diff --git a/recipes/incoming-go/anew.toml b/recipes/incoming-go/anew.toml
new file mode 100644
index 00000000..68a6949a
--- /dev/null
+++ b/recipes/incoming-go/anew.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "anew"
+version = "0.1.1"
+
+[source]
+repo   = "https://github.com/tomnomnom/anew"
+commit = "26ebc8ce1f0bdbaaee2930ea7ab191ed0c0da261"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/chartmuseum.toml b/recipes/incoming-go/chartmuseum.toml
new file mode 100644
index 00000000..e8a81279
--- /dev/null
+++ b/recipes/incoming-go/chartmuseum.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "chartmuseum"
+version = "0.16.5"
+
+[source]
+repo   = "https://github.com/helm/chartmuseum"
+commit = "7508866ec40195cbcb285e4981c092bcb9451944"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./cmd/chartmuseum"]
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/fortio.toml b/recipes/incoming-go/fortio.toml
new file mode 100644
index 00000000..068097d9
--- /dev/null
+++ b/recipes/incoming-go/fortio.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "fortio"
+version = "1.75.2"
+
+[source]
+repo   = "https://github.com/fortio/fortio"
+commit = "630bfb3db6cf663b4e01524f9e9be945e44f8a20"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/goldilocks.toml b/recipes/incoming-go/goldilocks.toml
new file mode 100644
index 00000000..c3959346
--- /dev/null
+++ b/recipes/incoming-go/goldilocks.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "goldilocks"
+version = "4.15.1"
+
+[source]
+repo   = "https://github.com/FairwindsOps/goldilocks"
+commit = "93e16c312bede765ede4fe2823c014b992fbbc0c"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/tandas/needs-review-weekend/kluctl.toml b/recipes/incoming-go/kluctl.toml
similarity index 59%
rename from tandas/needs-review-weekend/kluctl.toml
rename to recipes/incoming-go/kluctl.toml
index ac130895..d26c3e18 100644
--- a/tandas/needs-review-weekend/kluctl.toml
+++ b/recipes/incoming-go/kluctl.toml
@@ -1,4 +1,3 @@
-# REVIEW 2026-07-05T09:55:34Z: binario instalado='cmd' ≠ esperado='kluctl' (detect_go_main eligió otro main); fijar flags=["./cmd/kluctl"]
 # Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
 # - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
 #   compiler/link/phases y adaptá hasta que compile.
@@ -19,3 +18,13 @@ flags    = []
 # buildInputs de nix (no usados con CGO off): go
 [deps]
 build = ["go"]
+
+[build.phases]
+# main en ./cmd (dir llamado "cmd" a secas) ⇒ `go install ./cmd` nombraría el binario "cmd";
+# go build -o le pone el nombre real.
+compile = '''
+export GOCACHE=/src/.gocache GOTMPDIR=/src/.gotmp GOPATH=/tmp/gopath GOTOOLCHAIN=local CGO_ENABLED=0 GOFLAGS=-mod=vendor GOPROXY=off
+mkdir -p /src/.gotmp /out/usr/bin
+go build -trimpath -ldflags=-buildid= -o /out/usr/bin/kluctl ./cmd
+'''
+install = "true"
diff --git a/recipes/incoming-go/nancy.toml b/recipes/incoming-go/nancy.toml
new file mode 100644
index 00000000..6e181caf
--- /dev/null
+++ b/recipes/incoming-go/nancy.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "nancy"
+version = "2.1.0"
+
+[source]
+repo   = "https://github.com/sonatype-nexus-community/nancy"
+commit = "410f73d14f5cf35300b2695dc1a74fb560b70a85"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/pint.toml b/recipes/incoming-go/pint.toml
new file mode 100644
index 00000000..ed91e4dd
--- /dev/null
+++ b/recipes/incoming-go/pint.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "pint"
+version = "0.86.0"
+
+[source]
+repo   = "https://github.com/cloudflare/pint"
+commit = "e622a47c6fc350caabb3fe75c25cc3bfbd6feab6"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["./cmd/pint"]
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/puredns.toml b/recipes/incoming-go/puredns.toml
new file mode 100644
index 00000000..8dffe6a2
--- /dev/null
+++ b/recipes/incoming-go/puredns.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "puredns"
+version = "2.1.1"
+
+[source]
+repo   = "https://github.com/d3mondev/puredns"
+commit = "e1478a433e00bf3081d4bbb1e02b037a673c97ac"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/sake.toml b/recipes/incoming-go/sake.toml
new file mode 100644
index 00000000..33137038
--- /dev/null
+++ b/recipes/incoming-go/sake.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "sake"
+version = "0.15.1"
+
+[source]
+repo   = "https://github.com/alajmo/sake"
+commit = "72850d13cf296bf4bdcdd3e827b23115946cf5e0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/timetrace.toml b/recipes/incoming-go/timetrace.toml
new file mode 100644
index 00000000..ca8d44a8
--- /dev/null
+++ b/recipes/incoming-go/timetrace.toml
@@ -0,0 +1,17 @@
+# Escrita a mano (Etapa G, tanda 2026-07-05b): fuera del radar de nixpkgs; último tag
+# estable resuelto con git ls-remote, vía Go automática del lab.
+name    = "timetrace"
+version = "0.14.3"
+
+[source]
+repo   = "https://github.com/dominikbraun/timetrace"
+commit = "e0a36d2956a3a25c5c3bfea05d8327c85792791a"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["go"]
diff --git a/tandas/staged-fallidos-go-20260705/README.md b/tandas/staged-fallidos-go-20260705/README.md
index b895d132..768a0c9f 100644
--- a/tandas/staged-fallidos-go-20260705/README.md
+++ b/tandas/staged-fallidos-go-20260705/README.md
@@ -54,3 +54,4 @@ Los patches de gross/gitlab-runner/woodpecker viajan acá con sus recetas.
 - `minikube` (2026-07-05): pkg/drivers/kvm importa libvirt.org/go/libvirt (CGO
   contra libvirt del sistema; nix lo buildea con buildInputs libvirt) ⇒ frontera
   CGO-lib-externa.
+- `werf` (2026-07-05): vendorea containers/image con mechanism_gpgme (CGO gpgme, misma frontera que skopeo).
diff --git a/tandas/staged-fallidos-go-20260705/werf.toml b/tandas/staged-fallidos-go-20260705/werf.toml
new file mode 100644
index 00000000..99149a86
--- /dev/null
+++ b/tandas/staged-fallidos-go-20260705/werf.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "werf"
+version = "2.72.1"
+
+[source]
+repo   = "https://github.com/werf/werf"
+commit = "v2.72.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, btrfs-progs, glibc
+[deps]
+build = ["go"]