diff --git a/recipes/incoming-go/apko.toml b/recipes/incoming-go/apko.toml
new file mode 100644
index 00000000..fab09628
--- /dev/null
+++ b/recipes/incoming-go/apko.toml
@@ -0,0 +1,42 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "apko"
+version = "0.9.0"
+
+[source]
+tarball = "https://github.com/chainguard-dev/apko/archive/v0.9.0/apko-0.9.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "c8883955a99811762c3d358549d041c464a1dfe67f24b63666664c72dc2d0bb10b8ff517a8205c14d56a826bd0d02770aa254eefa06c50026e91833319387f24"
+sha256  = "65f248fecf72ef36303e6c61c5599272f1a0d3eb1fa287a6f021917001e29a0b"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+mkdir build
+	go build -o build/ -tags -tags=pivkey,pkcs11key "$builddir"/...
+
+	for i in bash fish zsh; do
+		"$builddir"/build/apko completion $i > "$builddir"/apko.$i
+	done
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 "$builddir"/build/apko "/out"/usr/bin/apko
+
+	install -Dm644 "$builddir"/apko.bash "/out"/usr/share/bash-completion/completions/apko
+	install -Dm644 "$builddir"/apko.fish "/out"/usr/share/fish/vendor_completions.d/apko.fish
+	install -Dm644 "$builddir"/apko.zsh "/out"/usr/share/zsh/site-functions/_apko
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/assetfinder.toml b/recipes/incoming-go/assetfinder.toml
new file mode 100644
index 00000000..1804324f
--- /dev/null
+++ b/recipes/incoming-go/assetfinder.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "assetfinder"
+version = "0.1.1"
+
+[source]
+repo   = "https://github.com/tomnomnom/assetfinder"
+commit = "v0.1.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/atlas.toml b/recipes/incoming-go/atlas.toml
new file mode 100644
index 00000000..02c800bc
--- /dev/null
+++ b/recipes/incoming-go/atlas.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "atlas"
+version = "1.2.3"
+
+[source]
+repo   = "https://github.com/ariga/atlas"
+commit = "v1.2.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/aws-vault.toml b/recipes/incoming-go/aws-vault.toml
new file mode 100644
index 00000000..6dcaf59d
--- /dev/null
+++ b/recipes/incoming-go/aws-vault.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "aws-vault"
+version = "7.12.3"
+
+[source]
+repo   = "https://github.com/ByteNess/aws-vault"
+commit = "v7.12.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/crane.toml b/recipes/incoming-go/crane.toml
new file mode 100644
index 00000000..d3f6d75b
--- /dev/null
+++ b/recipes/incoming-go/crane.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "go-containerregistry"
+version = "0.21.6"
+
+[source]
+repo   = "https://github.com/google/go-containerregistry"
+commit = "v0.21.6"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/dbgate.toml b/recipes/incoming-go/dbgate.toml
new file mode 100644
index 00000000..6414a6cf
--- /dev/null
+++ b/recipes/incoming-go/dbgate.toml
@@ -0,0 +1,16 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "dbgate"
+version = "7.2.1"
+
+[source]
+tarball = "https://github.com/dbgate/dbgate/releases/download/v7.2.1/dbgate-7.2.1-linux_x86_64.AppImage"
+sha256  = "411e38419e50373feaf427e9fdde44623946f386660ad0457bc6b868c1448634"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
diff --git a/recipes/incoming-go/disable-race-tests.patch b/recipes/incoming-go/disable-race-tests.patch
new file mode 100644
index 00000000..780f9f41
--- /dev/null
+++ b/recipes/incoming-go/disable-race-tests.patch
@@ -0,0 +1,41 @@
+--- a/Makefile
++++ b/Makefile
+@@ -179,20 +179,20 @@
+ 	(cd web/; pnpm lint --quiet)
+ 
+ test-agent: ## Test agent code
+-	go test -race -cover -coverprofile agent-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/agent go.woodpecker-ci.org/woodpecker/v3/agent/...
++	go test  -cover -coverprofile agent-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/agent go.woodpecker-ci.org/woodpecker/v3/agent/...
+ 
+ test-server: ## Test server code
+-	go test -race -cover -coverprofile server-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/server $(shell go list go.woodpecker-ci.org/woodpecker/v3/server/... | grep -v '/store')
++	go test  -cover -coverprofile server-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/server $(shell go list go.woodpecker-ci.org/woodpecker/v3/server/... | grep -v '/store')
+ 
+ test-cli: ## Test cli code
+-	go test -race -cover -coverprofile cli-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/cli go.woodpecker-ci.org/woodpecker/v3/cli/...
++	go test  -cover -coverprofile cli-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/cli go.woodpecker-ci.org/woodpecker/v3/cli/...
+ 
+ test-server-datastore: ## Test server datastore
+ 	go test -timeout 300s -tags 'test $(TAGS)' -run TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
+-	go test -race -timeout 120s -tags 'test $(TAGS)' -skip TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
++	go test  -timeout 120s -tags 'test $(TAGS)' -skip TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
+ 
+ test-server-datastore-coverage: ## Test server datastore with coverage report
+-	go test -race -cover -coverprofile datastore-coverage.out -timeout 300s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/server/store/...
++	go test  -cover -coverprofile datastore-coverage.out -timeout 300s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/server/store/...
+ 
+ test-ui: ui-dependencies ## Test UI code
+ 	(cd web/; pnpm run lint)
+@@ -201,10 +201,10 @@
+ 	(cd web/; pnpm run test)
+ 
+ test-lib: ## Test lib code
+-	go test -race -cover -coverprofile coverage.out -timeout 60s -tags 'test $(TAGS)' $(shell go list ./... | grep -v '/cmd\|/agent\|/cli\|/server')
++	go test  -cover -coverprofile coverage.out -timeout 60s -tags 'test $(TAGS)' $(shell go list ./... | grep -v '/cmd\|/agent\|/cli\|/server')
+ 
+ test-e2e: ## Test by running yaml config and compare expected result
+-	go test -race -cover -coverpkg=./... -coverprofile e2e-coverage.out -timeout 60s -tags 'test $(TAGS)' ./e2e/...
++	go test  -cover -coverpkg=./... -coverprofile e2e-coverage.out -timeout 60s -tags 'test $(TAGS)' ./e2e/...
+ 
+ .PHONY: test
+ test: test-agent test-server test-server-datastore test-cli test-lib test-e2e ## Run all tests
diff --git a/recipes/incoming-go/disable-ui-openai-generation.patch b/recipes/incoming-go/disable-ui-openai-generation.patch
new file mode 100644
index 00000000..de59b099
--- /dev/null
+++ b/recipes/incoming-go/disable-ui-openai-generation.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -214,7 +214,7 @@
+ build-ui: ## Build UI
+ 	(cd web/; pnpm install --frozen-lockfile; pnpm build)
+ 
+-build-server: build-ui generate-openapi ## Build server
++build-server: ## Build server
+ 	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-server${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/server
+ 
+ build-agent: ## Build agent
diff --git a/recipes/incoming-go/dolt.toml b/recipes/incoming-go/dolt.toml
new file mode 100644
index 00000000..3ac0181e
--- /dev/null
+++ b/recipes/incoming-go/dolt.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "dolt"
+version = "2.1.9"
+
+[source]
+repo   = "https://github.com/dolthub/dolt"
+commit = "v2.1.9"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, icu4c
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/etcd.toml b/recipes/incoming-go/etcd.toml
new file mode 100644
index 00000000..bf8827dd
--- /dev/null
+++ b/recipes/incoming-go/etcd.toml
@@ -0,0 +1,50 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "etcd"
+version = "3.6.11"
+
+[source]
+tarball = "https://github.com/etcd-io/etcd/archive/refs/tags/v3.6.11.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "56423c42443d9d1d2d06ff28aff389a381ed9b726cbee0d3523ac34fe2a8e22029377a42aa808077bb985f524a153c5fe63fd6166857749e8217b705fdf41910"
+sha256  = "bdc9b21505f4587c81f33235b53b3cb02f28158eb3487ae158f90b9534f0c0f3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
+	export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
+	export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
+	export GOFLAGS="$GOFLAGS -mod=mod"
+	export CGO_ENABLED=1
+	export FORCE_HOST_GO=1
+
+	GIT_SHA="$(git ls-remote https://github.com/coreos/etcd.git refs/tags/v3.6.11 | awk '{print $1}')" \
+		make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -d -o "$pkgusers" -g "$pkggroups" -m 700 "/out"/var/lib/etcd
+	install -Dm755 bin/etcd "/out"/usr/bin/etcd
+	install -Dm755 bin/etcdctl "/out"/usr/bin/etcdctl
+	install -Dm644 $srcdir/etcd.yaml "/out"/etc/etcd/conf.yml
+	install -Dm644 $srcdir/etcd.confd "/out"/etc/conf.d/etcd
+	install -Dm755 $srcdir/etcd.initd "/out"/etc/init.d/etcd
+	install -Dm644 LICENSE "/out"/usr/share/licenses/etcd/LICENSE
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["bash"]
diff --git a/recipes/incoming-go/flux.toml b/recipes/incoming-go/flux.toml
new file mode 100644
index 00000000..fbf8d80f
--- /dev/null
+++ b/recipes/incoming-go/flux.toml
@@ -0,0 +1,16 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "flux"
+version = "2013-09-20"
+
+[source]
+repo   = "https://github.com/deniskropp/flux"
+commit = "e45758aa9384b9740ff021ea952399fd113eb0e9"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
diff --git a/recipes/incoming-go/fluxcd.toml b/recipes/incoming-go/fluxcd.toml
new file mode 100644
index 00000000..9b7565f1
--- /dev/null
+++ b/recipes/incoming-go/fluxcd.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "fluxcd"
+version = "2.8.8"
+
+[source]
+repo   = "https://github.com/fluxcd/flux2"
+commit = "v2.8.8"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/forgejo.toml b/recipes/incoming-go/forgejo.toml
new file mode 100644
index 00000000..fa5cd678
--- /dev/null
+++ b/recipes/incoming-go/forgejo.toml
@@ -0,0 +1,67 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "forgejo"
+version = "15.0.3"
+
+[source]
+tarball = "https://codeberg.org/forgejo/forgejo/archive/v15.0.3.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "c1ebd90bc1c8ce9a0cbbf88451078691d7f272927a8208328f9ba26786200347ca0d9f25bf87a256d825c0c6a63a0a022082f21c2871c45ac1710394c9385f1b"
+sha256  = "a73bb36caebf15925c00d46abce2adbd38b810a86610a0202a928c0a746e5742"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# XXX: LARGEFILE64
+	export CGO_CFLAGS="$CFLAGS -O2 -D_LARGEFILE64_SOURCE"
+	export TAGS="bindata sqlite sqlite_unlock_notify"
+	export GITEA_VERSION="15.0.3"
+	export EXTRA_GOFLAGS="$GOFLAGS"
+	export CGO_LDFLAGS="$LDFLAGS"
+	unset LDFLAGS
+	## make FHS compliant
+	local setting="forgejo.org/modules/setting"
+	export LDFLAGS="$LDFLAGS -X $setting.CustomConf=/etc/forgejo/app.ini"
+	export LDFLAGS="$LDFLAGS -X $setting.AppWorkPath=/var/lib/forgejo/"
+
+	make -j1 build
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+for dir in forgejo forgejo/git forgejo/data forgejo/db forgejo/custom; do
+		install -dm750 -o forgejo -g www-data \
+			"/out"/var/lib/$dir
+	done
+
+	install -dm755 -o forgejo -g www-data "/out"/var/log/forgejo
+
+	# TODO: rename when upstream does: https://codeberg.org/forgejo/forgejo/issues/5174
+	install -Dm755 -g www-data gitea "/out"/usr/bin/forgejo
+
+	install -Dm644 -o forgejo -g www-data "$srcdir"/forgejo.ini \
+		"/out"/etc/forgejo/app.ini
+	chown forgejo:www-data "/out"/etc/forgejo
+
+	install -Dm755 "$srcdir"/forgejo.initd \
+		"/out"/etc/init.d/forgejo
+	install -Dm644 contrib/systemd/forgejo.service \
+		-t "/out"/usr/lib/systemd/system/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): git, git-lfs, gnupg
+
+[deps]
+build = ["nodejs", "npm"]
diff --git a/recipes/incoming-go/frp.toml b/recipes/incoming-go/frp.toml
new file mode 100644
index 00000000..650c96d7
--- /dev/null
+++ b/recipes/incoming-go/frp.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "frp"
+version = "0.69.1"
+
+[source]
+repo   = "https://github.com/fatedier/frp"
+commit = "v0.69.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gcc15-bool.patch b/recipes/incoming-go/gcc15-bool.patch
new file mode 100644
index 00000000..23ab7a30
--- /dev/null
+++ b/recipes/incoming-go/gcc15-bool.patch
@@ -0,0 +1,26 @@
+Based on: https://codeberg.org/bizdelnick/gross/commit/5a27b077d1b34b64687d1e3b717175280337aa22#diff-09c2d15e9648a6e088b053b7d71a3b532ce5b61b
+---
+diff -ruN a/include/thread_pool.h b/include/thread_pool.h
+--- a/include/thread_pool.h	2025-07-30 17:19:45.060000000 +0000
++++ b/include/thread_pool.h	2025-07-30 17:26:12.140000000 +0000
+@@ -22,6 +20,10 @@
+ 
+ #include <signal.h>
+ 
++#ifdef HAVE_STDBOOL_H
++# include <stdbool.h>
++#endif
++
+ typedef int mseconds_t;
+ 
+ typedef struct thread_pool_s
+@@ -109,8 +110,7 @@
+ int submit_job(thread_pool_t *pool, edict_t *edict);
+ thread_pool_t *create_thread_pool(const char *name, int (*routine) (thread_pool_t *, thread_ctx_t *,
+ 	edict_t *), pool_limits_t *limits, void *arg);
+-edict_t *edict_get();
+-edict_t *edict_get();
++edict_t *edict_get(bool forget);
+ void send_result(edict_t *edict, void *result);
+ void edict_unlink(edict_t *edict);
+ 
diff --git a/recipes/incoming-go/gcc15-conflicting-types.patch b/recipes/incoming-go/gcc15-conflicting-types.patch
new file mode 100644
index 00000000..25c13e4f
--- /dev/null
+++ b/recipes/incoming-go/gcc15-conflicting-types.patch
@@ -0,0 +1,24 @@
+diff -ruN a/include/syncmgr.h b/include/syncmgr.h
+--- a/include/syncmgr.h	2023-12-26 23:43:03.000000000 +0000
++++ b/include/syncmgr.h	2025-07-30 17:38:33.930000000 +0000
+@@ -73,7 +73,7 @@
+ 
+ int send_startup_sync(peer_t *peer, startup_sync_t *sync);
+ int send_oper_sync(peer_t *peer, oper_sync_t *sync);
+-int force_peer_aggregate();
++int force_peer_aggregate(peer_t *peer);
+ void send_filters(peer_t *peer);
+ 
+ void *recv_syncs(void *arg);
+diff -ruN a/include/thread_pool.h b/include/thread_pool.h
+--- a/include/thread_pool.h	2025-07-30 17:19:45.060000000 +0000
++++ b/include/thread_pool.h	2025-07-30 17:50:05.690000000 +0000
+@@ -68,7 +70,7 @@
+ typedef struct
+ {
+ 	void *state;
+-	int (*cleanup) ();
++	int (*cleanup) (void *state);
+ 	watchdog_t watchdog;
+ } thread_ctx_t;
+ 
diff --git a/recipes/incoming-go/gf.toml b/recipes/incoming-go/gf.toml
new file mode 100644
index 00000000..eaf657f1
--- /dev/null
+++ b/recipes/incoming-go/gf.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gf"
+version = "0-unstable-2026-06-16"
+
+[source]
+repo   = "https://github.com/nakst/gf"
+commit = "1c04ed95d45d49fb4b06cbc620c61acd58818977"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["libx11", "gdb", "freetype"]
diff --git a/recipes/incoming-go/gitlab-runner.toml b/recipes/incoming-go/gitlab-runner.toml
new file mode 100644
index 00000000..83b5934d
--- /dev/null
+++ b/recipes/incoming-go/gitlab-runner.toml
@@ -0,0 +1,61 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "gitlab-runner"
+version = "19.0.1"
+
+[source]
+tarball = "https://gitlab.com/gitlab-org/gitlab-runner/-/archive/v19.0.1/gitlab-runner-v19.0.1.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "fa07957baa4f89141f9cbe342e10afb3f202312db4ba3edd28c904ad9acb65b64d0a5dcae0e2d46920d06d2c990c83d5546c523b464389c5976d28745d1c59a5"
+sha256  = "c44d94d9a5bcc0298ac5c61b9fbb49c10ee3ccf7f622a7c5684ea74040c38af6"
+patches = ["syslog-log-format.patch", "use-logrus-syslog-hook.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# This is used to determine what version of
+	# https://hub.docker.com/r/gitlab/gitlab-runner-helper/tags to use.
+	local gitrev
+	gitrev="$(jq -r '.commit.short_id' "$srcdir/gitlab-runner-19.0.1-tags.json")"
+	echo "Tag v19.0.1 resolved to SHA $gitrev" >&2
+
+	local ldflags="
+		-X gitlab.com/gitlab-org/gitlab-runner/common.NAME=gitlab-runner
+		-X gitlab.com/gitlab-org/gitlab-runner/common.VERSION=19.0.1
+		-X gitlab.com/gitlab-org/gitlab-runner/common.REVISION=$gitrev
+		-X gitlab.com/gitlab-org/gitlab-runner/common.BUILT=$(date -d @"$SOURCE_DATE_EPOCH" -u +%Y-%m-%dT%H:%M:%S%z)
+		-X gitlab.com/gitlab-org/gitlab-runner/common.BRANCH=master
+		"
+	# required for github.com/docker/docker
+	export GO111MODULE=auto
+	go build -ldflags "$ldflags" -o bin/gitlab-runner
+	go build -ldflags "$ldflags" -o bin/gitlab-runner-helper \
+		./apps/gitlab-runner-helper
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 bin/gitlab-runner -t "/out"/usr/bin/
+
+	install -Dm755 "$srcdir"/gitlab-runner.initd "/out"/etc/init.d/gitlab-runner
+	install -Dm644 "$srcdir"/gitlab-runner.confd "/out"/etc/conf.d/gitlab-runner
+	install -Dm644 "$srcdir"/gitlab-runner.logrotate "/out"/etc/logrotate.d/gitlab-runner
+
+	install -d -m750 -o "$pkgusers" -g "$pkggroups" "/out"/etc/gitlab-runner
+	install -d -m700 -o "$pkgusers" -g "$pkggroups" "/out"/var/lib/gitlab-runner
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["jq"]
diff --git a/recipes/incoming-go/gocron.toml b/recipes/incoming-go/gocron.toml
new file mode 100644
index 00000000..2e9397db
--- /dev/null
+++ b/recipes/incoming-go/gocron.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gocron"
+version = "0.9.14"
+
+[source]
+repo   = "https://github.com/flohoss/gocron"
+commit = "v0.9.14"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gotop.toml b/recipes/incoming-go/gotop.toml
new file mode 100644
index 00000000..d14f36d0
--- /dev/null
+++ b/recipes/incoming-go/gotop.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gotop"
+version = "4.2.0"
+
+[source]
+repo   = "https://github.com/xxxserxxx/gotop"
+commit = "v4.2.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/gross-1.0.1-default-conf.patch b/recipes/incoming-go/gross-1.0.1-default-conf.patch
new file mode 100644
index 00000000..39cd9070
--- /dev/null
+++ b/recipes/incoming-go/gross-1.0.1-default-conf.patch
@@ -0,0 +1,17 @@
+diff -ru gross-1.0.1.orig/doc/examples/grossd.conf gross-1.0.1/doc/examples/grossd.conf
+--- gross-1.0.1.orig/doc/examples/grossd.conf	2008-06-03 09:27:37 +0000
++++ gross-1.0.1/doc/examples/grossd.conf	2008-06-03 09:31:33 +0000
+@@ -71,11 +71,13 @@
+ # 'statefile' is the full path of the file that the server will use to
+ # store the state information. 
+ # statefile = /var/db/grossd.state
++statefile = /var/db/gross/state
+ 
+ # 'pidfile' is the full path of the file grossd writes its pid into.
+ # You can set parameter 'check', if you want to keep grossd
+ # from starting if pidfile already exists.
+ # pidfile = /var/run/grossd.pid;check
++pidfile = /var/run/gross/grossd.pid
+ 
+ # 'log_method' is used to list all the possible logging facilities.
+ # currently only syslog is implemented
diff --git a/recipes/incoming-go/gross-grey_tuple.patch b/recipes/incoming-go/gross-grey_tuple.patch
new file mode 100644
index 00000000..ea80f199
--- /dev/null
+++ b/recipes/incoming-go/gross-grey_tuple.patch
@@ -0,0 +1,146 @@
+Index: include/conf.h
+===================================================================
+--- a/include/conf.h	(revision 519)
++++ b/include/conf.h	(working copy)
+@@ -41,6 +41,7 @@
+ 			"stat_type",		"status",	\
+ 			"grey_mask",		"24",		\
+ 			"grey_delay",		"10",           \
++			"grey_tuple",		"user",		\
+ 			"syslog_facility",	"mail",		\
+ 			"blocker_port",		"4466",		\
+ 			"blocker_weight",	"1",		\
+@@ -80,6 +81,7 @@
+                         "log_level",			\
+ 			"grey_mask",			\
+                         "grey_delay",               	\
++                        "grey_tuple",               	\
+ 			"check",			\
+ 			"protocol",			\
+                         "syslog_facility",		\
+Index: include/common.h
+===================================================================
+--- a/include/common.h	(revision 519)
++++ b/include/common.h	(working copy)
+@@ -151,6 +151,12 @@
+ # endif	/* bool */
+ #endif /* HAVE_BOOL */
+ 
++typedef enum
++{
++	GREY_TUPLE_USER = 0,
++	GREY_TUPLE_SERVER,
++} greytupletype_t;
++
+ typedef struct peer_s
+ {
+ 	struct sockaddr_in peer_addr;
+@@ -207,6 +213,7 @@
+ 	int grey_mask;
+ 	int protocols;
+ 	int greylist_delay;
++	greytupletype_t grey_tuple;
+ 	postfix_config_t postfix;
+ 	sjsms_config_t sjsms;
+ 	blocker_config_t blocker;
+Index: src/gross.c
+===================================================================
+--- a/src/gross.c	(revision 519)
++++ b/src/gross.c	(working copy)
+@@ -112,7 +112,7 @@
+ {
+ 	int ret;
+ 	configlist_t *cp;
+-	const char *updatestr;
++	const char *updatestr, *greytuplestr;
+ 	struct hostent *host = NULL;
+ 	char buffer[MAXLINELEN] = { '\0' };
+ 	params_t *pp;
+@@ -214,6 +214,17 @@
+ 		daemon_shutdown(EXIT_CONFIG, "Invalid updatestyle: %s", updatestr);
+ 	}
+ 
++	greytuplestr = CONF("grey_tuple");
++	if ((greytuplestr == NULL) || (strcmp(greytuplestr, "user") == 0)) {
++		logstr(GLOG_DEBUG, "grey_tuple: USER");
++		ctx->config.grey_tuple = GREY_TUPLE_USER;
++	} else if (strcmp(greytuplestr, "server") == 0) {
++		logstr(GLOG_DEBUG, "grey_tuple: SERVER");
++		ctx->config.grey_tuple = GREY_TUPLE_SERVER;
++	} else {
++		daemon_shutdown(EXIT_CONFIG, "Invalid grey_tuple: %s", greytuplestr);
++	}
++
+ 	/* we must reset errno because strtol returns 0 if it fails */
+ 	errno = 0;
+ 	ctx->config.grey_mask = strtol(CONF("grey_mask"), (char **)NULL, 10);
+Index: src/worker.c
+===================================================================
+--- a/src/worker.c	(revision 519)
++++ b/src/worker.c	(working copy)
+@@ -186,6 +186,14 @@
+ 	}
+ }
+ 
++static const char *domain_part(const char *email)
++{
++	char *p = strchr(email, '@');
++	if (p == NULL)
++		return email;
++	return p + 1;
++}
++
+ int
+ test_tuple(final_status_t *final, grey_tuple_t *request, tmout_action_t *ta)
+ {
+@@ -233,7 +241,14 @@
+ 	}
+ 
+ 	/* greylist */
+-	snprintf(maskedtuple, MSGSZ, "%s %s %s", chkipstr, request->sender, request->recipient);
++	switch (ctx->config.grey_tuple) {
++	case GREY_TUPLE_USER:
++		snprintf(maskedtuple, MSGSZ, "%s %s %s", chkipstr, request->sender, request->recipient);
++		break;
++	case GREY_TUPLE_SERVER:
++		snprintf(maskedtuple, MSGSZ, "%s %s %s", chkipstr, domain_part(request->sender), request->helo_name);
++		break;
++	}
+ 	digest = sha256_string(maskedtuple);
+ 
+ 	querylog_entry = &final->querylog_entry;
+Index: doc/examples/grossd.conf
+===================================================================
+--- a/doc/examples/grossd.conf	(revision 519)
++++ b/doc/examples/grossd.conf	(working copy)
+@@ -93,6 +93,13 @@
+ # only if response is STATUS_GREY 
+ # DEFAULT: update = grey
+ 
++# 'grey_tuple' is the way greylisting tuples are created. Valid options are
++# 'normal' and 'loose'. If 'grey_tuple = user' the tuple for grey listing
++# will be: masked client-ip, sender email, recipient email. If 'grey_tuple =
++# server' the tuple for greylisting will be client-ip, domain of sender email
++# and helo.
++# DEFAULT: grey_tuple = normal
++
+ # 'grey_mask' is the mask for grossd to use when matching client_ip
+ # against the database. Default is 24, so grossd treats addresses
+ # like a.b.c.d as a.b.c.0. Setting this to 32 makes grossd to 
+Index: man/grossd.conf.5.in
+===================================================================
+--- a/man/grossd.conf.5.in	(revision 519)
++++ b/man/grossd.conf.5.in	(working copy)
+@@ -66,6 +66,12 @@
+ \fIgrossd\fP\|(8) will update the database only if the response is
+ `\s-1STATUS_GREY\s+1'.  Setting it to `always' may reduce the impact on
+ \s-1DNS\s+1 servers.
++.IP "\fBgrey_tuple\fP" 4
++is the greylisting tuple. Valid options are `user' and `server'. If set to
++`user', which is the default, \fIgrossd\fP\|(8) will create the tuple from
++the masked `smtp\-client\-ip', sender email and recipient email. If set to
++`server' it will create the tuple from the masked `smtp\-client\-ip', the sender
++email domain and helo message.
+ .IP "\fBgrey_mask\fP" 4
+ is the mask for \fIgrossd\fP\|(8) to use when matching the 
+ `smtp\-client\-ip' against the database.  Default is 24, which makes \fIgrossd\fP\|(8)
diff --git a/recipes/incoming-go/gross.toml b/recipes/incoming-go/gross.toml
new file mode 100644
index 00000000..b9e455f1
--- /dev/null
+++ b/recipes/incoming-go/gross.toml
@@ -0,0 +1,48 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "gross"
+version = "1.0.4"
+
+[source]
+tarball = "https://codeberg.org/bizdelnick/gross/releases/download/v1.0.4/gross-1.0.4.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "28126ed65ca82b9826b04f6210a95865fc514b924c0f14123e822923d2ce44f2c5c80d41f5b23c3ff845f9734a8e6ca3424fa165e7955d0fa99d52ae45bb30ea"
+sha256  = "0ee4fb368151558dc962328f2e99d9b6b61ddede44ead606fec8131774a5d174"
+patches = ["gross-1.0.1-default-conf.patch", "gross-grey_tuple.patch", "gcc15-bool.patch", "gcc15-conflicting-types.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	make -j1
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -j1 DESTDIR="/out" install
+
+	install -dD "/out"/var/run/gross
+	install -m755 -D "$srcdir"/grossd.initd "/out"/etc/init.d/grossd
+	install -m644 -D "$srcdir"/grossd.confd "/out"/etc/conf.d/grossd
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["c-ares", "autoconf", "automake", "libtool", "sed"]
diff --git a/recipes/incoming-go/grype.toml b/recipes/incoming-go/grype.toml
new file mode 100644
index 00000000..405159b7
--- /dev/null
+++ b/recipes/incoming-go/grype.toml
@@ -0,0 +1,45 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "grype"
+version = "0.111.0"
+
+[source]
+tarball = "https://github.com/anchore/grype/archive/v0.111.0/grype-0.111.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "109662075d13ed6b397c3624679b52f49c2713d9bfc5562750ff2892c6f81810f616ffbb218bdfa31a8beae7331b0ff3d446de4cd9f295033afb527e74be1a0f"
+sha256  = "01d60c3e785f635da8f060712df2a901025386b740eb173e365ae0c263e66792"
+patches = ["disable-update-check.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+go build -ldflags "
+		-X main.version=0.111.0
+		" \
+		-o bin/grype ./cmd/grype
+
+	./bin/grype completion bash >grype.bash
+	./bin/grype completion fish >grype.fish
+	./bin/grype completion zsh >grype.zsh
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 bin/grype -t "/out"/usr/bin/
+
+	install -Dm644 grype.bash "/out"/usr/share/bash-completion/completions/grype
+	install -Dm644 grype.fish "/out"/usr/share/fish/vendor_completions.d/grype.fish
+	install -Dm644 grype.zsh "/out"/usr/share/zsh/site-functions/_grype
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/gtt.toml b/recipes/incoming-go/gtt.toml
new file mode 100644
index 00000000..9498c610
--- /dev/null
+++ b/recipes/incoming-go/gtt.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gtt"
+version = "10"
+
+[source]
+repo   = "https://github.com/eeeXun/gtt"
+commit = "v10"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, alsa-lib, xclip, wl-clipboard
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/httpstat.toml b/recipes/incoming-go/httpstat.toml
new file mode 100644
index 00000000..75d5428d
--- /dev/null
+++ b/recipes/incoming-go/httpstat.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "httpstat"
+version = "1.3.2"
+
+[source]
+repo   = "https://github.com/reorx/httpstat"
+commit = "1.3.2"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["python3", "setuptools", "glibc-locales"]
diff --git a/recipes/incoming-go/jc.toml b/recipes/incoming-go/jc.toml
new file mode 100644
index 00000000..fdbf7bb6
--- /dev/null
+++ b/recipes/incoming-go/jc.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "jc"
+version = "1.25.7"
+
+[source]
+repo   = "https://github.com/kellyjonbrazil/jc"
+commit = "v1.25.7"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["python3"]
diff --git a/recipes/incoming-go/jsonnet.toml b/recipes/incoming-go/jsonnet.toml
new file mode 100644
index 00000000..8cf670a4
--- /dev/null
+++ b/recipes/incoming-go/jsonnet.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "jsonnet"
+version = "0.21.0"
+
+[source]
+repo   = "https://github.com/google/jsonnet"
+commit = "v0.21.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["jekyll", "cmake", "gtest"]
diff --git a/recipes/incoming-go/kics.toml b/recipes/incoming-go/kics.toml
new file mode 100644
index 00000000..0e181568
--- /dev/null
+++ b/recipes/incoming-go/kics.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "kics"
+version = "2.1.19"
+
+[source]
+repo   = "https://github.com/Checkmarx/kics"
+commit = "v2.1.19"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/kubetail.toml b/recipes/incoming-go/kubetail.toml
new file mode 100644
index 00000000..098a77d6
--- /dev/null
+++ b/recipes/incoming-go/kubetail.toml
@@ -0,0 +1,16 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "kubetail"
+version = "1.6.22"
+
+[source]
+repo   = "https://github.com/johanhaleby/kubetail"
+commit = "1.6.22"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
diff --git a/recipes/incoming-go/kubie.toml b/recipes/incoming-go/kubie.toml
new file mode 100644
index 00000000..1bc8ff65
--- /dev/null
+++ b/recipes/incoming-go/kubie.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "kubie"
+version = "0.26.1"
+
+[source]
+repo   = "https://github.com/sbstp/kubie"
+commit = "v0.26.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "kubie"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/kubie /out/usr/bin/kubie"
diff --git a/recipes/incoming-go/lego.toml b/recipes/incoming-go/lego.toml
new file mode 100644
index 00000000..decf9ca4
--- /dev/null
+++ b/recipes/incoming-go/lego.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "lego"
+version = "4.35.2"
+
+[source]
+repo   = "https://github.com/go-acme/lego"
+commit = "v4.35.2"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/logs_tests.patch b/recipes/incoming-go/logs_tests.patch
new file mode 100644
index 00000000..9b3cd19d
--- /dev/null
+++ b/recipes/incoming-go/logs_tests.patch
@@ -0,0 +1,99 @@
+diff --git a/pkg/observability/logs/aws_test.go b/pkg/observability/logs/aws_test.go
+index 36a970d..b315f8b 100644
+--- a/pkg/observability/logs/aws_test.go
++++ b/pkg/observability/logs/aws_test.go
+@@ -21,5 +21,5 @@ func TestNewAWSWrapper(t *testing.T) {
+ 
+ 	logger.Logf(logging.Debug, "%s", "foo")
+ 
+-	assert.Equal(t, "<nil> DBG aws_test.go:22 > foo\n", buf.String())
++	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/aws_test.go:22 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/datadog_test.go b/pkg/observability/logs/datadog_test.go
+index 41c6df4..47eadad 100644
+--- a/pkg/observability/logs/datadog_test.go
++++ b/pkg/observability/logs/datadog_test.go
+@@ -20,5 +20,5 @@ func TestNewDatadogLogger(t *testing.T) {
+ 
+ 	logger.Log("foo")
+ 
+-	assert.Equal(t, "<nil> DBG datadog_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/datadog_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/elastic_test.go b/pkg/observability/logs/elastic_test.go
+index e00604d..16e1304 100644
+--- a/pkg/observability/logs/elastic_test.go
++++ b/pkg/observability/logs/elastic_test.go
+@@ -20,5 +20,5 @@ func TestNewElasticLogger(t *testing.T) {
+ 
+ 	logger.Errorf("foo")
+ 
+-	assert.Equal(t, "<nil> ERR elastic_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> ERR github.com/traefik/traefik/v3/pkg/observability/logs/elastic_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/gokit_test.go b/pkg/observability/logs/gokit_test.go
+index 791157b..7531651 100644
+--- a/pkg/observability/logs/gokit_test.go
++++ b/pkg/observability/logs/gokit_test.go
+@@ -20,5 +20,5 @@ func TestNewGoKitWrapper(t *testing.T) {
+ 
+ 	_ = logger.Log("foo")
+ 
+-	assert.Equal(t, "<nil> DBG gokit_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/gokit_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/hclog_test.go b/pkg/observability/logs/hclog_test.go
+index 02681d7..50fe5e2 100644
+--- a/pkg/observability/logs/hclog_test.go
++++ b/pkg/observability/logs/hclog_test.go
+@@ -20,5 +20,5 @@ func TestNewRetryableHTTPLogger(t *testing.T) {
+ 
+ 	logger.Info("foo")
+ 
+-	assert.Equal(t, "<nil> INF hclog_test.go:21 > Foo\n", buf.String())
++	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/hclog_test.go:21 > Foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/instana_test.go b/pkg/observability/logs/instana_test.go
+index 38b53f2..dc758f0 100644
+--- a/pkg/observability/logs/instana_test.go
++++ b/pkg/observability/logs/instana_test.go
+@@ -20,5 +20,5 @@ func TestNewInstanaLogger(t *testing.T) {
+ 
+ 	logger.Info("foo")
+ 
+-	assert.Equal(t, "<nil> INF instana_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/instana_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/log_test.go b/pkg/observability/logs/log_test.go
+index 5c80e76..26fd44a 100644
+--- a/pkg/observability/logs/log_test.go
++++ b/pkg/observability/logs/log_test.go
+@@ -20,5 +20,5 @@ func TestNoLevel(t *testing.T) {
+ 
+ 	logger.Info().Msg("foo")
+ 
+-	assert.Equal(t, "<nil> INF log_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/log_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/logrus_test.go b/pkg/observability/logs/logrus_test.go
+index af3c085..d30889a 100644
+--- a/pkg/observability/logs/logrus_test.go
++++ b/pkg/observability/logs/logrus_test.go
+@@ -20,5 +20,5 @@ func TestNewLogrusStdWrapper(t *testing.T) {
+ 
+ 	logger.Println("foo")
+ 
+-	assert.Equal(t, "<nil> DBG logrus_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> DBG github.com/traefik/traefik/v3/pkg/observability/logs/logrus_test.go:21 > foo\n", buf.String())
+ }
+diff --git a/pkg/observability/logs/oxy_test.go b/pkg/observability/logs/oxy_test.go
+index 5645986..26f915c 100644
+--- a/pkg/observability/logs/oxy_test.go
++++ b/pkg/observability/logs/oxy_test.go
+@@ -20,5 +20,5 @@ func TestNewOxyWrapper(t *testing.T) {
+ 
+ 	logger.Info("foo")
+ 
+-	assert.Equal(t, "<nil> INF oxy_test.go:21 > foo\n", buf.String())
++	assert.Equal(t, "<nil> INF github.com/traefik/traefik/v3/pkg/observability/logs/oxy_test.go:21 > foo\n", buf.String())
+ }
diff --git a/recipes/incoming-go/mc.toml b/recipes/incoming-go/mc.toml
new file mode 100644
index 00000000..b96dddde
--- /dev/null
+++ b/recipes/incoming-go/mc.toml
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "mc"
+version = "4.8.33"
+
+[source]
+tarball = "https://ftp.osuosl.org/pub/midnightcommander/mc-4.8.33.tar.xz"
+sha256  = "cae149d42f844e5185d8c81d7db3913a8fa214c65f852200a9d896b468af164c"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+configure = "./configure --prefix=/usr PERL=/home/sergio/.nixstore/0x66x7027f00bgk414vbg05hfzp2f1l2-perl-5.42.0/bin/perl PERL_FOR_BUILD=/home/sergio/.nixstore/0x66x7027f00bgk414vbg05hfzp2f1l2-perl-5.42.0/bin/perl --disable-configure-args"
+
+[deps]
+build = ["unzip", "file", "gettext", "glib", "libice", "libssh2", "openssl", "slang", "zip", "libx11", "e2fsprogs", "gpm"]
diff --git a/recipes/incoming-go/minikube.toml b/recipes/incoming-go/minikube.toml
new file mode 100644
index 00000000..d32ce047
--- /dev/null
+++ b/recipes/incoming-go/minikube.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "minikube"
+version = "1.38.1"
+
+[source]
+repo   = "https://github.com/kubernetes/minikube"
+commit = "v1.38.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, which, libvirt
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/oh-my-posh.toml b/recipes/incoming-go/oh-my-posh.toml
new file mode 100644
index 00000000..e1261000
--- /dev/null
+++ b/recipes/incoming-go/oh-my-posh.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "oh-my-posh"
+version = "29.19.0"
+
+[source]
+repo   = "https://github.com/jandedobbeleer/oh-my-posh"
+commit = "v29.19.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/operator-sdk.toml b/recipes/incoming-go/operator-sdk.toml
new file mode 100644
index 00000000..3b908cf0
--- /dev/null
+++ b/recipes/incoming-go/operator-sdk.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "operator-sdk"
+version = "1.42.3"
+
+[source]
+repo   = "https://github.com/operator-framework/operator-sdk"
+commit = "v1.42.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, gpgme
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/polaris.toml b/recipes/incoming-go/polaris.toml
new file mode 100644
index 00000000..69f7e279
--- /dev/null
+++ b/recipes/incoming-go/polaris.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "polaris"
+version = "0.14.3"
+
+[source]
+repo   = "https://github.com/agersant/polaris"
+commit = "0.14.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "polaris"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/polaris /out/usr/bin/polaris"
diff --git a/recipes/incoming-go/prometheus-blackbox-exporter.toml b/recipes/incoming-go/prometheus-blackbox-exporter.toml
new file mode 100644
index 00000000..500f44da
--- /dev/null
+++ b/recipes/incoming-go/prometheus-blackbox-exporter.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "blackbox_exporter"
+version = "0.28.0"
+
+[source]
+repo   = "https://github.com/prometheus/blackbox_exporter"
+commit = "v0.28.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/prometheus-node-exporter.toml b/recipes/incoming-go/prometheus-node-exporter.toml
new file mode 100644
index 00000000..47f4a7f7
--- /dev/null
+++ b/recipes/incoming-go/prometheus-node-exporter.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "node_exporter"
+version = "1.11.1"
+
+[source]
+repo   = "https://github.com/prometheus/node_exporter"
+commit = "v1.11.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/respect-cgo-flags.patch b/recipes/incoming-go/respect-cgo-flags.patch
new file mode 100644
index 00000000..e082639f
--- /dev/null
+++ b/recipes/incoming-go/respect-cgo-flags.patch
@@ -0,0 +1,102 @@
+--- a/Makefile
++++ b/Makefile
+@@ -120,11 +120,11 @@
+ .PHONY: generate
+ generate: install-mockery generate-openapi ## Run all code generations
+ 	mockery
+-	CGO_ENABLED=0 go generate ./...
++	CGO_ENABLED=${CGO_ENABLED} go generate ./...
+ 
+ generate-openapi: ## Run openapi code generation and format it
+-	CGO_ENABLED=0 go run github.com/swaggo/swag/cmd/swag fmt --exclude rpc/proto
+-	CGO_ENABLED=0 go generate cmd/server/openapi.go
++	CGO_ENABLED=${CGO_ENABLED} go run github.com/swaggo/swag/cmd/swag fmt --exclude rpc/proto
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/server/openapi.go
+ 
+ generate-license-header: install-addlicense
+ 	addlicense -c "Woodpecker Authors" -l apache -ignore "vendor/**" -ignore cmd/server/openapi/docs.go **/*.go
+@@ -218,10 +218,10 @@
+ 	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-server${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/server
+ 
+ build-agent: ## Build agent
+-	CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-agent${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-agent${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+ 
+ build-cli: ## Build cli
+-	CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-cli${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-cli${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+ 
+ build-tarball: ## Build tar archive
+ 	mkdir -p ${DIST_DIR} && tar chzvf ${DIST_DIR}/woodpecker-src.tar.gz \
+@@ -291,13 +291,13 @@
+ 
+ release-agent: ## Create agent binaries for release
+ 	# compile
+-	GOOS=linux   GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_amd64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_riscv64/woodpecker-agent     go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=arm     CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm/woodpecker-agent         go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=windows GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/windows_amd64/woodpecker-agent.exe go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_amd64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_arm64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_amd64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_riscv64/woodpecker-agent     go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=arm     CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm/woodpecker-agent         go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=windows GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/windows_amd64/woodpecker-agent.exe go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_amd64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_arm64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+ 	# tar binary files
+ 	tar -cvzf ${DIST_DIR}/woodpecker-agent_linux_amd64.tar.gz   -C ${DIST_DIR}/agent/linux_amd64   woodpecker-agent
+ 	tar -cvzf ${DIST_DIR}/woodpecker-agent_linux_arm64.tar.gz   -C ${DIST_DIR}/agent/linux_arm64   woodpecker-agent
+@@ -311,13 +311,13 @@
+ 
+ release-cli: ## Create cli binaries for release
+ 	# compile
+-	GOOS=linux   GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_amd64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_riscv64/woodpecker-cli     go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=arm     CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm/woodpecker-cli         go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=windows GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/windows_amd64/woodpecker-cli.exe go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_amd64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_arm64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_amd64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_riscv64/woodpecker-cli     go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=arm     CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm/woodpecker-cli         go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=windows GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/windows_amd64/woodpecker-cli.exe go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_amd64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_arm64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+ 	# tar binary files
+ 	tar -cvzf ${DIST_DIR}/woodpecker-cli_linux_amd64.tar.gz   -C ${DIST_DIR}/cli/linux_amd64   woodpecker-cli
+ 	tar -cvzf ${DIST_DIR}/woodpecker-cli_linux_arm64.tar.gz   -C ${DIST_DIR}/cli/linux_arm64   woodpecker-cli
+@@ -369,8 +369,8 @@
+ 
+ .PHONY: generate-docs
+ generate-docs: ## Generate docs (currently only for the cli)
+-	CGO_ENABLED=0 go generate cmd/cli/app.go
+-	CGO_ENABLED=0 go generate cmd/server/openapi.go
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/cli/app.go
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/server/openapi.go
+ 
+ .PHONY: build-docs
+ build-docs: generate-docs docs-dependencies ## Build the docs
+@@ -379,15 +379,15 @@
+ ##@ Man Pages
+ .PHONY: man-cli
+ man-cli: ## Generate man pages for cli
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man cmd/cli/man.go cmd/cli/app.go > dist/woodpecker-cli.man.1 && gzip -9 -f dist/woodpecker-cli.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man cmd/cli/man.go cmd/cli/app.go > dist/woodpecker-cli.man.1 && gzip -9 -f dist/woodpecker-cli.man.1
+ 
+ .PHONY: man-agent
+ man-agent: ## Generate man pages for agent
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man cmd/agent/man.go > dist/woodpecker-agent.man.1 && gzip -9 -f dist/woodpecker-agent.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man cmd/agent/man.go > dist/woodpecker-agent.man.1 && gzip -9 -f dist/woodpecker-agent.man.1
+ 
+ .PHONY: man-server
+ man-server: ## Generate man pages for server
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man go.woodpecker-ci.org/woodpecker/v3/cmd/server > dist/woodpecker-server.man.1 && gzip -9 -f dist/woodpecker-server.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man go.woodpecker-ci.org/woodpecker/v3/cmd/server > dist/woodpecker-server.man.1 && gzip -9 -f dist/woodpecker-server.man.1
+ 
+ .PHONY: man
+ man: man-cli man-agent man-server ## Generate all man pages
diff --git a/recipes/incoming-go/skaffold.toml b/recipes/incoming-go/skaffold.toml
new file mode 100644
index 00000000..8029bed1
--- /dev/null
+++ b/recipes/incoming-go/skaffold.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "skaffold"
+version = "2.23.0"
+
+[source]
+repo   = "https://github.com/GoogleContainerTools/skaffold"
+commit = "v2.23.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/skip-alternate-unix-sh-test.patch b/recipes/incoming-go/skip-alternate-unix-sh-test.patch
new file mode 100644
index 00000000..8e1b38a4
--- /dev/null
+++ b/recipes/incoming-go/skip-alternate-unix-sh-test.patch
@@ -0,0 +1,428 @@
+--- a/pipeline/backend/local/local_test.go
++++ b/pipeline/backend/local/local_test.go
+@@ -19,14 +19,14 @@
+ import (
+ 	"context"
+ 	"fmt"
+-	"io"
++//	"io"
+ 	"os"
+-	"os/exec"
++//	"os/exec"
+ 	"path/filepath"
+ 	"runtime"
+-	"slices"
++//	"slices"
+ 	"strings"
+-	"sync"
++//	"sync"
+ 	"sync/atomic"
+ 	"testing"
+ 	"time"
+@@ -163,206 +163,206 @@
+ 		}
+ 	})
+ }
+-
+-func TestRunStep(t *testing.T) {
+-	if runtime.GOOS != "linux" {
+-		t.Skip("skipping on non linux due to shell availability and symlink capability")
+-	}
+-
+-	// we lookup shell tools we use first and create the PATH var based on that
+-	shBinary, err := exec.LookPath("sh")
+-	require.NoError(t, err)
+-	path := []string{filepath.Dir(shBinary)}
+-	echoBinary, err := exec.LookPath("echo")
+-	require.NoError(t, err)
+-	if echoPath := filepath.Dir(echoBinary); !slices.Contains(path, echoPath) {
+-		path = append(path, echoPath)
+-	}
+-	// we make a symlinc to have a posix but non default shell
+-	altShellDir := t.TempDir()
+-	altShellPath := filepath.Join(altShellDir, "altsh")
+-	require.NoError(t, os.Symlink(shBinary, altShellPath))
+-	path = append(path, altShellDir)
+-
+-	prepairEnv(t)
+-	//nolint:usetesting // reason: we use prepairEnv()
+-	os.Setenv("PATH", strings.Join(path, ":"))
+-
+-	backend, _ := New().(*local)
+-	backend.tempDir = t.TempDir()
+-	backend.isolatedHome = true
+-	ctx := t.Context()
+-	taskUUID := "test-run-tasks"
+-
+-	// Setup workflow
+-	require.NoError(t, backend.SetupWorkflow(ctx, &types.Config{}, taskUUID))
+-
+-	t.Run("type commands", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-1",
+-			Name:     "test-step",
+-			Type:     types.StepTypeCommands,
+-			Image:    "sh",
+-			Commands: []string{"echo hello", "env"},
+-			Environment: map[string]string{
+-				"TEST_VAR": "test_value",
+-			},
+-		}
+-
+-		t.Run("start successful", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			require.NoError(t, err)
+-
+-			// Verify command was started
+-			state, err := backend.getWorkflowState(taskUUID)
+-			require.NoError(t, err)
+-			stepStateWraped, contains := state.stepState.Load(step.UUID)
+-			assert.True(t, contains)
+-			stepState, _ := stepStateWraped.(*stepState)
+-			assert.NotNil(t, stepState.cmd)
+-
+-			var outputData []byte
+-			outputDataMutex := sync.Mutex{}
+-			go t.Run("TailStep", func(t *testing.T) {
+-				outputDataMutex.Lock()
+-				go outputDataMutex.Unlock()
+-				output, err := backend.TailStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-				assert.NotNil(t, output)
+-
+-				// Read output
+-				outputData, err = io.ReadAll(output)
+-				require.NoError(t, err)
+-			})
+-
+-			// Wait for step to finish
+-			t.Run("TestWaitStep", func(t *testing.T) {
+-				time.Sleep(time.Second / 5) // needed to prevent race condition on outputData
+-				state, err := backend.WaitStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-				assert.True(t, state.Exited)
+-				assert.Equal(t, 0, state.ExitCode)
+-			})
+-
+-			// Verify output
+-			outputDataMutex.Lock()
+-			go outputDataMutex.Unlock()
+-			outputLines := strings.Split(strings.TrimSpace(string(outputData)), "\n")
+-			require.Truef(t, len(outputLines) > 3, "output of lines must be bigger than 3 at least but we got: %#v", outputLines)
+-			// we first test output without environments
+-			wantBeforeEnvs := []string{
+-				"+ echo hello",
+-				"hello",
+-				"+ env",
+-			}
+-			gotBeforeEnvs := outputLines[:len(wantBeforeEnvs)]
+-			assert.Equal(t, wantBeforeEnvs, gotBeforeEnvs)
+-			// we filter out nixos specific stuff catched up in env output
+-			gotEnvs := slices.DeleteFunc(outputLines[len(wantBeforeEnvs):], func(s string) bool {
+-				return strings.HasPrefix(s, "_=") || strings.HasPrefix(s, "SHLVL=")
+-			})
+-			assert.ElementsMatch(t, []string{
+-				"PWD=" + state.baseDir + "/workspace",
+-				"USERPROFILE=" + state.baseDir + "/home",
+-				"TEST_VAR=test_value",
+-				"HOME=" + state.baseDir + "/home",
+-				"CI_WORKSPACE=" + state.baseDir + "/workspace",
+-				"PATH=" + strings.Join(path, ":"),
+-			}, gotEnvs)
+-
+-			t.Run("TestDestroyStep", func(t *testing.T) {
+-				err := backend.DestroyStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-			})
+-		})
+-	})
+-
+-	t.Run("run command in alternate unix shell", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-altshell",
+-			Name:     "altshell",
+-			Type:     types.StepTypeCommands,
+-			Image:    "altsh",
+-			Commands: []string{"echo success"},
+-		}
+-
+-		err = backend.StartStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-
+-		state, err := backend.WaitStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-		assert.True(t, state.Exited)
+-		assert.Equal(t, 0, state.ExitCode)
+-	})
+-
+-	t.Run("command should fail", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-fail",
+-			Name:     "fail-step",
+-			Type:     types.StepTypeCommands,
+-			Image:    "sh",
+-			Commands: []string{"exit 1"},
+-		}
+-
+-		err = backend.StartStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-
+-		state, err := backend.WaitStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-		assert.True(t, state.Exited)
+-		assert.Equal(t, 1, state.ExitCode)
+-	})
+-
+-	t.Run("WaitStep", func(t *testing.T) {
+-		t.Run("step not found", func(t *testing.T) {
+-			step := &types.Step{
+-				UUID: "nonexistent-step",
+-				Name: "missing",
+-			}
+-
+-			_, err = backend.WaitStep(ctx, step, taskUUID)
+-			assert.Error(t, err)
+-			assert.Contains(t, err.Error(), "not found")
+-		})
+-	})
+-
+-	t.Run("type plugin", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:        "step-plugin-1",
+-			Name:        "test-plugin",
+-			Type:        types.StepTypePlugin,
+-			Image:       "echo", // Use a binary that exists
+-			Environment: map[string]string{},
+-		}
+-
+-		t.Run("start", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			require.NoError(t, err)
+-
+-			// Verify command was started
+-			state, err := backend.getStepState(taskUUID, step.UUID)
+-			require.NoError(t, err)
+-			assert.NotEqualf(t, 0, state.cmd.Process.Pid, "expect an pid of the process")
+-		})
+-	})
+-
+-	t.Run("type unsupported", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID: "step-unsupported",
+-			Name: "test-unsupported",
+-			Type: "unsupported-type",
+-		}
+-
+-		t.Run("start", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			assert.ErrorIs(t, err, ErrUnsupportedStepType)
+-		})
+-	})
+-
+-	// Cleanup
+-	assert.NoError(t, backend.DestroyWorkflow(ctx, &types.Config{}, taskUUID))
+-}
+-
++//
++//func TestRunStep(t *testing.T) {
++//	if runtime.GOOS != "linux" {
++//		t.Skip("skipping on non linux due to shell availability and symlink capability")
++//	}
++//
++//	// we lookup shell tools we use first and create the PATH var based on that
++//	shBinary, err := exec.LookPath("sh")
++//	require.NoError(t, err)
++//	path := []string{filepath.Dir(shBinary)}
++//	echoBinary, err := exec.LookPath("echo")
++//	require.NoError(t, err)
++//	if echoPath := filepath.Dir(echoBinary); !slices.Contains(path, echoPath) {
++//		path = append(path, echoPath)
++//	}
++//	// we make a symlinc to have a posix but non default shell
++//	altShellDir := t.TempDir()
++//	altShellPath := filepath.Join(altShellDir, "altsh")
++//	require.NoError(t, os.Symlink(shBinary, altShellPath))
++//	path = append(path, altShellDir)
++//
++//	prepairEnv(t)
++//	//nolint:usetesting // reason: we use prepairEnv()
++//	os.Setenv("PATH", strings.Join(path, ":"))
++//
++//	backend, _ := New().(*local)
++//	backend.tempDir = t.TempDir()
++//	backend.isolatedHome = true
++//	ctx := t.Context()
++//	taskUUID := "test-run-tasks"
++//
++//	// Setup workflow
++//	require.NoError(t, backend.SetupWorkflow(ctx, &types.Config{}, taskUUID))
++//
++//	t.Run("type commands", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-1",
++//			Name:     "test-step",
++//			Type:     types.StepTypeCommands,
++//			Image:    "sh",
++//			Commands: []string{"echo hello", "env"},
++//			Environment: map[string]string{
++//				"TEST_VAR": "test_value",
++//			},
++//		}
++//
++//		t.Run("start successful", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			require.NoError(t, err)
++//
++//			// Verify command was started
++//			state, err := backend.getWorkflowState(taskUUID)
++//			require.NoError(t, err)
++//			stepStateWraped, contains := state.stepState.Load(step.UUID)
++//			assert.True(t, contains)
++//			stepState, _ := stepStateWraped.(*stepState)
++//			assert.NotNil(t, stepState.cmd)
++//
++//			var outputData []byte
++//			outputDataMutex := sync.Mutex{}
++//			go t.Run("TailStep", func(t *testing.T) {
++//				outputDataMutex.Lock()
++//				go outputDataMutex.Unlock()
++//				output, err := backend.TailStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//				assert.NotNil(t, output)
++//
++//				// Read output
++//				outputData, err = io.ReadAll(output)
++//				require.NoError(t, err)
++//			})
++//
++//			// Wait for step to finish
++//			t.Run("TestWaitStep", func(t *testing.T) {
++//				time.Sleep(time.Second / 5) // needed to prevent race condition on outputData
++//				state, err := backend.WaitStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//				assert.True(t, state.Exited)
++//				assert.Equal(t, 0, state.ExitCode)
++//			})
++//
++//			// Verify output
++//			outputDataMutex.Lock()
++//			go outputDataMutex.Unlock()
++//			outputLines := strings.Split(strings.TrimSpace(string(outputData)), "\n")
++//			require.Truef(t, len(outputLines) > 3, "output of lines must be bigger than 3 at least but we got: %#v", outputLines)
++//			// we first test output without environments
++//			wantBeforeEnvs := []string{
++//				"+ echo hello",
++//				"hello",
++//				"+ env",
++//			}
++//			gotBeforeEnvs := outputLines[:len(wantBeforeEnvs)]
++//			assert.Equal(t, wantBeforeEnvs, gotBeforeEnvs)
++//			// we filter out nixos specific stuff catched up in env output
++//			gotEnvs := slices.DeleteFunc(outputLines[len(wantBeforeEnvs):], func(s string) bool {
++//				return strings.HasPrefix(s, "_=") || strings.HasPrefix(s, "SHLVL=")
++//			})
++//			assert.ElementsMatch(t, []string{
++//				"PWD=" + state.baseDir + "/workspace",
++//				"USERPROFILE=" + state.baseDir + "/home",
++//				"TEST_VAR=test_value",
++//				"HOME=" + state.baseDir + "/home",
++//				"CI_WORKSPACE=" + state.baseDir + "/workspace",
++//				"PATH=" + strings.Join(path, ":"),
++//			}, gotEnvs)
++//
++//			t.Run("TestDestroyStep", func(t *testing.T) {
++//				err := backend.DestroyStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//			})
++//		})
++//	})
++//
++//	t.Run("run command in alternate unix shell", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-altshell",
++//			Name:     "altshell",
++//			Type:     types.StepTypeCommands,
++//			Image:    "altsh",
++//			Commands: []string{"echo success"},
++//		}
++//
++//		err = backend.StartStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//
++//		state, err := backend.WaitStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//		assert.True(t, state.Exited)
++//		assert.Equal(t, 0, state.ExitCode)
++//	})
++//
++//	t.Run("command should fail", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-fail",
++//			Name:     "fail-step",
++//			Type:     types.StepTypeCommands,
++//			Image:    "sh",
++//			Commands: []string{"exit 1"},
++//		}
++//
++//		err = backend.StartStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//
++//		state, err := backend.WaitStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//		assert.True(t, state.Exited)
++//		assert.Equal(t, 1, state.ExitCode)
++//	})
++//
++//	t.Run("WaitStep", func(t *testing.T) {
++//		t.Run("step not found", func(t *testing.T) {
++//			step := &types.Step{
++//				UUID: "nonexistent-step",
++//				Name: "missing",
++//			}
++//
++//			_, err = backend.WaitStep(ctx, step, taskUUID)
++//			assert.Error(t, err)
++//			assert.Contains(t, err.Error(), "not found")
++//		})
++//	})
++//
++//	t.Run("type plugin", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:        "step-plugin-1",
++//			Name:        "test-plugin",
++//			Type:        types.StepTypePlugin,
++//			Image:       "echo", // Use a binary that exists
++//			Environment: map[string]string{},
++//		}
++//
++//		t.Run("start", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			require.NoError(t, err)
++//
++//			// Verify command was started
++//			state, err := backend.getStepState(taskUUID, step.UUID)
++//			require.NoError(t, err)
++//			assert.NotEqualf(t, 0, state.cmd.Process.Pid, "expect an pid of the process")
++//		})
++//	})
++//
++//	t.Run("type unsupported", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID: "step-unsupported",
++//			Name: "test-unsupported",
++//			Type: "unsupported-type",
++//		}
++//
++//		t.Run("start", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			assert.ErrorIs(t, err, ErrUnsupportedStepType)
++//		})
++//	})
++//
++//	// Cleanup
++//	assert.NoError(t, backend.DestroyWorkflow(ctx, &types.Config{}, taskUUID))
++//}
++//
+ func TestStateManagement(t *testing.T) {
+ 	backend, _ := New().(*local)
+ 
diff --git a/recipes/incoming-go/skopeo.toml b/recipes/incoming-go/skopeo.toml
new file mode 100644
index 00000000..28fabeb7
--- /dev/null
+++ b/recipes/incoming-go/skopeo.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "skopeo"
+version = "1.23.0"
+
+[source]
+repo   = "https://github.com/containers/skopeo"
+commit = "v1.23.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, go-md2man, gpgme, lvm2, btrfs-progs
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/ssh-vault.toml b/recipes/incoming-go/ssh-vault.toml
new file mode 100644
index 00000000..366be2dd
--- /dev/null
+++ b/recipes/incoming-go/ssh-vault.toml
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "ssh-vault"
+version = "1.2.10"
+
+[source]
+repo   = "https://github.com/ssh-vault/ssh-vault"
+commit = "1.2.10"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "ssh-vault"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/ssh-vault /out/usr/bin/ssh-vault"
+
+# buildInputs de nix (NO deps de hammer — cargo vendorea; backend Rust por
+# defecto). Si algún sys-crate C falla, adaptá per-paquete (patch/feature): openssl
diff --git a/recipes/incoming-go/staticcheck.toml b/recipes/incoming-go/staticcheck.toml
new file mode 100644
index 00000000..0a7097ad
--- /dev/null
+++ b/recipes/incoming-go/staticcheck.toml
@@ -0,0 +1,43 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "staticcheck"
+version = "2026.1"
+
+[source]
+tarball = "https://github.com/dominikh/go-tools/archive/refs/tags/2026.1.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "d0594069505f3a16cb0de51c92edf22d53c66ce42829575e29b72f1a83e9b929a2c7876d5af3d12321ead054cf525a9de6cdfbbd163e070314788f5aea20bcab"
+sha256  = "4b20d65194e5462264c784f2968de65fcd7aba8e9efa37aa9b1fadc13b29699b"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+export CGO_CPPFLAGS="$CPPFLAGS"
+	export CGO_CFLAGS="$CFLAGS"
+	export CGO_CXXFLAGS="$CXXFLAGS"
+	export CGO_LDFLAGS="$LDFLAGS"
+
+	mkdir -p bin
+	go build -o ./bin ./...
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -p -Dm755 -t "/out/usr/bin/" bin/*
+
+	install -Dm644 "LICENSE"  "/out/usr/share/licenses/staticcheck/LICENSE"
+	install -Dm644 "LICENSE-THIRD-PARTY" \
+		"/out/usr/share/licenses/staticcheck/LICENSE-THIRD-PARTY"
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/syft.toml b/recipes/incoming-go/syft.toml
new file mode 100644
index 00000000..ccda432a
--- /dev/null
+++ b/recipes/incoming-go/syft.toml
@@ -0,0 +1,45 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "syft"
+version = "1.42.4"
+
+[source]
+tarball = "https://github.com/anchore/syft/archive/v1.42.4/syft-1.42.4.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "846637c7ced355722f86aee40a080383cd708f680216e83c664d3103af37ed4e205b2b64369cb61bd4f39233645ec3fa3694c527144e228b73b5c88b2f6242ba"
+sha256  = "8e84d456e253149d0e0c5a381a1cc4121a0e169c0608c73f99eed9ea56ed036d"
+patches = ["disable-update-check.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+go build -ldflags "
+		-X main.version=1.42.4
+		" \
+		-o bin/syft ./cmd/syft
+
+	bin/syft completion bash >syft.bash
+	bin/syft completion fish >syft.fish
+	bin/syft completion zsh >syft.zsh
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 bin/syft -t "/out"/usr/bin/
+
+	install -Dm644 syft.bash "/out"/usr/share/bash-completion/completions/syft
+	install -Dm644 syft.fish "/out"/usr/share/fish/vendor_completions.d/syft.fish
+	install -Dm644 syft.zsh "/out"/usr/share/zsh/site-functions/_syft
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/syncthing.toml b/recipes/incoming-go/syncthing.toml
new file mode 100644
index 00000000..7056e35b
--- /dev/null
+++ b/recipes/incoming-go/syncthing.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "syncthing"
+version = "2.1.0"
+
+[source]
+repo   = "https://github.com/syncthing/syncthing"
+commit = "v2.1.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/syslog-log-format.patch b/recipes/incoming-go/syslog-log-format.patch
new file mode 100644
index 00000000..fa6b22c5
--- /dev/null
+++ b/recipes/incoming-go/syslog-log-format.patch
@@ -0,0 +1,98 @@
+Add "syslog" log format.
+
+I didn't contribute this patch to the upstream because I don't wanna
+contribute to any Go projects. However, if you find this patch useful,
+feel free to send it to the upstream under your name.
+
+diff --git a/log/configuration.go b/log/configuration.go
+index a756242b8..cbe4dabcd 100644
+--- a/log/configuration.go
++++ b/log/configuration.go
+@@ -13,6 +13,7 @@ const (
+ 	FormatRunner = "runner"
+ 	FormatText   = "text"
+ 	FormatJSON   = "json"
++	FormatSyslog = "syslog"
+ )
+ 
+ var (
+@@ -26,7 +27,7 @@ var (
+ 		},
+ 		cli.StringFlag{
+ 			Name:   "log-format",
+-			Usage:  "Choose log format (options: runner, text, json)",
++			Usage:  "Choose log format (options: runner, text, json, syslog)",
+ 			EnvVar: "LOG_FORMAT",
+ 		},
+ 		cli.StringFlag{
+@@ -44,6 +45,7 @@ var (
+ 		FormatJSON: &logrus.JSONFormatter{
+ 			TimestampFormat: time.RFC3339Nano,
+ 		},
++		FormatSyslog: new(SyslogFormatter),
+ 	}
+ )
+ 
+diff --git a/log/syslog_formatter.go b/log/syslog_formatter.go
+new file mode 100644
+index 000000000..fe60e0fc7
+--- /dev/null
++++ b/log/syslog_formatter.go
+@@ -0,0 +1,57 @@
++package log
++
++import (
++	"bytes"
++	"fmt"
++	"time"
++
++	"github.com/sirupsen/logrus"
++)
++
++type SyslogFormatter struct {
++}
++
++func (f *SyslogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
++	var b *bytes.Buffer
++	if entry.Buffer != nil {
++		b = entry.Buffer
++	} else {
++		b = &bytes.Buffer{}
++	}
++
++	if entry.Message != "" {
++		b.WriteString(entry.Message)
++	}
++	dataWritten := false
++	for key, val := range entry.Data {
++		if key == "now" {
++			continue
++		}
++		var stringVal string
++
++		switch val := val.(type) {
++		case time.Time:
++			stringVal = val.Format(time.RFC3339)
++		default:
++			var ok bool
++			if stringVal, ok = val.(string); !ok {
++				stringVal = fmt.Sprint(val)
++			}
++		}
++
++		// The format is inspired by RFC 5424 STRUCTURED-DATA.
++		if dataWritten {
++			b.WriteByte(' ')
++		} else {
++			b.WriteString(" [meta ")
++			dataWritten = true
++		}
++		b.WriteString(fmt.Sprintf("%s=%q", key, stringVal))
++	}
++	if dataWritten {
++		b.WriteByte(']')
++	}
++	b.WriteByte('\n')
++
++	return b.Bytes(), nil
++}
diff --git a/recipes/incoming-go/talosctl.toml b/recipes/incoming-go/talosctl.toml
new file mode 100644
index 00000000..d14fa4d5
--- /dev/null
+++ b/recipes/incoming-go/talosctl.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "talosctl"
+version = "1.13.5"
+
+[source]
+repo   = "https://github.com/siderolabs/talos"
+commit = "v1.13.5"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/tea.toml b/recipes/incoming-go/tea.toml
new file mode 100644
index 00000000..ee597c94
--- /dev/null
+++ b/recipes/incoming-go/tea.toml
@@ -0,0 +1,36 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "tea"
+version = "0.9.2"
+
+[source]
+tarball = "https://gitea.com/gitea/tea/archive/v0.9.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "05be2ea5f845773324c10fe8f0340c96f40f392b7ef8cafb44463b7a5492de2216799d8cc339e7dc42e921afcd3ba0e21be133a87385e907af47261733935e62"
+sha256  = "b5a944de8db7d5af4aa87e9640261c925f094d2b6d26c4faf2701773acab219b"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+local sdk=$(go list -f '{{.Version}}' -m code.gitea.io/sdk/gitea)
+
+	go build -ldflags "-X main.Version=0.9.2 -X main.SDK=$sdk" -o tea
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 "$builddir"/tea "/out"/usr/bin/tea
+	install -Dm644 "$srcdir"/bash_autocomplete "/out"/usr/share/bash-completion/completions/tea
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/terrascan.toml b/recipes/incoming-go/terrascan.toml
new file mode 100644
index 00000000..5492f81f
--- /dev/null
+++ b/recipes/incoming-go/terrascan.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "terrascan"
+version = "1.19.9"
+
+[source]
+repo   = "https://github.com/accurics/terrascan"
+commit = "v1.19.9"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/tilt.toml b/recipes/incoming-go/tilt.toml
new file mode 100644
index 00000000..78f88330
--- /dev/null
+++ b/recipes/incoming-go/tilt.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "tilt"
+version = "0.37.3"
+
+[source]
+repo   = "https://github.com/tilt-dev/tilt"
+commit = "v0.37.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/traefik.toml b/recipes/incoming-go/traefik.toml
new file mode 100644
index 00000000..e456e29f
--- /dev/null
+++ b/recipes/incoming-go/traefik.toml
@@ -0,0 +1,49 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "traefik"
+version = "3.7.1"
+
+[source]
+tarball = "https://github.com/traefik/traefik/releases/download/v3.7.1/traefik-v3.7.1.src.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "dd09d3e0a548c300a07c446c1b25f45f46c44c24eb214c899738ffa99ada80cd52e9493be0afdb793fcb57f52ac0b797c5a77f1cfd22a6e154af3cca4544083a"
+sha256  = "8d6e5b7bae2b255e42f0ff3a8cf3c7eb02e1a29778931e67d7b2cde1759336f5"
+patches = ["logs_tests.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+local builddate="$(date -u "+%Y-%m-%dT%TZ" ${SOURCE_DATE_EPOCH:+-d @$SOURCE_DATE_EPOCH})"
+
+	go generate -v
+	go build -v -ldflags "-s -w -extldflags \"$LDFLAGS\" \
+			-X github.com/traefik/traefik/v3/pkg/version.Codename=cheddar \
+			-X github.com/traefik/traefik/v3/pkg/version.Version=3.7.1 \
+			-X github.com/traefik/traefik/v3/pkg/version.BuildDate=$builddate" \
+		-o bin/ ./cmd/traefik
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 bin/traefik "/out"/usr/sbin/traefik
+	install -Dm644 LICENSE.md -t "/out"/usr/share/licenses/traefik/
+	install -dm775 -o traefik -g traefik "/out"/var/log/traefik
+	install -dm750 -o traefik -g traefik "/out"/etc/traefik
+	install -m644 -o traefik -g traefik "$srcdir"/traefik.yaml \
+		-t "/out"/etc/traefik/
+
+	install -Dm755 "$srcdir"/traefik.initd "/out"/etc/init.d/traefik
+	install -Dm644 "$srcdir"/traefik.confd "/out"/etc/conf.d/traefik
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-go/trivy.toml b/recipes/incoming-go/trivy.toml
new file mode 100644
index 00000000..71996e90
--- /dev/null
+++ b/recipes/incoming-go/trivy.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "trivy"
+version = "0.72.0"
+
+[source]
+repo   = "https://github.com/aquasecurity/trivy"
+commit = "v0.72.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/use-logrus-syslog-hook.patch b/recipes/incoming-go/use-logrus-syslog-hook.patch
new file mode 100644
index 00000000..0690d30f
--- /dev/null
+++ b/recipes/incoming-go/use-logrus-syslog-hook.patch
@@ -0,0 +1,43 @@
+Replace gitlab-runner/log/system_logger with standard logrus/hooks/syslog.
+There are two reasons:
+
+1. gitlab-runner/log/system_logger delegates the syslog initialization
+   (syslog.Dial) to kardianos/service, which doesn't set the syslog
+   facility. This results in messages logged with the "kern" facility.
+2. gitlab-runner/log/system_logger maps Error, Panic, and Fatal levels
+   to the syslog's "err" level, but Panic and Fatal could be mapped to
+   the "crit" level.
+
+I didn't contribute this patch to the upstream because I don't wanna
+contribute to any Go projects. However, if you find this patch useful,
+feel free to send it to the upstream under your name.
+
+diff --git a/commands/multi.go b/commands/multi.go
+index e62594be6..a0c2d659b 100644
+--- a/commands/multi.go
++++ b/commands/multi.go
+@@ -37,6 +37,9 @@ import (
+ 	"gitlab.com/gitlab-org/gitlab-runner/log"
+ 	"gitlab.com/gitlab-org/gitlab-runner/network"
+ 	"gitlab.com/gitlab-org/gitlab-runner/session"
++
++	"log/syslog"
++	lSyslog "github.com/sirupsen/logrus/hooks/syslog"
+ )
+ 
+ const (
+@@ -1462,7 +1465,13 @@ func (mr *RunCommand) Execute(_ *cli.Context) {
+ 	}
+ 
+ 	if mr.Syslog {
+-		log.SetSystemLogger(logrus.StandardLogger(), svc)
++		hook, err := lSyslog.NewSyslogHook("", "", syslog.LOG_DAEMON | syslog.LOG_INFO, mr.ServiceName)
++		if err == nil {
++			logrus.AddHook(hook)
++		} else {
++			logrus.WithError(err).
++				Error("Error while setting up the system logger")
++		}
+ 	}
+ 
+ 	mr.sentryLogHookMutex.Lock()
diff --git a/recipes/incoming-go/vale.toml b/recipes/incoming-go/vale.toml
new file mode 100644
index 00000000..5dfa0dd7
--- /dev/null
+++ b/recipes/incoming-go/vale.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "vale"
+version = "3.15.1"
+
+[source]
+repo   = "https://github.com/errata-ai/vale"
+commit = "v3.15.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/werf.toml b/recipes/incoming-go/werf.toml
new file mode 100644
index 00000000..99149a86
--- /dev/null
+++ b/recipes/incoming-go/werf.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "werf"
+version = "2.72.1"
+
+[source]
+repo   = "https://github.com/werf/werf"
+commit = "v2.72.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, btrfs-progs, glibc
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/woodpecker.toml b/recipes/incoming-go/woodpecker.toml
new file mode 100644
index 00000000..d57cc0d7
--- /dev/null
+++ b/recipes/incoming-go/woodpecker.toml
@@ -0,0 +1,65 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "woodpecker"
+version = "3.14.1"
+
+[source]
+tarball = "https://github.com/woodpecker-ci/woodpecker/releases/download/v3.14.1/woodpecker-src.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "6a8a7183f2a7ffaa9df6b4e23396153ceedfd08e666ec9aecd49de35ff75b09aff437c76452878769270e548fe4d564031a1fbe9dff84a217334e97214e4c510"
+sha256  = "dafba02f6a55f748a80d0fa4d66720c7436af446baf903e5187553834226f3a4"
+patches = ["respect-cgo-flags.patch", "disable-race-tests.patch", "disable-ui-openai-generation.patch", "skip-alternate-unix-sh-test.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+export TARGETARCH="$(go env GOHOSTARCH)"
+	make build -j1 STATIC_BUILD=false VERSION=3.14.1
+	make docs
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+# Install server
+	install -Dm755 "$builddir"/dist/woodpecker-server \
+		"/out"/usr/bin/woodpecker-server
+
+	# Install initd & conf
+	install -Dm755 "$srcdir"/woodpecker-server.initd \
+		"/out"/etc/init.d/woodpecker-server
+	install -Dm640 -o woodpecker -g woodpecker "$srcdir"/woodpecker-server.conf \
+		"/out"/etc/woodpecker/server.conf
+
+	# Install web resources
+	install -d -m 755 -o woodpecker -g woodpecker "/out"/usr/share/webapps/woodpecker
+	cp -R "$builddir"/web/dist/* "/out"/usr/share/webapps/woodpecker/
+
+	# Create empty log & lib directories
+	install -d -m0750 -o woodpecker -g woodpecker \
+		"/out"/var/log/woodpecker "/out"/var/lib/woodpecker
+
+	# Install logrotate rules
+	install -Dm644 "$srcdir"/woodpecker-server.logrotate \
+		"/out"/etc/logrotate.d/woodpecker-server
+
+	# Install mandocs
+	mkdir -p "/out"/usr/share/doc/woodpecker
+	cp -R "$builddir"/docs/docs/* "/out"/usr/share/doc/woodpecker/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): openrc
+
+[deps]
+build = ["go-swag", "sqlite", "pnpm"]
diff --git a/recipes/incoming-go/wtf.toml b/recipes/incoming-go/wtf.toml
new file mode 100644
index 00000000..95ac3af5
--- /dev/null
+++ b/recipes/incoming-go/wtf.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "wtf"
+version = "0.5.7"
+
+[source]
+repo   = "https://github.com/0vercl0k/wtf"
+commit = "v0.5.7"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["cmake", "ninja"]
diff --git a/recipes/incoming-go/wuzz.toml b/recipes/incoming-go/wuzz.toml
new file mode 100644
index 00000000..ba1ee86a
--- /dev/null
+++ b/recipes/incoming-go/wuzz.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "wuzz"
+version = "0.5.0"
+
+[source]
+repo   = "https://github.com/asciimoo/wuzz"
+commit = "v0.5.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming-go/xq.toml b/recipes/incoming-go/xq.toml
new file mode 100644
index 00000000..da398bce
--- /dev/null
+++ b/recipes/incoming-go/xq.toml
@@ -0,0 +1,36 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "xq"
+version = "1.3.0"
+
+[source]
+tarball = "https://github.com/sibprogrammer/xq/archive/v1.3.0/xq-1.3.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "5f8678d566f0fbaf9466771b20dde42dca8ef3d6a6c828031dd608279e6b2cefe4090bcc22b4ac098b3cac5a8150e2dc4a6c37a296fd1243bb46948368d33284"
+sha256  = "6f75b4433ac83b9ddbc60e1106349e22654d14bb58e198f811b2f9d10181ee8f"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+go build
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 xq /out/usr/bin/xq
+	install -Dm644 README.md "/out/usr/share/doc/xq/README"
+	install -Dm644 LICENSE "/out"/usr/share/licenses/xq/LICENSE
+	install -Dm644 docs/xq.man /out/usr/share/man/man1/xq.1
+}
+_abuild_phase
+'''
diff --git a/tandas/go-refeed-1.txt b/tandas/go-refeed-1.txt
new file mode 100644
index 00000000..357ebe2a
--- /dev/null
+++ b/tandas/go-refeed-1.txt
@@ -0,0 +1,60 @@
+anew
+apko
+assetfinder
+atlas
+aws-vault
+bom
+chaos-client
+chartmuseum
+container-diff
+crane
+dagger
+dbgate
+dlv
+dnsprobe
+dolt
+dyff-cli
+etcd
+fabric
+falco
+flux
+fluxcd
+flyctl
+forgejo
+fortio
+frp
+fubectl
+gf
+gitlab-runner
+gitleaks2
+glow-cli
+glsh
+gocron
+godoc
+gohugo
+golang-migrate
+goldilocks
+gomi
+gotop
+gping-go
+gross
+grype
+grype2
+gtt
+htmlq-go
+httpstat
+inlets
+jb
+jc
+jnv-go
+jsonnet
+k0s
+kics
+krew
+kubescape
+kubetail
+kubie
+lego
+mc
+melange
+minikube
diff --git a/tandas/go-refeed-2.txt b/tandas/go-refeed-2.txt
new file mode 100644
index 00000000..63d7ab51
--- /dev/null
+++ b/tandas/go-refeed-2.txt
@@ -0,0 +1,48 @@
+mockery
+mq
+nancy
+oh-my-posh
+opa
+operator-sdk
+pint
+polaris
+prometheus-blackbox-exporter
+prometheus-node-exporter
+puredns
+redpanda-connect
+rekor-cli
+restique
+revive
+sake
+scorecard
+scw
+sealed-secrets
+seaweedfs
+skaffold
+skopeo
+skopeo-go
+sops-cli
+ssh-vault
+sshs-go
+staticcheck
+step-ca
+stringer
+syft
+syncthing
+talosctl
+tea
+terrascan
+tilt
+timetrace
+traefik
+trivy
+trivy2
+usqlx
+vale
+werf
+woodpecker
+wtf
+wuzz
+xq
+yamllint-go
+yh