docs backend GO1273_SECURITY_REVALIDATION

Go 1.27.3 security and toolchain reconciliation

Status: LOCAL_DONE Validation: PASS Date: 2026-10-21. Parent: 550c5e1294c61e9b93cb84a0e842513535474fc6. Delivery: existing protected dev -> main PR #140; no deployment or tag.

Before behavior

The approved feed delivery failed Quick verification/fast at GO-2026-6809 in crypto/x509.Certificate.Verify, reached by station-profile verification. The official stable release index on 2026-10-21 lists Go1.27.3 as latest; the Go vulnerability report identifies it as the fix for the1.27 series. Sources: https://go.dev/dl/?mode=json and https://pkg.go.dev/vuln/GO-2026-6809.

Risk: critical certificate verification and build provenance. Follow AI_ENGINEERING_CONTRACT, CI_PLAN and DELIVERY_WORKFLOW. Keep the Go1.27 language level and dependency set. Update the exact production toolchain, CI runtime, Docker builder digest and executable smoke/recovery pins as a single reviewed change. Staticcheck's existing1.27.1 analysis-only workaround stays separate from compiled/runtime/vulnerability-scanned binaries. Retain vulnerability checks and negative security-gate cases; no bypass.

Acceptance: official release/digest verification; existing security mutant harness plus stale-toolchain refusal; affected gate harnesses, full backend unit/race/PostGIS and certificate/auth tests on the new runtime, static/ sqlc/OpenAPI/security checks, image build/smoke, source/secret diff review. Run the local aggregate once through guarded finish only after all required remote checks pass. Existing Android/native evidence can be reused only for unchanged app inputs; this update is not production certification.

Recovery: preserve the validated source; refuse integration if any required check fails. Never downgrade to a known vulnerable toolchain or suppress the scanner. Keep other worktrees and unpublished expansion commits isolated.

Delivered and actual acceptance

• Official release index confirmed latest stable Go1.27.3. Exact runtime pins now agree in go.mod, Quick/backend workflows, smoke/load/restore commands and current tooling docs. The language level remains1.27; go.sum and the application dependency set are unchanged.
• Official Docker Registry manifest for library/golang:1.27.3-bookworm returned digest sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5. Its exact response bytes independently hash to that header; saved locally at /tmp/bfp-go1273-official-image-manifest.json. The builder is pinned to both version and digest, retaining the existing nonroot runtime images.
• Actual initial static RED: changing only go.mod exposed the obsolete security guard (/tmp/bfp-go1273-static-red.log). Updated guard and generic image-digest mutant now pass; added explicit old-vulnerable- toolchain refusal. scripts/tests/test-security.sh:11/11 PASS, including live govulncheck ./... on Go1.27.3, zero vulnerabilities reported (/tmp/bfp-go1273-security.log). No scanner suppression. Independent saved symbol-scan JSON confirms go_version=go1.27.3, scanner1.8.0, database modified2026-10-21 and zero finding events: /tmp/bfp-go1273-govuln.json (successful exit).
• go test -race -count=1 ./... PASS across all backend unit packages, /tmp/bfp-go1273-unit-race.log. go vet ./..., existing pinned staticcheck workaround, sqlc vet and sqlc diff PASS; individual logs /tmp/bfp-go1273-{vet,staticcheck,sqlc-vet,sqlc-diff}.log.
• Full real integration executed with a unique tmpfs PostGIS/S3 Compose project, production migrations and all four real Rust preparers: go test -json -race -count=1 -p 2 -timeout 10m -tags=integration ./.... 112 packages passed; only cmd/worker failed because Cargo followed the operator umask and emitted mode775 CLIs. The bridge correctly refused those group-writable executables. After mode755 normalization, the entire worker integration package passed (6.382s) with the same Go1.27.3 code; /tmp/bfp-go1273-worker-recheck.log. This was an environment correction, not a retry of unchanged failing inputs or a weakened trust gate. No unresolved executed-test failure remains in this scoped matrix.
• Corrected the existing full-local harness to build/export all four preparers in its own temp directory and set their trusted executable modes; it previously built only registry and could inherit missing/writable quality/fine CLI inputs. Those exact preparation commands and actual native worker paths were exercised above; the unrelated full load/restore/ soak script is not claimed as re-executed in its entirety.
• Integration report: /tmp/bfp-go1273-integration.sQOGIT/, with failed first-attempt results retained, not overwritten. Four explicit opt-ins remain separate: evidence soak, vector regeneration, Android consent cross-runtime harness and real PMQC methodology. Missing opt-ins are not claimed as proof;26 packages contain no tagged tests. The fixture project was removed by its cleanup trap; no shared dev/VPS database was selected.
• API, worker, migrate and station-load images all built PASS. Extracted API build metadata reports go1.27.3; runtime user is65532:65532. Actual migration image and API live/ready returned200 against another new tmpfs PostGIS fixture (/tmp/bfp-go1273-image-smoke.log). All owned containers were removed. Image build logs and binary metadata remain under /tmp/bfp-go1273-image-*; no registry push/deploy occurred.
• Infrastructure mutation harness7/7, CI cadence2/2 and OpenAPI lint PASS. Shell syntax, diff/secret review PASS. Android code/config/APK inputs are unchanged; prior feed JVM/native evidence is reused only for those inputs.

Integration remains pending at the new commit. Publish to existing dev PR140, require current-head Quick verification/fast/integration/test and review/base/ merge-ref guards, then guarded finish. No local aggregate was run ahead of pending CI. Wiki publication follows actual merge SHA once; no release, provider, source or production readiness is inferred. The formerly paused heartbeat stays paused while this human-requested audit proceeds.