@@ -42,20 +42,20 @@ jobs:
       - name: Check book source
         id: check
         run: |
-          if [ ! -f book.md ]; then
+          if [ ! -f docs/book/book.md ]; then
             echo "has_book=false" >> $GITHUB_OUTPUT
             echo "lines=0" >> $GITHUB_OUTPUT
             echo "images=0" >> $GITHUB_OUTPUT
             echo "tables=0" >> $GITHUB_OUTPUT
-            echo "WARNING: book.md not found"
+            echo "WARNING: docs/book/book.md not found"
             exit 0
           fi
           echo "has_book=true" >> $GITHUB_OUTPUT
-          LINES=$(wc -l < book.md)
-          IMAGES=$(grep -c '!\[' book.md || echo 0)
-          TABLES=$(grep -c '^|' book.md || echo 0)
-          CODE=$(grep -c '```' book.md || echo 0)
-          CHAPTERS=$(grep -c '^## ' book.md || echo 0)
+          LINES=$(wc -l < docs/book/book.md)
+          IMAGES=$(grep -c '!\[' docs/book/book.md || echo 0)
+          TABLES=$(grep -c '^|' docs/book/book.md || echo 0)
+          CODE=$(grep -c '```' docs/book/book.md || echo 0)
+          CHAPTERS=$(grep -c '^## ' docs/book/book.md || echo 0)
           echo "lines=$LINES" >> $GITHUB_OUTPUT
           echo "images=$IMAGES" >> $GITHUB_OUTPUT
           echo "tables=$TABLES" >> $GITHUB_OUTPUT
@@ -104,7 +104,7 @@ jobs:
 
       - name: Clean source
         run: |
-          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' book.md
+          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' docs/book/book.md
           echo "Control characters cleaned"
 
       - name: Extract metadata
@@ -114,9 +114,9 @@ jobs:
           echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT
           echo "pdf_name=${REPO_NAME}-guide.pdf" >> $GITHUB_OUTPUT
           # Extract title from frontmatter or first heading
-          TITLE=$(grep -m1 '^title:' book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
+          TITLE=$(grep -m1 '^title:' docs/book/book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
           if [ -z "$TITLE" ]; then
-            TITLE=$(head -10 book.md | grep "^# " | head -1 | sed 's/^# //')
+            TITLE=$(head -10 docs/book/book.md | grep "^# " | head -1 | sed 's/^# //')
           fi
           if [ -z "$TITLE" ]; then TITLE="$REPO_NAME — Official Guide"; fi
           echo "title=$TITLE" >> $GITHUB_OUTPUT
 
@@ -13,11 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    name: Test (${{ matrix.os }})
+    name: Test (${{ matrix.os }} / Go ${{ matrix.go-version }})
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:
@@ -28,6 +30,8 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go-version }}
+      - name: go vet
+        run: go vet ./...
       - name: Run tests
         run: go test -race -v -count=1 -coverprofile=coverage.out ./...
       - name: Upload coverage
@@ -40,7 +44,6 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -50,26 +53,29 @@ jobs:
         uses: golangci/golangci-lint-action@v6
         with:
           version: latest
+      - name: Install staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@latest
+      - name: Run staticcheck
+        run: staticcheck ./...
 
   fuzz:
     name: Fuzz Tests
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: "1.22"
       - name: Run fuzz tests
         run: |
+          set -e
           for pkg in $(go list ./... | grep -E 'protocol|core|security'); do
-            go test -fuzz=. -fuzztime=30s "$pkg" 2>/dev/null || true
+            go test -fuzz=. -fuzztime=30s "$pkg" || true
           done
 
   benchmark:
     name: Benchmarks
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -85,19 +91,33 @@ jobs:
   build-c-sdk:
     name: C SDK (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
-      - name: Build C SDK
+      - name: Build C SDK (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
         run: |
           cd sdk/c
           if [ -f CMakeLists.txt ]; then
             cmake -B build
-            cmake --build build
+            cmake --build build --parallel
           elif [ -f Makefile ]; then
             make
-          fi
+          else
+            echo "::warning::No build system found in sdk/c"
+          fi
+      - name: Build C SDK (Windows)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          cd sdk/c
+          if [ -f CMakeLists.txt ]; then
+            cmake -B build -A x64
+            cmake --build build --config Release --parallel
+          else
+            echo "::warning::No CMakeLists.txt found in sdk/c on Windows"
+          fi
@@ -8,6 +8,13 @@ on:
 env:
   EOSIM_VERSION: "0.1.0"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   install-validate:
     name: Install & Validate (${{ matrix.os }}, Python ${{ matrix.python-version }})
 
@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test (${{ matrix.os }})
 
@@ -8,6 +8,13 @@ on:
 env:
   EOSIM_VERSION: "0.1.0"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   simulate:
     name: EoSim ${{ matrix.platform }}