github.com/faustbrian/go-authentication v1.1.0

Changed

• Add the preferred BeginInstrumenter observation contract and
  NewInstrumentedWithBegin decorator while retaining the released
  Instrumenter.Start contract and constructor for source compatibility.

• State Go 1.26.6 as the exact supported toolchain floor.

• Deprecate Instrumenter and NewInstrumented in favor of the Begin-named
  contracts, and deprecate authlog.Instrumenter.Start in favor of Begin.
  Add Begin with equivalent semantics and switch constructor and method
  calls; the legacy APIs remain supported throughout v1 and may be removed no
  earlier than v2.0.0.

• Publish schema-v2 cohesion metadata for the root authentication module and
  the optional OpenTelemetry, JWT, and OIDC modules.

• Adopt the checksum-verified go-library-tools v1.3.0 CLI, expose the local
  make cohesion gate, and pin reusable-workflow cohesion enforcement to its
  final immutable revision.

• Adopt the checksum-verified go-library-tools v1.4.0 W14 contract and
  immutable workflow so public module identities are preferred over bootstrap
  fallbacks.

• Reconcile go-clock v1.0.0 with its public SumDB identity across the root
  and optional modules.

• Adopt the pinned go-library-tools v1.2.0 CLI and reusable workflow so CI
  enforces specification decisions, conformance bindings, source monitoring,
  and change control while retaining package-owned policy and verification
  evidence.
  The required specification lane remains independent of module-resolution
  failures in the broader repository gate.

Documentation

• Link the root and optional modules to the immutable v1.4.0 Golib ecosystem
  index and Service edge family guidance.

• Record the behavior-neutral review of reported RFC 9110 Erratum 9162 while
  retaining the package's duplicate-credential rejection policy.

• Replace archived monorepo links with a package-owned documentation index.

• Make the current authentication specification decisions
  machine-auditable and preserve their content identities below.

• Treat recorded decision digests and public conformance test identifiers as
  non-secret specification metadata during repository scanning.

• AUTH-DEC-011 sha256:be33f5111184dec4c31bdeac3760ee2ef0fcdd730a677f55479e7ee8f66ad659

• AUTH-DEC-012 sha256:9135676640d9c0df84a1b676985d9f5c2512998304591b8809092b50ce0d7884

• AUTH-DEC-001 sha256:dbf293fd525d952dfe51ac1af7a43325429fa00dfe6d34e2cdc45069830330f5

• AUTH-DEC-002 sha256:5d9b14d24d6ac9ea1f84b43d5d745454b53e5271fee035aa909d1d9a2342d5fe

• AUTH-DEC-002 sha256:15e8ade498da812548bf36deb3ab0b77d5fae91462036bc36e27aaa39fb4f273

• AUTH-DEC-003 sha256:81ffead77cfa54913477444f24798f9b632beb94057e578ec1f266b020c6a7c1

• AUTH-DEC-003 sha256:10e348b7b49b28fb53f35f0072cbda5ff08156f871c854fcb7e0f62b70f0ed9e

• AUTH-DEC-004 sha256:86762f7d564203e9714e51b867aa8ec4ebc913d0ca704e716a409e56b2537722

• AUTH-DEC-004 sha256:06998d20abf14867af6c7195a88b8adadc4a66dda00e1990172180c5c71a61a6

• AUTH-DEC-005 sha256:b8d53a0e3c0980892e5b161e2e5b2534f635d250e4310757d11d78ff08b773c4

• AUTH-DEC-006 sha256:e18d639138c2828e3b8240a6bf80c5437b04d630da12cc3e419d476ab35b88e7

• AUTH-DEC-007 sha256:f8b3f8e8393811a2c3ce06988b92f81252babeede518c6836afaac7a3de89326

• AUTH-DEC-007 sha256:e9a921116a9efa033845aff4eb3e931303ad4f1380b190338c730245ea8860d6

• AUTH-DEC-008 sha256:b4f02becb2f6f0f2d098c8d24fe750048bf87f8d2aefc8c680745c0d240c812a

• AUTH-DEC-009 sha256:0104da4c0dca68fb7146d17f5d70077fe34edaf919feef29b718252edb65ee37

• AUTH-DEC-010 sha256:4a94dc00885603ca190f6e2eda39a98d09511ff7417bb3de9cb131774398d60f

Release integrity

• Source commit: 8c8e052beaa1a0ffd90bbabcf28a0eba425d6782
• Exact-head CI: https://github.com/faustbrian/go-authentication/actions/runs/34049155264
• Release dry-run: urn:sha256:926159ef027073e44857c437a841267c5677187cd4165d2b9c1c05d2208601d6
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS