# Go rebuild notes

The service was rebuilt from the product behavior rather than ported module-for-module from the previous Python implementation. The Go code keeps the durable table names and public webhook/health contracts while separating domain decisions from HTTP, SQL, Gitea, Docker, and Codex concerns.

## Deliberate differences

- There is no host-side review fallback. Runner failure is a failed attempt and is retried according to queue policy.
- Review result output is validated strictly and bounded before persistence or posting.
- The landing and 404 pages are embedded and do not load Tailwind from a third-party CDN.
- The current tested append-comment behavior is retained: each completed review posts a new comment and updates the latest `bot_comments` mapping.
- Docker execution is treated as a privileged deployment boundary. The bundled image runs the bot as root because direct Docker-socket access otherwise fails; production should replace this with a socket proxy or separate runner service, pin the runner image and Codex CLI instead of using the development bootstrap defaults, apply resource limits, and use least-privilege credentials.

## Migration compatibility

The Go startup migrator creates the logical `webhook_events`, `review_jobs`, `review_runs`, and `bot_comments` schema and preserves `trigger_comment_body`. Existing deployments should be backed up before switching binaries. The first Go release does not drop old columns or tables.