[the-sarge]

Updates the root and maintained tooling-module toolchain selections to Go 1.27.2, preserves the Go 1.27 floor and runtime dependencies, and selects official gosec v2.29.0 / govulncheck v1.9.0 through the existing catalogue.

Part of https://github.com/the-sarge/infra/issues/686. Blocked draft; do not merge.

The required standalone gosec v2.29.0 scan fails with Go 1.27.2: its x/tools v0.49.0 importer reports export data version 5 is greater than maximum supported version 4, then skips SSA analysis. Building the official module with Go 1.27.2 does not fix the importer. The official latest release was rechecked as v2.29.0. SARIF output exists but is not successful coverage. No custom build, dependency overlay, unreleased pin, scanner bypass, or release-policy change is permitted by the batch contract. Resume only after a qualifying official scanner release passes this same scan.

Passed under Go 1.27.2: module verification and tidy drift, root tests, govulncheck (No vulnerabilities found), Go tool helper tests, release helper tests and release policy checker. Full certification, RAS review, and merge are intentionally pending the scanner blocker. Existing release SARIF upload, test-inclusive scope, failure propagation, overrides and DCO remain unchanged. No release tag is planned.

[the-sarge]

Official scanner availability rechecked at 2026-10-15 01:11 UTC. The upstream latest-release endpoint, release list and tag list still identify gosec v2.29.0 as the newest official version, published 2026-08-26. Its tagged go.mod still requires x/tools v0.49.0. The previously tested binary is confirmed as official module v2.29.0 built with Go 1.27.2 and x/tools v0.49.0.

There is no new qualifying scanner candidate. The diagnosed export-data/SSA failure therefore remains unresolved; an identical scan was not blindly rerun. PR head c8cc38a and base 1f12b5a are unchanged, and the dedicated worktree is clean. No code, required coverage, tool distribution channel or release policy was changed. Keep this PR draft and infra #686 / OmniFocus open until a qualifying official scanner release passes the required standalone scan.

[the-sarge]

Dedicated remaining-work tracker: #320 . It owns the official scanner compatibility condition and the existing review/certification/merge/journal checklist. Infra #686 remains partial and is blocked by that issue; the audited removal of the blanket #686 → #687 gate is unchanged.