diff --git a/.clang-tidy b/.clang-tidy
index aa8780f0a647..01eb6ffd31b1 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -58,5 +58,5 @@ Checks: >
   -readability-magic-numbers,
 
 WarningsAsErrors: '*'
-HeaderFilterRegex: 'include\/ccf\/(ds|threading|service|research|pal)\/.*'
+HeaderFilterRegex: 'include\/ccf\/.*'
 FormatStyle:     'file'
\ No newline at end of file
diff --git a/include/ccf/base_endpoint_registry.h b/include/ccf/base_endpoint_registry.h
index a1999d251167..cf4da9122a9f 100644
--- a/include/ccf/base_endpoint_registry.h
+++ b/include/ccf/base_endpoint_registry.h
@@ -14,7 +14,7 @@ namespace ccf
   /** Lists the possible return codes from the versioned APIs in @c
    * ccf::BaseEndpointRegistry
    */
-  enum class ApiResult
+  enum class ApiResult : uint8_t
   {
     /** Call was successful, results can be used */
     OK = 0,
@@ -25,7 +25,7 @@ namespace ccf
     /** One of the arguments passed to the function is invalid. It may be
        outside the range of known values, or not be in the expected format. */
     InvalidArgs,
-    /** The requsted value was not found. */
+    /** The requested value was not found. */
     NotFound,
     /** General error not covered by the cases above. Generally means that an
        unexpected exception was thrown during execution. */
@@ -66,7 +66,7 @@ namespace ccf
   /** Lists possible reasons for an ApiResult::InvalidArgs being return in @c
    * ccf::BaseEndpointRegistry
    */
-  enum class InvalidArgsReason
+  enum class InvalidArgsReason : uint8_t
   {
     NoReason = 0,
     /** Views start at 1 (one) in CCF */
diff --git a/include/ccf/claims_digest.h b/include/ccf/claims_digest.h
index 4baf8ae10d8f..45881ea97436 100644
--- a/include/ccf/claims_digest.h
+++ b/include/ccf/claims_digest.h
@@ -27,7 +27,7 @@ namespace ccf
     void set(Digest::Representation&& r)
     {
       is_set = true;
-      digest.set(std::move(r));
+      digest.set(r);
     }
 
     [[nodiscard]] bool empty() const
diff --git a/include/ccf/cose_signatures_config_interface.h b/include/ccf/cose_signatures_config_interface.h
index 32a0df01a6d6..3baebfd20709 100644
--- a/include/ccf/cose_signatures_config_interface.h
+++ b/include/ccf/cose_signatures_config_interface.h
@@ -15,14 +15,14 @@ namespace ccf::cose
   class AbstractCOSESignaturesConfig : public ccf::AbstractNodeSubSystem
   {
   public:
-    virtual ~AbstractCOSESignaturesConfig() = default;
+    ~AbstractCOSESignaturesConfig() override = default;
 
     static char const* get_subsystem_name()
     {
       return "COSESignaturesConfig";
     }
 
-    virtual const ccf::COSESignaturesConfig& get_cose_signatures_config()
-      const = 0;
+    [[nodiscard]] virtual const ccf::COSESignaturesConfig&
+    get_cose_signatures_config() const = 0;
   };
 }
\ No newline at end of file
diff --git a/include/ccf/crypto/jwk.h b/include/ccf/crypto/jwk.h
index 5902df5434df..c9a85c4e5871 100644
--- a/include/ccf/crypto/jwk.h
+++ b/include/ccf/crypto/jwk.h
@@ -48,7 +48,7 @@ namespace ccf::crypto
 
   struct JsonWebKeyData
   {
-    JsonWebKeyType kty;
+    JsonWebKeyType kty = JsonWebKeyType::EC;
     std::optional<std::string> kid = std::nullopt;
     std::optional<std::vector<std::string>> x5c = std::nullopt;
     std::optional<std::string> n = std::nullopt;
diff --git a/include/ccf/crypto/sha256_hash.h b/include/ccf/crypto/sha256_hash.h
index 192d3c33ed24..13a33128fa2d 100644
--- a/include/ccf/crypto/sha256_hash.h
+++ b/include/ccf/crypto/sha256_hash.h
@@ -21,9 +21,9 @@ namespace ccf::crypto
 
     Sha256Hash() = default;
 
-    void set(Representation&& r)
+    void set(const Representation& r)
     {
-      h = std::move(r);
+      h = r;
     }
 
     Sha256Hash(const uint8_t* data, size_t size);
@@ -34,6 +34,14 @@ namespace ccf::crypto
       const Sha256Hash& first,
       const Sha256Hash& second,
       const Sha256Hash& third);
+    Sha256Hash(const Sha256Hash& hash) = default;
+    Sha256Hash& operator=(const Sha256Hash& hash) = default;
+    Sha256Hash(Sha256Hash&& hash) noexcept : h(hash.h) {}
+    Sha256Hash& operator=(Sha256Hash&& hash) noexcept
+    {
+      h = hash.h;
+      return *this;
+    }
 
     friend std::ostream& operator<<(
       std::ostream& os, const ccf::crypto::Sha256Hash& h);
diff --git a/include/ccf/endpoint.h b/include/ccf/endpoint.h
index c8b3025e7e1c..a407c8f47065 100644
--- a/include/ccf/endpoint.h
+++ b/include/ccf/endpoint.h
@@ -40,7 +40,7 @@ namespace ccf::kv::serialisers
     {
       auto str =
         fmt::format("{} {}", endpoint_key.verb.c_str(), endpoint_key.uri_path);
-      return SerialisedEntry(str.begin(), str.end());
+      return {str.begin(), str.end()};
     }
 
     static ccf::endpoints::EndpointKey from_serialised(
@@ -64,7 +64,7 @@ namespace ccf::endpoints
   DECLARE_JSON_TYPE(EndpointKey);
   DECLARE_JSON_REQUIRED_FIELDS(EndpointKey, uri_path, verb);
 
-  enum class ForwardingRequired
+  enum class ForwardingRequired : uint8_t
   {
     /** ForwardingRequired::Sometimes is the default value, and should be used
      * for most read-only operations. If this request is made to a backup node,
@@ -90,7 +90,7 @@ namespace ccf::endpoints
     Never
   };
 
-  enum class RedirectionStrategy
+  enum class RedirectionStrategy : uint8_t
   {
     /** This operation does not need to be redirected, and can be executed on
        the receiving node. Most read-only operations can be executed on any
@@ -109,14 +109,14 @@ namespace ccf::endpoints
     ToBackup,
   };
 
-  enum class Mode
+  enum class Mode : uint8_t
   {
     ReadWrite,
     ReadOnly,
     Historical
   };
 
-  enum QueryParamPresence
+  enum QueryParamPresence : uint8_t
   {
     RequiredParameter,
     OptionalParameter,
@@ -142,10 +142,10 @@ namespace ccf::endpoints
 
   struct InterpreterReusePolicy
   {
-    enum
+    enum class Kind : uint8_t
     {
       KeyBased
-    } kind;
+    } kind = Kind::KeyBased;
 
     std::string key;
 
@@ -154,8 +154,11 @@ namespace ccf::endpoints
 
   void to_json(nlohmann::json& j, const InterpreterReusePolicy& grp);
   void from_json(const nlohmann::json& j, InterpreterReusePolicy& grp);
-  std::string schema_name(const InterpreterReusePolicy*);
-  void fill_json_schema(nlohmann::json& schema, const InterpreterReusePolicy*);
+  std::string schema_name(
+    [[maybe_unused]] const InterpreterReusePolicy* policy);
+  void fill_json_schema(
+    nlohmann::json& schema,
+    [[maybe_unused]] const InterpreterReusePolicy* policy);
 
   struct EndpointProperties
   {
@@ -259,8 +262,9 @@ namespace ccf::endpoints
     struct Installer
     {
       virtual void install(Endpoint&) = 0;
+      virtual ~Installer() = default;
     };
-    Installer* installer;
+    Installer* installer = nullptr;
 
     using SchemaBuilderFn =
       std::function<void(nlohmann::json&, const Endpoint&)>;
@@ -341,6 +345,7 @@ namespace ccf::endpoints
      * @param status Response status code
      * @return This Endpoint for further modification
      */
+    // NOLINTNEXTLINE(misc-confusable-identifiers)
     template <typename In, typename Out>
     Endpoint& set_auto_schema(std::optional<http_status> status = std::nullopt)
     {
@@ -430,7 +435,7 @@ namespace ccf::endpoints
     template <typename T>
     Endpoint& add_query_parameter(
       const std::string& param_name,
-      QueryParamPresence presence = RequiredParameter)
+      QueryParamPresence presence = QueryParamPresence::RequiredParameter)
     {
       schema_builders.push_back(
         [param_name,
@@ -448,7 +453,8 @@ namespace ccf::endpoints
           auto parameter = nlohmann::json::object();
           parameter["name"] = param_name;
           parameter["in"] = "query";
-          parameter["required"] = presence == RequiredParameter;
+          parameter["required"] =
+            presence == QueryParamPresence::RequiredParameter;
           parameter["schema"] = ds::openapi::add_schema_to_components(
             document, schema_name, query_schema);
           ds::openapi::add_request_parameter_schema(
@@ -488,7 +494,7 @@ struct formatter<ccf::endpoints::ForwardingRequired>
   auto format(
     const ccf::endpoints::ForwardingRequired& v, FormatContext& ctx) const
   {
-    char const* s;
+    char const* s = nullptr;
     switch (v)
     {
       case ccf::endpoints::ForwardingRequired::Sometimes:
diff --git a/include/ccf/endpoint_registry.h b/include/ccf/endpoint_registry.h
index 1e5a6578c883..21189cb1bead 100644
--- a/include/ccf/endpoint_registry.h
+++ b/include/ccf/endpoint_registry.h
@@ -40,12 +40,12 @@ namespace ccf::endpoints
 
   struct RequestCompletedEvent
   {
-    std::string method = "";
+    std::string method;
     // This contains the path template against which the request matched. For
     // instance `/user/{user_id}` rather than `/user/Bob`. This should be safe
     // to log, though doing so still reveals (to anyone with stdout access)
     // exactly which endpoints were executed and when.
-    std::string dispatch_path = "";
+    std::string dispatch_path;
     int status = 0;
     std::chrono::milliseconds exec_time{0};
     size_t attempts = 0;
@@ -53,7 +53,7 @@ namespace ccf::endpoints
 
   struct DispatchFailedEvent
   {
-    std::string method = "";
+    std::string method;
     int status = 0;
   };
 
@@ -116,7 +116,7 @@ namespace ccf::endpoints
   class EndpointRegistry : public Endpoint::Installer
   {
   public:
-    enum ReadWrite
+    enum class ReadWrite : uint8_t
     {
       Read,
       Write
@@ -165,11 +165,11 @@ namespace ccf::endpoints
     ccf::kv::TxHistory* history = nullptr;
 
   public:
-    EndpointRegistry(const std::string& method_prefix_) :
-      method_prefix(method_prefix_)
+    EndpointRegistry(std::string method_prefix_) :
+      method_prefix(std::move(method_prefix_))
     {}
 
-    virtual ~EndpointRegistry() = default;
+    ~EndpointRegistry() override = default;
 
     /** Create a new endpoint.
      *
@@ -254,12 +254,13 @@ namespace ccf::endpoints
      * internally, so must be able to populate the document
      * with the supported endpoints however it defines them.
      */
-    virtual void build_api(nlohmann::json& document, ccf::kv::ReadOnlyTx&);
+    virtual void build_api(
+      nlohmann::json& document, [[maybe_unused]] ccf::kv::ReadOnlyTx& tx);
 
     virtual void init_handlers();
 
     virtual EndpointDefinitionPtr find_endpoint(
-      ccf::kv::Tx&, ccf::RpcContext& rpc_ctx);
+      [[maybe_unused]] ccf::kv::Tx& tx, ccf::RpcContext& rpc_ctx);
 
     virtual void execute_endpoint(
       EndpointDefinitionPtr e, EndpointContext& ctx);
@@ -268,7 +269,7 @@ namespace ccf::endpoints
       EndpointDefinitionPtr e, CommandEndpointContext& ctx, const TxID& tx_id);
 
     virtual std::set<RESTVerb> get_allowed_verbs(
-      ccf::kv::Tx&, const ccf::RpcContext& rpc_ctx);
+      [[maybe_unused]] ccf::kv::Tx& tx, const ccf::RpcContext& rpc_ctx);
 
     virtual bool request_needs_root(const ccf::RpcContext& rpc_ctx);
 
@@ -276,7 +277,7 @@ namespace ccf::endpoints
       const std::string& path,
       const std::vector<EndpointDefinitionPtr>& matches);
 
-    virtual void tick(std::chrono::milliseconds);
+    virtual void tick([[maybe_unused]] std::chrono::milliseconds duration);
 
     void set_consensus(ccf::kv::Consensus* c);
 
diff --git a/include/ccf/endpoints/authentication/all_of_auth.h b/include/ccf/endpoints/authentication/all_of_auth.h
index 04476b541682..a8814ad6abd7 100644
--- a/include/ccf/endpoints/authentication/all_of_auth.h
+++ b/include/ccf/endpoints/authentication/all_of_auth.h
@@ -15,7 +15,7 @@ namespace ccf
   {
     std::map<std::string, std::unique_ptr<AuthnIdentity>> identities;
 
-    std::string get_conjoined_name() const;
+    [[nodiscard]] std::string get_conjoined_name() const;
   };
 
   class AllOfAuthnPolicy : public AuthnPolicy
@@ -37,15 +37,16 @@ namespace ccf
       const std::vector<std::shared_ptr<AuthnPolicy>>& _policies);
 
     std::unique_ptr<AuthnIdentity> authenticate(
-      ccf::kv::ReadOnlyTx&,
-      const std::shared_ptr<ccf::RpcContext>&,
-      std::string&) override;
+      ccf::kv::ReadOnlyTx& tx,
+      const std::shared_ptr<ccf::RpcContext>& ctx,
+      std::string& error_reason) override;
 
     void set_unauthenticated_error(
-      std::shared_ptr<ccf::RpcContext>, std::string&&) override;
+      std::shared_ptr<ccf::RpcContext> ctx,
+      std::string&& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override;
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override;
 
     std::string get_security_scheme_name() override;
   };
diff --git a/include/ccf/endpoints/authentication/cert_auth.h b/include/ccf/endpoints/authentication/cert_auth.h
index 844716db7f3a..2648362791a7 100644
--- a/include/ccf/endpoints/authentication/cert_auth.h
+++ b/include/ccf/endpoints/authentication/cert_auth.h
@@ -7,15 +7,12 @@
 
 namespace ccf
 {
-  namespace
+  inline std::optional<OpenAPISecuritySchema> get_cert_based_security_schema()
   {
-    std::optional<OpenAPISecuritySchema> get_cert_based_security_schema()
-    {
-      // There is currently no OpenAPI-compliant way to describe cert-based TLS
-      // auth, so this policy is not documented. This should change in
-      // OpenAPI3.1: https://github.com/OAI/OpenAPI-Specification/pull/1764
-      return std::nullopt;
-    }
+    // There is currently no OpenAPI-compliant way to describe cert-based TLS
+    // auth, so this policy is not documented. This should change in
+    // OpenAPI3.1: https://github.com/OAI/OpenAPI-Specification/pull/1764
+    return std::nullopt;
   }
 
   struct UserCertAuthnIdentity : public AuthnIdentity
@@ -35,20 +32,20 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "user_cert";
 
     UserCertAuthnPolicy();
-    virtual ~UserCertAuthnPolicy();
+    ~UserCertAuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
       const std::shared_ptr<ccf::RpcContext>& ctx,
       std::string& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return get_cert_based_security_schema();
     }
 
-    virtual std::string get_security_scheme_name() override
+    std::string get_security_scheme_name() override
     {
       return SECURITY_SCHEME_NAME;
     };
@@ -69,20 +66,20 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "member_cert";
 
     MemberCertAuthnPolicy();
-    virtual ~MemberCertAuthnPolicy();
+    ~MemberCertAuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
       const std::shared_ptr<ccf::RpcContext>& ctx,
       std::string& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return get_cert_based_security_schema();
     }
 
-    virtual std::string get_security_scheme_name() override
+    std::string get_security_scheme_name() override
     {
       return SECURITY_SCHEME_NAME;
     };
@@ -103,13 +100,13 @@ namespace ccf
       const std::shared_ptr<ccf::RpcContext>& ctx,
       std::string& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return get_cert_based_security_schema();
     }
 
-    virtual std::string get_security_scheme_name() override
+    std::string get_security_scheme_name() override
     {
       return SECURITY_SCHEME_NAME;
     };
@@ -130,20 +127,20 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "any_cert";
 
     AnyCertAuthnPolicy();
-    virtual ~AnyCertAuthnPolicy();
+    ~AnyCertAuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
       const std::shared_ptr<ccf::RpcContext>& ctx,
       std::string& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return get_cert_based_security_schema();
     }
 
-    virtual std::string get_security_scheme_name() override
+    std::string get_security_scheme_name() override
     {
       return SECURITY_SCHEME_NAME;
     };
diff --git a/include/ccf/endpoints/authentication/cose_auth.h b/include/ccf/endpoints/authentication/cose_auth.h
index 03a59bb0fe6e..546b08b96cab 100644
--- a/include/ccf/endpoints/authentication/cose_auth.h
+++ b/include/ccf/endpoints/authentication/cose_auth.h
@@ -11,7 +11,7 @@ namespace ccf
 {
   struct ProtectedHeader
   {
-    int64_t alg;
+    int64_t alg = 0;
     std::string kid;
   };
 
@@ -19,7 +19,7 @@ namespace ccf
   {
     std::optional<std::string> gov_msg_type;
     std::optional<std::string> gov_msg_proposal_id;
-    uint64_t gov_msg_created_at;
+    uint64_t gov_msg_created_at = 0;
   };
 
   struct TimestampedProtectedHeader : ProtectedHeader
@@ -70,13 +70,13 @@ namespace ccf
       const std::span<const uint8_t>& content_,
       const std::span<const uint8_t>& envelope_,
       const std::span<const uint8_t>& signature_,
-      const MemberId& member_id_,
-      const ccf::crypto::Pem& member_cert_,
-      const GovernanceProtectedHeader& protected_header_) :
+      MemberId member_id_,
+      ccf::crypto::Pem member_cert_,
+      GovernanceProtectedHeader protected_header_) :
       COSESign1AuthnIdentity(content_, envelope_, signature_),
-      member_id(member_id_),
-      member_cert(member_cert_),
-      protected_header(protected_header_)
+      member_id(std::move(member_id_)),
+      member_cert(std::move(member_cert_)),
+      protected_header(std::move(protected_header_))
     {}
   };
 
@@ -95,13 +95,13 @@ namespace ccf
       const std::span<const uint8_t>& content_,
       const std::span<const uint8_t>& envelope_,
       const std::span<const uint8_t>& signature_,
-      const UserId& user_id_,
-      const ccf::crypto::Pem& user_cert_,
-      const TimestampedProtectedHeader& protected_header_) :
+      UserId user_id_,
+      ccf::crypto::Pem user_cert_,
+      TimestampedProtectedHeader protected_header_) :
       COSESign1AuthnIdentity(content_, envelope_, signature_),
-      user_id(user_id_),
-      user_cert(user_cert_),
-      protected_header(protected_header_)
+      user_id(std::move(user_id_)),
+      user_cert(std::move(user_cert_)),
+      protected_header(std::move(protected_header_))
     {}
   };
 
@@ -122,7 +122,7 @@ namespace ccf
 
     MemberCOSESign1AuthnPolicy(
       std::optional<std::string> gov_msg_type_ = std::nullopt);
-    ~MemberCOSESign1AuthnPolicy();
+    ~MemberCOSESign1AuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
@@ -133,8 +133,8 @@ namespace ccf
       std::shared_ptr<ccf::RpcContext> ctx,
       std::string&& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return security_schema;
     }
@@ -190,12 +190,12 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "user_cose_sign1";
 
     UserCOSESign1AuthnPolicy(
-      const std::string& msg_type_name_ = "ccf.msg.type",
-      const std::string& msg_created_at_name_ = "ccf.msg.created_at") :
-      msg_type_name(msg_type_name_),
-      msg_created_at_name(msg_created_at_name_)
+      std::string msg_type_name_ = "ccf.msg.type",
+      std::string msg_created_at_name_ = "ccf.msg.created_at") :
+      msg_type_name(std::move(msg_type_name_)),
+      msg_created_at_name(std::move(msg_created_at_name_))
     {}
-    ~UserCOSESign1AuthnPolicy();
+    ~UserCOSESign1AuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
@@ -206,8 +206,8 @@ namespace ccf
       std::shared_ptr<ccf::RpcContext> ctx,
       std::string&& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return security_schema;
     }
@@ -232,11 +232,12 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "typed_user_cose_sign1";
 
     TypedUserCOSESign1AuthnPolicy(
-      const std::string& expected_msg_type_,
-      const std::string& msg_type_name_ = "ccf.msg.type",
-      const std::string& msg_created_at_name_ = "ccf.msg.created_at") :
-      UserCOSESign1AuthnPolicy(msg_type_name_, msg_created_at_name_),
-      expected_msg_type(expected_msg_type_)
+      std::string expected_msg_type_,
+      std::string msg_type_name_ = "ccf.msg.type",
+      std::string msg_created_at_name_ = "ccf.msg.created_at") :
+      UserCOSESign1AuthnPolicy(
+        std::move(msg_type_name_), std::move(msg_created_at_name_)),
+      expected_msg_type(std::move(expected_msg_type_))
     {}
 
     std::unique_ptr<AuthnIdentity> authenticate(
diff --git a/include/ccf/endpoints/authentication/empty_auth.h b/include/ccf/endpoints/authentication/empty_auth.h
index f5ec3870e575..2827b5fa426a 100644
--- a/include/ccf/endpoints/authentication/empty_auth.h
+++ b/include/ccf/endpoints/authentication/empty_auth.h
@@ -17,15 +17,16 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "no_auth";
 
     std::unique_ptr<AuthnIdentity> authenticate(
-      ccf::kv::ReadOnlyTx&,
-      const std::shared_ptr<ccf::RpcContext>&,
-      std::string&) override;
+      [[maybe_unused]] ccf::kv::ReadOnlyTx& tx,
+      [[maybe_unused]] const std::shared_ptr<ccf::RpcContext>& ctx,
+      [[maybe_unused]] std::string& error_reason) override;
 
     void set_unauthenticated_error(
-      std::shared_ptr<ccf::RpcContext>, std::string&&) override;
+      [[maybe_unused]] std::shared_ptr<ccf::RpcContext> ctx,
+      [[maybe_unused]] std::string&& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return unauthenticated_schema;
     }
diff --git a/include/ccf/endpoints/authentication/js.h b/include/ccf/endpoints/authentication/js.h
index 2a853d4ccbeb..6894b4a54f14 100644
--- a/include/ccf/endpoints/authentication/js.h
+++ b/include/ccf/endpoints/authentication/js.h
@@ -56,7 +56,7 @@ namespace ccf
   }
 
   template <typename T>
-  static inline constexpr char const* get_policy_name_from_ident(const T*)
+  static constexpr char const* get_policy_name_from_ident(const T* /*unused*/)
   {
     if constexpr (std::is_same_v<T, ccf::UserCertAuthnIdentity>)
     {
diff --git a/include/ccf/endpoints/authentication/jwt_auth.h b/include/ccf/endpoints/authentication/jwt_auth.h
index 70d4f3f7c813..2471410cb83f 100644
--- a/include/ccf/endpoints/authentication/jwt_auth.h
+++ b/include/ccf/endpoints/authentication/jwt_auth.h
@@ -34,7 +34,7 @@ namespace ccf
     static constexpr auto SECURITY_SCHEME_NAME = "jwt";
 
     JwtAuthnPolicy();
-    virtual ~JwtAuthnPolicy();
+    ~JwtAuthnPolicy() override;
 
     std::unique_ptr<AuthnIdentity> authenticate(
       ccf::kv::ReadOnlyTx& tx,
@@ -45,8 +45,8 @@ namespace ccf
       std::shared_ptr<ccf::RpcContext> ctx,
       std::string&& error_reason) override;
 
-    std::optional<OpenAPISecuritySchema> get_openapi_security_schema()
-      const override
+    [[nodiscard]] std::optional<OpenAPISecuritySchema>
+    get_openapi_security_schema() const override
     {
       return security_schema;
     }
diff --git a/include/ccf/entity_id.h b/include/ccf/entity_id.h
index 9c12ad3f800e..f6a87ed5282f 100644
--- a/include/ccf/entity_id.h
+++ b/include/ccf/entity_id.h
@@ -26,20 +26,27 @@ namespace ccf
     EntityId(const EntityId& id_) = default;
     EntityId(const Value& id_) : id(id_) {}
     EntityId(Value&& id_) : id(std::move(id_)) {}
+    EntityId(EntityId&& id_) noexcept : id(std::move(id_)) {}
+    EntityId& operator=(EntityId&& other) = default;
 
     operator std::string() const
     {
       return id;
     }
 
-    void operator=(const EntityId& other)
+    EntityId& operator=(const EntityId& other)
     {
-      id = other.id;
+      if (this != &other)
+      {
+        id = other.id;
+      }
+      return *this;
     }
 
-    void operator=(const Value& id_)
+    EntityId& operator=(const Value& id_)
     {
       id = id_;
+      return *this;
     }
 
     bool operator==(const EntityId& other) const
@@ -157,6 +164,7 @@ namespace ccf
   using NodeId = EntityId<NodeIdFormatter>;
 }
 
+// NOLINTBEGIN(cert-dcl58-cpp)
 namespace std
 {
   template <typename FmtExtender>
@@ -183,6 +191,7 @@ namespace std
     }
   };
 }
+// NOLINTEND(cert-dcl58-cpp)
 
 FMT_BEGIN_NAMESPACE
 template <typename FmtExtender>
diff --git a/include/ccf/historical_queries_adapter.h b/include/ccf/historical_queries_adapter.h
index 01abd9720227..e95252c85bee 100644
--- a/include/ccf/historical_queries_adapter.h
+++ b/include/ccf/historical_queries_adapter.h
@@ -39,7 +39,7 @@ namespace ccf::historical
   std::optional<ccf::TxID> txid_from_header(
     endpoints::CommandEndpointContext& args);
 
-  enum class HistoricalQueryErrorCode
+  enum class HistoricalQueryErrorCode : uint8_t
   {
     InternalError,
     TransactionPending,
@@ -63,7 +63,7 @@ namespace ccf::historical
     std::string reason,
     endpoints::CommandEndpointContext& args);
 
-  enum class HistoricalTxStatus
+  enum class HistoricalTxStatus : uint8_t
   {
     Error,
     PendingOrUnknown,
diff --git a/include/ccf/historical_queries_interface.h b/include/ccf/historical_queries_interface.h
index f4bc6ba9f4d4..0867b859c535 100644
--- a/include/ccf/historical_queries_interface.h
+++ b/include/ccf/historical_queries_interface.h
@@ -23,11 +23,11 @@ namespace ccf::historical
     ccf::TxID transaction_id;
 
     State(
-      const ccf::kv::ReadOnlyStorePtr& store_,
-      const TxReceiptImplPtr& receipt_,
+      ccf::kv::ReadOnlyStorePtr store_,
+      TxReceiptImplPtr receipt_,
       const ccf::TxID& transaction_id_) :
-      store(store_),
-      receipt(receipt_),
+      store(std::move(store_)),
+      receipt(std::move(receipt_)),
       transaction_id(transaction_id_)
     {}
 
@@ -66,7 +66,7 @@ namespace ccf::historical
   class AbstractStateCache : public ccf::AbstractNodeSubSystem
   {
   public:
-    virtual ~AbstractStateCache() = default;
+    ~AbstractStateCache() override = default;
 
     static char const* get_subsystem_name()
     {
diff --git a/include/ccf/http_accept.h b/include/ccf/http_accept.h
index 53093bfde33b..8e294c7e885b 100644
--- a/include/ccf/http_accept.h
+++ b/include/ccf/http_accept.h
@@ -22,7 +22,7 @@ namespace ccf::http
       return s == "*";
     }
 
-    bool matches(const std::string& mime) const
+    [[nodiscard]] bool matches(const std::string& mime) const
     {
       const auto [t, st] = ccf::nonstd::split_1(mime, "/");
 
diff --git a/include/ccf/http_etag.h b/include/ccf/http_etag.h
index 8047539abaaa..68f3f0b04dde 100644
--- a/include/ccf/http_etag.h
+++ b/include/ccf/http_etag.h
@@ -7,70 +7,67 @@
 #include <set>
 #include <string>
 
-namespace ccf
+namespace ccf::http
 {
-  namespace http
+  /** Utility class to resolve If-Match and If-None-Match as described
+   * in https://www.rfc-editor.org/rfc/rfc9110#field.if-match
+   */
+  class Matcher
   {
-    /** Utility class to resolve If-Match and If-None-Match as described
-     * in https://www.rfc-editor.org/rfc/rfc9110#field.if-match
+  private:
+    /// If-Match header is present and has the value "*"
+    bool any_value = false;
+    /// If-Match header is present and has specific etag values
+    std::set<std::string> if_etags;
+
+  public:
+    /** Construct a Matcher from a match header
+     *
+     * Note: Weak tags are not supported.
      */
-    class Matcher
+    Matcher(const std::string& match_header)
     {
-    private:
-      /// If-Match header is present and has the value "*"
-      bool any_value = false;
-      /// If-Match header is present and has specific etag values
-      std::set<std::string> if_etags;
-
-    public:
-      /** Construct a Matcher from a match header
-       *
-       * Note: Weak tags are not supported.
-       */
-      Matcher(const std::string& match_header)
+      if (match_header == "*")
       {
-        if (match_header == "*")
-        {
-          any_value = true;
-          return;
-        }
-
-        std::regex etag_rx("\\\"([0-9a-f]+)\\\",?\\s*");
-        auto etags_begin = std::sregex_iterator(
-          match_header.begin(), match_header.end(), etag_rx);
-        auto etags_end = std::sregex_iterator();
-        ssize_t last_matched = 0;
-
-        for (std::sregex_iterator i = etags_begin; i != etags_end; ++i)
-        {
-          if (i->position() != last_matched)
-          {
-            throw std::runtime_error("Invalid If-Match header");
-          }
-          std::smatch match = *i;
-          if_etags.insert(match[1].str());
-          last_matched = match.position() + match.length();
-        }
+        any_value = true;
+        return;
+      }
 
-        ssize_t last_index_in_header = match_header.size();
+      std::regex etag_rx(R"(\"([0-9a-f]+)\",?\s*)");
+      auto etags_begin =
+        std::sregex_iterator(match_header.begin(), match_header.end(), etag_rx);
+      auto etags_end = std::sregex_iterator();
+      ssize_t last_matched = 0;
 
-        if (last_matched != last_index_in_header || if_etags.empty())
+      for (std::sregex_iterator i = etags_begin; i != etags_end; ++i)
+      {
+        if (i->position() != last_matched)
         {
           throw std::runtime_error("Invalid If-Match header");
         }
+        const std::smatch& match = *i;
+        if_etags.insert(match[1].str());
+        last_matched = match.position() + match.length();
       }
 
-      /// Check if a given ETag matches the If-Match/If-None-Match header
-      bool matches(const std::string& etag) const
-      {
-        return any_value || if_etags.contains(etag);
-      }
+      ssize_t last_index_in_header = match_header.size();
 
-      /// Check if the header will match any ETag (*)
-      bool is_any() const
+      if (last_matched != last_index_in_header || if_etags.empty())
       {
-        return any_value;
+        throw std::runtime_error("Invalid If-Match header");
       }
-    };
-  }
+    }
+
+    /// Check if a given ETag matches the If-Match/If-None-Match header
+    [[nodiscard]] bool matches(const std::string& etag) const
+    {
+      return any_value || if_etags.contains(etag);
+    }
+
+    /// Check if the header will match any ETag (*)
+    [[nodiscard]] bool is_any() const
+    {
+      return any_value;
+    }
+  };
 }
\ No newline at end of file
diff --git a/include/ccf/http_query.h b/include/ccf/http_query.h
index 88157af8d530..d52854cfe495 100644
--- a/include/ccf/http_query.h
+++ b/include/ccf/http_query.h
@@ -63,19 +63,18 @@ namespace ccf::http
         val = true;
         return true;
       }
-      else if (param_val == "false")
+
+      if (param_val == "false")
       {
         val = false;
         return true;
       }
-      else
-      {
-        error_reason = fmt::format(
-          "Unable to parse value '{}' as bool in parameter '{}'",
-          param_val,
-          param_key);
-        return false;
-      }
+
+      error_reason = fmt::format(
+        "Unable to parse value '{}' as bool in parameter '{}'",
+        param_val,
+        param_key);
+      return false;
     }
     else if constexpr (std::is_integral_v<T>)
     {
@@ -108,9 +107,6 @@ namespace ccf::http
     {
       return val;
     }
-    else
-    {
-      return std::nullopt;
-    }
+    return std::nullopt;
   }
 }
diff --git a/include/ccf/indexing/indexer_interface.h b/include/ccf/indexing/indexer_interface.h
index 58cb70f75afa..b92d894c4429 100644
--- a/include/ccf/indexing/indexer_interface.h
+++ b/include/ccf/indexing/indexer_interface.h
@@ -24,7 +24,7 @@ namespace ccf::indexing
     std::set<StrategyPtr> strategies;
 
   public:
-    virtual ~IndexingStrategies() = default;
+    ~IndexingStrategies() override = default;
 
     static char const* get_subsystem_name()
     {
diff --git a/include/ccf/indexing/strategies/seqnos_by_key_bucketed.h b/include/ccf/indexing/strategies/seqnos_by_key_bucketed.h
index 96ec1d15ff46..7d121d0381cf 100644
--- a/include/ccf/indexing/strategies/seqnos_by_key_bucketed.h
+++ b/include/ccf/indexing/strategies/seqnos_by_key_bucketed.h
@@ -34,7 +34,7 @@ namespace ccf::indexing::strategies
       size_t seqnos_per_bucket_ = 1000,
       size_t max_buckets_ = 10);
 
-    size_t max_requestable_range() const;
+    [[nodiscard]] size_t max_requestable_range() const;
   };
 
   template <typename M>
diff --git a/include/ccf/indexing/strategies/visit_each_entry_in_map.h b/include/ccf/indexing/strategies/visit_each_entry_in_map.h
index fb6b9613e058..d5dbb2eaf671 100644
--- a/include/ccf/indexing/strategies/visit_each_entry_in_map.h
+++ b/include/ccf/indexing/strategies/visit_each_entry_in_map.h
@@ -31,7 +31,7 @@ namespace ccf::indexing::strategies
       const std::string& map_name_,
       const std::string& strategy_prefix = "VisitEachEntryIn");
 
-    virtual ~VisitEachEntryInMap() = default;
+    ~VisitEachEntryInMap() override = default;
 
     void handle_committed_transaction(
       const ccf::TxID& tx_id, const ccf::kv::ReadOnlyStorePtr& store) override;
diff --git a/include/ccf/indexing/strategy.h b/include/ccf/indexing/strategy.h
index 3d3773468072..d7e1cdabf5de 100644
--- a/include/ccf/indexing/strategy.h
+++ b/include/ccf/indexing/strategy.h
@@ -25,7 +25,7 @@ namespace ccf::indexing
     const std::string name;
 
   public:
-    Strategy(const std::string& name) : name(name) {}
+    Strategy(std::string name) : name(std::move(name)) {}
     virtual ~Strategy() = default;
 
     [[nodiscard]] std::string get_name() const
diff --git a/include/ccf/js/audit_format.h b/include/ccf/js/audit_format.h
index 96a36932990f..151a2eddc3b4 100644
--- a/include/ccf/js/audit_format.h
+++ b/include/ccf/js/audit_format.h
@@ -8,7 +8,7 @@
 
 namespace ccf
 {
-  enum class ActionFormat
+  enum class ActionFormat : uint8_t
   {
     COSE = 0,
     JSON = 1
diff --git a/include/ccf/js/core/context.h b/include/ccf/js/core/context.h
index fa5946e0dfff..f1672d2f5c6d 100644
--- a/include/ccf/js/core/context.h
+++ b/include/ccf/js/core/context.h
@@ -36,8 +36,8 @@ namespace ccf::js::core
   struct InterruptData
   {
     std::chrono::high_resolution_clock::time_point start_time;
-    std::chrono::milliseconds max_execution_time;
-    ccf::js::TxAccess access;
+    std::chrono::milliseconds max_execution_time = {};
+    ccf::js::TxAccess access = ccf::js::TxAccess::APP_RO;
     bool request_timed_out = false;
   };
 
@@ -142,7 +142,7 @@ namespace ccf::js::core
     [[nodiscard]] JSWrappedValue new_string_len(
       const char* buf, size_t buf_len) const;
     [[nodiscard]] JSWrappedValue new_string_len(
-      const std::span<const uint8_t> buf) const;
+      std::span<const uint8_t> buf) const;
     JSWrappedValue new_type_error(const char* fmt, ...) const;
     JSWrappedValue new_internal_error(const char* fmt, ...) const;
     [[nodiscard]] JSWrappedValue new_tag_value(int tag, int32_t val = 0) const;
@@ -197,8 +197,7 @@ namespace ccf::js::core
     {
       for (auto& extension : extensions)
       {
-        if (TExtension* t = dynamic_cast<TExtension*>(extension.get());
-            t != nullptr)
+        if (auto* t = dynamic_cast<TExtension*>(extension.get()); t != nullptr)
         {
           return t;
         }
diff --git a/include/ccf/js/core/runtime.h b/include/ccf/js/core/runtime.h
index 6794c5fa4982..8d36446cd25e 100644
--- a/include/ccf/js/core/runtime.h
+++ b/include/ccf/js/core/runtime.h
@@ -9,7 +9,7 @@
 
 namespace ccf::js::core
 {
-  enum class RuntimeLimitsPolicy
+  enum class RuntimeLimitsPolicy : uint8_t
   {
     NONE,
     NO_LOWER_THAN_DEFAULTS
diff --git a/include/ccf/js/core/wrapped_property_enum.h b/include/ccf/js/core/wrapped_property_enum.h
index 9b0aa0cce7ca..10068577da8a 100644
--- a/include/ccf/js/core/wrapped_property_enum.h
+++ b/include/ccf/js/core/wrapped_property_enum.h
@@ -48,7 +48,7 @@ namespace ccf::js::core
       return prop_enum[i].atom;
     }
 
-    size_t size() const
+    [[nodiscard]] size_t size() const
     {
       return prop_count;
     }
diff --git a/include/ccf/js/extensions/ccf/historical.h b/include/ccf/js/extensions/ccf/historical.h
index 772175d3c305..6e581f62da49 100644
--- a/include/ccf/js/extensions/ccf/historical.h
+++ b/include/ccf/js/extensions/ccf/historical.h
@@ -28,7 +28,7 @@ namespace ccf::js::extensions
     std::unique_ptr<Impl> impl;
 
     HistoricalExtension(ccf::historical::AbstractStateCache* hs);
-    ~HistoricalExtension();
+    ~HistoricalExtension() override;
 
     void install(js::core::Context& ctx) override;
 
diff --git a/include/ccf/js/extensions/ccf/kv.h b/include/ccf/js/extensions/ccf/kv.h
index a0094a9b7533..d021c014a018 100644
--- a/include/ccf/js/extensions/ccf/kv.h
+++ b/include/ccf/js/extensions/ccf/kv.h
@@ -29,9 +29,9 @@ namespace ccf::js::extensions
     ccf::js::NamespaceRestriction namespace_restriction;
 
     KvExtension(ccf::kv::Tx* t, ccf::js::NamespaceRestriction nr = {});
-    ~KvExtension();
+    ~KvExtension() override;
 
-    void install(js::core::Context& ctx);
+    void install(js::core::Context& ctx) override;
 
     void rethrow_trapped_exceptions() const;
   };
diff --git a/include/ccf/js/extensions/console.h b/include/ccf/js/extensions/console.h
index 0de9158e522f..6188701f2513 100644
--- a/include/ccf/js/extensions/console.h
+++ b/include/ccf/js/extensions/console.h
@@ -27,7 +27,6 @@ namespace ccf::js::extensions
 
     void install(js::core::Context& ctx) override;
 
-    static void log_info_with_tag(
-      const ccf::js::TxAccess access, std::string_view s);
+    static void log_info_with_tag(ccf::js::TxAccess access, std::string_view s);
   };
 }
diff --git a/include/ccf/js/interpreter_cache_interface.h b/include/ccf/js/interpreter_cache_interface.h
index c0ee446881fd..0c9ff9e02c4b 100644
--- a/include/ccf/js/interpreter_cache_interface.h
+++ b/include/ccf/js/interpreter_cache_interface.h
@@ -22,7 +22,7 @@ namespace ccf::js
   class AbstractInterpreterCache : public ccf::AbstractNodeSubSystem
   {
   public:
-    virtual ~AbstractInterpreterCache() = default;
+    ~AbstractInterpreterCache() override = default;
 
     static char const* get_subsystem_name()
     {
diff --git a/include/ccf/js/kv_access_permissions.h b/include/ccf/js/kv_access_permissions.h
index 9553813d573b..9ce17b0bc402 100644
--- a/include/ccf/js/kv_access_permissions.h
+++ b/include/ccf/js/kv_access_permissions.h
@@ -6,7 +6,7 @@
 
 namespace ccf::js
 {
-  enum class KVAccessPermissions
+  enum class KVAccessPermissions : uint8_t
   {
     ILLEGAL = 0,
     READ_ONLY = 1 << 0,
diff --git a/include/ccf/js/registry.h b/include/ccf/js/registry.h
index 9cdca205dbbd..d94d16d7fb1a 100644
--- a/include/ccf/js/registry.h
+++ b/include/ccf/js/registry.h
@@ -145,11 +145,11 @@ namespace ccf::js
     void build_api(nlohmann::json& document, ccf::kv::ReadOnlyTx& tx) override;
 
     std::set<RESTVerb> get_allowed_verbs(
-      ccf::kv::Tx&, const ccf::RpcContext& rpc_ctx) override;
+      ccf::kv::Tx& tx, const ccf::RpcContext& rpc_ctx) override;
     ///@}
 
     virtual ccf::js::extensions::Extensions get_extensions(
-      const ccf::endpoints::EndpointContext& endpoint_ctx)
+      [[maybe_unused]] const ccf::endpoints::EndpointContext& endpoint_ctx)
     {
       return {};
     };
@@ -195,7 +195,7 @@ namespace ccf::js
     ccf::ApiResult check_action_not_replayed_v1(
       ccf::kv::Tx& tx,
       uint64_t created_at,
-      const std::span<const uint8_t> action,
+      std::span<const uint8_t> action,
       ccf::InvalidArgsReason& reason);
   };
 }
diff --git a/include/ccf/js/tx_access.h b/include/ccf/js/tx_access.h
index 9433af65a9b9..2614750312bd 100644
--- a/include/ccf/js/tx_access.h
+++ b/include/ccf/js/tx_access.h
@@ -6,7 +6,7 @@ namespace ccf::js
 {
   /// Describes the context in which JS script is currently executing. Used to
   /// determine which KV tables should be accessible.
-  enum class TxAccess
+  enum class TxAccess : uint8_t
   {
     /// Application code, during evaluation of an endpoint handler function
     /// marked as readonly
diff --git a/include/ccf/network_identity_interface.h b/include/ccf/network_identity_interface.h
index c484de5a5535..510524199392 100644
--- a/include/ccf/network_identity_interface.h
+++ b/include/ccf/network_identity_interface.h
@@ -15,7 +15,7 @@ namespace ccf
   class NetworkIdentitySubsystemInterface : public ccf::AbstractNodeSubSystem
   {
   public:
-    virtual ~NetworkIdentitySubsystemInterface() = default;
+    ~NetworkIdentitySubsystemInterface() override = default;
 
     static char const* get_subsystem_name()
     {
diff --git a/include/ccf/node/cose_signatures_config.h b/include/ccf/node/cose_signatures_config.h
index 974de3f84445..f4e19300359a 100644
--- a/include/ccf/node/cose_signatures_config.h
+++ b/include/ccf/node/cose_signatures_config.h
@@ -10,8 +10,8 @@ namespace ccf
 {
   struct COSESignaturesConfig
   {
-    std::string issuer = "";
-    std::string subject = "";
+    std::string issuer;
+    std::string subject;
 
     bool operator==(const COSESignaturesConfig& other) const = default;
   };
diff --git a/include/ccf/node/node_configuration_interface.h b/include/ccf/node/node_configuration_interface.h
index bb164014e11a..2e913411e6e1 100644
--- a/include/ccf/node/node_configuration_interface.h
+++ b/include/ccf/node/node_configuration_interface.h
@@ -22,7 +22,7 @@ namespace ccf
   class NodeConfigurationInterface : public AbstractNodeSubSystem
   {
   public:
-    virtual ~NodeConfigurationInterface() = default;
+    ~NodeConfigurationInterface() override = default;
 
     static char const* get_subsystem_name()
     {
diff --git a/include/ccf/node/quote.h b/include/ccf/node/quote.h
index f5b2d73e55ef..a1e9fa93eef9 100644
--- a/include/ccf/node/quote.h
+++ b/include/ccf/node/quote.h
@@ -14,7 +14,7 @@
 
 namespace ccf
 {
-  enum class QuoteVerificationResult
+  enum class QuoteVerificationResult : uint8_t
   {
     Verified = 0,
     Failed,
diff --git a/include/ccf/node/startup_config.h b/include/ccf/node/startup_config.h
index bd2684459d85..d02ce53eb4bd 100644
--- a/include/ccf/node/startup_config.h
+++ b/include/ccf/node/startup_config.h
@@ -28,12 +28,12 @@ namespace ccf
     ccf::ds::SizeString historical_cache_soft_limit = {"512MB"};
 
     ccf::consensus::Configuration consensus = {};
-    ccf::NodeInfoNetwork network = {};
+    ccf::NodeInfoNetwork network;
 
     struct NodeCertificateInfo
     {
       std::string subject_name = "CN=CCF Node";
-      std::vector<std::string> subject_alt_names = {};
+      std::vector<std::string> subject_alt_names;
       ccf::crypto::CurveID curve_id = ccf::crypto::CurveID::SECP384R1;
       size_t initial_validity_days = 1;
 
@@ -44,7 +44,7 @@ namespace ccf
     struct Ledger
     {
       std::string directory = "ledger";
-      std::vector<std::string> read_only_directories = {};
+      std::vector<std::string> read_only_directories;
       ccf::ds::SizeString chunk_size = {"5MB"};
 
       bool operator==(const Ledger&) const = default;
@@ -70,7 +70,7 @@ namespace ccf
 
     struct Attestation
     {
-      ccf::pal::snp::EndorsementsServers snp_endorsements_servers = {};
+      ccf::pal::snp::EndorsementsServers snp_endorsements_servers;
       std::optional<std::string> snp_security_policy_file = std::nullopt;
       std::optional<std::string> snp_uvm_endorsements_file = std::nullopt;
       std::optional<std::string> snp_endorsements_file = std::nullopt;
@@ -135,7 +135,7 @@ namespace ccf
     {
       ccf::NodeInfoNetwork::NetAddress target_rpc_address;
       ccf::ds::TimeString retry_timeout = {"1000ms"};
-      std::vector<uint8_t> service_cert = {};
+      std::vector<uint8_t> service_cert;
       bool follow_redirect = true;
     };
     Join join = {};
diff --git a/include/ccf/node_context.h b/include/ccf/node_context.h
index c073822dd792..9d3d358bdc75 100644
--- a/include/ccf/node_context.h
+++ b/include/ccf/node_context.h
@@ -34,7 +34,8 @@ namespace ccf
     }
 
     template <typename T>
-    std::shared_ptr<T> get_subsystem(const std::string& name) const
+    [[nodiscard]] std::shared_ptr<T> get_subsystem(
+      const std::string& name) const
     {
       const auto it = subsystems.find(name);
       if (it != subsystems.end())
@@ -56,7 +57,7 @@ namespace ccf
     }
 
     template <typename T>
-    std::shared_ptr<T> get_subsystem() const
+    [[nodiscard]] std::shared_ptr<T> get_subsystem() const
     {
       return get_subsystem<T>(T::get_subsystem_name());
     }
@@ -71,7 +72,8 @@ namespace ccf
       return {};
     }
 
-    ccf::historical::AbstractStateCache& get_historical_state()
+    [[nodiscard]] ccf::historical::AbstractStateCache& get_historical_state()
+      const
     {
       auto historical_state_cache =
         get_subsystem<ccf::historical::AbstractStateCache>();
@@ -83,7 +85,8 @@ namespace ccf
       return *historical_state_cache;
     }
 
-    ccf::indexing::IndexingStrategies& get_indexing_strategies()
+    [[nodiscard]] ccf::indexing::IndexingStrategies& get_indexing_strategies()
+      const
     {
       auto indexer = get_subsystem<ccf::indexing::IndexingStrategies>();
       if (indexer == nullptr)
diff --git a/include/ccf/node_startup_state.h b/include/ccf/node_startup_state.h
index 639e09d63d12..9d283d3bce36 100644
--- a/include/ccf/node_startup_state.h
+++ b/include/ccf/node_startup_state.h
@@ -6,7 +6,7 @@
 
 namespace ccf
 {
-  enum class NodeStartupState
+  enum class NodeStartupState : uint8_t
   {
     uninitialized,
     initialized,
@@ -29,6 +29,7 @@ namespace ccf
 }
 
 // Used by fmtlib to render ccf::State
+// NOLINTBEGIN(cert-dcl58-cpp)
 namespace std
 {
   inline std::ostream& operator<<(std::ostream& os, ccf::NodeStartupState s)
@@ -37,4 +38,5 @@ namespace std
     to_json(j, s);
     return os << j.dump();
   }
-}
\ No newline at end of file
+}
+// NOLINTEND(cert-dcl58-cpp)
\ No newline at end of file
diff --git a/include/ccf/odata_error.h b/include/ccf/odata_error.h
index ea23ce7494a3..94022799223d 100644
--- a/include/ccf/odata_error.h
+++ b/include/ccf/odata_error.h
@@ -56,7 +56,7 @@ namespace ccf
 
   struct ErrorDetails
   {
-    http_status status;
+    http_status status = HTTP_STATUS_BAD_REQUEST;
     std::string code;
     std::string msg;
   };
diff --git a/include/ccf/receipt.h b/include/ccf/receipt.h
index b814e2364d77..c835452f0501 100644
--- a/include/ccf/receipt.h
+++ b/include/ccf/receipt.h
@@ -50,11 +50,12 @@ namespace ccf
 
     struct ProofStep
     {
-      enum
+      enum class Direction : uint8_t
       {
         Left,
         Right
-      } direction;
+      };
+      Direction direction = Direction::Left;
 
       ccf::crypto::Sha256Hash hash;
 
@@ -74,7 +75,7 @@ namespace ccf
 
       for (const auto& element : proof)
       {
-        if (element.direction == ProofStep::Left)
+        if (element.direction == ProofStep::Direction::Left)
         {
           current = ccf::crypto::Sha256Hash(element.hash, current);
         }
@@ -87,21 +88,17 @@ namespace ccf
       return current;
     }
 
-    ccf::crypto::Sha256Hash get_leaf_digest()
+    [[nodiscard]] ccf::crypto::Sha256Hash get_leaf_digest() const
     {
       ccf::crypto::Sha256Hash ce_dgst(leaf_components.commit_evidence);
       if (!leaf_components.claims_digest.empty())
       {
-        return ccf::crypto::Sha256Hash(
+        return {
           leaf_components.write_set_digest,
           ce_dgst,
-          leaf_components.claims_digest.value());
-      }
-      else
-      {
-        return ccf::crypto::Sha256Hash(
-          leaf_components.write_set_digest, ce_dgst);
+          leaf_components.claims_digest.value()};
       }
+      return {leaf_components.write_set_digest, ce_dgst};
     }
 
     [[nodiscard]] bool is_signature_transaction() const override
@@ -137,6 +134,7 @@ namespace ccf
   nlohmann::json describe_receipt_v1(const TxReceiptImpl& receipt);
   ReceiptPtr describe_receipt_v2(const TxReceiptImpl& in);
 
+  // NOLINTNEXTLINE(performance-enum-size)
   enum MerkleProofLabel : int64_t
   {
     // Values set in
@@ -160,19 +158,24 @@ namespace ccf
 
   void to_json(nlohmann::json& j, const ProofReceipt::Components& components);
   void from_json(const nlohmann::json& j, ProofReceipt::Components& components);
-  std::string schema_name(const ProofReceipt::Components*);
+  std::string schema_name(
+    [[maybe_unused]] const ProofReceipt::Components* components);
   void fill_json_schema(
-    nlohmann::json& schema, const ProofReceipt::Components*);
+    nlohmann::json& schema,
+    [[maybe_unused]] const ProofReceipt::Components* components);
 
   void to_json(nlohmann::json& j, const ProofReceipt::ProofStep& step);
   void from_json(const nlohmann::json& j, ProofReceipt::ProofStep& step);
-  std::string schema_name(const ProofReceipt::ProofStep*);
-  void fill_json_schema(nlohmann::json& schema, const ProofReceipt::ProofStep*);
+  std::string schema_name([[maybe_unused]] const ProofReceipt::ProofStep* step);
+  void fill_json_schema(
+    nlohmann::json& schema,
+    [[maybe_unused]] const ProofReceipt::ProofStep* step);
 
   void to_json(nlohmann::json& j, const ReceiptPtr& receipt);
   void from_json(const nlohmann::json& j, ReceiptPtr& receipt);
-  std::string schema_name(const ReceiptPtr*);
-  void fill_json_schema(nlohmann::json& schema, const ReceiptPtr*);
+  std::string schema_name([[maybe_unused]] const ReceiptPtr* receipt);
+  void fill_json_schema(
+    nlohmann::json& schema, [[maybe_unused]] const ReceiptPtr* receipt);
 
   template <typename T>
   void add_schema_components(
diff --git a/include/ccf/rest_verb.h b/include/ccf/rest_verb.h
index 018e8a040b65..2f63de688c6c 100644
--- a/include/ccf/rest_verb.h
+++ b/include/ccf/rest_verb.h
@@ -51,7 +51,7 @@ namespace ccf
     RESTVerb(const llhttp_method& hm) : verb(hm) {}
     RESTVerb(const std::string& s)
     {
-      verb = http_method_from_str(s.c_str());
+      verb = http_method_from_str(s);
     }
 
     [[nodiscard]] std::optional<llhttp_method> get_http_method() const
@@ -100,7 +100,7 @@ namespace ccf
     std::string s = j.get<std::string>();
     ccf::nonstd::to_upper(s);
 
-    verb = RESTVerb(s.c_str());
+    verb = RESTVerb(s);
   }
 
   inline std::string schema_name([[maybe_unused]] const RESTVerb* verb_type)
diff --git a/include/ccf/rpc_exception.h b/include/ccf/rpc_exception.h
index 0f6fc02ad1b4..e5e49332aa58 100644
--- a/include/ccf/rpc_exception.h
+++ b/include/ccf/rpc_exception.h
@@ -18,7 +18,7 @@ namespace ccf
       error{status, code, std::move(msg)}
     {}
 
-    const char* what() const throw() override
+    [[nodiscard]] const char* what() const noexcept override
     {
       return error.msg.c_str();
     }
diff --git a/include/ccf/tx.h b/include/ccf/tx.h
index ee0971a7d334..a2851271e2d9 100644
--- a/include/ccf/tx.h
+++ b/include/ccf/tx.h
@@ -86,27 +86,26 @@ namespace ccf::kv
       {
         auto& [abstract_map, change_set] = it->second;
 
+        // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
         auto typed_handle = new THandle(*change_set, map_name);
         std::unique_ptr<AbstractHandle> abstract_handle(typed_handle);
         retain_handle(map_name, std::move(abstract_handle));
         return typed_handle;
       }
-      else
-      {
-        auto [abstract_map, change_set] = get_map_and_change_set_by_name(
-          map_name, track_deletes_on_missing_keys);
+      auto [abstract_map, change_set] =
+        get_map_and_change_set_by_name(map_name, track_deletes_on_missing_keys);
 
-        if (change_set == nullptr)
-        {
-          compacted_version_conflict(map_name);
-        }
-
-        auto typed_handle = new THandle(*change_set, map_name);
-        std::unique_ptr<AbstractHandle> abstract_handle(typed_handle);
-        retain_handle(map_name, std::move(abstract_handle));
-        retain_change_set(map_name, std::move(change_set), abstract_map);
-        return typed_handle;
+      if (change_set == nullptr)
+      {
+        compacted_version_conflict(map_name);
       }
+
+      // NOLINTNEXTLINE(cppcoreguidelines-owning-memory)
+      auto typed_handle = new THandle(*change_set, map_name);
+      std::unique_ptr<AbstractHandle> abstract_handle(typed_handle);
+      retain_handle(map_name, std::move(abstract_handle));
+      retain_change_set(map_name, std::move(change_set), abstract_map);
+      return typed_handle;
     }
 
   public:
diff --git a/include/ccf/tx_id.h b/include/ccf/tx_id.h
index e0fea054509d..1d857883825f 100644
--- a/include/ccf/tx_id.h
+++ b/include/ccf/tx_id.h
@@ -52,7 +52,7 @@ namespace ccf
 
     static std::optional<TxID> from_str(const std::string_view& sv)
     {
-      const auto separator_idx = sv.find(".");
+      const auto separator_idx = sv.find('.');
       if (separator_idx == std::string_view::npos)
       {
         return std::nullopt;
diff --git a/include/ccf/tx_status.h b/include/ccf/tx_status.h
index 64aaff1562d0..6dceea3feac0 100644
--- a/include/ccf/tx_status.h
+++ b/include/ccf/tx_status.h
@@ -9,7 +9,7 @@ namespace ccf
 {
   /** Describes the status of a transaction, as seen by this node.
    */
-  enum class TxStatus
+  enum class TxStatus : uint8_t
   {
     /** This node has not received this transaction, and knows nothing about it
      */
@@ -92,33 +92,30 @@ namespace ccf
       {
         return TxStatus::Committed;
       }
-      else
-      {
-        return TxStatus::Invalid;
-      }
+      return TxStatus::Invalid;
     }
-    else if (views_match)
+
+    if (views_match)
     {
       // This node knows about the requested tx id, but it is not globally
       // committed
       return TxStatus::Pending;
     }
-    else if (committed_view > target_view)
+
+    if (committed_view > target_view)
     {
       // This node has seen the seqno in a different view, and committed
       // further, so the requested tx id is impossible
       return TxStatus::Invalid;
     }
-    else
-    {
-      // Otherwise, we cannot state anything about this tx id. The most common
-      // reason is that the local_view is unknown (this transaction has never
-      // existed, or has not reached this node yet). It is also possible that
-      // this node believes locally that this tx id is impossible, but does not
-      // have a global commit to back this up - it will eventually receive
-      // either a global commit confirming this belief, or an election and
-      // global commit making this tx id invalid
-      return TxStatus::Unknown;
-    }
+
+    // Otherwise, we cannot state anything about this tx id. The most common
+    // reason is that the local_view is unknown (this transaction has never
+    // existed, or has not reached this node yet). It is also possible that
+    // this node believes locally that this tx id is impossible, but does not
+    // have a global commit to back this up - it will eventually receive
+    // either a global commit confirming this belief, or an election and
+    // global commit making this tx id invalid
+    return TxStatus::Unknown;
   }
 }
\ No newline at end of file
diff --git a/src/endpoints/endpoint.cpp b/src/endpoints/endpoint.cpp
index 0b5c3ad0f962..c4ca626790a2 100644
--- a/src/endpoints/endpoint.cpp
+++ b/src/endpoints/endpoint.cpp
@@ -137,7 +137,7 @@ namespace ccf::endpoints
   {
     switch (grp.kind)
     {
-      case InterpreterReusePolicy::KeyBased:
+      case InterpreterReusePolicy::Kind::KeyBased:
       {
         j = nlohmann::json::object();
         j["key"] = grp.key;
@@ -152,7 +152,7 @@ namespace ccf::endpoints
       const auto key_it = j.find("key");
       if (key_it != j.end())
       {
-        grp.kind = InterpreterReusePolicy::KeyBased;
+        grp.kind = InterpreterReusePolicy::Kind::KeyBased;
         grp.key = key_it->get<std::string>();
       }
     }
diff --git a/src/js/extensions/ccf/historical.cpp b/src/js/extensions/ccf/historical.cpp
index f457a96b71d9..e86e78347cd3 100644
--- a/src/js/extensions/ccf/historical.cpp
+++ b/src/js/extensions/ccf/historical.cpp
@@ -246,7 +246,7 @@ namespace ccf::js::extensions
           JS_CHECK_EXC(js_element);
 
           auto is_left =
-            element.direction == ccf::ProofReceipt::ProofStep::Left;
+            element.direction == ccf::ProofReceipt::ProofStep::Direction::Left;
           const auto hash_hex = ds::to_hex(element.hash.h);
 
           auto js_hash = jsctx.new_string(hash_hex);
diff --git a/src/js/interpreter_cache.h b/src/js/interpreter_cache.h
index 7230669b35da..f5a8ddcf229a 100644
--- a/src/js/interpreter_cache.h
+++ b/src/js/interpreter_cache.h
@@ -60,7 +60,7 @@ namespace ccf::js
       {
         switch (interpreter_reuse->kind)
         {
-          case ccf::endpoints::InterpreterReusePolicy::KeyBased:
+          case ccf::endpoints::InterpreterReusePolicy::Kind::KeyBased:
           {
             auto key = interpreter_reuse->key;
             if (access == js::TxAccess::APP_RW)
diff --git a/src/js/registry.cpp b/src/js/registry.cpp
index b0757bd616a9..576306eb3dd2 100644
--- a/src/js/registry.cpp
+++ b/src/js/registry.cpp
@@ -906,7 +906,7 @@ namespace ccf::js
   }
 
   std::set<RESTVerb> BaseDynamicJSEndpointRegistry::get_allowed_verbs(
-    ccf::kv::Tx& tx, const ccf::RpcContext& rpc_ctx)
+    [[maybe_unused]] ccf::kv::Tx& tx, const ccf::RpcContext& rpc_ctx)
   {
     const auto method = rpc_ctx.get_method();
 
diff --git a/src/node/gov/handlers/proposals.h b/src/node/gov/handlers/proposals.h
index 51b9af30f67b..bf96846ebee9 100644
--- a/src/node/gov/handlers/proposals.h
+++ b/src/node/gov/handlers/proposals.h
@@ -215,7 +215,11 @@ namespace ccf::gov::endpoints
             v.set(
               "member_id",
               js_context.new_string_len(member_id.data(), member_id.size()));
-            v.set_bool("vote", vote_result);
+            if (v.set_bool("vote", vote_result) != 1)
+            {
+              throw std::runtime_error(
+                "Failed to set vote property on vote result object");
+            }
 
             vs.set_at_index(index++, std::move(v));
           }
diff --git a/src/node/historical_queries_adapter.cpp b/src/node/historical_queries_adapter.cpp
index e0c429ad5940..eed55ad4a11b 100644
--- a/src/node/historical_queries_adapter.cpp
+++ b/src/node/historical_queries_adapter.cpp
@@ -153,8 +153,8 @@ namespace ccf
       {
         const auto direction =
           node.direction == ccf::HistoryTree::Path::Direction::PATH_LEFT ?
-          ccf::ProofReceipt::ProofStep::Left :
-          ccf::ProofReceipt::ProofStep::Right;
+          ccf::ProofReceipt::ProofStep::Direction::Left :
+          ccf::ProofReceipt::ProofStep::Direction::Right;
         const auto hash = ccf::crypto::Sha256Hash::from_span(
           std::span<const uint8_t, ccf::ClaimsDigest::Digest::SIZE>(
             node.hash.bytes, sizeof(node.hash.bytes)));
diff --git a/src/node/receipt.cpp b/src/node/receipt.cpp
index 934077bbecf3..24308c10b6b0 100644
--- a/src/node/receipt.cpp
+++ b/src/node/receipt.cpp
@@ -111,7 +111,8 @@ namespace ccf
   {
     j = nlohmann::json::object();
     const auto* const key =
-      step.direction == ProofReceipt::ProofStep::Left ? "left" : "right";
+      step.direction == ProofReceipt::ProofStep::Direction::Left ? "left" :
+                                                                   "right";
     j[key] = step.hash;
   }
 
@@ -135,12 +136,12 @@ namespace ccf
 
     if (l_it != j.end())
     {
-      step.direction = ProofReceipt::ProofStep::Left;
+      step.direction = ProofReceipt::ProofStep::Direction::Left;
       step.hash = l_it.value();
     }
     else
     {
-      step.direction = ProofReceipt::ProofStep::Right;
+      step.direction = ProofReceipt::ProofStep::Direction::Right;
       step.hash = r_it.value();
     }
   }
diff --git a/src/node/rpc_context_impl.h b/src/node/rpc_context_impl.h
index 82dbbc965cbb..6d3fe5dd1331 100644
--- a/src/node/rpc_context_impl.h
+++ b/src/node/rpc_context_impl.h
@@ -49,10 +49,12 @@ namespace ccf
     }
 
     ccf::ClaimsDigest claims = ccf::empty_claims();
+    // NOLINTBEGIN(performance-move-const-arg)
     void set_claims_digest(ccf::ClaimsDigest::Digest&& digest) override
     {
       claims.set(std::move(digest));
     }
+    // NOLINTEND(performance-move-const-arg)
 
     ccf::PathParams path_params = {};
     virtual const ccf::PathParams& get_request_path_params() override
diff --git a/src/node/snapshot_serdes.h b/src/node/snapshot_serdes.h
index 54dfe02db207..fa9f1c41405b 100644
--- a/src/node/snapshot_serdes.h
+++ b/src/node/snapshot_serdes.h
@@ -177,6 +177,7 @@ namespace ccf
     ccf::MerkleTreeHistory history(tree);
     auto proof = history.get_proof(seqno);
     ccf::ClaimsDigest cd;
+    // NOLINTNEXTLINE(performance-move-const-arg)
     cd.set(std::move(claims_digest));
     ccf::TxReceiptImpl tx_receipt(
       sig,
diff --git a/src/node/snapshotter.h b/src/node/snapshotter.h
index bddfbfa2189c..5cc25ec4615b 100644
--- a/src/node/snapshotter.h
+++ b/src/node/snapshotter.h
@@ -144,6 +144,7 @@ namespace ccf
       evidence->put({snapshot_hash, snapshot_version});
 
       ccf::ClaimsDigest cd;
+      // NOLINTNEXTLINE(performance-move-const-arg)
       cd.set(std::move(snapshot_hash));
 
       ccf::crypto::Sha256Hash ws_digest;
diff --git a/src/node/test/receipt.cpp b/src/node/test/receipt.cpp
index e0f5a2d022fe..28186ca4dcdf 100644
--- a/src/node/test/receipt.cpp
+++ b/src/node/test/receipt.cpp
@@ -46,14 +46,15 @@ void populate_receipt(std::shared_ptr<ccf::ProofReceipt> receipt)
   const auto num_proof_steps = rand() % 8;
   for (auto i = 0; i < num_proof_steps; ++i)
   {
-    const auto dir = rand() % 2 == 0 ? ccf::ProofReceipt::ProofStep::Left :
-                                       ccf::ProofReceipt::ProofStep::Right;
+    const auto dir = rand() % 2 == 0 ?
+      ccf::ProofReceipt::ProofStep::Direction::Left :
+      ccf::ProofReceipt::ProofStep::Direction::Right;
     const auto digest = rand_digest();
 
     ccf::ProofReceipt::ProofStep step{dir, digest};
     receipt->proof.push_back(step);
 
-    if (dir == ccf::ProofReceipt::ProofStep::Left)
+    if (dir == ccf::ProofReceipt::ProofStep::Direction::Left)
     {
       current_digest = ccf::crypto::Sha256Hash(digest, current_digest);
     }