From 2b4ddad78aeff71c062405155f32bbeda2292892 Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Wed, 30 Sep 2026 13:46:11 +1000
Subject: [PATCH] chore: drop dead and redundant nolint directives

Removes directives for linters that are not enabled (noctx, exhaustive,
deadcode) and gosec suppressions already covered by config exclusions.
Tags ochrevector QueryResult and Filter with their existing field names
so musttag passes without changing the NATS wire format, and bounds the
RDS window slot conversion instead of suppressing G115.
---
 cmd/installer/install/install.go         |  2 +-
 cmd/spinifex/cmd/admin_ochre_vector.go   |  5 +----
 spinifex/daemon/daemon_handlers.go       |  2 +-
 spinifex/daemon/state_test.go            |  4 ++--
 spinifex/handlers/ochrevector/backend.go | 10 +++++-----
 spinifex/handlers/ochrevector/filter.go  |  8 ++++----
 spinifex/handlers/rds/window.go          |  6 +++++-
 spinifex/lbagent/healthcheck.go          |  2 +-
 tests/e2e/ecr/crane_skopeo_test.go       |  2 +-
 tests/e2e/ecs/ecs_test.go                |  2 +-
 tests/e2e/eks/eks_test.go                |  2 +-
 tests/e2e/gpu/ecs_gpu_test.go            |  2 +-
 tests/e2e/harness/fixtures_test.go       |  4 +---
 tests/e2e/harness/kubectl.go             |  4 ++--
 tests/e2e/harness/registry.go            |  4 ++--
 tests/e2e/harness/system_account.go      |  2 +-
 tests/integration/predastore_test.go     |  2 +-
 17 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/cmd/installer/install/install.go b/cmd/installer/install/install.go
index 3dde95b50..b9b300491 100644
--- a/cmd/installer/install/install.go
+++ b/cmd/installer/install/install.go
@@ -870,7 +870,7 @@ func fireInstallCallback() {
 		return
 	}
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(url) //nolint:noctx // installer has no context; best-effort fire-and-forget
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("fireInstallCallback: request failed", "url", url, "err", err)
 		return
diff --git a/cmd/spinifex/cmd/admin_ochre_vector.go b/cmd/spinifex/cmd/admin_ochre_vector.go
index c3ff43bf0..321eed7cd 100644
--- a/cmd/spinifex/cmd/admin_ochre_vector.go
+++ b/cmd/spinifex/cmd/admin_ochre_vector.go
@@ -283,11 +283,9 @@ func truncateForTable(s string, maxRunes int) string {
 }
 
 // formatQueryResults renders 'ochre vector query' output: a truncated table
-// by default, or the full response as indented JSON when asJSON is set
-// (D10's "full text via source ref" -- here, via --json).
+// by default, or the full response as indented JSON when asJSON is set.
 func formatQueryResults(results []handlers_ochrevector.QueryResult, asJSON bool) (string, error) {
 	if asJSON {
-		//nolint:musttag // QueryResult is an internal, non-wire Go type (predates this CLI); it round-trips fine on its default field names.
 		data, err := json.MarshalIndent(results, "", "  ")
 		if err != nil {
 			return "", fmt.Errorf("encode results as JSON: %w", err)
@@ -317,7 +315,6 @@ func parseFilterFlag(raw string) (*handlers_ochrevector.Filter, error) {
 		return nil, nil
 	}
 	var f handlers_ochrevector.Filter
-	//nolint:musttag // Filter is the existing filter-AST type (D9); it round-trips fine on its default field names.
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		return nil, fmt.Errorf("decode --filter: %w", err)
 	}
diff --git a/spinifex/daemon/daemon_handlers.go b/spinifex/daemon/daemon_handlers.go
index 004ec06d5..e8a7578eb 100644
--- a/spinifex/daemon/daemon_handlers.go
+++ b/spinifex/daemon/daemon_handlers.go
@@ -482,7 +482,7 @@ var roleHTTPClient = &http.Client{Timeout: 500 * time.Millisecond}
 
 // fetchNATSRole queries a NATS /varz endpoint and returns "leader", "follower", or "".
 func fetchNATSRole(url string, client *http.Client) string {
-	resp, err := client.Get(url) //nolint:noctx // internal monitoring call
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Debug("Failed to query NATS monitoring", "err", err)
 		return ""
diff --git a/spinifex/daemon/state_test.go b/spinifex/daemon/state_test.go
index 5eb1ae974..e082470dc 100644
--- a/spinifex/daemon/state_test.go
+++ b/spinifex/daemon/state_test.go
@@ -254,7 +254,7 @@ func TestEveryState_CanReachTerminated(t *testing.T) {
 			continue
 		}
 
-		visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+		visited := map[vm.InstanceState]bool{start: true}
 		queue := []vm.InstanceState{start}
 		found := false
 
@@ -415,7 +415,7 @@ func TestTransitionState_ConcurrentTransitions(t *testing.T) {
 
 // reachableStates returns all states reachable from start via BFS.
 func reachableStates(start vm.InstanceState) map[vm.InstanceState]bool {
-	visited := map[vm.InstanceState]bool{start: true} //nolint:exhaustive // BFS seed — populated dynamically
+	visited := map[vm.InstanceState]bool{start: true}
 	queue := []vm.InstanceState{start}
 	for len(queue) > 0 {
 		current := queue[0]
diff --git a/spinifex/handlers/ochrevector/backend.go b/spinifex/handlers/ochrevector/backend.go
index 0bbd16033..9f18e89c4 100644
--- a/spinifex/handlers/ochrevector/backend.go
+++ b/spinifex/handlers/ochrevector/backend.go
@@ -27,11 +27,11 @@ type VectorRow struct {
 // stored metadata, source provenance, and cosine similarity Score in [0,1]
 // (D8; 1 - cosine_distance).
 type QueryResult struct {
-	Chunk        string
-	Metadata     map[string]any
-	SourceKey    string
-	SourceOffset int
-	Score        float32
+	Chunk        string         `json:"Chunk"`
+	Metadata     map[string]any `json:"Metadata"`
+	SourceKey    string         `json:"SourceKey"`
+	SourceOffset int            `json:"SourceOffset"`
+	Score        float32        `json:"Score"`
 }
 
 // defaultQueryK and maxQueryK bound Query's k (D8/D10): k<=0 defaults to
diff --git a/spinifex/handlers/ochrevector/filter.go b/spinifex/handlers/ochrevector/filter.go
index 4cfe1e0d0..2a7a5ee50 100644
--- a/spinifex/handlers/ochrevector/filter.go
+++ b/spinifex/handlers/ochrevector/filter.go
@@ -46,10 +46,10 @@ var filterKeyPattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]{0,63}$`)
 // orAll) over Children. Construct via the Equals/GreaterThan/.../AndAll
 // helpers rather than the struct literal directly.
 type Filter struct {
-	Op       FilterOp
-	Key      string
-	Value    any
-	Children []*Filter
+	Op       FilterOp  `json:"Op"`
+	Key      string    `json:"Key"`
+	Value    any       `json:"Value"`
+	Children []*Filter `json:"Children"`
 }
 
 // Equals builds an `equals` leaf filter: metadata[key] as text equals value.
diff --git a/spinifex/handlers/rds/window.go b/spinifex/handlers/rds/window.go
index 4ab48f92f..3d1221171 100644
--- a/spinifex/handlers/rds/window.go
+++ b/spinifex/handlers/rds/window.go
@@ -3,6 +3,7 @@ package handlers_rds
 import (
 	"fmt"
 	"hash/fnv"
+	"math"
 	"slices"
 	"strconv"
 	"strings"
@@ -290,7 +291,10 @@ func assignDailySlot(block dailyWindow, identifier string, shift int64) dailyWin
 	if slots < 1 {
 		return block
 	}
-	slot := int64(windowHash(identifier) % uint64(slots)) //nolint:gosec // the modulus bounds it to the slot count
+	var slot int64
+	if h := windowHash(identifier) % uint64(slots); h <= math.MaxInt64 {
+		slot = int64(h)
+	}
 	start := (block.start + time.Duration((slot+shift)%slots)*windowSlot) % oneDay
 	return dailyWindow{start: start, end: (start + windowSlot) % oneDay}
 }
diff --git a/spinifex/lbagent/healthcheck.go b/spinifex/lbagent/healthcheck.go
index 14424755e..4bd752283 100644
--- a/spinifex/lbagent/healthcheck.go
+++ b/spinifex/lbagent/healthcheck.go
@@ -76,7 +76,7 @@ func probeHTTP(t HealthTarget) bool {
 	}
 
 	url := fmt.Sprintf("%s://%s%s", scheme, t.Address, path)
-	resp, err := client.Get(url) //nolint:noctx // short fixed-timeout probe
+	resp, err := client.Get(url)
 	if err != nil {
 		slog.Warn("HTTP probe failed", "url", url, "err", err)
 		return false
diff --git a/tests/e2e/ecr/crane_skopeo_test.go b/tests/e2e/ecr/crane_skopeo_test.go
index 6f224c7f2..2bf30e111 100644
--- a/tests/e2e/ecr/crane_skopeo_test.go
+++ b/tests/e2e/ecr/crane_skopeo_test.go
@@ -22,7 +22,7 @@ const ociCmdTimeout = 2 * time.Minute
 func writeLayerTar(t *testing.T, dir string) string {
 	t.Helper()
 	path := filepath.Join(dir, "layer.tar")
-	fh, err := os.Create(path) //nolint:gosec // test-controlled path under TmpDir
+	fh, err := os.Create(path)
 	require.NoError(t, err)
 	defer fh.Close()
 
diff --git a/tests/e2e/ecs/ecs_test.go b/tests/e2e/ecs/ecs_test.go
index 13629492b..bd9a80900 100644
--- a/tests/e2e/ecs/ecs_test.go
+++ b/tests/e2e/ecs/ecs_test.go
@@ -527,7 +527,7 @@ func guestUserData(t *testing.T, env *harness.Env, fx *ecsFixture) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder
diff --git a/tests/e2e/eks/eks_test.go b/tests/e2e/eks/eks_test.go
index 77cda0944..b6466474e 100644
--- a/tests/e2e/eks/eks_test.go
+++ b/tests/e2e/eks/eks_test.go
@@ -69,7 +69,7 @@ func TestEKS(t *testing.T) {
 	t.Run("DescribeKubeconfigArtifacts", func(t *testing.T) {
 		requireClusterReady(t, fx)
 		path := writeKubeconfig(t, artifacts, fx.Cluster)
-		raw, err := os.ReadFile(path) //nolint:gosec // artifact path built by the test
+		raw, err := os.ReadFile(path)
 		require.NoError(t, err)
 		kc := string(raw)
 		assert.Contains(t, kc, "server: "+aws.StringValue(fx.Cluster.Endpoint), "kubeconfig server = cluster endpoint")
diff --git a/tests/e2e/gpu/ecs_gpu_test.go b/tests/e2e/gpu/ecs_gpu_test.go
index aad6fe60b..1d24949cd 100644
--- a/tests/e2e/gpu/ecs_gpu_test.go
+++ b/tests/e2e/gpu/ecs_gpu_test.go
@@ -235,7 +235,7 @@ func ecsGPUUserData(t *testing.T, env *harness.Env, cluster string) string {
 	t.Helper()
 	caPath, err := harness.ResolveCACert(env)
 	require.NoError(t, err, "resolve CA cert")
-	caBytes, err := os.ReadFile(caPath) //nolint:gosec // CA path from harness env
+	caBytes, err := os.ReadFile(caPath)
 	require.NoError(t, err, "read CA cert")
 
 	var ca strings.Builder
diff --git a/tests/e2e/harness/fixtures_test.go b/tests/e2e/harness/fixtures_test.go
index 472b5ddf2..17634c246 100644
--- a/tests/e2e/harness/fixtures_test.go
+++ b/tests/e2e/harness/fixtures_test.go
@@ -428,9 +428,7 @@ func TestPollUntil_TimeoutWrapsLastErr(t *testing.T) {
 
 // Compile-time check: every exported Ensure* compiles with the Fixture.
 // Never invoked at runtime; pure type assertion against the public API.
-//
-//nolint:unused,deadcode // exists only to fail compile when an Ensure* signature drifts
-func _ensureCompileCheck(t *testing.T, fx *Fixture) {
+var _ = func(t *testing.T, fx *Fixture) {
 	_, _ = EnsureKeyPair(t, fx)
 	_ = EnsureAMI(t, fx, AMISource{Existing: "ami-0"})
 	_ = EnsureDefaultVPC(t, fx)
diff --git a/tests/e2e/harness/kubectl.go b/tests/e2e/harness/kubectl.go
index d5b8cc0bb..b3fc403c8 100644
--- a/tests/e2e/harness/kubectl.go
+++ b/tests/e2e/harness/kubectl.go
@@ -43,7 +43,7 @@ func NewKubectl(t *testing.T, kubeconfig string, awsEnv []string) *Kubectl {
 // output. Errors are returned (not fatal) so callers can poll readiness.
 func (k *Kubectl) Run(timeout time.Duration, args ...string) (string, error) {
 	full := append([]string{"--kubeconfig", k.Kubeconfig}, args...)
-	cmd := exec.Command(k.Bin, full...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(k.Bin, full...)
 	env := os.Environ()
 	env = append(env, k.AWSEnv...)
 	cmd.Env = env
@@ -116,7 +116,7 @@ func (k *Kubectl) execPluginProbe(timeout time.Duration) string {
 	if err != nil {
 		return "exec plugin " + argv[0] + " not on PATH: " + err.Error() + "\n"
 	}
-	cmd := exec.Command(bin, argv[1:]...) //nolint:gosec // argv comes from the kubeconfig this test wrote
+	cmd := exec.Command(bin, argv[1:]...)
 	cmd.Env = append(os.Environ(), k.AWSEnv...)
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout, cmd.Stderr = &stdout, &stderr
diff --git a/tests/e2e/harness/registry.go b/tests/e2e/harness/registry.go
index 0d1acfd1c..68cc24921 100644
--- a/tests/e2e/harness/registry.go
+++ b/tests/e2e/harness/registry.go
@@ -55,7 +55,7 @@ func NewSkopeo(t *testing.T, dockerConfig string) *ExternalCLI {
 // Run executes the client with args and returns combined output. Errors are
 // returned (not fatal) so callers can assert on output or poll.
 func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	var buf bytes.Buffer
 	cmd.Stdout = &buf
@@ -78,7 +78,7 @@ func (c *ExternalCLI) Run(timeout time.Duration, args ...string) (string, error)
 // RunStdin is Run with data piped to the process stdin (docker login
 // --password-stdin).
 func (c *ExternalCLI) RunStdin(timeout time.Duration, stdin string, args ...string) (string, error) {
-	cmd := exec.Command(c.Bin, args...) //nolint:gosec // bin is LookPath-resolved, args test-controlled
+	cmd := exec.Command(c.Bin, args...)
 	cmd.Env = append(os.Environ(), c.Env...)
 	cmd.Stdin = strings.NewReader(stdin)
 	var buf bytes.Buffer
diff --git a/tests/e2e/harness/system_account.go b/tests/e2e/harness/system_account.go
index 9173de656..45b0f4ff6 100644
--- a/tests/e2e/harness/system_account.go
+++ b/tests/e2e/harness/system_account.go
@@ -35,7 +35,7 @@ func SystemAWSClient(t *testing.T, env *Env) *AWSClient {
 		t.Fatalf("SystemAWSClient: no config dir located; set SPINIFEX_CONFIG_DIR")
 	}
 	path := filepath.Join(env.ConfigDir, systemCredentialsFile)
-	out, err := exec.Command("sudo", "-n", "cat", path).Output() //nolint:gosec // path is env-derived, not caller input
+	out, err := exec.Command("sudo", "-n", "cat", path).Output()
 	if err != nil {
 		t.Fatalf("SystemAWSClient: sudo -n cat %s: %v", path, err)
 	}
diff --git a/tests/integration/predastore_test.go b/tests/integration/predastore_test.go
index 12ac2b6e0..feae0ce87 100644
--- a/tests/integration/predastore_test.go
+++ b/tests/integration/predastore_test.go
@@ -90,7 +90,7 @@ func predastoreS3Client(t *testing.T, fixture *testpredastore.Fixture) *s3.S3 {
 	t.Helper()
 	httpClient := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // self-signed cert generated by this same fixture, localhost-only
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		},
 	}
 	sess, err := session.NewSession(&aws.Config{