[coderdan]

Summary

• Correct the Go EQL capability reference to match the generated catalog, including JsonSearch and ordered date, timestamp, and numeric types; fix contradictory release notes and add a catalog drift check.
• Add a Go module entry point and contributor instructions, with links to the SDK, generator, credentials, and EQL v4 setup.
• Add a runnable typed JSON document example covering generation, PostgreSQL storage, containment, ordered path queries, whole-document decryption, and a partial read; improve the generated JSON field godoc.

Validation

• mise run wasm:guest:build, mise run wasm:guest:build:eql, mise run wasm:auth-guest:build
• GOCACHE=/private/tmp/go-doc-cache mise run go:test
• go generate ./... (clean tree afterward)
• vitest run scripts/__tests__/go-eql-doc-capabilities.test.mjs

The example compiled as part of the Go suite. A live run of the example needs ZeroKMS credentials and a PostgreSQL database with EQL v4 installed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3d86433c-3015-42d9-8310-8fdae8d1ac59

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 238ac9a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T14:07:48.491214Z	be96a9e	Draft marked ready
🔒 Security Review	🔄 Running since 2026-10-26T14:05:47.998311Z	be96a9e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be96a9e52e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Build the production guests before invoking the Go test task

On a fresh checkout, this sequence does not produce the production encryption guests required by mise run go:test. In mise.toml, the two deterministic tasks copy their outputs only into encrypt/testdata/, whereas scripts/go-binding-test.sh explicitly requires encrypt/wasm/stack_encrypt_guest.wasm and encrypt/eql/wasm/stack_encrypt_guest_eql.wasm and exits before running tests if either is absent. Add wasm:guest:build and wasm:guest:build:eql alongside the deterministic builds, and update the identical sequence in CONTRIBUTING.md as well.

Useful? React with 👍 / 👎.

[cipherstash-agent]

Review attestation: /code-review medium followed by company-skills:cross-check-review-findings (cipherstash/skills), run against head be96a9e.

Result: no findings. No critical or blocking issues.

• Verified at head: the stashgen README capability table matches the Producible: true set in eql_gen.go (50 of 50), which is what the new drift test asserts.
• Verified at head: the example's run instructions load the right guest. encrypt selects the EQL guest when encrypt/eql is linked, so wasm:guest:build:eql and the auth guest are sufficient.
• Verified at head: the Between, Gt and Subtree references in the docs exist in the generated code.
• Verified at head: the Go version floor matches go.mod.
• Existing PR feedback: none to cross-check. The only comments are bot status notices (CodeRabbit skipped, changeset-bot, Codex still running).
• Not verified: the example was not run live (needs ZeroKMS credentials and EQL v4 PostgreSQL). mise was unavailable, so the Go suite was not re-run. CI was still in progress when this ran.

---

Generated by Claude Code