feat(image): export the Go environment as image ENV

[sbp-bvanb]

Set GOROOT/GOPATH/GOBIN as image ENV, so they hold for docker run, docker exec, and non-login shells alike rather than existing only as go env defaults. Scripts and non-Go tooling that read the variables directly now agree with the toolchain. /root/.local/bin joins the default PATH so session-installed tools are runnable by name.

Spelled against a literal /root rather than ${HOME}: Docker does not define HOME at build time, so "${HOME}/go" would expand to /go. /root is correct for both paths through the entrypoint — the legacy root fallback, and the dropped-privilege user, whose passwd entry is created with -d /root. GOBIN is spelled out rather than written as ${GOPATH}/bin for the same class of reason: Docker resolves a reference against the value from before the current instruction.

PATH is "/usr/local/go/bin:${PATH}:/root/.local/bin:/root/go/bin". Both /root/.local/bin and /root/go/bin are agent-writable and live in the persistent claude-code-root volume, so both sit after every system path: a binary one session leaves in either must never be able to shadow git/gh/aws on a later run. Tools installed into either stay runnable by name; only deliberate overrides of a system binary are given up. smoke/assert-in-container.sh now enforces that ordering, which the requirement has asserted in prose since it was written but never tested.

The spec change goes through OpenSpec: openspec/changes/archive/2026-08-29-export-go-env/ carries the proposal, the design note arguing the trailing position, and the delta; openspec/specs/go-toolchain/spec.md is regenerated from it. The requirement is renamed from "keeps GOPATH binaries non-shadowing" to "keeps volume-persisted directories non-shadowing", with scenarios covering both directories.

No TASK_X_REMOTE_TASKFILES in this PR. The first commit's subject (1ddfa7b) wrongly claims it; the diff has always said the opposite. That subject is superseded — do not use it as the squash-merge subject; use this PR title.

Not build-verified locally: no container runtime in this environment. CI's docker build and smoke matrix cover it.

[dtump]

BLOCKED · 3 block, 2 fix, 1 later

The Go environment export is a real improvement and most of the reasoning in the comments is right. Three things need to change before this can merge, one of them a security regression that the spec edit quietly authorises.

Blocking

1. /root/.local/bin in first position re-opens the shadowing hole this spec exists to close

Dockerfile:293 puts /root/.local/bin ahead of every system path — before /usr/bin, /usr/local/bin, everything. Three facts make that load-bearing:

• /root is the persistent claude-code-root named volume (run.sh:861), so the directory survives across sessions and across workspaces.
• The image PATH survives the privilege drop — entrypoint.sh:89 is exec runuser -u claude, not runuser -l, so the ENV reaches the agent unchanged.
• Nothing the image ships ever writes there. There is no pipx, no pip install --user, no uv tool install anywhere in the Dockerfile. By construction, every byte on that path is written by a session.

So: a prompt-injected --yolo session writes /root/.local/bin/gh; a later session, in an unrelated workspace, runs gh and executes the planted binary with that session's credentials. That is precisely the scenario openspec/specs/go-toolchain/spec.md:135 forbids for /root/go/bin, and the reason the existing requirement pins that directory last.

The commit body says the change puts the prefix "ahead of /usr/local/go/bin", and the spec paragraph says it "MAY precede /usr/local/go/bin". Both understate the reach: because /usr/local/go/bin was already first, preceding it means preceding /usr/bin/git too.

Fix: PATH="/usr/local/go/bin:${PATH}:/root/.local/bin:/root/go/bin". Tools installed into the user prefix stay runnable by name — the only capability lost is deliberately overriding a system binary, which is the thing the invariant forbids.

2. The title and commit message describe a change that isn't in the diff

The PR title is "export Go environment and task remote-taskfiles opt-in", and the commit body opens with "Set GOHOME/GOPATH/GOBIN/GOROOT and TASK_X_REMOTE_TASKFILES=1 as image ENV". The diff sets no such variable — Dockerfile:275 on this branch says the opposite, in your own words: "No TASK_X_REMOTE_TASKFILES here."

The decision itself is well-researched and I'd keep it. The problem is that the headline is what lands in main's history: anyone later auditing task's network behaviour reads the log, sees the image opting into remote taskfiles, and reaches the wrong conclusion. Retitle to the Go-env change and drop the claim from the body.

3. The spec was hand-edited instead of proposed as a change

openspec/specs/go-toolchain/spec.md is generated output. The same requirement lives in openspec/changes/archive/2026-08-20-add-go-toolchain/specs/go-toolchain/spec.md:102, still carrying the original "first … last, after every system path" wording, so archive and spec now disagree with no record reconciling them.

More importantly, this is where the security guarantee gets traded away, and the trade is recorded as a single asserted sentence — "the distinction is intent, not trust" — with no proposal, no design note, and no reviewer sign-off. CONTRIBUTING.md:11 asks for a change proposal for exactly this. Propose it, let archive regenerate the spec, and the rationale gets reviewed on its own terms rather than arriving as a fait accompli inside an ENV commit.

Worth fixing

4. The requirement's title and scenario no longer cover what it permits

openspec/specs/go-toolchain/spec.md:117 still reads "PATH ordering keeps GOPATH binaries non-shadowing", and its only scenario (:135) tests /root/go/bin. The new allowance ships with nothing stating what /root/.local/bin may and may not shadow. Retitle to cover volume-persisted PATH entries generally, and add a scenario for the new directory — otherwise the next reader greps the title, concludes the requirement is about go install output, and misses that the same file now permits a first-position writable directory.

5. GOHOME is not a Go variable

Dockerfile:267 introduces GOHOME purely to work around ENV self-reference, and it then ships in every session's environment. go env ignores it. Someone will eventually pass -e GOHOME=/other expecting GOPATH and GOBIN to follow, and get nothing — both are baked at build time. Spell /root/go and /root/go/bin literally; the comment right above already argues for literal /root over ${HOME} for the same class of reason.

Later

smoke/assert-in-container.sh has no PATH-ordering assertion at all — the only PATH-adjacent check is no-sudo at :159. So the existing GOPATH non-shadowing scenario has never actually been enforced by a test. That gap predates this PR and belongs in an issue, but if the resolution to (1) keeps any agent-writable directory on PATH, the assertion belongs in the same commit.

Strengths

• The ${HOME} analysis is correct and worth the comment it got. Docker does not define HOME at build time, so "${HOME}/go" really would expand to /go — a subtle enough failure that spelling out the reasoning inline is the right call.
• The ENV self-reference gotcha is real. Docker resolving ${GOHOME} against the value from before the current instruction is exactly the kind of thing that produces a silent /bin and a confusing bug report. Correct diagnosis, even though I'd rather drop the variable than keep the workaround.
• Declining TASK_X_REMOTE_TASKFILES was the right call, for the right reason. Noticing that the experiment shipped in 3.53.1 and that setting the flag now makes every task invocation warn is good research, and classing remote taskfiles alongside pnpm dlx/uvx/go install matches how the threat model already reasons about runtime code-fetch.
• Exporting GOROOT/GOPATH/GOBIN rather than leaning on go env defaults genuinely helps non-Go tooling that reads the variables directly, and keeping /root/go/bin last while doing it shows the existing invariant was on your mind.
• "Not build-verified" in the description was the honest thing to write. For what it's worth, CI's docker build and the smoke matrix have since passed on this branch, so that caveat is now covered.

[sbp-bvanb]

All five actionable points addressed in 6c11723. Thanks — point 1 was a real hole and the reasoning about why it was one (nothing in the image writes there, so every byte is session-written) is what made the fix obvious rather than a judgement call.

1. /root/.local/bin first position. Fixed, exactly as proposed:

PATH="/usr/local/go/bin:${PATH}:/root/.local/bin:/root/go/bin"

The "meant to win" framing is gone from the comment and the spec. The design note now states the reason it doesn't transfer: on a workstation ~/.local/bin is under the control of the person typing; here it's written by an agent into a volume read by later sessions in other workspaces holding other credentials, and there is nothing the image can check that distinguishes it from /root/go/bin — same volume, same writer, same lifetime.

2. Title and commit body. PR retitled to the Go-env change alone and the body rewritten; the TASK_X_REMOTE_TASKFILES claim is gone. 1ddfa7b itself is left in place rather than force-pushed, so the body now carries an explicit note that its subject is superseded and must not be used as the squash-merge subject. The Dockerfile comment recording why the opt-in is declined stays, and the reasoning is now also in the proposal's non-goals so it survives outside a comment.

3. Hand-edited spec. Reverted to main's content and redone through OpenSpec. openspec/changes/archive/2026-08-29-export-go-env/ carries proposal, design, tasks, and delta; openspec/specs/go-toolchain/spec.md is regenerated by openspec archive. openspec validate --strict passes.

4. Requirement title and scenario coverage. Renamed via REMOVED + ADDED (the pattern from 2026-08-25-container-git-config-overlay): "PATH ordering keeps volume-persisted directories non-shadowing". Five scenarios — the two originals, plus a planted /root/.local/bin/gh losing to the system gh, a user-prefix install being runnable by name, and one binding the smoke assertions.

5. GOHOME. Dropped. Both paths spelled literally; the ENV self-reference gotcha survives as a comment rather than as a shipped variable.

Deferred item. Pulled into this commit, since the resolution keeps agent-writable directories on PATH. check_path_order() asserts /usr/local/go/bin < /usr/bin, /usr/bin < /root/.local/bin, /usr/bin < /root/go/bin, command -v git = /usr/bin/git, and the three exported GO* values. So the non-shadowing requirement is enforced by a test for the first time. Worth noting the assertion pins /usr/bin/git — if a future change moves git, that fails loudly rather than silently stopping to test anything, which is the intended failure mode.

Still no container runtime on my side, so docker build and the smoke matrix are CI's word, not mine.