[Brad-Edwards]

Summary

Require Go verification, scan targets and coverage consumers to cover every declared module. Stage the approved branch-specific CodeQL replacement.

Requirement UIDs

• (none: the issue carries the requirement)

Related Issues

Closes #1858

ADR Impact

• ADR-121
• ADR-122

Changes

• Reconcile the Go matrix, OSV targets/reports, coverage artifacts and Sonar roots with the architecture inventory.
• Run the compiler per module with readonly dependencies, workspaces disabled and shared lint configuration.
• Test omitted modules/gates, unsafe configuration, clean CLI startup, missing reports and compiler cycles.
• Use scanned CI captures and exact replay for the temporary migration reference; Remove the parity corpus and migration harness after the Go cutover #1872 removes the harness after cutover.
• Score changed-line mutants only when production Go source changed, preserving thresholds and error propagation.
• Stage the CodeQL workflow from Stage branch-aware CodeQL scanning #1874/ci: stage branch-aware CodeQL scanning #1875 with narrowly scoped result uploads and distinct inactive check names.
• Refresh only the shared validator source binding in the proof manifest.
• Merge the completed Go architecture work from go-cutover, preserve its source changes and retain one coherent generated snapshot until CI produces the combined capture.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

The original module-verification head passed broad CI, exact replay of 45,305 files and Sonar with zero findings or hotspots. The latest workflow boundary passed 155 targeted tests and seven proof integrity cases. CI capture 13203386574 was validated and imported with 45,309 files, 19,744 tests and 18,136 inputs. After go-cutover advanced to 52979ff, the real merge passed 97 targeted inventory, workflow and mutation cases (one CI-only compiler case skipped locally), targeted Vale and mandatory hooks. Current-head CI must produce and replay a fresh combined-source capture. Default CodeQL remains active; the approved replacement is staged inactive pending reviewed upstream merges.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: Make Go verification and vulnerability scanning cover every modeled module #1858 module verification ← tools/check_go_module_inventory.py and .github/workflows/canonical-verification.yml, Make Go verification and vulnerability scanning cover every modeled module #1858 complete scan reports ← .github/workflows/ci.yml, Make Go verification and vulnerability scanning cover every modeled module #1858 CodeQL blocker repair ← .github/workflows/codeql.yml, tools/tooling_artifact_policy_actions.py and docs/develop/codeql.md
• TESTS: Make Go verification and vulnerability scanning cover every modeled module #1858 inventory, CLI and compiler cases ← implementations/python/tests/test_issue_1858_go_inventory.py, Make Go verification and vulnerability scanning cover every modeled module #1858 mutation applicability ← implementations/tooling/python/tests/test_go_mutation_gate.py, Make Go verification and vulnerability scanning cover every modeled module #1858 scan boundaries and workflow completeness ← test_release_workflows.py and test_issue_1313_workflow_policy.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.