Centralize Go validation and build environments

docs/consumers/build.md

@@ -50,13 +50,18 @@ resolved from the repository. Selected artifact filenames are regenerated. Other
 directory are left in place. A failed later build or native version check returns the binaries already
 generated in `BuildResult.Artifacts`.
 
-Builds use the prepared local Go toolchain, readonly module mode, disabled
-module network access, `CGO_ENABLED=0`, `-trimpath`, and `-buildvcs=false`. Each
-selected target is compiled explicitly. ReleaseKit then runs the `version`
-command on a native binary and requires `<binary> <version>` followed by a
-newline. If no selected target matches the Go host, it builds a temporary
-native binary for this check and removes it afterward. Cross-compilation does
-not promise that a binary runs on another platform.
+Builds use the available compatible Go toolchain selected locally; ReleaseKit
+does not download a different toolchain automatically. It disables workspace
+discovery and module network access, uses readonly module mode, sets
+`CGO_ENABLED=0`, and passes `-trimpath` and `-buildvcs=false`. Effective cache,
+module-cache, temporary-directory, and tool settings are retained, including
+values from Go's persistent environment file. Ambient experiment and CPU
+feature settings are cleared so the selected toolchain uses its baseline for
+each target. Each selected target is compiled explicitly. ReleaseKit then runs
+the `version` command on a native binary and requires `<binary> <version>`
+followed by a newline. If no selected target matches the Go host, it builds a
+temporary native binary for this check and removes it afterward.
+Cross-compilation does not promise that a binary runs on another platform.
 
 An empty target list records the source commit and returns without invoking Go,
 creating the output directory, or running a version check. It does not require a

docs/consumers/check.md

@@ -25,8 +25,14 @@ product name and exact version as complete title elements. No local tag with
 that version may already exist.
 
 The callback receives the captured repository, commit, and version. ReleaseKit
-calls it once. When omitted, ReleaseKit runs the offline Go test command. The
-check revalidates the branch, commit, and cleanliness after validation.
+calls it once. When omitted, ReleaseKit runs
+`go test -mod=readonly -count=1 ./...` with the available compatible local Go
+toolchain; it does not download a different toolchain automatically. The suite
+uses the Go host target, disables workspace and module network access, and
+ignores ambient `GOFLAGS`, experiment, and CPU feature overrides. Effective
+cache and native cgo/C-tool settings are preserved, including values from Go's
+persistent environment file. The check revalidates the branch, commit, and
+cleanliness after validation.
 
 A successful check is evidence about the local candidate only. It does not
 check whether a remote branch or tag is available and does not create a tag.

docs/internal/gotool.md

@@ -0,0 +1,42 @@
+# Go command environments
+
+`internal/gotool` resolves effective Go settings once for a validation or build
+operation and applies the shared environment to its Go commands. It uses
+`internal/process` for cancellation, the working directory, output, and wrapped
+errors.
+
+## Configuration discovery
+
+The owner asks the installed `go` command for `GOHOSTOS` and `GOHOSTARCH`, then
+queries effective operational settings with that host selected. Both queries
+use `GOTOOLCHAIN=local` and controlled `GOFLAGS`. Discovery sets
+`GOEXPERIMENT=none` and clears architecture feature variables so an invalid or
+nonbaseline tuning value cannot prevent settings from being read. The
+experiment override is discovery-only.
+
+The persistent Go environment remains active during discovery. The owner copies
+the effective cache and module-cache locations, Go root, temporary directory,
+and native cgo/C-tool configuration into its settings. This captures values
+supplied by either the process environment or the persistent Go environment
+file.
+
+## Command environments
+
+Every Go command receives `GOENV=off`, so removed persistent values cannot
+return. ReleaseKit owns `GOFLAGS=-mod=readonly`, `GOWORK=off`,
+`GOTOOLCHAIN=local`, `GOPROXY=off`, `GONOPROXY=none`, and `GOSUMDB=off`.
+Native commands use `GOHOSTOS` and `GOHOSTARCH` and retain the effective
+`CGO_ENABLED`, `CC`, `CXX`, `PKG_CONFIG`, and `CGO_CFLAGS`, `CGO_CPPFLAGS`,
+`CGO_CXXFLAGS`, and `CGO_LDFLAGS`. Static commands use the selected target and
+`CGO_ENABLED=0`.
+
+Both modes clear `GOEXPERIMENT` and the Go architecture feature variables
+`GOAMD64`, `GOARM`, `GOARM64`, `GO386`, `GOMIPS`, `GOMIPS64`, `GOPPC64`,
+`GORISCV64`, and `GOWASM`. The selected Go toolchain supplies its ordinary
+baseline values. Effective `GOCACHE`, `GOCACHEPROG`, `GOMODCACHE`, `GOPATH`,
+`GOROOT`, and `GOTMPDIR` values are retained. Other process variables remain
+available to child commands.
+
+Candidate validation uses native mode for the offline `go test` suite. Builds
+use static mode for selected-target compilation and the native version-check
+build. The native version executable itself runs as a normal child process.

docs/internal/overview.md

@@ -39,8 +39,9 @@ these implemented packages:
 | `internal/delivery` | Tagged-checkout verification, artifact inventory/hash validation, manifest assembly, and coordination of hosted delivery results. |
 | `internal/git` | Git command boundary, push-destination resolution, exact ref inspection, and tag operations, including captured-endpoint verification during recovery. |
 | `internal/gitea` | Gitea API transport, hosted release pages, asset inspection, manifests, and uploads. |
+| `internal/gotool` | Effective Go configuration discovery and shared native-validation and static-build environments; see [Go command environments](gotool.md). |
 | `internal/tempdir` | Disposable system temporary storage outside source worktrees. |
-| `internal/process` | Cancellable child-process execution with per-command environment overlays. |
+| `internal/process` | Cancellable child-process execution with per-command environment overlays and removals. |
 | `internal/publish` | Publication guards, one validation run, annotated tag creation, push, and recovery state. |
 | `internal/runtimeinfo` | Private version lookup used by the runtime facade. |
 | `internal/versioncontract` | Shared stable-version rules and linker-symbol identity. |
@@ -62,6 +63,7 @@ not a separate release matrix:
 | --- | --- | --- |
 | Runtime version lookup and injected application version | `buildinfo`, `internal/runtimeinfo`, `internal/versioncontract`, `internal/build` | `TestVersionInConsumerExecutable`, `TestVersion` |
 | Candidate capture, committed note, one validation, and rechecks | `releasekit.Check`, `internal/candidate`, `cmd/releasekit/internal/cli` | `TestCheckCapturesCandidateAndCallsValidationOnce`, `TestCheckRechecksHeadAndWorktreeAfterCallback`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate` |
+| Shared Go settings for validation and builds | `internal/gotool`, `internal/process`, `internal/candidate`, `internal/build` | `TestDefaultValidationDoesNotInheritGOFLAGSRunFilter`, `TestNativeAndStaticCommandsUseOwnedBaseline`, `TestPersistentSettingsPreserveCachesAndNativeCTools`, `TestBuildIgnoresAmbientAndPersistentArchitectureTuning` |
 | Authoritative endpoint and exact annotated tag publication | `releasekit.Publish`, `internal/publish`, `internal/git` | `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestResolveUsesPushURLAndQueriesWithoutMutation` |
 | Publication partial and uncertain recovery | `internal/publish`, `internal/git` | `TestPublishRejectedPushKeepsLocalTagAndReportsNotPublished`, `TestPublishLostAcknowledgmentConfirmsExactRemoteObject`, `TestPublishLostAcknowledgmentWithChangedEndpointRemainsUnknown`, `TestPublishUnavailableReconciliationRemainsUnknownAndPreservesPushError` |
 | Cross-builds, version smoke checks, empty target sets, and partial outputs | `releasekit.Build`, `internal/build`, `buildinfo` | `TestBuildCreatesSelectedTargetsAndInjectsVersion`, `TestBuildWithNoTargetsDoesNotInvokeCompiler`, `TestBuildReturnsPartialArtifactsAfterTargetFailure` |

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # ReleaseKit audit implementation plan
 
-Status: Stage 1 complete; Stage 2 not started.
+Status: Stages 1 and 2 complete; Stage 3 not started.
 Baseline: `e4be7fa` (2026-10-06). The [audit](audit.md) records the evidence,
 product goals, and selected direction. This document owns implementation order
 and completion criteria for that work.
@@ -160,6 +160,14 @@ survive. Preserve existing version injection, empty-target, cancellation, and
 partial-build behavior. Fixtures use temporary Go configuration and never edit
 the developer's persistent settings.
 
+**Completed:** Shared Go configuration now drives default validation,
+toolchain/host queries, target builds, and the native smoke build. Failing
+validation fixtures prove process and persistent `GOFLAGS` cannot suppress a
+real test and that cross-target settings still run tests on the host. Build
+metadata confirms ambient and persistent tuning are cleared, and a temporary
+persistent cache is used. Focused tests, the full offline suite, API boundary
+checks, and documentation whitespace checks pass.
+
 ## Stage 3 — Make product checks additive
 
 **Covers:** F4 and ReleaseKit's own F1 exposure. **Primary owners:** `check.go`,