[zzwong]

Add toolchain go1.26.10 to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add a crypto/x509 distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.

actions/setup-go uses the toolchain directive in preference to the go directive, so builds, tests and releases all pick it up. The go language version is unchanged.

Verification

GOTOOLCHAIN=go1.26.10 go build ./... passes for every module.

[monit-reviewer]

Automated PR Review

Reviewed commit: 5a708ccddc8d
Profile: claude-monit-reviewer - Posting as: monit-reviewer

Summary

Reviewer	Findings
automation:ci-release	0
go:implementation-tests	0
policies:conventions	0
security:code-auditor	0

Reviewer Coverage

• automation:ci-release — complete (broad); skipped: none; constraints: Release workflow delegates to open-cli-collective/.github release.yml@v1, which is not checked out; could not verify it honors the go.mod toolchain directive. Repo has a single go.mod; .github/workflows/test-chocolatey.yml hardcodes go-version '1.26' (pre-existing, test-only build, not changed by this diff).
• go:implementation-tests — complete (broad); skipped: none; constraints: Did not run go build; reviewed the go.mod diff only. The repo has a single go.mod and no go.work.
• policies:conventions — complete (broad); skipped: none; constraints: Only go.mod was assigned; workflows were checked read-only for how they select the Go version. Shared cli-common docs were not in context, so only repo-visible conventions were checked.
• security:code-auditor — complete (broad); skipped: none; constraints: Could not independently verify that go1.26.10 contains the claimed eMudhra distrust fix; relied on the PR description. The repo has a single go.mod.

Inspected files (1)

• go.mod

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 3m 51s | ~$0.74 (est.) | claude-sonnet-5-5 | cr 0.10.325

Field	Value
Model	claude-sonnet-5-5
Reviewers	automation:ci-release, go:implementation-tests, policies:conventions, security:code-auditor
Engine	claude_cli · claude-sonnet-5-5
Reviewed by	cr · monit-reviewer
Duration	3m 51s wall · 8m 07s compute
Cost	~$0.74 (est.)
Pricing basis	baseline-2026-10-02/pricing
Tokens	46 in / 6.3k out

Per-workstream usage

• orchestrator-selection — claude-sonnet-5-5
  • In: 4
  • Out: 872
  • Cache read: 28.8k
  • Cache create: 23.4k
  • Cost: ~$0.11 (est.)
  • Duration: 57s
• automation:ci-release — claude-sonnet-5-5
  • In: 12
  • Out: 2.0k
  • Cache read: 141.4k
  • Cache create: 34.8k
  • Cost: ~$0.19 (est.)
  • Duration: 1m 54s
• go:implementation-tests — claude-sonnet-5-5
  • In: 8
  • Out: 970
  • Cache read: 93.8k
  • Cache create: 20.2k
  • Cost: ~$0.11 (est.)
  • Duration: 1m 44s
• policies:conventions — claude-sonnet-5-5
  • In: 8
  • Out: 1.1k
  • Cache read: 72.8k
  • Cache create: 32.2k
  • Cost: ~$0.15 (est.)
  • Duration: 1m 32s
• security:code-auditor — claude-sonnet-5-5
  • In: 8
  • Out: 890
  • Cache read: 94.3k
  • Cache create: 20.4k
  • Cost: ~$0.11 (est.)
  • Duration: 1m 27s
• orchestrator-rollup — claude-sonnet-5-5
  • In: 6
  • Out: 427
  • Cache read: 118.0k
  • Cache create: 10.8k
  • Cost: ~$0.07 (est.)
  • Duration: 31s