Development record
The intake protocol's contained-review stage pins a container that cannot build the module. The S4 recipe pins golang:1.25 while go.mod declares a higher toolchain, and --network=none in the same line blocks the GOTOOLCHAIN auto rescue, so the one command the protocol hands a maintainer fails at the toolchain check and S5's build-or-INCONCLUSIVE tri-state misreads the stale pin as an inconclusive contribution. Drift, not born broken: the pin matched go.mod when written; the toolchain bump that advertised lockstep did not include this file, and the work tier sits outside every lint-configured tree. The recipe also lacks any module-cache provision, so even a corrected tag fails on dependency fetch under --network=none — the line has never worked as written. S4 is load-bearing: a recorded maintainer decision cites it as the mitigation that closed a review-agent exposure question. Acceptance: the pin tracks the module toolchain and the recipe provisions modules before the network is cut.
The intake protocol's contained-review stage pins a container that cannot build the module. The S4 recipe pins golang:1.25 while go.mod declares a higher toolchain, and --network=none in the same line blocks the GOTOOLCHAIN auto rescue, so the one command the protocol hands a maintainer fails at the toolchain check and S5's build-or-INCONCLUSIVE tri-state misreads the stale pin as an inconclusive contribution. Drift, not born broken: the pin matched go.mod when written; the toolchain bump that advertised lockstep did not include this file, and the work tier sits outside every lint-configured tree. The recipe also lacks any module-cache provision, so even a corrected tag fails on dependency fetch under --network=none — the line has never worked as written. S4 is load-bearing: a recorded maintainer decision cites it as the mitigation that closed a review-agent exposure question. Acceptance: the pin tracks the module toolchain and the recipe provisions modules before the network is cut.
Frontmatter
| id | iss-2608261533173466 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608261533173466-intake-s4-container-pin-below-module.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2608271702469341intake.md graduates to the durable record when the contribute-triage verb ships: .abcd/work/intake.md stays in the working tier today as the live S1-S6 external-contribution runbook (the 2026-08-27 structural review re-adjudicated its placement: live operating state, cited in force by [dcn-2608190000000002](../../decisions/dcn-2608190000000002-review-agents-keep-their-bash-grant.md) and filed-against by ledger records), but its own header declares it the script-first MVP rung that a future 'abcd contribute triage' verb absorbs. When that verb ships, the protocol content is no longer working state and the document's home moves up: promote the durable protocol description into .abcd/development/ (brief surface or discipline record) in a change that says why, leave or redirect the working-tier path for in-flight citers (iss-276 and resolved iss-2608261533173466 cite found_at .abcd/work/intake.md; [dcn-2608190000000002](../../decisions/dcn-2608190000000002-review-agents-keep-their-bash-grant.md) cites its S4 rule), and record the supersession of the highlight-not-inventory adjudication ([dcn-2608210000000001](../../decisions/dcn-2608210000000001-bug-hunt-round-4-branch-bughunt-b.md), [dcn-2608220000000001](../../decisions/dcn-2608220000000001-bug-hunt-round-7-branch-bughunt-b.md)) for this file. Trigger is the verb shipping, not a date.