Release github.com/faustbrian/go-audit v1.0.0 · faustbrian/go-audit

1.0.0 - 2026-08-25

Upgrade PostgreSQL adapter archive and cryptography dependencies to current
security-fixed releases.
Keep root fuzzing scoped to the root module; the standalone CI matrix owns
the PostgreSQL adapter's independent fuzz gate.
Verify clean consumers against versioned standalone modules without local
replacements or sibling checkouts.
Align the PostgreSQL adapter with the current standalone root archive
checksum used by repository-local and CI verification.
Make CodeQL resolve nested modules through that same current root archive.
Exclude intentional nested modules from root local-proxy archives so local,
bootstrap, CI, and public module checksums describe the same source
boundary.
Track the pinned documentation-tool lockfile so clean CI checkouts install
the exact validated cspell dependency.
Reconcile standalone dependency checksums against deterministic current
module archives so CI, local verification, and release consumers resolve
identical content.
Harden standalone documentation validation with deterministic spelling and
link checks, package-specific documentation gates, and repository-local
contributor guidance.

Publish the module from its standalone github.com/faustbrian/go-audit identity while preserving its documented API and behavior.

Immutable-by-contract bounded audit record construction and canonical JSON.
Explicit actor, subject, context, outcome, change, privacy, delivery,
integrity, query, export, retention, and observation contracts.
Bounded concurrency-safe in-memory test adapter.
Separately releasable PostgreSQL append-only adapter with least-privilege
roles, stable pagination, transaction staging, and legal-hold-aware retention.
SHA-256 and HMAC-SHA-256 chain verification, checkpoints, and Merkle anchors
using standard-library primitives and external key-provider contracts.
Explicit finite record, batch, and persisted-byte limits for durable buffers,
plus golden integrity, leak, stress, benchmark, and PostgreSQL version-matrix
release evidence.
Canonical UTC microsecond timestamps and mandatory stable IDs for system
actors, preserving ordering across durable adapters.

Reject secret-bearing namespaces and unrestricted request or response bodies.
Redact before persistence and expose identifier-free observation events.
Keep arbitrary redactor failures opaque and give PostgreSQL writers only the
append-function privilege rather than direct table read access.
Reject redactor field injection and post-validation aliasing, sanitize every
dependency boundary including builder clocks and ID generators, and require
explicit bounded recovery for fail-open and durable-buffer policies.
Verify canonical bytes, persisted digests, historical HMAC key IDs, stable
acceptance snapshots, deterministic retention plans, and cross-adapter field
ceilings before use.
Reject arbitrary and credential-shaped authentication-method values; the
field accepts only the closed AuthenticationMethod* vocabulary.
Reject NUL in every durable text field and map entry so every accepted core
record remains representable by the PostgreSQL adapter.
Reject separator-obfuscated credential and API-key field names at every
validated persistence boundary.

Preserve cursor round trips for newline-bearing durable record IDs and reject
timestamps whose UTC canonicalization leaves the supported year range.

Source commit: 314cd6a3dfb03c1575b77a13a11f9d3f9a787c01
Exact-head CI: https://github.com/faustbrian/go-audit/actions/runs/32916459832
Release dry-run: urn:sha256:b71eb622a683800796d7ddf55c47031194c0f6d6cf831ecab3910980e083e189
Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS