[antoinetoussaint-byte]

Bootstrap recipes through agent v0.0.147 download checksum-pinned upstream migrate v4.19.1 executables. Those binaries retain vulnerable dependencies even when this repository updates its own Go module or rebuilds consumers. This change builds migrate from the agent's maintained module graph with the PostgreSQL/file drivers, using a digest-pinned Go 1.27.3 builder and cross-compiling for linux/amd64 and linux/arm64.

Classification: fix in service-postgres, the owner of the bootstrap recipe. It reuses the existing bootstrap lock, atomic context stager, recipe/provenance interface, and parent go.mod/go.sum. No new migration implementation, engine, companion, or independent module graph. Core's Python/proto changes and PostgreSQL #193 are separate and untouched. Existing #173 patched parent dependencies, #190 removed curl, and #197 corrected runtime musl; none replaced the migrate archives. #170 is already merged; this is a successor PR in the same existing branch/workspace.

The source stage verifies the embedded module-file hashes before compiling with -mod=readonly, GOTOOLCHAIN=local, and CGO disabled. Provenance includes the exact builder digest, source version, driver set, and both module-file hashes; the normal recipe/context digest includes the staged inputs. The final image receives only the executable and cleaned bootstrap artifacts, excluding the compiler and unused parent module manifests. The existing TARGETARCH fallback is preserved. Migration SQL, advisory locks, ledgers, budgets, and dirty-state behavior are unchanged.

The source-only resolver updates migrate's portion of bootstrap-image.json without Docker; the existing full resolver calls it when refreshing all bootstrap inputs. No lock digest is hand-authored. The new builder is golang:1.27.3-alpine3.24@sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb, resolved from registry bytes and verified for both architectures.

Evidence and tests:

• Downloaded the old amd64 archive and verified its exact locked SHA256 2ac648fbd1b127b69ab5a7b33cf96212178f71e22379fc50573630c6f4c7ce18. Actual build metadata records Go 1.25.4, x/crypto 0.45.0, x/net 0.47.0, pgx/v5 5.5.4, grpc 1.74.2, go-jose/v4 4.0.5, and OpenTelemetry 1.37.0/SDK 1.36.0. Its binary govulncheck reports 92 vulnerabilities from 12 modules and the standard library.
• Actual candidate linux/amd64 and linux/arm64 binaries record Go 1.27.3, migrate v4.19.1 and only lib/pq v1.12.3 as an external dependency. All six vulnerable dependency families above are absent. govulncheck -mode=binary reports No vulnerabilities found for each candidate.
• Tests execute the rendered source-build shell for both architectures and inspect each binary's actual module graph. Modified module inputs fail checksum verification before compilation. Builder tests verify staged module bytes/hashes and existing deterministic recipe identity; template tests preserve explicit architecture and legacy fallback behavior.
• Passed host go build ./..., go vet ./..., go mod tidy -diff, focused bootstrap/builder/release/dev/context/conformance tests, resolver re-resolution, shellcheck, and git diff --check.

Docs updated: docs/bootstrap-migrate.md, AGENTS.md, and .claude/skills/bootstrap-image-lock/SKILL.md describe source maintenance, exact provenance, dependency evidence, and image verification.

Not verified locally: no Docker/engine commands were run; multi-architecture container builds, bootstrap/database parity, the full container-dependent suite, full Alpine package refresh, and the 11 actual migration-image scans require an allocated interval. Binary vulnerability clearance is not image clearance. Runtime/base/package pins are unchanged. Consumers must adopt the corrected agent and rebuild their migration images; old agent releases still emit the vulnerable archive recipe. Hosted CI and independent review are required before merge; Root coordinates merge and Blue owns actual consumer image build/scan evidence.