[zzwong]

Add toolchain go1.26.10 to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add a crypto/x509 distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.

actions/setup-go uses the toolchain directive in preference to the go directive, so builds, tests and releases all pick it up. The go language version is unchanged.

Verification

GOTOOLCHAIN=go1.26.10 go build ./... passes for every module.

[monit-reviewer]

Automated PR Review

Reviewed commit: a4a9d1bfabf6
Profile: claude-monit-reviewer - Posting as: monit-reviewer

Summary

Reviewer	Findings
automation:ci-release	1
go:implementation-tests	0
security:code-auditor	0

automation:ci-release (1 finding)

Minor - go.work:3

The PR says actions/setup-go picks up the toolchain directive, but every setup-go step in .github/workflows/ci.yml (lines 49, 83, 117, 131, 145, 173) passes go-version: '1.26' and not go-version-file. The directive does not drive the toolchain installed in those jobs. They get the newest 1.26.x on the runner manifest, and the go command only switches to go1.26.10 if that is older. Only arch-package.yml uses go-version-file. So the CI gate does not enforce the pin, and the Go version is still duplicated as a literal. Switch the ci.yml steps to go-version-file: go.work (or the module's go.mod), so toolchain go1.26.10 is the single source of truth. Alternatively, drop the claim that CI picks the pin up.

Reviewer Coverage

• automation:ci-release — complete (broad); skipped: none; constraints: Release workflows (release-cfl.yml, release-jtk.yml) delegate to a reusable workflow that is not in the checkout; its setup-go configuration was not inspected.
• go:implementation-tests — complete (broad); skipped: none; constraints: Did not run a build; reviewed the diff only. The repo has exactly three go.mod files plus go.work, all covered by this change.
• security:code-auditor — complete (broad); skipped: none; constraints: Could not independently verify that go1.26.10 contains the CVE-2026-111943 fix; relied on the PR description.

Inspected files (4)

• go.work
• shared/go.mod
• tools/cfl/go.mod
• tools/jtk/go.mod

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 3m 17s | ~$0.92 (est.) | claude-sonnet-5-5 | cr 0.10.325

Field	Value
Model	claude-sonnet-5-5
Reviewers	automation:ci-release, go:implementation-tests, security:code-auditor
Engine	claude_cli · claude-sonnet-5-5
Reviewed by	cr · monit-reviewer
Duration	3m 17s wall · 4m 50s compute
Cost	~$0.92 (est.)
Pricing basis	baseline-2026-10-02/pricing
Tokens	40 in / 6.0k out

Per-workstream usage

• orchestrator-selection — claude-sonnet-5-5
  • In: 6
  • Out: 1.2k
  • Cache read: 44.2k
  • Cache create: 36.7k
  • Cost: ~$0.17 (est.)
  • Duration: 16s
• automation:ci-release — claude-sonnet-5-5
  • In: 12
  • Out: 2.3k
  • Cache read: 144.9k
  • Cache create: 36.4k
  • Cost: ~$0.20 (est.)
  • Duration: 1m 26s
• go:implementation-tests — claude-sonnet-5-5
  • In: 8
  • Out: 1.0k
  • Cache read: 75.3k
  • Cache create: 33.4k
  • Cost: ~$0.16 (est.)
  • Duration: 59s
• security:code-auditor — claude-sonnet-5-5
  • In: 8
  • Out: 932
  • Cache read: 75.7k
  • Cache create: 33.6k
  • Cost: ~$0.16 (est.)
  • Duration: 1m 00s
• orchestrator-rollup — claude-sonnet-5-5
  • In: 6
  • Out: 501
  • Cache read: 97.7k
  • Cache create: 52.5k
  • Cost: ~$0.23 (est.)
  • Duration: 1m 08s