[mnkiefer]

Summary

• Require native Go for App-backed collection and retire the filesystem/Node collector fallback; the independent Actions snapshot pipeline remains unchanged.
• Move hosted Value policy, local Optimization evaluation, and reviewed Daily File Diet Git acquisition to Go, with PostgreSQL packet/proof fences and actual-attempt health.
• Add reviewed, quota-bounded Dependabot alert and pull-request lifecycle acquisition for github/gh-aw. Publish all three frozen metric packets atomically; the local evaluator reads canonical PostgreSQL facts and reports numeric counts only for a complete seven-day cutoff. Missing or truncated evidence remains unavailable, never synthetic zero. Alert pagination follows GitHub after cursors; the 111-request ceiling includes an optional Search-quota preflight.
• Ship a Node-free collector image and migrate Azure native collection away from the evidence lake.

Validation

• Full Go server test suite, Go build/vet, and isolated PostgreSQL batch-publication and acquisition → canonical SQL → numeric Value tests passed.
• Repository lint and CAO typecheck, relevant JS/policy tests, documentation build, and all 78 gh-aw workflow compilations passed (eight compiler warnings).
• Collector runtime was inspected without Node or GitHub CLI; Git remains for the reviewed File Diet transport.

Remaining limitations

• Dependabot acquisition requires the enrolled GitHub App to have Dependabot-alert and pull-request read permissions and enough shared Core/Search quota. Evidence beyond the bounded alert/search pagination caps remains missing; a live API run was rate-limited (HTTP 403) and is not claimed as validated.
• Azure workers require exact reviewed inventory bytes provisioned in PostgreSQL before selecting their digest.

Security review note

• Workflow sources and generated lock files are unchanged by this follow-up; no secrets, actions, or redirect changes were added or removed in its workflow diff. The compiler nevertheless flagged docker/build-push-action and docker/setup-buildx-action as new unapproved actions in safe-update mode. I inspected the tracked workflow Markdown and lock YAML and found neither action there; these are Docker build/publish and Buildx setup actions, but I cannot verify the warning provenance or approve any resulting change. Human review is required if the compiler proposes either action on regeneration; no secret or redirect change was reported.

[mnkiefer]

@copilot Fix failing checks and address review comments

[mnkiefer]

@copilot Fix failing checks

[Copilot]

@copilot Fix failing checks

Fixed the Go server lint failures and verified the server tests, vet, uncapped lint, and formatting checks. The change is in commit 87d4cb5.