Why: govulncheck reported 20 module-level advisories against golang.org/x/crypto v0.37.0 (19 with upstream fixes, GO-2026-5932 unfixed); none were reachable from our code, but the whole batch clears with one routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: golang.org/x/crypto v0.37.0 => v0.56.0 (x/text follows to v0.41.0 as a requirement); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green against the new core types; govulncheck now reports 0 affected, 0 import-level, 1 module-level (the upstream-unfixed GO-2026-5932 — the floor until upstream ships a fix).
Impact: go.mod/go.sum bumps only; no code change; x/crypto is not imported by any of our packages (transitive require).
Refs: Dev-side task fix/followup-hardening (gitlink pin follows after combined verification)
Why: govulncheck flagged two reachable vulnerabilities: GO-2026-5004 (SQL injection via placeholder confusion with dollar-quoted literals in pgx v5.7.6, reached through pgx.Conn.Exec sanitize path on Postgres deployments) and GO-2026-5970 (infinite loop on invalid input in golang.org/x/text v0.24.0, reached through pgx.Connect normalization). Follow-up to the 2026-09-30 dependency CVE inventory task.
Evidence: golang.org/x/text v0.24.0 => v0.39.0 and github.com/jackc/pgx/v5 v5.7.6 => v5.9.2 (both at or past the fixed versions); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green; govulncheck ./... now reports 0 reachable vulnerabilities (was 2).
Impact: go.mod/go.sum dependency bumps only; no code change; the remaining 20 module-level advisories are not called by our code (informational).
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)
Why: T3 of the interaction foundation - unify button/card/slash/chat entries onto one command bus (D27) composing the Agent-Command library (D30), with danger=high commands gated behind inline confirm cards and every dispatch leaving the same audit envelope.
Evidence: go test green - cmdbus suite (four-entrance audit symmetry, high-danger confirm lifecycle incl. cancel/expiry/handler-reject, audit-unavailable yields unknown, plugin spec fail-closed, schema scalar validation) and server e2e (danger command via POST /api/commands -> confirm card -> card action confirm -> committed receipt -> audit query ordered accepted->committed); legacy /help,/new,/mock,/model,/profile contract preserved through the bus; store migration v7 command_audit (both dialects) with roundtrip test updated.
Impact: new internal/cmdbus (L1 package per D33), server routes POST /api/commands/{id} + GET /api/commands/audit + registry-driven GET /api/commands, postMessage chat-entrance dispatch when the intent gate matches a registered command, plugins host OnCommands overlay, module cards policy/modules/{cmdbus,cardsvc}.md; pending confirm state is process-local (documented limitation).
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T3; task card feature/command-bus-r1
weichen
weichen