fix: address CodeRabbit review findings

- Remove hardcoded @host localhost:8080 from global API annotations so
  the spec is served host-agnostic
- Add omitempty to StartedAt on ExecutionSummary, ExecutionDetail, and
  StepSummary to match CompletedAt behaviour and align wire format with
  schema
- Replace http.Error (text/plain) with writeJSONError in budget/usage
  handlers so 400/500 responses honour the documented ErrorResponse
  contract; log internal errors via s.Logger instead of leaking details
- Pin swag install in CI spec job to v1.16.6 for reproducible builds
- Sync govulncheck step with main's known-unfixable exclusion filter
- Regenerate swagger.json/yaml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: michaelmcnees

.github/workflows/engine-ci.yml

@@ -60,7 +60,16 @@ jobs:
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Run govulncheck
-        run: govulncheck ./...
+        run: |
+          # GO-2026-4887 and GO-2026-4883 are in docker/docker (testcontainers test dep only).
+          # Fixed in: N/A — no upstream fix available. Remove exclusions when a patched release ships.
+          OUTPUT=$(govulncheck ./... 2>&1 || true)
+          echo "$OUTPUT"
+          ACTIONABLE=$(echo "$OUTPUT" | grep -E '^Vulnerability #[0-9]+:' | grep -vE 'GO-2026-4887|GO-2026-4883')
+          if [ -n "$ACTIONABLE" ]; then
+            echo "FAIL: unfixed actionable vulnerabilities found"
+            exit 1
+          fi
 
   gosec:
     name: Gosec
@@ -84,7 +93,7 @@ jobs:
         with:
           go-version: '1.25'
       - name: Install swag
-        run: go install github.com/swaggo/swag/cmd/swag@latest
+        run: go install github.com/swaggo/swag/cmd/swag@v1.16.6
       - name: Regenerate spec
         run: |
           swag init \

packages/engine/internal/server/api.go

@@ -21,7 +21,7 @@ type ExecutionSummary struct {
 	Workflow    string  `json:"workflow"`
 	Version     int     `json:"version"`
 	Status      string  `json:"status"`
-	StartedAt   *string `json:"started_at"`
+	StartedAt   *string `json:"started_at,omitempty"`
 	CompletedAt *string `json:"completed_at,omitempty"`
 }
 
@@ -31,7 +31,7 @@ type ExecutionDetail struct {
 	Workflow    string        `json:"workflow"`
 	Version     int           `json:"version"`
 	Status      string        `json:"status"`
-	StartedAt   *string       `json:"started_at"`
+	StartedAt   *string       `json:"started_at,omitempty"`
 	CompletedAt *string       `json:"completed_at,omitempty"`
 	Steps       []StepSummary `json:"steps"`
 }
@@ -41,7 +41,7 @@ type StepSummary struct {
 	Name        string  `json:"name"`
 	Status      string  `json:"status"`
 	Error       string  `json:"error,omitempty"`
-	StartedAt   *string `json:"started_at"`
+	StartedAt   *string `json:"started_at,omitempty"`
 	CompletedAt *string `json:"completed_at,omitempty"`
 }
 
@@ -512,7 +512,8 @@ func (s *Server) handleListBudgets(w http.ResponseWriter, r *http.Request) {
 	teamID := auth.TeamIDFromContext(r.Context())
 	budgets, err := s.BudgetStore.ListTeamBudgets(r.Context(), teamID)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		s.Logger.Error("listing budgets", "error", err)
+		writeJSONError(w, "internal server error", http.StatusInternalServerError)
 		return
 	}
 	writeJSON(w, http.StatusOK, budgets)
@@ -537,19 +538,20 @@ func (s *Server) handleSetBudget(w http.ResponseWriter, r *http.Request) {
 
 	var body SetBudgetRequest
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "invalid request body", http.StatusBadRequest)
+		writeJSONError(w, "invalid request body", http.StatusBadRequest)
 		return
 	}
 	if body.Enforcement == "" {
 		body.Enforcement = "hard"
 	}
 	if body.Enforcement != "hard" && body.Enforcement != "warn" {
-		http.Error(w, "enforcement must be 'hard' or 'warn'", http.StatusBadRequest)
+		writeJSONError(w, "enforcement must be 'hard' or 'warn'", http.StatusBadRequest)
 		return
 	}
 
 	if err := s.BudgetStore.SetTeamBudget(r.Context(), teamID, provider, body.MonthlyTokenLimit, body.Enforcement); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		s.Logger.Error("setting budget", "provider", provider, "error", err)
+		writeJSONError(w, "internal server error", http.StatusInternalServerError)
 		return
 	}
 
@@ -590,7 +592,8 @@ func (s *Server) handleDeleteBudget(w http.ResponseWriter, r *http.Request) {
 	provider := r.PathValue("provider")
 
 	if err := s.BudgetStore.DeleteTeamBudget(r.Context(), teamID, provider); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		s.Logger.Error("deleting budget", "provider", provider, "error", err)
+		writeJSONError(w, "internal server error", http.StatusInternalServerError)
 		return
 	}
 
@@ -639,7 +642,8 @@ func (s *Server) handleGetUsage(w http.ResponseWriter, r *http.Request) {
 		usage, err = s.BudgetStore.GetTotalUsage(r.Context(), teamID, period)
 	}
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		s.Logger.Error("getting usage", "provider", provider, "error", err)
+		writeJSONError(w, "internal server error", http.StatusInternalServerError)
 		return
 	}
 

packages/engine/internal/server/docs.go

@@ -8,7 +8,6 @@
 //	@license.name   BSL 1.1
 //	@license.url    https://github.com/dvflw/mantle/blob/main/LICENSE
 //
-//	@host        localhost:8080
 //	@basePath    /
 //
 //	@securityDefinitions.apikey ApiKeyAuth

packages/engine/internal/server/docs/swagger.json

@@ -13,7 +13,6 @@
         },
         "version": "1.0"
     },
-    "host": "localhost:8080",
     "basePath": "/",
     "paths": {
         "/api/v1/budgets": {

packages/engine/internal/server/docs/swagger.yaml

@@ -176,7 +176,6 @@ definitions:
       updated_at:
         type: string
     type: object
-host: localhost:8080
 info:
   contact:
     name: Mantle