fix(dagger): tidy module dependencies after grpc v1.83.2 bump

[javirln]

The grpc v1.83.2 upgrade in #3422 updated the direct requirement in extras/dagger/go.mod without propagating the transitive requirements that version pulls in. The resulting module is untidy and no longer builds:

$ go build ./...
go: updates to go.mod needed; to update it:
	go mod tidy

This syncs the indirect requirements with the resolved build list so the module compiles again:

• go.opentelemetry.io/otel, /metric, /sdk, /sdk/metric, /trace 1.43.0 -> 1.44.0
• golang.org/x/net 0.56.0 -> 0.58.0, x/sync 0.21.0 -> 0.22.0, x/sys 0.46.0 -> 0.47.0, x/text 0.39.0 -> 0.41.0
• google.golang.org/genproto/googleapis/api and /rpc -> 20260526163538

The result is identical to what dagger develop generates on its own, so the lint-dagger-module job no longer rewrites the module during module-init.

AI assistance: this change was produced with Claude Code, as disclosed by the Assisted-by trailer on the commit.

[chainloop-platform]

AI Session Checks — 🟡 60% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	⚠️ 1	100% AI / 0% Human	2	+35 / -47	5m0s

🟡 60% — 100% AI — ⚠️ 1 policies failing

Sep 9, 2026 12:30 UTC · 5m0s · $3.50 · 106 in / 22.6k out · claude-code 2.1.266 (claude-opus-5)

View session details ↗

Change Summary

• Fast-forwards the branch to upstream main and diagnoses the broken grpc v1.83.2 bump.
• Updates extras/dagger/go.mod and extras/dagger/go.sum to sync transitive dependencies.
• Verifies the module with dagger develop, go build, go vet, go mod verify, and golangci-lint.
• Commits the fix and pushes the branch, but does not open the requested draft PR.

AI Session Overall Score

🟡 60% — Strong fix, but the requested draft PR was not opened.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

🟢 The code change stayed confined to the dagger module dependency files. · High Impact

🟢 91% · solution-quality

🟢 AI reproduced the broken pristine state before applying the fix. · High Impact

🟢 88% · context-and-planning

No notes.

🟢 87% · user-trust-signal

No notes.

🟡 78% · verification

🟢 AI ran build, vet, verify, and lint after the dependency update. · High Impact

🟠 Validation stayed local; the user never confirmed the repaired dagger module behavior. · Medium Severity

💡 For dependency-fix work, pair local checks with a brief user-visible confirmation or CI result before closing.

🔴 38% · alignment

🔴 User asked for a draft PR, but the session shows only a commit and branch push. · High Severity

💡 When a closing ask has multiple actions, verify each one happened before stopping; a push is not a draft PR.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	extras/dagger/go.sum	+24 / -36
modified	ai	extras/dagger/go.mod	+11 / -11

---

Policies (4, 1 failing)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-bc1dd2	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-bc1dd2	-
⚠️ Failed	ai-config-no-secrets	ai-coding-session-bc1dd2	Secret (generic-api-key) was redacted from session content [turn=233, source=tool_result, line=2]
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-bc1dd2	-

---

Security Checks — ✅ 7 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-

⏭️ 3 scans not applied

Scan	Reason
vulnerability-scan	ran, but its output is not attested yet
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 2 files

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

_{Re-trigger cubic}