Production fixes (20 files, 26 findings):
- 19 errcheck
- 2 staticcheck
- 5 unused

Test files skipped per brief.

Pre-existing failure NOT caused by this lane:
- pkg/lib TestLib_ReferenceFiles_* / TestLib_ReferenceFs_* fail because
  the tests compute refDir as core.JoinPath(repoRoot, '.core', 'reference')
  where repoRoot is taken from runtime.Caller location → resolves to
  go/.core/reference/ (empty), but the actual .core/reference/ lives at
  the agent repo root. Restructure-related; needs a follow-up to either
  move .core/ into go/ or update the test to walk up one level.

Mirrors api shape: .github/workflows/ci.yml runs test+coverage (Codecov),
golangci-lint --tests=false, and sonarcloud-scan-action to
dappcore_agent. README gets the badge block (CI / quality gate / cov /
security / maintainability / reliability / smells / NCLOC / pkg.go.dev /
license).

GOPROXY=direct GOSUMDB=off env in workflow to dodge the proxy.golang.org
stale-zip pattern that broke api's first run.

Internal Woodpecker pipeline at ci.lthn.sh continues unchanged.

- Delete .core/reference/ (Snider 2026-04-30: hack for a broken core.agent,
  no longer needed)
- Delete embedded copy at go/pkg/lib/workspace/default/.core/reference/
- Move .core/docs/core-folder-spec.md → /Users/snider/Code/core/config/docs/
  (Snider: belongs in core/config)
- Delete 6 lib_test.go funcs that exercised the deleted .core/reference:
  TestLib_ReferenceFiles_Good_SPDXHeaders
  TestLib_ReferenceFs_Good_EmbeddedCopyMatchesSource
  TestLib_ExtractWorkspace_Good_ReferenceFsSecureDefaults
  TestLib_ExtractWorkspace_Good_ReferenceHeaders
  TestLib_ExtractWorkspace_Good_ReferenceUsageExamples
  TestLib_ExtractWorkspaceSubdirs_Good_Case
- Drop runtime import (was only used by deleted Reference tests)
- Drop replace forge.lthn.ai/Snider/Poindexter => ../../snider/Poindexter
  from go.mod (0% replace policy; vanity URL resolves direct)

All tests pass: agent root, cmd/core-agent, pkg/{agentic,brain,lib,
lib/flow,messages,monitor,runner,setup}.

…,hermes,google}

Restructure to give each agent provider its own clear home. Snider
2026-04-30: '/Users/snider/Code/core/agent/plugins is /Users/snider/Code/
core/agent/provider/claude/plugins i think'.

Moves:
- claude/   → provider/claude/
- codex/    → provider/codex/
- hermes/   → provider/hermes/
- google/   → provider/google/
- plugins/  → provider/claude/plugins/  (was a marketplace-flavoured
              subset of claude/, now correctly homed under it)

Updated:
- .claude-plugin/marketplace.json: 3 source paths rewritten
  ./claude/<name>/  →  ./provider/claude/<name>/
  (codex marketplace + nested plugin manifests use relative `.` or
  sibling paths so were unaffected.)

Out of scope (explicitly per Snider): wiring up codex / hermes /
google providers to actually function from the new locations. Only the
claude marketplace + plugins paths needed updating to remain functional.

Containerised dev stack now lives under vm/docker/ alongside any future
vm shapes (e.g. vm/podman/, vm/k8s/, vm/microvm/). Snider 2026-04-30:
'put /Users/snider/Code/core/agent/docker inside /Users/snider/Code/core/
agent/vm/docker please'.

Updated:
- vm/docker/docker-compose.yml — dockerfile: docker/Dockerfile →
  Dockerfile (since compose runs from its own dir, the path is now
  sibling-relative)
- docs/plans/2026-03-15-local-stack.md — path refs updated to vm/docker/

Original docker/docker-compose.yml used 'context: ..' to mean repo root.
After moving to vm/docker/, '..' now resolves to vm/, breaking the
build (Dockerfile expects to COPY from project root: composer.json,
package.json, src/, etc.).

Fix: context: ../.. (repo root from vm/docker/), dockerfile:
vm/docker/Dockerfile (relative to that context). Build now works the
same as before the move.

Leftover from the 'agent round 2 — inline agentcompat shim, drop /tmp
replaces' work — a 3-file mini-module that nothing imports anymore.
go.mod + core.go + core_test.go, 12K total. Snider 2026-04-30:
'im not sure what /Users/snider/Code/core/agent/.deps is but should
probbly go'.

go vet clean post-deletion.

….yaml

Snider 2026-04-30: 'these files need to be in .core/ or go'.

agents.yaml — moved to .core/ where Go runtime already looked for it
(CoreRoot()/agents.yaml). Removes the awkward two-location pattern
where source-of-truth was config/ but runtime read .core/.

  - Updated fetch_loop.go fallback path: source repo lookup is now
    core/agent/.core/agents.yaml (was config/agents.yaml).
  - Empty config/ dir removed.

repos.yaml — deleted. The canonical host-uk dependency registry lives
at ~/Code/host-uk/.core/repos.yaml (per docs/CHARON-ONBOARDING.md and
provider/claude/core/skills/repo-sweep/SKILL.md). The agent repo's
copy was a stale duplicate.

v0.21.0 moved config/agents.yaml → .core/agents.yaml but .gitignore had
.core/* gating, so the new location was silently untracked. Add explicit
!.core/agents.yaml exception so the file actually ships.

Also drops the !.core/reference/ exception lines (the .core/reference/
hack got nuked in v0.16.0).

Removed:
- core-agent  (56MB compiled binary; build artefact, not source)
- core-agent.backup  (50MB stale binary backup)
- llm.txt   (stray file, no consumers)
- Makefile  (Go build targets; Taskfile.yml is canonical now)

Moved:
- composer.json → php/composer.json  (was at repo root, but php/ is the
  PHP package home now)

Snider 2026-04-30: 'these to remove: llm.txt core-agent.backup
core-agent (its a binary) Makefile, and mv composer.json to
php/composer.json along with other php centric settings'.

Other PHP-centric settings (phpstan.neon, phpunit.xml, .php-cs-fixer.*)
not present at repo root, so no further moves needed in this commit.

README rewrite — old version described agent as 'A monorepo of Claude
Code plugins for the Host UK federated monorepo' with paths like
./claude/code, ./claude/review, ./claude/qa that don't exist. Reality
post-restructure (today's v0.17→v0.23):
- Go binary core-agent + MCP/HTTP modes
- provider/{claude,codex,hermes,google} subtree
- .core/agents.yaml runtime config (was config/agents.yaml)
- vm/docker/ containerised stack (was docker/)
- Provider integrations the actual plugins describe (core, core-go,
  core-php, devops, infra, research, hermes_runner_mcp, camofox_mcp)

Snider 2026-04-30: 'the readme copy is not actualy acurate at all
anymore'.

Plus dropped tracked .DS_Store (gitignore covers it; was tracked from
a pre-gitignore commit).

Other dot files reviewed and kept:
- .gitleaks.toml + .gitleaksignore (real config, false-positive
  allowlist with athena/argus review notes — Mantis #325 follow-up)
- .gitattributes / .gitignore / .gitmodules (load-bearing)
- .mcp.json (MCP server config for core-agent itself)
- .claude-plugin/ (marketplace.json — refs new provider/claude/ paths)
- .github/workflows/ (public CI)
- .core/ (runtime seed; gitignored except docs/, workspace.yaml,
  agents.yaml exceptions)

Old version described agent as 'A monorepo of Claude Code plugins for
the Host UK federated monorepo' with paths like ./claude/code,
./claude/review, ./claude/qa that don't exist. Reality post-restructure:

- Go binary core-agent (MCP stdio + HTTP serve modes)
- provider/{claude,codex,hermes,google}/ subtree
- 8 actual claude plugins (core, core-go, core-php, devops, infra,
  research, hermes_runner_mcp, camofox_mcp)
- .core/agents.yaml runtime config (was config/agents.yaml)
- vm/docker/ containerised stack (was docker/)
- php/ Laravel package
- go/ Go module subtree

Snider 2026-04-30: 'the readme copy is not actualy acurate at all
anymore'.

README v0.25.0 referenced LICENCE but the file was missing — copying
the same EUPL-1.2 file used in core/api. SPDX header in README +
project-wide policy already declared EUPL-1.2 throughout; just the
canonical text was missing.