fix(factory): resolve generated service endpoints and preserve current runtime

.github/scripts/refresh-apk-pins.sh

@@ -46,6 +46,19 @@ command -v docker >/dev/null || { echo "docker is required to resolve package ve
 base="$(sed -n 's/^ARG GO_IMAGE=\(.*\)$/\1/p' "$DOCKERFILE" | head -1)"
 [[ -n "$base" ]] || { echo "$DOCKERFILE declares no ARG GO_IMAGE" >&2; exit 2; }
 
+# Try the configured HTTPS mirror explicitly at the unchanged pinned digest.
+# Direct registry references cannot express an HTTP mirror's transport policy,
+# so leave those to Docker. If the direct pull fails, Docker also retains its
+# normal ordered mirror/origin fallback through the original reference.
+mirror="$(docker info --format '{{range .RegistryConfig.Mirrors}}{{println .}}{{end}}' | head -1)"
+if [[ "$mirror" == https://* && "$base" == golang:*@sha256:* ]]; then
+  mirror="${mirror#https://}"
+  mirrored="${mirror%/}/library/$base"
+  if docker pull "$mirrored" >&2; then
+    base="$mirrored"
+  fi
+fi
+
 # Every `name=version` token inside the apk add instruction. A RUN spans
 # continuation lines, so the instruction is rejoined before it is read. perl
 # does the joining because BSD sed does not understand \f and `mapfile` is

.github/workflows/manifest-guard.yml

@@ -5,4 +5,4 @@ on:
     branches: [ main ]
 jobs:
   manifest-guard:
-    uses: codefly-dev/.github/.github/workflows/plugin-manifest-guard.yml@78f7890b3e55f420a7d16b2b3e3e655c25e16cc8 # main
+    uses: codefly-dev/.github/.github/workflows/plugin-manifest-guard.yml@aa2b11b43d815ce1195ca881e686f5475c19362a # checksum metadata and Go binding coverage (#11, #12)

AGENTS.md

@@ -111,6 +111,16 @@ rather than re-deriving from `go list`.
 
 ## Rules that bite
 
+- **Factory templates are generated from `base/`, a lock.** Edit the base,
+  remove build artifacts, then run `codefly agent generate --service .`.
+  Never hand-edit `.tmpl` output. `TestFactoryTemplatesRenderToBase` guards it.
+- **Generated services resolve their composition-assigned HTTP address.**
+  Initialize the SDK, then call `ResolveNetworkInstance()` and bind its host
+  and port, including native loopback. Refuse when the SDK has no supported
+  address source, and reject malformed endpoint contracts. Local workspace
+  fallback remains SDK-owned; absent carriers fail without that local source. The factory declares the private HTTP endpoint it serves;
+  the real scaffold process test proves the allocated address and refusal.
+
 - **`Builder.Build` emits a recipe; it does not build an image.** It renders the
   Dockerfile and copies the source into `<output>/code`, and the CLI runs
   buildx. A service with `source-dir: "."` roots its sources where the CLI puts

BUILD-RECIPES.md

@@ -69,3 +69,10 @@ service whose go.mod requires a newer patch is refused outright rather than
 quietly building against something else).
 `apk-runtime.txt` is redundant with the digest by construction, which is the
 point: two builds that disagree on it are evidence the pin stopped holding.
+
+The apk-pin refresher tries the Docker daemon's first configured HTTPS mirror
+with the official Go base's unchanged pinned digest. HTTP mirrors and failed
+direct pulls retain Docker's normal mirror/origin resolution through the original
+Dockerfile reference. The Go-version policy
+test checks the actual `go version | grep -F` smoke command in each workflow;
+a matching version in a comment does not satisfy it.

base/GETTING_STARTED.md

@@ -0,0 +1,18 @@
+# Go Generic Service
+
+A plain Go service with a declared, private HTTP endpoint.
+
+## Structure
+
+- `code/main.go` serves `/health` at the address Codefly assigns to `http`.
+- `code/go.mod` declares the service's dependencies.
+- `service.codefly.yaml` declares the endpoint and development settings.
+
+## Validation and running
+
+From `code/`, build with `go build ./...` and test with `go test ./...`.
+Follow the handbook's [Codefly run instructions](https://github.com/obin-ai/handbook/blob/main/getting-started/codefly.md#how-do-i-run-it)
+to run the service with its resolved identity and endpoint. The generated server
+refuses startup when it cannot resolve that address.
+
+Replace the default handler with your service's behavior.

base/code/go.mod

@@ -0,0 +1,68 @@
+module codefly-base
+
+go 1.27.3
+
+require (
+	github.com/codefly-dev/core v0.19.6
+	github.com/codefly-dev/sdk-go v0.4.3
+)
+
+require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect
+	buf.build/go/protovalidate v1.4.0 // indirect
+	cel.dev/cel-go v0.32.0 // indirect
+	cel.dev/expr v0.25.3 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/analysis v1.0.0 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
+	github.com/go-openapi/jsonpointer v1.0.1 // indirect
+	github.com/go-openapi/jsonreference v1.0.2 // indirect
+	github.com/go-openapi/loads v0.25.3 // indirect
+	github.com/go-openapi/spec v1.0.1 // indirect
+	github.com/go-openapi/strfmt v0.27.2 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/oklog/ulid/v2 v2.1.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/yoheimuta/go-protoparser/v4 v4.14.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 // indirect
+	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.47.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.47.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.47.0 // indirect
+	go.opentelemetry.io/otel/trace v1.47.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/grpc v1.84.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)