v2.1.0

Changed

• Publish the current source and documentation with a fresh immutable tag.
• Build with Go 1.27.3 to address GO-2026-6809 in crypto/x509.
  Consumers should use Go 1.27.3 or newer.
• Publish independently versioned modules from the same source snapshot:
  • postgres/v1.1.0.

postgres/v1.1.0

Changed

• Publish the current source and documentation with a fresh immutable tag.
• Build with Go 1.27.3 to address GO-2026-6809 in crypto/x509.
  Consumers should use Go 1.27.3 or newer.
• Publish independently versioned modules from the same source snapshot:
  • postgres/v1.1.0.

v2.0.2

Refresh shared CI and its pinned release tooling for root-only release
qualification while retaining the root v2 API and runtime dependencies.
The independently released PostgreSQL adapter remains at v1.0.1.

v2.0.1

Refresh test dependencies and shared CI without changing root v2 APIs
or runtime behavior. The independently released PostgreSQL adapter
continues to use root v1 records.

postgres/v1.0.1

Refresh pgx runtime and PostgreSQL integration-test dependencies while
preserving the adapter API, SQL, and migrations.

Go 1.27.0 is now required, up from Go 1.26.6. Upgrade application
toolchains before adopting this version. Custom implementations of
pgx.Rows must add TypeMap; review upstream connection-string and
date/time changes before upgrading caller-created pools. The adapter
continues to use root v1 records, not root v2.

go-audit v2.0.0

Bound integrity and record-validation work in the root v2 module.

Chain verification, checkpoint-suffix verification, and Merkle construction
accept at most 1,000 records per operation. Oversized record text and map
inputs are rejected before scanning or allocating normalization and encoding
buffers, including when configured field budgets exceed the record ceiling.

Migration requires github.com/faustbrian/go-audit/v2 and /v2/memory
imports, Go 1.27 or newer, and bounded integrity batches. Retain trusted
checkpoints between verification segments; splitting a Merkle batch does not
preserve the larger batch's root. Validation now checks byte limits before
text and privacy errors.

The independently released PostgreSQL adapter remains on root v1 and cannot
accept v2 record types. Root-v2 consumers need application-owned persistence
integration pending a separately reviewed adapter migration. Legacy v1
callers should enforce record-field byte and integrity-count limits before
calling validation or integrity operations.

Synchronous callbacks, aggregate request admission, privacy allowances,
database-driver allocations, and independent key/checkpoint custody remain
caller-owned; v2 does not preempt arbitrary callbacks or establish compliance.

github.com/faustbrian/go-audit v1.0.0

1.0.0 - 2026-08-25

Changed

• Upgrade PostgreSQL adapter archive and cryptography dependencies to current
  security-fixed releases.

• Keep root fuzzing scoped to the root module; the standalone CI matrix owns
  the PostgreSQL adapter's independent fuzz gate.

• Verify clean consumers against versioned standalone modules without local
  replacements or sibling checkouts.

• Align the PostgreSQL adapter with the current standalone root archive
  checksum used by repository-local and CI verification.

• Make CodeQL resolve nested modules through that same current root archive.

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Changed

• Publish the module from its standalone github.com/faustbrian/go-audit identity while preserving its documented API and behavior.

Documentation

• Link the package README to the repository-wide Golib documentation portal.

Added

• Immutable-by-contract bounded audit record construction and canonical JSON.
• Explicit actor, subject, context, outcome, change, privacy, delivery,
  integrity, query, export, retention, and observation contracts.
• Bounded concurrency-safe in-memory test adapter.
• Separately releasable PostgreSQL append-only adapter with least-privilege
  roles, stable pagination, transaction staging, and legal-hold-aware retention.
• SHA-256 and HMAC-SHA-256 chain verification, checkpoints, and Merkle anchors
  using standard-library primitives and external key-provider contracts.
• Explicit finite record, batch, and persisted-byte limits for durable buffers,
  plus golden integrity, leak, stress, benchmark, and PostgreSQL version-matrix
  release evidence.
• Canonical UTC microsecond timestamps and mandatory stable IDs for system
  actors, preserving ordering across durable adapters.

Security

• Reject secret-bearing namespaces and unrestricted request or response bodies.
• Redact before persistence and expose identifier-free observation events.
• Keep arbitrary redactor failures opaque and give PostgreSQL writers only the
  append-function privilege rather than direct table read access.
• Reject redactor field injection and post-validation aliasing, sanitize every
  dependency boundary including builder clocks and ID generators, and require
  explicit bounded recovery for fail-open and durable-buffer policies.
• Verify canonical bytes, persisted digests, historical HMAC key IDs, stable
  acceptance snapshots, deterministic retention plans, and cross-adapter field
  ceilings before use.
• Reject arbitrary and credential-shaped authentication-method values; the
  field accepts only the closed AuthenticationMethod* vocabulary.
• Reject NUL in every durable text field and map entry so every accepted core
  record remains representable by the PostgreSQL adapter.
• Reject separator-obfuscated credential and API-key field names at every
  validated persistence boundary.

Fixed

• Preserve cursor round trips for newline-bearing durable record IDs and reject
  timestamps whose UTC canonicalization leaves the supported year range.

Release integrity

• Source commit: 314cd6a3dfb03c1575b77a13a11f9d3f9a787c01
• Exact-head CI: https://github.com/faustbrian/go-audit/actions/runs/32916459832
• Release dry-run: urn:sha256:b71eb622a683800796d7ddf55c47031194c0f6d6cf831ecab3910980e083e189
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-audit/postgres v1.0.0

1.0.0 - 2026-08-25

Documentation

• Link the package README to the repository-wide Golib documentation portal.

Changed

• Publish the module from its standalone github.com/faustbrian/go-audit/postgres identity while preserving its documented API and behavior.
• Refresh local v0.0.0 owned-module checksums after dependency manifests and
  release notes were normalized; runtime behavior and public APIs are
  unchanged.

Added

• Append-only PostgreSQL schema, least-privilege roles, deterministic indexes,
  idempotent atomic append, bounded cursor queries and streaming export.
• Caller-owned transaction staging and separately privileged legal-hold-aware
  two-phase retention.
• Digest-pinned PostgreSQL 14 through 18 compatibility, transactional migration
  interruption, backup/restore, connection-loss recovery, fault-classification,
  and leak exercises.
• Security-definer idempotent append without ordinary-writer table read,
  update, or delete authority.
• Forward-only hardening migration with canonical digest enforcement,
  acceptance-order snapshot pagination, deterministic retention ordering, and
  revocation of historical fixed-role privileges before deployment-owned role
  grants generated by PrivilegeSQL.
• Batch-atomic transaction staging, immutable record-ID digest tombstones after
  retention, and exact canonical/schema validation at the security-definer
  append boundary, including the canonical UTC year range.
• Migration-safe identity capture for protocol-compatible writers already in
  flight while the durability migration commits.
• Atomic full-table legacy validation before the durability migration accepts
  and backfills existing history.
• Preserve the published migration 1 and 2 checksums while migration 3 commits
  fixed-role neutralization, including stored-password removal, before
  migration 4 validates legacy history and installs the durable acceptance
  boundary.
• Add a fresh-install preflight that atomically reserves fixed NOLOGIN roles,
  rejecting existing and concurrent name collisions before migration 1 can
  grant temporary access.
• Pin the retention trigger's trusted search path so a retention writer cannot
  shadow its ordering and locking dependencies.
• Bind fixed-role neutralization directly to the PostgreSQL catalog so a
  hostile migration search path cannot hide reserved-role memberships.
• Enforce unique per-record retention acceptance order and reject ambiguous
  historical orders atomically during durability migration.
• Reject non-UTF-8 databases before canonical validation or persistence can
  accept only an encoding-dependent subset of records.
• Enforce the core closed authentication-method vocabulary during legacy
  validation and every new append so credential-shaped custom values cannot
  cross the persistence boundary.
• Bound durability-migration lock acquisition at 30 seconds so active writers
  cause a visible deployment failure instead of an unbounded wait.
• Atomic digest-bound evidence for each digest-pinned PostgreSQL 14 through 18
  matrix result.

Release integrity

• Source commit: 314cd6a3dfb03c1575b77a13a11f9d3f9a787c01
• Exact-head CI: https://github.com/faustbrian/go-audit/actions/runs/32916459832
• Release dry-run: urn:sha256:8aeba455076d98bb2eef09edc3d5b147e334b76bfdfc85cc142d85cd7847404f
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS