minor fixes

pkg/appview/middleware/registry.go

@@ -23,9 +23,6 @@ import (
 	"atcr.io/pkg/auth/token"
 )
 
-// holdDIDKey is the context key for storing hold DID
-const holdDIDKey contextKey = "hold.did"
-
 // authMethodKey is the context key for storing auth method from JWT
 const authMethodKey contextKey = "auth.method"
 
@@ -296,8 +293,6 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name
 		// This is a fatal configuration error - registry cannot function without a hold service
 		return nil, fmt.Errorf("no hold DID configured: ensure default_hold_did is set in middleware config")
 	}
-	ctx = context.WithValue(ctx, holdDIDKey, holdDID)
-
 	// Auto-reconcile crew membership on first push/pull
 	// This ensures users can push immediately after docker login without web sign-in
 	// EnsureCrewMembership is best-effort and logs errors without failing the request

pkg/atproto/lexicon.go

@@ -599,9 +599,9 @@ type CrewRecord struct {
 	Member      string   `json:"member" cborgen:"member"`
 	Role        string   `json:"role" cborgen:"role"`
 	Permissions []string `json:"permissions" cborgen:"permissions"`
-	Tier        string   `json:"tier,omitempty" cborgen:"tier,omitempty"`             // Optional tier for quota limits (e.g., 'deckhand', 'bosun', 'quartermaster')
+	Tier        string   `json:"tier,omitempty" cborgen:"tier,omitempty"`   // Optional tier for quota limits (e.g., 'deckhand', 'bosun', 'quartermaster')
 	Plankowner  bool     `json:"plankowner,omitempty" cborgen:"plankowner"` // Early adopter flag - gets plankowner_crew_tier for free
-	AddedAt     string   `json:"addedAt" cborgen:"addedAt"`                           // RFC3339 timestamp
+	AddedAt     string   `json:"addedAt" cborgen:"addedAt"`                 // RFC3339 timestamp
 }
 
 // LayerRecord represents metadata about a container layer stored in the hold

pkg/hold/oci/xrpc.go

@@ -25,8 +25,8 @@ type XRPCHandler struct {
 	pds                *pds.HoldPDS
 	httpClient         pds.HTTPClient
 	enableBlueskyPosts bool
-	quotaMgr           *quota.Manager        // Quota manager for tier-based limits
-	scanBroadcaster    *pds.ScanBroadcaster  // Scan job dispatcher (nil = scanning disabled)
+	quotaMgr           *quota.Manager       // Quota manager for tier-based limits
+	scanBroadcaster    *pds.ScanBroadcaster // Scan job dispatcher (nil = scanning disabled)
 }
 
 // NewXRPCHandler creates a new OCI XRPC handler

pkg/hold/pds/scan_broadcaster.go

@@ -59,12 +59,12 @@ type ScanJobEvent struct {
 
 // ScannerMessage is a message received from scanner over WebSocket
 type ScannerMessage struct {
-	Type       string                  `json:"type"`       // "ack", "result", "error"
-	Seq        int64                   `json:"seq"`        // Job sequence number
-	SBOM       string                  `json:"sbom,omitempty"`
-	VulnReport string                  `json:"vulnReport,omitempty"`
-	Summary    *VulnerabilitySummary   `json:"summary,omitempty"`
-	Error      string                  `json:"error,omitempty"`
+	Type       string                `json:"type"` // "ack", "result", "error"
+	Seq        int64                 `json:"seq"`  // Job sequence number
+	SBOM       string                `json:"sbom,omitempty"`
+	VulnReport string                `json:"vulnReport,omitempty"`
+	Summary    *VulnerabilitySummary `json:"summary,omitempty"`
+	Error      string                `json:"error,omitempty"`
 }
 
 // VulnerabilitySummary contains counts of vulnerabilities by severity
@@ -268,7 +268,9 @@ func (sb *ScanBroadcaster) dispatchJob(job *ScanJobEvent) {
 		slog.Warn("Scanner buffer full, re-marking job as pending",
 			"seq", job.Seq,
 			"subscriberId", sub.id)
-		sb.db.Exec(`UPDATE scan_jobs SET status = 'pending', assigned_to = NULL, assigned_at = NULL WHERE seq = ?`, job.Seq)
+		if _, err := sb.db.Exec(`UPDATE scan_jobs SET status = 'pending', assigned_to = NULL, assigned_at = NULL WHERE seq = ?`, job.Seq); err != nil {
+			slog.Error("Failed to re-mark scan job as pending", "seq", job.Seq, "error", err)
+		}
 	}
 }
 
@@ -591,6 +593,6 @@ func (sb *ScanBroadcaster) ValidateScannerSecret(secret string) bool {
 
 func generateSubscriberID() string {
 	b := make([]byte, 8)
-	rand.Read(b)
+	_, _ = rand.Read(b)
 	return hex.EncodeToString(b)
 }

pkg/hold/pds/xrpc.go

@@ -44,13 +44,13 @@ const (
 
 // XRPCHandler handles XRPC requests for the embedded PDS
 type XRPCHandler struct {
-	pds              *HoldPDS
-	s3Service        s3.S3Service
-	storageDriver    driver.StorageDriver
-	broadcaster      *EventBroadcaster
-	scanBroadcaster  *ScanBroadcaster // Scan job dispatcher for connected scanners
-	httpClient       HTTPClient       // For testing - allows injecting mock HTTP client
-	quotaMgr         *quota.Manager   // Quota manager for tier-based limits
+	pds             *HoldPDS
+	s3Service       s3.S3Service
+	storageDriver   driver.StorageDriver
+	broadcaster     *EventBroadcaster
+	scanBroadcaster *ScanBroadcaster // Scan job dispatcher for connected scanners
+	httpClient      HTTPClient       // For testing - allows injecting mock HTTP client
+	quotaMgr        *quota.Manager   // Quota manager for tier-based limits
 }
 
 // PartInfo represents a completed part in a multipart upload