fix: critical defects and add comprehensive test coverage

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 jobs:
   test:
@@ -69,7 +69,11 @@ jobs:
 
     - name: Run tests
       run: |
-        go test -v -race -coverprofile=coverage.out -covermode=atomic ./pkg/...
+        # The whole module: ./pkg/... alone skips the LangGraph conformance
+        # suite and the Studio end-to-end suite under ./test/....
+        go test -v -race -timeout 15m \
+          -coverpkg=./pkg/... -coverprofile=coverage.out -covermode=atomic \
+          ./...
       env:
         POSTGRES_HOST: localhost
         POSTGRES_PORT: 5432
@@ -79,6 +83,28 @@ jobs:
         REDIS_HOST: localhost
         REDIS_PORT: 6379
 
+    - name: Fuzz smoke test
+      run: |
+        # A short run of each target: enough to catch a regression that makes a
+        # fuzz target crash immediately, without lengthening CI.
+        set -e
+        for pkg_target in \
+          "./pkg/core FuzzStateJSONRoundTrip" \
+          "./pkg/core FuzzStateMarshalUnmarshal" \
+          "./pkg/core FuzzDeepCopy" \
+          "./pkg/core FuzzGraphRouting" \
+          "./pkg/core FuzzGraphConstruction" \
+          "./pkg/tools FuzzToolArguments" \
+          "./pkg/tools FuzzPathResolution" \
+          "./pkg/tools FuzzCommandPolicy" \
+          "./pkg/tools FuzzURLPolicy" \
+          "./pkg/server FuzzAPIRequestBodies" \
+          "./pkg/server FuzzAPIPaths" ; do
+          set -- $pkg_target
+          echo "fuzzing $2 in $1"
+          go test -run '^$' -fuzz "^$2$" -fuzztime=20s "$1"
+        done
+
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v4
       with:
@@ -245,7 +271,7 @@ jobs:
 
     - name: Run integration tests
       run: |
-        go test -v -tags=integration ./test/e2e/...
+        go test -v -race -timeout 15m ./test/e2e/...
       env:
         POSTGRES_HOST: localhost
         POSTGRES_PORT: 5432

.github/workflows/docs.yml

@@ -24,7 +24,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 jobs:
   build:

.github/workflows/pre-commit.yml

@@ -12,7 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 jobs:
   pre-commit:
@@ -118,7 +118,7 @@ jobs:
       continue-on-error: true
 
     - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@0.25.0
+      uses: aquasecurity/trivy-action@v0.36.0
       with:
         scan-type: 'fs'
         scan-ref: '.'

.github/workflows/release.yml

@@ -23,7 +23,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 

.gitignore

@@ -6,6 +6,18 @@ bin/
 *.so
 *.dylib
 
+# Compiled example binaries. These were previously committed, adding ~100 MB of
+# platform-specific artifacts to every clone that could silently drift from the
+# source they were built from. Build them with `go build ./...` in the example.
+/examples/*/[0-9][0-9]-*
+!/examples/*/[0-9][0-9]-*/
+/examples/01-basic-chat/basic-chat
+/examples/02-react-agent/react-agent
+/examples/07-tools-integration/tools-integration
+/examples/08-production-ready/production-ready
+/examples/09-workflow-graph/workflow-graph
+/examples/streaming-demo/streaming-demo
+
 # Test binary, built with `go test -c`
 *.test
 

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.23.10-alpine AS builder
+FROM golang:1.25.13-alpine AS builder
 
 # Set working directory
 WORKDIR /app
@@ -47,9 +47,14 @@ USER golanggraph
 # Expose port (adjust as needed)
 EXPOSE 8080
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD ./golanggraph health || exit 1
+# Health check.
+#
+# Probes the server's own endpoint rather than running a local dependency
+# scan: the container is healthy when it is serving. A plain "health" run
+# reports on dependencies, which is a different question and would mark a
+# perfectly serving container unhealthy whenever an optional one is absent.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ["./golanggraph", "health", "--server", "http://127.0.0.1:8080"]
 
 # Run the binary
 ENTRYPOINT ["./golanggraph"]

Dockerfile.agent

@@ -1,5 +1,5 @@
 # Production Dockerfile for GoLangGraph Agent
-FROM golang:1.23.10-alpine AS builder
+FROM golang:1.25.13-alpine AS builder
 
 # Set working directory
 WORKDIR /app
@@ -37,12 +37,10 @@ WORKDIR /app
 # Copy the binary from builder stage
 COPY --from=builder /app/golanggraph-agent .
 
-# Copy configuration files
-COPY configs/ ./configs/
-COPY static/ ./static/
-
-# Create necessary directories and change ownership to non-root user
-RUN mkdir -p ./logs ./data && \
+# Create the directories the server may use. These were previously COPY'd from
+# configs/ and static/, which do not exist in the repository, so this image
+# could not be built at all. Mount or bake in real configuration as needed.
+RUN mkdir -p ./configs ./static ./logs ./data && \
     chown -R golanggraph:golanggraph /app
 
 # Switch to non-root user
@@ -51,9 +49,13 @@ USER golanggraph
 # Expose port
 EXPOSE 8080
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD ./golanggraph-agent health || exit 1
+# Health check.
+#
+# Probes the server's own endpoint: the container is healthy when it is
+# serving. A local dependency scan is a different question and would mark a
+# perfectly serving container unhealthy whenever an optional service is absent.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD ["./golanggraph-agent", "health", "--server", "http://127.0.0.1:8080"]
 
 # Run the agent
 ENTRYPOINT ["./golanggraph-agent"]

README.md

@@ -173,6 +173,26 @@ if err != nil {
 fmt.Printf("🔄 Graph Result: %v\n", result.Get("response"))
 ```
 
+## 🔒 Production Deployment
+
+Defaults favour local development. Before exposing GoLangGraph to real traffic,
+read **[docs/PRODUCTION.md](docs/PRODUCTION.md)**, which covers:
+
+- **Authentication and CORS** — `RequireAuth` is off by default, and the allowed-origin list also governs WebSocket upgrades.
+- **Tool sandboxing** — filesystem confinement, the shell allowlist, and SSRF protection for the HTTP tool.
+- **Durable execution** — checkpointing, resume after a crash, and human-in-the-loop interrupts.
+- **Health checking** — which probe belongs in a container, and which does not.
+- **Typed errors, retries, concurrency and observability.**
+
+LangGraph compatibility, including the places GoLangGraph intentionally
+differs, is documented in
+**[test/conformance/DEVIATIONS.md](test/conformance/DEVIATIONS.md)** and
+enforced by the conformance suite:
+
+```bash
+go test -race ./test/conformance/...
+```
+
 ## 🏗️ Architecture
 
 GoLangGraph follows a modular architecture: