dAppCore · Snider · Apr 30, 2026 · Apr 30, 2026 · Apr 30, 2026 · Apr 30, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  push:
+    branches: [dev, main]
+  pull_request:
+    branches: [dev, main]
+
+permissions:
+  contents: read
+
+env:
+  GOFLAGS: -buildvcs=false
+  GOWORK: "off"
+  GOPROXY: "direct"
+  GOSUMDB: "off"
+
+jobs:
+  test:
+    name: Test + Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test with coverage
+        working-directory: go
+        run: go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: go/coverage.out
+          flags: unittests
+          fail_ci_if_error: false
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          working-directory: go
+          args: --timeout=5m --tests=false
+
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test for coverage
+        working-directory: go
+        run: go test -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@v6
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=dappcore
+            -Dsonar.projectKey=dappcore_app
+            -Dsonar.sources=go
+            -Dsonar.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/*_test.go
+            -Dsonar.tests=go
+            -Dsonar.test.inclusions=**/*_test.go
+            -Dsonar.go.coverage.reportPaths=go/coverage.out
diff --git a/.gitmodules b/.gitmodules
@@ -0,0 +1,16 @@
+[submodule "external/go"]
+	path = external/go
+	url = https://github.com/dappcore/go.git
+	branch = dev
+[submodule "external/config"]
+	path = external/config
+	url = https://github.com/dappcore/config.git
+	branch = dev
+[submodule "external/io"]
+	path = external/io
+	url = https://github.com/dappcore/go-io.git
+	branch = dev
+[submodule "external/log"]
+	path = external/log
+	url = https://github.com/dappcore/go-log.git
+	branch = dev
diff --git a/.woodpecker.yml b/.woodpecker.yml
@@ -14,7 +14,7 @@ steps:
       GOFLAGS: -buildvcs=false
       GOWORK: "off"
     commands:
-      - golangci-lint run --timeout=5m ./...
+      - cd go && golangci-lint run --timeout=5m ./...
 
   - name: go-test
     image: golang:1.26-alpine
@@ -25,7 +25,7 @@ steps:
       CGO_ENABLED: "1"
     commands:
       - apk add --no-cache git build-base
-      - go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - cd go && go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
   - name: sonar
     image: sonarsource/sonar-scanner-cli:latest
     depends_on: [go-test]

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -16,6 +16,40 @@ Reference: `docs/RFC.md` — **keystone spec**. Every other Core RFC exists to m
 6. **Config** — apply template + vars via core/config
 7. **Start** — hand the composed window to core/gui + unblock entry action
 
+## Repo Layout
+
+Go module now lives under `go/` and the repo root is cross-language / metadata only:
+
+```
+core/app/
+├── go/                                  ← Go module root (dappco.re/go/app)
+│   ├── *.go
+│   ├── go.mod, go.sum
+│   ├── cmd/
+│   ├── tests/
+│   ├── README.md                        → ../README.md
+│   ├── CLAUDE.md                        → ../CLAUDE.md
+│   ├── AGENTS.md                        → ../AGENTS.md
+│   └── docs                             → ../docs
+├── docs/                                ← cross-language docs source
+├── README.md                            ← repo index / overview
+├── CLAUDE.md                            ← this repo guidance
+├── AGENTS.md                            ← repo-level instructions
+├── LICENSE/LICENCE
+├── .woodpecker.yml
+├── sonar-project.properties
+└── .gitignore
+```
+
+## Go Resolution Modes
+
+This repo is intentionally single-module from `go/` with no `go.work` in use:
+
+| Mode | When | What runs |
+|------|------|-----------|
+| **Module mode (default)** | Local work from `go/` | `go test`, `go vet`, `go test ./...`, and CLI builds use `go.mod` directly. |
+| **Repro/CI mode** | Verification scripts | Use explicit override: `GOWORK=off GOPROXY=direct GOSUMDB=off GOFLAGS=-mod=mod` for stable behavior and strict cache isolation. |
+
 ## Dependency boundary
 
 CoreApp is the orchestrator. It does NOT own:

diff --git a/README.md b/README.md
@@ -1,5 +1,21 @@
+<!-- SPDX-License-Identifier: EUPL-1.2 -->
+
 # core/app
 
+> Lethean app installer + workspace manager — pkg discovery, manifest, integrity, runtime
+
+[![CI](https://github.com/dappcore/app/actions/workflows/ci.yml/badge.svg?branch=dev)](https://github.com/dappcore/app/actions/workflows/ci.yml)
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=alert_status)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Coverage](https://codecov.io/gh/dappcore/app/branch/dev/graph/badge.svg)](https://codecov.io/gh/dappcore/app)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=security_rating)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=reliability_rating)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=code_smells)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=dappcore_app&metric=ncloc)](https://sonarcloud.io/dashboard?id=dappcore_app)
+[![Go Reference](https://pkg.go.dev/badge/dappco.re/go/app.svg)](https://pkg.go.dev/dappco.re/go/app)
+[![License: EUPL-1.2](https://img.shields.io/badge/License-EUPL--1.2-blue.svg)](https://eupl.eu/1.2/en/)
+
+
 The CoreApp keystone runtime — reads a `.core/view.yaml` manifest, runs the 7-step boot, enforces permissions, composes layout, starts the app.
 
 > "The keystone spec. Every other RFC exists to make this work."

diff --git a/external/config b/external/config
diff --git a/external/go b/external/go
diff --git a/external/io b/external/io
diff --git a/external/log b/external/log
diff --git a/go.work b/go.work
@@ -0,0 +1,12 @@
+go 1.26.2
+
+// Workspace mode for development: pulls fresh code from external/ submodules.
+// CI uses GOWORK=off to fall back to go/go.mod tags (reproducible).
+
+use (
+	./go
+	./external/go
+	./external/config
+	./external/io
+	./external/log
+)
diff --git a/go/CLAUDE.md b/go/CLAUDE.md
@@ -0,0 +1 @@
+../CLAUDE.md
diff --git a/go/README.md b/go/README.md
@@ -0,0 +1 @@
+../README.md
diff --git a/access.go → go/access.go b/access.go → go/access.go
diff --git a/access_test.go → go/access_test.go b/access_test.go → go/access_test.go
diff --git a/app.go → go/app.go b/app.go → go/app.go
diff --git a/app_test.go → go/app_test.go b/app_test.go → go/app_test.go
diff --git a/cmd/core-app/main.go → go/cmd/core-app/main.go b/cmd/core-app/main.go → go/cmd/core-app/main.go
diff --git a/cmd/core-app/main_test.go → go/cmd/core-app/main_test.go b/cmd/core-app/main_test.go → go/cmd/core-app/main_test.go
diff --git a/cmd/core-app/pkg.go → go/cmd/core-app/pkg.go b/cmd/core-app/pkg.go → go/cmd/core-app/pkg.go
diff --git a/cmd/core-app/pkg_marketplace_test.go → go/cmd/core-app/pkg_marketplace_test.go b/cmd/core-app/pkg_marketplace_test.go → go/cmd/core-app/pkg_marketplace_test.go
diff --git a/cmd/core-app/pkg_test.go → go/cmd/core-app/pkg_test.go b/cmd/core-app/pkg_test.go → go/cmd/core-app/pkg_test.go
diff --git a/cmd/core-app/sdk.go → go/cmd/core-app/sdk.go b/cmd/core-app/sdk.go → go/cmd/core-app/sdk.go
diff --git a/cmd/core-app/sdk_test.go → go/cmd/core-app/sdk_test.go b/cmd/core-app/sdk_test.go → go/cmd/core-app/sdk_test.go
diff --git a/compile.go → go/compile.go b/compile.go → go/compile.go
diff --git a/compile_json.go → go/compile_json.go b/compile_json.go → go/compile_json.go
diff --git a/compile_json_test.go → go/compile_json_test.go b/compile_json_test.go → go/compile_json_test.go
diff --git a/compile_test.go → go/compile_test.go b/compile_test.go → go/compile_test.go
diff --git a/conclave.go → go/conclave.go b/conclave.go → go/conclave.go
diff --git a/conclave_test.go → go/conclave_test.go b/conclave_test.go → go/conclave_test.go
diff --git a/config.go → go/config.go b/config.go → go/config.go
diff --git a/config_template.go → go/config_template.go b/config_template.go → go/config_template.go
diff --git a/config_template_example_test.go → go/config_template_example_test.go b/config_template_example_test.go → go/config_template_example_test.go
diff --git a/config_template_test.go → go/config_template_test.go b/config_template_test.go → go/config_template_test.go
diff --git a/config_test.go → go/config_test.go b/config_test.go → go/config_test.go
diff --git a/discover.go → go/discover.go b/discover.go → go/discover.go
diff --git a/discover_test.go → go/discover_test.go b/discover_test.go → go/discover_test.go
diff --git a/go/docs b/go/docs
@@ -0,0 +1 @@
+../docs
diff --git a/export_test.go → go/export_test.go b/export_test.go → go/export_test.go
diff --git a/go.mod → go/go.mod b/go.mod → go/go.mod
diff --git a/go.sum → go/go.sum b/go.sum → go/go.sum
diff --git a/host.go → go/host.go b/host.go → go/host.go
diff --git a/host_test.go → go/host_test.go b/host_test.go → go/host_test.go
diff --git a/integration_test.go → go/integration_test.go b/integration_test.go → go/integration_test.go
diff --git a/integrity.go → go/integrity.go b/integrity.go → go/integrity.go
diff --git a/layout.go → go/layout.go b/layout.go → go/layout.go
diff --git a/layout_test.go → go/layout_test.go b/layout_test.go → go/layout_test.go
diff --git a/marketplace.go → go/marketplace.go b/marketplace.go → go/marketplace.go
diff --git a/marketplace_install_test.go → go/marketplace_install_test.go b/marketplace_install_test.go → go/marketplace_install_test.go
diff --git a/marketplace_test.go → go/marketplace_test.go b/marketplace_test.go → go/marketplace_test.go
diff --git a/marketplace_update_test.go → go/marketplace_update_test.go b/marketplace_update_test.go → go/marketplace_update_test.go
diff --git a/marketplace_verify.go → go/marketplace_verify.go b/marketplace_verify.go → go/marketplace_verify.go
diff --git a/marketplace_verify_test.go → go/marketplace_verify_test.go b/marketplace_verify_test.go → go/marketplace_verify_test.go
diff --git a/modules.go → go/modules.go b/modules.go → go/modules.go
diff --git a/modules_test.go → go/modules_test.go b/modules_test.go → go/modules_test.go
diff --git a/permissions.go → go/permissions.go b/permissions.go → go/permissions.go
diff --git a/permissions_test.go → go/permissions_test.go b/permissions_test.go → go/permissions_test.go
diff --git a/pkg.go → go/pkg.go b/pkg.go → go/pkg.go
diff --git a/pkg_electron.go → go/pkg_electron.go b/pkg_electron.go → go/pkg_electron.go
diff --git a/pkg_electron_extract.go → go/pkg_electron_extract.go b/pkg_electron_extract.go → go/pkg_electron_extract.go
diff --git a/pkg_electron_extract_tar.go → go/pkg_electron_extract_tar.go b/pkg_electron_extract_tar.go → go/pkg_electron_extract_tar.go
diff --git a/pkg_electron_extract_tar_test.go → go/pkg_electron_extract_tar_test.go b/pkg_electron_extract_tar_test.go → go/pkg_electron_extract_tar_test.go
diff --git a/pkg_electron_extract_test.go → go/pkg_electron_extract_test.go b/pkg_electron_extract_test.go → go/pkg_electron_extract_test.go
diff --git a/pkg_electron_fetch.go → go/pkg_electron_fetch.go b/pkg_electron_fetch.go → go/pkg_electron_fetch.go
diff --git a/pkg_electron_fetch_test.go → go/pkg_electron_fetch_test.go b/pkg_electron_fetch_test.go → go/pkg_electron_fetch_test.go
diff --git a/pkg_electron_test.go → go/pkg_electron_test.go b/pkg_electron_test.go → go/pkg_electron_test.go
diff --git a/pkg_local_test.go → go/pkg_local_test.go b/pkg_local_test.go → go/pkg_local_test.go
diff --git a/pkg_pwa.go → go/pkg_pwa.go b/pkg_pwa.go → go/pkg_pwa.go
diff --git a/pkg_pwa_test.go → go/pkg_pwa_test.go b/pkg_pwa_test.go → go/pkg_pwa_test.go
diff --git a/pkg_repo.go → go/pkg_repo.go b/pkg_repo.go → go/pkg_repo.go
diff --git a/pkg_repo_test.go → go/pkg_repo_test.go b/pkg_repo_test.go → go/pkg_repo_test.go
diff --git a/pkg_test.go → go/pkg_test.go b/pkg_test.go → go/pkg_test.go
diff --git a/pkg_type.go → go/pkg_type.go b/pkg_type.go → go/pkg_type.go
diff --git a/pkg_type_test.go → go/pkg_type_test.go b/pkg_type_test.go → go/pkg_type_test.go
diff --git a/pkg_update_test.go → go/pkg_update_test.go b/pkg_update_test.go → go/pkg_update_test.go
diff --git a/pkg_web.go → go/pkg_web.go b/pkg_web.go → go/pkg_web.go
diff --git a/pkg_web_test.go → go/pkg_web_test.go b/pkg_web_test.go → go/pkg_web_test.go
diff --git a/pkg_wrap_example_test.go → go/pkg_wrap_example_test.go b/pkg_wrap_example_test.go → go/pkg_wrap_example_test.go
diff --git a/pkg_wrap_test.go → go/pkg_wrap_test.go b/pkg_wrap_test.go → go/pkg_wrap_test.go
diff --git a/plugin.go → go/plugin.go b/plugin.go → go/plugin.go
diff --git a/plugin_test.go → go/plugin_test.go b/plugin_test.go → go/plugin_test.go
diff --git a/pwa_runtime.go → go/pwa_runtime.go b/pwa_runtime.go → go/pwa_runtime.go
diff --git a/registry.go → go/registry.go b/registry.go → go/registry.go
diff --git a/registry_test.go → go/registry_test.go b/registry_test.go → go/registry_test.go
diff --git a/runtime.go → go/runtime.go b/runtime.go → go/runtime.go
diff --git a/runtime_process.go → go/runtime_process.go b/runtime_process.go → go/runtime_process.go
diff --git a/runtime_store.go → go/runtime_store.go b/runtime_store.go → go/runtime_store.go
diff --git a/runtime_store_internal_test.go → go/runtime_store_internal_test.go b/runtime_store_internal_test.go → go/runtime_store_internal_test.go
diff --git a/runtime_store_sigil_test.go → go/runtime_store_sigil_test.go b/runtime_store_sigil_test.go → go/runtime_store_sigil_test.go
diff --git a/runtime_store_test.go → go/runtime_store_test.go b/runtime_store_test.go → go/runtime_store_test.go
diff --git a/runtime_test.go → go/runtime_test.go b/runtime_test.go → go/runtime_test.go
diff --git a/sdk.go → go/sdk.go b/sdk.go → go/sdk.go
diff --git a/sdk_test.go → go/sdk_test.go b/sdk_test.go → go/sdk_test.go
diff --git a/sign.go → go/sign.go b/sign.go → go/sign.go
diff --git a/sign_test.go → go/sign_test.go b/sign_test.go → go/sign_test.go
diff --git a/start.go → go/start.go b/start.go → go/start.go
diff --git a/start_test.go → go/start_test.go b/start_test.go → go/start_test.go
diff --git a/store_test.go → go/store_test.go b/store_test.go → go/store_test.go
diff --git a/tests/cli/Taskfile.yaml → go/tests/cli/Taskfile.yaml b/tests/cli/Taskfile.yaml → go/tests/cli/Taskfile.yaml
diff --git a/tests/cli/app/Taskfile.yaml → go/tests/cli/app/Taskfile.yaml b/tests/cli/app/Taskfile.yaml → go/tests/cli/app/Taskfile.yaml
diff --git a/tests/cli/boot/Taskfile.yaml → go/tests/cli/boot/Taskfile.yaml b/tests/cli/boot/Taskfile.yaml → go/tests/cli/boot/Taskfile.yaml
diff --git a/...cli/boot/fixtures/project/.core/view.yaml → ...cli/boot/fixtures/project/.core/view.yaml b/...cli/boot/fixtures/project/.core/view.yaml → ...cli/boot/fixtures/project/.core/view.yaml
diff --git a/tests/cli/compile/Taskfile.yaml → go/tests/cli/compile/Taskfile.yaml b/tests/cli/compile/Taskfile.yaml → go/tests/cli/compile/Taskfile.yaml
diff --git a/.../compile/fixtures/project/.core/view.yaml → .../compile/fixtures/project/.core/view.yaml b/.../compile/fixtures/project/.core/view.yaml → .../compile/fixtures/project/.core/view.yaml
diff --git a/tests/cli/marketplace/Taskfile.yaml → go/tests/cli/marketplace/Taskfile.yaml b/tests/cli/marketplace/Taskfile.yaml → go/tests/cli/marketplace/Taskfile.yaml
diff --git a/...ixtures/home/.core/marketplace/index.json → ...ixtures/home/.core/marketplace/index.json b/...ixtures/home/.core/marketplace/index.json → ...ixtures/home/.core/marketplace/index.json
diff --git a/...s/home/.core/marketplace/tools/index.json → ...s/home/.core/marketplace/tools/index.json b/...s/home/.core/marketplace/tools/index.json → ...s/home/.core/marketplace/tools/index.json
diff --git a/tests/cli/pkg/Taskfile.yaml → go/tests/cli/pkg/Taskfile.yaml b/tests/cli/pkg/Taskfile.yaml → go/tests/cli/pkg/Taskfile.yaml
diff --git a/.../home/.core/apps/ax10-pkg/.core/view.yaml → .../home/.core/apps/ax10-pkg/.core/view.yaml b/.../home/.core/apps/ax10-pkg/.core/view.yaml → .../home/.core/apps/ax10-pkg/.core/view.yaml
diff --git a/tests/cli/sdk/Taskfile.yaml → go/tests/cli/sdk/Taskfile.yaml b/tests/cli/sdk/Taskfile.yaml → go/tests/cli/sdk/Taskfile.yaml
diff --git a/.../cli/sdk/fixtures/project/.core/view.yaml → .../cli/sdk/fixtures/project/.core/view.yaml b/.../cli/sdk/fixtures/project/.core/view.yaml → .../cli/sdk/fixtures/project/.core/view.yaml
diff --git a/tests/cli/sign/Taskfile.yaml → go/tests/cli/sign/Taskfile.yaml b/tests/cli/sign/Taskfile.yaml → go/tests/cli/sign/Taskfile.yaml
diff --git a/...cli/sign/fixtures/project/.core/view.yaml → ...cli/sign/fixtures/project/.core/view.yaml b/...cli/sign/fixtures/project/.core/view.yaml → ...cli/sign/fixtures/project/.core/view.yaml
diff --git a/validate.go → go/validate.go b/validate.go → go/validate.go
diff --git a/validate_test.go → go/validate_test.go b/validate_test.go → go/validate_test.go
diff --git a/verify.go → go/verify.go b/verify.go → go/verify.go
diff --git a/verify_test.go → go/verify_test.go b/verify_test.go → go/verify_test.go
diff --git a/watch.go → go/watch.go b/watch.go → go/watch.go
diff --git a/watch_test.go → go/watch_test.go b/watch_test.go → go/watch_test.go
diff --git a/workspace.go → go/workspace.go b/workspace.go → go/workspace.go
diff --git a/workspace_crypto_metadata.go → go/workspace_crypto_metadata.go b/workspace_crypto_metadata.go → go/workspace_crypto_metadata.go
diff --git a/workspace_crypto_metadata_test.go → go/workspace_crypto_metadata_test.go b/workspace_crypto_metadata_test.go → go/workspace_crypto_metadata_test.go
diff --git a/workspace_test.go → go/workspace_test.go b/workspace_test.go → go/workspace_test.go
diff --git a/yaml.go → go/yaml.go b/yaml.go → go/yaml.go
diff --git a/yaml_test.go → go/yaml_test.go b/yaml_test.go → go/yaml_test.go
diff --git a/sonar-project.properties b/sonar-project.properties
@@ -5,4 +5,4 @@ sonar.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/gomodcache/**,**/n
 sonar.tests=.
 sonar.test.inclusions=**/*_test.go,**/*.test.ts,**/*.test.js,**/*.spec.ts,**/*.spec.js
 sonar.test.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/gomodcache/**,**/node_modules/**,**/dist/**,**/build/**
-sonar.go.coverage.reportPaths=coverage.out
+sonar.go.coverage.reportPaths=go/coverage.out