chore: promote dev to main (top-down dep tree sweep)

.github/workflows/ci.yml

@@ -2,25 +2,79 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [dev, main]
+  pull_request:
+    branches: [dev, main]
+
+permissions:
+  contents: read
+
+env:
+  GOFLAGS: -buildvcs=false
+  GOWORK: "off"
+  GOPROXY: "direct"
+  GOSUMDB: "off"
 
 jobs:
   test:
+    name: Test + Coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v5
         with:
-          go-version-file: go.mod
-
-      - name: Run tests with coverage
-        run: |
-          go test -coverprofile=coverage.out ./pkg/mcp/...
-          sed -i 's|forge.lthn.ai/core/mcp/||g' coverage.out
-
-      - name: Upload to Codecov
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test with coverage
+        working-directory: go
+        run: go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
         with:
-          files: coverage.out
           token: ${{ secrets.CODECOV_TOKEN }}
+          files: go/coverage.out
+          flags: unittests
+          fail_ci_if_error: false
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          working-directory: go
+          args: --timeout=5m --tests=false
+
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+      - name: Test for coverage
+        working-directory: go
+        run: go test -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@v6
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=dappcore
+            -Dsonar.projectKey=dappcore_mcp
+            -Dsonar.sources=go
+            -Dsonar.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/*_test.go
+            -Dsonar.tests=go
+            -Dsonar.test.inclusions=**/*_test.go
+            -Dsonar.go.coverage.reportPaths=go/coverage.out

.gitmodules

@@ -0,0 +1,24 @@
+[submodule "external/go"]
+	path = external/go
+	url = https://github.com/dappcore/go.git
+	branch = dev
+[submodule "external/io"]
+	path = external/io
+	url = https://github.com/dappcore/go-io.git
+	branch = dev
+[submodule "external/log"]
+	path = external/log
+	url = https://github.com/dappcore/go-log.git
+	branch = dev
+[submodule "external/process"]
+	path = external/process
+	url = https://github.com/dappcore/go-process.git
+	branch = dev
+[submodule "external/rag"]
+	path = external/rag
+	url = https://github.com/dappcore/go-rag.git
+	branch = dev
+[submodule "external/ws"]
+	path = external/ws
+	url = https://github.com/dappcore/go-ws.git
+	branch = dev

.woodpecker.yml

@@ -0,0 +1,37 @@
+# Woodpecker CI pipeline.
+# Server: ci.lthn.sh. Lint + sonar in parallel, both depend only on clone.
+# sonar_token is admin-scoped on the Woodpecker server.
+
+when:
+  - event: push
+    branch: [dev, main]
+
+steps:
+  - name: golangci-lint
+    image: golangci/golangci-lint:latest-alpine
+    depends_on: []
+    environment:
+      GOFLAGS: -buildvcs=false
+      GOWORK: "off"
+    commands:
+      - cd go && golangci-lint run --timeout=5m ./...
+
+  - name: go-test
+    image: golang:1.26-alpine
+    depends_on: []
+    environment:
+      GOFLAGS: -buildvcs=false
+      GOWORK: "off"
+      CGO_ENABLED: "1"
+    commands:
+      - apk add --no-cache git build-base
+      - cd go && go test -race -coverprofile=coverage.out -covermode=atomic -count=1 ./...
+  - name: sonar
+    image: sonarsource/sonar-scanner-cli:latest
+    depends_on: [go-test]
+    environment:
+      SONAR_HOST_URL: https://sonar.lthn.sh
+      SONAR_TOKEN:
+        from_secret: sonar_token
+    commands:
+      - sonar-scanner

CLAUDE.md

@@ -6,21 +6,33 @@ Guidance for Claude Code and Codex when working with this repository.
 
 `forge.lthn.ai/core/mcp` — Model Context Protocol server with file operations, tool registration, notification broadcasting, and channel events.
 
+Repo layout has become language-segmented:
+
+```text
+core/mcp/
+├── go/      — Go module `dappco.re/go/mcp`
+├── php/     — PHP Laravel package (formerly `src/`)
+├── docs/    — shared docs
+└── composer.json
+```
+
+The Go module is `core/mcp/go/`; the PHP package is `core/mcp/php/`.
+
 Licence: EUPL-1.2
 
 ## Build & Test
 
 ```bash
-go test ./pkg/mcp/...            # run all tests
-go build ./pkg/mcp/...           # verify compilation
-go build ./cmd/core-mcp/         # build binary
+(cd go && go test ./pkg/mcp/...)       # run all tests
+(cd go && go build ./pkg/mcp/...)      # verify compilation
+(cd go && go build ./cmd/core-mcp/)    # build binary
 ```
 
 Or via the Core CLI:
 
 ```bash
-core go test
-core go qa                       # fmt + vet + lint + test
+(cd go && core go test)
+(cd go && core go qa)                  # fmt + vet + lint + test
 ```
 
 ## API Shape
@@ -126,4 +138,6 @@ Selected by `Run()` in priority order:
 
 ## Go Workspace
 
-Part of `~/Code/go.work`. Use `GOWORK=off` to test in isolation.
+The Go stack in this repo is nested as `go/`:
+
+`cd go && GOWORK=off go test ./...` for isolated module verification.

README.md

@@ -1,3 +1,19 @@
+<!-- SPDX-License-Identifier: EUPL-1.2 -->
+
 # mcp
 
-Model Context Protocol — Go MCP server + Laravel MCP package
+> MCP server framework — Go runtime + PHP package; tool/resource/prompt registry
+
+[![CI](https://github.com/dappcore/mcp/actions/workflows/ci.yml/badge.svg?branch=dev)](https://github.com/dappcore/mcp/actions/workflows/ci.yml)
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=alert_status)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Coverage](https://codecov.io/gh/dappcore/mcp/branch/dev/graph/badge.svg)](https://codecov.io/gh/dappcore/mcp)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=security_rating)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=reliability_rating)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=code_smells)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=dappcore_mcp&metric=ncloc)](https://sonarcloud.io/dashboard?id=dappcore_mcp)
+[![Go Reference](https://pkg.go.dev/badge/dappco.re/go/mcp.svg)](https://pkg.go.dev/dappco.re/go/mcp)
+[![License: EUPL-1.2](https://img.shields.io/badge/License-EUPL--1.2-blue.svg)](https://eupl.eu/1.2/en/)
+
+
+Model Context Protocol — Go MCP server + Laravel MCP package

composer.json

@@ -9,14 +9,14 @@
     },
     "autoload": {
         "psr-4": {
-            "Core\\Mcp\\": "src/php/src/Mcp/",
-            "Core\\Website\\Mcp\\": "src/php/src/Website/Mcp/",
-            "Core\\Front\\Mcp\\": "src/php/src/Front/Mcp/"
+            "Core\\Mcp\\": "php/src/Mcp/",
+            "Core\\Website\\Mcp\\": "php/src/Website/Mcp/",
+            "Core\\Front\\Mcp\\": "php/src/Front/Mcp/"
         }
     },
     "autoload-dev": {
         "psr-4": {
-            "Core\\Mcp\\Tests\\": "src/php/tests/"
+            "Core\\Mcp\\Tests\\": "php/tests/"
         }
     },
     "extra": {

go.work

@@ -0,0 +1,14 @@
+go 1.26.2
+
+// Workspace mode for development: pulls fresh code from external/ submodules.
+// CI uses GOWORK=off to fall back to go/go.mod tags (reproducible).
+
+use (
+	./go
+	./external/go
+	./external/io
+	./external/log
+	./external/process
+	./external/rag
+	./external/ws
+)

go/AGENTS.md

@@ -0,0 +1 @@
+../AGENTS.md

go/CLAUDE.md

@@ -0,0 +1 @@
+../CLAUDE.md

go/README.md

@@ -0,0 +1 @@
+../README.md

go/docs

@@ -0,0 +1 @@
+../docs