Releases · faustbrian/go-correlation

1.0.0 - 2026-08-25

Exclude intentional nested modules from root local-proxy archives so local,
bootstrap, CI, and public module checksums describe the same source
boundary.
Track the pinned documentation-tool lockfile so clean CI checkouts install
the exact validated cspell dependency.
Reconcile standalone dependency checksums against deterministic current
module archives so CI, local verification, and release consumers resolve
identical content.
Harden standalone documentation validation with deterministic spelling and
link checks, package-specific documentation gates, and repository-local
contributor guidance.

Amortize system entropy reads through a bounded factory-owned buffer while
preserving cryptographic UUIDv4 request identities.
Skip inbound carrier parsing when the default HTTP policy replaces all
untrusted metadata, and write canonical response headers without reparsing
their names.
Trust the canonical default UUID generator while validating custom generator
output once with a byte-oriented ASCII policy scan.
Return fresh correlation and request identifiers on explicitly rejected
malformed HTTP metadata without invoking application handlers.
Avoid allocating header-value storage when optional inbound correlation
metadata is absent and reuse canonical header storage when it is safe.

Publish the module from its standalone github.com/faustbrian/go-correlation identity while preserving its documented API and behavior.
Replace the obsolete owned-module pseudo-version pin with the monorepo's
local v0.0.0 source-proxy coordinate; release tooling continues to emit
the exact v1.0.0 dependency version.
Pin the owned identifier module to an immutable source revision so
correlation resolves from a clean external consumer without go.work.
Normalized standalone module metadata against the canonical owned dependency
graph, including complete checksums for clean consumer resolution.

Distinct correlation, request, causation, and external identifier types.
Secure identifier generation and explicit deterministic strategies.
Context, carrier, HTTP, JSON-RPC, queue, schedule, webhook, log, telemetry,
and request ID middleware adapters.
Trust, privacy, multi-hop, retry, fuzz, race, mutation, coverage, allocation,
compatibility, documentation, and CI gates.

Source commit: 9943fef0495a97345d097dad9f052b595e54fafb
Exact-head CI: https://github.com/faustbrian/go-correlation/actions/runs/32907442109
Release dry-run: urn:sha256:d0bafc41a62fb49b53ef7aa2ac77642c74309462b0fba0973f25fcaa1e6db7ae
Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS