[devantler]

🤖 Generated by the Agentic Engineer

Why

The prepared reports-controller image needs updated runtime dependencies before it can safely support controller recovery. Its executable must also retain enough information for a precise security audit.

What

Prepares a tested, auditable replacement under the current platform quality and security checks. Publication, independent verification and production adoption remain separate delivery gates.

Part of #5545

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T00:22:18.408874Z	efccec1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: efccec172b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

At 91ed369cb9435d8babc63f48369a1a2ba49ddb42, both builds fetch and verify the actual release tag against the pinned source before patching. The compiled executable must retain VCS metadata and independently report that release and revision; no version is injected into Go's module metadata.

An isolated Linux cross-build with a real Git checkout now records v1.19.2+dirty. Its unmodified executable scan still refuses three public advisory records with unresolved version boundaries. The draft remains blocked; this is improved evidence, not vulnerability clearance. The new publisher guard, shellcheck and actionlint pass locally. Hadolint is unavailable locally; native validation remains required.

[devantler]

🤖 Generated by the Agentic Engineer

Two narrowly scoped corrections to the existing public advisory records are prepared and pass the vulnerability database's complete test suite. The remaining record still needs the source project's fixed-version clarification; the proposal deliberately leaves it unchanged.

This is preparation, not published database clearance. #5546 remains Draft with the current native security failure intact, and the runtime must not be adopted until the upstream data and executable acceptance gates are satisfied. The upstream tracking issue remains golang/vulndb#6886.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: golang/vulndb#6886 | upstream | last-verified 2026-11-09: The Go advisory issue remains open. Gerrit changes 858342 and 862062 are under review and cover two of the three reports. The published Go vulnerability database still has no fixed boundary for the three reports tracked here. Verify reports controller remains red. Resume after the official advisory data changes, then rerun the source and executable audits and collect current-head CI, review and user-path evidence.

[devantler]

🤖 Generated by the Agentic Engineer

Updated signed head a79aedc7b5ba6f39e1c0e36d90ba2757154d65f4 incorporates reviewed main 3434f9f413a622f386b8ea4e4ef73d8640710fbc. This is maintenance of the existing draft; it does not claim publication or runtime recovery.

• The builder now pins the independently verified official Go 1.27.3 image. The candidate executable no longer reports GO-2026-6809.
• Main’s existing patch-based lint policy is retained, with the changed production packages and local credential module included through a temporary workspace. Formatting was applied to the actual source and the patch regenerated mechanically. Independent reapplication reproduces source tree bb6b1b1c14b27fe1c752ca001555907590011d67 at the pinned upstream release.
• Both native race-test groups pass with the existing 900s/300s limits: 119.921s and 130.073s. The matched Go 1.27.3/linter 2.15.0 run reports zero issues. Module verification, the unsafe-OpenPGP refusal, Linux cross-build and truthful executable metadata, publisher regression, ShellCheck and publisher-workflow actionlint pass.
• The matched govulncheck 1.8.0 source audit exits 0. The actual executable audit still exits 3 for GO-2026-5594, GO-2026-5337 and GO-2025-3615. The upstream record review remains unresolved; no advisory is suppressed or accepted as cleared.
• Local limits remain explicit: Docker is unavailable, so the final Linux runtime-container help check is unverified. Whole-CI actionlint still reports the same two unsupported queue-key diagnostics as reviewed main with the latest available actionlint 1.7.12; the publisher workflow itself passes.

The security gate remains enforced and this PR stays draft. Image publication, independent artifact verification and production adoption remain outstanding.