[zzwong]

Add toolchain go1.26.10 to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add a crypto/x509 distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.

actions/setup-go uses the toolchain directive in preference to the go directive, so builds, tests and releases all pick it up. The go language version is unchanged.

Verification

GOTOOLCHAIN=go1.26.10 go build ./... passes for every module.

[monit-reviewer]

Automated PR Review

Reviewed commit: f1716c609995
Profile: claude-monit-reviewer - Posting as: monit-reviewer

Summary

Reviewer	Findings
automation:ci-release	1
go:implementation-tests	0

automation:ci-release (1 finding)

Minor - go.mod:5

The new toolchain go1.26.10 directive only governs workflows that use go-version-file: go.mod (ci.yml, arch-package.yml). .github/workflows/release-build-check.yml:38 and .github/workflows/test-chocolatey.yml:23 still hard-code go-version: "1.26", so they do not read the toolchain directive and the PR's claim that setup-go picks it up for 'builds, tests and releases' does not hold for them. They install the latest 1.26.x, so they probably land on >=1.26.10 today. But release-build-check is the PR-time check of the release matrix and can drift from go.mod, and test-chocolatey builds nrq.exe from a different Go selection than go.mod. Fix: switch both to go-version-file: go.mod, matching ci.yml, so go.mod stays the single source of the Go version.

Reviewer Coverage

• automation:ci-release — complete (broad); skipped: none; constraints: Could not run builds; the PR's GOTOOLCHAIN=go1.26.10 build claim was not independently verified. release.yml delegates to the shared reusable workflow open-cli-collective/.github release.yml@v1, which is not checked out; its Go setup was not inspected.
• go:implementation-tests — complete (broad); skipped: none; constraints: Diff is a single toolchain directive in go.mod; did not run a build with GOTOOLCHAIN=go1.26.10.

Inspected files (1)

• go.mod

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 3m 54s | ~$0.54 (est.) | claude-sonnet-5-5 | cr 0.10.325

Field	Value
Model	claude-sonnet-5-5
Reviewers	automation:ci-release, go:implementation-tests
Engine	claude_cli · claude-sonnet-5-5
Reviewed by	cr · monit-reviewer
Duration	3m 54s wall · 5m 13s compute
Cost	~$0.54 (est.)
Pricing basis	baseline-2026-10-02/pricing
Tokens	32 in / 4.8k out

Per-workstream usage

• orchestrator-selection — claude-sonnet-5-5
  • In: 6
  • Out: 956
  • Cache read: 52.2k
  • Cache create: 35.3k
  • Cost: ~$0.16 (est.)
  • Duration: 53s
• automation:ci-release — claude-sonnet-5-5
  • In: 12
  • Out: 2.4k
  • Cache read: 159.8k
  • Cache create: 22.7k
  • Cost: ~$0.15 (est.)
  • Duration: 1m 52s
• go:implementation-tests — claude-sonnet-5-5
  • In: 8
  • Out: 910
  • Cache read: 74.4k
  • Cache create: 32.7k
  • Cost: ~$0.15 (est.)
  • Duration: 1m 54s
• orchestrator-rollup — claude-sonnet-5-5
  • In: 6
  • Out: 507
  • Cache read: 118.0k
  • Cache create: 10.9k
  • Cost: ~$0.07 (est.)
  • Duration: 33s