[antoinetoussaint-byte]

Main and the published v0.0.12/v0.0.13 runtime still selected Core v0.19.1. This completes the released Core adoption associated with #62 by selecting v0.19.4, including its dependency-graph correction for stable client-go composition.

Only go.mod, go.sum, and README.md change. Core's required transitive floors move genproto API/RPC, gRPC, OpenAPI errors/swag helpers, x/exp and x/sys; go.sum is tidied. SDK v0.3.2 and sdk-go/workcontext v0.1.0 remain selected. No Go source, public API or transport changes, replacements, excludes, or unreleased dependency APIs.

Reuse and classification

This is a fix at the consuming runtime's dependency pin, reusing Core's released implementation and compatibility correction. It introduces no duplicate parser, verifier, transport or dependency workaround. README.md records the selected release and graph constraints: no structured-merge-diff/v7 and no kube-openapi newer than v0.0.0-20260721132016-d427ff9ee9ad.

PR #69 remains the separate transport migration and is untouched. Its owner authorized this minimal main migration and will re-pin its overlapping module files later. This is one self-contained PR from main, with no dependency on #69.

Review and validation

Fresh independent review accepted the exact three-file candidate, patch SHA-256 8f3f4afbd26b5aaec7016915f08081edeb8b69be12a9f8b833b6b96a96e3700d. The report is in the handbook workspace at .lazybox/artifacts/REVIEW-FINDING-3-solution-runtime-go.md.

All local Go checks ran with Go 1.27.2 on darwin/arm64 under the local-only sandbox, offline dependency/toolchain settings, readonly modules during verification, and separate author/reviewer build caches.

• Author: full go test -race ./... -count=1 -timeout=5m passed (root 206.304s; passthroughtest 1.509s), plus build, vet, module verification, tidy consistency, formatting and diff checks. Public API listings are identical.
• Reviewer independently passed the full non-race test suite (root 129.006s), module verification, tidy consistency and graph checks; race/vet evidence was inspected, not independently rerun.
• Runtime graph: 584 edges. Additive client-go v0.37.1 graph: 835 edges. Both satisfy Core's existing graph-guard semantics.
• Author and reviewer built client-go/kubernetes and apimachinery/pkg/util/managedfields against the additive graph. The author also compiled the managedfields test binary. Client-go was added only in a temporary verification modfile, not to this library.

Limits

The attempted managedfields runtime-test command failed at initialization because the published module lacks its referenced api/openapi-spec/swagger.json; the separate build and test-binary compilation establish compile compatibility only. This does not claim compatibility with every client-go release or Kubernetes-server behavior.

No real host/gateway, composition, hosted deployment, TLS/mesh-posture qualification, or external dependency advisory scan was performed. The pre-existing conflict between this runtime's application TLS and the handbook's mesh-owned in-cell transport remains separately scoped to #69. This dependency review does not qualify that posture or authorize deployment.

Draft for review only; no merge, tag or release is requested.

[antoinetoussaint-byte]

Superseded by #69 (fc62c1e): main moved past core v0.19.4 and now pins core v0.19.7-pseudo (8ea6c26) with the authority libraries.