[vt128]

CLI packaging fails its security gate on older net/http and x/net versions. SQLite custom callbacks also execute outside the normal Machine step budget and need an explicit trusted-script grant.

Use Go 1.27.4 for production builds, adopt x/net 0.62 and the reviewed crypto fix with their required x/* dependencies, and require --dangerously-allow-all for SQLite custom callbacks. Normal SQL remains available under ordinary capability grants. Source builds of the CLI, kit consumers and examples require Go 1.26.0.

The candidate passed main/examples build, full race tests, vet, source and native binary vulnerability scans against the current official database, and a Go 1.27.4 coverage comparison with no lost covered blocks (797/881 statements). Actual macOS arm64 install, upgrade, rollback, e2e and PTY tests passed. This commit retains the tested application, tests, module and workflow content, with a one-line README correction for the production compiler version. The new commit must complete the six-platform artifact and installation checks before merge.

Consolidates the changes reviewed in #40 and #41. The documented Go 1.26.0 compatibility scope has been approved for CLI, kit and examples.

Additional validation completed on this exact application/module source: the hello and qrcard Go shells build and run correctly under both the minimum Go 1.26.0 (Linux amd64) and production Go 1.27.4 (macOS arm64), selecting the unchanged core module pins. Their normalized output bytes match.

One bounded same-Go-1.27.4 comparison against #41 measured a small positive process-time cost for the complete security candidate (two scripts, paired medians about +2.7% and +5.7%). The module-floor change also changes Go compatibility defaults, and the host was loaded; these observations do not isolate any dependency or establish a universal slowdown. The full observations are retained. This scoped cost is accepted under the safety-first direction; no extra sampling or special-case optimization is added. Functional, coverage, compatibility and all six native installation gates still apply.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.01%. Comparing base (a6877c3) to head (b214041).

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #43      +/-   ##
==========================================
+ Coverage   87.99%   88.01%   +0.02%     
==========================================
  Files          23       23              
  Lines        1166     1168       +2     
==========================================
+ Hits         1026     1028       +2     
  Misses        108      108              
  Partials       32       32              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.