build: move Go floor to 1.26.6

[steipete]

Summary

• raise the module and documented Go floor to 1.26.6
• record the security-floor update in the changelog
• clear GO-2026-5026, GO-2026-5972, GO-2026-6090, and GO-2026-6218

Verification

• GOTOOLCHAIN=go1.26.6 GOWORK=off go build ./...
• GOTOOLCHAIN=go1.26.6 GOWORK=off go test ./...
• GOTOOLCHAIN=go1.26.6 GOWORK=off go vet ./...
• GOTOOLCHAIN=go1.26.6 GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... — no reachable vulnerabilities
• GOTOOLCHAIN=go1.26.6 GOWORK=off go run ./cmd/crawlctl --help
• autoreview clean

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 14, 2026, 4:17 AM ET / 08:17 UTC.

ClawSweeper review

What this changes

The PR raises crawlkit’s declared Go minimum from 1.26.5 to 1.26.6 and updates public install guidance and the changelog.

Merge readiness

⛔ Blocked until real behavior proof is added - 5 items remain

Keep open: the focused Go-floor update needs removal of the release-owned changelog edit and real after-fix terminal proof before merge.

Likely related people

• Peter Steinberger — recent dependency/build contributor (medium confidence).

Priority: P2
Reviewed head: 06096a6f2ad7f1d08752c78013a50cf6cdf56a94

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The focused update is mostly sound, but it needs a release-process correction and real behavior proof.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The PR body lists validation commands but provides no after-fix terminal output or artifact proving the Go 1.26.6 build and advisory result; attach redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body lists validation commands but provides no after-fix terminal output or artifact proving the Go 1.26.6 build and advisory result; attach redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Focused branch change: The branch consistently raises the declared requirement from Go 1.26.5 to 1.26.6 in module metadata and installation documentation, but also adds a changelog entry. Current-main baseline: Current main declares Go 1.26.5 and the README presents the same floor, so the two functional edits are aligned with existing project behavior. Repository policy: The full repository policy was read; its shared-library and GOWORK=off validation guidance applies to this toolchain-floor change.
Findings	1 actionable finding	[P2] Remove the release-owned changelog entry
Security	None	None.

How this fits together

crawlkit is a shared Go module consumed by downstream archive applications. Its Go version directive controls the minimum toolchain consumers need to build the library, while the README communicates that requirement.

flowchart LR
  A[Downstream applications] --> B[Go toolchain]
  B --> C[Module version requirement]
  C --> D[Build and validation]
  C --> E[Installation guidance]
  D --> F[Shared crawlkit library]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR body lists validation commands but provides no after-fix terminal output or artifact proving the Go 1.26.6 build and advisory result; attach redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Remove the release-owned changelog entry (P2) - CHANGELOG.md is release-owned for OpenClaw PR review, so this maintenance PR should not add an Unreleased entry. Keep the module and README requirement update and provide release-note context in the PR body instead.
• Resolve merge risk (P1) - Consumers pinned to Go 1.26.5 or using GOTOOLCHAIN=local will need an upgrade before they can build this module.
• Resolve merge risk (P1) - The four advisory-clearance claims have no attached after-fix terminal output or artifact.
• Complete next step (P2) - The changelog correction is mechanical, but the required real-world proof must come from the contributor’s environment and cannot be generated by a repair lane.

Findings

• [P2] Remove the release-owned changelog entry — CHANGELOG.md:3-5

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Requirement surface	3 files affected; 6 additions, 2 deletions	The change updates module metadata, public install guidance, and a release-owned file.

Merge-risk options

Maintainer options:

1. Prove the raised floor before merge (recommended)
   Remove the release-owned changelog edit and attach redacted Go 1.26.6 build, test, vet, and vulnerability-check output before landing the consumer-facing requirement.

Technical review

Best possible solution:

Keep go.mod and the README aligned at the verified minimum security release, leave release notes to the release workflow, and attach redacted live validation output.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR changes a build prerequisite rather than repairing a runtime behavior with a user reproduction path.

Is this the best way to solve the issue?

No: the module and README edits are aligned, but normal PRs must not edit the release-owned changelog and the security-floor claim needs visible after-fix evidence.

Full review comments:

• [P2] Remove the release-owned changelog entry — CHANGELOG.md:3-5
CHANGELOG.md is release-owned for OpenClaw PR review, so this maintenance PR should not add an Unreleased entry. Keep the module and README requirement update and provide release-note context in the PR body instead.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a7025e21fc5c.

Labels

Label changes:

• add P2: This is a bounded shared build-requirement update with limited downstream impact.
• add merge-risk: 🚨 compatibility: The raised minimum can stop existing consumer builds until their Go toolchain is upgraded.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists validation commands but provides no after-fix terminal output or artifact proving the Go 1.26.6 build and advisory result; attach redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded shared build-requirement update with limited downstream impact.
• merge-risk: 🚨 compatibility: The raised minimum can stop existing consumer builds until their Go toolchain is upgraded.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists validation commands but provides no after-fix terminal output or artifact proving the Go 1.26.6 build and advisory result; attach redacted live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Focused branch change: The branch consistently raises the declared requirement from Go 1.26.5 to 1.26.6 in module metadata and installation documentation, but also adds a changelog entry. (go.mod:3, 06096a6f2ad7)
• Current-main baseline: Current main declares Go 1.26.5 and the README presents the same floor, so the two functional edits are aligned with existing project behavior. (go.mod:3, a7025e21fc5c)
• Repository policy: The full repository policy was read; its shared-library and GOWORK=off validation guidance applies to this toolchain-floor change. (AGENTS.md:18, a7025e21fc5c)
• Recent area history: The current main tip is a dependency-maintenance commit by Peter Steinberger, and the proposed toolchain-floor commit is also authored by Peter Steinberger. (go.mod:3, a7025e21fc5c)
• Autoreview infrastructure result: The required structured review helper could not create an isolated temporary directory in this read-only environment; this does not replace the direct diff review.

Likely related people:

• Peter Steinberger: He authored current main’s recent dependency-maintenance commit and the proposed Go-floor commit; partial local history prevented deeper per-line attribution. (role: recent dependency/build contributor; confidence: medium; commits: a7025e21fc5c, 06096a6f2ad7; files: go.mod, README.md, CHANGELOG.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Remove the CHANGELOG.md edit.
• Attach redacted terminal output for the specified Go 1.26.6 validation commands.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.