feat(tok): production hardening (#33)

* feat(tok): production hardening — strict linting, errcheck fixes, dead code removal

- Strengthened golangci-lint config: added errcheck, gocritic, unused, unconvert, whitespace, bodyclose, noctx
- Fixed all errcheck issues in production code (db.Close, rows.Close, os.Remove, fmt.Sscanf)
- Removed dead code: unused separatorLevels var, unused reportProgress func
- Fixed ineffectual assignments in log_fold_compress.go and position_aware.go
- Fixed SA4010-style dead code (traceBuffer assigned but never read)
- Added .github/dependabot.yml for automated dependency updates

* feat(tok): re-baseline to v0.2.0 + OSS standards (PR/issue templates)

Re-baselines tok's version to 0.2.0 across every authoritative location and
adds the top-50 OSS standard files that were missing.

Version 0.2.0 set in:
  - .release-please-manifest.json (".": "0.2.0")
  - CITATION.cff (version + date-released)
  - scripts/install.sh (USAGE comment example, --version flag help)

Aligns tok with the rest of the hawk-eco ecosystem (hawk, eyrie, yaad,
sight, inspect).

CHANGELOG.md gains an [Unreleased] section that captures both this
re-baseline and the production-hardening pass already on this branch
(strict golangci v2 config, errcheck fixes across internal/cache,
internal/filter, internal/utils, dead-code removal). Historical
release-please entries are preserved verbatim.

New top-level OSS files:
  - .github/PULL_REQUEST_TEMPLATE.md — Summary / Changes /
    Compression-impact (with bench output) / Testing / Checklist
  - .github/ISSUE_TEMPLATE/bug_report.yml — structured bug report,
    includes a slot for a minimal compression-input sample
  - .github/ISSUE_TEMPLATE/feature_request.yml — feature request with
    a 'kind' selector (filter / pipeline / CLI / library / integration /
    tooling) and solo-dev fit checks
  - .github/ISSUE_TEMPLATE/config.yml — routes security to advisories,
    questions to discussions, blocks blank issues

Cleanup:
  - gofmt -w on internal/filter/position_aware.go and progress.go to
    remove residual blank-line drift left by the dead-code removal in
    the prior commit

Verification:
  - `go build ./...` clean
  - `go vet ./...` clean
  - `go test -race -count=1 -timeout=120s -short` passes on the root
    package and all internal/* packages (cache, config, core, filter,
    simd, utils)
  - `gofmt -l .` clean — entire repo is now gofmt-clean.

* fix(tok): fix QueryCache Cleanup time format mismatch

SQLite CURRENT_TIMESTAMP uses 'YYYY-MM-DD HH:MM:SS' format but Cleanup
was comparing with RFC3339 ('YYYY-MM-DDTHH:MM:SSZ'), causing the WHERE
clause to never match entries. Fixed to use matching SQLite time format.

* chore: standardize eco-wide infra (versioning, CI, hooks, templates)

- VERSION file as single source of truth
- CODEOWNERS for auto-review routing
- Canonical Makefile with standard targets
- release-please config + workflow
- lefthook/pre-commit hooks (conventional commits, fmt, lint, secrets)
- Canonical CI + release GitHub Actions workflows
- Standardized .editorconfig, .gitattributes, CODE_OF_CONDUCT, SECURITY, CONTRIBUTING
- goreleaser config (where applicable)

Part of hawk-eco standardization sweep.

* feat(tok): add structured compaction schema for LLM-based context compression

5-field schema (task_overview, current_state, important_discoveries,
next_steps, context_to_preserve) with prompt builder and response parser.

* feat(tok): add structured compaction schema in Go

5-field CompactionSchema (TaskOverview, CurrentState, ImportantDiscoveries,
NextSteps, ContextToPreserve) with BuildCompactionPrompt and
ParseCompactionResponse for LLM-based context compression.

Replaces mistaken .py file with proper Go implementation.

Author: Patel230

.editorconfig

@@ -1,9 +1,9 @@
-# EditorConfig - https://editorconfig.org
-# Consistent coding styles across editors and IDEs
+# EditorConfig — https://editorconfig.org
+# Canonical eco-wide template (.shared-templates/editorconfig.tmpl).
 
 root = true
 
-# Default settings for all files
+# Default for everything.
 [*]
 charset = utf-8
 end_of_line = lf
@@ -12,55 +12,56 @@ trim_trailing_whitespace = true
 indent_style = space
 indent_size = 4
 
-# Go files - tabs per Go convention
+# Go uses tabs by convention.
 [*.go]
 indent_style = tab
 indent_size = 4
 
-# YAML files
+# Python — PEP 8.
+[*.py]
+indent_size = 4
+
+# TypeScript / JavaScript — 2 spaces, ecosystem default.
+[*.{ts,tsx,js,jsx,mjs,cjs}]
+indent_size = 2
+
+# Web assets.
+[*.{html,css,scss}]
+indent_size = 2
+
+# YAML — 2 spaces (ecosystem standard, GitHub Actions, k8s, etc.).
 [*.{yml,yaml}]
 indent_size = 2
 
-# TOML files
-[*.toml]
+# JSON / JSONC.
+[*.{json,jsonc}]
 indent_size = 2
 
-# JSON files
-[*.json]
+# TOML.
+[*.toml]
 indent_size = 2
 
-# Markdown files
+# Markdown — 2 spaces, preserve trailing whitespace (used for line breaks).
 [*.md]
 trim_trailing_whitespace = false
 indent_size = 2
 
-# Shell scripts
-[*.sh]
+# Shell scripts.
+[*.{sh,bash,zsh,fish}]
 indent_size = 4
 
-# Makefiles - must use tabs
-[Makefile]
-indent_style = tab
-
-[*.mk]
+# Makefiles must use tabs.
+[{Makefile,*.mk}]
 indent_style = tab
 
-# Docker files
+# Dockerfiles.
 [Dockerfile*]
 indent_size = 4
 
-# GitHub Actions
-[.github/**/*.yml]
+# GitHub Actions workflows — 2 spaces.
+[.github/**/*.{yml,yaml}]
 indent_size = 2
 
-# Config files
+# Config files.
 [*.{cfg,ini,conf}]
 indent_size = 4
-
-# HTML/CSS/JS (for dashboard)
-[*.{html,css,js,ts}]
-indent_size = 2
-
-# Git config
-[.git*]
-indent_size = 4

.gitattributes

@@ -1,76 +1,86 @@
-# Auto detect text files and perform LF normalization
-* text=auto eol=lf
-
-# Go source files
-*.go text eol=lf diff=golang
-
-# Shell scripts
-*.sh text eol=lf
+# Canonical eco-wide .gitattributes template (.shared-templates/gitattributes.tmpl).
+# Auto-detect text files and normalise line endings to LF.
 
-# Makefiles
-Makefile text eol=lf
+* text=auto eol=lf
 
-# Documentation
-*.md text eol=lf diff=markdown
-*.txt text eol=lf
+# --- Source code -----------------------------------------------------------
+*.go     text eol=lf diff=golang
+*.py     text eol=lf diff=python
+*.ts     text eol=lf
+*.tsx    text eol=lf
+*.js     text eol=lf
+*.jsx    text eol=lf
+*.mjs    text eol=lf
+*.cjs    text eol=lf
+*.rs     text eol=lf diff=rust
 
-# Config files
-*.toml text eol=lf
-*.yaml text eol=lf
-*.yml text eol=lf
-*.json text eol=lf linguist-language=JSON
-*.cff text eol=lf
+# --- Shell + config --------------------------------------------------------
+*.sh     text eol=lf
+*.bash   text eol=lf
+*.toml   text eol=lf
+*.yaml   text eol=lf
+*.yml    text eol=lf
+*.json   text eol=lf linguist-language=JSON
+*.jsonc  text eol=lf linguist-language=JSON
+*.cff    text eol=lf
 
-# Go module files
-go.mod text eol=lf linguist-generated
-go.sum text eol=lf linguist-generated
+# --- Documentation ---------------------------------------------------------
+*.md     text eol=lf diff=markdown
+*.txt    text eol=lf
 
-# Docker
-Dockerfile text eol=lf
+# --- Build / packaging ----------------------------------------------------
+Makefile        text eol=lf
+*.mk            text eol=lf
+Dockerfile*     text eol=lf
 docker-compose*.yml text eol=lf
+.github/**/*.yml    text eol=lf
+.github/**/*.yaml   text eol=lf
 
-# GitHub Actions
-.github/**/*.yml text eol=lf
-
-# Binary files
-*.exe binary
-*.dll binary
-*.so binary
-*.dylib binary
-*.db binary
-*.sqlite binary
-*.png binary
-*.jpg binary
-*.jpeg binary
-*.gif binary
-*.ico binary
-*.pdf binary
-*.zip binary
-*.tar.gz binary
-*.tgz binary
+# --- Generated artefacts (mark as such for diffs and language stats) ------
+go.mod          text eol=lf linguist-generated
+go.sum          text eol=lf linguist-generated
+*.pb.go         linguist-generated
+*_generated.go  linguist-generated
+package-lock.json   linguist-generated
+pnpm-lock.yaml      linguist-generated
+yarn.lock           linguist-generated
 
-# Test data
-tests/testdata/** linguist-vendored
+# --- Vendored / external sources ------------------------------------------
+vendor/**       linguist-vendored
+node_modules/** linguist-vendored
+testdata/**     linguist-vendored
 benchmarks/data/** linguist-vendored
-OSS-REF/** linguist-vendored
-
-# Vendor (if used)
-vendor/** linguist-vendored
 
-# Generated files
-*_generated.go linguist-generated
-*.pb.go linguist-generated
+# --- Binary files (do not text-normalise) ---------------------------------
+*.exe    binary
+*.dll    binary
+*.so     binary
+*.dylib  binary
+*.a      binary
+*.o      binary
+*.db     binary
+*.sqlite binary
+*.png    binary
+*.jpg    binary
+*.jpeg   binary
+*.gif    binary
+*.ico    binary
+*.svg    text eol=lf
+*.pdf    binary
+*.zip    binary
+*.tar.gz binary
+*.tgz    binary
+*.whl    binary
 
-# Export ignore (not included in source archives)
-.github export-ignore
-.gitattributes export-ignore
-.gitignore export-ignore
-.editorconfig export-ignore
-.golangci.yml export-ignore
-OSS-REF/ export-ignore
-benchmarks/ export-ignore
-tests/ export-ignore
-docs/DEEP_COMPETITIVE_ANALYSIS.md export-ignore
-docs/COMPREHENSIVE_OSS_COMPETITORS.md export-ignore
-docs/COMPETITOR_SUMMARY.md export-ignore
-MASTER_TASK_LIST.md export-ignore
+# --- Source archive hygiene (excluded from `git archive`) -----------------
+.github         export-ignore
+.shared-templates export-ignore
+.gitattributes  export-ignore
+.gitignore      export-ignore
+.editorconfig   export-ignore
+.golangci.yml   export-ignore
+.goreleaser.yml export-ignore
+.goreleaser.yaml export-ignore
+testdata/       export-ignore
+benchmarks/     export-ignore
+e2e/            export-ignore

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+name: Bug report
+description: Something is broken or behaving unexpectedly.
+title: "bug: <one-line summary>"
+labels: ["bug", "triage"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report. Please fill in as much
+        of the form as you can — the more we know, the faster we can fix it.
+
+        Before submitting:
+        - Search [existing issues](https://github.com/GrayCodeAI/tok/issues) to avoid duplicates.
+        - If this is a security issue, please **do not** file a public issue. See `SECURITY.md`.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear, concise description of the bug.
+      placeholder: When I run `tok ...` (or call `tok.Compress(...)`), I expected X but got Y.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps that reliably reproduce the problem.
+      placeholder: |
+        1. Run `tok ...`
+        2. Pipe in `...`
+        3. See output `...` (expected `...`)
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: input-sample
+    attributes:
+      label: Minimal input sample (if compression-related)
+      description: |
+        If the bug is about compression output / ratio / a specific filter, paste a small,
+        self-contained input that reproduces it. **Redact any secrets, tokens, or private data first.**
+      render: text
+
+  - type: input
+    id: tok-version
+    attributes:
+      label: tok version
+      description: Output of `tok --version` or the git SHA you built from.
+      placeholder: "0.2.0"
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      description: e.g. macOS 14.5 (arm64), Ubuntu 24.04 (amd64), Windows 11 (amd64).
+      placeholder: "macOS 14.5 (arm64)"
+    validations:
+      required: true
+
+  - type: input
+    id: go-version
+    attributes:
+      label: Go version (if building from source)
+      description: Output of `go version`. Skip if you installed a pre-built binary.
+      placeholder: "go version go1.26.1 darwin/arm64"
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / output
+      description: |
+        Paste any relevant output. Re-run with `--verbose` if applicable.
+        **Redact any secrets, tokens, or private data first.**
+      render: shell
+
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Confirmation
+      options:
+        - label: I searched existing issues and did not find a duplicate.
+          required: true
+        - label: I redacted any secrets, API keys, or private data from logs.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/GrayCodeAI/tok/security/advisories/new
+    about: Please report security issues privately via a GitHub Security Advisory. See SECURITY.md.
+  - name: Question / discussion
+    url: https://github.com/GrayCodeAI/tok/discussions
+    about: Have a question or want to discuss an idea? Open a discussion instead of an issue.