fix: address security, UX, and hygiene findings from codebase audit

.github/workflows/ci.yaml

@@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Verify go.mod is tidy
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: Build
+        run: go build ./...
+
+      - name: Test
+        run: go test -race -count=1 ./...
+
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          # v1.62.0 is built with go1.23 and refuses to lint a go1.24 module
+          # ("language version go1.23 is lower than the targeted go1.24.4");
+          # v1.64.8 is the last v1 release and is built with go1.24.
+          version: v1.64.8
+          args: --timeout=5m

.gitignore

@@ -1,3 +1,15 @@
+# Compiled binary at repo root (local builds; the release workflow ships
+# platform binaries via GitHub releases).
+/bedrock
+
+# Go build artifacts and test caches
+*.test
+*.out
+coverage.*
+
+# Local notes/scratch from CLAUDE.md workflow
+tasks/
+
 # Dependencies
 docs/node_modules/
 docs/.vitepress/dist/
@@ -8,3 +20,4 @@ docs/.vitepress/cache/
 
 # IDE
 .idea/
+.vscode/

.golangci.yml

@@ -0,0 +1,24 @@
+run:
+  timeout: 5m
+  tests: true
+
+linters:
+  disable-all: true
+  enable:
+    - errcheck      # catches ignored errors (the _ = pattern in init.go etc.)
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - gofmt
+    - goimports
+    - misspell
+
+issues:
+  exclude-rules:
+    # Embedded modules.go uses ReadFile/WriteFile heavily; allow the standard
+    # ignore patterns inside test helpers if/when they appear.
+    - path: _test\.go
+      linters: [errcheck]
+  max-issues-per-linter: 0
+  max-same-issues: 0

CLAUDE.md

@@ -70,11 +70,11 @@ bedrock build --release=false
 ### Deploying Smart Contracts
 
 ```bash
-# Deploy to alphanet (default)
+# Deploy to local node (default)
 bedrock deploy
 
-# Deploy to local node
-bedrock deploy --network local
+# Deploy to alphanet (testnet)
+bedrock deploy --network alphanet
 
 # Deploy with specific wallet
 bedrock deploy --wallet <seed>
@@ -194,11 +194,13 @@ bedrock node stop
 # Check status
 bedrock node status
 
-# View logs
+# View logs (use --follow to stream, --tail N to limit)
 bedrock node logs
+bedrock node logs --follow
+bedrock node logs --tail 100
 ```
 
-The node uses the `lejamon/rippled-smart-contracts-vault:arm64` Docker image for all project types.
+The node uses the unified `lejamon/rippled_smart_contract_vault_x86` Docker image for all project types (the CLI auto-selects the right platform — `linux/arm64` on Apple Silicon, `linux/amd64` elsewhere).
 
 A ledger advancement daemon runs in the background (PID in `.bedrock/ledger-daemon.pid`).
 

README.md

@@ -17,7 +17,7 @@ Bedrock is a developer tool for building, deploying, and interacting with XRPL s
 
 Before installing Bedrock, ensure you have:
 
-- **[Go](https://go.dev/dl/)** (1.21 or later) - For building/installing Bedrock
+- **[Go](https://go.dev/dl/)** (1.24 or later) - For building/installing Bedrock
 - **[Node.js](https://nodejs.org/)** (18 or later) - For XRPL transaction handling
 - **[Rust](https://rustup.rs/)** - For compiling smart contracts
   ```bash
@@ -28,7 +28,7 @@ Before installing Bedrock, ensure you have:
 ### Verify Installation
 
 ```bash
-go version      # Should show 1.21+
+go version      # Should show 1.24+
 node --version  # Should show v18+
 rustc --version # Should show 1.70+
 cargo --version
@@ -48,8 +48,8 @@ This auto-detects your OS and architecture, downloads the latest release binary,
 
 ```bash
 # Clone the repository
-git clone https://github.com/xrpl-bedrock/bedrock.git
-cd bedrock
+git clone https://github.com/XRPL-Commons/Bedrock.git
+cd Bedrock
 
 # Build and install
 go build -o bedrock cmd/bedrock/main.go
@@ -173,8 +173,8 @@ bedrock deploy --wallet sXXX...     # Use specific wallet
 
 ```bash
 bedrock call <contract> <function> \
-  --wallet sXXX...                  # Wallet seed (required)
-  --network alphanet                # Network (default: alphanet)
+  --wallet sXXX...                  # Wallet seed or jade keystore name (required)
+  --network local                   # Network (default: local; use alphanet for testnet)
   --params '{"key":"value"}'        # JSON parameters
   --params-file params.json         # Parameters from file
   --gas 1000000                     # Computation allowance
@@ -184,10 +184,12 @@ bedrock call <contract> <function> \
 ### Node Management
 
 ```bash
-bedrock node start    # Start local XRPL node
-bedrock node stop     # Stop local node
-bedrock node status   # Check if running
-bedrock node logs     # View node logs (coming soon)
+bedrock node start             # Start local XRPL node
+bedrock node stop              # Stop local node
+bedrock node status            # Check if running
+bedrock node logs              # Print recent node logs
+bedrock node logs --follow     # Stream logs (like `docker logs -f`)
+bedrock node logs --tail 100   # Show only the last N lines
 ```
 
 ## Project Configuration
@@ -360,7 +362,7 @@ bedrock init my-project
 Contributions are welcome! Please check out:
 - [CONTRIBUTING.md](CONTRIBUTING.md) - Contribution guidelines
 - [BRANDING.md](BRANDING.md) - Design philosophy
-- [Issues](https://github.com/xrpl-bedrock/bedrock/issues) - Bug reports & features
+- [Issues](https://github.com/XRPL-Commons/Bedrock/issues) - Bug reports & features
 
 ## Roadmap
 

docs/guide/commands-reference.md

@@ -101,7 +101,7 @@ bedrock deploy [flags]
 
 | Flag | Short | Description | Default |
 |------|-------|-------------|---------|
-| `--network` | `-n` | Target network (local, alphanet) | `alphanet` |
+| `--network` | `-n` | Target network (local, alphanet) | `local` |
 | `--wallet` | `-w` | Wallet seed or jade name | Auto-generated |
 | `--skip-build` | | Skip automatic contract rebuild | `false` |
 | `--skip-abi` | | Skip ABI generation | `false` |
@@ -111,8 +111,8 @@ bedrock deploy [flags]
 **Transaction fee:** 100 XRP (100,000,000 drops)
 
 ```bash
-bedrock deploy                          # Deploy to alphanet
-bedrock deploy --network local          # Deploy to local node
+bedrock deploy                          # Deploy to local node (default)
+bedrock deploy --network alphanet       # Deploy to alphanet (testnet)
 bedrock deploy --wallet sEd7...         # Use specific wallet
 bedrock deploy --skip-build             # Skip rebuild
 ```
@@ -133,7 +133,7 @@ bedrock call <contract> <function> [flags]
 | Flag | Short | Description | Default |
 |------|-------|-------------|---------|
 | `--wallet` | `-w` | Wallet seed or jade name (required) | - |
-| `--network` | `-n` | Target network | `alphanet` |
+| `--network` | `-n` | Target network | `local` |
 | `--params` | `-p` | JSON string of function parameters | - |
 | `--params-file` | `-f` | Path to JSON file with parameters | - |
 | `--gas` | `-g` | Computation allowance | `1000000` |
@@ -308,10 +308,12 @@ The node uses the `lejamon/rippled_smart_contract_vault_x86` Docker image for al
 **Requirements:** Docker must be installed and running.
 
 ```bash
-bedrock node start     # Start local node
-bedrock node status    # Check status
-bedrock node logs      # View logs
-bedrock node stop      # Stop node
+bedrock node start             # Start local node
+bedrock node status            # Check status
+bedrock node logs              # Print recent logs and exit
+bedrock node logs --follow     # Stream logs (like `docker logs -f`)
+bedrock node logs --tail 100   # Show only the last N lines
+bedrock node stop              # Stop node
 ```
 
 ## jade

docs/guide/deployment-and-calling.md

@@ -22,7 +22,7 @@ bedrock deploy [flags]
 
 | Flag | Short | Description | Default |
 |------|-------|-------------|---------|
-| `--network` | `-n` | Target network (local, alphanet) | `alphanet` |
+| `--network` | `-n` | Target network (local, alphanet) | `local` |
 | `--wallet` | `-w` | Wallet seed for signing transactions | Auto-generated |
 | `--skip-build` | | Skip automatic contract rebuild | `false` |
 | `--skip-abi` | | Skip ABI generation | `false` |
@@ -32,11 +32,11 @@ bedrock deploy [flags]
 ### Examples
 
 ```bash
-# Deploy to alphanet (default)
+# Deploy to local node (default)
 bedrock deploy
 
-# Deploy to local node
-bedrock deploy --network local
+# Deploy to alphanet (testnet)
+bedrock deploy --network alphanet
 
 # Deploy with existing wallet
 bedrock deploy --wallet sEd7...
@@ -86,7 +86,7 @@ bedrock call <contract> <function> [flags]
 | Flag | Short | Description | Default |
 |------|-------|-------------|---------|
 | `--wallet` | `-w` | Wallet seed for signing (required) | - |
-| `--network` | `-n` | Target network | `alphanet` |
+| `--network` | `-n` | Target network | `local` |
 | `--params` | `-p` | JSON string of function parameters | - |
 | `--params-file` | `-f` | Path to JSON file with parameters | - |
 | `--gas` | `-g` | Computation allowance | `1000000` |

docs/guide/getting-started.md

@@ -8,15 +8,15 @@ Before installing Bedrock, ensure you have the following tools:
 
 | Tool | Version | Purpose |
 |------|---------|---------|
-| [Go](https://go.dev/dl/) | 1.21+ | Building Bedrock from source |
+| [Go](https://go.dev/dl/) | 1.24+ | Building Bedrock from source |
 | [Node.js](https://nodejs.org/) | 18+ | XRPL transaction handling |
 | [Rust](https://rustup.rs/) | 1.70+ | Compiling smart contracts |
 | [Docker](https://www.docker.com/) | Latest | Local XRPL node (optional) |
 
 ### Verify Prerequisites
 
 ```bash
-go version      # Should show 1.21+
+go version      # Should show 1.24+
 node --version  # Should show v18+
 rustc --version # Should show 1.70+
 cargo --version

docs/guide/local-node.md

@@ -6,7 +6,7 @@ Bedrock manages local XRPL nodes using Docker, providing a fast development envi
 
 Bedrock's local node functionality wraps Docker to run a local XRPL node (rippled). It auto-detects your project type and configures the node accordingly:
 
-- **All project types** — Uses the unified `lejamon/rippled_smart_contract_vault_x86` image
+- **All project types** — Uses the unified `lejamon/rippled_smart_contract_vault_x86` image; the CLI auto-selects `linux/arm64` on Apple Silicon and `linux/amd64` elsewhere
 
 All project types get:
 
@@ -77,12 +77,20 @@ Endpoints:
 
 ### `bedrock node logs`
 
-View node container logs.
+View node container logs. Reads directly from the Docker container's
+stdout/stderr.
 
 ```bash
-bedrock node logs
+bedrock node logs              # print all current logs and exit
+bedrock node logs --follow     # stream new lines as they arrive (Ctrl-C to stop)
+bedrock node logs --tail 100   # only the last 100 lines
 ```
 
+| Flag | Short | Description | Default |
+|------|-------|-------------|---------|
+| `--follow` | `-f` | Keep streaming after the current logs | `false` |
+| `--tail` | | Number of lines to show from the end (or `all`) | `all` |
+
 ## Configuration
 
 The local node reads its configuration from `bedrock.toml`:

docs/guide/wallet.md

@@ -7,10 +7,16 @@
 Jade provides a secure way to manage your XRPL wallets by encrypting them and storing them on disk. This means you don't have to expose your wallet seeds in your command-line history or scripts.
 
 **Security features:**
-- AES-256-GCM encryption with PBKDF2 key derivation
+- AES-256-GCM encryption with PBKDF2-HMAC-SHA256 key derivation
+  (600,000 iterations, aligned with OWASP 2023 baseline)
+- Per-keystore iteration count, so future tightening of KDF parameters
+  does not break existing wallets
 - Password-protected access
 - Supports secp256k1 and ed25519 algorithms
-- Stored in `~/.config/bedrock/wallets/`
+- Stored in `~/.config/bedrock/wallets/` (directory mode `0700`,
+  keystore files `0600`)
+- Wallet names like `swap-vault` (starting with `s`) are resolved as
+  keystore lookups, not raw seeds, in every `--wallet` flag
 
 ## Commands
 

docs/index.md

@@ -96,7 +96,7 @@ bedrock CLI (Go)
 
 Before installing Bedrock, ensure you have:
 
-- **[Go](https://go.dev/dl/)** (1.21 or later) - For building Bedrock from source
+- **[Go](https://go.dev/dl/)** (1.24 or later) - For building Bedrock from source
 - **[Node.js](https://nodejs.org/)** (18 or later) - For XRPL transaction handling
 - **[Rust](https://rustup.rs/)** - For compiling smart contracts
 - **[Docker](https://www.docker.com/)** (optional) - For running a local XRPL node

embedded/modules.go

@@ -16,9 +16,8 @@ import (
 var ModulesFS embed.FS
 
 var (
-	setupMu    sync.Mutex
-	setupDone  map[string]string // group -> cacheDir
-	setupError error
+	setupMu   sync.Mutex
+	setupDone map[string]string // group -> cacheDir
 )
 
 const (
@@ -148,7 +147,9 @@ func extractAndInstall(cacheDir string, modules []moduleFile) error {
 			return fmt.Errorf("failed to read %s: %w", m.EmbedPath, err)
 		}
 		outPath := filepath.Join(cacheDir, m.CacheName)
-		if err := os.WriteFile(outPath, data, 0755); err != nil {
+		// Modules are invoked via `node <path>`, never executed directly,
+		// so they do not need the executable bit.
+		if err := os.WriteFile(outPath, data, 0644); err != nil {
 			return fmt.Errorf("failed to write %s: %w", m.CacheName, err)
 		}
 	}