feat(sdk): add Go client SDK with full API-tree parity

.claude/commands/cover.md

@@ -1,6 +1,6 @@
 ---
 description: Render coverage HTML for a suite and surface drops below threshold
-argument-hint: [unit|integration|e2e|sdk|merge|all] (default: merge whatever exists)
+argument-hint: [unit|integration|e2e|go-sdk|sdk|merge|all] (default: merge whatever exists)
 ---
 
 Generate the coverage report and surface anything below threshold from `.testcoverage.yml`.
@@ -13,10 +13,11 @@ Behavior:
 - **unit**: `make test-unit` (gates per-suite + writes `tmp/coverage/unit/`)
 - **integration**: `make test-integration` (requires Docker)
 - **e2e**: `make test-e2e` (requires Docker; orchestrator + cover binary)
+- **go-sdk**: `make test-go-sdk` (nested module `clients/go`; gates against `suites.go-sdk`, rendered separately and never merged into the Go total)
 - **ts-unit**: `make test-ts` (SDK unit tests + coverage + gate against `suites.ts-unit`)
 - **ts-e2e**: emitted as a side effect of `make test-e2e` (the orchestrator always passes `--coverage` to the e2e vitest run; informational only, no standalone gate)
 - **ts-total**: `make cov` (runs `cov report` — one consolidated Go + TS summary with per-suite HTML links + all gates; fails if *no* suite has data)
-- **all**: `make test-all` (all four suites sequentially + `make cov`)
+- **all**: `make test-all` (every suite sequentially + `make cov`)
 
 After the run completes:
 

.github/dependabot.yml

@@ -1,8 +1,17 @@
 version: 2
 updates:
   # Go modules
+  #
+  # TWO directories, not one — the same trap as github-actions below:
+  # `directory: /` covers the root module only, and Dependabot does not
+  # descend into nested modules. clients/go is its own module, so its
+  # go.mod needs its own entry here. That module is stdlib-only today
+  # (no `require` block, no go.sum), so this catches the first dependency
+  # it takes on rather than closing a gap that already exists.
   - package-ecosystem: gomod
-    directory: /
+    directories:
+      - /
+      - /clients/go
     schedule:
       interval: weekly
       day: monday

.github/labeler.yml

@@ -43,7 +43,9 @@
   - changed-files:
     - any-glob-to-any-file:
       - "clients/ts/**"
+      - "clients/go/**"
       - "tests/e2e/sdk/**"
+      - "tests/conformance/**"
 
 "area/docs":
   - changed-files:
@@ -83,8 +85,8 @@
 dependencies:
   - changed-files:
     - any-glob-to-any-file:
-      - "go.mod"
-      - "go.sum"
+      - "**/go.mod"
+      - "**/go.sum"
       - "**/package.json"
       - "**/pnpm-lock.yaml"
       - "**/package-lock.json"

.github/workflows/ci.yml

@@ -204,8 +204,14 @@ jobs:
         uses: ./.github/actions/setup-env
         with:
           go-cache-suffix: "-unit"
-      - name: Run Go unit tests + SDK vitest tests
-        run: make test-unit test-ts COV_DEFER=1
+      - name: Run Go unit tests + SDK vitest + Go SDK tests
+        run: make test-unit test-ts test-go-sdk test-conformance-ts COV_DEFER=1
+      # This one fragment carries THREE suites' data: unit covdata, ts-unit
+      # (vitest/istanbul) and go-sdk covdata from the nested clients/go
+      # module — every target above ran under COV_DEFER, so the `coverage`
+      # job renders and gates all three. No per-suite paths here on purpose:
+      # uploading the whole tmp/coverage tree means a new suite collected by
+      # this job needs no workflow change.
       - name: Upload coverage fragment
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.testcoverage.yml

@@ -12,7 +12,9 @@
 # together, so `threshold.total` below applies to the *project-wide*
 # coverage number — unit alone covers only `./internal/...` packages
 # exercised by `*_test.go` files (below total threshold); merged
-# coverage adds integration- and e2e-only paths and clears it.
+# coverage adds integration- and e2e-only paths and clears it. The
+# nested-module suites (go-sdk) are gated separately and never merged
+# in — see suites.go-sdk.
 profile: tmp/coverage/total/coverage.txt
 local-prefix: github.com/Wave-RF/WaveHouse
 
@@ -30,6 +32,18 @@ suites:
   unit: 80
   integration: 20
   e2e: 60
+  # Go SDK (clients/go) — a NESTED module, so its coverage is rendered and
+  # gated on its own and is deliberately NOT part of the merged Go total
+  # above. Nothing from clients/go can leak into that total: the root
+  # module can't see a nested one (`go list ./...` at the repo root never
+  # yields clients/go), so the unit/integration/e2e `-coverpkg=./...` never
+  # reaches these files — which is also why there is no `^clients/go/`
+  # entry under exclude.paths; there is nothing to exclude.
+  # Measured 82.7% when this floor was set (SDK package 88.6%,
+  # cmd/wavehouse-codegen 55.8%). 75 leaves the same order of headroom
+  # unit's 80 leaves under its real ~91%. Raise it as the codegen
+  # command's tests fill in.
+  go-sdk: 75
   # TypeScript SDK suites — see scripts/cov for the merge / render logic.
   # vitest gates via --coverage.thresholds.statements; the merged ts-total
   # is gated by `cov ts-merge` against the value below. Tune ts-total