Go and Hugo tooling policy

Status: active Foundry Core v1 long-term-support contract

Foundry Core uses Go, Hugo, and Git. It does not use Node, npm, npx, pnpm, Yarn, package manifests, package-manager lockfiles, or executable Node scripts for framework development, validation, migration, documentation, or release work.

Foundry Core’s support promise is separate from upstream tool lifecycle labels. Go does not publish an LTS channel; it supports its two newest major release lines. Hugo does not publish an LTS channel either. For Core v1.1.0, Go 1.27 is the tested source line and Hugo Extended 0.165.0 is the tested compatibility baseline. foundry check reports current-supported, previous-supported, unsupported, tested-baseline, and newer-unqualified states without inventing an upstream LTS designation.

This is enforced by:

go run ./cmd/foundry validate tooling
go run ./cmd/foundry check
go run ./cmd/foundry release-check --json

The tooling validator fails when package-manager files, Node scripts under scripts/, Node installation actions, or Node package commands appear in the active repository or workflow definitions.

Browser JavaScript is not Node tooling

Foundry may ship small JavaScript assets in assets/js/ when a portable site needs a browser interaction. Those files run in the visitor’s browser and are ordinary customer-owned source. They are not a package-manager, build, release, or server dependency.

Browser behavior is verified through Core’s Go-driven compatibility fixture and Safari WebDriver lane. WCAG receipts, responsive geometry, lab performance evidence, and visual artifacts remain explicit evidence contracts; Core validates their identity and limitations in Go. A historical evidence packet may truthfully record an older measurement tool, but it is not an active Core command or dependency.

Migration boundary

Source-first site migration excludes package manifests, package-manager locks, dependency snapshots, generated output, and managed Control state. Section migration proof clones never bind or execute a consumer’s node_modules or a Node toolchain. They render with Hugo under a restrictive network and command policy.

Required release floor

• Go tests pass.
• Hugo builds the declared Core fixtures and consumer proof directly.
• foundry validate tooling passes.
• foundry release-check passes.
• Browser, WCAG, Web Vitals, assistive-technology, and human-review limits are reported honestly rather than hidden behind a package toolchain.