Move the canonical golangci-lint to v2.15.0 and bring back canonicalheader

v2.15.0 (released 2026-10-16, built with go1.27.0 like v2.14.0) bundles
canonicalheader with its upstream fix for non-deterministic results, the
defect behind issue 105. Linted 20 times each on a scratch package with
two planted findings beside a ResponseWriter.Header() call, v2.14.0
reported them on 8 runs and nothing on 12; v2.15.0 reported them on all
20. REPO_POLICIES.md names the new digest; .golangci.yml no longer
disables canonicalheader and is otherwise unchanged, since it verifies
against v2.15.0 as it was and default: all switches on no new linter.

.golangci.yml

@@ -25,8 +25,6 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
-    # Misses findings at random in v2.14.0; back once a pinned release fixes it
-    - canonicalheader
   settings:
     lll:
       line-length: 88

TODO.md

@@ -21,25 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-11-03: A package from the distribution's own package index now needs no
+- 2026-11-01: Moved the canonical golangci-lint to v2.15.0 (released
-  version and no hash, and pulling that index is allowed
+  2026-10-16), still built with go1.27.0, so the `go` directive rule is
-  (https://git.eeqj.de/sneak/prompts/issues/72), on sneak's answer at
+  unchanged. The canonical `.golangci.yml` passes `golangci-lint config verify`
-  https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196. The
+  on v2.15.0, and `default: all` switches on no new linter. `canonicalheader` is
-  distribution is the pinned base image's in a `Dockerfile` and the host's on a
+  enabled again (issue 105): v2.15.0 carries the upstream commit "fix:
-  host. It is trusted, and everything else stays pinned by hash. A package
+  non-deterministic results", and on a scratch package with two planted findings
-  source that a `Dockerfile` adds itself does not get the exception. The pinning
+  beside a `ResponseWriter.Header()` call, linted 20 times with each pinned
-  rule of `REPO_POLICIES.md` and both checklists say so, and the canonical Go
+  image, v2.14.0 reported them on 8 runs and nothing on 12, while v2.15.0
-  `Dockerfile`'s `apk add` line has a comment saying why it is allowed.
+  reported them on all 20.
-- 2026-11-03: A first test run that timed out now gets no verbose rerun
-  (https://git.eeqj.de/sneak/prompts/issues/61), on sneak's approval at
-  https://git.eeqj.de/sneak/prompts/issues/61#issuecomment-165195. The Go recipe
-  in `REPO_POLICIES.md` looks in the first run's output for
-  `panic: test timed out` or `*** Test killed`, and exits 1 when either is
-  there. The Python `make test` example takes the same `timeout 90 sh -c`
-  wrapper as its `Dockerfile` example. The 60 and 90 second rule and the
-  5-minute rule now say a hung package uses the backstop once. The Go item in
-  both repo checklists now asks for this, so a repository with the old recipe
-  fails it.
 - 2026-10-27: Added `prompts/API_POLICIES.md`
   (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from
   https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-11-03
+last_modified: 2026-10-26
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -70,9 +70,8 @@ with your task.
       (`--mount=type=cache,target=/root/.cache/go-build`), `golangci-lint run`
       also mounts golangci-lint's
       (`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
-      mounts anything else; both `go test` runs carry `-count=1`; a first run
+      mounts anything else; both `go test` runs carry `-count=1`, as in the
-      that timed out gets no rerun, as in the canonical Go `Dockerfile` in
+      canonical Go `Dockerfile` in `REPO_POLICIES.md`
-      `REPO_POLICIES.md`
 - [ ] Python: a `test` phase that installs its packages from `Pipfile.lock` does
       it above `ARG CACHEBUST`, with `COPY script/ script/`,
       `COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
@@ -216,12 +215,7 @@ with your task.
 - [ ] Pre-commit hook is installed (`make hooks`)
 - [ ] No secrets in the repo (`.env`, keys, credentials)
 - [ ] No mutable references in Dockerfiles or scripts (tags, `@latest`) — all
-      pinned by cryptographic hash with version/date comment. The one exception
+      pinned by cryptographic hash with version/date comment
-      is a package from the distribution's own package index, which needs no
-      version and no hash. Pulling that index is also allowed. In a
-      `Dockerfile`, the distribution is the pinned base image's. On a host, it
-      is the host's. A package source that a `Dockerfile` adds itself does not
-      get this exception
 - [ ] Using `yarn`, not `npm` (JS projects)
 
 # Directory Structure

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-11-03
+last_modified: 2026-10-26
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -129,9 +129,8 @@ Template files can be fetched from:
       (`--mount=type=cache,target=/root/.cache/go-build`), `golangci-lint run`
       also mounts golangci-lint's
       (`--mount=type=cache,target=/root/.cache/golangci-lint`), and no step
-      mounts anything else; both `go test` runs carry `-count=1`; a first run
+      mounts anything else; both `go test` runs carry `-count=1`, as in the
-      that timed out gets no rerun, as in the canonical Go `Dockerfile` in
+      canonical Go `Dockerfile` in `REPO_POLICIES.md`
-      `REPO_POLICIES.md`
     - Python: a `test` phase that installs its packages from `Pipfile.lock` does
       it above `ARG CACHEBUST`, with `COPY script/ script/`,
       `COPY Pipfile Pipfile.lock ./` and `RUN script/bootstrap`. When
@@ -243,11 +242,7 @@ are thin shims calling them. Model scripts:
       final stage is missing its `COPY --from=` edge to the gate phases.
 - [ ] No secrets in repo, and none in the build context: enumerate a probe image
       rather than reading `.dockerignore`
-- [ ] No mutable image/package references. The one exception is a package from
+- [ ] No mutable image/package references
-      the distribution's own package index, which needs no version and no hash.
-      Pulling that index is also allowed. In a `Dockerfile`, the distribution is
-      the pinned base image's. On a host, it is the host's. A package source
-      that a `Dockerfile` adds itself does not get this exception
 - [ ] No unnecessary files in repo root
 - [ ] All dates written as YYYY-MM-DD
 

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-11-03
+last_modified: 2026-11-01
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -20,36 +20,19 @@ style conventions are in separate documents:
   `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync
   with the authoritative source as policies evolve.
 
-- **External references must be pinned by cryptographic hash.** This includes
+- **ALL external references must be pinned by cryptographic hash.** This
-  Docker base images, Go modules, npm packages, GitHub Actions, and anything
+  includes Docker base images, Go modules, npm packages, GitHub Actions, and
-  else fetched from a remote source. Version tags (`@v4`, `@latest`, `:3.21`,
+  anything else fetched from a remote source. Version tags (`@v4`, `@latest`,
-  etc.) are server-mutable and therefore remote code execution vulnerabilities.
+  `:3.21`, etc.) are server-mutable and therefore remote code execution
-  Reference an external dependency by its content hash (Docker `@sha256:...`, Go
+  vulnerabilities. The ONLY acceptable way to reference an external dependency
-  module hash in `go.sum`, npm integrity hash in lockfile, GitHub Actions
+  is by its content hash (Docker `@sha256:...`, Go module hash in `go.sum`, npm
-  `@<commit-sha>`). This also means never `curl | bash` to install tools like
+  integrity hash in lockfile, GitHub Actions `@<commit-sha>`). No exceptions.
-  pyenv, nvm, rustup, etc. Instead, download a specific release archive from
+  This also means never `curl | bash` to install tools like pyenv, nvm, rustup,
-  GitHub, verify its hash (hardcoded in the Dockerfile or script), and only then
+  etc. Instead, download a specific release archive from GitHub, verify its hash
-  install. Unverified install scripts are arbitrary remote code execution. This
+  (hardcoded in the Dockerfile or script), and only then install. Unverified
-  is the single most important rule in this document. Double-check every
+  install scripts are arbitrary remote code execution. This is the single most
-  external reference in every file before committing.
+  important rule in this document. Double-check every external reference in
-
+  every file before committing. There are zero exceptions to this rule.
-    There is one exception: a package from the distribution's own package index
-    needs no version and no hash. Pulling that index is also allowed. The
-    distribution is trusted. In a `Dockerfile`, it is the pinned base image's
-    distribution. On a host, it is the host's. These commands are examples:
-    - `apt-get update`
-    - `apt-get install`
-    - `apk update`
-    - `apk add`
-
-    These are not trusted, so everything from them stays pinned by hash:
-    - Docker Hub
-    - PyPI
-    - npm
-    - `go get`
-
-    A package source that a `Dockerfile` adds itself is not the distribution's
-    own, so the exception does not cover it.
 
 - Every repo with software must have a root `Makefile` with these targets:
   `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
@@ -250,8 +233,6 @@ style conventions are in separate documents:
     # Test phase. -race needs cgo and so a C compiler, which the Debian Go
     # image ships and the alpine one does not. -count=1 because the mounted
     # cache also holds test results, which go test would otherwise replay.
-    # A first run that timed out gets no rerun, because a rerun would only
-    # wait for the same hang.
     # golang:1.x, YYYY-MM-DD
     FROM golang@sha256:... AS test
     WORKDIR /src
@@ -260,24 +241,15 @@ style conventions are in separate documents:
     ARG CACHEBUST
     COPY . .
     RUN --mount=type=cache,target=/root/.cache/go-build \
-        status=0; \
+        go test -count=1 -timeout 90s -race -cover ./... || \
-        output=$(go test -count=1 -timeout 90s -race -cover ./... 2>&1) || status=$?; \
+        { echo "--- Rerunning with -v for details ---"; \
-        printf '%s\n' "$output"; \
+          go test -count=1 -timeout 90s -race -v ./...; exit 1; }
-        test "$status" -eq 0 && exit 0; \
-        case "$output" in \
-            *"panic: test timed out"*|*"*** Test killed"*) exit 1 ;; \
-        esac; \
-        echo "--- Rerunning with -v for details ---"; \
-        go test -count=1 -timeout 90s -race -v ./...; \
-        exit 1
 
     # Build stage. Nothing is wanted from either phase above; the copies
     # are what make BuildKit build them first, so nothing after them can
     # run unless lint and test passed.
     # golang:1.x-alpine, YYYY-MM-DD
     FROM golang@sha256:... AS builder
-    # git comes from the base image's own distribution package index, which
-    # is trusted, so it needs no version and no hash.
     RUN apk add --no-cache git
     WORKDIR /src
     COPY go.mod go.sum ./
@@ -413,10 +385,11 @@ style conventions are in separate documents:
       `Pipfile.lock`. It installs no Python there: the tests use the base
       image's Python, which the image's hash pins. If it installs anything else
       there, the step goes after `ARG CACHEBUST`.
-    - PyPI is not trusted, so `script/bootstrap` installs pipenv and its
+    - Every external reference must be pinned by hash, so `script/bootstrap`
-      dependencies by hash. It does so with `pip install --require-hashes -r`
+      installs pipenv and its dependencies by hash. It does so with
-      and a requirements file in `script/` that lists each of them with `==` and
+      `pip install --require-hashes -r` and a requirements file in `script/`
-      its `--hash`. pip refuses to install a dependency the file does not list.
+      that lists each of them with `==` and its `--hash`. pip refuses to install
+      a dependency the file does not list.
     - It then runs `pipenv install --deploy`, with `--dev` when the tests need
       the development packages. `--deploy` installs only what `Pipfile.lock`
       names, checks every package against the lockfile's hashes, and fails when
@@ -440,8 +413,7 @@ style conventions are in separate documents:
     `pipenv install --dev --deploy`:
 
     ```dockerfile
-    # Test phase. Both pytest runs share one 90-second timeout, so a hang
+    # Test phase. The 90-second timeout covers both pytest runs.
-    # uses it once and gets no rerun.
     # python:3.x-slim, YYYY-MM-DD
     FROM python@sha256:... AS test
     # make and git are base tools that script/bootstrap installs when they
@@ -512,19 +484,15 @@ style conventions are in separate documents:
   improvement bug against that repo. Add a 90-second timeout to the test
   invocation (`go test -timeout 90s`). The backstop deliberately sits above the
   hard cap so that it catches a genuinely hung test rather than a merely slow
-  one. A hung package uses the backstop once, because a first run that timed out
+  one.
-  gets no rerun. `-timeout` applies to each package, so several hung packages
-  can each use it.
 
 - **The test command should use the conditional verbose rerun pattern.** Run
   tests without `-v` (verbose) first. If tests fail, automatically rerun with
   `-v` to show full output. This keeps CI logs and `docker build` output clean
   on success (just package/suite summaries) while providing full diagnostic
-  detail on failure (every test case, every assertion). A first run that timed
+  detail on failure (every test case, every assertion). The command lives in the
-  out gets no rerun, because the rerun would only wait for the same hang. The
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
-  command lives in the `test` phase of the `Dockerfile`, since `script/test`
+  Makefile form below is the same pattern for any repo-local invocation:
-  builds that phase; the Makefile form below is the same pattern for any
-  repo-local invocation:
 
     ```makefile
     test:
@@ -537,29 +505,11 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@status=0; \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
-    		output=$$(go test -count=1 -timeout 90s -race -cover ./... 2>&1) || status=$$?; \
+    		{ echo "--- Rerunning with -v for details ---"; \
-    		printf '%s\n' "$$output"; \
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
-    		test "$$status" -eq 0 && exit 0; \
-    		case "$$output" in \
-    			*"panic: test timed out"*|*"*** Test killed"*) exit 1 ;; \
-    		esac; \
-    		echo "--- Rerunning with -v for details ---"; \
-    		go test -count=1 -timeout 90s -race -v ./...; \
-    		exit 1
     ```
 
-    The first run's output is kept so that the recipe can look in it for what Go
-    prints for a hang:
-    - `panic: test timed out` means the test's own timer fired.
-    - `*** Test killed` means `go test` stopped a test that ignored that timer,
-      about a minute later.
-
-    Go prints the goroutine stacks with either line, as long as the test can
-    still respond. A rerun would only wait for the same hang, so the recipe
-    exits 1. A failure with neither line in its output reruns with `-v`. The
-    kept output prints when the first run ends, not while it runs.
-
     `-count=1` is required on both invocations: it defeats Go's test _result_
     cache, so neither run can report a stored pass in place of running the
     tests. It leaves the build cache alone, so it costs the runtime of the suite
@@ -578,25 +528,17 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@timeout 90 sh -c 'python -m pytest || { \
+    	@python -m pytest || \
-    		echo "--- Rerunning with -v for details ---"; \
+    		{ echo "--- Rerunning with -v for details ---"; \
-    		python -m pytest -v; exit 1; }'
+    		  python -m pytest -v; exit 1; }
     ```
 
-    Both pytest runs share that one 90-second timeout, as in the `Dockerfile`
-    example above, so a hang uses it once and gets no rerun. Ctrl-C does not
-    stop a running `make test`, which goes on until the tests end or the 90
-    seconds run out. On a Mac without `timeout`, the target fails until it is
-    installed.
-
     The `exit 1` ensures the target always fails after a rerun — the first run
     already proved the tests are broken, so the build must not pass even if a
     flaky test happens to succeed on the second attempt. The rerun exists solely
     for diagnostic output.
 
-- Docker builds must complete in under 5 minutes. A hung package uses the
+- Docker builds must complete in under 5 minutes.
-  90-second test backstop once, because a first run that timed out gets no
-  rerun.
 
 - `make check` must not modify any files in the repo. Tests may use temporary
   directories.
@@ -716,10 +658,10 @@ style conventions are in separate documents:
   `test-support` depguard rule, where a repo names its own test-support packages
   by full import path. A repo adds entries there and changes nothing else, and a
   re-vendor carries its entries forward. The canonical golangci-lint version is
-  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  v2.15.0 (released 2026-10-16), pinned as the digest of the lint phase's base
   image
-  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  (`golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481`,
-  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  which reports `2.15.0 built with go1.27.0 from 25c5369a`). A module's `go`
   directive must not name a newer Go minor version than the one golangci-lint
   was built with, or golangci-lint refuses to lint it: this release lints
   `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo