: Full transport race, go vet, full repository tests, and GitHub CI are pending the final verification task.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>