Three doc changes for the bundle's discoverability:
1. New docs/contributor/ci-guards.md (185 lines)
Entry-point doc for new contributors. Explains the four categories
of guards (code-shape, contract-parity, build/dep, operational),
the discipline that keeps them honest (allowlist + expiration),
and how to add a new one. Cross-references scripts/ci-guards/README.md
for the exhaustive list.
2. scripts/ci-guards/README.md — added a 'Forward-looking guards'
subsection naming complete-path-config-coverage, doc-rot-detector,
and cold-db-compose-smoke with their item references + a
one-sentence description of what each catches. Replaced the
stale '22 guards' header with 'Count: re-derive via ls' per the
no-version-stamped-numbers convention from CLAUDE.md.
3. docs/README.md — wired ci-guards.md into the Contributor section
navigation table.
Bumped 'Last reviewed:' to 2026-05-12 on the two docs touched
(docs/README.md, docs/contributor/ci-pipeline.md).
Verified: doc-rot-detector.sh green at 91 docs scanned, 89 dated, 0
warns, 0 fails.
Audit-Closes: post-v2.1.0-anti-rot/item-1
Audit-Closes: post-v2.1.0-anti-rot/item-2
Audit-Closes: post-v2.1.0-anti-rot/item-5
Audit-Closes: post-v2.1.0-anti-rot/item-6
CI run #484's Go Build & Test job failed govulncheck (M-024 hard
gate). Six standard-library CVEs land in go1.25.9 + one
golang.org/x/net CVE in v0.49.0; all are fixed in go1.25.10 + x/net
v0.53.0 respectively. The advisories that fired were:
GO-2026-4986 Quadratic string concat in net/mail.consumeComment
— called via internal/api/handler/validation.go's
ValidateCommonName -> mail.ParseAddress
GO-2026-4977 Quadratic string concat in net/mail.consumePhrase
— same call site
GO-2026-4982 Bypass of meta-content URL escaping in html/template
— called via internal/service/digest.go's
RenderDigestHTML -> Template.Execute
GO-2026-4980 Escaper bypass in html/template
— same call site
GO-2026-4971 Panic in net.Dial / LookupPort on Windows NUL bytes
— many call sites (email notifier, SSH connector,
ACME validators, validation.ValidateSafeURL, ...)
GO-2026-4918 Infinite loop in net/http2 transport on bad
SETTINGS_MAX_FRAME_SIZE
— called via internal/connector/target/f5.go's
F5Client.Authenticate -> http.Client.Do
Bumps applied:
* `go.mod`: `go 1.25.9` -> `go 1.25.10`; `golang.org/x/net v0.49.0`
-> `v0.53.0` (kept indirect — the upgrade is force-pulled by the
module-version directive; transitive deps will pick the higher).
* `.github/workflows/{ci,codeql,release}.yml`: setup-go pin and the
release.yml `GO_VERSION` env var bumped to 1.25.10. The
security-deep-scan.yml workflow uses the major-minor `1.25` pin
which auto-resolves to the latest 1.25.x and is unaffected.
* `Dockerfile` + `Dockerfile.agent`: `golang:1.25-alpine@sha256:5caa...`
re-pinned to `golang:1.25.10-alpine@sha256:8d22e29d960bc50cd0...`
(digest looked up against `registry-1.docker.io/v2/library/golang/
manifests/1.25.10-alpine`; verified by the digest-validity ci-guard).
The explicit `1.25.10-alpine` tag form replaces the moving
`1.25-alpine` pin so the image-spec is reproducible end-to-end
even without the digest reference.
* `deploy/test/f5-mock-icontrol/Dockerfile`: `golang:1.25.9-bookworm
@sha256:1a14...` re-pinned to `golang:1.25.10-bookworm@sha256:
e3a54b77385b4f8a31c1...` (looked up the same way).
* `deploy/test/f5-mock-icontrol/go.mod`: `go 1.25.9` -> `go 1.25.10`.
* `internal/api/handler/version.go` + `api/openapi.yaml`: the
`runtime.Version()`-shape comment + OpenAPI `example: go1.25.9`
bumped to keep doc/example freshness.
* `docs/contributor/ci-pipeline.md` + `docs/reference/connectors/
iis.md`: doc-only `Go 1.25.9` -> `Go 1.25.10` references.
Verification done in-tree:
* All `scripts/ci-guards/*.sh` pass locally including
`digest-validity.sh` (the new digests resolve cleanly against
Docker Hub).
* `S-1-hardcoded-source-counts.sh` clean (the false-positive on
"Bundle 1 migrations" was fixed in the prior commit).
Operator step required post-push (sandbox has no Go toolchain):
cd certctl && go mod tidy
This regenerates go.sum's `golang.org/x/net v0.49.0` h1: lines into
v0.53.0 ones. CI's `go mod tidy && git diff --exit-code go.mod
go.sum` step will catch the drift if missed; in that case run the
command, commit, and push the go.sum-only delta.
Per Phase 1 audit at cowork/docs-overhaul-phase-1-audit-2026-05-04/.
Adds a `> Last reviewed: 2026-05-05` line right after the H1 heading
of every doc that didn't already have one (41 files).
This dates the freshness clock for the future Phase 4 per-doc review.
The discipline going forward: when a doc's content gets a meaningful
edit, bump the date. When the date gets old (e.g., >6 months), the
doc earns a freshness-review pass.
Mechanical insertion via awk one-liner, applied to every docs/*.md
that didn't already match `grep -q 'Last reviewed:'`. Files that
already carried the line from earlier Phase 2 work (the navigation
index, the new connector docs, the new SCEP server / legacy-clients-
TLS-1.2 / release-verification docs, and the 5 per-connector deep
dives) were skipped to avoid duplicate insertion.
Net: every doc in docs/ now has a Last reviewed line.
shankar0123