sergio/takana

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

diff --git a/recipes/incoming-go/bom.toml b/recipes/incoming-go/bom.toml
new file mode 100644
index 00000000..5278a268
--- /dev/null
+++ b/recipes/incoming-go/bom.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "bom"
+version = "0.7.1"
+
+[source]
+repo   = "https://github.com/kubernetes-sigs/bom"
+commit = "1ab6284ac5e118267414f2ac3874bb08a701e9ad"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/crossplane-cli.toml b/recipes/incoming-go/crossplane-cli.toml
new file mode 100644
index 00000000..2121de09
--- /dev/null
+++ b/recipes/incoming-go/crossplane-cli.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "crossplane-cli"
+version = "2.3.3"
+
+[source]
+repo   = "https://github.com/crossplane/cli"
+commit = "0bbd2114570966d34e3137627750ec58b48d82a2"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/fabric-ai.toml b/recipes/incoming-go/fabric-ai.toml
new file mode 100644
index 00000000..98f737ea
--- /dev/null
+++ b/recipes/incoming-go/fabric-ai.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "fabric-ai"
+version = "1.4.455"
+
+[source]
+repo   = "https://github.com/danielmiessler/fabric"
+commit = "a420eaf63c532094eb12bc90c91a227401e96c31"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/flyctl.toml b/recipes/incoming-go/flyctl.toml
new file mode 100644
index 00000000..6ec892fe
--- /dev/null
+++ b/recipes/incoming-go/flyctl.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "flyctl"
+version = "0.4.63"
+
+[source]
+repo   = "https://github.com/superfly/flyctl"
+commit = "5b3fc2f5a2cb33e7cbb4910b6e19ce1577a96fed"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/go-migrate.toml b/recipes/incoming-go/go-migrate.toml
new file mode 100644
index 00000000..c3a54ce2
--- /dev/null
+++ b/recipes/incoming-go/go-migrate.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "go-migrate"
+version = "4.19.1"
+
+[source]
+repo   = "https://github.com/golang-migrate/migrate"
+commit = "89e308c340a2c069c3260f268307d38a7db88227"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gomi.toml b/recipes/incoming-go/gomi.toml
new file mode 100644
index 00000000..35cbedfe
--- /dev/null
+++ b/recipes/incoming-go/gomi.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "gomi"
+version = "1.6.2"
+
+[source]
+repo   = "https://github.com/b4b4r07/gomi"
+commit = "c3c52f932484542b94d6af10ecdd982fc0e175c5"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/jsonnet-bundler.toml b/recipes/incoming-go/jsonnet-bundler.toml
new file mode 100644
index 00000000..878071b3
--- /dev/null
+++ b/recipes/incoming-go/jsonnet-bundler.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "jsonnet-bundler"
+version = "0.6.0"
+
+[source]
+repo   = "https://github.com/jsonnet-bundler/jsonnet-bundler"
+commit = "ddded59c7066658f3d5abc7fcfc6be2220c92cad"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/krew.toml b/recipes/incoming-go/krew.toml
new file mode 100644
index 00000000..73af9f97
--- /dev/null
+++ b/recipes/incoming-go/krew.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "krew"
+version = "0.5.0"
+
+[source]
+repo   = "https://github.com/kubernetes-sigs/krew"
+commit = "8a4a6fffb08d2ee04b4b013253160a50ed22139c"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./cmd/krew"]
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/kubescape.toml b/recipes/incoming-go/kubescape.toml
new file mode 100644
index 00000000..cd6128f8
--- /dev/null
+++ b/recipes/incoming-go/kubescape.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "kubescape"
+version = "4.0.10"
+
+[source]
+repo   = "https://github.com/kubescape/kubescape"
+commit = "f956507357091c3806777fe13ddf5e65efe36e44"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/melange.toml b/recipes/incoming-go/melange.toml
new file mode 100644
index 00000000..38787398
--- /dev/null
+++ b/recipes/incoming-go/melange.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "melange"
+version = "0.41.1"
+
+[source]
+repo   = "https://github.com/chainguard-dev/melange"
+commit = "61754ecffc527ac37e723f4ee766669eaac04e29"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/rekor-cli.toml b/recipes/incoming-go/rekor-cli.toml
new file mode 100644
index 00000000..83d97b1e
--- /dev/null
+++ b/recipes/incoming-go/rekor-cli.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "rekor-cli"
+version = "1.5.2"
+
+[source]
+repo   = "https://github.com/sigstore/rekor"
+commit = "3b75cd9c9a101bae26eecf1ad261d94aba247ee9"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./cmd/rekor-cli"]
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/revive.toml b/recipes/incoming-go/revive.toml
new file mode 100644
index 00000000..948d4fbd
--- /dev/null
+++ b/recipes/incoming-go/revive.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "revive"
+version = "1.11.0"
+
+[source]
+repo   = "https://github.com/mgechev/revive"
+commit = "92243279ea475f93e3bfa468488f5b44c642a659"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/scorecard.toml b/recipes/incoming-go/scorecard.toml
new file mode 100644
index 00000000..6bc2d1ee
--- /dev/null
+++ b/recipes/incoming-go/scorecard.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "scorecard"
+version = "5.4.0"
+
+[source]
+repo   = "https://github.com/ossf/scorecard"
+commit = "80ee3ecfedf8b19ab8991713a9fdb2e7dcd7262e"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/seaweedfs.toml b/recipes/incoming-go/seaweedfs.toml
new file mode 100644
index 00000000..1fa16411
--- /dev/null
+++ b/recipes/incoming-go/seaweedfs.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "seaweedfs"
+version = "4.36"
+
+[source]
+repo   = "https://github.com/seaweedfs/seaweedfs"
+commit = "d0b90d29eb6c3cfad1f9c0f80d671c72c4ec1d27"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./weed"]
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/step-ca.toml b/recipes/incoming-go/step-ca.toml
new file mode 100644
index 00000000..cbdb9dbd
--- /dev/null
+++ b/recipes/incoming-go/step-ca.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05): import-nix rechaza el fetchgit recursivo
+# de nixpkgs (hash NAR no reusable) ⇒ repo+commit fijados a mano, vía Go automática del lab.
+name    = "step-ca"
+version = "0.29.0"
+
+[source]
+repo   = "https://github.com/smallstep/certificates"
+commit = "992ff696e95b424a99140bd7edb2144013975059"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./cmd/step-ca"]
+
+[deps]
+build = ["go"]
diff --git a/scripts/farm/harvest-go.sh b/scripts/farm/harvest-go.sh
index 33a19189..bdeb4782 100755
--- a/scripts/farm/harvest-go.sh
+++ b/scripts/farm/harvest-go.sh
@@ -99,6 +99,8 @@ for f in "$QUEUE"/*.toml; do
     prometheus-blackbox-exporter|blackbox_exporter) want=blackbox_exporter ;;
     argo-rollouts) want=kubectl-argo-rollouts ;; step-cli) want=step ;; soft-serve) want=soft ;; go-mockery) want=mockery ;;
     temporal-cli) want=temporal ;;
+    seaweedfs) want=weed ;; go-migrate) want=migrate ;; jsonnet-bundler) want=jb ;; fabric-ai) want=fabric ;;
+    crossplane-cli) want=crank ;;
     *) want="$n" ;;
   esac
 
diff --git a/tandas/fuel-go-20260705.txt b/tandas/fuel-go-20260705.txt
new file mode 100644
index 00000000..25fcc850
--- /dev/null
+++ b/tandas/fuel-go-20260705.txt
@@ -0,0 +1,16 @@
+# tanda go 2026-07-05 (attrs de nixpkgs verificados con nix eval)
+flyctl
+gomi
+krew
+kubescape
+melange
+rekor-cli
+revive
+scorecard
+seaweedfs
+step-ca
+crossplane-cli
+go-migrate
+jsonnet-bundler
+fabric-ai
+bom
diff --git a/tandas/staged-fallidos-go-20260705/README.md b/tandas/staged-fallidos-go-20260705/README.md
index 4b444572..8ebb44ed 100644
--- a/tandas/staged-fallidos-go-20260705/README.md
+++ b/tandas/staged-fallidos-go-20260705/README.md
@@ -39,3 +39,10 @@ tras la purga de caches el baseline volvió a 75% y los sanos avanzan.
 - `syncthing` — build constraints excluyen todos los fuentes en /src
 
 Los patches de gross/gitlab-runner/woodpecker viajan acá con sus recetas.
+
+## Post-review del finde (2026-07-05)
+- `flux` — misimport TOTAL: repo deniskropp/flux (DirectFB, 2013), no fluxcd; el gate
+  lo cazó porque sella `fluxcomp`. El fluxcd real está arriba (frontera embed).
+- `kics`/`terrascan` quedan en tandas/needs-review-weekend/ (proyectos reales, duros:
+  kics = main en cmd/console + queries embebidas; terrascan = panic proto duplicado
+  gnostic vs gnostic-models).
diff --git a/tandas/needs-review-weekend/flux.toml b/tandas/staged-fallidos-go-20260705/flux.toml
similarity index 100%
rename from tandas/needs-review-weekend/flux.toml
rename to tandas/staged-fallidos-go-20260705/flux.toml