review-golisted

# Review Go Correctness and security review for Go. The checklist is the baseline and runs whether or not any tool is installed; present tools sharpen it. A check that did not run is named in the report — never omitted, never reported as clean. ## Procedure Follow `../../references/procedure.md`. In short: probe, scope, run what exists, walk the checklist by hand over every file in scope, score per `../../references/rubric.md`, emit both artifacts. ## Capability probe ```bash command -v go # go vet, go build, go test command -v staticcheck command -v gosec command -v govulncheck command -v errcheck ``` | Tool | Invocation | If absent | |---|---|---| | `go vet` | `go vet ./...` | install Go — nothing else here works either | | `staticcheck` | `staticcheck ./...` | `go install honnef.co/go/tools/cmd/staticcheck@latest` | | `gosec` | `gosec -quiet ./...` | `go install github.com/securego/gosec/v2/cmd/gosec@latest` | | `govulncheck` | `govulncheck ./...` | `go install golang.org/x/vuln/cmd/govulncheck@latest` | | `errcheck` | `errcheck ./...` | `go install github.com/kisielk/errcheck@latest` | Several missing at once? The suite ships `review-tools.sh`, which probes and installs the whole toolchain in one pass. **Name it in `## Checks skipped` and leave running it to the user** — a review reports, it does not install. These tools exit non-zero when they find something. That is a result, not a crash — see the error handling rules in `../../references/procedure.md