mir-backend-golisted

Make It Right (Go runtime tier). Go 1.25/1.26 runtime reliability footguns shared across every Go backend framework (Gin, Fiber, Echo, chi, stdlib net/http) — distinct from the generic backend gates and from any one framework's mechanics. Covers: goroutine leaks (the #1 Go reliability bug) and the runtime goroutineleak profile, context propagation and cancellation, data races and `go test -race`, channel ownership rules, goroutine-level panic recovery, the nil-interface/nil-pointer trap, defer-in-loop resource buildup, slice aliasing, error wrapping with errors.Is/As/AsType, sync.WaitGroup.Go, the Go 1.22 per-iteration loop-variable change and its go.mod gating, deterministic concurrency tests with testing/synctest, container-aware GOMAXPROCS, log/slog structured logging, and Go-level security mechanics (http.Server timeouts, net/http CrossOriginProtection, os.Root path containment, SSRF dialer control, module checksum verification, govulncheck). TRIGGER when the backend runtime is Go — sits between mir-backe
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-go · Make It Right (Go runtime) The middle tier. `mir-backend` decides **what is correct** (any language). The framework module (e.g. `mir-backend-go-gin`) knows the **library's mechanics**. This tier owns what is true for **all Go backends because they run on the Go runtime** — the goroutine scheduler, memory model, and process model that Gin, Fiber, Echo, chi, and raw `net/http` all inherit. **Runtime state, verified 13 Aug 2026.** Load order: `mir-backend` → `mir-backend-go` → `<framework module>`. | Release | Status | Notes | |---|---|---| | Go 1.26 (1.26.5, 2026-07-07) | current stable | Green Tea GC on by default; `goroutineleak` profile behind `GOEXPERIMENT=goroutineleakprofile`; `errors.AsType`; `slog.NewMultiHandler` | | Go 1.25 (1.25.12, 2026-07-07) | supported | `sync.WaitGroup.Go`; `testing/synctest` stable; container-aware `GOMAXPROCS`; `net/http.CrossOriginProtection` | | Go 1.24 and older | **end of life** | No security patches. Go supports each major only until two newer majors exist | | Go 1.27 | RC2 as of 2026-07-07, expected Aug 2026 | Final release not confirmed at time of writing — verify before relying on it | **Set the floor at Go 1.25.** Anything below it is an unpatched toolchain. Note the two version knobs are different things: the *toolchain* you build with decides which security fixes you have; the `go` line in `go.mod` decides which *language and GODEBUG defaults* apply (see footgun 11). ## The Go footguns AI walks into (framew