chore(deps): refresh Go dependencies and CI toolchain

[steipete]

Refresh the Go dependencies used by Clawgo and the tools that build it. The application and bridge protocol are unchanged; the updated binary passes a live local pairing/transcript exchange with mDNS enabled.

Dependency changes

Dependency/tool	Before	After
Preferred Go toolchain	1.26.0 from the go directive	1.27.0 via toolchain; minimum remains 1.26.0
github.com/miekg/dns	v1.1.27	v1.1.73
golang.org/x/net	v0.55.0	v0.58.0
golang.org/x/sys	v0.46.0	v0.47.0
golang.org/x/sync in the selected module graph	2019 pseudo-version	v0.22.0
CI deadcode	v0.45.0	v0.49.0
actions/checkout	v6	v7.0.1, pinned to its release commit
actions/setup-go	v6	v7.0.0, pinned to its release commit

Regenerated manifests with go get -u ./..., go get toolchain@go1.27.0, and go mod tidy. Tidy removed the unnecessary direct x/crypto requirement; go mod why -m golang.org/x/crypto reports that the main module does not need it. Existing transitive module metadata still selects v0.55.0. No new library was introduced.

zeroconf v1.0.0, backoff v2.2.1+incompatible, and the dispatch workflow's app-token action v3.2.0 are already current on their existing release/import paths. Every module used by the application's packages and tests is current on its existing path. Generator-only module constraints inherited from dependencies are left to their owners.

Major upgrades taken: checkout v7 adds safer checkout defaults for privileged events; this build workflow uses ordinary push/pull_request events. setup-go v7 changes its internal module format without changing inputs or outputs. Its documented toolchain-directive support selects Go 1.27.0 from go.mod.

NEEDS-PETER: defer backoff v5 and the DNS v2 successor. zeroconf owns the imports of both older APIs; migrating them requires changing/forking/replacing that dependency. Recommendation: retain the latest compatible versions in this maintenance PR and handle any mDNS-library migration separately. See the backoff import contract and DNS successor notice.

Validation and live proof

Run on macOS arm64 with Go 1.27.0. Build artifacts and the private build cache were kept inside .git/deps-refresh for cleanup.

GOCACHE="$PWD/.git/deps-refresh/go-cache" go build -o .git/deps-refresh/clawgo ./cmd/clawgo
GOCACHE="$PWD/.git/deps-refresh/go-cache" go build ./...
GOCACHE="$PWD/.git/deps-refresh/go-cache" go test -count=1 ./...
python3 .git/deps-refresh/live.py

Builds exited 0 with no output. Test and live output:

?   github.com/clawdbot/clawgo/cmd/clawgo [no test files]
?   github.com/clawdbot/clawgo/internal/routing [no test files]
?   github.com/clawdbot/clawgo/internal/routing/plugin [no test files]
ok  github.com/clawdbot/clawgo/internal/routing/policy/default 1.304s
ok  github.com/clawdbot/clawgo/internal/routing/queue 0.696s
?   github.com/clawdbot/clawgo/internal/session [no test files]
ok  github.com/clawdbot/clawgo/modules/audio 1.234s
ok  github.com/clawdbot/clawgo/modules/stt 1.036s
?   github.com/clawdbot/clawgo/modules/tts [no test files]
?   github.com/clawdbot/clawgo/modules/wakeword [no test files]
PASS: real TCP pairing, persisted state, and authenticated hello
PASS: stdin -> voice.transcript {"sessionKey": "deps-proof", "text": "turn on the kitchen lights"}
PASS: bridge ping -> matching pong
PASS: mDNS registration with refreshed DNS/network dependencies
PASS: SIGTERM clean exit=0

The fixture uses a loopback TCP bridge and synthetic state, writes real transcript text to the built CLI's stdin, checks the received protocol frames, and verifies mDNS registration and graceful shutdown. It does not contact a production gateway or send messages to a provider. This proves local protocol behavior, not compatibility with a deployed gateway.

Additional commands:

GOCACHE="$PWD/.git/deps-refresh/go-cache" GOBIN="$PWD/.git/deps-refresh/bin" go install golang.org/x/tools/cmd/deadcode@v0.49.0
GOCACHE="$PWD/.git/deps-refresh/go-cache" .git/deps-refresh/bin/deadcode -test ./... > .git/deps-refresh/deadcode.txt
test ! -s .git/deps-refresh/deadcode.txt
GOCACHE="$PWD/.git/deps-refresh/go-cache" GOOS=linux GOARCH=arm64 go build -o .git/deps-refresh/clawgo-linux-arm64 ./cmd/clawgo
file .git/deps-refresh/clawgo-linux-arm64
go mod verify

deadcode: no unreachable functions
.git/deps-refresh/clawgo-linux-arm64: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, [...]
all modules verified

CI reasoning

The initial NORUNS observation was a discovery gap. The current default-branch commit already passed the real CI workflow: https://github.com/openclaw/clawgo/actions/runs/30230830563. Its deadcode, test, and build assertions remain intact. The PR build/test run passed with the refreshed toolchain, actions, and deadcode version: https://github.com/openclaw/clawgo/actions/runs/33378295860. No failing assertions or jobs were weakened or removed. Both CodeQL analyses (Go and Actions) also passed: https://github.com/openclaw/clawgo/actions/runs/33378292377.

ClawSweeper Dispatch is event-driven operational automation, not a build/test gate or a scheduled production monitor. Its latest observed run succeeded: https://github.com/openclaw/clawgo/actions/runs/33368092116. Its current pinned action and workflow behavior are unchanged.

Codex autoreview completed scoped-clean at its default P0 threshold with no accepted/actionable findings. No runtime behavior change is intended, so no changelog entry is needed. This PR is for maintainer review; it must not be merged by this worker.

Reproduce the live fixture

Save the following as .git/deps-refresh/live.py after creating .git/deps-refresh, then run the build and live-proof commands above.

import json
import pathlib
import signal
import socket
import subprocess
import tempfile

root = pathlib.Path.cwd()
binary = root / '.git/deps-refresh/clawgo'
with tempfile.TemporaryDirectory(prefix='live-', dir=root / '.git/deps-refresh') as temp:
    state = pathlib.Path(temp) / 'state.json'
    state.write_text(json.dumps({'nodeId': 'deps-proof', 'displayName': 'Dependency Proof'}))
    with socket.socket() as listener:
        listener.bind(('127.0.0.1', 0))
        listener.listen(1)
        listener.settimeout(15)
        address = '127.0.0.1:' + str(listener.getsockname()[1])
        args = [str(binary), 'run', '-bridge', address, '-state', str(state),
                '-node-id', 'deps-proof', '-display-name', 'Dependency Proof',
                '-stdin', '-chat-subscribe=false', '-tts-engine', 'none',
                '-ping-interval=0', '-quick-actions=false', '-session-key', 'deps-proof',
                '-mdns-name', 'clawgo-deps-proof', '-mdns-service', '_clawgo-proof._tcp']
        child = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                                 stderr=subprocess.PIPE, text=True)
        try:
            with listener.accept()[0] as conn:
                conn.settimeout(15)
                stream = conn.makefile('rwb', buffering=0)
                def receive():
                    line = stream.readline()
                    if not line:
                        raise RuntimeError('client closed before completing live proof')
                    return json.loads(line)
                def send(frame):
                    stream.write(json.dumps(frame).encode() + b'\n')
                pair = receive()
                assert pair['type'] == 'pair-request' and pair['nodeId'] == 'deps-proof', pair
                # A fixture value, never a real credential or remote gateway.
                send({'type': 'pair-ok', 'token': 'synthetic-proof'})
                hello = receive()
                assert hello['type'] == 'hello' and hello['token'] == 'synthetic-proof'
                send({'type': 'hello-ok', 'serverName': 'loopback-proof'})
                print('PASS: real TCP pairing, persisted state, and authenticated hello')
                child.stdin.write('turn on the kitchen lights\n')
                child.stdin.flush()
                frame = receive()
                assert frame['type'] == 'event' and frame['event'] == 'voice.transcript', frame
                payload = json.loads(frame['payloadJSON'])
                assert payload == {'sessionKey': 'deps-proof', 'text': 'turn on the kitchen lights'}, payload
                print('PASS: stdin -> voice.transcript ' + json.dumps(payload, sort_keys=True))
                send({'type': 'ping', 'id': 'proof-ping'})
                assert receive() == {'type': 'pong', 'id': 'proof-ping'}
                print('PASS: bridge ping -> matching pong')
                child.send_signal(signal.SIGTERM)
                stdout, stderr = child.communicate(timeout=15)
                assert child.returncode == 0, stderr
                assert json.loads(state.read_text())['token'] == 'synthetic-proof'
                assert 'mdns: advertised clawgo-deps-proof' in stderr, stderr
                assert 'mdns register failed' not in stderr, stderr
                print('PASS: mDNS registration with refreshed DNS/network dependencies')
                print('PASS: SIGTERM clean exit=0')
        finally:
            if child.poll() is None:
                child.kill()
                child.communicate(timeout=5)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 31, 2026, 5:36 AM ET / 09:36 UTC.

ClawSweeper review

What this changes

The PR updates Go module dependencies, prefers Go 1.27.0, refreshes the CI actions and deadcode tool, and documents the toolchain requirement.

Merge readiness

✅ Ready for maintainer review

Keep open for normal maintainer review: this is a focused dependency and CI refresh with no definite introduced defect found, and its supplied live trace exercises the built node through pairing, transcript delivery, mDNS registration, and clean shutdown.

Priority: P2
Reviewed head: 9518a349b7b94617c494b9e4a103489f9c614dc5

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, reviewable maintenance patch with strong local runtime proof and no supported correctness finding.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.
Evidence reviewed	5 items	Verified introduced scope: The verified merge-base-to-head diff changes only the CI workflow, README, go.mod, and go.sum; the test-merge result has the pinned main parent followed by this exact head. Dependency-affected behavior has a production owner: The built node imports zeroconf and calls its registration API for its mDNS listener; the updated dependency graph contains the indirect DNS and network modules used on that path. Real local behavior proof: The PR body records a macOS arm64 Go 1.27.0 run of the built binary against a loopback TCP bridge, observing authenticated pairing, a stdin transcript frame, ping/pong, mDNS registration, persisted state, and SIGTERM exit 0. This directly covers the dependency-affected local runtime path, while correctly not claiming deployed-gateway compatibility.
Findings	None	None.
Security	None	None.

How this fits together

Clawgo is a headless Go node that connects to an OpenClaw bridge, sends transcript events, and advertises itself through mDNS. Its module manifest determines the dependency graph used by local builds, while CI selects the Go toolchain and runs static checks, tests, and a build.

flowchart LR
  A[Developer checkout] --> B[Go module and toolchain]
  B --> C[Clawgo build]
  C --> D[Bridge pairing and transcript events]
  C --> E[mDNS advertisement]
  B --> F[CI checks]
  F --> G[Test and build results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	4 files affected; 18 added, 15 removed	The patch is confined to dependency metadata, CI setup, and matching build documentation.

Technical review

Best possible solution:

Land the focused refresh after ordinary exact-head CI review, retaining the pinned action revisions and deferring incompatible mDNS-library major migrations to a separate change.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug report; the PR includes a concrete live local run of the dependency-affected node behavior after the update.

Is this the best way to solve the issue?

Yes; updating compatible modules and pinning CI actions is the narrowest maintainable path, while leaving incompatible major mDNS dependency migrations out of this refresh.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 5f1b9d90abe2.

Labels

Label changes:

• add P2: This is a bounded maintenance update to the build and dependency surface with limited user-facing blast radius.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.

Label justifications:

• P2: This is a bounded maintenance update to the build and dependency surface with limited user-facing blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR supplies a recorded real macOS Go 1.27.0 run of the built Clawgo binary through its loopback bridge and mDNS production path, with observed successful pairing, transcript frame delivery, mDNS registration, persisted state, and graceful shutdown.

Evidence

What I checked:

• Verified introduced scope: The verified merge-base-to-head diff changes only the CI workflow, README, go.mod, and go.sum; the test-merge result has the pinned main parent followed by this exact head. (go.mod:5, 9518a349b7b9)
• Dependency-affected behavior has a production owner: The built node imports zeroconf and calls its registration API for its mDNS listener; the updated dependency graph contains the indirect DNS and network modules used on that path. (cmd/clawgo/main.go:1152, 9518a349b7b9)
• Real local behavior proof: The PR body records a macOS arm64 Go 1.27.0 run of the built binary against a loopback TCP bridge, observing authenticated pairing, a stdin transcript frame, ping/pong, mDNS registration, persisted state, and SIGTERM exit 0. This directly covers the dependency-affected local runtime path, while correctly not claiming deployed-gateway compatibility. (9518a349b7b9)
• CI hardening remains narrow: The workflow keeps contents read-only and replaces floating major action tags with full commit pins while retaining the existing test, build, and deadcode stages. (.github/workflows/ci.yml:8, 9518a349b7b9)
• Area history: Repository history shows Peter Steinberger's earlier dependency refresh and CI-runtime updates, and Vincent Koc's deadcode-check addition; both are relevant routing context for this maintenance surface. (.github/workflows/ci.yml:24, 141b5f05d4cf)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.