菜单
Use when editing go.mod, Makefile, bumping the Go toolchain version, addressing govulncheck stdlib vulnerabilities, or when `make verify` fails with `go: go.mod requires go >= X.Y.Z (running go X.Y.Z; GOTOOLCHAIN=goX.Y.Z)`. Keeps the two Go version pins (`go.mod` and `Makefile`) in lockstep.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when a human or agent needs to do exploratory QA on existing Itervox UI before/after a UI change. Drives both the route-mocked Playwright lane and the real-daemon lane, then captures qualitative issues (visual hierarchy, copy, accessibility) automated tests cannot. Produces a structured report under `docs/qa-reports/`.
Use when editing any file in internal/orchestrator/, when adding or modifying fields on structs in internal/config/config.go, or when discussing concurrency, state mutations, locking, goroutines, or race conditions in the itervox Go codebase. Enforces the single-goroutine state machine rule and the exact cfgMu guard list.
Use before claiming any change is complete, before creating a commit or PR, or when the user asks "is this ready" / "are we done" / "can I merge". Also use when the user mentions test failures, coverage drops, or CI red. Enforces running `make verify` and related gates with evidence before asserting success.
Use when editing any file in web/src/ that performs HTTP requests or opens SSE streams — any .ts/.tsx file outside web/src/auth/ that uses fetch, EventSource, or adds a new query/mutation under web/src/queries/. Enforces bearer-token transport rules so frontend network I/O stays compatible with ITERVOX_API_TOKEN auth and the AuthGate login flow.
Use when `change-impact-review` surfaces a breaking change, OR when you're about to remove/rename an exported Go symbol, remove/rename a Zod schema field, change an HTTP route's shape, rename a WORKFLOW.md config field, or alter the semantics of a field without changing its name. This skill is a HARD STOP — no code changes until the user explicitly confirms.
Use BEFORE editing any exported Go symbol (type, function, interface, struct field), any HTTP route in `internal/server/`, any SSE event shape, any Zod schema in `web/src/types/schemas.ts`, any WORKFLOW.md config field, or any public API surface. Produces a structured impact analysis listing affected call sites, schema parity risks, and regression surface before code changes begin.
| name | go-toolchain-sync |
| description | Use when editing go.mod, Makefile, bumping the Go toolchain version, addressing govulncheck stdlib vulnerabilities, or when `make verify` fails with `go: go.mod requires go >= X.Y.Z (running go X.Y.Z; GOTOOLCHAIN=goX.Y.Z)`. Keeps the two Go version pins (`go.mod` and `Makefile`) in lockstep. |
itervox pins the Go toolchain in two places. They MUST match byte-for-byte.
| File | Line | Current |
|---|---|---|
go.mod | 3 | go 1.25.9 |
Makefile | 6 | export GOTOOLCHAIN := go1.25.9 |
CI is the single-source-of-truth pattern: .github/workflows/ci-go.yml and release.yml use actions/setup-go@v6 with go-version-file: go.mod. Never hardcode go-version: in workflow YAML.
gofmt -l -w .
go vet ./...
go: go.mod requires go >= 1.25.9 (running go 1.25.8; GOTOOLCHAIN=go1.25.8)
make: *** [vet] Error 1
The Makefile's export GOTOOLCHAIN overrides the contributor's shell unset GOTOOLCHAIN because make rebuilds the env on every invocation. The fix is always: align the two pins.
go.mod line 3: go 1.X.Y -> new versionMakefile line 6: export GOTOOLCHAIN := go1.X.Y -> matching version (update the comment too if present)go build ./... (toolchain auto-downloads; watch for go: downloading go1.X.Y)make verify (confirms both pins align and full suite passes)govulncheck -tags dev ./... (confirms the bump closes the intended CVEs).github/workflows/*.yml for go-version: literals — must not exist; only go-version-file: go.modgo: requires go >= X.Y.Zgo env GOTOOLCHAIN.auto, run go env -w GOTOOLCHAIN=auto.$GOPATH/sdk/.Stdlib vulns (crypto/x509, crypto/tls, archive/tar, net/http, ...) are fixed by bumping to the patch release listed in Fixed in: std@goA.B.C. Bumping go.mod + Makefile in lockstep is the entire fix — no code changes.
Makefile GOTOOLCHAIN export. It is the defense against "works on my machine" drift from contributor /usr/local/go installs.