[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register.

Kind: bug (test hermeticity). Register ID: T66.

Problem

The CLI reads Go settings from the environment and from the Go env file:

• go_env reads the variable, else the GOENV file, else $XDG_CONFIG_HOME/go/env (L110-L116).
• The go crawler resolves the cache through GOMODCACHE and GOPATH (go_crawler.rs L186-L189).``
• Go apply and vex honor GOFLAGS=-modfile (Go apply, apply --check and vex ignore GOFLAGS=-modfile, so they report a patch as applied while go builds from another go.mod and links the unpatched module #1799), and vendor reads GOWORK.

The test scrub has an Extra for each other crawler that reads the environment (Venv, Bundle, Composer, Pdm, Poetry), but none for Go. CRAWLER_EXTRAS is [Venv, Bundle, Composer]. Every socket-patch child therefore inherits the developer's or runner's Go environment.

Consequences found while auditing:

• Two hosted-production tests can't fail. In e2e_hosted_production.rs:
  • golang_hosted_redirects_only_via_goproxy_override writes a go.mod with no require and no go.sum. The crawl therefore walks the ambient GOMODCACHE/$HOME/go, and on a clean runner only "scan exit 0" is asserted.
  • deno_hosted_is_unsupported installs nothing, so it gets 0 pins whether or not hosted Deno is supported.
• Process-wide env set and never restored.
  • e2e_golang_build.rs sets GOTOOLCHAIN with std::env::set_var and never restores it (L198). The binary has no serial_test, so sibling tests read the environment in parallel while it is set.
  • e2e_golang_hosted_build.rs sets GOTOOLCHAIN, GOFLAGS=-mod=mod and GONOSUMDB=* the same way (L376-L378).````` Its later CLI children and in-process discovery see these values depending on test order.
• Only GOMODCACHE is pinned. run_socket pins GOMODCACHE only, so an ambient GOFLAGS=-modfile=… or a user go/env file reaches apply/apply --check.

Proposed change

1. Add Extra::Go to hermetic.rs:
   • remove GOFLAGS, GOWORK, GOPATH and GOMODCACHE;
   • set GOENV=off.
2. Include Extra::Go in CRAWLER_EXTRAS. Tests that need a value set it after the scrub, as they already do.
3. Replace the process-wide set_var calls with per-Command .env(..) on the go and CLI children. Failing that, use a restoring guard under #[serial].
4. In e2e_hosted_production.rs:
   • Give the golang leg a require + go.sum and a fixture GOMODCACHE, and assert the pin or skip code.
   • Install a Deno tree and assert a hosted_skips code, or delete the test.

Size

3–4 test files. About +40/−30 lines.

Acceptance criteria

• With GOFLAGS=-modfile=/nonexistent and GOMODCACHE=/tmp/x exported in the parent shell, these suites still pass: e2e_golang, e2e_golang_build, e2e_golang_hosted_build and e2e_vendor_golang_build.
• A hermetic selftest shows that the Go variables don't reach the child.
• The two production tests fail when their claimed behavior is broken.