chore: deploy-audit cleanup (drop fictional binary scaffolding, fix version embed)

.github/workflows/ci.yml

@@ -166,7 +166,7 @@ jobs:
         run: git clone --depth=1 https://github.com/GrayCodeAI/tok.git ../tok
       - name: deadcode
         run: |
-          go install golang.org/x/tools/cmd/deadcode@latest
+          go install golang.org/x/tools/cmd/deadcode@v0.30.0
           deadcode ./... 2>&1 | head -50
 
   # -------------------------------------------------------------------------

CHANGELOG.md

@@ -10,10 +10,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - **Version re-baselined to `0.1.0`** across `internal/server/mcp.go`
   (advertised MCP server version), `sdk/python/pyproject.toml`,
-  `sdk/typescript/package.json`, `Formula/yaad.rb` (formula `version`
-  + every release-asset URL), and `openapi.yaml` (header `version` and
-  the `/yaad/health` example). Aligns yaad with the rest of the
+  `sdk/typescript/package.json`, and `api/openapi.yaml` (header `version`
+  and the `/yaad/health` example). Aligns yaad with the rest of the
   hawk-eco ecosystem (`hawk`, `tok`, `eyrie`, `sight`, `inspect`).
+- **`internal/version`**: `Version` is now read at compile time via
+  `go:embed` from `internal/version/VERSION` (kept in sync with the root
+  `VERSION` via `make sync-version`). Previously hard-coded to `"dev"`
+  and only overrideable through ldflags that no build path was actually
+  setting — so every build reported `dev` regardless of the VERSION
+  file. Pure `go build` / `go install` / `go get` now report the
+  correct version with zero ldflags wiring required.
+
+### Removed
+- **`install.sh`** — fetched `yaad_${OS}_${ARCH}` from GitHub Releases and
+  ran `yaad auto`. yaad is library-only (no `cmd/`, no `package main`, no
+  goreleaser config); there is no such binary or subcommand.
+- **`Formula/yaad.rb`** — Homebrew formula pointed at
+  `releases/download/v0.2.0/yaad_<os>_<arch>` artifacts that have never
+  been published, ran `yaad --version` against a binary that does not
+  exist, and was still pinned at `0.2.0` while the rest of the repo
+  re-baselined to `0.1.0`. Will return once a binary actually ships.
+- **`deploy/docker/docker-compose.yml`** + **`.dockerignore`** —
+  referenced a `Dockerfile` that does not exist in the repo. yaad is a
+  library; consumers wire `internal/server/RESTServer` into their own
+  daemons (or use `hawk daemon`).
 
 ### Security
 - **Stop tracking `.yaad/integrity.key`** — this is a per-installation

Makefile

@@ -8,9 +8,12 @@ NAME      := yaad
 
 # ---------------------------------------------------------------------------
 # Versioning — sourced from VERSION file; falls back to git describe.
-# See https://github.com/GrayCodeAI/hawk/blob/main/VERSIONING.md.
+# See https://github.com/GrayCodeAI/hawk/blob/main/docs/versioning.md.
 # yaad is library-only: it ships no binary, so there is no goreleaser config
-# and no ldflags to inject. VERSION is exposed only via `make version`.
+# and no ldflags to inject the version. The runtime `version.Version`
+# constant is read at compile time via `go:embed` from
+# `internal/version/VERSION` (kept in sync with the root VERSION via
+# `make sync-version`). `make version` just echoes what `go:embed` will see.
 # ---------------------------------------------------------------------------
 VERSION ?= $(shell cat VERSION 2>/dev/null | head -n1 | tr -d '[:space:]' || git describe --tags --always --dirty 2>/dev/null || echo "dev")
 COMMIT  := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
@@ -29,7 +32,7 @@ GOVULNCHECK  := $(GOBIN_DIR)/govulncheck
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
 .PHONY: all bench build ci clean cover fmt help lint lint-fix \
-        security test test-10x test-race tidy version vet
+        security sync-version test test-10x test-race tidy version vet
 
 # ---------------------------------------------------------------------------
 # Default target.
@@ -91,6 +94,10 @@ tidy: ## Tidy go.mod / go.sum.
 	go mod tidy
 	go mod verify
 
+sync-version: ## Copy root VERSION into internal/version/VERSION (kept in sync for go:embed).
+	@cp VERSION internal/version/VERSION
+	@echo "internal/version/VERSION updated to $$(cat VERSION)"
+
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------

internal/version/VERSION

@@ -0,0 +1 @@
+0.1.0

internal/version/version.go

@@ -1,34 +1,43 @@
-// Package version provides the canonical version string for the yaad binary.
+// Package version provides the canonical version string for yaad.
 //
-// Single source of truth: the VERSION file at the repo root. To bump the
-// version, edit that one file. Both build paths read it and inject these vars
-// at build time via ldflags (the package path and var names below must match
-// in all callers — Makefile and .goreleaser.yml):
+// Single source of truth: the VERSION file at the repo root, which is
+// kept in sync with the co-located internal/version/VERSION via the
+// `make tidy` target (or `release-please`, which bumps both atomically).
 //
-//		go build -ldflags " \
-//		  -X github.com/GrayCodeAI/yaad/internal/version.Version=$(cat VERSION) \
-//		  -X github.com/GrayCodeAI/yaad/internal/version.Commit=$(git rev-parse --short HEAD) \
-//		  -X github.com/GrayCodeAI/yaad/internal/version.Date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+// The co-located VERSION file is embedded at compile time via `go:embed`,
+// so `go build`, `go install`, and `go get` all see the correct version
+// with zero ldflags wiring required. Release builds (goreleaser, or
+// `make build` if a binary is ever added) may additionally inject a
+// short commit + build date through ldflags:
 //
-//	  - `make build` reads VERSION (see the Makefile's VERSION/LDFLAGS).
-//	  - Goreleaser injects {{.Version}} from the git tag during release builds.
+//	go build -ldflags " \
+//	  -X github.com/GrayCodeAI/yaad/internal/version.Commit=$(git rev-parse --short HEAD) \
+//	  -X github.com/GrayCodeAI/yaad/internal/version.Date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 //
-// The defaults below ("dev", "none", "unknown") apply only to local builds
-// without ldflags so a fresh `go build` still produces a runnable binary.
+// Do NOT edit Version directly — bump the root VERSION file and resync
+// the co-located one (or let release-please/goreleaser do it).
 package version
 
 import (
+	_ "embed"
 	"fmt"
 	"runtime"
+	"strings"
 )
 
-// Version is the current version of yaad. Set via ldflags at release time.
-var Version = "dev"
+//go:embed VERSION
+var versionFile string
 
-// Commit is the git commit short SHA. Set via ldflags at release time.
+// Version is the current version of yaad, embedded from the VERSION file
+// at compile time.
+var Version = strings.TrimSpace(versionFile)
+
+// Commit is the git commit short SHA. Set via ldflags at release time;
+// defaults to "none" for plain `go build`.
 var Commit = "none"
 
-// Date is the build date in RFC3339. Set via ldflags at release time.
+// Date is the build date in RFC3339. Set via ldflags at release time;
+// defaults to "unknown" for plain `go build`.
 var Date = "unknown"
 
 // String returns just the version string (kept for backwards compatibility