GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #391
Fixes #392
Fixes #509

Summary

Go keys a replace by module and version. When the build list
selects a different version, a replace pinned to the patched version is
silently ignored and the build links the unpatched module. Every Go path
used its own partial go.mod/go.sum heuristic to decide whether a version
is built, so each reported a patch as applied or attested when it wasn't:

Root cause and fix

There was no shared answer to "does the build list select M@v?". The new
vendor::go_build_list answers it offline from go.mod and go.sum, and every
call site above uses it:

• go ≥ 1.17 (pruned graph): require is authoritative. If the module
  is absent, it is built only if go.sum has its zip line.
• go < 1.17 (or no go directive): require holds only lower bounds
  and leaves out transitive modules. The selected version is the highest of
  the required version and the go.sum zip-line versions. A /go.mod
  line is written for every version MVS reads, so it doesn't count. With
  no evidence at or above the patched version (as after go mod tidy
  drops a directory-replaced original's lines), the answer is unknown and
  nothing is flagged, unless a zip line below the patched version shows
  that lower version is built.
• In workspace mode, "not in graph" degrades to unknown, because another
  member may require the module.

Docs: CLI_CONTRACT.md (golang agent section and the hosted rule) and
docs/ecosystems.md (Go).

Tests (red on main, green here)

Each new regression test was applied to unmodified origin/main and failed
there:

• Agent-mode Go apply writes a go-patches replace for a module version the build graph doesn't select, reports it applied, and on a go 1.16 go.mod apply --check and vex also report it as patched #392 golang_local::tests::test_apply_refuses_a_version_the_build_does_not_select: go 1.16 graph, go 1.21 require bump, and a module the project doesn't use. FAILED on main.
• Agent-mode Go apply writes a go-patches replace for a module version the build graph doesn't select, reports it applied, and on a go 1.16 go.mod apply --check and vex also report it as patched #392 golang_local::tests::test_verify_flags_go116_transitive_version_mismatch: apply --check in a go 1.16 graph. FAILED on main.
• Agent-mode Go apply writes a go-patches replace for a module version the build graph doesn't select, reports it applied, and on a go 1.16 go.mod apply --check and vex also report it as patched #392 (vendored) vendor::golang::tests::test_vendor_refuses_a_version_the_build_does_not_select. Added with the vendor gate.
• Hosted Go redirect's not_in_module_graph gate counts a go.sum /go.mod-only line as "in the graph", so on a go 1.16 module it writes an inert replace for an unselected version and VEX attests not_affected #509 redirect::tests::golang_go116_go_mod_only_line_is_not_the_selected_version. FAILED on main.
• Agent-mode Go vex attests not_affected after go get upgrades the patched module, although the go-patches replace no longer applies and the build links the unpatched code #391 covgap_commands_vex::go_patches_replace_for_an_unselected_version_is_not_attested: go 1.21 go get bump and the go 1.16 graph are omitted; the selected and unknown controls still attest. FAILED on main.
• Control: test_apply_go116_selected_version_still_applies, where the selected version applies and stays in sync after tidy. Passes on both.
• Unit tests for the helper itself (go_build_list::tests).

Commands run locally (Linux, go 1.24.7):

• cargo fmt --all -- --check: clean
• cargo clippy --locked --workspace --all-features -- -D warnings: clean
• cargo test -p socket-patch-core --all-features --lib -- go: 848 passed
• cargo test -p socket-patch-cli --all-features --lib: 913 passed
• CLI suites covgap_commands_vex, covgap_commands_rollback, e2e_golang, e2e_vex_vendor, in_process_vendor, e2e_golang_build, e2e_golang_hosted_build, e2e_golang_hosted_state, e2e_golang_workspace_build and e2e_vendor_golang_build (with --include-ignored, real go): all pass

The full cargo test --workspace couldn't finish locally because the session
ran out of disk, so CI's full matrix is the check for the rest.

tests/equivalence/golang_rewrite.golden was re-blessed. To show only the
warning wording changed, I restored the old not-in-graph message and checked
that the old golden still matched.

/code-review high findings not fixed

• Stale higher zip line in a go < 1.17 go.sum (a downgrade with no
  go mod tidy): this reads as "the build selects the higher version". It
  fails closed: apply refuses, vex omits, and hosted drops its own
  replace. go.mod and go.sum alone can't tell a stale line from a transitive
  requirement. go mod tidy clears it.
• apply fails rather than skips, and leaves an already-written inert
  replace in place: a failure is the right signal, because the patch isn't
  applied, and apply --check names the drift. Removing go.mod lines from a
  failing apply would be a larger behavior change.
• project_selection re-reads go.mod/go.sum per replace entry in
  apply --check and vex: there are a handful of entries per project, so
  I didn't add the extra plumbing.
• read_required_versions is no longer used outside tests: left in place
  to keep this PR scoped. Its tests and a discovery guard still reference it.
• The equivalence golden doesn't exercise go < 1.17: that path is covered
  by the targeted unit tests above instead.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DH6BEwGj8nVAeveDy6x5fc

Generated by Claude Code