[bborbe]

Bumps the golang bundle's default_golang_version from 1.27.2 to 1.27.3, matching the toolchain now shipped in claude-yolo v0.16.4 and dark-factory v0.198.11.

Verification: make precommit (bw test --ignore-missing-faults) exit 0.

The fleet apply (bw apply -o bundle:golang -i all) is a separate, operator-gated step — this PR only changes the pinned version.

[ben-s-pull-request-reviewer]

Review complete. Findings summary:

Must Fix (Critical): None.

Should Fix (Important):

• bundles/golang/items.py:5 — the bumped constant feeds a curl -Ls ... | tar -xz of the Go tarball with no SHA256/signature pin anywhere in the bundle (bundles/golang/metadata.py only installs curl). Pre-existing pattern, unchanged by this PR, so non-blocking.

Nice to Have (Optional): None.

Selector-mode traceability: Candidates 7 → Applicable 2 (git-commit/feature-branch-no-tag — no tag/release automation in .github/workflows, non-release chore commit; git-commit/imperative-mood — "bump" is imperative, no violation), Skipped 5 (python-architecture/constructor-injection-only, python-architecture/main-py-composition-root, python-logging/configure-once-in-main — declarative config dict, no DI/logging; go-security/resource-ownership, go-security/tenant-isolation — no Go source in scope). Mechanical funnel: 0 findings.

Notes: upstream tarball existence can't be validated from the sandbox (network denied), but the failure mode is loud — curl without -f pipes the 404 body into tar, which fails, so the bw action errors rather than silently installing nothing; the operator-gated bw apply is the verifier. The unless guard now demands go version go1.27.3 <os>/<arch>, so hosts on 1.27.2 correctly fail the check and re-install. No node pins a per-node golang version.

{
  "verdict": "approve",
  "summary": "The PR is a one-line, single-file default Go version bump (1.27.2 -> 1.27.3) in bundles/golang/items.py that matches the precedent of the five prior bump commits exactly, touches no other Go-version pin in the repo (the monit docker-golang-base-layer probe is version-agnostic by design), and is exercised by the green CI 'bw test' job; selector-mode traceability: 7 candidate rules, 2 applicable (git-commit/feature-branch-no-tag, git-commit/imperative-mood), 5 skipped, 0 mechanical findings, 0 blocking findings, with one non-blocking Should Fix noting the pre-existing absence of a checksum pin on the Go tarball download.",
  "comments": [
    {
      "file": "bundles/golang/items.py",
      "line": 5,
      "severity": "major",
      "blocking": false,
      "blocking_reason": "",
      "message": "Should Fix: the bumped default_golang_version feeds the `curl -Ls https://dl.google.com/go/go{version}.{os}-{arch}.tar.gz | tar -xz` install at bundles/golang/items.py:18, and no SHA256 checksum or signature is pinned anywhere in the bundle (bundles/golang/metadata.py only installs curl), so the 1.27.3 tarball is fetched and extracted without integrity verification. This is pre-existing debt (identical in the 1.27.0/1.27.1/1.27.2 bumps) and unchanged by this PR, so it does not block the merge — but a pinned checksum for the Go release would close the supply-chain gap for every future bump."
    }
  ],
  "concerns_addressed": [
    {
      "concern": "security: checksum/signature pinned alongside default_golang_version must be updated to matching1.27.3 values",
      "disposition": "not-an-issue",
      "detail": "Examined bundles/golang/items.py and bundles/golang/metadata.py: the bundle contains no checksum or signature mechanism at all (metadata.py only installs curl), so there is nothing to keep in sync. The absence of verification is pre-existing and not weakened by this bump; surfaced as a non-blocking Should Fix comment rather than a blocker."
    },
    {
      "concern": "correctness: upstream Go 1.27.3 exists and the version string is well formed",
      "disposition": "not-an-issue",
      "detail": "String is well formed ('1.27.3', matching the format of the prior 1.27.0/1.27.1/1.27.2 pins in the same file). Upstream tarball existence could not be checked from the sandbox (network access to dl.google.com denied); the verifier is the operator-gated fleet apply. Failure mode is loud, not silent: curl without -f pipes the 404 body into tar, which exits non-zero, so the bw action errors instead of installing nothing."
    },
    {
      "concern": "correctness: other files still pinning the Go version would now be inconsistent",
      "disposition": "not-an-issue",
      "detail": "Repo-wide grep for 1.2[567].x / golang_version / go-version / GO_VERSION found only bundles/golang/items.py:5 (the changed line), the version-agnostic comment in bundles/monit/files/docker-golang-base-layer:11, and the matching comment in nodes/hm.sun.py:29. No go.mod, Dockerfile, CI setup-go step, or node metadata pins a Go version. Prior bump commits 0c490be and ebd8bae changed the same single file, so the scope is deliberate."
    },
    {
      "concern": "correctness: bundle items converge to the new version on apply and no host pins/overrides the version per node",
      "disposition": "not-an-issue",
      "detail": "All node metadata blocks (nodes/hm.*.py, nodes/hz.*.py) set only 'enabled', 'arch', 'os' for golang — none sets 'version', so default_golang_version applies fleet-wide. The 'unless' guard at bundles/golang/items.py:23 now compares against 'go version go1.27.3 <os>/<arch>', so hosts running 1.27.2 fail the check and re-install on the next apply."
    },
    {
      "concern": "correctness: remaining items.py body still behaves for a patch-release bump",
      "disposition": "not-an-issue",
      "detail": "The download URL template (go{version}.{os}-{arch}.tar.gz), the strip-components=1 extraction, and the /opt/go ownership/mode (0755 root:root) are all version-agnostic; patch releases keep the same tarball layout, so no extraction change is required."
    },
    {
      "concern": "tests: CI actually exercises the golang bundle",
      "disposition": "not-an-issue",
      "detail": "Makefile 'test' target runs 'bw test --ignore-missing-faults', which compiles/evaluates the bundles (including bundles/golang/items.py) for the nodes with golang enabled; the CI workflow (.github/workflows/ci.yml) runs 'make test' on every PR and is green per the PR's checked statuses. The test validates bundle compilation, though it cannot validate upstream tarball existence — that is the fleet apply's job."
    },
    {
      "concern": "correctness: monit docker-golang-base-layer check must not treat the bundle as converged on nodes running the old Go version",
      "disposition": "not-an-issue",
      "detail": "Read bundles/monit/files/docker-golang-base-layer: the probe is explicitly version-agnostic (docker images --format '{{.Repository}}' | grep -c 'golang', exit 1 only when no golang image is present) and its comment states the pin moves and a version-pinned probe would go blind. It needs no change for this bump and does not assert Go version convergence; the version convergence signal is the bundle's own 'unless' guard."
    }
  ]
}