github.com/faustbrian/go-queue-control-plane v1.0.0

1.0.0 - 2026-08-25

Fixed

• Bind the reviewed zero-mutant embedded UI handler to its exact standalone
  source identity.

Changed

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Documentation

• Correct stale package, standalone, and authoritative-source links in public
  documentation.

Fixed

• Enforce exact fleet capacity, runtime accumulation, rejection aggregation,
  deterministic ordering, and telemetry saturation boundaries under mutation
  verification.
• Validate structured data-plane results through an explicit terminal-outcome
  whitelist, preserving fail-closed cancellation and lifecycle-state handling
  without redundant status conditions.
• Strengthen command-orchestration verification around desired-state target
  alternatives, caller-supplied metadata, and every nonterminal dispatch
  outcome.

Documentation

• Replace obsolete standalone-repository links and workflow claims with
  monorepo-canonical targets and current release guidance.

• Link the package README to the repository-wide Golib documentation portal.

• Replace the invalid GitHub package URL with a portable repository-relative
  link to queue.

Compatibility

• Added a pinned module export baseline so incompatible public API changes
  fail the canonical repository gate.

Changed

• Publish the module from its standalone github.com/faustbrian/go-queue-control-plane identity while preserving its documented API and behavior.

• Require each CLI connection credential independently, with mutation-precise
  regression coverage for every missing environment value.

• Replace obsolete owned-module pseudo-version pins with the monorepo's local
  v0.0.0 source-proxy coordinates; release tooling continues to emit exact
  v1.0.0 dependency versions.

• New durable command identifiers are lowercase ULIDs. The PostgreSQL upgrade
  preserves historical UUID command identifiers while changing command and
  reference columns to text so existing audit history remains addressable.

• Require owned sibling modules at local v0.0.0; clean external consumers
  pin each module to an exact main pseudo-version.

• Upgraded the resolved gRPC dependency to 1.82.1 and refreshed owned-module
  checksums after the shared telemetry dependency update.

• Align indirect dependency metadata with the resolved graph so clean
  consumers and CI obtain reproducible module metadata.

• Refresh owned-module checksums against the final consolidated archives.

• Made the documented idempotency example unambiguously synthetic so strict
  secret scanning does not mistake it for a credential.

• Normalized standalone module metadata against the canonical owned dependency
  graph, including complete checksums for clean consumer resolution.

• Refreshed the canonical authentication checksum after its test archive
  changed, preserving isolated module verification.

• Refreshed owned authentication, authorization, and PostgreSQL checksums after
  their API compatibility baselines were normalized to module boundaries.

• Pinned the completed queue dead-letter v1 contracts, stable operational
  failure codes, retention negotiation, and bounded Redis/Valkey redrive
  lineage used by rolling worker fleets.

• Strengthened the deterministic local and hosted quality gate with module
  checksum verification, Staticcheck, strict golangci-lint, advisory NilAway,
  and exact per-package statement coverage.

• Added a global CLI --output human mode while retaining compact JSON as the
  stable default and keeping terminal control characters escaped.

Added

• Fixed-label bounded alert telemetry export for up to 12,000 validated alerts
  without tenant, resource, or error-derived metric labels.
• Attachment disposition on privileged payload and diagnostics responses.
• Real Redis and Valkey concurrent retry/delete evidence proving exactly one
  truthful winner for a contested failed record.
• PostgreSQL child-process death evidence during authorization and live
  dispatcher execution, preserving zero or durably auditable state.
• Allocation-budgeted maximum-payload, 10,000-worker reconnect-storm, and
  backend-outage dispatch benchmarks in the local and hosted smoke gate.
• Distinct durable unsupported, timed_out, and partial command outcomes
  so queue acknowledgements cannot be flattened into a clean failure.
• Restart-safe pending, dispatched, and acknowledged command boundaries,
  transition timestamps, pre-dispatch cancellation, and fault-injected
  PostgreSQL recovery evidence.
• Durable bounded command deadlines, authentication methods, required
  capabilities, and worker/protocol acknowledgement snapshots.
• Durable opaque command identifiers distinct from caller-owned idempotency keys,
  including migration backfill and end-to-end result propagation.
• Separate record-list, record-inspection, payload-view, and audit-view
  permissions with exact tenant and object scope.
• Truthful CLI retention status derived from negotiated worker capabilities,
  with unknown numeric limits represented explicitly.
• Independently authorized diagnostics visibility with fail-closed masking
  across the HTTP API, typed client, and CLI.
• Fail-closed chained audit persistence before every privileged payload or
  diagnostics backend read.
• Public administrative command, result, permission, and validation contracts.
• Durable PostgreSQL command, desired-state, and tamper-evident audit storage.
• Bounded worker fleet and rolling-protocol compatibility models.
• Authenticated and authorized HTTP API with health, readiness, version,
  capability, command, audit, worker, and Kubernetes workload surfaces.
• Typed Go client and administrative CLI.
• Narrow namespace-scoped Kubernetes Deployment visibility and scaling.
• Hardened server and CLI container targets for amd64 and arm64.
• Deterministic Go quality, race, coverage, fuzz-smoke, and container CI gates.
• Real PostgreSQL 16, 17, and 18 migration, persistence, idempotency, tenant
  isolation, audit verification, and retention integration gates.
• Reproducible 10,000-worker and 100,000-audit-event load benchmarks with a
  documented development baseline and CI smoke execution.
• Maximum 1,000-worker authenticated HTTP response benchmark with every worker
  advertising the bounded 256-queue limit.
• Maximum-page queue and failure/dead-letter conversion benchmarks in the
  hosted load smoke gate.
• Pinned govulncheck source scanning against the canonical Go vulnerability
  database in local and hosted quality workflows.
• BuildKit SBOM and maximal provenance attestations on the multi-platform OCI
  artifact produced by CI.
• Semver-tagged GHCR publication and keyless Sigstore signing for both server
  and CLI images, with immediate workflow-identity verification.
• Targeted goroutine-leak assertions for graceful and forced HTTP server
  shutdown paths.
• Pinned mutation testing with 100% coverage and efficacy across all current
  public command, authorization, desired-state, dispatch, and orchestration
  mutants.
• Migration-only server mode for one-shot production schema Jobs that exit
  before loading serving dependencies.
• Isolated PostgreSQL 18 disaster-recovery gate using native dump and restore
  with repository-level verification of the recovered state.
• Pinned semantic API-diff gate against a reviewed full-module export baseline
  in both CI and release quality.
• Reproducible standalone archives for six operating-system and architecture
  targets with signed checksums and GitHub Release publication.
• Optional secure OTLP runtime wiring for HTTP and bounded control-command
  telemetry with explicit lifecycle ownership and trusted-context policy.
• One-shot production audit retention with strict per-tenant policies, legal
  holds, pre/post verification, bounded batches, and real PostgreSQL coverage.
• Real Chromium security coverage for exact-origin CORS, automatic preflight,
  cookie-backed CSRF, credential admission, and defensive response headers.
• Real Chromium command-envelope coverage for every public mutation and each
  action-specific selection, replay, and scale field.
• Mutation scope excludes installed browser dependencies and test-server code,
  keeping release efficacy measurements limited to owned production decisions.
• Server and CLI container builds now include the imported data-plane adapter
  and embedded UI packages in their restricted build context.
• Newest-first tenant command history with bounded opaque-cursor pagination
  across PostgreSQL, the authenticated API, typed client, and CLI.
• Safe bounded terminal-command retention after verified audit cleanup, while
  preserving active commands and current desired-state references.
• Tenant-scoped queue management adaptation for every control action,
  bounded bulk retry, protocol deadlines, and structured terminal outcomes.
• Authenticated failure and dead-letter list and inspect APIs, typed client,
  and CLI with bounded search/sort pagination and privileged payload viewing.
• Authenticated bounded queue-status API, typed client, CLI, and application
  capability wiring with explicit unsupported-measurement representation.
• Optional production worker and queue-status composition through a strict
  tenant-to-HTTPS management document and separate bounded per-tenant
  bearer-token files.
• Optional production tenant command dispatch through the sam...