fix(go): resolver writability, truthful push reporting, existing-branch builds, test-before-push

[AbirAbbas]

Summary

Four operational fixes for the Go port, all discovered while running SWE-AF against real PRs on 2026-07-24:

1. resolve now defaults its fixer role to permission_mode: "auto". The empty default landed the pr_resolver agent in a read-only sandbox: it validated findings but could not edit files, so every default resolve run reported "valid finding, but the read-only workspace prevents applying the fix" and changed nothing (observed on 7 consecutive runs). An explicit config.permission_mode is still honored verbatim.
2. resolve verifies push state via git instead of trusting the agent's self-report. The remote head of the target branch is captured before the role runs and re-resolved after; if it advanced, the result reports pushed: true with real commit SHAs and changed files even when the agent's final JSON fails schema validation. Live impact: on 4 of 7 runs the fix was committed and pushed while the result claimed pushed: false / total failure.
3. build gains an optional work_branch input. When set, git-init fetches and checks out that existing branch as the integration branch (no new branch), and fails fast — before any planning/coder spend — if the branch does not exist on the remote. Previously a goal targeting an existing PR branch was silently executed against main, burning a full pipeline run to produce 0/N completed issues (observed twice).
4. The pr_resolver prompt now requires running affected tests before committing and forbids pushing on red. A live resolve pushed a fix that broke 4 pre-existing tests in the touched packages; the prompt now mandates running the test suite for every touched package/module (plus gofmt/linters per repo convention) and reporting the commands and outcomes.

Provenance

Implemented by SWE-AF itself (build pipeline), then salvaged by cherry-picking the three fix commits off the run's integration branch — the run's finalize stage had committed a destructive tree pruning (−63.9k lines), which is why the pipeline never opened this PR on its own. Prompt goldens aligned in a follow-up commit.

Test plan

• go build ./... clean
• go test ./... — 27/27 packages pass
• gofmt -l clean
• Per-fix unit tests included in each commit (permission-mode resolution, git-verified push reporting, work_branch threading + fail-fast, prompt-content assertions)

---

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.