[Desperado]

The published qmax-code v1.40.0 binaries were built with Go 1.25.13, whose crypto/x509 verifier predates the compromised emSign root denylist in GO-2026-6809. This change requires Go 1.27.3 and prepares v1.40.1 so release archives use the fixed verifier.

Validation:

• GOTOOLCHAIN=go1.27.3 go vet ./...
• GOTOOLCHAIN=go1.27.3 go test . -run '^TestInitReceiptPathsPointsAtQMaxCodeState$' -count=1 -timeout=60s
• local release build reports qmax-code v1.40.1 and go1.27.3 via go version -m

The complete local suite was attempted. Existing macOS integration tests blocked on the live keychain command and a timing-sensitive handoff self-check; Linux CI is the clean full-suite gate for this metadata-only release change.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: model judgment; findings have not been reproduced

Re-review: Open the QualityMax check and select Re-review after it completes.

Files eligible: 4 · Files reviewed: 4 · Files with findings: 1 · Findings: 1 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 4, reviewed 4 · MODEL-ONLY findings are advisory · batches reviewed 1 of 1 · LLM · served claude-haiku-4-5-20251001 · requested gemini-3.1-flash-lite
SAST	completed · eligible 10, reviewed 10 · hybrid · served qwen3.7-plus
Overall review evidence	non-blocking findings remain
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Advisory MODEL-ONLY candidates (1)

These model judgments do not block this PR and are not posted inline. Check reachable callers and existing protections, and reproduce a concrete failure before treating a candidate as a defect. A second model's confirmation or a model-reviewed patch does not reproduce a failure.

location	candidate	served model
.github/workflows/ci.yml:30	The linter invocation uses `${{ github.event.pull_request.base.sha || github.event.before }}` to determine the baseline for `--new-from-rev`. On non-PR events (e.g., push to main, scheduled runs), `github.event.pull_request` is null, so `base.sha` is empty. The fallback to `github.event.before` is undefined for scheduled workflows and may be null or stale for force-pushes. This causes the linter to receive an invalid or missing `--new-from-rev` value, silently disabling the intended filtering and linting all files instead of only changed ones. The behavior is inconsistent across event types and defeats the purpose of the new-only filtering.	claude-haiku-4-5-20251001

Change diagram — Flow

flowchart TD
    A[CI Workflow Triggered] --> B{Event Type?}
    B -->|Pull Request| C[github.event.pull_request.base.sha Available]
    B -->|Push/Schedule| D[github.event.pull_request.base.sha is Null]
    C --> E[--new-from-rev Set to Base SHA]
    D --> F[Fallback to github.event.before]
    F --> G{github.event.before Defined?}
    G -->|Yes| H[--new-from-rev Set to Before SHA]
    G -->|No| I[--new-from-rev Undefined/Invalid]
    E --> J[Lint Only Changed Files]
    H --> K{Correct Baseline?}
    K -->|Yes| J
    K -->|No| L[Lint All Files Unintentionally]
    I --> L
    J --> M[Efficient Linting]
    L --> N[Filtering Disabled]

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: GROUNDED deterministic scanner evidence · MODEL-ONLY advisory model judgment · MODEL-REVIEWED patch model judgment, not reproduction.

QualityMax project results are available in the configured project.

_{Receipt · commit f692b4ce64d32aa5bf8dd03a2cffec28fe1bb8e6 · run 2026-10-22T19:33:54+00:00 · model served claude-haiku-4-5-20251001 · model requested gemini-3.1-flash-lite · model review recorded — 1141 model output tokens · model source not recorded · re-review 2 · proof counts {'MODEL-ONLY': 1}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

QualityMax Code Health

Grade A · 100/100 · PASS — 0 finding(s) in 10 file(s).

No code-health findings.

Full report · Commit f692b4c

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

The PR upgrades golangci-lint from v1 to v2 and switches to incremental linting via --new-from-rev, which improves CI efficiency but introduces a material risk: the --new-from-rev flag depends on github.event.pull_request.base.sha being populated, which is only available in pull_request events. On push events (e.g., direct commits to main), github.event.pull_request is null, causing the fallback to github.event.before. However, github.event.before may be empty or undefined in certain workflows (e.g., initial push, force-push, or tag creation), resulting in linting against an invalid or missing baseline. This could silently skip linting or fail the workflow unexpectedly. Additionally, the Go version bump to 1.27.3 is undocumented in the PR context, raising questions about compatibility testing.

🟡 Finding 1: logic

File: .github/workflows/ci.yml:30 | Severity: warning

What: The --new-from-rev flag uses a conditional fallback: github.event.pull_request.base.sha || github.event.before. On push events, github.event.pull_request is null, so the expression evaluates to github.event.before. However, github.event.before is undefined or empty in several scenarios: (1) initial push to a new branch, (2) force-push operations, (3) tag creation, or (4) workflows triggered by other events. When github.event.before is empty, golangci-lint receives an empty or invalid revision, which may cause it to lint against HEAD~1, skip linting entirely, or fail with an unclear error. This breaks the intended incremental-linting behavior and creates inconsistent CI results across different push scenarios.

Fix: Add explicit event-type handling: use github.event.pull_request.base.sha only in pull_request events, and for push events, use a stable baseline (e.g., origin/main or a commit hash from the workflow context). Alternatively, document the limitation and restrict this workflow to pull_request events only. Test the workflow with force-push and initial-branch scenarios to confirm behavior.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in .github/workflows/ci.yml at line 30: The --new-from-rev flag uses a conditional fallback: github.event.pull_request.base.sha || github.event.before. On push events, github.event.pull_request is null, so the expression evaluates to github.event.before. However, github.event.before is undefined or empty in several scenarios: (1) initial push to a new branch, (2) force-push operations, (3) tag creation, or (4) workflows triggered by other events. When github.event.before is empty, golangci-lint receives an empty or invalid revision, which may cause it to lint against HEAD~1, skip linting entirely, or fail with an unclear error. This breaks the intended incremental-linting behavior and creates inconsistent CI results across different push scenarios."

🔵 Finding 2: breaking

File: go.mod:3 | Severity: info

What: Go version requirement bumped from 1.25.13 to 1.27.3 without visible justification in the PR diff. This is a breaking change for users or CI systems running older Go versions. The PR comment mentions upgrading golangci-lint to v2 (which may require a newer Go version), but the specific Go 1.27.3 requirement is not explained. No visible test or compatibility check is included in the diff.

Fix: Document the reason for the Go version bump (e.g., 'golangci-lint v2 requires Go 1.27+') in the commit message or PR description. Verify that all dependencies and the project code are compatible with Go 1.27.3. Consider adding a CI step to test against the minimum supported Go version.

Fix with your LLM agent

<your-llm-agent> "Fix the breaking issue in go.mod at line 3: Go version requirement bumped from 1.25.13 to 1.27.3 without visible justification in the PR diff. This is a breaking change for users or CI systems running older Go versions. The PR comment mentions upgrading golangci-lint to v2 (which may require a newer Go version), but the specific Go 1.27.3 requirement is not explained. No visible test or compatibility check is included in the diff."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- logic in .github/workflows/ci.yml:30: The --new-from-rev flag uses a conditional fallback: github.event.pull_request.base.sha || github.event.before. On push events, github.event.pull_request is null, so the expression evaluates to github.event.before. However, github.event.before is undefined or empty in several scenarios: (1) initial push to a new branch, (2) force-push operations, (3) tag creation, or (4) workflows triggered by other events. When github.event.before is empty, golangci-lint receives an empty or invalid revision, which may cause it to lint against HEAD~1, skip linting entirely, or fail with an unclear error. This breaks the intended incremental-linting behavior and creates inconsistent CI results across different push scenarios.\n- breaking in go.mod:3: Go version requirement bumped from 1.25.13 to 1.27.3 without visible justification in the PR diff. This is a breaking change for users or CI systems running older Go versions. The PR comment mentions upgrading golangci-lint to v2 (which may require a newer Go version), but the specific Go 1.27.3 requirement is not explained. No visible test or compatibility check is included in the diff."

Change diagram — Flow

flowchart TD
    A[CI Workflow Triggered] --> B{Event Type?}
    B -->|pull_request| C[github.event.pull_request.base.sha Available]
    B -->|push| D[github.event.pull_request is null]
    C --> E[--new-from-rev=base.sha]
    D --> F[Fallback to github.event.before]
    F --> G{github.event.before Defined?}
    G -->|Yes| H[--new-from-rev=before]
    G -->|No/Empty| I[Invalid Baseline]
    E --> J[Incremental Lint]
    H --> J
    I --> K[Lint Fails or Skips]
    J --> L[CI Result]
    K --> L

Loading

_{Analyzed commit 590af283 with claude-haiku-4-5-20251001 (degraded — requested gemini-3.1-flash-lite) (4 files, 3973 tokens) | Customize review preferences}

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	ℹ️ 2 advisory MODEL-ONLY candidate(s) · claude-haiku-4-5-20251001 · completed · 4 eligible / 4 reviewed · claude-haiku-4-5-20251001
🔍 SAST	completed · 10 eligible / 10 reviewed · qwen3.7-plus
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5619800093 and overview #6349316125 confirmed
🧪 Repo Tests	✅ 1551/1551 passed (go)
🤖 AI Tests	⚠️ 51/56 passed

_{Powered by QualityMax — AI-Powered Test Automation}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

The PR introduces a workflow change to use golangci-lint v2 with --new-from-rev filtering, which is a logic improvement but carries a material risk: the github.event.pull_request.base.sha expression is null for non-PR events (e.g., push to main), causing the linter to fall back to github.event.before which may be undefined or point to an unexpected commit, silently disabling the new-only filtering. Additionally, the fetch-depth: 0 addition enables full history cloning, increasing CI latency and network cost. Go version bumps (1.25.13 → 1.27.3) and version string update are routine maintenance with no defects identified.

🟡 Finding 1: logic

File: .github/workflows/ci.yml:30 | Severity: warning

What: The linter invocation uses ${{ github.event.pull_request.base.sha || github.event.before }} to determine the baseline for --new-from-rev. On non-PR events (e.g., push to main, scheduled runs), github.event.pull_request is null, so base.sha is empty. The fallback to github.event.before is undefined for scheduled workflows and may be null or stale for force-pushes. This causes the linter to receive an invalid or missing --new-from-rev value, silently disabling the intended filtering and linting all files instead of only changed ones. The behavior is inconsistent across event types and defeats the purpose of the new-only filtering.

Fix: Explicitly handle the event type: use conditional logic to set the baseline only for pull_request events, or use a GitHub Actions expression that safely defaults to a known commit (e.g., github.event.pull_request.base.sha for PRs and HEAD~1 or HEAD for pushes). Test the workflow on both PR and push events to verify the baseline is correct. Example: run: |\n if [[ -n "${{ github.event.pull_request.base.sha }}" ]]; then\n BASE_SHA="${{ github.event.pull_request.base.sha }}"\n else\n BASE_SHA="HEAD~1"\n fi\n go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 run --new-from-rev=$BASE_SHA

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in .github/workflows/ci.yml at line 30: The linter invocation uses '${{ github.event.pull_request.base.sha || github.event.before }}' to determine the baseline for '--new-from-rev'. On non-PR events (e.g., push to main, scheduled runs), 'github.event.pull_request' is null, so 'base.sha' is empty. The fallback to 'github.event.before' is undefined for scheduled workflows and may be null or stale for force-pushes. This causes the linter to receive an invalid or missing '--new-from-rev' value, silently disabling the intended filtering and linting all files instead of only changed ones. The behavior is inconsistent across event types and defeats the purpose of the new-only filtering."

🔵 Finding 2: dependency

File: .github/workflows/ci.yml:16 | Severity: info

What: The addition of fetch-depth: 0 to the checkout action enables full repository history cloning. While this is necessary for --new-from-rev to work correctly (it needs access to the base commit), it increases CI latency and network egress costs by downloading the entire history on every run. This is a trade-off between correctness and efficiency.

Fix: Consider using fetch-depth: 0 only when needed (e.g., for PR events where --new-from-rev is used). For push events without the filtering, a shallow clone may suffice. Alternatively, document this as an accepted cost of the new linting strategy and monitor CI runtime trends.

Fix with your LLM agent

<your-llm-agent> "Fix the dependency issue in .github/workflows/ci.yml at line 16: The addition of 'fetch-depth: 0' to the checkout action enables full repository history cloning. While this is necessary for '--new-from-rev' to work correctly (it needs access to the base commit), it increases CI latency and network egress costs by downloading the entire history on every run. This is a trade-off between correctness and efficiency."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- logic in .github/workflows/ci.yml:30: The linter invocation uses '${{ github.event.pull_request.base.sha || github.event.before }}' to determine the baseline for '--new-from-rev'. On non-PR events (e.g., push to main, scheduled runs), 'github.event.pull_request' is null, so 'base.sha' is empty. The fallback to 'github.event.before' is undefined for scheduled workflows and may be null or stale for force-pushes. This causes the linter to receive an invalid or missing '--new-from-rev' value, silently disabling the intended filtering and linting all files instead of only changed ones. The behavior is inconsistent across event types and defeats the purpose of the new-only filtering.\n- dependency in .github/workflows/ci.yml:16: The addition of 'fetch-depth: 0' to the checkout action enables full repository history cloning. While this is necessary for '--new-from-rev' to work correctly (it needs access to the base commit), it increases CI latency and network egress costs by downloading the entire history on every run. This is a trade-off between correctness and efficiency."

Change diagram — Flow

flowchart TD
    A[CI Workflow Triggered] --> B{Event Type?}
    B -->|Pull Request| C[github.event.pull_request.base.sha Available]
    B -->|Push/Schedule| D[github.event.pull_request.base.sha is Null]
    C --> E[--new-from-rev Set to Base SHA]
    D --> F[Fallback to github.event.before]
    F --> G{github.event.before Defined?}
    G -->|Yes| H[--new-from-rev Set to Before SHA]
    G -->|No| I[--new-from-rev Undefined/Invalid]
    E --> J[Lint Only Changed Files]
    H --> K{Correct Baseline?}
    K -->|Yes| J
    K -->|No| L[Lint All Files Unintentionally]
    I --> L
    J --> M[Efficient Linting]
    L --> N[Filtering Disabled]

Loading

_{Analyzed commit f692b4ce with claude-haiku-4-5-20251001 (degraded — requested gemini-3.1-flash-lite) (4 files, 4198 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!