feat(hosted): golang hosted redirect via fork-replace + committed go.sum pin (free tier) - #173

What

Makes scan --mode hosted work for Go (free tier), overturning docs/design/golang-hosted-no-go.md. The committable shape:

go.mod:  replace github.com/foo/bar v1.4.2 => patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1
go.sum:  patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1 h1:…          (flavor zip dirhash)
         patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1/go.mod h1:…   (served .mod bytes)

The load-bearing fact (validated empirically against go 1.26, with a bogus-GOSUMDB tripwire): go consults the checksum database only for modules absent from go.sum — committed hashes are the committable per-module sumdb exemption the no-go doc said Go lacked. A grant-free, content-addressed module path keeps the build-once converter (one artifact per patch), and free-tier publicity makes proxy.golang.org caching a robustness win instead of a leak. Paid tier stays vendored, as documented (docs/design/golang-hosted.md carries the full validated-claims list and the server requirements).

Changes

• rewrite_golang is now a real rewriter (was: unconditional redirect_golang_unsupported). Activates per-dep on registry_override.kind == "goproxy"; fails closed (per-dep redirect_golang_* warnings, zero partial writes) on missing/malformed hashes (h1: + 44-char base64), a module path outside patch.socket.dev/gopatch/, whitespace/control chars in any token (go.mod/go.sum injection guard), a require-version mismatch (a version-pinned replace the graph doesn't select is SILENTLY inert — validated), or a user-authored replace conflict. References without the override keep the historical warning, so behavior is unchanged until the server publishes hosted Go modules (production has zero golang patches today; server half: SocketDev/depscan#24218).
• go_mod_edit: ReplaceOwner::Hosted (ownership = RHS module path under the socket namespace), module-target replace parsing/upsert, in-place cross-owner takeover, gofmt-shaped appends (tidy-stable). New pure go_sum_edit: sorted upsert of the flavor's two lines + prune of the replaced original's lines (removed lines ride the ledger original).
• Cross-mode safety (adversarially reviewed, 9 confirmed findings fixed): local apply refuses a Hosted-owned replace (taking it over would strand the pruned go.sum lines and brick later builds); apply --check exempts hosted-owned modules from MissingReplace drift; vendor takeover of a hosted replace is ledger-recorded and revert warns to re-run scan --mode hosted or go mod tidy; a committed-but-inert stale pin is reconciled away so it can't false-confirm ledger/VEX.
• scan --mode hosted wiring: go.mod/go.sum join the candidate files, the redirected-confirmation matcher accepts the socket module path (a Go rewrite contains no URL), and the server's identifiers-borne hash pair (goZipDirhashH1/goModH1) merges into the normalized integrity — the tarball's dirhashH1 stays the original-path flavor that released vendor-mode CLIs verify against.

Testing

• Capstone e2e_golang_hosted_build.rs: a fresh "day-2 machine" (empty caches, default -mod=readonly, bogus GOSUMDB that fails loudly if ever consulted, hostile ambient env baked in as RED guards) builds the PATCHED module from the committed go.mod+go.sum alone; go mod tidy is a byte-level no-op; a tampered hash dies with go's checksum SECURITY ERROR; a positive tripwire control proves the bogus sumdb actually fires when a line is missing.
• Golden fixture golang/gomod/basic pins the byte contract the depscan TS twin matches (its inline copy already passes there); ~30 unit tests across the editors/rewriter; full suites green.
• Merge order: this PR and depscan#24218 are independent to merge, but the depscan submodule bump that follows this merge must land AFTER depscan#24218 (its golden harness has no skip list).

🤖 Generated with Claude Code