chore: drop Homebrew + delete stale Java-era docs (CLI + MCP only) (#138)

* chore: drop Homebrew + delete stale Java-era docs (CLI + MCP only)

Three changes per the post-v0.3.0 cleanup goal:

## 1. Homebrew dropped

- .goreleaser.yml: remove `brews:` block.
- release-go.yml: remove HOMEBREW_TAP_OWNER/REPO/GITHUB_TOKEN env.
- README.md: remove the `### Homebrew` install section.
- shared/runbooks/release-go.md: remove `## Homebrew tap` section and
  related cross-references.
- CHANGELOG.md / CLAUDE.md: scrub Homebrew mentions.

Not pursuing a tap — pre-built binaries from Releases + Cosign-verified
checksums cover the install surface. Saves repo creation + PAT churn.

## 2. Stale Java-era docs deleted

The entire `docs/project/` tree (architecture.md, conventions.md,
data-model.md, flows.md, ui.md, build-and-run.md) referenced Spring
Boot, application.yml, REST controllers, the React SPA, Jacoco, etc.
— all deleted in Phase 6 cutover. The content was wrong, not just
stale. CLAUDE.md is the single source of truth.

Updated PROJECT_SUMMARY.md links to point at CLAUDE.md instead.

## 3. `serve` subcommand decisively out of scope

CLAUDE.md previously said `serve: (deferred — not ported in v0.3.0)`.
Updated to state the position: codeiq has no REST API and no web UI.
Consumers use the CLI or the stdio MCP server. Java's `codeiq serve`
will not be reintroduced.

The `golang-jwt/jwt/v5` dep is transitive via the MCP SDK's auth
package (verified with `go mod why`) — not a serve-mode leftover.
CLAUDE.md note corrected.

Also drove (out-of-band) the branch-protection update:

    $ gh api -X POST .../branches/main/protection/required_status_checks/contexts \
        -f 'contexts[]=vet / test / staticcheck / gosec / govulncheck' \
        -f 'contexts[]=index perf gate (fixture-multi-lang)'

→ both Go gates now block merge on main.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: scrub stale Homebrew/docs refs left over from cleanup

PR #138 deleted docs/project/ and the brews: block, but missed:

- README.md linked to docs/project/architecture.md + conventions.md
- PROJECT_SUMMARY.md listed HOMEBREW_TAP_GITHUB_TOKEN as a runtime env
- shared/runbooks/release-go.md still had "Homebrew tap PR fails" recovery
- release-go.yml + .goreleaser.yml carried stale "darwin/arm64 deferred"
  comments after release-darwin.yml landed (#137)

Pure docs/comments fix; no code or workflow behavior changes.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/release-go.yml

@@ -1,17 +1,14 @@
 name: release-go
 
-# Tag-triggered release pipeline for the codeiq Go binary.
+# Tag-triggered release pipeline for the codeiq Go binary (linux/amd64
+# + linux/arm64). darwin/arm64 ships from `release-darwin.yml` on the
+# same tag.
 #
 # Trigger: push a tag matching `v*.*.*` (e.g. `git tag v0.3.0 && git push --tags`).
 #
-# v0.3.0 scope: linux/amd64 + linux/arm64 only. Single ubuntu-latest
-# runner builds both via the linux→linux cross-compile with
-# gcc-aarch64-linux-gnu (CGO permits this cross — both kuzu and
-# go-sqlite3 build cleanly).
-#
-# darwin/arm64 deferred — needs a macos runner and separate matrix.
-# Follow-up: add a `release-darwin.yml` that attaches darwin binaries
-# to the same draft Release.
+# Single ubuntu-latest runner builds both linux archs via
+# linux→linux cross-compile with gcc-aarch64-linux-gnu (CGO permits
+# this cross — both kuzu and go-sqlite3 build cleanly).
 
 on:
   push:
@@ -57,9 +54,6 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_OWNER: RandomCodeSpace
-          HOMEBREW_TAP_REPO: homebrew-codeiq
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
       - name: Attest release artifacts (build provenance)
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:

.goreleaser.yml

@@ -61,8 +61,8 @@ builds:
       - -X 'github.com/randomcodespace/codeiq/go/internal/buildinfo.Dirty={{.IsGitDirty}}'
     goos: [linux]
     goarch: [arm64]
-  # darwin/arm64 deferred — needs a macos runner. Follow-up:
-  # release-darwin.yml attaches macOS binaries to the same draft Release.
+  # darwin/arm64 ships from `release-darwin.yml` (macos-14 runner) and
+  # attaches to the same Release that this config creates.
 
 archives:
   - id: codeiq
@@ -114,28 +114,6 @@ signs:
     output: true
     signature: '${artifact}.cosign.bundle'
 
-# Homebrew tap publish — opt-in via $HOMEBREW_TAP_GITHUB_TOKEN. When the
-# env var is empty (forks, dry runs), the upload is skipped so the same
-# .goreleaser.yml works for the owning org and downstream forks alike.
-brews:
-  - name: codeiq
-    repository:
-      owner: '{{ envOrDefault "HOMEBREW_TAP_OWNER" "RandomCodeSpace" }}'
-      name: '{{ envOrDefault "HOMEBREW_TAP_REPO" "homebrew-codeiq" }}'
-      token: '{{ envOrDefault "HOMEBREW_TAP_GITHUB_TOKEN" "" }}'
-    skip_upload: '{{ if eq (envOrDefault "HOMEBREW_TAP_GITHUB_TOKEN" "") "" }}true{{ else }}false{{ end }}'
-    commit_author:
-      name: codeiq-bot
-      email: noreply@github.com
-    directory: Formula
-    homepage: 'https://github.com/RandomCodeSpace/codeiq'
-    description: 'Deterministic code knowledge graph + MCP server'
-    license: 'Apache-2.0'
-    install: |
-      bin.install "codeiq"
-    test: |
-      assert_match "codeiq", shell_output("#{bin}/codeiq --version")
-
 release:
   github:
     owner: RandomCodeSpace

CHANGELOG.md

@@ -36,8 +36,6 @@ landing) and `c630245` (release infra).
   helper.
 - **`spf13/cobra`** — CLI framework. Subcommand registration via
   `internal/cli` blank imports.
-- **`golang-jwt/jwt/v5`** — token validation surface (kept from a
-  serve-mode prototype; serve isn't fully ported yet).
 
 ## Architecture
 
@@ -46,10 +44,15 @@ landing) and `c630245` (release infra).
 ```
 index:   FileDiscovery → Parsers → Detectors (goroutine pool) → GraphBuilder → SQLite cache
 enrich:  SQLite → Linkers → LayerClassifier → LexicalEnricher → LanguageEnricher → ServiceDetector → Kuzu (COPY FROM)
-serve:   (deferred — not ported in v0.3.0)
 mcp:     Kuzu → QueryService → 6 consolidated MCP tools + run_cypher escape hatch + review_changes
 ```
 
+codeiq has no REST API and no web UI surface — by design. Consumers
+interact through the CLI or through the stdio MCP server (read-only).
+The Java reference had a `codeiq serve` subcommand (Spring Boot REST
++ React SPA); both were removed in the Go port and will not be
+reintroduced.
+
 ### Pipeline components
 
 - **`internal/analyzer/file_discovery.go`** — `git ls-files` first,
@@ -426,10 +429,8 @@ Release pipeline:
 - Release tag must be `v*.*.*`; pre-releases use the
   `vX.Y.Z-rc.N` form (Goreleaser `prerelease: auto` honors it).
 - Cosign keyless via GitHub OIDC — no long-lived key on the runner.
-  Verification needs the cert + sig + the OIDC identity regex (see
-  `shared/runbooks/release-go.md`).
-- Homebrew tap publish is opt-in via `HOMEBREW_TAP_GITHUB_TOKEN`.
-  Forks leave the secret unset and the brew step skips silently.
+  Verification needs the cosign bundle file + the OIDC identity regex
+  (see `shared/runbooks/release-go.md`).
 
 ## Updating This File
 

CLAUDE.md

@@ -5,9 +5,8 @@
 >
 > **Canonical depth lives in [`CLAUDE.md`](CLAUDE.md)** (~16 KB,
 > agent-oriented, hand-maintained). This file is a thin entry point
-> that links into `CLAUDE.md`, the runbooks under
-> [`shared/runbooks/`](shared/runbooks/), and the deep-dives under
-> [`docs/project/`](docs/project/).
+> that links into `CLAUDE.md` and the runbooks under
+> [`shared/runbooks/`](shared/runbooks/).
 
 ## Identity
 
@@ -54,7 +53,7 @@ codeiq/
 │   │   ├── cli/                     — cobra subcommands
 │   │   ├── detector/                — 100 detectors organized by category
 │   │   ├── flow/                    — architecture-flow diagram engine
-│   │   ├── graph/                   — Kuzu facade (read-only on serve path)
+│   │   ├── graph/                   — Kuzu facade (read-only)
 │   │   ├── intelligence/            — lexical + language extractors + evidence + planner
 │   │   ├── mcp/                     — MCP server + tool definitions
 │   │   ├── model/                   — CodeNode, CodeEdge, kinds, Confidence
@@ -65,8 +64,7 @@ codeiq/
 │   ├── testdata/                    — fixtures (fixture-minimal, fixture-multi-lang)
 │   ├── go.mod
 │   └── go.sum
-├── .github/workflows/               — go-ci, perf-gate, release-go, security, scorecard
-├── docs/project/                    — architecture + conventions + flows deep-dives
+├── .github/workflows/               — go-ci, perf-gate, release-go, release-darwin, security, scorecard
 ├── shared/runbooks/                 — release-go.md + engineering-standards.md
 ├── CHANGELOG.md
 ├── CLAUDE.md                        — SSoT internals doc
@@ -104,8 +102,8 @@ CGO_ENABLED=1 go build -o /usr/local/bin/codeiq ./cmd/codeiq
 ```
 
 **Required env / external services**: none for build. At run-time the
-binary reads `OLLAMA_API_KEY` (optional) and `HOMEBREW_TAP_GITHUB_TOKEN`
-(release-side only).
+binary reads `OLLAMA_API_KEY` (optional, switches `codeiq review` to
+Ollama Cloud).
 
 ## Conventions an agent must respect
 
@@ -126,8 +124,7 @@ binary reads `OLLAMA_API_KEY` (optional) and `HOMEBREW_TAP_GITHUB_TOKEN`
   boundary; detectors override only when they have higher-confidence
   evidence.
 
-Full set in [`CLAUDE.md` §Code Conventions](CLAUDE.md#code-conventions)
-and [`docs/project/conventions.md`](docs/project/conventions.md).
+Full set in [`CLAUDE.md` §Code Conventions](CLAUDE.md#code-conventions).
 
 ## Gotchas
 
@@ -147,8 +144,6 @@ and [`docs/project/conventions.md`](docs/project/conventions.md).
 
 ## Where to look next
 
-- Architecture & components → [`docs/project/architecture.md`](docs/project/architecture.md)
-- Conventions (full) → [`docs/project/conventions.md`](docs/project/conventions.md)
 - Build & release → [`shared/runbooks/release-go.md`](shared/runbooks/release-go.md)
 - MCP integration → [`README.md#mcp-integration`](README.md#mcp-integration)
 - Internal SSoT → [`CLAUDE.md`](CLAUDE.md)

PROJECT_SUMMARY.md

@@ -63,13 +63,6 @@ cosign verify-blob \
   checksums.sha256
 ```
 
-### Homebrew
-
-```bash
-brew tap RandomCodeSpace/codeiq
-brew install codeiq
-```
-
 ### Build from source
 
 Requires Go 1.25.10+ and a C toolchain (CGO).
@@ -153,11 +146,10 @@ the graph) are dropped at snapshot. Every run prints a
 "Deduped: N nodes, M edges  Dropped: K phantom edges" line so graph
 hygiene is visible.
 
-See [`docs/project/architecture.md`](docs/project/architecture.md) for
-the pipeline (FileDiscovery → tree-sitter / regex → detectors →
-GraphBuilder → linkers → LayerClassifier → Kuzu) and
-[`docs/project/conventions.md`](docs/project/conventions.md) for the
-detector authoring contract.
+Pipeline: FileDiscovery → tree-sitter / regex → detectors →
+GraphBuilder → linkers → LayerClassifier → Kuzu. See
+[`CLAUDE.md`](CLAUDE.md) for the full architecture and the detector
+authoring contract.
 
 ## Releases