Fix VEX to check go.work replaces for workspace selection

The VEX gate only walked go.mod replaces from module_roots and never
inspected go.work pins. Discovery still emits a hosted go.work replace
when selection is Unknown (a zip line still satisfies lockfile basis),
so VEX incorrectly attested that pin on a fresh clone or unread module
graph instead of withholding go_version_not_selected.

The fix loads the workspace and adds its replaces to the entries list,
applying the same selection gate logic. Now a go.work-only pin is
correctly withheld when the module graph is unavailable.

Updated tests to expect the corrected behavior: go.work replaces in a
workspace without a cached module graph are now withheld like go.mod
replaces.

Author: cursoragent

crates/socket-patch-cli/src/commands/vex.rs

@@ -998,6 +998,16 @@ async fn generate_vex(
                 entries.push((root.clone(), entry));
             }
         }
+        // Also check go.work replaces: discovery emits them when selection is
+        // Unknown, but the gate must not attest an unproven workspace selection.
+        if let socket_patch_core::vendor::go_workspace::Loaded::Workspace(workspace) =
+            socket_patch_core::vendor::go_workspace::load(&common.cwd).await
+        {
+            let work_root = workspace.work_dir().to_path_buf();
+            for entry in workspace.replaces() {
+                entries.push((work_root.clone(), entry));
+            }
+        }
         for (root, entry) in entries {
             let Some(version) = entry.version.as_deref().filter(|_| entry.socket_owned()) else {
                 continue;

crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs

@@ -550,13 +550,17 @@ fn redirect_fixture(rel: &str) -> String {
 // ══════════════════════════════════════════════════════════════════════
 
 /// a + g(not installed): go.mod (line / block) and go.work flavors attest
-/// `(redirected)` for the ORIGINAL module's purl.
+/// `(redirected)` for the ORIGINAL module's purl. go.work requires the
+/// module graph to be cached (workspace selection check).
 #[test]
 fn golang_hosted_a_attests_every_flavor_without_manifest_or_ledgers() {
     let api = Api::start(vec![(U, go_view(U))]);
     for file in GO_FILES {
         let fx = Fx::new();
         write_go_hosted(&fx, U, file);
+        if file == GoFile::GoWork {
+            fx.cache_go_mod(GO_MODULE, GO_VERSION);
+        }
         let run = fx.vex(&["--proxy-url", &api.uri()]);
         assert_attested(&fx, &run, GO_PURL, U, "redirected", &format!("{file:?}"));
         assert!(
@@ -1046,9 +1050,8 @@ fn golang_workspace_without_its_module_graph_is_not_attested() {
     assert_attested(&fx, &run, GO_PURL, U, "redirected", "graph cached");
 }
 
-/// A hand-written go.work replace whose pin lines stayed in the root
-/// go.sum (go reads both sum files in workspace mode): still pinned, still
-/// attested; the vendored twin needs no pin.
+/// A hand-written go.work replace with proper pins: withheld until the
+/// module graph is available (like go.mod replaces), then attested.
 #[test]
 fn golang_go_work_replace_pinned_by_root_go_sum_attests() {
     let api = Api::start(vec![(U, go_view(U))]);
@@ -1058,7 +1061,10 @@ fn golang_go_work_replace_pinned_by_root_go_sum_attests() {
     fx.rm("go.work.sum");
     fx.put("go.sum", sums);
     let run = fx.vex(&["--proxy-url", &api.uri()]);
-    assert_attested(&fx, &run, GO_PURL, U, "redirected", "go.work + go.sum pin");
+    assert_omitted(&run, GO_PURL, "go_version_not_selected", "empty cache");
+    fx.cache_go_mod(GO_MODULE, GO_VERSION);
+    let run = fx.vex(&["--proxy-url", &api.uri()]);
+    assert_attested(&fx, &run, GO_PURL, U, "redirected", "graph cached");
 }
 
 /// LIMITATION (documented, root-only discovery): a Socket replace in a