feat(verity-go): add Go fs-verity implementation and metadata package

.github/workflows/test.yml

@@ -72,3 +72,27 @@ jobs:
 
       - name: Run test script from repo
         run: make run-test
+
+  go-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: 'true'
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.24'
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.85.0
+      - name: Verify interop fixture is up to date
+        run: |
+          (cd verity-core && python3 make_testfiles.py)
+          cargo run -p cryptpilot-verity -- format verity-core/testfiles --hash-output - --label env=prod --force
+          diff verity-core/testfiles/cryptpilot-verity.metadata.fb verity-go/metadata/testdata/rust.metadata.fb \
+            || { echo "ERROR: interop fixture is stale. Run verity-go/metadata/gen_fixture.sh to regenerate."; exit 1; }
+      - name: Run Go tests
+        run: |
+          cd verity-go
+          go test -race -v ./...
+      - name: Check FlatBuffers schemas in sync
+        run: make check-fbs

.gitignore

@@ -24,3 +24,9 @@ cryptpilot-verity/benchmark/verity_source_data/
 
 # Superpowers design docs
 docs/superpowers/
+
+# Claude session artifacts
+.claude/
+
+# Generated test files
+testfiles/

CLAUDE.md

@@ -1,5 +1,13 @@
 # CLAUDE.md
 
+## Rust-Go Sync
+
+When modifying the Rust `cryptpilot-verity`, `verity-core`, or `verity-fuse` code, always evaluate whether the corresponding Go library (`verity-go/`) needs the same change. If the change affects core algorithms (hash computation, merkle tree, descriptor format) or metadata structures (FlatBuffers schema, serialization), apply the equivalent change to the Go code in the same commit.
+
+## Excluded Paths
+
+Never commit files under `docs/superpowers/` or `.claude/` to git. These are Claude session artifacts and should be kept local only. Add them to `.gitignore` if not already present.
+
 ## Git Commit Requirements
 
 When creating or amending commits:

Makefile

@@ -352,3 +352,27 @@ docker-build-verity:
 .PHONY: docker-build-all
 docker-build-all: docker-build
 
+# Cross-language quality assurance targets
+
+.PHONY: check-fbs
+check-fbs:
+	@test -L verity-go/metadata/metadata.fbs || { echo "ERROR: metadata.fbs should be a symlink to Rust source"; exit 1; }
+	@test -L verity-go/metadata/metadata_hash.fbs || { echo "ERROR: metadata_hash.fbs should be a symlink to Rust source"; exit 1; }
+	@echo "FlatBuffers schemas are shared via symlink."
+
+.PHONY: go-test
+go-test:
+	cd verity-go && /usr/local/go/bin/go test -race -v ./... -skip TestInterop
+
+.PHONY: check-all
+check-all: clippy go-test check-fbs
+	cargo fmt --check
+
+.PHONY: gen-interop-fixture
+gen-interop-fixture:
+	@echo "=== Generating interop fixture ==="
+	cd verity-core && python3 make_testfiles.py
+	cargo run -p cryptpilot-verity -- format verity-core/testfiles --hash-output - --label env=prod --force
+	cp verity-core/testfiles/cryptpilot-verity.metadata.fb verity-go/metadata/testdata/rust.metadata.fb
+	@echo "Fixture updated: verity-go/metadata/testdata/rust.metadata.fb"
+

cryptpilot-verity/Cargo.toml

@@ -6,6 +6,7 @@ version.workspace = true
 
 [dependencies]
 anyhow = {workspace = true}
+base64 = {workspace = true}
 async-trait = {workspace = true}
 async-walkdir = {workspace = true}
 clap = {workspace = true}