chore(release): prepare v0.3.1

[steipete]

Stamps the changelog for v0.3.1 (Go 1.26.6 toolchain floor — ships the patched stdlib in released binaries).

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 14, 2026, 4:21 PM ET / 20:21 UTC.

ClawSweeper review

What this changes

This PR changes the changelog heading from Unreleased to v0.3.1 dated 2026-08-14 for the existing Go toolchain security update.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep open: the release stamp accurately records the Go 1.26.6 security floor already on main, and the one-line diff has no correctness finding; real release-preparation evidence is still needed before merge.

Priority: P1
Reviewed head: 049af5de64fd355918036a39f9589a73e687971b

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The release stamp is clean and consistent, but required real behavior proof is absent.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: No redacted post-change terminal output, release-preparation transcript, artifact verification, or other real behavior evidence is present; add evidence from a release-preparation checkout before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: No redacted post-change terminal output, release-preparation transcript, artifact verification, or other real behavior evidence is present; add evidence from a release-preparation checkout before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Proposed release stamp: The branch changes only the top changelog heading to v0.3.1 and retains the existing Go 1.26.6 advisory entry. Current toolchain state: Current main already declares Go 1.26.6, matching the changelog entry being versioned. History provenance: The current Go floor and changelog entry date to the main-branch commit “build: move Go floor to 1.26.6 (#164)”, authored by Peter Steinberger on 2026-08-14.
Findings	None	None.
Security	None	None.

How this fits together

ClickClack’s release process turns the changelog and current source into signed, verified release artifacts. This PR records which release will ship the already-configured Go toolchain floor.

flowchart LR
A[Go toolchain update] --> B[Unreleased changelog entry]
B --> C[Release preparation PR]
C --> D[Signed release tag]
D --> E[Verified published artifacts]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: No redacted post-change terminal output, release-preparation transcript, artifact verification, or other real behavior evidence is present; add evidence from a release-preparation checkout before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Until the signed v0.3.1 tag and documented artifact-verification flow complete, merging would advertise a release that has not yet been published.
• Complete next step (P2) - Await contributor-provided real release-preparation evidence and the normal signed-tag/publish sequence; no mechanical repair was identified.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release metadata scope	1 line changed in 1 file	The patch is limited to the version heading for the existing security-toolchain release note.

Merge-risk options

Maintainer options:

1. Complete the normal release sequence (recommended)
   Merge after required checks complete, then create and verify the signed v0.3.1 tag and publish through the documented release workflow.
2. Hold the version stamp
   Leave this PR open if a verified v0.3.1 release is not currently intended, so the changelog remains accurate.

Technical review

Best possible solution:

Publish v0.3.1 from the Go 1.26.6 source through the signed-tag and verified-artifact release flow, retaining this changelog stamp as the version record.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is release metadata, not a reported runtime defect.

Is this the best way to solve the issue?

Yes. A minimal changelog heading follows the prior release convention; the documented signed-tag and artifact-verification flow is the appropriate completion path.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against c9f21280aa11.

Labels

Label changes:

• add P1: This prepares release delivery of the patched Go 1.26.6 toolchain for four listed security advisories.
• add merge-risk: 🚨 other: The only merge-specific risk is release metadata claiming v0.3.1 before signed-tag and artifact publication complete.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No redacted post-change terminal output, release-preparation transcript, artifact verification, or other real behavior evidence is present; add evidence from a release-preparation checkout before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P1: This prepares release delivery of the patched Go 1.26.6 toolchain for four listed security advisories.
• merge-risk: 🚨 other: The only merge-specific risk is release metadata claiming v0.3.1 before signed-tag and artifact publication complete.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No redacted post-change terminal output, release-preparation transcript, artifact verification, or other real behavior evidence is present; add evidence from a release-preparation checkout before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Proposed release stamp: The branch changes only the top changelog heading to v0.3.1 and retains the existing Go 1.26.6 advisory entry. (CHANGELOG.md:3, 049af5de64fd)
• Current toolchain state: Current main already declares Go 1.26.6, matching the changelog entry being versioned. (go.mod:3, c9f21280aa11)
• History provenance: The current Go floor and changelog entry date to the main-branch commit “build: move Go floor to 1.26.6 (build: move Go floor to 1.26.6 #164)”, authored by Peter Steinberger on 2026-08-14. (CHANGELOG.md:5, c4ad226d318d)
• Release procedure: The documented procedure requires a verified signed tag and publishes the draft only after artifact checks succeed. (docs/releasing.md:88, c9f21280aa11)
• Release boundary: The local release tags end at v0.3.0 and no tag contains the Go 1.26.6 commit, so v0.3.1 is not yet established as a released version. (c4ad226d318d)

Likely related people:

• steipete: Peter Steinberger authored the current-main Go floor change and the prior v0.3.0 release preparation commit. (role: recent release and toolchain contributor; confidence: high; commits: c4ad226d318d, 93ff8e2ca314; files: CHANGELOG.md, go.mod, docs/releasing.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted terminal or release-verification output showing the v0.3.1 release-preparation state and Go 1.26.6 floor, then update the PR body for re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.