chore: drop dead and redundant nolint directives

Removes directives for linters that are not enabled (noctx, exhaustive,
deadcode) and gosec suppressions already covered by config exclusions.
Tags ochrevector QueryResult and Filter with their existing field names
so musttag passes without changing the NATS wire format, and bounds the
RDS window slot conversion instead of suppressing G115.

cmd/installer/install/install.go

@@ -870,7 +870,7 @@ func fireInstallCallback() {
 		return
 	}
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(url) //nolint:noctx // installer has no context; best-effort fire-and-forget
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("fireInstallCallback: request failed", "url", url, "err", err)
 		return

cmd/spinifex/cmd/admin_ochre_vector.go

@@ -283,11 +283,9 @@ func truncateForTable(s string, maxRunes int) string {
 }
 
 // formatQueryResults renders 'ochre vector query' output: a truncated table
-// by default, or the full response as indented JSON when asJSON is set
-// (D10's "full text via source ref" -- here, via --json).
+// by default, or the full response as indented JSON when asJSON is set.
 func formatQueryResults(results []handlers_ochrevector.QueryResult, asJSON bool) (string, error) {
 	if asJSON {
-		//nolint:musttag // QueryResult is an internal, non-wire Go type (predates this CLI); it round-trips fine on its default field names.
 		data, err := json.MarshalIndent(results, "", "  ")
 		if err != nil {
 			return "", fmt.Errorf("encode results as JSON: %w", err)
@@ -317,7 +315,6 @@ func parseFilterFlag(raw string) (*handlers_ochrevector.Filter, error) {
 		return nil, nil
 	}
 	var f handlers_ochrevector.Filter
-	//nolint:musttag // Filter is the existing filter-AST type (D9); it round-trips fine on its default field names.
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		return nil, fmt.Errorf("decode --filter: %w", err)
 	}

spinifex/daemon/daemon_handlers.go

@@ -482,7 +482,7 @@ var roleHTTPClient = &http.Client{Timeout: 500 * time.Millisecond}
 
 // fetchNATSRole queries a NATS /varz endpoint and returns "leader", "follower", or "".
 func fetchNATSRole(url string, client *http.Client) string {
-	resp, err := client.Get(url) //nolint:noctx // internal monitoring call
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Debug("Failed to query NATS monitoring", "err", err)
 		return ""

spinifex/daemon/state_test.go

@@ -254,7 +254,7 @@ func TestEveryState_CanReachTerminated(t *testing.T) {
 			continue
 		}
 
-		visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+		visited := map[vm.InstanceState]bool{start: true}
 		queue := []vm.InstanceState{start}
 		found := false
 
@@ -415,7 +415,7 @@ func TestTransitionState_ConcurrentTransitions(t *testing.T) {
 
 // reachableStates returns all states reachable from start via BFS.
 func reachableStates(start vm.InstanceState) map[vm.InstanceState]bool {
-	visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+	visited := map[vm.InstanceState]bool{start: true}
 	queue := []vm.InstanceState{start}
 	for len(queue) > 0 {
 		current := queue[0]

spinifex/handlers/ochrevector/backend.go

@@ -27,11 +27,11 @@ type VectorRow struct {
 // stored metadata, source provenance, and cosine similarity Score in [0,1]
 // (D8; 1 - cosine_distance).
 type QueryResult struct {
-	Chunk        string
-	Metadata     map[string]any
-	SourceKey    string
-	SourceOffset int
-	Score        float32
+	Chunk        string         `json:"Chunk"`
+	Metadata     map[string]any `json:"Metadata"`
+	SourceKey    string         `json:"SourceKey"`
+	SourceOffset int            `json:"SourceOffset"`
+	Score        float32        `json:"Score"`
 }
 
 // defaultQueryK and maxQueryK bound Query's k (D8/D10): k<=0 defaults to

spinifex/handlers/ochrevector/filter.go

@@ -46,10 +46,10 @@ var filterKeyPattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]{0,63}$`)
 // orAll) over Children. Construct via the Equals/GreaterThan/.../AndAll
 // helpers rather than the struct literal directly.
 type Filter struct {
-	Op       FilterOp
-	Key      string
-	Value    any
-	Children []*Filter
+	Op       FilterOp  `json:"Op"`
+	Key      string    `json:"Key"`
+	Value    any       `json:"Value"`
+	Children []*Filter `json:"Children"`
 }
 
 // Equals builds an `equals` leaf filter: metadata[key] as text equals value.

spinifex/handlers/rds/window.go

@@ -3,6 +3,7 @@ package handlers_rds
 import (
 	"fmt"
 	"hash/fnv"
+	"math"
 	"slices"
 	"strconv"
 	"strings"
@@ -290,7 +291,10 @@ func assignDailySlot(block dailyWindow, identifier string, shift int64) dailyWin
 	if slots < 1 {
 		return block
 	}
-	slot := int64(windowHash(identifier) % uint64(slots)) //nolint:gosec // the modulus bounds it to the slot count
+	var slot int64
+	if h := windowHash(identifier) % uint64(slots); h <= math.MaxInt64 {
+		slot = int64(h)
+	}
 	start := (block.start + time.Duration((slot+shift)%slots)*windowSlot) % oneDay
 	return dailyWindow{start: start, end: (start + windowSlot) % oneDay}
 }

spinifex/lbagent/healthcheck.go

@@ -76,7 +76,7 @@ func probeHTTP(t HealthTarget) bool {
 	}
 
 	url := fmt.Sprintf("%s://%s%s", scheme, t.Address, path)
-	resp, err := client.Get(url) //nolint:noctx // short fixed-timeout probe
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("HTTP probe failed", "url", url, "err", err)
 		return false

tests/e2e/ecr/crane_skopeo_test.go

@@ -22,7 +22,7 @@ const ociCmdTimeout = 2 * time.Minute
 func writeLayerTar(t *testing.T, dir string) string {
 	t.Helper()
 	path := filepath.Join(dir, "layer.tar")
-	fh, err := os.Create(path) //nolint:gosec // test-controlled path under TmpDir
+	fh, err := os.Create(path)
 	require.NoError(t, err)
 	defer fh.Close()
 

tests/e2e/ecs/ecs_test.go

@@ -527,7 +527,7 @@ func guestUserData(t *testing.T, env *harness.Env, fx *ecsFixture) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder

tests/e2e/eks/eks_test.go

@@ -69,7 +69,7 @@ func TestEKS(t *testing.T) {
 	t.Run("DescribeKubeconfigArtifacts", func(t *testing.T) {
 		requireClusterReady(t, fx)
 		path := writeKubeconfig(t, artifacts, fx.Cluster)
-		raw, err := os.ReadFile(path) //nolint:gosec // artifact path built by the test
+		raw, err := os.ReadFile(path)
 		require.NoError(t, err)
 		kc := string(raw)
 		assert.Contains(t, kc, "server: "+aws.StringValue(fx.Cluster.Endpoint), "kubeconfig server = cluster endpoint")

tests/e2e/gpu/ecs_gpu_test.go

@@ -235,7 +235,7 @@ func ecsGPUUserData(t *testing.T, env *harness.Env, cluster string) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder

tests/e2e/harness/fixtures_test.go

@@ -428,9 +428,7 @@ func TestPollUntil_TimeoutWrapsLastErr(t *testing.T) {
 
 // Compile-time check: every exported Ensure* compiles with the Fixture.
 // Never invoked at runtime; pure type assertion against the public API.
-//
-//nolint:unused,deadcode // exists only to fail compile when an Ensure* signature drifts
-func _ensureCompileCheck(t *testing.T, fx *Fixture) {
+var _ = func(t *testing.T, fx *Fixture) {
 	_, _ = EnsureKeyPair(t, fx)
 	_ = EnsureAMI(t, fx, AMISource{Existing: "ami-0"})
 	_ = EnsureDefaultVPC(t, fx)

tests/e2e/harness/kubectl.go

@@ -43,7 +43,7 @@ func NewKubectl(t *testing.T, kubeconfig string, awsEnv []string) *Kubectl {
 // output. Errors are returned (not fatal) so callers can poll readiness.
 func (k *Kubectl) Run(timeout time.Duration, args ...string) (string, error) {
 	full := append([]string{"--kubeconfig", k.Kubeconfig}, args...)
-	cmd := exec.Command(k.Bin, full...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(k.Bin, full...)
 	env := os.Environ()
 	env = append(env, k.AWSEnv...)
 	cmd.Env = env
@@ -116,7 +116,7 @@ func (k *Kubectl) execPluginProbe(timeout time.Duration) string {
 	if err != nil {
 		return "exec plugin " + argv[0] + " not on PATH: " + err.Error() + "\n"
 	}
-	cmd := exec.Command(bin, argv[1:]...) //nolint:gosec // argv comes from the kubeconfig this test wrote
+	cmd := exec.Command(bin, argv[1:]...)
 	cmd.Env = append(os.Environ(), k.AWSEnv...)
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &stdout, &stderr

tests/e2e/harness/registry.go

@@ -55,7 +55,7 @@ func NewSkopeo(t *testing.T, dockerConfig string) *ExternalCLI {
 // Run executes the client with args and returns combined output. Errors are
 // returned (not fatal) so callers can assert on output or poll.
 func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	var buf bytes.Buffer
 	cmd.Stdout = &buf
@@ -78,7 +78,7 @@ func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error)
 // RunStdin is Run with data piped to the process stdin (docker login
 // --password-stdin).
 func (c *ExternalCLI) RunStdin(timeout time.Duration, stdin string, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	cmd.Stdin = strings.NewReader(stdin)
 	var buf bytes.Buffer

tests/e2e/harness/system_account.go

@@ -35,7 +35,7 @@ func SystemAWSClient(t *testing.T, env *Env) *AWSClient {
 		t.Fatalf("SystemAWSClient: no config dir located; set SPINIFEX_CONFIG_DIR")
 	}
 	path := filepath.Join(env.ConfigDir, systemCredentialsFile)
-	out, err := exec.Command("sudo", "-n", "cat", path).Output() //nolint:gosec // path is env-derived, not caller input
+	out, err := exec.Command("sudo", "-n", "cat", path).Output()
 	if err != nil {
 		t.Fatalf("SystemAWSClient: sudo -n cat %s: %v", path, err)
 	}

tests/integration/predastore_test.go

@@ -90,7 +90,7 @@ func predastoreS3Client(t *testing.T, fixture *testpredastore.Fixture) *s3.S3 {
 	t.Helper()
 	httpClient := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // self-signed cert generated by this same fixture, localhost-only
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		},
 	}
 	sess, err := session.NewSession(&aws.Config{