jjangg96 · Oct 22, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 15
     env:
       # Match Make's explicit selection even if the installed default changes.
-      GOTOOLCHAIN: go1.26.8
+      GOTOOLCHAIN: go1.26.9
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -81,7 +81,7 @@ jobs:
     timeout-minutes: 15
     env:
       # Match Make's explicit selection even if the installed default changes.
-      GOTOOLCHAIN: go1.26.8
+      GOTOOLCHAIN: go1.26.9
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -111,7 +111,7 @@ jobs:
           - experiments/g02-auth
           - experiments/r1-credentials
     env:
-      GOTOOLCHAIN: go1.26.8
+      GOTOOLCHAIN: go1.26.9
       OFFLINE_EXPERIMENT_MODULE: ${{ matrix.module }}
     steps:
       - name: Check out source
@@ -136,7 +136,7 @@ jobs:
     timeout-minutes: 15
     env:
       # Match Make's explicit selection even if the installed default changes.
-      GOTOOLCHAIN: go1.26.8
+      GOTOOLCHAIN: go1.26.9
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

diff --git a/.github/workflows/pr-fast.yml b/.github/workflows/pr-fast.yml
@@ -19,7 +19,7 @@ jobs:
     env:
       BASE_SHA: ${{ github.event.pull_request.base.sha }}
       HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-      GOTOOLCHAIN: go1.26.8
+      GOTOOLCHAIN: go1.26.9
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

diff --git a/Makefile b/Makefile
@@ -3,7 +3,7 @@ SHELL := /usr/bin/env bash
 GO ?= go
 GOFLAGS ?=
 # A go directive is a minimum under auto, including on a newer installation.
-override GOTOOLCHAIN := go1.26.8
+override GOTOOLCHAIN := go1.26.9
 export GOTOOLCHAIN
 export GOFLAGS
 FAST_MODULE := $(value FAST_MODULE)

diff --git a/docs/CI.md b/docs/CI.md
@@ -1,11 +1,11 @@
 # Public CI and local checks
 
-G03 establishes the reproducible development baseline. The module requires Go 1.26.8 in [go.mod](../go.mod). That directive is a minimum under automatic toolchain selection; Make explicitly exports `GOTOOLCHAIN=go1.26.8` to select the exact version even on a newer installation. No redundant `toolchain` directive is kept. Go's [release policy](https://go.dev/doc/devel/release) and [security guidance](https://go.dev/doc/security/) support security fixes for the two most recent major releases; on 2026-09-07 the official release history lists Go 1.27.1 and Go 1.26.8. The project uses 1.26.8 because it is the latest patch in the supported 1.26 line observed on that date and the released Scale Set SDK baseline requires Go 1.25.3 or newer. Revisit the pin when a newer supported patch is selected and compatibility is rechecked.
+G03 established the reproducible development baseline. Its 2026-09-07 snapshot recorded Go 1.26.8 in [go.mod](../go.mod) and selected it as the latest patch in the supported 1.26 line then observed; the official release history on that date listed Go 1.27.1 and Go 1.26.8. The Go directive is a minimum under automatic toolchain selection, and Make selects an exact toolchain without a redundant `toolchain` directive. Following the 2026-10-13 source-mode vulnerability result for Go 1.26.8, the approved current shared pin is Go 1.26.9. The patch and source re-verification evidence is recorded in the [G01 runner release checkpoint](evidence/g01-runner-release-checkpoint.md); it does not close the remaining G01/G02 or live qualification gates. The released Scale Set SDK baseline requires Go 1.25.3 or newer.
 
-Make and standalone `scripts/check-toolchain.sh` select `go1.26.8` explicitly;
+Make and standalone `scripts/check-toolchain.sh` select `go1.26.9` explicitly;
 they do not change the user's global Go configuration. Go may download that
 version into its normal per-user toolchain cache. The hosted workflow uses
-`actions/setup-go` to install 1.26.8 from `go.mod` and uses the same explicit
+`actions/setup-go` to install 1.26.9 from `go.mod` and uses the same explicit
 `GOTOOLCHAIN` value. The equality check still refuses an unexpected toolchain.
 Conventional settings such as `make GOFLAGS=-mod=readonly build` are exported
 through Go's environment, rather than placed before its subcommand.
@@ -88,7 +88,7 @@ Individual commands are available when iterating:
 
 | Command | Check |
 | --- | --- |
-| `make toolchain` | Confirm the module directives and selected Go toolchain are exactly 1.26.8. |
+| `make toolchain` | Confirm the module directives and selected Go toolchain are exactly 1.26.9. |
 | `make build` | Link the application executable; included in `make check` and hosted CI. |
 | `make fmt` / `make fmt-check` | Format or verify all Go sources with the selected toolchain. |
 | `make vet` | Run `go vet ./...`. |

diff --git a/docs/DEPENDENCIES.md b/docs/DEPENDENCIES.md
@@ -21,7 +21,7 @@ runtime graph contains only the local module; nested experiments remain separate
 
 ## Toolchain
 
-Go standard library: `go1.26.8`, BSD-3-Clause, the language/runtime baseline;
+Go standard library: `go1.26.9`, BSD-3-Clause, the language/runtime baseline;
 [official release history](https://go.dev/doc/devel/release).
 
 The selector matcher helper adapted from the Go standard library is documented
@@ -40,7 +40,7 @@ Both immutable manifests declare `runs.using: node24`; the upstream action
 documentation lists Actions Runner `v2.327.1` or later as the Node 24 minimum.
 The workflows stay on GitHub-hosted `ubuntu-24.04`. Setup Go v7's ESM migration
 does not change its inputs or behavior. The workflow keeps `go-version-file:
-go.mod`, the Go 1.26.8 declaration and `GOTOOLCHAIN=go1.26.8`; `cache: false`
+go.mod`, the Go 1.26.9 declaration and `GOTOOLCHAIN=go1.26.9`; `cache: false`
 keeps module caching disabled. Checkout keeps the exact triggering SHA for
 Public CI, the PR head SHA with `fetch-depth: 0`, and
 `persist-credentials: false`. The v7 unsafe fork checkout opt-in remains unset.

diff --git a/docs/decisions/0002-scaleset-integration.md b/docs/decisions/0002-scaleset-integration.md
@@ -1,12 +1,18 @@
 # ADR 0002: Released Scale Set listener with independent reconciliation
 
-Status: **provisional integration selection; G01 remains unresolved** pending
-independent Luna max protocol review and authorized live contract evidence.
+Status: **provisional integration selection; independent offline protocol review
+approved on 2026-10-03; G01 closure and production G01/G02 remain unresolved.**
 
 Issue: [G01](https://github.com/1XP-AI/gh-runnerd/issues/1).
 Checked: 2026-09-07. See [measured offline evidence](../evidence/g01-contract.md)
 and [required live experiment](../evidence/g01-live-canary.md).
 
+The review is limited to the offline evidence and this provisional selection; it
+does not satisfy the authorized live canary, sanitized live evidence or safe-drain
+gate. See the [independent protocol review](../evidence/g01-contract.md#independent-protocol-review-2026-10-03),
+[full review comment](https://github.com/1XP-AI/gh-runnerd/issues/1#issuecomment-5967217026)
+and [focused-test supplement](https://github.com/1XP-AI/gh-runnerd/issues/1#issuecomment-5967258854).
+
 ## Decision
 
 Pin `github.com/actions/scaleset v0.4.0` (source

diff --git a/docs/evidence/g01-contract.md b/docs/evidence/g01-contract.md
@@ -6,6 +6,53 @@ review approved the offline artifact at `4e58c55`; the reviewer reproduced race
 tests, vet and both pinned SDK comparisons. This is not approval of a live
 canary or the unresolved production integration gate.
 
+## Independent protocol review (2026-10-03)
+
+**Verdict:** APPROVE, scoped to the offline protocol evidence and provisional
+selection of the released `github.com/actions/scaleset v0.4.0` high-level
+listener with independent reconciliation. HOLD G01 closure and any production or
+live approval. The reviewer found no actionable defect in the reviewed current
+protocol evidence. This additive record preserves the historical 2026-09-07
+Astra authorship above.
+
+The independent reviewer was actual Codex GPT-6-Luna/max, verified before
+dispatch, and reviewed immutable parent-main source
+`9636e33781c72c32319db419334f49f1bc1866bc`. The complete
+[review comment](https://github.com/1XP-AI/gh-runnerd/issues/1#issuecomment-5967217026)
+contains the source anchors and scoped findings; the
+[supplement](https://github.com/1XP-AI/gh-runnerd/issues/1#issuecomment-5967258854)
+records the one corrected test-name gap. The review confirms the recorded
+statistics → ACK → acquisition → callbacks order, ACK-to-acquisition loss
+window, observational callbacks, 202/stale-statistics and session-fencing limits,
+and quarantine and JIT-secret-exposure conclusions. It does not establish
+exactly-once behavior or live GitHub semantics.
+
+The initial focused selection was run with Go 1.26.8:
+
+```text
+GOTOOLCHAIN=go1.26.8 go test -count=1 -timeout=60s -run '^(TestSDKACKBoundaries|TestSDKAcquisitionResponseLossAfterACK|TestSDKRepeatedStatisticsAnd202ReuseLastObservation|TestSDKHTTPFailuresAndSessionRefresh|TestSDKCapacityWithdrawalDoesNotFenceInFlightAcquisition|TestSDKJITResponseLossBeforeCreationDoesNotDiscoverIdentity|TestSDKJITResponseLossWithoutCommitDoesNotDiscoverIdentity|TestSDKJITResponseLossDiscoversIdentityWithoutReissuing)$' .
+PASS: github.com/1XP-AI/gh-runnerd/experiments/g01-scaleset (0.359s)
+```
+
+Seven of the eight regex alternatives matched tests. The alternative
+`TestSDKJITResponseLossBeforeCreationDoesNotDiscoverIdentity` matched no test;
+the checked-in case is
+`TestSDKJITLookupBeforeCreationDoesNotDiscoverIdentity`, which this first
+command did not execute. The coordinator closed that execution-evidence gap on the
+same unchanged source SHA with:
+
+```text
+GOTOOLCHAIN=go1.26.8 go test -count=1 -timeout=45s -run '^TestSDKJITLookupBeforeCreationDoesNotDiscoverIdentity$' .
+PASS: github.com/1XP-AI/gh-runnerd/experiments/g01-scaleset (0.361s)
+```
+
+That fixture used `httptest` and a transport that rejects non-fixture
+addresses; no JIT was created on GitHub and no runner binary was downloaded or
+executed. No full suite, race run, SDK comparison matrix, live canary or
+production approval is claimed by this review. The authorized canary, sanitized
+live evidence, safe-drain decision, and full G01/G02 production gates remain
+unresolved.
+
 ## Exact inputs and primary sources
 
 | Input | Exact selection / finding |
@@ -94,6 +141,12 @@ API (must verify bytes before execution):
 
 Source: [official runner release](https://github.com/actions/runner/releases/tag/v2.337.0).
 
+Release/source freshness update (2026-10-13): the
+[runner release checkpoint](g01-runner-release-checkpoint.md) records official
+`v2.338.0` metadata and reviewed source changes. The existing `v2.337.0`
+selection remains in force until a named tenant's availability and candidate
+archive bytes are qualified; the checkpoint does not change this pin.
+
 | Transport | Evidence and exposure |
 |---|---|
 | `Runner.Listener run --jitconfig <encoded>` / `run.sh --jitconfig <encoded>` | Command parser recognizes `jitconfig`; argv exposes the encoded credential to process inspection and command capture. Avoid for the canary. |

diff --git a/docs/evidence/g01-live-canary.md b/docs/evidence/g01-live-canary.md
@@ -26,8 +26,45 @@ provisioning/rotation remain unresolved, as does the provider-side conditional
 delete gate. This template correction closes neither gate and authorizes no live
 execution.
 
+Release/source freshness (2026-10-13): see the
+[runner release checkpoint](g01-runner-release-checkpoint.md). Keep this plan's
+`v2.337.0` selection unless a later authorized revision identifies the version
+offered to the named organization/repository. Before any candidate change, verify
+the archive bytes against the published digest and record the exact runtime/image
+digest; the checkpoint is source/metadata evidence only and authorizes no swap.
+
 ## Required environment and authorization record
 
+### Read-only preparation checkpoint — 2026-10-22
+
+The maintainer authorized preparation, not execution. A dedicated private,
+non-archived repository was located through `gh`; its name and local endpoint
+remain in the private approval conversation, not this public record. Its current
+workflow is manual-only, has empty token permissions, one ten-minute job and
+non-cancelling concurrency. However, it targets macOS ARM64 with a fixed label
+and prints the runner name. It is **not** the nonce-scoped Linux workload in
+`experiments/g01-canary-assets`, and is not approved for this experiment.
+
+The preparation host is macOS ARM64 and has a configured Docker Desktop Linux
+context. Only local context metadata was inspected: daemon availability, worker
+isolation and resources have not been verified. No context was switched, image
+pulled, container started or runner changed. Approximately 7.5 GiB free disk was
+observed, so runtime preparation must wait for adequate measured headroom.
+The proposed first scope is one disposable Linux ARM64 worker (1 vCPU / 1 GiB),
+one controller/session/scale set and one baseline job, with no host socket or
+controller mounts in the worker. No current native runner is a fallback target.
+
+The organization runner-group metadata request returned HTTP 403. Selected-only
+repository policy, group identity and existing-runner inventory therefore remain
+unverified; no authentication scopes or App permissions were changed. A reviewed
+nonce-bound workflow commit, immutable executor/runtime inputs, separate
+controller/broker identities, authenticated provenance/trust roots and supported
+conditional cleanup are still required. A configured context or a successful
+source review cannot clear these live gates. Later fault phases need their own
+explicit approval; do not dispatch even the baseline from this checkpoint.
+
+### Execution checklist
+
 - [ ] Maintainer identifies one disposable **private** repository and one
   organization; no public fork/PR execution. Record the reviewed workflow SHA.
 - [ ] Dedicated runner group allows only that repository, and a unique canary
@@ -46,9 +83,13 @@ execution.
   target after host headroom is checked, 10-minute job deadline. Increase any
   limit only with new concrete authorization. No service-container workloads in
   this protocol canary.
-- [ ] Use SDK `v0.4.0`, Go `1.26.8` and runner `2.337.0`; verify runner bytes
+- [ ] Use SDK `v0.4.0`, Go `1.26.9` and runner `2.337.0`; verify runner bytes
   against [published digests](g01-contract.md#runner-and-jit-transport) and record
   exact runtime/image digest. Recheck support/security status before execution.
+  This supersedes the earlier Go `1.26.8` source profile. Go `1.26.8` commands
+  embedded in the recovery packet remain inert historical/specimen text and are
+  not current execution instructions; this checklist does not authorize a
+  canary or live runner operation.
 - [ ] Independent Luna max reviews the immutable live harness, authority
   checks, cleanup, fault barriers and sanitized telemetry. The offline fixture
   must not be pointed at GitHub by replacing its URL. The separate tagged driver