v1.1.16

[1.1.16] - 2026-08-26

Security

• Raise the Go toolchain to 1.26.6 to clear four reachable Go standard-library
  vulnerabilities reported by govulncheck: GO-2026-6218 (net/url),
  GO-2026-6090 (crypto/tls), GO-2026-5972 (encoding/asn1), and
  GO-2026-5026 (net/http).
• CI now runs govulncheck ./... in the Lint job, fail-closed. SEC-SPEC §5 was
  tightened to require a dependency audit for every ecosystem a tool ships in;
  this one ships as a Go binary and an npm wrapper, and only the wrapper was
  ever audited, so the Go module's own dependencies went unscanned.

Changed

• Sync the vendored spec to ai-native-cli-spec@v1.6.0. Besides the audit rule
  above, CLI-SPEC §14 now states the update final-state contract explicitly:
  the idempotent no-op check runs before any package-manager command, and both
  successful and no-op results report current_version == target_version with
  update_available: false.
• Sync the vendored spec to ai-native-cli-spec@v1.6.1. gen-contract.js no
  longer falls back to unformatted output when its source formatter is missing:
  the generated bytes are what check-spec.js byte-compares against, so a
  silent fallback made a fail-closed drift guard answer differently depending on
  what was installed. A missing formatter is now an error with exit 2.

Fixed

• The CI job that runs check-spec.js now sets up Go. It had Node only and
  worked purely because the GitHub runner image happens to preinstall Go — one
  image change away from every Go tool in the fleet reporting phantom contract
  drift at once. The codegen verifier now gets the codegen's own toolchain.
• The release path now gates on the same checks as the merge path.
  release.yml re-ran formatting, vet and tests at tag time but never ran
  govulncheck or check-spec.js, so a CVE published after the last green run
  on main shipped signed and published — which is exactly what would have
  happened this month. It now runs both, Linux-only, before the build. A
  release blocked by a fresh upstream advisory is the intended outcome.
• The two steps that shell out to apt-get (Project-specific clean check and
  Ensure race detector toolchain) are bounded with timeout-minutes: 5. They
  normally take seconds; one stalled for close to an hour and had to be
  cancelled by hand, which without a bound would have run to the six-hour job
  default.