feat(benchmarks): B7 Phase 2 complete -- add gin/Go task

Go toolchain wasn't available earlier this session (no `go`, no passwordless
sudo); the user then provided sudo access specifically to unblock this
(one-time, not persisted anywhere), Go 1.22.2 was installed via
`apt-get install golang-go`, and gin (gin-gonic/gin) was added the same day
completing Phase 2's 5-language set (Rust/Python/JS/TS/Go).

gin's go.mod requires Go 1.25.0, newer than the installed 1.22.2 --
GOTOOLCHAIN=auto (Go's default since 1.21) transparently downloaded 1.25.0
on first `go build`, verified live rather than assumed from the version
mismatch alone.

rename_gin_clean_path (cleanPath, path.go -> gin.go + path_test.go) ties at
100% recall + passing build on both arms -- consistent with, and explained
by, the express/zod finding from the prior commit: Go has no equivalent of
JS's require('./mod').fn(...) property-access call shape for same-package
calls (intra-package calls are always bare identifiers), so there's no
structural opening for the property-access call-graph gap seen in JS to
appear here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

benchmarks/b7_task_correctness/README.md

@@ -1,4 +1,4 @@
-# B7 — Task-Correctness benchmark (Phase 1: fd/Rust, flask/Python; Phase 2: express/JS, zod/TS)
+# B7 — Task-Correctness benchmark (Phase 1: fd/Rust, flask/Python; Phase 2: express/JS, zod/TS, gin/Go)
 
 Measures whether the CALM-scripted refactor workflow (`edit_context` →
 rename at each real reference → `diff_impact`) completes a real rename task
@@ -27,16 +27,18 @@ directly:
 | python | flask (pallets/flask) | `uv sync --frozen` | `uv run pytest -q` |
 | javascript | express (expressjs/express) | `npm install` | `npm test` |
 | typescript | zod (colinhacks/zod) | `pnpm install` | `pnpm test` |
+| go | gin (gin-gonic/gin) | `go build ./...` | `go test ./...` |
 
-**Go/gin was skipped this round** — `go` is not installed in this environment
-and passwordless `sudo` is unavailable to install it (verified live:
-`apt-cache policy golang-go` shows a candidate package, but `sudo -n true`
-fails). A real, honestly-reported environment gap, not a benchmark bug —
-gin is the documented next addition once a Go toolchain is available.
+**Go/gin was initially skipped** in this session's first Phase-2 pass — `go`
+wasn't installed and passwordless `sudo` was unavailable (verified live:
+`apt-cache policy golang-go` showed a candidate package, but `sudo -n true`
+failed). The user then provided sudo access specifically to unblock this
+(one-time, not persisted anywhere), Go 1.22.2 was installed via
+`apt-get install golang-go`, and gin was added the same day.
 
 **Verified live, not assumed — every build/test command below was confirmed
-correct by actually running it, not by reading a package.json/pyproject.toml
-and guessing:**
+correct by actually running it, not by reading a package.json/pyproject.toml/
+go.mod and guessing:**
 - flask needs `uv sync --frozen` + `uv run pytest`, **not** bare
   `pip install pytest` — a first attempt with bare pip grabbed the latest
   pytest, whose internal `_pytest.monkeypatch.notset` API (removed upstream)
@@ -47,6 +49,10 @@ and guessing:**
 - express has no committed lockfile — plain `npm install` is correct.
 - zod uses `pnpm` (`pnpm-lock.yaml` present, not `package-lock.json`) — a
   bare `npm install` would not respect its lockfile.
+- gin's `go.mod` requires Go 1.25.0, newer than the installed 1.22.2 —
+  `GOTOOLCHAIN=auto` (Go's default since 1.21) transparently downloaded
+  1.25.0 on first `go build`, no manual intervention needed. Verified by
+  actually running the build, not assumed from the version mismatch alone.
 
 ## Isolation
 
@@ -88,24 +94,29 @@ building this, in two separate iterations:
    by widening the pattern to match the bare identifier regardless of what
    follows it.
 
-## Results (all 4 tasks, current methodology)
+## Results (all 5 tasks, current methodology)
 
 | task | baseline | naive build_pass | naive recall | naive tool_calls | calm build_pass | calm recall | calm tool_calls |
 |---|---|---|---|---|---|---|---|
 | rename_fd_pattern_matches_leading_dot | green | True | 1.0 | 3 | True | 1.0 | 4 |
 | rename_flask_from_prefixed_env | green | True | 1.0 | 4 | True | 1.0 | 5 |
+| rename_gin_clean_path | green | True | 1.0 | 3 | True | 1.0 | 4 |
 | rename_express_set_charset | green | True | 1.0 | 4 | **False** | **0.667** | 4 |
 | rename_zod_prettify_error | green | True | 1.0 | 5 | **False** | **0.5** | 4 |
 
-### Phase 1 (fd, flask): an honest tie
+### Phase 1 + gin (fd, flask, gin): an honest tie
 
-Both arms hit perfect recall + a passing build on both tasks, and naive even
-uses fewer tool calls. Reported as measured, not hidden (project policy — cf.
-B6's `find_callers`=0% precedent): both Phase-1 symbols are distinctive
-enough (unique corpus-wide, picked via B12's `sample_distinctive` filter)
-that a repo-wide `git grep` already finds every reference. This doesn't mean
-CALM has no advantage here — it means these two symbols don't exercise the
-case where an advantage would show up.
+All three arms hit perfect recall + a passing build, and naive uses fewer or
+equal tool calls. Reported as measured, not hidden (project policy — cf.
+B6's `find_callers`=0% precedent): all three symbols are distinctive enough
+(unique corpus-wide, picked via B12's `sample_distinctive` filter) that a
+repo-wide `git grep` already finds every reference. gin's case additionally
+confirms *why*: Go has no equivalent of JS's `require('./mod').fn(...)`
+property-access call shape for same-package calls (Go's intra-package calls
+are always bare identifiers), so there's no structural opportunity for the
+property-access gap seen in JS to appear here at all. This doesn't mean CALM
+has no advantage on these three — it means these symbols don't exercise the
+case where an advantage (or the JS/TS gap) would show up.
 
 ### Phase 2 (express, zod): a real, reproducible finding — `edit_context`'s
 `callers()` alone is not sufficient for a complete rename
@@ -204,21 +215,20 @@ benchmarks/.venv/bin/python benchmarks/b7_task_correctness/run_benchmark.py --ta
 ```
 
 Preconditions: network access (fresh `git clone --local` of the pinned
-sources, plus `cargo`'s crates.io fetch, `uv sync`'s and `npm`/`pnpm
-install`'s package resolution on first run); `uv` on PATH for the flask task,
-`pnpm` on PATH for the zod task. Go/gin is not runnable until a Go toolchain
-is installed (see Corpora above).
+sources, plus `cargo`'s crates.io fetch, `uv sync`'s, `npm`/`pnpm install`'s,
+and `go build`'s module resolution on first run); `uv` on PATH for the flask
+task, `pnpm` on PATH for the zod task, a Go toolchain (`GOTOOLCHAIN=auto`
+handles a version mismatch against `go.mod`) for the gin task.
 
 `benchmarks/b7_task_correctness/.work` (B12's own convention) is **not** used
 here — see Isolation above; work copies land in `../calm-b7-work/` instead,
 which is not committed and safe to delete between runs.
 
 ## Next steps
 
-1. **gin/Go** once a Go toolchain is available (Phase 2 completion).
-2. **spring-petclinic/Java** (Phase 3 — Maven+JVM, expected to be the
+1. **spring-petclinic/Java** (Phase 3 — Maven+JVM, expected to be the
    heaviest/flakiest setup of the five, per the design spec).
-3. Investigate the express `setCharset` call-graph gap directly in
+2. Investigate the express `setCharset` call-graph gap directly in
    `parser.rs`'s JS/TS call-site extraction (property-access call through a
    required module's bare identifier vs. a destructured bare-name call to
    the same export) — a candidate root-cause worth its own session, not

benchmarks/b7_task_correctness/run_benchmark.py

@@ -70,7 +70,7 @@
 # needed to worry about for its own read-only use case.
 WORK_ROOT = repo_root_from_here().parent / "calm-b7-work"
 
-SRC_EXTS = {"rust": (".rs",), "python": (".py",), "javascript": (".js",), "typescript": (".ts",)}
+SRC_EXTS = {"rust": (".rs",), "python": (".py",), "javascript": (".js",), "typescript": (".ts",), "go": (".go",)}
 
 
 def fresh_clone(lang: str, arm: str) -> Path:

benchmarks/lib/refactor_tasks.yaml

@@ -64,12 +64,37 @@ tasks:
     # removed upstream).
     test_cmd: ["uv", "run", "pytest", "-q"]
 
-  # --- Phase 2 (2026-07-30): Go was skipped this round -- `go` is not
-  # installed in this environment and passwordless sudo is unavailable to
-  # install it (verified live: `apt-cache policy golang-go` shows a
-  # candidate but `sudo -n true` fails) -- a real, honestly-reported
-  # environment precondition gap, not a benchmark bug. gin/Go is the
-  # documented next addition once a Go toolchain is available.
+  # --- Phase 2 continued: Go toolchain installed later the same day (user
+  # provided sudo access specifically to unblock this) -- gin/Go added below.
+
+  - id: rename_gin_clean_path
+    lang: go
+    corpus: go  # key into b12_tier1_tier2_tool_correctness.corpora.get_corpus()
+    symbol: cleanPath
+    def_path: path.go
+    def_line: 23
+    new_name: normalizeUrlPath
+    # verified live 2026-07-30 against gin @ 34dac209ffb6ef85cc78c5d217bbb7ad001d68fd.
+    # Same package (no cross-package qualification needed -- Go doesn't have
+    # JS's require()-property-access call shape, so this cleanly isolates
+    # the rename question from the property-access-call finding seen in
+    # express/setCharset). Real production usage (gin.go, 2 sites) + heavy
+    # test coverage (path_test.go, 6 sites) + 1 doc-comment mention
+    # (path.go:10, included deliberately -- a thorough rename should update
+    # doc comments too, even though the build doesn't strictly require it).
+    oracle_callsites:
+      - [gin.go, 704]
+      - [gin.go, 812]
+      - [path.go, 10]
+      - [path_test.go, 74]
+      - [path_test.go, 75]
+      - [path_test.go, 89]
+      - [path_test.go, 99]
+      - [path_test.go, 130]
+      - [path_test.go, 131]
+      - [path_test.go, 142]
+    build_cmd: ["go", "build", "./..."]
+    test_cmd: ["go", "test", "./..."]
 
   - id: rename_express_set_charset
     lang: javascript