[lusoris]

gosec findings in the Go tools drop from 280 on main to 31, and all 31 left are in the frozen P1-SRC-02 runner. Every other finding is fixed in code or marked at its line with a reason; no finding is anchored in a baseline file.

The one injection-shaped site, first

tools/knowledge-mcp/projection.go built SELECT COUNT(*) FROM <table> with the table name taken from the receipt it reads in. The first commit checks every receipt table against the fixed projectionColumns allowlist before any query and fails with the unknown name. projection_table_guard_test.go plants a receipt table x; DROP TABLE components: it fails before the guard and passes after.

The projection validator is split into one function per check; the checks run in the same order as before.

The other findings

• G104 (unhandled errors): handled, wrapped or joined with the cleanup error; none marked.
• Fixed in code as well: G115 integer conversions through a checked helper, G122, G301 and G302 directory and file modes, G306 write modes, G602, and some G204, G304 and G703 sites.
• 87 line marks #nosec Gxxx -- reason, each naming why the input is safe: G304 35, G703 19, G204 12, G704 6, G202 4, G401 3, G505 3, G101 2, G302 1, G306 1, G702 1.
• G401 and G505 stay: Git blob object ids are SHA-1 by protocol, and SHA-256 binds the bytes separately.
• G101 stays: the two strings are public tokenizer version ids, not credentials.

The frozen runner keeps its bytes

tools/knowledge-registry/source-acquisition-runner is the P1-SRC-02 runner (review state implementation_frozen); p1-src03-acquisition-runner/runner_test.go pins the sha256 of its files. Any fix or line mark there would break those pins, so the module stays byte-identical to main and keeps its 31 findings (G104 25, G115, G602, G401, G505, G704 2). The adoption change declares them as a dated per-file exception until the runner is frozen again with fixes.

Verification

• gosec ./... per module: 0 issues in eight modules, 31 in the frozen runner.
• The frozen runner files match all 7 pinned digests.
• go test -p 4 -count=1 ./... passes in seven modules. knowledge-retrieval (5) and p1-src03-acquisition-runner (3) fail on exactly the tests main fails: 2 read the canonical JSON vectors, which the adoption change adds, and 6 read shared registry data this repository does not hold yet. A follow-up change makes those 6 read a declared data root and skip by name without it.
• The commits are split per module so each one can be reviewed and reverted on its own.
• The cleanup-error and checked-I/O helpers are copied into each module that needs them: every tool is its own Go module and there is no shared library module yet. praetorctl dedupe scan . counts 94 duplicate function groups on this branch against 80 on main.

Order: engine-adoption-knowledge-gosec-debt-20261023