v0.4.0

Changelog

• 104257f build(release): make builds reproducible and ship an SBOM
• 11e29f8 ci: align toolchain with go.mod and add the missing gates
• d11a5df ci: run golangci-lint directly at a pinned version
• 2a6107e docs(rfc): add v0.4.0 production hardening RFC
• a58d1ea docs(rfc): close batch 7 and state why the status stays ACCEPTED
• 8ddce45 docs(rfc): mark batch 3 complete and record the full-matrix decision
• cce8597 docs(rfc): mark batch 4 complete
• 1678b2c docs(rfc): mark batch 5 complete with a status table for all 16 anomalies
• a4cebc3 docs(rfc): mark batch 6 complete
• 64b9bfc docs(rfc): mark batches 1 and 2 complete with commit references
• 2c95e14 feat(adopt): replace the questionnaire with a real repository scan
• 7560e2e feat(cli): make adopt preview by default
• f7d4810 feat(cli): publish how much evidence stands behind each command
• d65eeea feat(doctor): audit the user's project, not just go-aether's own output
• fcf5b65 feat(domain): enforce the project root as a real boundary
• eaadf5f feat(domain): model brownfield layout reports and BYO detection
• ab4801a feat(domain): validate stack selections against what templates exist
• 98229cb feat(scanner): implement bounded layout scanning and BYO detection
• 82f6be1 feat(service): resolve templates from the manifest stack
• c501019 feat(templates): add real router and driver variants
• 53d41cc feat(templates): surface detected clients in repository constructors
• 8d6b0af feat(writer): bound manifest size and Windows path length
• ea51d7f fix(arch): make per-layer commands produce a slice that compiles
• 4d5ef5f fix(cli): offer only stack choices that actually exist
• 7342ba6 fix(cli): release the lock on failure and bound the manifest search
• 4b1cf6e fix(doctor): match syntax, not source text
• e750e07 fix(domain): reject Windows reserved device names
• 523cb59 fix(init): derive the Go version from the running toolchain
• 9d70230 fix(init): resolve dependencies after rendering, not before
• 40d92a5 fix(release): migrate archives to the formats list and pin GoReleaser
• 9487cd5 fix(service): check every transactional write
• 59a23e8 fix(service): stop reporting success for work that never happened
• c420947 fix(template): format generated Go before it reaches disk
• 1b1c5eb fix(templates): make the generated Dockerfile buildable and non-root
• 766aac1 fix(writer): detect missing files through errors.Is
• 8a80b65 test(e2e): add compile gate proving generated code does not build
• a931518 test(e2e): cover brownfield adoption against a legacy repository
• f6ee26b test(e2e): gate every router and driver combination
• d26ebfb test(regression): bank path escapes and partial-write rollback
• 1dd7012 test(regression): bank the silent generator failures

---

Verify the download before running it:

sha256sum -c checksums.txt

Command maturity is printed by go-aether --help. Commands marked
[experimental] have no automated coverage yet.