v4.8.2 — Go 1.27.3

Mirrors baseline v4.8.2, Go 1.27.3 as the floor, pinning baseline commit c79c209.

The pin moves to Go 1.27.3. It fixes GO-2026-6809 in crypto/x509. Under 1.27.2, govulncheck reports it as called from cmd/server, so ./verify.sh stops at its fifth step. verify.sh names the new pin; go.mod already says go 1.27, so nothing in the build moves.

The dependencies moved under it, as the baseline's operations/ci.md asks when VERSIONS.md moves: golang.org/x/crypto v0.58.0, x/sync v0.24.0 and x/time v0.16.0, plus go-humanize, go-strftime and x/sys. modernc.org/sqlite stays at the pinned v1.58.0, and modernc.org/libc goes back from v1.75.7 to v1.75.6, the exact version that driver's go.mod names.

./verify.sh exits 0 over 79 gates and make ci is green on this commit, both under Go 1.27.3.

v4.8.1 — staticcheck is back

Mirrors baseline v4.8.1, staticcheck reads Go 1.27.2 again, pinning baseline commit aafa39f.

The staticcheck gate is back. Staticcheck 2026.2.2 (v0.8.2), released on 2026-10-12, reads the export data Go 1.27.2 writes (dominikh/go-tools#1832). Under the pin, the export-data error the baseline's operations/ci.md names no longer comes out, so the line is back in Makefile and verify.sh and the README's waiver is gone. Staticcheck reports nothing to fix. verify.sh's header, the README's file list and SPEC.md's first acceptance criterion no longer allow for a waived gate.

./verify.sh exits 0 over 79 gates, staticcheck among them, and make ci is green on this commit under Go 1.27.2.

v4.8.0 — staticcheck waived under Go 1.27.2

Mirrors baseline v4.8.0, Go 1.27.2 and a patch that outruns staticcheck, pinning baseline commit e7e378c.

The staticcheck gate is waived. Go 1.27.2 writes export data that staticcheck 2026.2.1, the newest release, cannot read (dominikh/go-tools#1832), so it checks no package that imports the standard library. The line is out of Makefile and verify.sh under a dated waiver in the README's Baseline deviations, as the baseline's operations/ci.md now rules, and verify.sh prints the waiver in its place. Every other gate runs, and the pin stays at 1.27.2. The line comes back with the staticcheck release that reads the new format.

Why the pin had to move. Under 1.27.1, govulncheck here reports twelve of 1.27.2's fifteen security fixes as called: both html/template escaper fixes through render, Range parsing through ServeContent and the static file server, and multipart header parsing through the upload handler. Under 1.27.2 it reports none.

make fmt fails when go fix does not converge. The loop used to exit 0 after three passes that still left a diff. verify.sh names the 1.27.2 pin in its go.mod check.

./verify.sh exits 0 over 79 gates, the staticcheck one printing its waiver, and make ci is green on this commit under Go 1.27.2.

v4.7.0 — match with strings, not regexp

Mirrors baseline v4.7.0, import a package for what it does, pinning baseline commit d12a127.

Two test helpers dropped regexp. The "Show older" cursor and the machine-token secret are now found with strings.Cut and strings.IndexFunc. For every page the app renders they match exactly what the regexps matched: the cursor is digits only, and the secret is gochat_ plus RawURL base64. Production code imports neither regexp nor reflect.

./verify.sh exits 0 over 79 gates, and make ci is green on this commit. Nothing needed a waiver.

v4.6.0 — a secret is its own type

Mirrors baseline v4.6.0, the Go 1.27 defect backlog, pinning baseline commit b6a731e.

A secret is its own type. InviteCode, AnthropicKey and SMTPPassword are a Secret carrying LogValue, String and MarshalText. Config.LogValue stays — it is the allowlist — but it only fires when the Config is the value logged.

That distinction is the thing this sync proved rather than argued. TestConfig_SecretsNeverLogged is seven cases against a config holding three real secrets, and six of them fail when the fields are plain strings: a struct that contains the config, a slice of configs, a map of configs, %+v over the config, and the field on its own by either route all print the key. Only "the config itself" passes — which is exactly the one case the previous test covered, and it did not even set a secret. The three string(...) conversions the type forces at anthropic.New, smtpmail.New and the InviteCode field are the cost of the rule, visible in the diff rather than described.

Both pools are asserted idle at the end of every store test, registered after the Close cleanup so LIFO runs it first. The store was already closing every Rows, Stmt and Tx — so the baseline's new rule 8 writes down a practice that was right and unwritten, which is the shape the self-improvement rule predicts.

make fmt loops go fix to a clean -diff and runs goimports again after it. It proved itself in the same run that needed it: the new test's fmt import was added automatically.

Also: apiJSON's buffering comment now gives the v2 reason — Marshal returns the bytes it got through and an error — rather than the v1 one it was written with. parseBaseURL lost the strings.TrimSuffix whose comment claimed JoinPath would double the slash; it does not.

./verify.sh exits 0 over 79 gates, and make ci is green on this commit. Nothing needed a waiver.

v4.5.0 — JSON is v2

Mirrors baseline v4.5.0 (rules commit 9035558): the two decisions v4.4.0 left open.

• Every encoding/json import is encoding/json/v2, seven files. The /api decoder is one UnmarshalRead with RejectUnknownMembers; the trailing-content check is gone because v2 refuses a second object itself, and an oversized body is still a 413.
• The refusal test gains the two cases the move makes new: a field in the wrong case is a 400 where v1 took it; a body over the cap is a 413.
• htmx stays at 2.0.10; the baseline adopts 4.x in a release of its own once 4.0.1 ships.

GOTOOLCHAIN=go1.27.1 ./verify.sh: 79 gates, exit 0. make ci green on this commit.

v4.4.0 — the pin moves to Go 1.27.1

Synced to baseline v4.4.0 (rules commit ce86f13): go.mod says go 1.27; the handler-test harness runs on httptest.NewTestServer; drainAndClose is gone; verify.sh gates the go line against the pin's major (79 gates, exit 0); make ci green under go1.27.1. Dependencies updated under the pin.

v4.3.0 — no code before the brief

Synced to baseline v4.3.0 (pin 7c5c2a4): SPEC.md carries the project-level brief — job, why, guardrails, done means — and make ci joins the acceptance criteria. verify.sh gates the brief as its ninth step: 78 gates, exit 0 under go1.26.7. No code moved.

v4.2.0 — go fix joins the gates

Mirrors baseline v4.2.0 (pins baseline commit 6015026).

• go fix -diff ./... is the third line of check and the third step of verify.sh; go fix ./... follows goimports in fmt.
• The gate was red on the tree it inherited: the assistant reply's Add(1)/go/Done() and a three-clause loop in a test are rewritten by the pin (Go 1.26.7).
• The two errors.As sites use errors.AsType, which Go 1.27's errorsastype fixer will demand.
• GOTOOLCHAIN=go1.26.7 ./verify.sh: 77 gates, exit 0. make ci green with go version go1.26.7.

v4.1.0 — synced to the self-improvement rule; no gate to add

Synced to baseline v4.1.0, commit 99a94e0 — gaps found in a project flow back to the corpus. SPEC.md is the only file that moved here, and that is the finding rather than an omission.

What the baseline changed. SKILL.md Handing the work back now takes a baseline gap as a next step — the checklist had no section and you settled it by inventing, or a rule names a dependency the standard library now covers — and forbids editing the baseline as a side effect of project work. README.md takes the other direction at every Go major: read the release notes for what moved into stdlib, and rewrite the pattern that prescribed the dependency rather than retiring it.

Nothing moved here, because neither rule is a property a repository can hold. One governs what an agent reports at the end of a task; the other governs what a maintainer reads on the 90-day cycle. There is no gate to add and no line of code to change. The run happened anyway. A rules commit this repository cannot gate is exactly the kind that gets tagged on a reading, and the half that catches a rule contradicting another one is the running application, not the diff.

GOTOOLCHAIN=go1.26.7 ./verify.sh exits 0 over 76 gates — the same count as v4.0.0, since no gate moved — and GOTOOLCHAIN=go1.26.7 make ci is green on this commit with go version go1.26.7 darwin/arm64 as its first line. The toolchain pin still stands in for this machine's Go 1.27.0, which the baseline does not adopt until 1.27.1.