[Mikola Lysenko (mikolalysenko)]

The pgx/v5 smoke test exposed local Go patches that could be attested while Go built vulnerable bytes from native vendor/, a missing warning in agent get, and rollback that stopped building after go mod tidy removed upstream checksums. Reapplying an intact agent patch after deleting the module cache also failed with package_not_installed. The production Go canaries passed without proving delivery.

Changes

• Verify the native vendor tree Go selects before VEX attestation and in apply --check / vendor --check. Cover workspace markers, quoted and double-hyphen GOFLAGS, unused replacements, package selection, ignored files, embedded assets, and dependency-only patches.
• Reuse an intact project-local agent copy after module-cache deletion, checking patch hashes, selected version, and replacement wiring. Refuse corrupt copies without deleting them or claiming success.
• Forward Go consumer synchronization warnings through nested agent operations.
• Save upstream checksum lines beside local artifacts and restore them on rollback. Refuse checksum conflicts while preserving the active replacement and copy, including orphan reconciliation. Preserve dry-run behavior and checksum backups across mode changes.
• Replace empty production canaries with the real github.com/jackc/pgx/v5@v5.7.0 patch d8941a4c-4bcd-4756-b0aa-239ec9c81b0f: require a delivery event and reject the malformed decoder input without a panic. Exercise get/scan, fresh caches, cache removal, same-version go get, go mod download/tidy/verify, consumer tests, repeated native vendoring, offline rollback after tidy, and explicit cold-cache agent failure followed by recovery. Hosted/vendored workspace tests also exercise go work sync and go work vendor when supported.

The cold-cache false applied result from the older smoke-test revision was already fixed on current main; this PR adds a live regression guard for the corrected failure behavior.

Validation

• Real production pgx patch: agent and vendored get/scan/workspace/native-vendor smoke cases passed, including fresh checkouts and rollback after tidy. Live reinstall canaries passed on macOS Go 1.24.13 and 1.26.3 and on Linux ARM64 as UID 1000 with Go 1.21.13, 1.24.13, and 1.26.3. Native-vendor tampering is rejected by audit and VEX in both modes.
• Controlled hosted pgx delivery passed with a local Go proxy using the real patched artifact, including fresh readonly builds, both file hashes, manifest-free VEX, and wrong-checksum rejection. This is not a production hosted pass.
• Go E2E suites passed on macOS ARM64 with Go 1.24.13 and 1.26.3 and Linux ARM64 as UID 1000 with Go 1.18.10, 1.21.13, 1.24.13, and 1.26.3 (109 checks per four-suite run; Go 1.18 uses compatible synthetic fixtures because pgx requires Go 1.21). The compatibility workflow is disabled in GitHub, and dispatch was refused; these are local runs, not GitHub compatibility-job passes.
• Focused core checks, formatting, and the CI-equivalent workspace/all-features Clippy command passed. The final macOS Go 1.26 run passed all 109 checks; the final core run passed 459 unit tests plus the matching integration checks.
• Draft PR checks are green on 5c4066702 (32 settled checks). Heavy draft-gated jobs were validated locally. Two high-effort Codex CLI reviews were run; confirmed findings were fixed and given regression coverage.

Rollout dependency

Companion backend PR: https://github.com/SocketDev/depscan/pull/28901

Keep this PR in draft until the backend is deployed and the existing legacy pgx patch is regenerated through the existing package-reset/admin workflow. The strict production hosted canary currently fails with redirect_golang_unsupported, because production has not published that patch's /v5 hosted module. It must pass before this PR is ready to merge; do not replace it with an empty-consumer success.

No production deployment or patch regeneration was performed. Existing checkouts created by older CLI releases without a checksum backup may still need go mod download <module>@<version> after rollback; newly patched checkouts restore their saved checksums offline.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: draft CI is green on 5c406670 (6 passed, 31 skipped/draft-gated; heavy jobs were validated locally per the description). I'm not marking this ready because the description says it must stay a draft until the backend companion SocketDev/depscan#28901 is deployed and the legacy pgx patch is regenerated, and the strict production hosted canary must pass first.

Question for a human: once depscan#28901 is deployed and the pgx /v5 hosted module is published, mark this ready for review (full CI will run then). Until that happens, the burn-down agent will leave this PR alone.

---

Generated by Claude Code