diff --git a/profiles/stackrox/README.md b/profiles/stackrox/README.md
index 1a934d74..66cf11a0 100644
--- a/profiles/stackrox/README.md
+++ b/profiles/stackrox/README.md
@@ -4,10 +4,18 @@
 NVIDIA OpenShell community base with integrations shared by StackRox workflows,
 including Atlassian MCP and Google Workspace tooling.
 
+It also includes the ACS triage toolchain: Go, `gopls` (the Go-analysis MCP
+server), and `ajv-cli` for JSON Schema validation. `gcloud` is intentionally
+not included; OpenShell provider credentials and inference routing replace the
+runner-side service-account setup used by the original GitHub Actions workflow.
+
 Generic Harness workflows use the NVIDIA base image directly. Select the
 published StackRox image only when a workflow needs one of these additions;
 providers, credentials, skills, and task-specific policy remain outside the
-image.
+image. The image does not create or attach providers; a workflow must name
+providers that are already provisioned and attach them through
+`sandbox.providers` before provider credentials or inference routes are
+available.
 
 Build it locally with:
 
diff --git a/profiles/stackrox/image/sandbox-default/CLAUDE.md b/profiles/stackrox/image/sandbox-default/CLAUDE.md
index 17558135..ff23673a 100644
--- a/profiles/stackrox/image/sandbox-default/CLAUDE.md
+++ b/profiles/stackrox/image/sandbox-default/CLAUDE.md
@@ -14,4 +14,7 @@ You are running inside an OpenShell sandbox. Credentials are injected via the Op
 - `gh` — GitHub CLI (pre-authenticated). Run `gh auth setup-git` before any git clone/push/pull to configure git credential helper.
 - `gws` — Google Workspace CLI (when available). Use `gws schema <service.resource.method>` to discover API parameters.
 - MCP servers (Jira, Confluence) are configured in `.mcp.json` and connected automatically.
-- `python3`, `uv`, `node`, `npm`, `git`, `curl`
+- `go`, `gopls`, `python3`, `uv`, `node`, `npm`, `ajv`, `git`, `curl`
+
+The OpenShell Vertex provider supplies model access and credentials. The image
+does not install `gcloud` or copy service-account keys into the sandbox.
diff --git a/profiles/stackrox/image/sandbox-default/Dockerfile b/profiles/stackrox/image/sandbox-default/Dockerfile
index d22e3cc0..6e04efa6 100644
--- a/profiles/stackrox/image/sandbox-default/Dockerfile
+++ b/profiles/stackrox/image/sandbox-default/Dockerfile
@@ -19,6 +19,8 @@
 #
 #   mcp-atlassian  0.21.1   https://github.com/sooperset/mcp-atlassian/releases
 #   gws CLI        0.22.5   https://github.com/googleworkspace/cli/releases
+#   gopls          0.20.0   https://pkg.go.dev/golang.org/x/tools/gopls
+#   ajv-cli        5.0.0    https://github.com/ajv-validator/ajv-cli
 #
 # Base image tools (inherited, pinned upstream):
 #   claude         latest   https://claude.ai/install.sh
@@ -26,6 +28,7 @@
 #   node           22.x     https://deb.nodesource.com
 #   python         3.14.x   https://github.com/astral-sh/uv
 #   uv             0.10.x   https://github.com/astral-sh/uv
+#   Go             1.24.2   https://go.dev/dl/
 #
 # ── Workarounds in this image ──────────────────────────────────────────
 #
@@ -47,6 +50,25 @@ USER root
 # https://github.com/sooperset/mcp-atlassian
 RUN pip install --no-cache-dir mcp-atlassian==0.21.1
 
+# Go and gopls for the Go-analysis MCP server used by ACS triage. Keep the Go
+# toolchain in the runtime image because gopls invokes `go list` and related
+# commands while analyzing a checked-out repository.
+ARG GO_VERSION=1.24.2
+ARG GO_SHA256_AMD64=68097bd680839cbc9d464a0edce4f7c333975e27a90246890e9f1078c7e702ad
+ARG GO_SHA256_ARM64=756274ea4b68fa5535eb9fe2559889287d725a8da63c6aae4d5f23778c229f4b
+ARG GOPLS_VERSION=0.20.0
+RUN set -eux; \
+    case "$(dpkg --print-architecture)" in \
+      amd64) go_arch=amd64; go_sha256="$GO_SHA256_AMD64" ;; \
+      arm64) go_arch=arm64; go_sha256="$GO_SHA256_ARM64" ;; \
+      *) echo "unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${go_arch}.tar.gz" -o /tmp/go.tgz; \
+    echo "${go_sha256}  /tmp/go.tgz" | sha256sum -c -; \
+    tar -C /usr/local -xzf /tmp/go.tgz; \
+    GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}"; \
+    rm -rf /tmp/go.tgz /root/go /root/.cache/go-build
+
 # Google Workspace CLI (Gmail, Calendar, Drive, Docs, Sheets)
 # https://github.com/googleworkspace/cli
 RUN ARCH=$(uname -m | sed 's/arm64/aarch64/') && \
@@ -55,7 +77,11 @@ RUN ARCH=$(uname -m | sed 's/arm64/aarch64/') && \
 
 # OpenCode AI coding agent
 # https://github.com/opencode-ai/opencode
-RUN npm install -g opencode-ai@1.18.30
+# JSON Schema validation used by the ACS triage workflow.
+RUN npm install -g opencode-ai@1.18.30 ajv-cli@5.0.0 && \
+    npm cache clean --force
+
+ENV PATH="/sandbox/.venv/bin:/usr/local/go/bin:${PATH}"
 
 # Sandbox policy (network egress rules — provider profiles contribute
 # additional endpoints at runtime via providers v2 composition)
diff --git a/profiles/stackrox/image/sandbox-default/mcp.json b/profiles/stackrox/image/sandbox-default/mcp.json
index 51af0075..f37b1d49 100644
--- a/profiles/stackrox/image/sandbox-default/mcp.json
+++ b/profiles/stackrox/image/sandbox-default/mcp.json
@@ -7,6 +7,11 @@
       "env": {
         "READ_ONLY_MODE": "true"
       }
+    },
+    "gopls-mcp": {
+      "type": "stdio",
+      "command": "/usr/local/bin/gopls",
+      "args": ["mcp"]
     }
   }
 }
diff --git a/profiles/stackrox/image/sandbox-default/opencode.json b/profiles/stackrox/image/sandbox-default/opencode.json
index 7e32edef..33680c19 100644
--- a/profiles/stackrox/image/sandbox-default/opencode.json
+++ b/profiles/stackrox/image/sandbox-default/opencode.json
@@ -8,6 +8,11 @@
       "environment": {
         "READ_ONLY_MODE": "true"
       }
+    },
+    "gopls-mcp": {
+      "type": "local",
+      "command": ["/usr/local/bin/gopls", "mcp"],
+      "enabled": true
     }
   }
 }
diff --git a/profiles/stackrox/image/sandbox-default/policy.yaml b/profiles/stackrox/image/sandbox-default/policy.yaml
index a6af549d..018fd27a 100644
--- a/profiles/stackrox/image/sandbox-default/policy.yaml
+++ b/profiles/stackrox/image/sandbox-default/policy.yaml
@@ -118,6 +118,17 @@ network_policies:
       - { path: /usr/local/bin/uv }
       - { path: "/sandbox/.uv/python/**" }
 
+  # Go module downloads used by gopls while analyzing checked-out repositories.
+  go_modules:
+    name: go-modules
+    endpoints:
+      - { host: proxy.golang.org, port: 443 }
+      - { host: sum.golang.org, port: 443 }
+      - { host: go.dev, port: 443 }
+    binaries:
+      - { path: /usr/local/go/bin/go }
+      - { path: /usr/local/bin/gopls }
+
   # Node packages
   npm:
     name: npm