Generate new games against SDK v0.0.2 and smoke-test released modules

[nicodes]

Closes aviorstudio/termcade-be#47

What

• termcade dev new scaffolds pinned SDK v0.0.1 while v0.0.2 is the current release. The go.mod template now requires github.com/aviorstudio/termcade/sdk v0.0.2 via a scaffoldSDK constant.
• New consumer gate in scaffold_test.go: a generated project in a temp dir outside this repository must
  1. pin the released SDK (TestScaffoldRequiresReleasedSDK),
  2. resolve only released modules — the preload fetches the SDK into a test-owned GOMODCACHE with explicit proxy/checksum policy (GOPROXY=https://proxy.golang.org,direct, GOSUMDB=sum.golang.org, GOWORK=off, verified against this repo's go.sum), the test asserts the released SDK zip actually landed in that isolated cache, then the consumer phase runs with GOPROXY=off against it; go list -m asserts no replace is in effect and the SDK resolves to exactly the pinned release,
  3. build with GOWORK=off and package/ABI-validate as WASI via dev build (which runs the same plugin.Runtime.Compile export check an install enforces).

Failure proofs (gates can fail)

Unavailable SDK version (scaffoldSDK = "v0.0.99"):

--- FAIL: TestScaffoldRequiresReleasedSDK (0.00s)
    scaffold_test.go:16: scaffoldSDK = v0.0.99, want v0.0.2
--- FAIL: TestScaffoldedGameBuildsAsAReleasedConsumer (0.07s)
    scaffold_test.go:86: go mod tidy: exit status 1
        go: downloading github.com/aviorstudio/termcade/sdk v0.0.99
        go: example.com/test/pong imports
        	github.com/aviorstudio/termcade/sdk: module lookup disabled by GOPROXY=off
        go: example.com/test/pong/cmd/wasm imports
        	github.com/aviorstudio/termcade/sdk/tcgame: module lookup disabled by GOPROXY=off

Preload/consumer boundary (consumer pointed at a different, empty cache than the preload filled):

--- FAIL: TestScaffoldedGameBuildsAsAReleasedConsumer (0.16s)
    scaffold_test.go:86: go mod tidy: exit status 1
        go: downloading github.com/aviorstudio/termcade/sdk v0.0.2
        go: example.com/test/pong imports
        	github.com/aviorstudio/termcade/sdk: module lookup disabled by GOPROXY=off
        go: example.com/test/pong/cmd/wasm imports
        	github.com/aviorstudio/termcade/sdk/tcgame: module lookup disabled by GOPROXY=off

Both restored; all tests pass.

Verification (local, Go 1.26.5)

• gofmt -l . — clean
• go vet ./... && go vet ./sdk/... — clean
• go test -race -count=1 -timeout 10m ./... ./sdk/... — all packages ok
• GOWORK=off go build ./... && GOWORK=off go vet ./... — clean (released-consumer gate)
• CI build action equivalent: cross-compiled linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64 — all OK

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[nicodes]

Review 1

Findings

1. P1 — Released-consumer gate is not cold-cache or network-config isolated. scaffold_test.go:30-37
   The preload uses the caller’s shared GOMODCACHE and inherited GOPROXY; only the subsequent commands set GOPROXY=off. On a clean cache with GOPROXY=off (or an unavailable corporate proxy), go test fails during preload rather than exercising the intended offline consumer build. Conversely, a warm/contaminated cache can mask proxy-resolution problems. Use a test-owned GOMODCACHE and explicitly configure the preload proxy/checksum behavior before disabling proxy access for the generated project.

Residual risks / review method

Reviewed only the pinned one-commit diff b1099aeb40fa1ad44983d9c5a261d7d887308697...65c0b7c0556e9f9760fe83c7835452b11323e323 (two files, 88 changed lines), plus pinned surrounding build/module code. CI was reported successful; I did not execute tests in this read-only review. The package/ABI path is exercised after preload, but cold-cache and proxy-isolation acceptance remains unproven.

Verdict: NEEDS ATTENTION

[nicodes]

Review 1 reply

Fixed in ee6b86e. The preload now owns a fresh GOMODCACHE and uses explicit GOPROXY=https://proxy.golang.org,direct, GOSUMDB=sum.golang.org, and GOFLAGS=-modcacherw; committed go.sum values still authenticate content. A filesystem assertion proves the v0.0.2 module zip landed in that isolated cache. The generated consumer then uses the same cache with GOPROXY=off and GOWORK=off, so ambient cache and workspace state cannot satisfy it.

The boundary was deliberately broken by pointing the consumer at another empty cache; go mod tidy failed with module lookup disabled by GOPROXY=off. Restored tests, full race suite, vet, GOWORK=off build/vet, five-target cross-build, and head CI pass. Residual risk is explicit: a fully cold runner needs one network fetch from proxy.golang.org for preload, matching the repository consumer-build convention; the generated consumer phase itself remains offline.

[nicodes]

Review 2 reply

No findings require changes. The cold-cache network dependency is accepted and documented: preload explicitly reaches proxy.golang.org once under committed checksum verification, matching the repository’s existing released-consumer gate; only the generated consumer phase claims offline isolation. Head CI is green.

Disposition: Review 2 is approving.

[nicodes]

Review 2

No findings.

Reviewed exact pinned range b1099aeb40fa1ad44983d9c5a261d7d887308697...ee6b86ecb5620d9c51a1722ddb95f12b44dd6922: 2 files, 114 changed lines. Inspected the full head scaffold/build/module/CI paths and Go modules reference. The test-owned GOMODCACHE, explicit preload proxy/checksum configuration, SDK zip assertion, and offline GOPROXY=off consumer phase address Review 1’s ambient cache/workspace contamination.

Residual risk: the preload intentionally requires access to proxy.golang.org on a cold cache; I did not execute tests in this read-only review. CI is reported successful.

Verdict: APPROVE