base-layer/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Record independent Go toolchain and consumer minimum policy

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-05 04:28:41 +00:00
parent fcc94eb9e9
commit 425f53a62e
1 changed files with 38 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
docs/roadmap/audit/catalog.md
View File

@@ -22,7 +22,11 @@ and conditional certificate-trust exposure. Use a patched maintainer toolchain
and repeat the focused security assessment against it. Actual downstream
exposure depends on the toolchain that builds the consumer and its transport
and trust configuration; raising PromptKit's minimum Go requirement is a
separate compatibility decision, not an implied remedy.
separate compatibility concern, not an implied remedy.
[Decision 5](#decision-5-consumer-go-minimum-after-the-toolchain-update) reaffirms
independent maintainer-toolchain selection and the initial-release consumer
minimum. Advising consumers about generally applicable Go vulnerabilities is
outside PromptKit's responsibility.
Sources: [Security 1](07-security.md#1-the-audited-go-toolchain-predates-applicable-networking-security-fixes).
@@ -593,37 +597,46 @@ ConfigKit's deferred rejection of unsupported inputs. Remove obsolete adapter
code and tests. Preserve distinct runtime JSON-copying behavior. This is a
deliberate compatibility change; this record does not itself implement it.
## Open Decisions
Work through the remaining decisions below in order, retaining their original
numbers. These are unresolved choices, not additional findings or approved
changes to public contracts. A decision blocks its dependent remediation, not
unrelated fixes. In particular, updating the maintainer toolchain need not wait
for the consumer-minimum decision. Implementation details and optional cleanup
do not become release gates merely by appearing in this catalog.
### Decision 5: Consumer Go Minimum After The Toolchain Update
**Related finding:** [1](#1-update-the-audited-maintainer-toolchain-for-applicable-security-fixes).
**Question:** Should the security fixes also change PromptKit's declared minimum
consumer Go version?
**Status:** Accepted; maintainer-toolchain remediation pending.
**Recommendation:** Update the maintainer toolchain and repeat the focused
assessment promptly; initially keep the consumer minimum decision separate.
Advise affected consumers to rebuild with a patched toolchain. This recognizes
that PromptKit publishes source and that downstream build/transport choices
control the deployed exposure.
**Decision:** Select the maintainer toolchain independently of the consumer Go
minimum. Always use the latest locally available Go version for PromptKit builds
and tests, including ordinary development and release validation. Update the
local installation as needed to address the audit findings; local availability
alone does not establish that those fixes are present.
**Alternative:** Raise the declared minimum to the selected patched release.
This makes the supported floor clearer and steers module consumers toward the
fixed toolchain, but changes compatibility and does not repair already-built
applications. Assess it under the existing release policy rather than treating
it as an automatic consequence of the scanner output.
Normally set the consumer minimum to the initial stable release (`1.x.0`) of
the current selected series. Advance series in minor releases; preserve the
minimum in patch releases. Retain the existing exception for a dependency or
identified correctness requirement that needs a higher patch minimum. This
reaffirms the [release policy](../../policy/release.md#consumer-minimum-and-release-toolchain)
and [release procedure](../../release.md#prepare-the-candidate), extending the
latest-local-toolchain instruction explicitly to ordinary builds and tests.
**Resolve before changing the minimum:** Confirm current advisory applicability,
select the patched version, and decide whether changing the supported consumer
floor is justified. No new recurring release gate is implied.
Advising consumers to update Go for generally applicable vulnerabilities is not
PromptKit's responsibility. Do not add consumer advisories, upgrade notices, or
an ongoing vulnerability-notification obligation for those issues to this
remediation. Downstream toolchain maintenance belongs to the consuming project.
**Alternative considered:** Raising the consumer patch minimum as a routine
response to general Go security advisories would conflate library compatibility
with downstream toolchain maintenance. That approach is not selected.
**Remediation follow-through:** Use the selected local toolchain for the focused
reassessment and clarify ordinary development toolchain selection in contributor
guidance. No new recurring release gate or general consumer security advisory
work is introduced. This record does not itself update the installed toolchain.
## Open Decisions
The remaining decision below retains its original number. It is an unresolved
choice, not an additional finding or approved contract change. It blocks only
its dependent remediation. Implementation details and optional cleanup do not
become release gates merely by appearing in this catalog.
### Decision 6: Retention Of The Legacy Capacity Client Wrapper