go-kafka v1.1.0

Adds the canonical slog, OpenTelemetry, and service-lifecycle adapter paths while preserving released compatibility paths. Aligns repository tooling and documentation with the revised cohesion contract.

github.com/faustbrian/go-kafka/kafkaservice v1.0.1

Patch release of the legacy service-lifecycle compatibility facade. The released public API and callback error semantics remain stable while implementation delegates to github.com/faustbrian/go-kafka/adapters/service.

Release integrity

• Source commit: b57ea490dd921ef06480793917bf54826560ac02
• Source tree: a20eb9fd96dd44fa7d723bca72019d014a1e15e0
• Identical-tree CI: https://github.com/faustbrian/go-kafka/actions/runs/34345477874
• Module sum: h1:qJkX3zpLaDy4u4rTtyXOaqm0/c2YOBIGj7VXpXCruJ4=
• Go module sum: h1:DMiFbzZOzXBzgBf4I6xAF7R1DGCdLkFAaxBF5bbJ2GM=
• Assets include the public proxy archive, module manifest, CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

go-kafka adapters/service v1.0.0

Initial release of the canonical target-oriented service lifecycle adapter. The released kafkaservice path remains supported during the compatibility window.

go-kafka adapters/otel v1.0.0

Initial release of the canonical target-oriented OpenTelemetry adapter. The released adapters/gotelemetry path remains supported during the compatibility window.

go-kafka adapters/mskiam v1.1.0

Adds context-aware Load(ctx, Config) while preserving New as an exact compatibility delegate. Refreshes the monitored AWS SDK v2 release authority digest.

github.com/faustbrian/go-kafka/adapters/gotelemetry v1.0.1

Patch release of the legacy OpenTelemetry compatibility facade. The released public API and legacy instrumentation scope remain stable while implementation delegates to github.com/faustbrian/go-kafka/adapters/otel.

Release integrity

• Source commit: b57ea490dd921ef06480793917bf54826560ac02
• Source tree: a20eb9fd96dd44fa7d723bca72019d014a1e15e0
• Identical-tree CI: https://github.com/faustbrian/go-kafka/actions/runs/34345477874
• Module sum: h1:ppLcWG2OlvNivckD6MKY5Vv+GmAxmDwspfzRWHuSbkI=
• Go module sum: h1:oFHMYaL+mZ2zoNK3riuqFr7E8QYu7e0vNS04yUf3Nt8=
• Assets include the public proxy archive, module manifest, CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

github.com/faustbrian/go-kafka v1.0.0

1.0.0 - 2026-08-25

Changed

• Upgrade archive, cryptography, and network dependencies across the root,
  lifecycle, adapter, and comparison modules to current security-fixed
  releases.

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Documentation

• Correct stale package, standalone, and authoritative-source links in public
  documentation.

Added

• register the exact Apache Kafka, Confluent Local, Testcontainers Ryuk,
  comparison-client, MSK signer, and AWS SDK inputs used by Kafka evidence in
  the repository catalog and provenance manifest
• add a canonical specification decision register and catalog the pinned
  broker, authentication, failure, and comparison-client conformance matrices
• prove zero-downtime overlap-first PLAIN principal rotation across three
  verified-TLS Kafka brokers, preserving exact acks-all delivery through each
  rolling restart and rejecting the retired credential on every recovered
  broker
• add a release-readiness findings report with explicit severity, impact,
  disposition, release conditions, and residual risks, including the current
  final-fingerprint, reverse-dependency, and MSK blockers plus resolved exact
  mutation and PLAIN-rotation findings
• pin the Testcontainers Ryuk resource reaper by immutable digest before every
  integration run, reject upstream tag or registry substitutions before
  container creation, and reject a running reaper with another image ID
• add pinned Apache Kafka 4.3.1 kafkaservice interoperability evidence for
  concrete producer startup, readiness, publication, and shutdown plus
  consumer pre-cancellation settlement, admitted-handler join, explicit
  cancellation redelivery, resource shutdown, and post-stop fencing
• add an independently versioned, bounded W3C Trace Context record-header
  policy in the OpenTelemetry adapter, with owned producer records,
  borrowed-consumer safety, duplicate-field rejection, and no baggage or
  global propagator state, plus pinned Apache Kafka 4.3.1 producer-to-consumer
  propagation evidence
• add reproducible no-I/O consumer-group record and batch performance matrices
  for sequential and cross-partition parallel handling plus a Kafka
  consume-transform-produce matrix, separating the common transport floor from
  root policy and optional observation with raw samples and allocation evidence
• add a reproducible no-I/O producer performance matrix separating the common
  transport floor from root policy and root policy plus observation across
  synchronous single, batch, asynchronous API-window, and Kafka-transaction
  workloads, with raw samples, allocations, environment fingerprints, and
  variance-preserving analysis
• report the measured local interval from package entry into franz-go's
  blocked callback to poll-gate release, with distinct successful,
  callback-canceled, and bounded
  timeout outcomes, poll-lifecycle retention, and no claim of complete broker
  rebalance timing
• report each record or whole-partition-batch handler failure selected for a
  bounded in-process retry through a stable payload-free consumer observation,
  before cancellation-aware backoff and without claiming Kafka redelivery;
  failure decorators reject observer-callback reentry
• prove a least-privilege transactional producer receives stable redacted
  ErrorAuthorization identity before its transactional-ID ACL is granted,
  commits after the live grant, and cannot expose a later transaction after
  that ACL is revoked from the active client
• extend three independent mTLS producers across three successive live
  client-certificate renewals, requiring every provider generation after a
  broker-enforced reconnect and preserving every acknowledged record
• prove a caller-owned OAuth client_credentials provider acquires and
  refreshes signed tokens from a verified HTTPS endpoint under bounded,
  cancellation-aware, redacted policy before Kafka authentication
• prove Kafka's production OAUTHBEARER validator refreshes a verified HTTPS
  JWKS, accepts an overlap-first RS256 signing-key rollover, rejects the retired
  key after refresh, preserves every acknowledged record, and returns a stable
  redacted authentication identity for RFC 7628 error challenges
• prove three independent OAUTHBEARER producers cross three broker-enforced
  reauthentication cycles through successive signed-JWT replacements, refresh
  every provider, and preserve every acknowledged record without claiming
  immediate rejection of still-valid retired tokens
• extend live mTLS renewal evidence to three independent producers, require
  every certificate provider after broker-enforced reconnect, and preserve all
  acknowledged records in exact broker order
• prove three provider-backed PLAIN producers recover after a bounded broker
  restart replaces the server credential, preserve every acknowledged record,
  and reject the retired password without claiming zero-downtime rotation
• prove three independent producers per SCRAM mechanism survive three
  successive broker credential replacements, refresh every provider, preserve
  every acknowledged record, and reject every retired credential
• extend equivalent authenticated producer evidence to SCRAM-SHA-256 and
  SCRAM-SHA-512 plus signed-JWT OAUTHBEARER over verified TLS 1.3 for the
  package policy, raw franz-go, and Sarama, retaining 3,000 warmed deliveries,
  1,500 complete client lifecycles, exact broker-visible outcomes, allocations,
  raw samples, and environment fingerprints
• prove five repeated cooperative transaction-processor membership cycles
  against minimum Apache Kafka 3.7.2 and current 4.3.1 with exact partition
  ownership, bounded retry of safe rebalance aborts, source-offset settlement,
  and read-committed output cardinality
• prove five repeated cooperative join, settlement, leave, and survivor
  reacquisition cycles against minimum Apache Kafka 3.7.2 and current 4.3.1
  three-broker clusters with exact one-copy partition ownership and
  monotonically advancing committed offsets
• prove exact-range replay from an Apache Kafka 4.3.1 remote segment after its
  local base segment is evicted, using Kafka's checksum-pinned test-only
  LocalTieredStorage implementation; inspection simultaneously proves the
  effective remote-storage, copy, local-retention, and broker offset state
• add payload-free Producer.Diagnostic and
  TransactionProcessor.Diagnostic snapshots for local admission, transaction,
  shutdown, fatal-category, client-termination, and franz-go buffered-output
  state without exposing retained errors, invoking their callback methods, or
  implying broker-coordinator health; producer health now derives the
  configured request timeout
• add bounded KIP-848 consumer-protocol group inspection with group,
  assignment, and member epochs; current and target assignments; subscription,
  static-instance, rack, client, and member-type state; stable committed
  offsets; log bounds; lag; fail-closed batches; and input-ordered partial
  results, proven with explicit-topic and broker-side regex subscriptions
  against pinned three-broker Apache Kafka 4.3.1 groups
• expose bounded tiered-storage topic policy through local-retention values and
  remote-storage/copy-disable flags while preserving Kafka's inheritance and
  unlimited sentinels, reporting version-dependent visibility, and rejecting
  impossible or incomplete relationships
• prove authenticated consumer-group partial inspection against Kafka's KRaft
  authorizer: one explicitly authorized result is retained beside an
  input-ordered authorization failure with stable classification and credential
  redaction
• add bounded, input-ordered per-target topic and consumer-group inspection
  results that retain independent successes and stable error classifications
  without changing the existing fail-closed batch methods
• prove Kafka 3.7.2 transaction-processor recovery after an in-flight child
  process terminates without committing its source offset or output
• prove Kafka 3.7.2 eager and cooperative transaction-processor rebalance
  recovery without committing the interrupted transaction
• prove Kafka 3.7.2 committed EndTxn response loss and bounded ambiguous
  transactional Produce response loss for producers and processors
• prove Kafka 3.7.2 same-transactional-ID producer fencing, its known fenced
  outcome after broker-enforced expiry, and committed replacement visibility
• prove Kafka 3.7.2 producer transaction commit and abort isolation while one
  follower is unavailable at ISR two and after full ISR recovery
• add equivalent mTLS and SASL/PLAIN producer performance workloads covering
  warmed delivery and complete authenticated connection lifecycles
• record the independently versioned kafkaservice lifecycle and readiness
  composition evidence in the Kafka compatibility and audit matrices
• require the Kafka contract tests on Linux arm64 when Kafka gate inputs are
  selected, complementing the existing Linux amd64 module contract with
  attributable architecture-specific CI evidence
• expose the configured redacted SASL method on every broker-connect
  observation; successful events prove that connection initialization,
  API-version negotiation, and the configured authentication flow completed
• add the public kafkatest package with reusable producer, consumer, Kafka
  transaction, replay, inspector, authenticat...

github.com/faustbrian/go-kafka/kafkaservice v1.0.0

1.0.0 - 2026-08-25

Fixed

• Retry the documented transient Kafka observer-reentry fence during the
  overlapping-member shutdown interoperability scenario, while keeping its
  shutdown callback retry-safe and failing immediately for every other cause.

Changed

• Publish the module from its standalone github.com/faustbrian/go-kafka/kafkaservice identity while preserving its documented API and behavior.
• Document lifecycle ordering, Kubernetes SIGTERM, duplicate and ambiguous
  delivery windows, API adoption, compatibility, migration, and FAQ guidance.
• Stop retaining obsolete Cobra command-line dependencies after the CLI module
  replaced its Cobra implementation.
• Require owned sibling modules at local v0.0.0; clean external consumers
  pin each module to an exact main pseudo-version.
• Serialize startup, readiness, publishing, and consumer run callbacks with
  resource shutdown so concurrent stop cannot close a resource still in use.
• Fence producer and consumer admission when service drain begins, before task
  cancellation, and redact ordinary callback causes while preserving error
  identity for programmatic inspection.

Added

• pinned Apache Kafka 4.3.1 interoperability evidence for concrete producer
  startup, readiness, publication, consumer drain-before-shutdown ordering,
  pre-cancellation settlement, in-flight cancellation redelivery, and post-stop
  admission fencing
• race-enabled pinned-broker failure evidence for overlapping-member rebalance,
  slow-handler cancellation, commit timeout and redelivery, broker loss and
  recovery, partial startup rollback, and producer flush ambiguity
• independently versioned service lifecycle adapter for explicit Kafka
  producers and consumers
• bounded startup, readiness, drain, retryable shutdown, task supervision,
  correlation propagation, and caller-owned trace propagation
• secret-safe panic containment for every application callback, including
  startup cleanup and retryable shutdown after panic
• pre-copy and post-propagation record validation, bounded UTF-8 lifecycle
  names, and non-aliasing consumed-header propagation
• deterministic lifecycle, concurrency, ownership, fuzz, compatibility, and
  allocation evidence
• broker-independent producer and consumer shutdown-latency benchmarks

Release integrity

• Source commit: 382373f72a0552d0996635dc4d0f7f8cf8af2287
• Exact-head CI: https://github.com/faustbrian/go-kafka/actions/runs/32907468696
• Release dry-run: urn:sha256:eb4b5badc9bb87cb4bae1657118b2dc9a88a00aa2f2c556e7999d050b39efa80
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-kafka/adapters/mskiam v1.0.0

1.0.0 - 2026-08-25

Changed

• Publish the module from its standalone github.com/faustbrian/go-kafka/adapters/mskiam identity while preserving its documented API and behavior.
• Record signer, credential-refresh, and managed-service support decisions in
  an auditable specification register backed by pinned source snapshots.
• Require owned sibling modules at local v0.0.0; clean external consumers
  pin each module to an exact main pseudo-version.
• Validate signer output as the bounded AWS MSK presigned-URL format, reject
  noncanonical AWS partition regions, and expose distinct redacted
  cancellation, timeout, expiry, and malformed-output categories.
• Expand API, adoption, tradeoff, and FAQ guidance and enforce those surfaces
  in the documentation gate.
• Clarify the cluster-level IAM permissions needed for idempotent production
  and the Kafka 3.8 minimum for transaction termination through IAM access
  control.
• Coordinate near-expiry credential invalidation across concurrent token
  requests, share redacted refresh failures within the waiting cohort, and
  reject signer timestamps outside the five-minute local-clock tolerance.
• Fail closed before signing when the upstream process-wide credential debug
  mode is enabled, preventing its extra STS request and identity logging.

Added

• Add a portable fail-closed specification gate for signer, SDK, configuration,
  and compatibility-boundary evidence.
• Add a fail-closed direct Amazon MSK compatibility gate for operator-owned
  Provisioned and Serverless fixtures, with persistent redacted runtime and
  dependency evidence, read-only control-plane identity and bootstrap
  verification, inspection, producer modes, consumer settlement, replay, and
  the explicitly declared transaction profile.
• Add a bounded Amazon MSK IAM provider backed by AWS's supported Go signer.
• Support the refreshing AWS SDK v2 default credential chain or one explicit
  caller-owned credentials provider.
• Cap effective token expiry at the signing credential expiry, perform one
  bounded cache invalidation for nearly expired credentials, and reject
  malformed, nearly expired, unexpectedly long-lived, or oversized tokens.
• Contain provider panics, discard arbitrary credential-chain and signer
  causes, and retain only stable categories plus context cancellation identity.
• Document TLS, least-privilege IAM, ECS/EKS rotation, and the current
  unverified Amazon MSK compatibility boundary.
• Exercise generated-canary environment, profile, ECS task-role, EKS pod and
  web-identity sources, pod token rotation, workload replacement, AWS failure
  redaction, refresh contention, and separate generation/retrieval benchmarks.

Release integrity

• Source commit: 382373f72a0552d0996635dc4d0f7f8cf8af2287
• Exact-head CI: https://github.com/faustbrian/go-kafka/actions/runs/32907468696
• Release dry-run: urn:sha256:7b906b947368a931b4ea1545b7f1f0bedf7429ac63ffff0b2a4b2f2ebe801996
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-kafka/adapters/gotelemetry v1.0.0

1.0.0 - 2026-08-25

Fixed

• make documentation and specification checks work on stock CI runners without
  a nonstandard search tool
• suppress unproved standard producer-send and poll-receive signals, restrict
  remaining standard metric dimensions to the pinned 1.44.0 schemas, keep
  adapter metrics identity-free, fail closed on unmapped observations, and
  contain provider panics without exposing panic values
• keep skipped and pre-handler replay failures out of OpenTelemetry application
  processing and delivery telemetry
• keep consumer record and batch observations out of standard processing
  telemetry because pre-handler exits and handler failures are indistinguishable

Added

• add an auditable specification decision register for span semantics,
  identity and propagation bounds, and caller-owned provider lifecycle
• exhaustive span, metric, attribute, lifecycle, sampling, shutdown,
  concurrency, fuzz, and benchmark contracts plus enforced API, privacy, FAQ,
  and migration documentation
• explicit, concurrency-safe W3C Trace Context injection and extraction for
  bounded Kafka records, with defensive producer copies, borrowed-consumer
  ownership, fail-closed duplicate fields, no baggage, and no global
  OpenTelemetry state
• pinned Apache Kafka 4.3.1 producer-to-consumer integration evidence that
  preserves and extracts the same remote W3C span context before source-offset
  settlement
• internal spans and adapter-owned duration metrics for the bounded local wait
  from blocked-callback entry through poll-gate release or failure
• internal spans and adapter-owned operation metrics for bounded consumer retry
  decisions without double-counting semantic consumption or processing
• bounded kafka.authentication.method broker-connect span attributes that
  identify the configured SASL flow without credentials or a fabricated
  standalone authentication span
• INTERNAL spans for producer, consumer, and consume-transform-produce
  shutdown-attempt observations
• CLIENT spans and bounded adapter-owned diagnostics for cluster, topic,
  consumer-group, and dependency-health queries, with INTERNAL readiness and
  inspector-shutdown spans
• replay plan, record-processing, exact aggregate progress, and shutdown spans
  plus fixed replay progress attributes
• independently versioned OpenTelemetry adapter for every stable root Kafka
  observation
• OpenTelemetry messaging semantic-convention 1.44.0 spans and metrics only
  where root observations prove replay processing, settle, and pulled-message
  semantics
• explicit deny-by-default client, topic, and consumer-group attribute
  allowlists with bounded validation and defensive copies
• adapter-owned broker request-size, queue-duration, throttle, lifecycle, and
  transaction telemetry without record data, endpoints, credentials, or
  application error text
• exact operation timestamps, stable redacted error categories, concurrent
  observer safety, fuzz targets, race coverage, and allocation benchmarks

Changed

• Publish the module from its standalone github.com/faustbrian/go-kafka/adapters/gotelemetry identity while preserving its documented API and behavior.

• select and record OpenTelemetry messaging semantic conventions 1.44.0,
  retaining explicit completion-observer boundaries for cluster identity,
  create/client-send spans, and creation-context links

• Require owned sibling modules at local v0.0.0; clean external consumers
  pin each module to an exact main pseudo-version.

• validate public observations through the root Kafka contract so adapters do
  not define divergent settlement or cardinality rules

Release integrity

• Source commit: 382373f72a0552d0996635dc4d0f7f8cf8af2287
• Exact-head CI: https://github.com/faustbrian/go-kafka/actions/runs/32907468696
• Release dry-run: urn:sha256:8cce81cc38489626da23bbf9505478bb9feb109b37a553775428a6963868b195
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS