feat: deliver Made remediation phases 1-3

.github/workflows/ci.yml

@@ -9,12 +9,19 @@ jobs:
   build-test-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: "1.23"
+          go-version: "1.26.5"
+      - name: Install reviewer containment
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y bubblewrap
+          sudo chmod 4755 "$(command -v bwrap)"
       - run: go build ./...
       - run: go test ./...
-      - uses: golangci/golangci-lint-action@v6
+      - run: go test -race -shuffle=on -count=1 ./...
+      - run: go vet ./...
+      - uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa # v7.0.1
         with:
-          version: latest
+          version: v2.11.2

AGENTS.md

@@ -0,0 +1,16 @@
+# Project agent memory
+
+This file is the project's committed home for project-intrinsic agent knowledge: build, test, release, architecture, and sharp-edge notes that should travel with the code.
+
+- Add durable project-specific notes here as they are discovered through real work.
+
+- The versioned runtime contract is implemented at `cmd/made/runcommands.go` and `internal/daemon`; validate it through `made capabilities --json` and the `made run ... --json` commands.
+- `.made.yml` is decoded strictly with `version: 1`; the authoritative loader is `internal/config/config.go`.
+- Local git fixtures can inherit SSH commit signing from the host; use process-local `GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false` when running the Go test suite.
+
+## Maintaining this file
+
+Keep this file for knowledge useful to almost every future agent session in this project.
+Do not repeat what the codebase already shows; point to the authoritative file or command instead.
+Prefer rewriting or pruning existing entries over appending new ones.
+When updating this file, preserve this bar for all agents and keep entries concise.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

README.md

@@ -7,3 +7,21 @@ A personal Go rewrite of [no-mistakes](https://github.com/kunchenguid/no-mistake
 made is an independent synthesis, not a dependency bundle or a one-to-one copy of any source.
 
 See `plans/made-rewrite.md` for the full design and build plan.
+
+## Versioned daemon contract
+
+`made capabilities --json` reports the public protocol and command schema.
+
+Use `made run submit --json --gate <bare-gate-path> --ref refs/heads/<branch> --old-sha <previous-head-sha> --input-sha <sha>` to create a run.
+
+Use `made run status --json <exact-run-id>` for one run, `made run list --json --active` for the active batch, and `made run cancel --json <exact-run-id>` for idempotent cancellation.
+
+Use `made review decide --json --stage <stage> --decision <approved|rejected> <exact-run-id>` for an exact review decision.
+
+Use `made doctor --json` for the fixed health schema.
+
+Run states are `queued`, `running`, `awaiting_review`, `awaiting_merge`, `succeeded`, `failed`, `canceled`, and `superseded`.
+
+Run state is persisted in a fsync-backed local WAL, and gate submissions use an idempotent fsync-backed spool keyed by gate, ref, and input SHA.
+
+The daemon acquires its singleton before touching the Unix socket path, removes only stale sockets, and refuses regular files, symlinks, and directories.