fix(ci): upgrade Go and network security baseline

.github/workflows/ci.yml

@@ -37,10 +37,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Test CI helpers
@@ -70,10 +70,10 @@ jobs:
           # Protocol and Surface history are compared with the exact PR/push
           # baseline. The first Surface registry PR is its explicit bootstrap.
           fetch-depth: 0
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Report Go toolchain
@@ -135,10 +135,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Race-check Workspace Access permission and authority fencing
@@ -155,10 +155,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Install pinned govulncheck
@@ -183,10 +183,10 @@ jobs:
         shard: [0, 1, 2, 3, 4, 5, 6, 7]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Run exact Store shard
@@ -241,10 +241,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -305,10 +305,10 @@ jobs:
       - run: npm run check:api
       - run: npm test
       - run: npm run build
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Verify Go bundle loader and embedded production UI bundle
@@ -338,10 +338,10 @@ jobs:
         working-directory: analyzers
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Report Go toolchain
@@ -414,10 +414,10 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Report Go toolchain
@@ -465,11 +465,11 @@ jobs:
       TRAVERSE_BOARD_LOCAL_SANDBOX_TEST_HOST_PREP: '1'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         id: windows-go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Report Go toolchain
@@ -480,6 +480,7 @@ jobs:
           TRAVERSE_CI_GO_VERSION: ${{ steps.windows-go.outputs.go-version }}
         run: |
           ./scripts/tests/prepare-windows-fixed-go.tests.ps1
+          ./scripts/tests/desktop-toolchain.tests.ps1
           ./scripts/prepare-windows-fixed-go.ps1 -ExpectedGoVersion $env:TRAVERSE_CI_GO_VERSION
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -561,10 +562,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Set up current Go 1.25 patch
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.x'
+          go-version-file: go.mod
           check-latest: true
           cache: true
       - name: Verify Local Sandbox on the Windows 2022 compatibility host

.github/workflows/release-desktop.yml

@@ -191,10 +191,10 @@ jobs:
             throw "The exact release revision has no successful full central CI; run CI manually for this revision before releasing"
           }
 
-      - name: Set up pinned Go 1.25.12
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.12'
+          go-version-file: go.mod
           cache: true
 
       - name: Set up pinned Node 24.16.0
@@ -251,10 +251,10 @@ jobs:
         run: |
           echo 'Stable macOS publication requires Developer ID signing, notarization and final-package manual acceptance; this pipeline currently produces previews only.' >&2
           exit 1
-      - name: Set up pinned Go 1.25.12
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.12'
+          go-version-file: go.mod
           cache: true
       - name: Set up pinned Node 24.16.0
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -316,10 +316,10 @@ jobs:
             throw "Windows source differs from shared release revision"
           }
 
-      - name: Set up pinned Go 1.25.12
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.12'
+          go-version-file: go.mod
           cache: true
 
       - name: Set up pinned Node 24.16.0
@@ -738,10 +738,10 @@ jobs:
             --dir build/desktop
           if ($LASTEXITCODE -ne 0) { throw "Exact Windows candidate download failed" }
 
-      - name: Set up pinned Go 1.25.12
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.12'
+          go-version-file: go.mod
           cache: true
 
       - name: Reverify downloaded Windows candidate
@@ -1065,10 +1065,10 @@ jobs:
             --dir build/store
           if ($LASTEXITCODE -ne 0) { throw "Exact Partner Center artifact download failed" }
 
-      - name: Set up pinned Go 1.25.12
+      - name: Set up repository-pinned Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25.12'
+          go-version-file: go.mod
           cache: true
 
       - name: Reverify downloaded candidate

CONTRIBUTING.md

@@ -16,12 +16,15 @@ Thank you for contributing to Universal Code. Resumability, auditability, and fa
 
 | 工具 | 版本 | 来源与用途 |
 |---|---:|---|
-| Go | 1.25 | [`go.mod`](go.mod)；唯一控制平面、CLI、TUI、HTTP API 与持久化 |
+| Go | 1.26.9 | [`go.mod`](go.mod)；唯一控制平面、CLI、TUI、HTTP API 与持久化 |
 | Node.js | 24 | [CI](.github/workflows/ci.yml)；`web/` 下的 React/Vite 控制台 |
 | Rust | 1.97.1 | [`analyzers/rust-toolchain.toml`](analyzers/rust-toolchain.toml)；确定性 Analyzer 夹具 |
 
 Git 需要 2.41+；修改 Analyzer 时另需 rustup。普通 Go/Web 开发不要求 Docker、真实 Provider 或 API key；未配置外部模型时使用 Mock Provider。`configs/models.yaml` 是无秘密的示例，不是运行时配置源。
 
+Go 构建使用 `go.mod` 中的精确补丁版本；本机安装其他版本时，设置
+`GOTOOLCHAIN=go1.26.9`。较新的 Go 发布分支也可能尚未修复同一漏洞，不能只按版本大小判断安全性。
+
 首次检出后，按你要修改的表面准备依赖：
 
 ```bash
@@ -40,7 +43,7 @@ rustup target add wasm32-wasip1 --toolchain 1.97.1
 
 ### Windows Desktop
 
-桌面开发和便携构建必须在 Windows 10/11 上进行，并安装 Microsoft Edge WebView2 Evergreen Runtime `94.0.992.31` 或更新版本。还需要上表中的 Go 1.25、Node.js 24 和 PowerShell；Rust 只在修改或完整验证 Analyzer 路径时需要。应用会在打开 SQLite 前检查 WebView2，缺失或过旧时失败关闭，不会自行下载或安装。
+桌面开发和便携构建必须在 Windows 10/11 上进行，并安装 Microsoft Edge WebView2 Evergreen Runtime `94.0.992.31` 或更新版本。还需要上表中的 Go 1.26.9、Node.js 24 和 PowerShell；Rust 只在修改或完整验证 Analyzer 路径时需要。应用会在打开 SQLite 前检查 WebView2，缺失或过旧时失败关闭，不会自行下载或安装。
 
 ```powershell
 # 在仓库根目录构建未签名的本地测试包
@@ -54,7 +57,7 @@ rustup target add wasm32-wasip1 --toolchain 1.97.1
 
 ### macOS Desktop
 
-macOS 便携构建需要 macOS 11+（Big Sur）与 Xcode 命令行工具（codesign），以及上表中的 Go 1.25、Node.js 24；WKWebView 随系统提供，不需要 WebView2 式预检。前端测试环境固定在 Node.js 24 基线：本地 Node 版本不符时脚本会在前端检查前明确报错（可用 `nvm use 24` 切换，或 `-SkipFrontend` 跳过已构建好的 web/dist）。
+macOS 便携构建需要 macOS 12+（Monterey）与 Xcode 命令行工具（codesign），以及上表中的 Go 1.26.9、Node.js 24；WKWebView 随系统提供，不需要 WebView2 式预检。前端测试环境固定在 Node.js 24 基线：本地 Node 版本不符时脚本会在前端检查前明确报错（可用 `nvm use 24` 切换，或 `-SkipFrontend` 跳过已构建好的 web/dist）。
 
 ```bash
 # 在仓库根目录构建未签名、ad-hoc 签名的本地测试包

cmd/cyberagent-desktop/main_darwin.go

@@ -24,7 +24,7 @@ func trustedDesktopRendererHost() string {
 }
 
 // checkDesktopPrerequisites returns nil on macOS: WKWebView ships with every
-// supported macOS release (the Go 1.25 toolchain requires macOS 11 Big Sur or
+// supported macOS release (the Go 1.26 toolchain requires macOS 12 Monterey or
 // newer), so the Desktop never probes, downloads, or installs a web runtime.
 func checkDesktopPrerequisites() error {
 	return nil

docs/DESKTOP_PLAN.md

@@ -83,7 +83,7 @@ macOS 本地构建（D0-Mac）：
 open build/desktop/Prayu.app
 ```
 
-输出为 `build/desktop/Prayu.app` 与同目录启动器/指南，默认不开放 control token；需要 Xcode 命令行工具（codesign）与 `CGO_ENABLED=1`。产物只有 ad-hoc 签名、未公证，是开发/便携测试包，不是正式发行包。macOS 11+（Big Sur）自带 WKWebView，构建不做 WebView2 式运行时预检；启动失败只写入 stderr 并显示有界 osascript 对话框。工作区启动器只通过固定 `/usr/bin/open` 打开已验证的 .app（Finder、Terminal、Antigravity、PyCharm、WebStorm、Visual Studio Code）。系统凭证库仍未接入；用户终端默认关闭，显式启用后使用 Bash PTY，受限浏览器与完整 CDP 继续失败关闭，凭证请使用环境变量。自动检查通过后 `release_ready` 仍为 false，直到签名、公证、PTY 实机行为与人工 macOS 矩阵完成。
+输出为 `build/desktop/Prayu.app` 与同目录启动器/指南，默认不开放 control token；需要 Xcode 命令行工具（codesign）与 `CGO_ENABLED=1`。产物只有 ad-hoc 签名、未公证，是开发/便携测试包，不是正式发行包。macOS 12+（Monterey）自带 WKWebView，构建不做 WebView2 式运行时预检；启动失败只写入 stderr 并显示有界 osascript 对话框。工作区启动器只通过固定 `/usr/bin/open` 打开已验证的 .app（Finder、Terminal、Antigravity、PyCharm、WebStorm、Visual Studio Code）。系统凭证库仍未接入；用户终端默认关闭，显式启用后使用 Bash PTY，受限浏览器与完整 CDP 继续失败关闭，凭证请使用环境变量。自动检查通过后 `release_ready` 仍为 false，直到签名、公证、PTY 实机行为与人工 macOS 矩阵完成。
 
 显式启用受控 Run 创建：
 
@@ -364,7 +364,7 @@ capability grant 为 false。开关只作用于 Traverse 管理的隔离内置
 ## 发布门禁
 
 - Windows 自动化覆盖启动前置条件、关闭/恢复、同库续传和 renderer 边界；Windows 11 x64 已实机验证，Windows 10 x64 仍是正式发行前必过矩阵。
-- macOS 自动化覆盖 desktop-tag 测试、Mach-O/codesign 兼容检查和双构建可复现性；签名、公证与 macOS 11+/Retina 实机矩阵是正式发行前必过项，`release_ready` 保持 false。
+- macOS 自动化覆盖 desktop-tag 测试、Mach-O/codesign 兼容检查和双构建可复现性；签名、公证与 macOS 12+/Retina 实机矩阵是正式发行前必过项，`release_ready` 保持 false。
 - 渲染进程无法绕过 Go API 访问 Shell、Docker、密钥或工作区外文件。
 - CLI 与 Desktop 同时运行时，SQLite 不损坏、operation 重放不分叉、Run lease 不被窗口生命周期或 Run 创建偷取。
 - 安装、升级和卸载不会静默删除 Workspace、数据库、凭证或用户创建文件。

docs/PROJECT_MEMORY.md

@@ -1,5 +1,13 @@
 # Prayu Project Memory
 
+> 2026-10-09 Go security baseline (#289): Go 1.26.9 is the minimum compiler;
+> CI and release builders read the exact version from go.mod. Local desktop
+> builders require that same patched compiler. The x/net
+> dependency includes the October HTTP/2 fixes. Native macOS packaging now
+> declares and verifies macOS 12, matching the compiler's actual support floor.
+> The nightly full matrix and blocking vulnerability audit remain enabled;
+> see [CI security baseline](ci.md#go-security-baseline) for scan evidence limits.
+
 > 2026-10-07 extension onboarding checkpoint (#276): shared Web/Desktop settings
 > stage manual MCP descriptors, import pinned Plugin ZIPs and stage/review LSP
 > configuration through Go-owned services. Backend capability flags, source/scope,

docs/ci.md

@@ -28,6 +28,34 @@ An unreadable or empty change set fails selection. Failed selection, a failed
 required job, cancellation, or an unexpected required-job skip cannot become a
 successful aggregate result. Unclassified build inputs select full checks.
 
+## Go security baseline
+
+The supported build toolchain is Go **1.26.9**, pinned by `go.mod`. Both central
+CI and release builders read that exact version with `go-version-file`.
+This avoids selecting an older patch while the setup-go version catalog lags
+behind a new Go security release. Local desktop builders require the same
+version; set `GOTOOLCHAIN=go1.26.9` when another Go toolchain is installed.
+The module's minimum version alone cannot exclude vulnerable newer release
+branches, such as Go 1.27.0 and 1.27.1; a larger version is not security evidence.
+The Windows fixed-toolchain fixture must match the exact version selected by
+`setup-go` and retains its official archive and executable hash checks.
+Update the module pin and fixture guard together when moving to another
+supported Go release, then rerun the full matrix and current vulnerability audit.
+
+`govulncheck` uses the current Go vulnerability database. A successful scan is
+evidence for its recorded toolchain, source revision and database timestamp;
+newly published advisories can make a later scan of the same commit fail.
+Affected-check PR runs may skip the Go audit, while nightly and manual full
+runs always select it. Check the job selection and scan log before treating a
+green PR as current full security evidence.
+
+The 2026-10-08 database update exposed the retired Go 1.25 baseline in the
+2026-10-09 nightly run ([#289](https://github.com/CWNU-Open-Source-Community/Universal-Code/issues/289)).
+The repair upgrades Go and `golang.org/x/net` without suppressing advisories or
+changing the schedule. Go 1.26 requires macOS 12+, so native build flags, bundle
+metadata and package verification use that same minimum; the earlier macOS 11
+declaration was already inconsistent with Go 1.25's supported platforms.
+
 ## Go impact selection
 
 `scripts/ci/run_go_checks.py` uses `go list -json ./...` to identify package

docs/mac-keychain.md

@@ -22,4 +22,4 @@ TRAVERSE_TEST_KEYCHAIN=1 CGO_ENABLED=1 go test -tags=keychainintegration -count=
 
 ## 仍需实际应用验收
 
-隔离 CRUD 不能证明实际 `.app` 的登录会话、ACL 和授权提示体验。使用独立 Mac 测试用户/可销毁环境，验证首次配置、替换、删除、退出重开、锁定后恢复、手动取消、同版本重启和不同 ad-hoc 构建升级。锁定/取消的真实系统对话框不在上述无人值守测试中伪造通过。记录准确的应用提交、OS、架构和二进制身份；Mac 15 runner 通过不能证明 macOS 11 或正式发行已就绪。
+隔离 CRUD 不能证明实际 `.app` 的登录会话、ACL 和授权提示体验。使用独立 Mac 测试用户/可销毁环境，验证首次配置、替换、删除、退出重开、锁定后恢复、手动取消、同版本重启和不同 ad-hoc 构建升级。锁定/取消的真实系统对话框不在上述无人值守测试中伪造通过。记录准确的应用提交、OS、架构和二进制身份；Mac 15 runner 通过不能证明 macOS 12 或正式发行已就绪。

docs/macos-release.md

@@ -35,7 +35,7 @@ bash scripts/release-desktop-darwin.sh v1.0.0-rc.1 "$(git rev-parse HEAD)" "$(go
 流水线固定 `macos-15` ARM64 与 `macos-15-intel` Intel runner；检查原生 CPU、Go target、
 Mach-O CPU 三者一致。构建两次比较二进制，再 ad-hoc 签名。`CFBundleVersion` 和
 `CFBundleShortVersionString` 使用数字版本，完整预发布名称保留在 build metadata。
-最低构建目标为 macOS 11；不代表已在所有 macOS 11+ 真机上通过验收。
+最低构建目标为 macOS 12；不代表已在所有 macOS 12+ 真机上通过验收。
 
 产物位于 `build/macos-public`。ZIP 包含完整应用、指南、兼容入口、元数据、兼容报告、
 SBOM、NOTICE 与 LICENSE。`ditto` 保留 POSIX 权限；新目录解压后再次核对全部文件、