chore: add copyright headers, CI tests, and sanitize gitignore

internal/infrastructure/antitamper/antitamper.go

@@ -1,3 +1,7 @@
+// Copyright 2026 Syntrex Lab. All rights reserved.
+// Use of this source code is governed by an Apache-2.0 license
+// that can be found in the LICENSE file.
+
 // Package antitamper implements SEC-005 Anti-Tamper Protection.
 //
 // Provides runtime protection against:
@@ -26,11 +30,11 @@ import (
 type TamperType string
 
 const (
-	TamperDebugger    TamperType = "debugger_attached"
-	TamperPtrace      TamperType = "ptrace_attempt"
-	TamperBinaryMod   TamperType = "binary_modified"
-	TamperEnvTamper   TamperType = "env_tampering"
-	TamperMemoryDump  TamperType = "memory_dump"
+	TamperDebugger   TamperType = "debugger_attached"
+	TamperPtrace     TamperType = "ptrace_attempt"
+	TamperBinaryMod  TamperType = "binary_modified"
+	TamperEnvTamper  TamperType = "env_tampering"
+	TamperMemoryDump TamperType = "memory_dump"
 
 	// CheckInterval for periodic integrity verification.
 	DefaultCheckInterval = 5 * time.Minute
@@ -51,24 +55,24 @@ type TamperHandler func(event TamperEvent)
 
 // Shield provides anti-tamper protection for SOC processes.
 type Shield struct {
-	mu             sync.RWMutex
-	binaryPath     string
-	binaryHash     string // SHA-256 at startup
-	envSnapshot    map[string]string
-	handlers       []TamperHandler
-	logger         *slog.Logger
-	stats          ShieldStats
+	mu          sync.RWMutex
+	binaryPath  string
+	binaryHash  string // SHA-256 at startup
+	envSnapshot map[string]string
+	handlers    []TamperHandler
+	logger      *slog.Logger
+	stats       ShieldStats
 }
 
 // ShieldStats tracks anti-tamper metrics.
 type ShieldStats struct {
-	mu               sync.Mutex
-	TotalChecks      int64 `json:"total_checks"`
-	TamperDetected   int64 `json:"tamper_detected"`
-	DebuggerBlocked  int64 `json:"debugger_blocked"`
-	BinaryIntegrity  bool  `json:"binary_integrity"`
-	LastCheck        time.Time `json:"last_check"`
-	StartedAt        time.Time `json:"started_at"`
+	mu              sync.Mutex
+	TotalChecks     int64     `json:"total_checks"`
+	TamperDetected  int64     `json:"tamper_detected"`
+	DebuggerBlocked int64     `json:"debugger_blocked"`
+	BinaryIntegrity bool      `json:"binary_integrity"`
+	LastCheck       time.Time `json:"last_check"`
+	StartedAt       time.Time `json:"started_at"`
 }
 
 // NewShield creates a new anti-tamper shield.

internal/infrastructure/antitamper/antitamper_test.go

@@ -1,3 +1,7 @@
+// Copyright 2026 Syntrex Lab. All rights reserved.
+// Use of this source code is governed by an Apache-2.0 license
+// that can be found in the LICENSE file.
+
 package antitamper
 
 import (

internal/infrastructure/antitamper/antitamper_unix.go

@@ -1,3 +1,7 @@
+// Copyright 2026 Syntrex Lab. All rights reserved.
+// Use of this source code is governed by an Apache-2.0 license
+// that can be found in the LICENSE file.
+
 //go:build !windows
 
 package antitamper

internal/infrastructure/antitamper/antitamper_windows.go

@@ -1,3 +1,7 @@
+// Copyright 2026 Syntrex Lab. All rights reserved.
+// Use of this source code is governed by an Apache-2.0 license
+// that can be found in the LICENSE file.
+
 //go:build windows
 
 package antitamper
@@ -10,7 +14,7 @@ import (
 )
 
 var (
-	kernel32           = syscall.NewLazyDLL("kernel32.dll")
+	kernel32          = syscall.NewLazyDLL("kernel32.dll")
 	isDebuggerPresent = kernel32.NewProc("IsDebuggerPresent")
 )
 
@@ -41,7 +45,7 @@ func (s *Shield) isDebuggerAttached() bool {
 
 	// Check parent process name for known debuggers.
 	// This is a heuristic — not foolproof.
-	_ = strings.Contains // suppress unused import
+	_ = strings.Contains    // suppress unused import
 	_ = unsafe.Pointer(nil) // suppress unused import
 
 	return false