github.com/faustbrian/go-queue v1.0.1

[1.0.1] - 2026-08-28

Added

• Add the independently versioned rabbitmq compatibility module over
  go-rabbitmq-queues, with explicit native policy, stable message identity,
  mandatory persistent publishing, confirmed retry and terminal replacement,
  bounded request bridging, and independent producer and consumer resources.

Changed

• Run repository verification with Go 1.27.0 so the nested RabbitMQ adapter
  and CodeQL build use the toolchain required by the native queue dependency.

• Remove direct AMQP ownership from the root module. RabbitMQ adopters now use
  github.com/faustbrian/go-queue/rabbitmq as a nested release after upgrading
  the parent module to the release that excludes the former package archive.

Documentation

• Align maintained documentation with the stable v1 release contract and
  remove obsolete candidate or verdict wording.

• Clarify how shared safety-policy updates are coordinated across standalone
  repositories.

• Replace archived monorepo links and completed execution artifacts with a
  standalone, human-oriented documentation structure.

Release integrity

• Source commit: bb1645ec4c723facde3081157550d8c54a27a720
• Exact-head CI: https://github.com/faustbrian/go-queue/actions/runs/33163236911
• Release rehearsal: https://github.com/faustbrian/go-queue/actions/runs/33167365793
• Verification evidence: urn:sha256:abdcf166aa49a6f1b7bb784b68988397156c16a66872c01c47a5d28933794328
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-queue/rabbitmq v1.0.0

[1.0.0] - 2026-08-28

Added

• Replace direct AMQP ownership with an explicit compatibility adapter over
  go-rabbitmq-queues while retaining the go-queue worker, option, request,
  and settlement surfaces.

• Require stable message identity, mandatory persistent publications, manual
  settlement, bounded pull requests, confirmed retry and terminal replacement
  publications, and independent producer and consumer lifecycles.

• Add CI-hosted RabbitMQ 4.3.5 TLS evidence for confirmed queueing, request and
  settlement, retry-before-ACK, terminal replacement, and producer/consumer
  failure isolation.

Changed

• Require WithNativeConfig; automatic acknowledgement, fanout, and headers
  exchanges are rejected until their legacy migration semantics are defined.

• Open the producer during construction and open the consumer only when
  Request first needs it.

• Preserve malformed, permanent, exhausted, canceled, infrastructure, repeated
  settlement, and repeated shutdown outcomes without exposing broker details.

• Reject invalid exchange policy without logging caller-controlled identities.

Release integrity

• Source commit: 532594a9036fd29c29c0b3fddd7b8ae9255f0055
• Exact-head CI: https://github.com/faustbrian/go-queue/actions/runs/33172582390
• Release rehearsal: https://github.com/faustbrian/go-queue/actions/runs/33178973420
• Verification evidence: urn:sha256:ed329afb2a8218831cba5de0983d1c5c2dc80373d9f6f6826603f49f0db753ff
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-queue v1.0.0

[1.0.0] - 2026-08-25

Changed

• Upgrade moby/go-archive and golang.org/x/crypto to their current
  security-fixed releases and reconcile the resulting indirect dependency
  graph.

• Build CodeQL against a deterministic proxy of the current root module so
  nested modules never resolve stale public or bootstrap archives.

• Validate action pinning from the standalone repository root and leave
  repository-foundation policy to the authoritative repository contract.

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Documentation

• Replace obsolete standalone-repository links and workflow claims with
  monorepo-canonical targets and current release guidance.

• Link the package README to the repository-wide Golib documentation portal.

Added

• Add managementhttp.NewFleetClient for bounded dynamic worker discovery,
  fleet-wide status aggregation, worker-target routing, and queue or worker-group
  command fan-out. Acknowledgements require every current endpoint; partial and
  unavailable outcomes remain explicit, and callers retain ownership of TLS,
  discovery, and operation deadlines.

Changed

• Publish the module from its standalone github.com/faustbrian/go-queue identity while preserving its documented API and behavior.

• Valkey Streams terminal delivery limits now accept one attempt, allowing a
  failed first handler execution to move directly to the dead-letter stream.

• Strengthen exact queue semantic, settlement-callback, retry, replay-lineage,
  failure-graph traversal, and metadata-boundary contracts while removing
  validation branches that were provably redundant with stricter aggregate
  limits.

• Preserve decodable NSQ dead-letter payloads through the maximum accepted
  source-message size and retain the backend default delay on every requeue
  path.

• Prove logger configuration, option ordering, lifecycle drain transitions,
  stack recovery, and in-memory queue boundaries with mutation-effective
  contracts.

• Management HTTP handlers, single-endpoint clients, and fleet clients now
  reject bearer tokens containing ASCII control characters before transport.

• Valkey Streams workers can now select a bounded terminal broker-delivery
  ceiling per decoded message with WithDeliveryAttemptLimitResolver.
  WithDeadLetter remains the default; unsafe resolver results or panics leave
  the source delivery pending and return a stable redacted error.

• Remove unused CLI-related indirect dependencies from canonical module
  metadata.

• Move the optional service and correlation lifecycle adapter into the
  independently versioned queueservice module. Core queue consumers no
  longer inherit unrelated service runtime dependencies.

• Queue.CloseAdmission now provides the prompt split phase used by service
  drain to reject submissions and stop backend intake without releasing the
  worker. Queue.ReleaseContext waits for accepted publishes and active
  handlers before release. Legacy Release retains its force-compatible
  behavior. Graceful withdrawal also releases a reserved management admission
  before the scheduler exits.

• Queue.ReleaseContext now contains concrete worker shutdown panics as the
  stable, secret-safe ErrWorkerShutdownPanic result and caches that terminal
  result across repeated release calls.

• Handler backoff now retries only retryable failures. Permanent, malformed,
  canceled, and infrastructure outcomes reach backend settlement after the
  first handler execution instead of repeating a known terminal or uncertain
  operation inside the same delivery.

• Redis Streams and Valkey Streams no longer use source MAXLEN trimming,
  which could delete accepted pending deliveries. Valkey source admission is
  hard-bounded; Redis direct enqueue is hard-bounded when configured, while
  cross-key administrative mutations preflight capacity without destructive
  trimming. Successful acknowledgement deletes a source entry only after
  every existing consumer group has settled it.

• Bound Redis and Valkey management page allocations to the package maximum
  and remove narrowing conversions from record and status pagination.

• Retry Valkey integration container startup, endpoint publication, and restart
  readiness failures, clean up partial containers, and retain connection errors
  for diagnosis.

• Retry NATS and Redis integration container startup after bounded host-port
  allocation races, clean up partially created containers between attempts,
  and keep Redis restart verification tolerant of loaded race-test hosts.

• Regenerated the complete documentation bundle from the current package
  documentation and release notes.

• Run the Redis Pub/Sub shutdown lifecycle benchmark once instead of allowing
  benchmark calibration to repeat its intentionally expensive untimed setup.

• NSQ statistics now synchronize with consumer initialization and shutdown so
  callers cannot observe a partially published consumer or trigger a data race.

• Reject malformed embedded job metadata explicitly in NSQ dead-letter wire
  boundary coverage.

• RabbitMQ restart integration now waits for a successful AMQP constructor
  after container restart instead of assuming container start implies protocol
  readiness under a concurrent full-backend test run.

• Valkey Streams retry and replay now carry bounded original/prior
  dead-letter identifiers and replay generation through native stream entries
  and repeated terminal records. Partial or overflowing lineage is rejected.

• Redis Streams dead-letter retry now carries bounded redrive lineage into the
  durable retry entry, matching replay behavior so another terminal failure
  retains its original and prior dead-letter identifiers.

• Redis Streams and Valkey Streams v1 management records now populate the
  last-delivery time from the package-owned settlement observation and include
  the configured management worker version when it is known.

• Exhausted NSQ and RabbitMQ deliveries now retain the terminal
  attempts_exhausted failure code even when the handler supplied a generic
  retryable code. RabbitMQ malformed attempt headers also retain their
  dedicated safe failure code.

• Valkey integration coverage now verifies that recovered handler panics are
  treated as permanent failures and dead-lettered instead of remaining
  pending for another consumer.

• Redis Streams and Valkey Streams record-read transport failures now expose
  secret-safe text and the stable management.ErrManagementUnavailable
  sentinel while preserving caller cancellation and the native cause for
  programmatic inspection.

• Valkey Streams record listings now use bounded native-ID cursors across the
  complete retained stream in either occurrence-time direction. Unsupported
  sort fields fail explicitly instead of sorting a truncated local snapshot.

• Valkey Streams source WithMaxLength no longer silently trims failure and
  dead-letter records; record eviction is disabled until explicitly enabled.

• Redis Streams source WithMaxLength no longer silently trims failure and
  dead-letter records. Record eviction is disabled unless explicitly enabled
  with exact maximum-count retention.

• NSQ now requeues retryable, canceled, and infrastructure failures under a
  bounded broker-attempt policy, then publishes a terminal envelope before
  finishing exhausted, permanent, or malformed source messages.

• RabbitMQ now declares a durable dead-letter exchange and queue by default.
  Retryable failures use confirmed republish with a bounded delivery-attempt
  header; exhausted, permanent, and malformed work is confirmed to the
  terminal destination before the source delivery is acknowledged.

• Redis Streams now defaults to bounded pending recovery and dead-letter
  policy instead of leaving failed and malformed entries indefinitely pending.

• Valkey record readers and the authenticated HTTP transport now preserve
  stable unsupported, not-found, malformed-cursor, unavailable, stale,
  conflict, partial, and unknown management outcomes through errors.Is.

• Added the GO-SAFETY-1 ownership, concurrency, race, fuzz, resource, and
  benchmark standard with an executable make safety gate.

• Moved AI planning and hardening briefs into .ai/ and clarified the
  separate purposes of ownership notices and detailed fork provenance.

• Valkey Streams now dead-letters explicitly permanent or malformed handler
  failures immediately, while canceled and infrastructure failures stay
  recoverable instead of becoming terminal through the attempt limit.

Added

• queueservice producer and worker lifecycle adapters with explicit concrete
  resource ownership, publisher draining, service-context shutdown bounds, and
  correlation- and trace-aware publish and delivery helpers.
• Bounded correlation and W3C trace-context carriers in job.Metadata; every
  trusted delivery uses the existing correlation queue adapter to preserve its
  workflow while creating a distinct request ID and causation link. Optional
  trace propagation uses an explicit caller-owned OpenTelemetry propagator
  without global provider state.
• Additive core.DeliveryValidator support lets a worker validate one decoded
  delivery exactly once before the root queue starts handler timeout and retry
  execution. Classified validation failures proceed directly to settlement.
• Valkey Streams WithCanceledDeadLetterCodes for calle...

github.com/faustbrian/go-queue/queueservice v1.0.0

1.0.0 - 2026-08-25

Documentation

• Link the package README to the repository-wide Golib documentation portal.

Changed

• Publish the module from its standalone github.com/faustbrian/go-queue/queueservice identity while preserving its documented API and behavior.
• Refresh local v0.0.0 owned-module checksums after dependency manifests and
  release notes were normalized; runtime behavior and public APIs are
  unchanged.
• Publish the service lifecycle adapter as an independently versioned optional
  module so core queue consumers do not inherit service or correlation runtime
  dependencies.
• Classify producer results as accepted, not accepted, or unknown so canceled
  and ambiguous publishes cannot be retried as if they were equivalent.
• Share and cache owned-resource cleanup results so repeated and concurrent
  stop calls never close the resource more than once.
• Close producer and typed-worker admission during service drain so readiness
  and new intake become unavailable before supervised work is canceled.
• Close concrete *queue.Queue admission during service drain without
  releasing its backend before admitted handlers settle.
• Classify contained concrete queue release panics as secret-safe shutdown
  callback panics with a deterministic terminal result.
• Preserve callback error causes behind operation-specific diagnostics that do
  not disclose backend endpoints, credentials, or task payloads.
• Report an unexpected successful worker-run exit as a supervised failure while
  treating exit after cancellation as normal shutdown.
• Reject concurrent or repeated typed-worker run calls so exactly one backend
  intake loop owns deliveries and settlement.
• Stabilize durable recovery verification by keeping replacement-worker test
  leases beyond the active handler and settlement window.

Added

• Correlation-aware producer, delivery-handler, and worker lifecycle adapters
  for the owned queue and service modules.
• Hostile-input fuzz and deterministic lifecycle coverage proving transport
  metadata never aliases caller-owned state and asynchronous failures cannot
  hang the verification suite.
• Optional producer startup and readiness callbacks with rollback-safe owned
  cleanup and secret-safe panic recovery.
• Typed supervised worker plans that bind startup, readiness, run, handler,
  drain, and shutdown callbacks to one stable service identity.
• Service drain admission hooks that reject new producer and worker work before
  shutdown cancellation begins.
• Module lifecycle, Kubernetes, scaling, duplicate-window, backend, adoption,
  migration, security, and FAQ documentation plus a package-scoped backend
  integration gate.
• An explicit lifecycle transition model and adversarial drain campaign that
  races readiness, cancellation, duplicate signals, and shutdown ownership.
• Lifecycle-aware HTTP liveness and readiness coverage during concurrent
  worker drain, cancellation, repeated signals, and backend failure.
• Independent producer, handler, and typed-worker adapter benchmarks that keep
  broker and application work outside the measured lifecycle overhead.
• Redis Streams and Valkey Streams composition coverage through the concrete
  queue worker adapter before the full durable-backend recovery suite runs.
• Abrupt process-termination coverage before handler effects, after effects,
  and after settlement, including expired-lease recovery by competing workers.
• Real Redis Streams and Valkey Streams adapter coverage for disconnect and
  reconnect, handler timeout, lease-expiry redelivery, dead-letter outage,
  shutdown, scale-up/down, and rolling replacement without lost settlement.
• An isolated Kind end-to-end gate that force-deletes Redis- and Valkey-backed
  worker pods at each effect/settlement boundary and verifies competing pod
  recovery against durable backend state.

Release integrity

• Source commit: e46589667d1adf44fbcc75287ca5327d7cf8b030
• Exact-head CI: https://github.com/faustbrian/go-queue/actions/runs/32918210335
• Release dry-run: urn:sha256:e567af04e378fa63c6f9c531b5e8bcb4c7044bafbd18b1dd2ca16192535dcd4c
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS