[steipete]

Move the macOS test and release-build jobs to xcode-27, and update the repository-local shared release caller to the current immutable v1 pin with an explicit dry_run input. The shared workflow performs native arm64 and Rosetta x86_64 verification; local snapshot CI now also asserts/installs Rosetta and executes the Intel binary.

Use Go 1.27.2 for CI, tests, Docker, and release builds to fix the nine reachable standard-library vulnerabilities found with Go 1.26.8. Go 1.27 requires macOS 13, so this change explicitly raises the supported macOS minimum from 12 to 13, as approved by the maintainer. Update the README, release guide, GoReleaser deployment target, and all-slice minimum-OS gate/tests together. The Go source directive remains 1.25.0, and no version, tag, or release is created by this PR.

Keep the required status context test (macos-latest) on the real macOS test job while running it on xcode-27. This preserves the existing branch-protection contract without changing repository security settings.

The race-enabled validation also reproduced a watch-test timing failure: cancelling 10 ms after the server writes can happen before the client prints. Cancel from the output writer instead, with a bounded deadline; application behavior is unchanged.

Validation: Go 1.27.2 tests and race tests, 50 race-enabled repetitions of each watch cancellation test, tidy check, lint, and govulncheck on Crabbox; local GoReleaser snapshot with all six targets, both Darwin binaries verified at minos 13.0 and smoke-tested natively/under Rosetta; four target-gate tests; actionlint; independent Codex review with no actionable P0–P2 findings. After merge, verify main CI and dispatch the release workflow with the unchanged current version and dry_run=true only.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-19T11:00:17.443593Z	fea24a7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR adopts Go 1.27.2 and Xcode 27 runners, raises the macOS minimum to 13, adds release dry runs and Rosetta checks, and stabilizes watch cancellation tests.

Example: A user downloads the next macOS release on macOS 12 Monterey.

• Before: The Go 1.26.8 release binary supports macOS 12.
• After: The Go 1.27.2 release binary requires macOS 13 Ventura, as documented in the breaking-change note.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is coherent and has no actionable finding; supporting CI is strong, while inspectable runtime evidence for the full release rehearsal remains limited.
Proof confidence	🦐 gold shrimp (3/6)	This OWNER-authored maintenance PR is outside the ordinary contributor proof gate; its body reports native and Rosetta snapshot execution, and exact-head Actions step results corroborate those paths, but blocked log retrieval prevents inspecting their output and the shared release rehearsal remains post-merge.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Release builds need the selected patched Go toolchain and current macOS infrastructure, with explicit notice that future binaries require macOS 13.
Reason: The repository owner approved the platform-floor change, and the patch coordinates build settings, verification, documentation, and a non-publishing release path.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the owner-approved toolchain and macOS migration remains absent from main, and review found no actionable introduced defect.

Priority: P2
Reviewed head: fea24a7cfa94bff0fdbc1afa4a1fa37b2f38db1a

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The shared release caller's signing and non-publishing dry run is scheduled for merged main; no runtime trace of that scenario was supplied.

Agent review details

How this fits together

GitHub Actions reads the Go toolchain and GoReleaser configuration to build platform binaries; the shared release workflow signs, verifies, and publishes those artifacts unless dry-run mode suppresses publication.

flowchart TD
  A[Repository source and Go toolchain] --> B[Xcode 27 CI]
  B --> C[GoReleaser platform binaries]
  C --> D[macOS deployment target gate]
  D --> E[Native and Rosetta smoke checks]
  A --> F[Shared release workflow]
  F --> G[Signed and verified artifacts]
  G --> H[Publication unless dry run]

Loading

Technical review

Best possible solution:

Land the consistent owner-approved migration after required checks pass, then perform the documented non-publishing release rehearsal on main.

Do we have a high-confidence way to reproduce the issue?

This is an intentional infrastructure migration; source confirms the existing toolchain and runner settings, while the claimed nine vulnerabilities and watch timing failure were not independently reproduced.

Is this the best way to solve the issue?

The patch updates the existing build and release owners consistently, uses the shared workflow's established dry-run contract, and replaces timing-dependent test cancellation with cancellation after observed output.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4752fb36bd43.

Provenance checked

• macOS deployment target and release pipeline changes intended behavior with a stated reason (dbe6571: Provide signed and notarized downloads while enforcing macOS 12 compatibility and immutable artifact verification.)
• Preferred Go toolchain and Docker builder changes intended behavior with a stated reason (7f32599: Refresh Go patches while retaining macOS 12; the current owner-authored PR explicitly accepts macOS 13 to adopt Go 1.27.2.)
• Watch cancellation tests keeps the original intent (c2a402c: Increase app command coverage; the patch preserves output and cancellation assertions while removing a reported scheduling race.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Pinned change and current-main boundary: The verified base-to-head diff contains the migration; main still uses Go 1.26.8, macOS 12 deployment targets, and the previous release-workflow pin. (go.mod:5, fea24a7cfa94)
• Explicit owner decision: The OWNER-authored PR explicitly accepts raising the macOS minimum to 13 to adopt Go 1.27.2; CHANGELOG.md, README.md, release documentation, GoReleaser, and the all-slice gate consistently record that decision. (CHANGELOG.md:5, fea24a7cfa94)
• Exact-head supporting validation: Push run 39241454997 succeeded at the reviewed head; release-build job 118023014695 ran on xcode-27 and passed the deployment gate, snapshot build, native smoke check, and Intel Rosetta smoke check. A separate pull-request run still has macOS jobs pending. Job logs redirect to a host blocked by the review network, so their runtime output was not inspected. (.github/workflows/ci.yml:60, fea24a7cfa94)
• Executed dependency contract: The caller directly executes this pinned dependency. Its Go workflow accepts the boolean dry-run input, uses xcode-27, rejects dispatches outside protected main, returns before tag creation during dry runs, skips draft creation and publication, and prevents Homebrew handoff without successful publication. The dependency tree contains no AGENTS.md. (.github/workflows/release-go-cli.yml:10, fc49859568b3)
• Feature history and prior intent: Peter Steinberger carried the toolchain updates and introduced the signed-release pipeline in fix(release): sign and notarize macOS downloads #9; chore(deps): refresh Go patch and build tooling #8 deliberately retained macOS 12. This PR explicitly revises that compatibility decision. Earlier CI follow-history encounters an unavailable old blob; the relevant release and toolchain commits remain readable. (.github/workflows/ci.yml:59, dbe6571e4a1e)
• Repository review policy: The complete root AGENTS.md was read at both revisions; no nested AGENTS.md, maintainer notes, or pr-simplify skill exists in the checkout. The notes concern discovery and prior art and impose no additional constraint on this migration. (AGENTS.md:1, 4752fb36bd43)

Likely related people:

• Peter Steinberger: Raw commit dbe6571 adds .github/workflows/ci.yml:59 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: dbe6571e4a1e; files: .github/workflows/ci.yml)

Labels

Label changes:

• add P2: This is a bounded build and release migration with successful exact-head supporting validation and no demonstrated urgent runtime failure.
• add merge-risk: 🚨 compatibility: Future macOS binaries stop supporting macOS 12; the owner explicitly accepted this tradeoff and documented it as breaking.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is a bounded build and release migration with successful exact-head supporting validation and no demonstrated urgent runtime failure.
• merge-risk: 🚨 compatibility: Future macOS binaries stop supporting macOS 12; the owner explicitly accepted this tradeoff and documented it as breaking.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 7:12 AM ET / 11:12 UTC.