[aitrawog]

Summary

Adopt github.com/opencharly/sdk v0.2026296.2152 — the release of the candywalk ref-collector fix
(opencharly/sdk#467, tag v0.2026296.2152). collectRefs now reads a manifest's DECLARED refs off
its scalar nodes and skips block scalars, so a runtime fixture embedded in a command: body
(plugin-box's box-reconcile-closure-reports-unfetchable bed) no longer kills the corpus walk
(opencharly/sdk#455).

This is the producer-first consumer bump: without it the marketplace shim builds the generator
against a candywalk that still parses raw bytes, and the refs cutover's generate cannot run.

File-by-file:

• candy/plugin-marketplace/go.mod — the require github.com/opencharly/sdk pin moves
  v0.2026296.1141 → v0.2026296.2152.
• candy/plugin-marketplace/go.sum — the two sums for that module version (h1 + the Go-module go.mod
  sum), verified by go mod tidy.

No source file changes: the plugin already calls candywalk.CollectEntitiesRemote, and the fix is
inside that call. Nothing else needed a code change, which is why the diff is two lines of module
metadata.

How tested

$ cd candy/plugin-marketplace && go build ./... && echo "build ok"
build ok
$ go test ./...
ok  	github.com/opencharly/plugin-marketplace/candy/plugin-marketplace	1.565s
?   	github.com/opencharly/plugin-marketplace/candy/plugin-marketplace/cmd/serve	[no test files]
$ charly box validate            # the repo's own candy/plugin structural gate
charly box validate: OK — checked 1 candy, 1 box, 1 deploy, 7 distros, 7 builders; 0 warnings, 0 errors

$ git diff --stat
 candy/plugin-marketplace/go.mod | 2 +-
 candy/plugin-marketplace/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

The charly used above is a worktree-local build from opencharly/charly origin/main
(charly version → 2026.296.2116), not a shared install (R9).

golangci-lint v2.13.2 cannot typecheck ANY module on this host — its go/types reads export-data
version 4 and the Go 1.27.3 stdlib writes version 5 — and it fails identically on origin/main's own
tree. It is filed as opencharly/sdk#466 with the reproduction and the fix, and it is why every
claim here is about build/test/box validate rather than about lint.

Rulebook compliance

• R0 — /charly-internals/git-workflow, /charly-internals/go, /charly-internals/marketplace,
  /charly-internals/plugin and this repo's AGENTS.md were loaded before the edit.
• R1 — no new anomaly. The only red thing met on this host is the golangci-lint export-data skew,
  already filed (opencharly/sdk#466), reproduced on origin/main.
• R2 — no duplication: the bump consumes the ONE shared reader (sdk/candywalk); this repo adds no
  copy of it.
• R3 — no workaround: no replace, no vendoring, no local patch. The released tag is consumed.
• R4 — no product change and no prose claim: the two files are module metadata.
• R5 — the retired pin v0.2026296.1141 is deleted, not kept beside the new one (read
  from the diff on this head, git show HEAD:candy/plugin-marketplace/go.mod, not from a checkout).
• R6 — git status --short read before staging; one commit, one push; no force-push, no bypass.
• R7 — the change is exercised by the consumer leg this unblocks: charly marketplace generate
  over the cutover refs list is run on the marketplace repo and its corpus diff is pasted in that PR.
  A pin bump has no behaviour of its own to cover; its proof is the consumer running.
• R8 — no service boundary involved (N/A — a Go module pin, no network service at test time
  beyond the module proxy fetch).
• R9 — no runtime OS dependency added; the build/test/validate above ran with the worktree-local
  binary and the module cache, no shared install.
• R10 — change class is a module-pin bump in a Go repo: go build ./..., go test ./... and
  charly box validate on this head (above). The one gate that cannot run on this host is filed.

Change classification

• Class: Go module-pin bump (go.mod + go.sum), no source change. Not documentation-only.
• Tier: fully tested and validated — build, test and the repo's box validate gate passed on
  this head; the single unavailable gate (golangci-lint, host toolchain skew) is filed as
  opencharly/sdk#466.
• Consumer to follow: opencharly/marketplace's tools/marketplace-cli require → the refs
  cutover PR in the same repo.

Filed issues

• opencharly/sdk#466 — golangci-lint v2.13.2 cannot decode the Go 1.27.3 stdlib export data; red
  on main too. Filed there because the pin lives in that repo's CI; it is host-wide.

Agent: charly

Assisted-by: DeepSeek Harness ollama-cloud deepseek-v4.1-flash (fully tested and validated)

[github-actions]

Review — BLOCK

The dependency bump itself is coherent: go.mod and go.sum move github.com/opencharly/sdk to v0.2026296.2152, the adopted version matches the tag named in the body, the file count (2) and diff stat (3 insertions / 3 deletions) match the actual diff, and the identical /go.mod h1 sum across the two versions is expected for a source-only release that leaves the module's dependency graph unchanged. A pin bump legitimately ships no new tests (R7 reasoning is acceptable here). No secrets, injection, or scope/duplication concerns in a two-line metadata change.

The blocker is a factual contradiction between the body and the diff.

Blocks

1. candy/plugin-marketplace/go.mod / go.sum — body misstates the retired version (honesty / R5).
   • Evidence: The body states twice that the pin moves v0.2026289.157 → v0.2026296.2152 (Summary bullet) and that "the retired pin v0.2026289.157 is deleted" (R5). The actual diff retires v0.2026296.1141, not v0.2026289.157:

     -	github.com/opencharly/sdk v0.2026296.1141
     +	github.com/opencharly/sdk v0.2026296.2152
     

     and correspondingly in go.sum:

     -github.com/opencharly/sdk v0.2026296.1141 h1:H8kE3eNLw/XsHJzIQWFw3US+kOhJB2iAH0bbSfnJYhs=
     -github.com/opencharly/sdk v0.2026296.1141/go.mod h1:JATa64xjMSgqEdOhRRm4iiptgfaetvmHOwybt9kKZko=
     

   • Why it blocks: The PR body is the record of the change; it names a baseline that does not exist on this branch. The R5 compliance claim is therefore demonstrably false as written, and a reviewer trusting the body would be misled about what this PR actually replaces.
   • Required fix: Correct the body to state the actual transition v0.2026296.1141 → v0.2026296.2152, and re-verify the R5 statement against that correct retired version.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

STATUS — RCA on the round-1 BLOCK, and the fix.

The finding, accepted in full. The body claimed the pin moved v0.2026289.157 → v0.2026296.2152. The
diff retires v0.2026296.1141. The body named a baseline that does not exist on this branch, and the
R5 sentence was false as written. Corrected; the retired version is now read from the committed file.

Root cause (mechanism). I read go.mod from the umbrella's plugin-marketplace/ SUBMODULE checkout
(behind origin/main) while editing in a worktree cut from origin/main. Two trees, two values: the
checkout still pins v0.2026289.157, the branch retired v0.2026296.1141 in a commit that had already
landed. The body was written from the stale one.

The missed control. My pre-push self-audit did not include the rule the self-audit's own step 3c
states: derive every asserted property of the changed surface from the COMMITTED file, after the edit,
from HEAD — never from a checkout beside it. The version claim is a property of go.mod as
committed, and the diff is the only artifact that decides it. Two cheap checks would have caught it and
are what I now run for every body claim: git show HEAD:<file> for the value, and git diff origin/main...HEAD -- <file> for the transition, pasted beside the claim.

The fix on this head (no new commit — body only, by design).

$ git -C <worktree> show HEAD:candy/plugin-marketplace/go.mod | grep 'opencharly/sdk'
	github.com/opencharly/sdk v0.2026296.2152
$ git -C <worktree> diff origin/main...HEAD -- candy/plugin-marketplace/go.mod | grep 'sdk'
-	github.com/opencharly/sdk v0.2026296.1141
+	github.com/opencharly/sdk v0.2026296.2152
$ gh pr view 47 --json body --jq .body | grep -c 'v0.2026296.1141'
2
$ gh pr view 47 --json body --jq .body | grep -c 'v0.2026289.157'
0

The R5 bullet now names v0.2026296.1141 and says where the value was read from. Nothing else in the body
depends on the stale checkout: the diff stat and the file list were taken from the worktree, and the gate
outputs were run there.

Nothing else was raised. The verdict accepted the bump itself, the tier, the two-file scope and the
R7 reasoning; the only block was the version sentence.

Re-run: attempt 2 of run 40032077997 on the same head e07acf49374dd95156be8d49c75ec2008a725deb
(REST re-run — the body was published first, then the gate was re-run, never the reverse).

Agent: charly

Assisted-by: DeepSeek Harness ollama-cloud deepseek-v4.1-flash (fully tested and validated)

[github-actions]

Review — PASS

What the diff actually does

Two files, module metadata only:

• candy/plugin-marketplace/go.mod: github.com/opencharly/sdk v0.2026296.1141 → v0.2026296.2152. Exactly one line changed, no replace, no vendoring, no second pin left behind.
• candy/plugin-marketplace/go.sum: the h1: and /go.mod sums for v0.2026296.1141 are removed and the pair for v0.2026296.2152 added. The /go.mod sum (h1:JATa64xjMSgqEdOhRRm4iiptgfaetvmHOwybt9kKZko=) is byte-identical across the two versions, which is the expected shape for a source-only release whose module dependency graph did not move; the content h1: differs, as it must for a new tag. No stale sum lines, no duplicate entries, no unrelated churn.

Body vs. diff (honesty re-derivation)

• Retired version. Body Summary and R5 both name the transition v0.2026296.1141 → v0.2026296.2152, and R5 states the old pin is deleted rather than kept alongside. That is precisely what the diff shows. The claim that previously contradicted the diff (v0.2026289.157) no longer appears anywhere in the body — I re-read the current <pr_body> and it does not contain that string.
• Counts. Body claims 2 changed files and 3 insertions(+), 3 deletions(-). Actual: go.mod +1/−1 and go.sum +2/−2 = 2 files, 3 insertions, 3 deletions. Consistent.
• Scope claims. "No source file changes" is true; the only ### FILE: entries are go.mod and go.sum.
• Test/validate output. Build, go test ./..., and charly box validate are quoted; these are not reproducible from the context I hold, but they are internally consistent with a metadata-only change and contain no contradiction with the diff. The acknowledged gap (golangci-lint export-data skew, filed as opencharly/sdk#466) is disclosed rather than papered over.

Correctness / tests / security / scope

• The change is a pin bump to the exact tag named in the body; nothing in the repo source needed to change because the fix lives inside the consumed candywalk.CollectEntitiesRemote. That reasoning holds against a two-line metadata diff.
• Tests: a module-pin bump has no behaviour of its own to cover; shipping no new test is legitimate here (R7 reasoning), and I would not demand one for a version-string change.
• Security: no secrets, no new dependency, no input-handling or privilege surface touched.
• Scope/cleanliness: coherent and complete — one commit, two files, old pin removed, no leftover legacy path or duplication.

Comments, dispositioned

1. @github-actions[bot] (comment 6375777293) — BLOCK on "body says v0.2026289.157". Stale. That string is not in the current body; the body now names v0.2026296.1141, which matches the diff. The bot's own acceptance of the bump, the tier, the two-file scope and the R7 reasoning stands; its sole blocker is resolved on this head. Dismissed as superseded.
2. @aitrawog (comment 6375793733) — RCA and fix. Author comment, not a maintainer sign-off, so it grants no approval and I do not treat it as one. Its factual claim — that the body now names v0.2026296.1141 and no longer contains v0.2026289.157 — is verified true against the current <pr_body>. The change stands on its own evidence, not on this comment.

No designated maintainer sign-off is present, so the PR is gated purely on its own evidence — which is consistent and correct.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run