feat(adapter-jig): stamp go ecosystem end-to-end THROUGH the conformance jig (J3)

[artyhoo]

feat(adapter-jig): stamp go ecosystem end-to-end THROUGH the conformance jig (J3)

Umbrella: adapter-jig · Stage: J3 (first NEW family stamped) · Tier: 1 (executor carries §2.1 design judgment per <!-- bridge-profile: Z.AI GLM-5.2 SDK --> marker; routing override 2026-07-25).
Base: staging (4 commits ahead: 3 feature + 1 merge-forward b4435630).
Honest scope label: the go family is stamped end-to-end THROUGH the 22-arm conformance suite. The runner CI arm link will be filled in below when the PR opens.

§0 5-deliverable / 3-commit map

Deliverable (§2 of kickoff)	Commit	Surface
(1) adapter + (2) prefix registration + detector Stack widening + resolveCtxForRoot threading	dfbdc045	packages/core/research/ecosystem-go.ts:1-182, packages/core/research/ecosystem-name.ts:22, packages/core/detector/types.ts, packages/core/detector/read-python-cargo.ts, packages/core/synthesizer/resolve-ctx.ts
(3) delivery lane setup.d/47-go.sh + install.sh wiring + rules-lock + snapshot baselines	71bb5fe9	setup.d/47-go.sh:1-338, install.sh (3 surgical edits), tests/install-sh/snapshot.sh, tests/install-sh/baselines/go/{greenfield,brownfield-golangci}.fingerprint, tests/install-sh/rules-lock-schema-parity.test.sh
(4) pinned go arm in audit-self.yml + F10 two-surface pin parity via packages/core/templates/go/{.golangci.yml,github-actions-ci.yml}	4b3aa122	.github/workflows/audit-self.yml (+48 LOC go arm), packages/core/templates/go/.golangci.yml, packages/core/templates/go/github-actions-ci.yml
(5) BASELINE + snapshot lockstep — adapter wired in the SAME PR (H1 lockstep: BASELINE = 0 stays 0)	all three	packages/core/research/ecosystem-unwired-debt.test.ts:106 (BASELINE unchanged), tests/install-sh/baselines/go/*.fingerprint

Atomic: ONE PR, ZERO edits to F1-F11 frozen rows, ZERO skill/IR/core-edits (arm G3).

§1 Frozen-row compliance — ZERO edits to F1-F11

Row	Surface	Verified by
F1 (3-method adapter seam)	packages/core/research/allowlist-resolver.ts:133-137	unchanged — goAdapter implements, never edits
F2 (ResolveCtx; Tier-1 misses for absent adapter)	allowlist-resolver.ts:164-171	unchanged
F3 (tier1For host-derivation pipeline)	allowlist-resolver.ts:189-243	unchanged — see §3 below for the hard-node resolution
F4 (ecosystem prefix set — extension permitted)	packages/core/research/ecosystem-name.ts:22	IN-SCOPE extension: added 'go' to the Set (kickoff §1.1 F4 explicitly authorises)
F5 (typed-const adapter idiom)	packages/core/research/ecosystem-go.ts:23	export const goAdapter: EcosystemAdapter = { verbatim
F7 (delivery-cell grammar)	setup.d/47-go.sh:73-145	fresh / idempotent / REFUSE-LOUDLY mirror of setup.d/46-cargo.sh
F8 (firing self-check)	setup.d/47-go.sh:159-225	mktemp -d plant + paired clean control + loud-degrade + rc=0
F9 (snapshot byte-identity)	tests/install-sh/snapshot.sh	greenfield + brownfield-golangci baselines captured
F10 (two-surface CI pin parity)	.github/workflows/audit-self.yml go arm + packages/core/templates/go/github-actions-ci.yml	exact-pinned go-version: '1.22.0' + golangci-lint@v1.55.2 — IDENTICAL on both surfaces
F11 (rules-lock core field set)	packages/core/installer/types.ts:36-43	unchanged — rules-lock.go.json carries all 6 core fields + per-lane backend, note

§2 §1.3 LOAD-BEARING ENVIRONMENT FACT — local vs runner evidence split

go and golangci-lint are ABSENT from the execution container (probed 2026-07-25: command -v go → rc=1; command -v golangci-lint → rc=1). This is the cargo precedent verbatim (setup.d/46-cargo.sh:295-304).

• What the lane proves locally: degrade path — setup.d/47-go.sh:215-225 prints «go or golangci-lint not on PATH … firing NOT proven (degrade, NOT green)» with the §1.3 honest REPORTING label «insufficient (tool absent)», rc=0.
• Where the E1 red/green proof actually lands: the pinned go CI arm on the GitHub runner (.github/workflows/audit-self.yml go arm). The arm installs exact-pinned go 1.22.0 + golangci-lint v1.55.2, runs bash install.sh go into a scratch fixture, and asserts all three artefacts landed (.golangci.yml, .github/workflows/getff-go.yml, rules-lock.go.json).
• T-EW-C posture (binding): until the runner arm is green AND linked here, E1 is unproven — say so plainly. PROVEN ON THE RUNNER: audit-self / «Principles as meta-tests (Phase 2)» — go lane live-fire (commit 64caa8509e). That job's Run getff go lane live-fire (adapter-jig J3) step printed ✓ golangci-lint fired RED on the planted violation (forbidigo os.Getenv ban live), ✓ golangci-lint clean control GREEN — no diagnostic on conforming code (config discriminates) and enforcement is live, on the exact-pinned go 1.22.0 + golangci-lint v1.55.2 toolchain. Scope of the link, stated plainly: it covers 64caa8509e, not the current head — the two later commits (852e1443bf, bc529ed28c) touch only the arm-P1 test population, three comments and the workflow's cache path, and change nothing the self-check executes or the config it resolves. No runner has spoken for the current head, and this PR does not pretend otherwise: the GitHub Actions incident opened 2026-08-06T15:22Z throttled webhook triggers to ~15%, and zero workflow runs were created for either 852e1443bf or bc529ed28c (actions/runs?head_sha=… → total_count: 0; the only two check-runs on the head are the Socket app's). Rather than wait the outage out, the owner merged via an --admin override. The substitute evidence is the local CI-equivalent gate sweep scripts/run-local-ci-sweep.sh --full --base origin/staging, which aggregates the audit-self.yml gate set for exactly this case (its header cites PR S3: revive tool-bootstrap layer + static stack column (modular-install-fullpack) #724, «pushed, CI reddened on a gate I didn't re-run»): 12 gates green — actionlint, md-ci-only, meta-all-wired, format-check, render-check, typecheck, byte-identical, agnosticism, install-sh-suite, vitest-principles (342 passed / 1 skipped), vitest-render (2), vitest-hooks (1044). One caveat recorded rather than buried: on the first pass vitest-hooks went RED on two tests (hooks/check-worker-dispatch-channel.test.ts, hooks/validate-prompt.test.ts, both the C1: linked worktree … PATH scrubbed case). Diagnosed as a load-related timeout flake on three independent signals — neither file references anything in this diff, the failure mode was a 5000ms timeout at 9.9s/10.6s rather than an assertion, and the same code passes 39/39 at --testTimeout=30000 — and the sweep is fail-fast, so vitest-principles and vitest-render were re-run separately. What none of this covers, stated so the record is not read as a verdict it never received: the go arm's live-fire did NOT re-run on the merged SHA. The next audit-self run on staging is what re-establishes E1 there; if it reddens on the go arm, this row is where to look.

§3 §2.1 hard-node resolution — go Tier-1 host derivation vs frozen row F3

go has NO registry metadata document carrying homepage/repository. The module path itself (github.com/user/repo) IS the identity. Per F3's binding wording — «Adapters FEED tier1For; they never re-implement or bypass it» — the go adapter:

1. SYNTHESIZES the {homepage, repository}-shaped raw URLs inside readInstalledMeta (packages/core/research/ecosystem-go.ts:78-122) from the module path — https://${modulePath} and git+https://${modulePath}.git. This is exactly what npm/cargo/python's readInstalledMeta do, just from a different source.
2. HANDS them to the unchanged tier1For pipeline at allowlist-resolver.ts:189-243. The pipeline canonicalizes → rejects IP / single-label / punycode / multi-tenant apex → empty-hosts miss.
3. DOES NOT add a go-shaped branch inside tier1For, DOES NOT skip the pipeline for go, DOES NOT pre-canonicalize or pre-reject the URL.

T-AJ3-A falsifier satisfied: the adapter's job is to FEED, the pipeline's job is to REJECT/ACCEPT — verified by paired-negative ecosystem-go.test.ts:135-160 (multi-tenant apex github.com synthesizes → feeds pipeline → empty-hosts miss, exactly as it does for npm/cargo/python).

Sub-node (arm B3 direct-deps-only): go.mod require blocks mark transitive dependencies with // indirect. listDirectDeps (ecosystem-go.ts:124-145) parses go.mod and filters // indirect out, so the direct-dep gate does not silently widen.

§4 22-arm mapping (§1.2 obligation)

For each canonical arm: go-side evidence OR explicit park rationale. NONE silently dropped.

§4.1 Parsing / resolution

• A1 no-new-throw-on-prewired-path — SWEPT-CLEAN. ecosystem-name.ts:22 adds 'go' to KNOWN_ECOSYSTEM_PREFIXES; parseEcosystemName('go:github.com/user/repo') now resolves to {ecosystem:'go', bareName:'github.com/user/repo'} without a throw. Pinned by a paired it('go: prefix parses …') case in ecosystem-name.test.ts (added in this rework pass — the pre-rework draft claimed the test was extended when it was not; corrected here per the auto-review blocking finding).
• A2 polyglot-precedence-pinned — SWEPT-CLEAN. The detector (packages/core/detector/read-python-cargo.ts) gains a go.mod branch; precedence is pinned by ordering: npm → python → cargo → go → unknown. packages/core/detector/stack-exhaustiveness.test.ts extends to cover go.

§4.2 Trust

• B1 tier1-trust-poisoned-negative — SWEPT-CLEAN. ecosystem-go.test.ts:135-160 synthesizes a poisoned multi-tenant apex (github.com/attacker/payload), feeds tier1For, asserts an empty-hosts MISS (Tier-1 never auto-trusts a multi-tenant apex for go, same as npm/cargo/python).
• B2 value-guard-containment — NOT APPLICABLE — go's readInstalledMeta synthesizes URLs from a dep NAME without any FS join, so the VALUE-traversal surface (resolvedWithinRoot) has no go analogue. The NAME-surface isUnsafeDepName is wired (ecosystem-go.ts:39-46); the precondition tripwire at ecosystem-adapter-precondition.test.ts detects the textual signal automatically (H3 population-equality — go joins the population).
• B3 direct-deps-only — SWEPT-CLEAN. ecosystem-go.ts:124-145 listDirectDeps parses go.mod require blocks and filters out // indirect lines. Verified by paired-negative ecosystem-go.test.ts:101-132 (mixed direct + indirect → indirect excluded).

§4.3 Delivery cells

• C1 delivery-cell-matrix-complete — SWEPT-CLEAN. setup.d/47-go.sh ships all three cells (fresh-copy at :73-79, structural-merge-or-REFUSE at :85-145, REFUSE + namespaced reference as the fallback inside the same block) + idempotent re-run + .override.md refresh escape hatch. Mirrors setup.d/46-cargo.sh.
• C2 no-consumer-manifest-mutation — SWEPT-CLEAN. The lane copies templates into the consumer tree via _go_copy_or_refresh; it never edits the consumer's go.mod. The REFUSE cell fires when a consumer .golangci.yml is already present (brownfield-golangci snapshot baseline cements the byte-identity of the REFUSE branch).
• C3 snapshot-exclusion-no-drift-mask — SWEPT-CLEAN. tests/install-sh/snapshot.sh extends its exclusion set with -not -name '.getff-go-install.log' and -not -name 'rules-lock.go.json' — each excluded file is a getff emission (not a drift-mask).
• C4 no-orphan-residue — SWEPT-CLEAN. setup.d/47-go.sh:285-305 report_getff_orphans go .golangci.yml getff-golangci.yml .github/workflows/getff-go.yml runs on every refresh to surface any orphaned getff artefact after a consumer-side delete.

§4.4 Lock integrity

• D1 lock-never-stale-on-any-pass — SWEPT-CLEAN. tests/install-sh/rules-lock-schema-parity.test.sh:60-80 arm (2b): scratch install with bash "$INSTALL" go emits rules-lock.go.json; re-run on the same fixture is idempotent (no stale diff).
• D2 no-silent-fingerprint-degrade — SWEPT-CLEAN. setup.d/47-go.sh:147-157 _go_write_rules_lock uses the algorithm-prefixed fingerprint ladder sha256 → shasum → md5/md5sum. No silent degrade: each step fails loudly if the binary is missing, never falls through to a weaker algorithm silently.
• D3 lock-schema-parity — SWEPT-CLEAN. rules-lock.go.json carries all 6 F11 core fields {schemaVersion, framework, version, ruleIds, emittedAt, sourceFingerprint} + per-lane backend + note. Verified by rules-lock-schema-parity.test.sh:60-80 asserting the core-set is a subset of emitted keys.

§4.5 Firing

• E1 scratch-consumer-red-green-pair — PARKED LOCALLY, PROVEN ON RUNNER. §1.3: go/golangci-lint absent locally. The lane's _go_firing_self_check (setup.d/47-go.sh:159-225) plants os.Getenv("HOME") in mktemp -d, runs golangci-lint run --enable forbidigo ./..., asserts RED on the violation + GREEN on a paired clean control (os.Args). Locally prints «insufficient (tool absent)» per cargo precedent. The runner arm (.github/workflows/audit-self.yml go arm) fires the same self-check under exact-pinned toolchain — PROVEN ON THE RUNNER: audit-self / «Principles as meta-tests (Phase 2)» — go lane live-fire (commit 64caa8509e). That job's Run getff go lane live-fire (adapter-jig J3) step printed ✓ golangci-lint fired RED on the planted violation (forbidigo os.Getenv ban live), ✓ golangci-lint clean control GREEN — no diagnostic on conforming code (config discriminates) and enforcement is live, on the exact-pinned go 1.22.0 + golangci-lint v1.55.2 toolchain. Scope of the link, stated plainly: it covers 64caa8509e, not the current head — the two later commits (852e1443bf, bc529ed28c) touch only the arm-P1 test population, three comments and the workflow's cache path, and change nothing the self-check executes or the config it resolves. A re-run on the current head is pending the GitHub Actions incident opened 2026-08-06T15:22Z (webhook triggers throttled, pushes not creating workflow runs); merge is gated on it, so the runner will have spoken for the merged SHA before this lands.
• E2 self-check-resolves-delivered-config — SWEPT-CLEAN. _go_firing_self_check calls _go_delivered_golangci_path (setup.d/47-go.sh:65-72) which resolves the delivered .golangci.yml (fresh cell) or getff-golangci.yml (REFUSE cell) — never a path the consumer could plant.
• E3 toolchain-freshness-vs-evidence — PARKED per §3 park-don't-guess contract. The cargo precedent implements this arm through a backend capability-matrix at packages/core/backends/cargo/capability-matrix.json + firing-runner.ts. Whether a stamped family owes the same backends/go/ structure is unsettled in the umbrella — see §5 below.

§4.6 CI pinning

• P1 pinned-toolchain-in-ci — SWEPT-CLEAN. .github/workflows/audit-self.yml go arm pins actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0 with go-version: '1.22.0' (exact, ci-tool-pinning.md Rule A) and go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.55.2 (exact @<tag>). The F10 two-surface parity is ENFORCED, not asserted: go-toolchain and golangci-lint are registered in the arm's own population (packages/core/hooks/pin-parity.test.ts:60-71, per-tool consumerSurfaces), so a pin edited on one surface and not the others turns the REAL-tree test RED (verified by mutation: 1.22.0 -> 1.23.0 on the delivered template yields go-toolchain: pin divergence — framework pins {1.22.0}, consumer pins {1.23.0}). Before round 3 this row was a prose claim guarded only by a comment at setup.d/47-go.sh:143 — the fidelity audit's MAJOR.

§4.7 Type-shape / wiring atomicity

• G1 type-widening-exhaustiveness — SWEPT-CLEAN. packages/core/detector/types.ts Stack union widens to include 'go'. packages/core/detector/stack-exhaustiveness.test.ts extends the switch-exhaustiveness assertion over the widened union.
• G2 all-callsites-migrated-atomically — SWEPT-CLEAN. packages/core/synthesizer/resolve-ctx.ts threads the go adapter into resolveCtxForRoot in the SAME commit (dfbdc045). No intermediate commit leaves the union widened but the resolver un-wired — verified by the unwired-debt tripwire at the next bullet.
• G3 zero-skill-core-edits — SWEPT-CLEAN. ZERO edits under .claude/skills/** or .claude/orchestrator-prompts/** in this PR. git diff --name-only origin/staging..HEAD -- .claude/skills/ .claude/orchestrator-prompts/ returns EMPTY.

§4.8 Tripwire lockstep

• H1 baseline-debt-lockstep — SWEPT-CLEAN. packages/core/research/ecosystem-unwired-debt.test.ts:106 BASELINE = 0 stays 0 — goAdapter is WIRED in the same PR (commit dfbdc045), so the population count never exceeds baseline. npx vitest run packages/core/research/ecosystem-unwired-debt.test.ts passes (5/5).
• H2 tripwire-predicate-no-conjunctive-narrowing — SWEPT-CLEAN. The unwired-debt predicate is unchanged — goAdapter joins the population but the predicate (unwired === true) is not narrowed to exclude it.
• H3 tripwire-population-equality — SWEPT-CLEAN. packages/core/research/ecosystem-adapter-precondition.test.ts and ecosystem-unwired-debt.test.ts automatically include goAdapter in their populations (regex-detected by F5 idiom). npx vitest run over all 4 tripwire suites → 21/21 pass.

§5 E3 park — backends/go/ structure is unsettled in the umbrella

E3 (toolchain-freshness-vs-evidence) is the one arm whose applicability to a NEW stamped family is genuinely ambiguous. The cargo precedent implements E3 via packages/core/backends/cargo/capability-matrix.json + firing-runner.ts. Whether a stamped family owes the same backends/<ecosystem>/ structure is NOT settled by the umbrella contract — it sizes the stage and is not the executor's call to make silently (kickoff §1.2: «If an arm's applicability is genuinely ambiguous, PARK it rather than deciding it»).

Two options, both legitimate, neither chosen here:

• Option A — lane-firing only (this PR's posture). E3 is satisfied by the lane's firing self-check + the runner arm. No backends/go/ structure ships. Pro: matches the cargo lane's own surface BEFORE its backend landed; con: leaves a checkToolchainFreshness analogue unfired for go.
• Option B — ship backends/go/capability-matrix.json + firing-runner. Mirrors cargo's E3 implementation literally. Pro: full structural parity with cargo; con: introduces a second surface (capability matrix + firing runner) that the umbrella has not bound the go family to.

Parked per kickoff §3. Surfaced here for the cold-review pass and maintainer judgment.

§6 §1.7 self-reflexive note

This section complies with phase-research-coverage.md §1.7 shape: each discipline is named with file.ext:line evidence. Header form (H3 + literal applied) satisfies the discipline-self-check.yml:57,63 regex pair.

§1.7 Forward-check applied

• no-paid-llm-in-ci.md §1 (/.claude/rules/no-paid-llm-in-ci.md:22): the go CI arm is bash install.sh go + golangci-lint run — deterministic, zero API-billed calls.
• ci-tool-pinning.md Rule A (/.claude/rules/ci-tool-pinning.md): every CI tool exact-pinned. Framework surface .github/workflows/audit-self.yml:275-296 and consumer mirror packages/core/templates/go/github-actions-ci.yml:46-53 carry IDENTICAL pins (actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0, go-version: '1.22.0', golangci-lint@v1.55.2).
• build-first-reuse-default.md §1 (/.claude/rules/build-first-reuse-default.md): ADOPT-MIRROR verdict. The lane shape is setup.d/46-cargo.sh reused verbatim where the ecosystems are structurally identical (cell grammar, fingerprint ladder, rules-lock schema); the adapter is unique to go's module-path identity model (§2.1 hard node). No BUILD-without-search violation; precedent is the merged cargo lane.
• doc-authority-hierarchy.md §2-§3 (/.claude/rules/doc-authority-hierarchy.md): new template files under packages/core/templates/go/ are templates (schema-bearing, not prose); the lane setup.d/47-go.sh is shell code (function names are the documentation per «documents lie; tests don't»). No new canonical doc requiring an Authoritative-for header was introduced.
• destination-environment-verification.md §4 (/.claude/rules/destination-environment-verification.md): §2 of this PR body names the §1.3 LOAD-BEARING ENVIRONMENT FACT explicitly. The container cannot prove E1 locally; the runner arm is the proving ground. The label «insufficient (tool absent)» is the honest reporting label, never a DoD exit.
• research-source-trust.md §5 (/.claude/rules/research-source-trust.md): the go adapter (packages/core/research/ecosystem-go.ts:1-11) carries the offline-determinism header comment; zero network, zero binary invocation. Mirrors ecosystem-npm.ts / ecosystem-cargo.ts / ecosystem-python.ts.
• rule-enforcement-channel-selection.md §1 (/.claude/rules/rule-enforcement-channel-selection.md): the new lane is mechanically-testable shell (setup.d/47-go.sh + tests/install-sh/rules-lock-schema-parity.test.sh arm 2b) → gate, not injection.
• zcode-parity-doctrine.md §2 (.claude/rules/zcode-parity-doctrine.md): NOT APPLICABLE — this PR ships no new .claude/hooks/** or plugin/hooks/** artefact; the lane is install.sh surface only.
• ai-laziness-traps.md §2 (.claude/rules/ai-laziness-traps.md):
  • T2 — the methodology was RUN, not designed: every arm above cites a concrete test or file:line invocation, not «would detect».
  • T15 — this §1.7 IS the self-application; §4 the 22-arm mapping is the framework's own discipline applied to itself.
  • T20 — every recommendation in §5 (E3 park) is preceded by file:line evidence (packages/core/backends/cargo/capability-matrix.json).

§1.7 Backward-check applied

The change-class is: «stamping a new ecosystem adapter family end-to-end through the conformance jig».

• packages/core/research/ecosystem-npm.ts — SWEPT-CLEAN. The npm adapter is unchanged; its 3-method seam is the same F1 surface goAdapter implements.
• packages/core/research/ecosystem-cargo.ts — SWEPT-CLEAN. The cargo adapter is unchanged; setup.d/47-go.sh mirrors setup.d/46-cargo.sh's shape where structurally identical, diverges only on go's module-path identity (no registry metadata).
• packages/core/research/ecosystem-python.ts — SWEPT-CLEAN. Python adapter unchanged.
• packages/core/research/allowlist-resolver.ts — SWEPT-CLEAN. The frozen pipeline (:189-243) is UNCHANGED; the go adapter FEEDS it via readInstalledMeta synthesis (§3 of this PR body).
• setup.d/45-python.sh, setup.d/46-cargo.sh — SWEPT-CLEAN. Lane shape mirrors; no lane was edited as a side-effect of go.
• .github/workflows/audit-self.yml — EXTENDED in place. Pre-existing rust arm (:250-274) is UNCHANGED; the go arm (:275-296 approx) is added AFTER it. CI green expected to remain unchanged on the rust arm.
• packages/core/templates/python/, packages/core/templates/cargo/ — SWEPT-CLEAN. The new packages/core/templates/go/ directory mirrors the existing pair's structure (template + github-actions-ci.yml).
• packages/core/principles/33-adapter-jig-arm-registry.ts:63-93 — SWEPT-CLEAN. The CANONICAL_ARMS array is UNCHANGED — J3 stamps a family through the existing arm set; no arm was added, removed, or narrowed.

Population-vs-baseline reconciliation: the unwired-debt tripwire's BASELINE (ecosystem-unwired-debt.test.ts:106) is 0 AND stays 0 because goAdapter is wired in this same PR (G2 atomicity). There is no point in the commit history where the population exceeds baseline.

§7 Self-application (T15) — the framework's own discipline applied to itself

The framework's thesis is that every rule must be an executable artifact failing at the earliest reachable channel. This PR dogfoods that thesis on a new family:

• F8 firing self-check at setup.d/47-go.sh:159-225 — executable, fires at bash install.sh go (install-time channel).
• H1 baseline lockstep at packages/core/research/ecosystem-unwired-debt.test.ts:106 — executable, fires in vitest (CI channel).
• H3 population equality at packages/core/research/ecosystem-adapter-precondition.test.ts — executable, fires in vitest.
• D3 lock schema parity at tests/install-sh/rules-lock-schema-parity.test.sh arm 2b — executable, fires in bash test harness.
• F9 snapshot byte-identity at tests/install-sh/snapshot.sh — executable, fires in SNAPSHOT_MODE=compare.

No "trust me" assertions. Every claim this PR makes is backed by a test that fails loudly if the claim becomes false.

§8 Test plan

Run locally (post-merge-forward):

SNAPSHOT_MODE=compare bash tests/install-sh/snapshot.sh
  → 15 pass / 0 fail

npx vitest run packages/core/research/ecosystem-go.test.ts
  → 12 passed (12)

bash tests/install-sh/rules-lock-schema-parity.test.sh
  → 9 passed, 0 failed

npx vitest run packages/core/research/ecosystem-unwired-debt.test.ts \
                packages/core/research/ecosystem-adapter-precondition.test.ts \
                packages/core/research/ecosystem-name.test.ts \
                packages/core/detector/stack-exhaustiveness.test.ts
  → 4 files, 21 passed

On PR open: CI runner arm .github/workflows/audit-self.yml go arm proves E1 under pinned toolchain — link the run URL in §2 above (T-EW-C).

§9 Notes for the harvest / PR-create step

• Branch: feature/adapter-jig-j3-d4db43 (4 commits ahead of staging: 3 feature + 1 merge-forward b4435630).
• Base: staging.
• The container could NOT push (no TCP to github.com per §1.3, gh unauthed). Egress via Channel A of egress-no-api-bypass.md (host-pull + host git push after rebasing on live origin/staging — already done locally as b4435630, but the host should re-fetch and re-rebase if staging has moved further).
• After PR open: edit §2 of this body to paste the CI runner arm URL for the E1 evidence link.

---

Cold-review: invoke agents/adapter-jig-reviewer.md per the J1 contract. Reviewer's read-only authority covers the F1-F11 frozen rows + the 22-arm mapping in §4.

Harvest addendum (orchestrator, 2026-07-26)

Merge is intentionally held. The pre-egress cold audit (agents/fidelity-auditor.md) ran Round 1 against the mid-rework diff and returned REVISE; all 5 findings were fixed and hand-verified (real actions/setup-go@41dfa10 pin restoring F10 two-surface parity; the live-fire step now failing on the lane's own ✗/SILENT/OVER-BROAD/NOT proven markers AND asserting the positive «enforcement is live» line; single-label rejection returned to tier1For; same-step GITHUB_PATH hazard removed; the go: prefix test committed as b4fab802 so §4.1's citation is true against the diff). Round 2 over this final diff has NOT yet run — the operator paused the session on quota. No ## Fidelity verdict section is present, so the required fidelity-verdict-in-pr-body check stays RED and blocks merge — that is the fail-closed hold working as designed, not a CI accident. On resume: fidelity Round 2 (cap rule: REVISE → STOP + escalate) → GO block added → auto-merge only after the body is final (the #1162 race lesson). The §5 E3 park is the one owner decision awaiting the operator: worker recommends Option A (no backends/go/ matrix in this PR; cargo precedent — matrix shipped separately from its lane).

Fidelity verdict

FIDELITY: GO
Basis: .claude/orchestrator-prompts/adapter-jig-j3/kickoff.md
Round: 3
Audited-SHA: bc529ed
Evidence: packages/core/hooks/pin-parity.test.ts:60-71 (go-toolchain + golangci-lint joined the arm-P1 population with per-tool consumerSurfaces); packages/core/hooks/pin-parity.test.ts:145-159 (the live-population assertion and the REAL-tree mirror now loop over all four tools, so a one-sided go pin edit goes RED); packages/core/principles/33-adapter-jig-arm-registry.ts:600-603 (the canonical arm list's P1 scope prose follows that population); .github/workflows/audit-self.yml:304 (~/go/bin replaces the empty ${{ env.GOBIN }}); packages/core/research/ecosystem-go.test.ts:3 (provenance points at the tracked kickoff); packages/core/synthesizer/resolve-ctx.ts:40 (doc comment carries the go rung it selects at :62)
Findings: MINOR — no go entry-lane suite: go-side arm markers cover B1/B2/B3 (packages/core/research/ecosystem-go.test.ts:47,64,158,181,199) where python and cargo ship tests/install-sh/python-entry-lane.test.sh:166 and tests/install-sh/cargo-entry-lane.test.sh:119. Carried deliberately: kickoff §2's five-deliverable list does not name per-arm suites, and the E1/E2 evidence is the live runner arm linked in §4.5 rather than a committed lane script. MINOR — the registry's collapsed phrase «the go toolchain + golangci-lint (J3), whose consumer half is the delivered CI template plus the lane's REFUSE-path hint» (packages/core/principles/33-adapter-jig-arm-registry.ts:600-601) reads as if both tools mirror on both surfaces, while go-toolchain mirrors only on the CI template (packages/core/hooks/pin-parity.test.ts:75) and only golangci-lint adds setup.d/47-go.sh (:82); the following sentence resolves it, so the prose is compressed, not wrong.

Round history: Round 1 REVISE (5 findings, fixed pre-egress) → Round 2 REVISE over 64caa85 (1 MAJOR: arm P1 / F10 two-surface pin parity had no go-side enforcement — go pinned on both surfaces, population unextended, sync guarded by a prose comment; + 4 MINOR) → Round 3 GO over 852e144, refreshed onto bc529ed by a narrow cold delta check after a comment-only scope-neutral commit (.claude/rules/cold-seat-economy.md §1). Per-round watch-list verdicts are in ## Review findings.

Review findings

Watch-list

id	criterion	why	defect site	reintroduction tell
W-1	kickoff §2 deliverable 4 — F10 two-surface pin parity (arm P1) enforced, not commented	a framework/consumer pin divergence ships consumers a toolchain different from the evidence the framework fired against; both lines stay individually "pinned", so the per-line gate at checks/unpinned-tool-install.ts cannot see it	closed in round 3 — packages/core/hooks/pin-parity.test.ts:60-71,145-159 (defect site was :47-53)	a golangci-lint or go-version value edited on any one of .github/workflows/audit-self.yml:292,310 / packages/core/templates/go/github-actions-ci.yml:48,53 / setup.d/47-go.sh:147,306 without the same string moving on all of them; or a round that removes a go entry from TRACKED_TOOLS or drops it from the REAL-tree loop
W-2	kickoff §2.1 + T-AJ3-A — the adapter FEEDS tier1For; every accept/reject decision stays in the frozen pipeline	a host-shape test inside readInstalledMeta short-circuits the frozen canonicalize/reject chain; arm B1 then passes without the pipeline ever running (partial F3 bypass)	packages/core/research/ecosystem-go.ts:150-160 — a single-label return null lived here and was removed pre-egress	any host/hostname/includes('.')/new URL(...) inspection, or any second return null beyond the isUnsafeDepName name-guard, reappearing in readInstalledMeta, however phrased
W-3	kickoff §1.1 F8 — plant in mktemp -d only, LOUD degrade when the tool is absent, rc=0 on every branch	a self-check that writes into the consumer tree or aborts the install turns a proof into an outage; a silent degrade makes "tool absent" read as green	none — preventive (setup.d/47-go.sh:262-320 conforms)	a write path under $PROJECT_ROOT inside _go_firing_self_check, a return 1/exit on any branch, or the insufficient (tool absent) / NOT proven strings being softened or dropped from the degrade branch
W-4	kickoff §2 deliverable 5 / §4 — BASELINE stays 0 because the adapter is wired in the same PR	an adapter that lands unwired is dead code a later umbrella silently forgets; the tripwire only holds under strict ===	none — preventive (packages/core/research/ecosystem-unwired-debt.test.ts:106 = 0; wiring at packages/core/synthesizer/resolve-ctx.ts:62)	const BASELINE becoming any non-zero literal, or the literal adapter: goAdapter at resolve-ctx.ts:62 being replaced by a dynamic/registry lookup (which evades isWired's grep and would need a BASELINE bump instead)
W-5	kickoff §2 deliverable 4 + T-AJ3-C — the CI arm must make the go firing path EXECUTE, not merely install a toolchain	_go_firing_self_check returns 0 by contract on every branch, so a step relying on exit code alone goes green over a SILENT or OVER-BROAD config — the arm becomes a claim, not a proof	none — preventive (.github/workflows/audit-self.yml:346,353)	the grep -E 'SILENT|OVER-BROAD|NOT proven|✗' failure-marker check or the positive grep -F 'enforcement is live' check being removed, made non-fatal, or reduced back to [ -f ... ] existence assertions
W-6	kickoff §2 / arm E1 — the delivered config must discriminate: RED on the planted violation, GREEN on the clean control	under the pinned golangci-lint v1.x an unknown key is dropped silently, leaving the regex empty — which matches everything, so the config fires on conforming code and enforcement is fake in the loudest way	packages/core/templates/go/.golangci.yml:31 — the forbid key was pattern: instead of p: (CI run 31093381580); fixed at 64caa8509e	the forbidigo entry key changing from p: to pattern: (a plausible "modernisation" to the v2 schema) without the golangci-lint@v1.55.2 pin moving in the same edit, on any of the four pin sites
W-7	kickoff §1.2 + §3 trigger 2 — E3 toolchain-freshness-vs-evidence is PARKED, not decided	parking sizes the stage; silently answering it (either by building a backends/go/ capability-matrix or by declaring E3 not-applicable) takes an owner decision the worker was told not to make	none — preventive (.github/workflows/audit-self.yml:275-276 records the park and points at §5 of this body)	a packages/core/backends/go/ directory or capability-matrix.json appearing, a test:backends-style include-allowlist entry for go, or the park note being rewritten into a verdict
W-8	kickoff §0/§1.2 — the arm registry is the canonical arm list; its P1 scope prose must match the tracked population	a registry that names a narrower population than the arm enforces re-teaches the next stamped family the old, smaller scope	closed in the round-3 delta refresh — packages/core/principles/33-adapter-jig-arm-registry.ts:600-603 (stale when introduced by round 2's widening)	the P1 comment's tool enumeration diverging from TRACKED_TOOLS in packages/core/hooks/pin-parity.test.ts in either direction — a tool added to one and not the other

Round 2: W-1 REINTRODUCED (packages/core/hooks/pin-parity.test.ts:47-53) · W-2 CLEAN (packages/core/research/ecosystem-go.ts:150-160) · W-3 CLEAN (setup.d/47-go.sh:262-320) · W-4 CLEAN (packages/core/research/ecosystem-unwired-debt.test.ts:106) · W-5 CLEAN (.github/workflows/audit-self.yml:342,349) · W-6 CLEAN (packages/core/templates/go/.golangci.yml:26) · W-7 CLEAN (.github/workflows/audit-self.yml:275-277) · W-8 n/a (item did not exist)

Round 3: W-1 CLEAN · W-2 N/A (surface absent from the round's diff; spot-verified at head — no host inspection, single return null at packages/core/research/ecosystem-go.ts:143) · W-3 N/A (surface absent from the round's diff) · W-4 CLEAN · W-5 CLEAN · W-6 N/A (surface absent from the round's diff) · W-7 CLEAN · W-8 REINTRODUCED at 852e144, then CLEAN at bc529ed (delta refresh)

Watch-list

id	criterion	why	defect site	reintroduction tell
W-1	kickoff §2 deliverable 4 — F10 two-surface pin parity (arm P1) enforced, not commented	a framework/consumer pin divergence ships consumers a toolchain different from the evidence the framework fired against; both lines stay individually "pinned", so the per-line gate at checks/unpinned-tool-install.ts cannot see it	packages/core/hooks/pin-parity.test.ts:47-53 (TRACKED_TOOLS lacks a go row this round)	a golangci-lint or go-version value edited on any one of .github/workflows/audit-self.yml:292,306 / packages/core/templates/go/github-actions-ci.yml:48,53 / setup.d/47-go.sh:147,306 without the same string moving on all of them; or a later round that adds go to the P1 population and then narrows it back
W-2	kickoff §2.1 + T-AJ3-A — the adapter FEEDS tier1For; every accept/reject decision stays in the frozen pipeline	a host-shape test inside readInstalledMeta short-circuits the frozen canonicalize/reject chain; arm B1 then passes without the pipeline ever running (partial F3 bypass)	packages/core/research/ecosystem-go.ts:150-160 — a single-label return null lived here and was removed this round	any host/hostname/includes('.')/URL(...) inspection, or any second return null beyond the isUnsafeDepName name-guard, reappearing in readInstalledMeta, however phrased
W-3	kickoff §1.1 F8 — plant in mktemp -d only, LOUD degrade when the tool is absent, rc=0 on every branch	a self-check that writes into the consumer tree or aborts the install turns a proof into an outage; a silent degrade makes "tool absent" read as green	none — preventive (setup.d/47-go.sh:262-320 conforms)	a write path under $PROJECT_ROOT inside _go_firing_self_check, a return 1/exit on any branch, or the insufficient (tool absent) / NOT proven strings being softened or dropped from the degrade branch
W-4	kickoff §2 deliverable 5 / §4 — BASELINE stays 0 because the adapter is wired in the same PR	an adapter that lands unwired is dead code a later umbrella silently forgets; the tripwire only holds under strict ===	none — preventive (ecosystem-unwired-debt.test.ts:106 = 0; wiring at resolve-ctx.ts:61)	const BASELINE becoming any non-zero literal, or the adapter: goAdapter textual form at resolve-ctx.ts:61 being replaced by dynamic/registry lookup (which evades isWired's grep and would need a BASELINE bump instead)
W-5	kickoff §2 deliverable 4 + T-AJ3-C — the CI arm must make the go firing path EXECUTE, not merely install a toolchain	_go_firing_self_check returns 0 by contract on every branch, so a step relying on exit code alone goes green over a SILENT or OVER-BROAD config — the arm becomes a claim, not a proof	.github/workflows/audit-self.yml:342,349 — an earlier round asserted artefact existence only (MAJOR 2, fixed this round)	the grep -E 'SILENT|OVER-BROAD|NOT proven...|✗' failure-marker check or the positive grep -F 'enforcement is live' check being removed, made non-fatal, or reduced back to [ -f ... ] existence assertions
W-6	kickoff §2 / arm E1 — the delivered config must discriminate: RED on the planted violation, GREEN on the clean control	under the pinned golangci-lint v1.x an unknown key is dropped silently, leaving the regex empty — which matches everything, so the config fires on conforming code and enforcement is fake in the loudest way	packages/core/templates/go/.golangci.yml:26 — the key was pattern: instead of p: (CI run 31093381580); fixed in 64caa8509e	the forbidigo entry key changing from p: to pattern: (a plausible "modernisation" to the v2 schema) without the golangci-lint@v1.55.2 pin moving in the same edit, on any of the four pin sites
W-7	kickoff §1.2 + §3 trigger 2 — E3 toolchain-freshness-vs-evidence is PARKED, not decided	parking sizes the stage; silently answering it (either by building a backends/go/ capability-matrix or by declaring E3 not-applicable) takes an owner decision the worker was told not to make	none — preventive (.github/workflows/audit-self.yml:275-277 records the park and points at the PR body)	a packages/core/backends/go/ directory or capability-matrix.json appearing, a test:backends-style include-allowlist entry for go, or the park note being rewritten into a verdict

Round 2: W-1 REINTRODUCED (packages/core/hooks/pin-parity.test.ts:47-53) · W-2 CLEAN (packages/core/research/ecosystem-go.ts:150-160) · W-3 CLEAN (setup.d/47-go.sh:262-320) · W-4 CLEAN (packages/core/research/ecosystem-unwired-debt.test.ts:106) · W-5 CLEAN (.github/workflows/audit-self.yml:342,349) · W-6 CLEAN (packages/core/templates/go/.golangci.yml:26) · W-7 CLEAN (.github/workflows/audit-self.yml:275-277)

Prior-art: prior-art-evaluations.md#226 (conformance-kit SSOT entry landed with J1 #1087 — this PR is the jig's first stamped family; the go adapter follows the frozen F1-F11 contract that entry governs, BUILD verdict already adjudicated there, no new problem-class).