Implementation result — repository foundation

The implementation has been published in branch ai/mvp-01-repository-foundation, commit bba6d00.

What was done

• Initialized the Go module gitcode.com/urandon/sessionless; Go/toolchain is pinned to 1.26.4.
• Established the package boundaries cmd/, internal/, migrations/ydb, infra, test/fixtures.
• Added four buildable binaries: control-api, reconciler, telegram-sender, worker-codex.
• control-api provides minimal /healthz, /readyz, /version endpoints, graceful shutdown and JSON logging; the remaining components are explicitly identified as skeletons and do not simulate a nonexistent domain flow.
• The Go, Docker Compose, Terraform, yc, YDB CLI and Goose versions are centralized in tools/versions.env; make tools checks for an exact match and reports the full list of drifted/missing tools.
• Implemented the command contract: make tools, generate, test, build, dev-up, migrate-local, integration, dev-down; added images, ci, compose-config and fail-closed dev-reset with mandatory CONFIRM_LOCAL_RESET=sessionless-dev.
• The Go build cache/module cache/temp directories are isolated under .build, so the checks do not require writing to the runner's home directory.
• Added separate Dockerfiles for the small distroless control plane and the separate worker runtime. The worker boundary does not contain Python yet and does not pin the harness runtime inside the control plane.
• Added compose.yaml, a safe-defaults-only .env.example, .dockerignore, secret/state ignore rules, a synthetic Telegram fixture, development/contribution docs and a Keychain/environment secret injection procedure.
• Added the GitCode workflow .gitcode/workflows/ci.yml: it runs the same make ci as the local environment, plus builds both runtime images.

Verification

Successfully verified locally:

make ci
  go generate ./...
  go vet ./...
  go test -race ./...
  build: 4/4 binaries
  go test -race -tags=integration ./test/integration/...

make migrate-local
  No YDB migrations exist yet; schema work starts in implementation issue #5.

git diff --check
sh -n scripts/*.sh
JSON/YAML syntax validation

The guard was also verified: make dev-reset without the exact confirmation refused to delete volumes.

make tools correctly confirmed Go 1.26.4 and reported that Docker Compose, Terraform, yc, YDB CLI and Goose are missing on the current Mac. Therefore, make images, compose-config and actual dev-up/dev-down runs are not presented here as successfully verified — they must be confirmed by the GitCode runner after the MR is opened. I am leaving the issue open until the image/Compose checks are green.

Handoff for MVP-03 / issue #5

Goose is pinned as required by the scope, but Goose does not have a YDB database driver. Therefore, the current make migrate-local:

1. successfully reports no migrations on an empty foundation;
2. as soon as .sql files appear, refuses to apply them without a durable YDB migration ledger.

Issue #5 needs a YDB-native runner with a version/checksum/applied-at ledger and idempotency; simply replaying raw DDL would be unsafe.

Correction: Goose does support YDB

Поправка к migration note в предыдущем implementation comment: утверждение «у Goose нет YDB database driver» было неверным. YDB официально документирует Goose, а upstream Goose включает driver ydb.

Исправление уже в MR !1, commit 8d4b4ee:

• make migrate-local применяет непустой набор через pinned Goose и YDB_CONNECTION_STRING;
• .env.example содержит безопасный local YDB connection string с обязательными scripting, fake_tx и bind flags;
• документация теперь отражает реальный failure model YDB.

Сохраняется другое ограничение: YDB не поддерживает schema transactions, а Goose по умолчанию не даёт YDB-specific migration lock. Production lock/checksum/crash-recovery protocol вынесен в #5; туда добавлен отдельный comparative research comment по Goose и ydb-platform/golang-migrate.

CI update: GitCode → GitHub mirror → GitHub Actions

Commit 3222c14 replaces the experimental .gitcode/workflows/ci.yml with .github/workflows/ci.yml.

The implemented topology is now:

GitCode branch/tag (source of truth)
    └─ push mirror, same commit SHA
         └─ github.com/urandon/sessionless
              └─ GitHub Actions
                   ├─ make ci
                   └─ make images

The workflow runs on every mirrored branch/tag push and on manual dispatch. GitHub PR objects are not required because code review remains in GitCode. Until status feedback into the GitCode MR UI exists, merge review must match the GitHub Actions run SHA to the GitCode MR head SHA.

Local make ci remains green. Mirror verification currently shows:

• GitCode/MR head: 3222c14;
• GitHub mirror head: 8d4b4ee;
• therefore no GitHub CI success is claimed yet.

Issue remains open until mirror propagation and both GitHub jobs (Go verification, Runtime images) complete successfully.

Release publication from GitHub back into GitCode is deliberately out of this task and tracked separately in #15. Branch CI receives no GitCode publication token.

Completion report

MVP-01 is accepted and ready to close.

Delivered

• !1 — repository foundation: Go module; four executable boundaries (control-api, reconciler, telegram-sender, worker-codex); cmd/, internal/, YDB migration, infrastructure and test-fixture boundaries.
• Stable Make command contract for tools, generation, tests, local stand lifecycle, migrations and integration checks; destructive local reset requires explicit confirmation.
• Pinned tool declarations, separate control-plane and Codex-worker Dockerfiles, safe .env.example, secret-loading guidance and executable development documentation.
• GitCode remains the source of truth; the GitHub push mirror executes the same make ci contract plus runtime image builds.
• !2 — clean CI warnings: Node.js 24-compatible checkout/setup-go actions and no meaningless Go dependency-cache warning before go.sum exists.

Final verification evidence

• GitCode main and GitHub mirror main both resolve to merge commit 8f27004699a0160b7f7a11d346861f48edecb74a.
• GitHub Actions CI run #2: success on that exact SHA.
  • Go verification: success, annotations_count = 0; runs generation, vet/static checks, race-enabled unit tests, all four Go builds and race-enabled integration tests through make ci.
  • Runtime images: success, annotations_count = 0; builds both the control-plane and worker images.
• Local make ci: pass.
• Local make migrate-local: pass, expected no-op because schema migrations start in #5.
• Workflow YAML parse, git diff --check and sh -n scripts/*.sh: pass.
• The source tree of follow-up commit 7d90441 exactly matches merge commit 8f27004 (tree 1c62f9d0ae11172a7036437e7e76bcda49f3ae95).
• Only safe local defaults are committed in .env.example; actual .env* files remain ignored except for the example.

Deferred by design

• Production YDB schema safety, locking and crash recovery remain in #5.
• Publishing GitHub release artifacts back to GitCode remains in #15 and is outside the MVP-01 critical path.

All acceptance criteria for #3 are satisfied.