[levifig]

Loaf's pinned Go 1.27.2 toolchain is affected by GO-2026-6809. Build and audit with Go 1.27.3, and keep fresh Orb environments on the same version with verified Linux archive checksums.

Verification

• The Linux amd64 and arm64 checksums match the official Go download metadata.
• The pinned-toolchain vulnerability audit passes with Go 1.27.3. The previous Go 1.27.2 audit reported the affected certificate-verification symbol.
• Independent review confirms only the toolchain pin, matching bootstrap metadata and changelog changed.
• Full local verification passes with Go 1.27.3 and Node 24.20.0, including uncached Go tests, vet, CGO-free build, all 39 adapter tests and generated-content checks.

Scope

No other dependency versions, runtime selection, release or deployment changes are included. The broader dependency review is tracked in #428; the Linear-reference checker is separate work in #427.

Ship

Signed candidate fbae720541aa46760e0f3f653b64f888932acafa passed local gates, hosted checks and independent review. The Ship approval and criterion evidence are recorded in the PR conversation.

Closes #429.

Agent notes

• Base: 5905ca59c82a5e9fad673c6a63c0d276f92a4a63; reviewed tree: 605db00adf3a59fe2bed6cdf66f039376e683c0a.
• Checksums: official Go download metadata.
• Advisory: GO-2026-6809.
• Existing module-only SSH/OpenPGP advisories are in packages the code does not import. They are not silently treated as fixed here; Review runtime dependencies and compare in-house alternatives #428 owns the dependency review.
• This source increment does not run Orb setup, activate a runtime or publish a release.

[levifig]

Approved for landing. The signed Go 1.27.3 patch passes full local verification, the pinned vulnerability audit and all hosted checks. No runtime activation, release or deployment is included.

Agent notes

• Reviewed head: fbae720541aa46760e0f3f653b64f888932acafa; tree: 605db00adf3a59fe2bed6cdf66f039376e683c0a; base: 5905ca59c82a5e9fad673c6a63c0d276f92a4a63. GitHub reports a valid signature and author me@levifig.com.
• Update the pinned Go toolchain to fix GO-2026-6809 #429: both Orb checksums match live official metadata; full uncached Go tests, compile/vet/CGO-free checks, 39 adapter tests and generated-content checks pass; pinned Go 1.27.3 audit passes; independent correctness/prose review is clean.
• The previous Go 1.27.2 audit failed GO-2026-6809. The committed binary names Go 1.27.3, this exact revision and an unmodified source tree.
• All four Verification boxes are ticked with this evidence. The actual committed base/head changelog check passes.
• Hosted build and both emitted changelog runs pass. Native rules require pull requests, signatures and linear history with squash only; they do not require these check contexts. Ship nevertheless requires passing checks.
• The maintainer explicitly authorized verification and Ship. Merge must pin this head and use squash with a deliberate outcome message. Re-read head, boxes and checks immediately before merging.

[levifig]

Landed as 5d6d7bfe; the resulting-main build passed. #429 is closed with all Verification boxes satisfied. No installed runtime, release or deployment was changed.

Agent notes

• Landed tree 605db00adf3a59fe2bed6cdf66f039376e683c0a matches the reviewed and tested candidate. GitHub verifies the signature and author me@levifig.com.
• Local reconciliation remains pending because main belongs to the owner checkout, which contains local configuration. That checkout was preserved. Clean feature worktrees and local/remote feature branches are retained.
• Remote landing and native issue closure are verified independently of that local synchronization boundary.