release

package
v2026.0.143 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: MPL-2.0 Imports: 32 Imported by: 0

Documentation

Overview

Package release verifies a clean repository at its exact commit and exact build tools, constructs deterministic fixed-target Go build and process plans, inspects the resulting native executables, binds signed tool and metadata provenance into immutable manifests, authenticates Latest selections, then makes the installed-versus-latest decision.

Release owns no file creation, transport, download, installation, scheduling, persistence, retry, or customer-facing policy. Executable inspection owns one bounded Filestore read handle for the duration of the inspection and closes it before returning.

Index

Constants

View Source 
const (
	EmbeddedBuildOfferingLinkSymbol = embeddedBuildIdentityPackagePath + "." + embeddedBuildOfferingVariableName
	EmbeddedBuildVersionLinkSymbol  = embeddedBuildIdentityPackagePath + "." + embeddedBuildVersionVariableName
	EmbeddedBuildCommitLinkSymbol   = embeddedBuildIdentityPackagePath + "." + embeddedBuildCommitVariableName
	EmbeddedBuildPlatformLinkSymbol = embeddedBuildIdentityPackagePath + "." + embeddedBuildPlatformVariableName
)

Embedded build-identity linker symbols are owned beside the variables they name. Consumer release builders use these constants with the Go linker's -X flag instead of copying Primitive's package path or private variable names.

View Source 
const (
	// TargetCount is the exact number of artifacts in one release.
	TargetCount = 4
	// ReleaseLatestMaximumLifetimeNanoseconds is the exact 24-hour Latest
	// validity ceiling.
	ReleaseLatestMaximumLifetimeNanoseconds int64 = int64(temporal.NanosecondsPerDay)
	// ReleaseClockRollbackToleranceNanoseconds is the exact five-minute
	// correction tolerance against a signed issue instant.
	ReleaseClockRollbackToleranceNanoseconds int64 = 5 * int64(temporal.NanosecondsPerMinute)
)
View Source 
const (
	// MetadataAssetCount is the exact number of non-binary documents bound to
	// every release manifest.
	MetadataAssetCount = 3

	// MetadataAssetMaximumBytes bounds each dependency, documentation, or
	// release-note object independently of object size in memory.
	MetadataAssetMaximumBytes = 256 << 20
)
View Source 
const (

	// BinaryFilenameMaximumBytes bounds the only derived artifact filename.
	BinaryFilenameMaximumBytes = 64
)
View Source 
const (
	// BuildDependencyMaximumCount bounds the distinct non-main modules in one
	// exact four-target build closure. The ceiling is chosen so the largest
	// admissible closure still projects into a decodable dependency document:
	// every module path, version, and sum admits only characters the JSON
	// encoder emits verbatim, so one entry costs at most
	// mainPackageMaximumBytes + goModuleVersionMaximumBytes +
	// goModuleSumMaximumBytes + dependencyEntryPunctuationBytes bytes and the
	// whole document stays under dependencyDocumentExtentMaximum.
	BuildDependencyMaximumCount = 1024
)
View Source 
const (
	// BuiltArtifactMaximumBytes is the largest executable admitted by the
	// release inspection boundary. It preserves the established consumer
	// release ceiling while keeping every read and parser view finite.
	BuiltArtifactMaximumBytes = 256 << 20
)
View Source 
const PublicationObjectCount = TargetCount + 1 + MetadataAssetCount

PublicationObjectCount is the exact immutable object count in one complete release publication: four executables, the signed manifest, and three metadata assets.

Variables

This section is empty.

Functions

func EmbeddedBuildIdentity 

func EmbeddedBuildIdentity() (core.BuildIdentity, error)

EmbeddedBuildIdentity reads the installation identity injected into the current binary at link time. It never accepts caller-supplied identity facts.

func PrepareBuildProcess added in v2026.0.11 

func PrepareBuildProcess(request BuildProcessRequest) (process.Request, error)

PrepareBuildProcess lowers one command into the generic typed process boundary without starting it.

Types

type AdvanceLatestRequest 

type AdvanceLatestRequest struct {
	Retained VerifiedLatest
	Proposed VerifiedLatest
}

func (AdvanceLatestRequest) Validate 

func (r AdvanceLatestRequest) Validate() error

Validate proves both authenticated stream observations at ingress.

type Artifact 

type Artifact struct {
	// contains filtered or unexported fields
}

Artifact is one immutable release object. Its filename is derived.

func InspectBuiltArtifact added in v2026.0.11 

func InspectBuiltArtifact(ctx context.Context, request ArtifactInspectionRequest) (Artifact, error)

InspectBuiltArtifact proves the executable format, target architecture, executable standing, stable held-file identity, stripping, exact observed extent, dual integrity, and embedded release stamps. The source is never retained and memory use is independent of its extent.

func NewArtifact 

func NewArtifact(request ArtifactRequest) (Artifact, error)

func (Artifact) Build 

func (a Artifact) Build() core.BuildIdentity

func (Artifact) Filename 

func (a Artifact) Filename() (BinaryFilename, error)

Filename returns the basename derived solely from the immutable build.

func (Artifact) Identity 

func (a Artifact) Identity() ArtifactIdentity

func (Artifact) Integrity 

func (a Artifact) Integrity() ArtifactIntegrity

func (Artifact) MarshalJSON 

func (a Artifact) MarshalJSON() ([]byte, error)

func (Artifact) Target 

func (a Artifact) Target() core.Platform

func (*Artifact) UnmarshalJSON 

func (a *Artifact) UnmarshalJSON(data []byte) error

func (Artifact) Validate 

func (a Artifact) Validate() error

type ArtifactIdentity 

type ArtifactIdentity struct {
	// contains filtered or unexported fields
}

ArtifactIdentity is the nominal digest of immutable artifact facts.

func (ArtifactIdentity) MarshalJSON 

func (i ArtifactIdentity) MarshalJSON() ([]byte, error)

func (ArtifactIdentity) String 

func (i ArtifactIdentity) String() string

func (*ArtifactIdentity) UnmarshalJSON 

func (i *ArtifactIdentity) UnmarshalJSON(data []byte) error

func (ArtifactIdentity) Validate 

func (i ArtifactIdentity) Validate() error

type ArtifactInspectionRequest added in v2026.0.11 

type ArtifactInspectionRequest struct {
	Path              core.AbsolutePath
	LinkerAssignments LinkerAssignments
	Build             core.BuildIdentity
}

ArtifactInspectionRequest names one built executable and the exact compiler-owned facts that its build command injected. The file extent is an observed Filestore fact, never a caller declaration.

func (ArtifactInspectionRequest) Validate added in v2026.0.11 

func (r ArtifactInspectionRequest) Validate() error

Validate closes the typed boundary before the path is observed.

type ArtifactIntegrity 

type ArtifactIntegrity struct {
	// contains filtered or unexported fields
}

ArtifactIntegrity is the complete fixed-size transfer verification contract.

func (ArtifactIntegrity) CRC32C 

func (i ArtifactIntegrity) CRC32C() core.CRC32C

func (ArtifactIntegrity) Extent 

func (i ArtifactIntegrity) Extent() core.ByteCount

func (ArtifactIntegrity) MarshalJSON 

func (i ArtifactIntegrity) MarshalJSON() ([]byte, error)

func (ArtifactIntegrity) SHA256 

func (i ArtifactIntegrity) SHA256() core.SHA256Digest

func (*ArtifactIntegrity) UnmarshalJSON 

func (i *ArtifactIntegrity) UnmarshalJSON(data []byte) error

func (ArtifactIntegrity) Validate 

func (i ArtifactIntegrity) Validate() error

type ArtifactRequest 

type ArtifactRequest struct {
	Build  core.BuildIdentity
	Extent core.ByteCount
	CRC32C core.CRC32C
	SHA256 core.SHA256Digest
}

ArtifactRequest supplies one artifact's immutable facts.

func (ArtifactRequest) Validate 

func (r ArtifactRequest) Validate() error

Validate proves every immutable artifact fact before identity derivation.

type ArtifactSet 

type ArtifactSet struct {
	// contains filtered or unexported fields
}

ArtifactSet is fixed storage for exactly one artifact per release target.

func NewArtifactSet 

func NewArtifactSet(request ArtifactSetRequest) (ArtifactSet, error)

func (ArtifactSet) At 

func (s ArtifactSet) At(index int) (Artifact, bool)

func (ArtifactSet) ForPlatform 

func (s ArtifactSet) ForPlatform(platform core.Platform) (Artifact, bool)

func (ArtifactSet) MarshalJSON 

func (s ArtifactSet) MarshalJSON() ([]byte, error)

func (ArtifactSet) TotalExtent 

func (s ArtifactSet) TotalExtent() (core.ByteCount, error)

func (*ArtifactSet) UnmarshalJSON 

func (s *ArtifactSet) UnmarshalJSON(data []byte) error

func (ArtifactSet) Validate 

func (s ArtifactSet) Validate() error

type ArtifactSetRequest 

type ArtifactSetRequest struct {
	Artifacts [TargetCount]Artifact
}

ArtifactSetRequest supplies the exact ordered target slots.

func (ArtifactSetRequest) Validate 

func (r ArtifactSetRequest) Validate() error

Validate proves every fixed target slot and the one-release closure.

type AssessLatestRequest 

type AssessLatestRequest struct {
	Latest      VerifiedLatest
	Observation temporal.Instant
}

func (AssessLatestRequest) Validate 

func (r AssessLatestRequest) Validate() error

Validate proves the authenticated Latest value and observation instant.

type AvailableRelease 

type AvailableRelease struct {
	// contains filtered or unexported fields
}

AvailableRelease privately carries every authenticated fact needed to prepare one Upgrade handoff without re-decoding caller data.

func (AvailableRelease) PrepareAt 

func (a AvailableRelease) PrepareAt(observation temporal.Instant) (Preparation, error)

func (AvailableRelease) Summary 

func (a AvailableRelease) Summary() (AvailableSummary, error)

Summary returns a validated value copy without Upgrade authority.

func (AvailableRelease) Validate 

func (a AvailableRelease) Validate() error

type AvailableSummary 

type AvailableSummary struct {
	Installed        core.BuildIdentity     `json:"installed"`
	Candidate        core.BuildIdentity     `json:"candidate"`
	Manifest         ManifestIdentity       `json:"manifest"`
	ManifestDocument ManifestDocumentDigest `json:"manifest_document"`
	Artifact         ArtifactIdentity       `json:"artifact"`
	Filename         BinaryFilename         `json:"filename"`
	Integrity        ArtifactIntegrity      `json:"integrity"`
	ValidUntil       temporal.Instant       `json:"valid_until"`
}

AvailableSummary is the non-authoritative value projection of an available release. Its fields are sufficient to render and preflight the exact candidate without granting installation authority.

func (AvailableSummary) MarshalJSON added in v2026.0.55 

func (s AvailableSummary) MarshalJSON() ([]byte, error)

func (*AvailableSummary) UnmarshalJSON added in v2026.0.55 

func (s *AvailableSummary) UnmarshalJSON(data []byte) error

func (AvailableSummary) Validate 

func (s AvailableSummary) Validate() error

Validate proves the summary's complete candidate-artifact closure.

type BinaryFilename 

type BinaryFilename struct {
	// contains filtered or unexported fields
}

BinaryFilename is a bounded, derived release artifact basename.

func (BinaryFilename) MarshalJSON added in v2026.0.55 

func (f BinaryFilename) MarshalJSON() ([]byte, error)

func (BinaryFilename) String 

func (f BinaryFilename) String() string

String returns the derived basename, or empty text when invalid.

func (*BinaryFilename) UnmarshalJSON added in v2026.0.55 

func (f *BinaryFilename) UnmarshalJSON(data []byte) error

func (BinaryFilename) Validate 

func (f BinaryFilename) Validate() error

Validate proves canonical derivation characters, length, and zero padding.

type BuildCommand added in v2026.0.11 

type BuildCommand struct {
	// contains filtered or unexported fields
}

BuildCommand is one exact Go invocation for one canonical target.

func (BuildCommand) ArgumentValues added in v2026.0.11 

func (c BuildCommand) ArgumentValues() ([]string, error)

ArgumentValues lowers the validated command to exact Go arguments.

func (BuildCommand) Build added in v2026.0.11 

func (c BuildCommand) Build() core.BuildIdentity

Build returns the immutable build identity.

func (BuildCommand) EnvironmentOverrides added in v2026.0.11 

func (c BuildCommand) EnvironmentOverrides() ([]string, error)

EnvironmentOverrides lowers the target to its hermetic compatibility controls. The executor supplies exact host paths and caches separately.

func (BuildCommand) GoToolchain added in v2026.0.11 

func (c BuildCommand) GoToolchain() GoToolchainIdentity

GoToolchain returns the exact compiler identity required by the command.

func (BuildCommand) LinkerAssignments added in v2026.0.131 

func (c BuildCommand) LinkerAssignments() LinkerAssignments

LinkerAssignments returns the exact product-owned linker mutations the command injected. Inspection must use this set, not an empty reconstruction.

func (BuildCommand) Output added in v2026.0.11 

func (c BuildCommand) Output() core.RelativePath

Output returns the derived artifact path.

func (BuildCommand) Validate added in v2026.0.11 

func (c BuildCommand) Validate() error

Validate proves the command and its derived output filename.

type BuildDependencies added in v2026.0.12 

type BuildDependencies struct {
	// contains filtered or unexported fields
}

BuildDependencies is the fixed, path-sorted union of all four target package closures observed from the verified Go tool before the release build runs.

func ObserveBuildDependencies added in v2026.0.12 

func ObserveBuildDependencies(
	ctx context.Context,
	request BuildDependencyObservationRequest,
) (BuildDependencies, error)

ObserveBuildDependencies streams cmd/go's exact package closure for every canonical target and returns the fixed, path-sorted module union.

func (BuildDependencies) At added in v2026.0.12 

func (d BuildDependencies) At(index int) (BuildDependency, bool)

func (BuildDependencies) Count added in v2026.0.12 

func (d BuildDependencies) Count() int

func (BuildDependencies) GoToolchain added in v2026.0.12 

func (d BuildDependencies) GoToolchain() GoToolchainIdentity

func (BuildDependencies) MainModule added in v2026.0.12 

func (d BuildDependencies) MainModule() GoModulePath

func (BuildDependencies) MarshalJSON added in v2026.0.12 

func (d BuildDependencies) MarshalJSON() ([]byte, error)

MarshalJSON projects the observed closure into the exact customer-visible dependency document. Release owns this projection so every consumer publishes one dependency document shape instead of inventing its own.

func (*BuildDependencies) UnmarshalJSON added in v2026.0.12 

func (d *BuildDependencies) UnmarshalJSON(data []byte) error

UnmarshalJSON reconstructs a published dependency document and re-proves its module bound, distinctness, and canonical order.

func (BuildDependencies) Validate added in v2026.0.12 

func (d BuildDependencies) Validate() error

type BuildDependency added in v2026.0.12 

type BuildDependency struct {
	// contains filtered or unexported fields
}

BuildDependency is one non-main module in the exact package closure.

func (BuildDependency) Path added in v2026.0.12 

func (d BuildDependency) Path() GoModulePath

func (BuildDependency) Sum added in v2026.0.12 

func (d BuildDependency) Sum() GoModuleSum

func (BuildDependency) Validate added in v2026.0.12 

func (d BuildDependency) Validate() error

func (BuildDependency) Version added in v2026.0.12 

func (d BuildDependency) Version() GoModuleVersion

type BuildDependencyObservationRequest added in v2026.0.12 

type BuildDependencyObservationRequest struct {
	Stderr           io.Writer
	WorkingDirectory core.AbsolutePath
	HostEnvironment  process.Environment
	Repository       VerifiedRepository
	Tools            VerifiedBuildTools
	Plan             BuildPlan
	WaitDelay        temporal.Duration
}

BuildDependencyObservationRequest binds dependency observation to the exact verified tool, build plan, target environments, and repository root.

func (BuildDependencyObservationRequest) Validate added in v2026.0.12 

func (r BuildDependencyObservationRequest) Validate() error

type BuildModuleMode added in v2026.0.11 

type BuildModuleMode uint8

BuildModuleMode selects the Go module graph used by one release build. 

const (
	// BuildModuleUnknown is the invalid zero module mode.
	BuildModuleUnknown BuildModuleMode = iota
	// BuildModuleReadonly admits the checked module graph without modifying it.
	BuildModuleReadonly
	// BuildModuleVendor requires the checked vendor projection.
	BuildModuleVendor
)

func (BuildModuleMode) IsValid added in v2026.0.11 

func (m BuildModuleMode) IsValid() bool

IsValid reports membership in the closed module-mode domain.

func (BuildModuleMode) OffWireEnum added in v2026.0.11 

func (BuildModuleMode) OffWireEnum()

OffWireEnum declares BuildModuleMode as local build execution policy.

func (BuildModuleMode) String added in v2026.0.11 

func (m BuildModuleMode) String() string

String returns the exact Go -mod value, or the unknown diagnostic.

func (BuildModuleMode) Validate added in v2026.0.11 

func (m BuildModuleMode) Validate() error

Validate rejects an incomplete or future module mode.

type BuildPlan added in v2026.0.11 

type BuildPlan struct {
	// contains filtered or unexported fields
}

BuildPlan is the exact fixed-target deterministic release build projection.

func PrepareBuildPlan added in v2026.0.11 

func PrepareBuildPlan(request BuildPlanRequest) (BuildPlan, error)

PrepareBuildPlan constructs one command for every canonical release target.

func (BuildPlan) At added in v2026.0.11 

func (p BuildPlan) At(index int) (BuildCommand, bool)

At returns one command in canonical target order.

func (BuildPlan) Validate added in v2026.0.11 

func (p BuildPlan) Validate() error

Validate reconstructs and compares the complete fixed-target projection.

type BuildPlanRequest added in v2026.0.11 

type BuildPlanRequest struct {
	MainPackage       MainPackage
	OutputDirectory   core.RelativePath
	Offering          core.Offering
	LinkerAssignments LinkerAssignments
	BuildTags         BuildTags
	Version           core.ReleaseVersion
	Commit            core.BuildCommit
	GoToolchain       GoToolchainIdentity
	ModuleMode        BuildModuleMode
}

BuildPlanRequest carries every compiler-owned input to the fixed release build.

func (BuildPlanRequest) Validate added in v2026.0.11 

func (r BuildPlanRequest) Validate() error

Validate proves every build-plan boundary input.

type BuildProcessRequest added in v2026.0.11 

type BuildProcessRequest struct {
	Streams          process.Streams
	WorkingDirectory core.AbsolutePath
	HostEnvironment  process.Environment
	Repository       VerifiedRepository
	Tools            VerifiedBuildTools
	Command          BuildCommand
	OutputLimit      core.ByteCount
	WaitDelay        temporal.Duration
}

BuildProcessRequest supplies host execution facts around one exact build command. HostEnvironment must be exact; ambient inheritance is never a release input.

func (BuildProcessRequest) Validate added in v2026.0.11 

func (r BuildProcessRequest) Validate() error

Validate proves every host and command fact before process lowering.

type BuildProvenance added in v2026.0.11 

type BuildProvenance struct {
	// contains filtered or unexported fields
}

func NewBuildProvenance added in v2026.0.11 

func NewBuildProvenance(request BuildProvenanceRequest) (BuildProvenance, error)

func (BuildProvenance) MarshalJSON added in v2026.0.11 

func (p BuildProvenance) MarshalJSON() ([]byte, error)

func (*BuildProvenance) UnmarshalJSON added in v2026.0.11 

func (p *BuildProvenance) UnmarshalJSON(data []byte) error

func (BuildProvenance) Validate added in v2026.0.11 

func (p BuildProvenance) Validate() error

Validate accepts every explicitly admitted historical Go toolchain. Construction separately pins new builds to the current toolchain; reading a signed older manifest must not consult that selector.

type BuildProvenanceRequest added in v2026.0.11 

type BuildProvenanceRequest struct {
	Tools VerifiedBuildTools
	Plan  BuildPlan
}

BuildProvenanceRequest binds public reproducibility facts to one exact plan and one verified Go executable.

func (BuildProvenanceRequest) Validate added in v2026.0.11 

func (r BuildProvenanceRequest) Validate() error

type BuildTag added in v2026.0.12 

type BuildTag struct {
	// contains filtered or unexported fields
}

BuildTag is one bounded Go build constraint admitted into a release build.

func ParseBuildTag added in v2026.0.12 

func ParseBuildTag(value string) (BuildTag, error)

ParseBuildTag validates one Go build-constraint identifier.

func (BuildTag) String added in v2026.0.12 

func (t BuildTag) String() string

String returns the canonical constraint word, or empty text when invalid.

func (BuildTag) Validate added in v2026.0.12 

func (t BuildTag) Validate() error

Validate rejects an unset or noncanonical build tag.

type BuildTags added in v2026.0.12 

type BuildTags struct {
	// contains filtered or unexported fields
}

BuildTags is a bounded, tag-sorted, distinct set of build constraints.

func NewBuildTags added in v2026.0.12 

func NewBuildTags(values []BuildTag) (BuildTags, error)

NewBuildTags validates, sorts, and rejects duplicate build tags.

func (BuildTags) Argument added in v2026.0.12 

func (s BuildTags) Argument() (string, error)

Argument returns the exact -tags argument for a nonempty set and empty text for the empty set. The empty set is cmd/go's own default constraint state, which is not the same request as an empty -tags list.

func (BuildTags) At added in v2026.0.12 

func (s BuildTags) At(index int) (BuildTag, bool)

At returns one validated build tag in ascending order.

func (BuildTags) Count added in v2026.0.12 

func (s BuildTags) Count() int

Count returns the number of admitted build tags.

func (BuildTags) Validate added in v2026.0.12 

func (s BuildTags) Validate() error

Validate proves canonical ordering, uniqueness, count, and zero padding.

type BuildToolVerificationRequest added in v2026.0.11 

type BuildToolVerificationRequest struct {
	GoExecutable     core.AbsolutePath
	WorkingDirectory core.AbsolutePath
	HostEnvironment  process.Environment
	WaitDelay        temporal.Duration
}

BuildToolVerificationRequest identifies the exact local executables and bounded process conditions used to prove them.

func (BuildToolVerificationRequest) Validate added in v2026.0.11 

func (r BuildToolVerificationRequest) Validate() error

Validate proves the complete verification boundary before file or process I/O.

type CachedLatest 

type CachedLatest struct {
	// contains filtered or unexported fields
}

CachedLatest is the explicit optional cache input.

func MissingCachedLatest 

func MissingCachedLatest() CachedLatest

func NewCachedLatest 

func NewCachedLatest(latest VerifiedLatest) (CachedLatest, error)

func (CachedLatest) Validate 

func (c CachedLatest) Validate() error

type CachedLatestState 

type CachedLatestState uint8

CachedLatestState distinguishes explicit absence from an authenticated cached selection. 

const (
	CachedLatestUnknown CachedLatestState = iota
	CachedLatestMissing
	CachedLatestPresent
)

func (CachedLatestState) IsValid 

func (s CachedLatestState) IsValid() bool

func (CachedLatestState) OffWireEnum 

func (CachedLatestState) OffWireEnum()

func (CachedLatestState) String 

func (s CachedLatestState) String() string

String returns a stable diagnostic label.

func (CachedLatestState) Validate 

func (s CachedLatestState) Validate() error

type CurrentRelease 

type CurrentRelease struct {
	// contains filtered or unexported fields
}

CurrentRelease proves the installed immutable release remains selected.

func (CurrentRelease) Summary 

func (c CurrentRelease) Summary() (CurrentSummary, error)

Summary returns a validated value copy without installation authority.

func (CurrentRelease) Validate 

func (c CurrentRelease) Validate() error

type CurrentSummary 

type CurrentSummary struct {
	ValidUntil temporal.Instant
	Version    core.ReleaseVersion
	Manifest   ManifestIdentity
	Artifact   ArtifactIdentity
}

CurrentSummary is the non-authoritative value projection of a current selection.

func (CurrentSummary) Validate 

func (s CurrentSummary) Validate() error

Validate proves every projected current-release fact.

type Domain 

type Domain uint8

Domain is the closed Attest domain for Release documents. 

const (
	DomainUnknown Domain = iota
	DomainManifestV1
	DomainLatestV1
)

func (Domain) IsValid 

func (d Domain) IsValid() bool

func (Domain) MarshalText 

func (d Domain) MarshalText() ([]byte, error)

func (Domain) OffWireEnum 

func (Domain) OffWireEnum()

func (Domain) ParseCanonicalText 

func (Domain) ParseCanonicalText(text []byte) (Domain, error)

func (Domain) String 

func (d Domain) String() string

func (Domain) Validate 

func (d Domain) Validate() error

type EvaluateInstalledRequest added in v2026.0.126 

type EvaluateInstalledRequest struct {
	Installed core.BuildIdentity
	Evaluate  EvaluateRequest
}

EvaluateInstalledRequest binds one authenticated latest cache to one already-known installed identity. It is the only public way to produce a PreparedRelease for an installation that is not the running binary.

func (EvaluateInstalledRequest) Validate added in v2026.0.126 

func (r EvaluateInstalledRequest) Validate() error

type EvaluateRequest 

type EvaluateRequest struct {
	InstalledManifest VerifiedManifest
	Latest            CachedLatest
	Observation       temporal.Instant
}

func (EvaluateRequest) Validate 

func (r EvaluateRequest) Validate() error

Validate proves the complete installed-selection ingress.

type Generation 

type Generation struct {
	// contains filtered or unexported fields
}

Generation is a positive monotonic Latest generation.

func NewGeneration 

func NewGeneration(value uint64) (Generation, error)

func (Generation) MarshalJSON 

func (g Generation) MarshalJSON() ([]byte, error)

func (Generation) Uint64 

func (g Generation) Uint64() uint64

func (*Generation) UnmarshalJSON 

func (g *Generation) UnmarshalJSON(data []byte) error

func (Generation) Validate 

func (g Generation) Validate() error

type GoModulePath added in v2026.0.12 

type GoModulePath struct {
	// contains filtered or unexported fields
}

GoModulePath is one bounded canonical module path observed from cmd/go.

func (GoModulePath) String added in v2026.0.12 

func (p GoModulePath) String() string

func (GoModulePath) Validate added in v2026.0.12 

func (p GoModulePath) Validate() error

type GoModuleSum added in v2026.0.12 

type GoModuleSum struct {
	// contains filtered or unexported fields
}

GoModuleSum is one exact h1 module-content checksum.

func (GoModuleSum) String added in v2026.0.12 

func (s GoModuleSum) String() string

func (GoModuleSum) Validate added in v2026.0.12 

func (s GoModuleSum) Validate() error

type GoModuleVersion added in v2026.0.12 

type GoModuleVersion struct {
	// contains filtered or unexported fields
}

GoModuleVersion is one bounded cmd/go module-version token.

func (GoModuleVersion) String added in v2026.0.12 

func (v GoModuleVersion) String() string

func (GoModuleVersion) Validate added in v2026.0.12 

func (v GoModuleVersion) Validate() error

type GoToolchainIdentity added in v2026.0.11 

type GoToolchainIdentity uint8

GoToolchainIdentity is the closed set of compilers admitted for release construction. Exact compiler identity is retained outside stripped binaries. 

const (
	// GoToolchainUnknown is the invalid zero compiler identity.
	GoToolchainUnknown GoToolchainIdentity = iota
	// GoToolchainPrimitive2026 identifies the exact reviewed Go 1.27.0 toolchain.
	GoToolchainPrimitive2026
)

func CurrentGoToolchain added in v2026.0.11 

func CurrentGoToolchain() GoToolchainIdentity

CurrentGoToolchain returns the compiler identity pinned for Primitive 2026 release construction.

func (GoToolchainIdentity) IsValid added in v2026.0.11 

func (i GoToolchainIdentity) IsValid() bool

IsValid reports membership in the reviewed compiler domain.

func (GoToolchainIdentity) OffWireEnum added in v2026.0.11 

func (GoToolchainIdentity) OffWireEnum()

OffWireEnum declares GoToolchainIdentity as reviewed execution policy.

func (GoToolchainIdentity) String added in v2026.0.11 

func (i GoToolchainIdentity) String() string

String returns the compiler-owned diagnostic label.

func (GoToolchainIdentity) Validate added in v2026.0.11 

func (i GoToolchainIdentity) Validate() error

Validate rejects compiler identities outside the reviewed closed domain.

func (GoToolchainIdentity) Version added in v2026.0.11 

func (i GoToolchainIdentity) Version() (string, error)

Version returns the exact output token required from go version.

type IssueLatestRequest 

type IssueLatestRequest struct {
	Key        ed25519.PrivateKey
	Manifest   VerifiedManifest
	IssuedAt   temporal.Instant
	ValidFrom  temporal.Instant
	ValidUntil temporal.Instant
	Generation Generation
}

func (IssueLatestRequest) Validate 

func (r IssueLatestRequest) Validate() error

Validate proves the complete signed Latest request, delegating signing-key custody to Attest after assembling the exact body Release owns.

type IssueManifestRequest 

type IssueManifestRequest struct {
	Signer crypto.Signer
	Fact   ManifestFact
}

func (IssueManifestRequest) Validate 

func (r IssueManifestRequest) Validate() error

Validate delegates signing-key custody and body validation to Attest.

type LatestAdvance 

type LatestAdvance struct {
	// contains filtered or unexported fields
}

func AdvanceLatest 

func AdvanceLatest(request AdvanceLatestRequest) (LatestAdvance, error)

func (LatestAdvance) State 

func (a LatestAdvance) State() LatestAdvanceState

func (LatestAdvance) Validate 

func (a LatestAdvance) Validate() error

type LatestAdvanceState 

type LatestAdvanceState uint8

LatestAdvanceState is the complete successful advance result domain. 

const (
	LatestAdvanceUnknown LatestAdvanceState = iota
	LatestAdvanceReplay
	LatestAdvanceAdvanced
)

func (LatestAdvanceState) IsValid 

func (s LatestAdvanceState) IsValid() bool

func (LatestAdvanceState) OffWireEnum 

func (LatestAdvanceState) OffWireEnum()

func (LatestAdvanceState) String 

func (s LatestAdvanceState) String() string

String returns a stable diagnostic label.

func (LatestAdvanceState) Validate 

func (s LatestAdvanceState) Validate() error

type LatestAssessment 

type LatestAssessment struct {
	// contains filtered or unexported fields
}

LatestAssessment is a closed, value-copy freshness projection.

func AssessLatest 

func AssessLatest(request AssessLatestRequest) (LatestAssessment, error)

func (LatestAssessment) Boundary 

func (a LatestAssessment) Boundary() (temporal.Instant, bool)

func (LatestAssessment) ClockState 

func (a LatestAssessment) ClockState() LatestClockState

func (LatestAssessment) EffectiveAt 

func (a LatestAssessment) EffectiveAt() temporal.Instant

func (LatestAssessment) Freshness 

func (a LatestAssessment) Freshness() LatestFreshness

func (LatestAssessment) ValidUntil 

func (a LatestAssessment) ValidUntil() temporal.Instant

func (LatestAssessment) Validate 

func (a LatestAssessment) Validate() error

type LatestClockState 

type LatestClockState uint8

LatestClockState records whether the signed issue floor corrected a local observation. 

const (
	LatestClockUnknown LatestClockState = iota
	LatestClockObserved
	LatestClockCorrected
)

func (LatestClockState) IsValid 

func (s LatestClockState) IsValid() bool

func (LatestClockState) OffWireEnum 

func (LatestClockState) OffWireEnum()

func (LatestClockState) String 

func (s LatestClockState) String() string

String returns a stable diagnostic label.

func (LatestClockState) Validate 

func (s LatestClockState) Validate() error

type LatestDocument 

type LatestDocument struct {
	Fact        LatestFact              `json:"fact"`
	Attestation attest.Envelope[Domain] `json:"attestation"`
}

LatestDocument is one untrusted Latest fact and structural Attest envelope.

func IssueLatest 

func IssueLatest(request IssueLatestRequest) (LatestDocument, error)

func (LatestDocument) MarshalJSON 

func (d LatestDocument) MarshalJSON() ([]byte, error)

func (*LatestDocument) UnmarshalJSON 

func (d *LatestDocument) UnmarshalJSON(data []byte) error

func (LatestDocument) Validate 

func (d LatestDocument) Validate() error

type LatestFact 

type LatestFact struct {
	// contains filtered or unexported fields
}

LatestFact is the immutable canonical release-selection body.

func (LatestFact) AttestationDomain 

func (LatestFact) AttestationDomain() Domain

func (LatestFact) Generation 

func (f LatestFact) Generation() Generation

func (LatestFact) Identity 

func (f LatestFact) Identity() LatestIdentity

func (LatestFact) IssuedAt 

func (f LatestFact) IssuedAt() temporal.Instant

func (LatestFact) Manifest 

func (f LatestFact) Manifest() ManifestDocument

func (LatestFact) MarshalJSON 

func (f LatestFact) MarshalJSON() ([]byte, error)

func (LatestFact) Offering 

func (f LatestFact) Offering() core.Offering

func (LatestFact) Revision 

func (f LatestFact) Revision() Revision

func (*LatestFact) UnmarshalJSON 

func (f *LatestFact) UnmarshalJSON(data []byte) error

func (LatestFact) ValidFrom 

func (f LatestFact) ValidFrom() temporal.Instant

func (LatestFact) ValidUntil 

func (f LatestFact) ValidUntil() temporal.Instant

func (LatestFact) Validate 

func (f LatestFact) Validate() error

func (LatestFact) WriteCanonical 

func (f LatestFact) WriteCanonical(destination io.Writer) error

type LatestFreshness 

type LatestFreshness uint8

LatestFreshness classifies a verified Latest at one observation. 

const (
	LatestFreshnessUnknown LatestFreshness = iota
	LatestFreshnessNotYetValid
	LatestFreshnessCurrent
	LatestFreshnessExpired
)

func (LatestFreshness) IsValid 

func (f LatestFreshness) IsValid() bool

func (LatestFreshness) OffWireEnum 

func (LatestFreshness) OffWireEnum()

func (LatestFreshness) String 

func (f LatestFreshness) String() string

String returns a stable diagnostic label.

func (LatestFreshness) Validate 

func (f LatestFreshness) Validate() error

type LatestIdentity 

type LatestIdentity struct {
	// contains filtered or unexported fields
}

LatestIdentity names the stable selection stream for one offering.

func (LatestIdentity) MarshalJSON 

func (i LatestIdentity) MarshalJSON() ([]byte, error)

func (LatestIdentity) String 

func (i LatestIdentity) String() string

func (*LatestIdentity) UnmarshalJSON 

func (i *LatestIdentity) UnmarshalJSON(data []byte) error

func (LatestIdentity) Validate 

func (i LatestIdentity) Validate() error

type LinkerAssignment added in v2026.0.11 

type LinkerAssignment struct {
	// contains filtered or unexported fields
}

LinkerAssignment is one bounded Go linker -X symbol/value pair.

func NewLinkerAssignment added in v2026.0.11 

func NewLinkerAssignment(symbol, value string) (LinkerAssignment, error)

NewLinkerAssignment constructs one product-owned linker assignment.

func (LinkerAssignment) Symbol added in v2026.0.11 

func (a LinkerAssignment) Symbol() string

Symbol returns the validated linker symbol.

func (LinkerAssignment) Validate added in v2026.0.11 

func (a LinkerAssignment) Validate() error

Validate proves symbol grammar, value bounds, and Primitive symbol ownership.

func (LinkerAssignment) Value added in v2026.0.11 

func (a LinkerAssignment) Value() string

Value returns the validated linker value.

type LinkerAssignments added in v2026.0.11 

type LinkerAssignments struct {
	// contains filtered or unexported fields
}

LinkerAssignments is a bounded, symbol-sorted set of linker assignments.

func NewLinkerAssignments added in v2026.0.11 

func NewLinkerAssignments(values []LinkerAssignment) (LinkerAssignments, error)

NewLinkerAssignments validates, sorts, and rejects duplicate symbols.

func (LinkerAssignments) At added in v2026.0.11 

func (s LinkerAssignments) At(index int) (LinkerAssignment, bool)

At returns one validated assignment by ascending symbol order.

func (LinkerAssignments) Validate added in v2026.0.11 

func (s LinkerAssignments) Validate() error

Validate proves canonical ordering, uniqueness, count, and zero padding.

type MainPackage added in v2026.0.11 

type MainPackage struct {
	// contains filtered or unexported fields
}

MainPackage is one bounded canonical Go import path naming a release main.

func ParseMainPackage added in v2026.0.11 

func ParseMainPackage(value string) (MainPackage, error)

ParseMainPackage validates one canonical Go import path.

func (MainPackage) String added in v2026.0.11 

func (p MainPackage) String() string

String returns the canonical import path, or empty text when invalid.

func (MainPackage) Validate added in v2026.0.11 

func (p MainPackage) Validate() error

Validate rejects an unset or noncanonical main package.

type ManifestDocument 

type ManifestDocument struct {
	Fact        ManifestFact            `json:"fact"`
	Attestation attest.Envelope[Domain] `json:"attestation"`
}

ManifestDocument is an untrusted fact and structural Attest envelope.

func IssueManifest 

func IssueManifest(request IssueManifestRequest) (ManifestDocument, error)

func (ManifestDocument) MarshalJSON 

func (d ManifestDocument) MarshalJSON() ([]byte, error)

func (*ManifestDocument) UnmarshalJSON 

func (d *ManifestDocument) UnmarshalJSON(data []byte) error

func (ManifestDocument) Validate 

func (d ManifestDocument) Validate() error

type ManifestDocumentDigest 

type ManifestDocumentDigest struct {
	// contains filtered or unexported fields
}

ManifestDocumentDigest names exact canonical document bytes, including the signer and signature.

func (ManifestDocumentDigest) MarshalJSON added in v2026.0.55 

func (d ManifestDocumentDigest) MarshalJSON() ([]byte, error)

func (ManifestDocumentDigest) SHA256 added in v2026.0.11 

func (d ManifestDocumentDigest) SHA256() core.SHA256Digest

SHA256 returns the exact authenticated manifest-document digest.

func (ManifestDocumentDigest) String 

func (d ManifestDocumentDigest) String() string

func (*ManifestDocumentDigest) UnmarshalJSON added in v2026.0.55 

func (d *ManifestDocumentDigest) UnmarshalJSON(data []byte) error

func (ManifestDocumentDigest) Validate 

func (d ManifestDocumentDigest) Validate() error

type ManifestFact 

type ManifestFact struct {
	// contains filtered or unexported fields
}

ManifestFact is the immutable canonical body authenticated by Attest.

func NewManifestFact 

func NewManifestFact(request ManifestFactRequest) (ManifestFact, error)

func (ManifestFact) Artifacts 

func (f ManifestFact) Artifacts() ArtifactSet

func (ManifestFact) AttestationDomain 

func (ManifestFact) AttestationDomain() Domain

func (ManifestFact) Commit 

func (f ManifestFact) Commit() core.BuildCommit

func (ManifestFact) CreatedAt 

func (f ManifestFact) CreatedAt() temporal.Instant

func (ManifestFact) Identity 

func (f ManifestFact) Identity() ManifestIdentity

func (ManifestFact) MarshalJSON 

func (f ManifestFact) MarshalJSON() ([]byte, error)

func (ManifestFact) Metadata added in v2026.0.11 

func (f ManifestFact) Metadata() MetadataSet

func (ManifestFact) Offering 

func (f ManifestFact) Offering() core.Offering

func (ManifestFact) Provenance added in v2026.0.11 

func (f ManifestFact) Provenance() BuildProvenance

func (ManifestFact) Revision 

func (f ManifestFact) Revision() Revision

func (ManifestFact) TotalExtent 

func (f ManifestFact) TotalExtent() core.ByteCount

func (*ManifestFact) UnmarshalJSON 

func (f *ManifestFact) UnmarshalJSON(data []byte) error

func (ManifestFact) Validate 

func (f ManifestFact) Validate() error

func (ManifestFact) Version 

func (f ManifestFact) Version() core.ReleaseVersion

func (ManifestFact) WriteCanonical 

func (f ManifestFact) WriteCanonical(destination io.Writer) error

type ManifestFactRequest 

type ManifestFactRequest struct {
	Offering   core.Offering
	Provenance BuildProvenance
	Artifacts  ArtifactSet
	Metadata   MetadataSet
	CreatedAt  temporal.Instant
	Version    core.ReleaseVersion
	Commit     core.BuildCommit
	Revision   Revision
}

ManifestFactRequest supplies the facts an artifact producer asks a manifest authority to sign.

func (ManifestFactRequest) Validate 

func (r ManifestFactRequest) Validate() error

Validate proves every manifest fact and its artifact/build bindings before identity derivation.

type ManifestIdentity 

type ManifestIdentity struct {
	// contains filtered or unexported fields
}

ManifestIdentity is the nominal digest of one manifest's signed facts.

func (ManifestIdentity) MarshalJSON 

func (i ManifestIdentity) MarshalJSON() ([]byte, error)

func (ManifestIdentity) String 

func (i ManifestIdentity) String() string

func (*ManifestIdentity) UnmarshalJSON 

func (i *ManifestIdentity) UnmarshalJSON(data []byte) error

func (ManifestIdentity) Validate 

func (i ManifestIdentity) Validate() error

type Material added in v2026.0.86 

type Material struct {
	SigningKey      keygen.SigningKey
	ServerPublicKey core.Ed25519PublicKey
}

func (*Material) Destroy added in v2026.0.86 

func (m *Material) Destroy() error

func (Material) Format added in v2026.0.86 

func (Material) Format(state fmt.State, _ rune)

func (Material) Validate added in v2026.0.86 

func (m Material) Validate() error

type MaterialRequest added in v2026.0.86 

type MaterialRequest struct {
	Primitive ProjectVersion           `json:"primitive"`
	Offering  core.Offering            `json:"offering"`
	Version   core.ReleaseVersion      `json:"version"`
	Commit    core.BuildCommit         `json:"commit"`
	Nonce     controlwire.RequestNonce `json:"nonce"`
	Revision  controlwire.Revision     `json:"revision"`
}

MaterialRequest asks a release authority for the exact secret capabilities needed to build and publish one offering at one commit. The authenticated transport is deliberately outside this fact: Cloudidentity and Exchange own that execution on both sides.

func NewMaterialRequest added in v2026.0.86 

func NewMaterialRequest(input MaterialRequestInput) (MaterialRequest, error)

func (MaterialRequest) ControlNonce added in v2026.0.96 

func (r MaterialRequest) ControlNonce() controlwire.RequestNonce

ControlNonce projects the request identity carried by the document.

func (MaterialRequest) ControlRequestBodyLimit added in v2026.0.96 

func (MaterialRequest) ControlRequestBodyLimit() (core.ByteCount, error)

func (MaterialRequest) ControlRevision added in v2026.0.96 

func (r MaterialRequest) ControlRevision() controlwire.Revision

ControlRevision projects the exact revision carried by this request.

func (MaterialRequest) ControlRoute added in v2026.0.96 

func (r MaterialRequest) ControlRoute() (controlwire.RouteContract, error)

ControlRoute projects the sole route admitted by this release request.

func (MaterialRequest) MarshalJSON added in v2026.0.86 

func (r MaterialRequest) MarshalJSON() ([]byte, error)

func (*MaterialRequest) UnmarshalJSON added in v2026.0.86 

func (r *MaterialRequest) UnmarshalJSON(data []byte) error

func (MaterialRequest) Validate added in v2026.0.86 

func (r MaterialRequest) Validate() error

type MaterialRequestInput added in v2026.0.86 

type MaterialRequestInput struct {
	Offering core.Offering
	Version  core.ReleaseVersion
	Commit   core.BuildCommit
	Nonce    controlwire.RequestNonce
}

type MaterialResponse added in v2026.0.86 

type MaterialResponse struct {
	ReleaseSigningSeed ReleaseSigningSeed    `json:"release_signing_seed"`
	Request            MaterialRequest       `json:"request"`
	ServerPublicKey    core.Ed25519PublicKey `json:"server_public_key"`
}

func (*MaterialResponse) Destroy added in v2026.0.97 

func (r *MaterialResponse) Destroy() error

Destroy clears the response seed and invalidates every copied handle.

func (MaterialResponse) Format added in v2026.0.97 

func (MaterialResponse) Format(state fmt.State, _ rune)

Format redacts the unopened response because it carries both secret seeds.

func (MaterialResponse) MarshalJSON added in v2026.0.86 

func (r MaterialResponse) MarshalJSON() ([]byte, error)

func (*MaterialResponse) Open added in v2026.0.86 

func (r *MaterialResponse) Open() (Material, error)

Open consumes one material response into the longer-lived typed capabilities. The response seeds are destroyed on every terminal path.

func (*MaterialResponse) UnmarshalJSON added in v2026.0.86 

func (r *MaterialResponse) UnmarshalJSON(data []byte) error

func (MaterialResponse) Validate added in v2026.0.86 

func (r MaterialResponse) Validate() error

type MetadataAsset added in v2026.0.11 

type MetadataAsset struct {
	// contains filtered or unexported fields
}

MetadataAsset is one immutable dependency, documentation, or release-note object. Filename and media type are derived from its closed role.

func InspectMetadataAsset added in v2026.0.11 

func InspectMetadataAsset(request MetadataInspectionRequest) (MetadataAsset, error)

InspectMetadataAsset streams one exact metadata object through SHA-256 and CRC32C without retaining its bytes.

func NewMetadataAsset added in v2026.0.11 

func NewMetadataAsset(request MetadataAssetRequest) (MetadataAsset, error)

func (MetadataAsset) ContentType added in v2026.0.11 

func (a MetadataAsset) ContentType() (core.HTTPMediaType, error)

func (MetadataAsset) Filename added in v2026.0.11 

func (a MetadataAsset) Filename(
	offering core.Offering,
	version core.ReleaseVersion,
) (BinaryFilename, error)

func (MetadataAsset) Integrity added in v2026.0.11 

func (a MetadataAsset) Integrity() ArtifactIntegrity

func (MetadataAsset) Kind added in v2026.0.11 

func (a MetadataAsset) Kind() MetadataKind

func (MetadataAsset) MarshalJSON added in v2026.0.11 

func (a MetadataAsset) MarshalJSON() ([]byte, error)

func (*MetadataAsset) UnmarshalJSON added in v2026.0.11 

func (a *MetadataAsset) UnmarshalJSON(data []byte) error

func (MetadataAsset) Validate added in v2026.0.11 

func (a MetadataAsset) Validate() error

type MetadataAssetRequest added in v2026.0.11 

type MetadataAssetRequest struct {
	Extent core.ByteCount
	SHA256 core.SHA256Digest
	CRC32C core.CRC32C
	Kind   MetadataKind
}

MetadataAssetRequest supplies integrity for one compiler-owned metadata role.

func (MetadataAssetRequest) Validate added in v2026.0.11 

func (r MetadataAssetRequest) Validate() error

type MetadataInspectionRequest added in v2026.0.11 

type MetadataInspectionRequest struct {
	Source io.ReaderAt
	Extent core.ByteCount
	Kind   MetadataKind
}

MetadataInspectionRequest supplies one bounded metadata stream. The exact extent is proved against the source before an immutable asset is returned.

func (MetadataInspectionRequest) Validate added in v2026.0.11 

func (r MetadataInspectionRequest) Validate() error

type MetadataKind added in v2026.0.11 

type MetadataKind uint8

MetadataKind is the closed set of customer-visible release metadata. 

const (
	MetadataKindUnknown MetadataKind = iota
	MetadataKindDependencies
	MetadataKindDocumentation
	MetadataKindReleaseNotes
)

func (MetadataKind) IsValid added in v2026.0.11 

func (k MetadataKind) IsValid() bool

func (MetadataKind) MarshalJSON added in v2026.0.11 

func (k MetadataKind) MarshalJSON() ([]byte, error)

func (MetadataKind) OffWireEnum added in v2026.0.11 

func (MetadataKind) OffWireEnum()

func (MetadataKind) String added in v2026.0.11 

func (k MetadataKind) String() string

func (*MetadataKind) UnmarshalJSON added in v2026.0.11 

func (k *MetadataKind) UnmarshalJSON(data []byte) error

func (MetadataKind) Validate added in v2026.0.11 

func (k MetadataKind) Validate() error

type MetadataSet added in v2026.0.11 

type MetadataSet struct {
	// contains filtered or unexported fields
}

MetadataSet is fixed storage for one asset per metadata role.

func NewMetadataSet added in v2026.0.11 

func NewMetadataSet(request MetadataSetRequest) (MetadataSet, error)

func (MetadataSet) At added in v2026.0.11 

func (s MetadataSet) At(index int) (MetadataAsset, bool)

func (MetadataSet) MarshalJSON added in v2026.0.11 

func (s MetadataSet) MarshalJSON() ([]byte, error)

func (*MetadataSet) UnmarshalJSON added in v2026.0.11 

func (s *MetadataSet) UnmarshalJSON(data []byte) error

func (MetadataSet) Validate added in v2026.0.11 

func (s MetadataSet) Validate() error

type MetadataSetRequest added in v2026.0.11 

type MetadataSetRequest struct {
	Assets [MetadataAssetCount]MetadataAsset
}

MetadataSetRequest supplies the exact ordered metadata slots.

func (MetadataSetRequest) Validate added in v2026.0.11 

func (r MetadataSetRequest) Validate() error

type OfferingMismatchError 

type OfferingMismatchError struct {
	// contains filtered or unexported fields
}

OfferingMismatchError carries the exact observed and expected offering facts when authenticated Release input names the wrong stream.

func (OfferingMismatchError) Error 

func (e OfferingMismatchError) Error() string

Error returns the operator-facing offering contradiction.

func (OfferingMismatchError) Expected 

func (e OfferingMismatchError) Expected() core.Offering

Expected returns the caller-selected offering.

func (OfferingMismatchError) Observed 

func (e OfferingMismatchError) Observed() core.Offering

Observed returns the offering carried by the authenticated document.

func (OfferingMismatchError) Unwrap 

func (OfferingMismatchError) Unwrap() error

Unwrap preserves the stable Release verification identity.

func (OfferingMismatchError) Validate 

func (e OfferingMismatchError) Validate() error

Validate proves both offerings and their contradiction.

type PackageCapability added in v2026.0.11 

type PackageCapability uint8

PackageCapability is the compiler-visible domain used by Witness to prove that this package deliberately owns a process execution boundary. 

const (
	PackageCapabilityUnknown PackageCapability = iota
	PackageCapabilityProcessExecution
)

func (PackageCapability) IsValid added in v2026.0.11 

func (c PackageCapability) IsValid() bool

func (PackageCapability) OffWireEnum added in v2026.0.11 

func (PackageCapability) OffWireEnum()

func (PackageCapability) String added in v2026.0.11 

func (c PackageCapability) String() string

func (PackageCapability) Validate added in v2026.0.11 

func (c PackageCapability) Validate() error

type Preparation 

type Preparation struct {
	// contains filtered or unexported fields
}

Preparation is a validated ready/refresh/reassess union.

func (Preparation) Ready 

func (p Preparation) Ready() (PreparedRelease, bool)

func (Preparation) Reassess 

func (p Preparation) Reassess() (ReassessDirective, bool)

func (Preparation) Refresh 

func (p Preparation) Refresh() (RefreshDirective, bool)

func (Preparation) Validate 

func (p Preparation) Validate() error

type PreparedRelease 

type PreparedRelease struct {
	// contains filtered or unexported fields
}

PreparedRelease is the authenticated handoff consumed by Upgrade.

func (PreparedRelease) Artifact 

func (p PreparedRelease) Artifact() (Artifact, error)

func (PreparedRelease) Assessment 

func (p PreparedRelease) Assessment() (LatestAssessment, error)

Assessment returns the exact freshness proof at Observation.

func (PreparedRelease) CandidateManifest 

func (p PreparedRelease) CandidateManifest() (VerifiedManifest, error)

func (PreparedRelease) InstalledManifest 

func (p PreparedRelease) InstalledManifest() (VerifiedManifest, error)

InstalledManifest returns the exact authenticated installed manifest.

func (PreparedRelease) Latest 

func (p PreparedRelease) Latest() (VerifiedLatest, error)

Latest returns the exact authenticated selection that authorized preparation.

func (PreparedRelease) Observation 

func (p PreparedRelease) Observation() (temporal.Instant, error)

Observation returns the exact observation used for final freshness proof.

func (PreparedRelease) Summary added in v2026.0.55 

func (p PreparedRelease) Summary() (AvailableSummary, error)

Summary returns the same non-authoritative candidate projection exposed by selection, derived from the authenticated handoff consumed by Upgrade.

func (PreparedRelease) Validate 

func (p PreparedRelease) Validate() error

type ProjectVersion added in v2026.0.55 

type ProjectVersion string

ProjectVersion is the exact current Primitive Git tag. Its closed domain has one member so no caller can invent a second current-version authority. 

const PrimitiveVersion ProjectVersion = "v2026.0.143"

PrimitiveVersion is the single compiler-owned Primitive project and Git release version. Publication derives the Git tag from this value directly.

func ParseProjectVersion added in v2026.0.55 

func ParseProjectVersion(value string) (ProjectVersion, error)

ParseProjectVersion admits only the exact current compiler-owned tag.

func (ProjectVersion) ReleaseVersion added in v2026.0.55 

func (v ProjectVersion) ReleaseVersion() (core.ReleaseVersion, error)

ReleaseVersion projects the current tag into the typed version embedded in release manifests and build identities.

func (ProjectVersion) String added in v2026.0.55 

func (v ProjectVersion) String() string

String returns the exact Git tag or empty text for an invalid value.

func (ProjectVersion) Validate added in v2026.0.55 

func (v ProjectVersion) Validate() error

Validate accepts only the one current compiler-owned tag and proves its suffix through Core's release-version parser.

type PublicationRole added in v2026.0.55 

type PublicationRole uint8

PublicationRole is the closed canonical order of objects in one release publication. Release owns the order because both the distribution agreement and the deployment effect must bind the same manifest slots. 

const (
	PublicationRoleUnknown PublicationRole = iota
	PublicationRoleWindowsAMD64
	PublicationRoleDarwinARM64
	PublicationRoleLinuxAMD64
	PublicationRoleLinuxARM64
	PublicationRoleManifest
	PublicationRoleDependencies
	PublicationRoleDocumentation
	PublicationRoleReleaseNotes
)

func PublicationRoleAt added in v2026.0.55 

func PublicationRoleAt(index int) (PublicationRole, bool)

PublicationRoleAt returns the role occupying one fixed publication slot.

func (PublicationRole) Index added in v2026.0.55 

func (r PublicationRole) Index() (int, error)

Index returns the fixed zero-based publication slot owned by Release.

func (PublicationRole) IsValid added in v2026.0.55 

func (r PublicationRole) IsValid() bool

IsValid reports membership in the closed publication-role domain.

func (PublicationRole) MarshalJSON added in v2026.0.55 

func (r PublicationRole) MarshalJSON() ([]byte, error)

MarshalJSON emits the canonical role token.

func (PublicationRole) String added in v2026.0.55 

func (r PublicationRole) String() string

String returns the canonical role label or Core's unknown diagnostic.

func (*PublicationRole) UnmarshalJSON added in v2026.0.55 

func (r *PublicationRole) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts only one exact canonical role token without mutating the receiver on rejection.

func (PublicationRole) Validate added in v2026.0.55 

func (r PublicationRole) Validate() error

Validate rejects the unset role and every value outside the complete publication order.

type ReassessDirective 

type ReassessDirective struct {
	At temporal.Instant
}

func (ReassessDirective) Validate 

func (d ReassessDirective) Validate() error

type RefreshDirective 

type RefreshDirective struct {
	// contains filtered or unexported fields
}

func (RefreshDirective) Validate 

func (d RefreshDirective) Validate() error

type ReleaseSigningSeed added in v2026.0.86 

type ReleaseSigningSeed struct {
	// contains filtered or unexported fields
}

func NewReleaseSigningSeed added in v2026.0.86 

func NewReleaseSigningSeed(value [keygen.SeedSize]byte) (ReleaseSigningSeed, error)

func (ReleaseSigningSeed) Destroy added in v2026.0.97 

func (s ReleaseSigningSeed) Destroy() error

Destroy clears the release-signing seed and invalidates every copied handle.

func (ReleaseSigningSeed) Format added in v2026.0.86 

func (ReleaseSigningSeed) Format(state fmt.State, _ rune)

func (ReleaseSigningSeed) MarshalJSON added in v2026.0.86 

func (s ReleaseSigningSeed) MarshalJSON() ([]byte, error)

func (ReleaseSigningSeed) SigningKey added in v2026.0.86 

func (s ReleaseSigningSeed) SigningKey() (keygen.SigningKey, error)

func (*ReleaseSigningSeed) UnmarshalJSON added in v2026.0.86 

func (s *ReleaseSigningSeed) UnmarshalJSON(data []byte) error

func (ReleaseSigningSeed) Validate added in v2026.0.86 

func (s ReleaseSigningSeed) Validate() error

type RepositoryCommitMismatchError added in v2026.0.16 

type RepositoryCommitMismatchError struct {
	// contains filtered or unexported fields
}

RepositoryCommitMismatchError carries both sides of a rejected HEAD binding.

func (RepositoryCommitMismatchError) Error added in v2026.0.16 

func (e RepositoryCommitMismatchError) Error() string

func (RepositoryCommitMismatchError) Expected added in v2026.0.16 

func (e RepositoryCommitMismatchError) Expected() core.BuildCommit

Expected and Observed expose the exact rejected commit binding.

func (RepositoryCommitMismatchError) Observed added in v2026.0.16 

func (e RepositoryCommitMismatchError) Observed() core.BuildCommit

func (RepositoryCommitMismatchError) Unwrap added in v2026.0.16 

func (RepositoryCommitMismatchError) Unwrap() error

Unwrap preserves the stable release-contract identity.

func (RepositoryCommitMismatchError) Validate added in v2026.0.16 

func (e RepositoryCommitMismatchError) Validate() error

Validate proves both commits are canonical and differ.

type RepositoryDirtyError added in v2026.0.16 

type RepositoryDirtyError struct {
	// contains filtered or unexported fields
}

RepositoryDirtyError identifies the exact checkout that produced status output. The output itself is deliberately neither retained nor disclosed.

func (RepositoryDirtyError) Error added in v2026.0.16 

func (e RepositoryDirtyError) Error() string

func (RepositoryDirtyError) Root added in v2026.0.16 

func (e RepositoryDirtyError) Root() core.AbsolutePath

Root returns the exact checkout that failed cleanliness verification.

func (RepositoryDirtyError) Unwrap added in v2026.0.16 

func (RepositoryDirtyError) Unwrap() error

Unwrap preserves the stable release-contract identity.

func (RepositoryDirtyError) Validate added in v2026.0.16 

func (e RepositoryDirtyError) Validate() error

Validate proves the rejected repository identity.

type RepositoryVerificationRequest added in v2026.0.16 

type RepositoryVerificationRequest struct {
	Root           core.AbsolutePath
	GitExecutable  core.AbsolutePath
	Environment    process.Environment
	WaitDelay      temporal.Duration
	ExpectedCommit core.BuildCommit
}

RepositoryVerificationRequest supplies the exact repository and process capability used to prove a release commit comes from a clean checkout.

func (RepositoryVerificationRequest) Validate added in v2026.0.16 

func (r RepositoryVerificationRequest) Validate() error

Validate closes the repository observation boundary before Git is started.

type Revision 

type Revision uint8

Revision is the closed Release wire revision. 

const (
	RevisionUnknown Revision = iota
	Revision2026V1
)

func (Revision) IsValid 

func (r Revision) IsValid() bool

func (Revision) MarshalJSON 

func (r Revision) MarshalJSON() ([]byte, error)

func (Revision) OffWireEnum 

func (Revision) OffWireEnum()

func (Revision) String 

func (r Revision) String() string

func (*Revision) UnmarshalJSON 

func (r *Revision) UnmarshalJSON(data []byte) error

func (Revision) Validate 

func (r Revision) Validate() error

type Selection 

type Selection struct {
	// contains filtered or unexported fields
}

Selection is a validated tagged union over the four caller actions.

func Evaluate 

func Evaluate(request EvaluateRequest) (Selection, error)

Evaluate reads the current binary's Core-owned embedded identity and makes one pure installed-versus-latest selection.

func EvaluateInstalled added in v2026.0.126 

func EvaluateInstalled(request EvaluateInstalledRequest) (Selection, error)

EvaluateInstalled makes one pure installed-versus-latest selection for an already-known installed identity. Products use this when the installation under review is not the running process.

func (Selection) Available 

func (s Selection) Available() (AvailableRelease, bool)

func (Selection) Current 

func (s Selection) Current() (CurrentRelease, bool)

func (Selection) Reassess 

func (s Selection) Reassess() (ReassessDirective, bool)

func (Selection) Refresh 

func (s Selection) Refresh() (RefreshDirective, bool)

func (Selection) State 

func (s Selection) State() SelectionState

func (Selection) Validate 

func (s Selection) Validate() error

type SelectionState 

type SelectionState uint8

SelectionState is the complete pure release-selection result domain. 

const (
	SelectionUnknown SelectionState = iota
	SelectionCurrent
	SelectionAvailable
	SelectionRefreshRequired
	SelectionReassessAt
)

func (SelectionState) IsValid 

func (s SelectionState) IsValid() bool

func (SelectionState) OffWireEnum 

func (SelectionState) OffWireEnum()

func (SelectionState) String 

func (s SelectionState) String() string

String returns a stable diagnostic label.

func (SelectionState) Validate 

func (s SelectionState) Validate() error

type TargetSet 

type TargetSet struct {
	// contains filtered or unexported fields
}

func Targets 

func Targets() TargetSet

func (TargetSet) At 

func (s TargetSet) At(index int) (core.Platform, bool)

func (TargetSet) Validate 

func (s TargetSet) Validate() error

type VerifiedBuildTools added in v2026.0.11 

type VerifiedBuildTools struct {
	// contains filtered or unexported fields
}

VerifiedBuildTools is proof that one exact on-disk Go executable matched every compiler-owned identity at one observation.

func VerifyBuildTools added in v2026.0.11 

func VerifyBuildTools(
	ctx context.Context,
	request BuildToolVerificationRequest,
) (VerifiedBuildTools, error)

VerifyBuildTools inspects the executable file and executes the selected Go command with bounded output. Operator-supplied version strings are never accepted as evidence.

func (VerifiedBuildTools) GoExecutable added in v2026.0.11 

func (v VerifiedBuildTools) GoExecutable() core.AbsolutePath

Accessors return the exact verified tool facts.

func (VerifiedBuildTools) GoExecutableDigest added in v2026.0.11 

func (v VerifiedBuildTools) GoExecutableDigest() core.SHA256Digest

func (VerifiedBuildTools) GoToolchain added in v2026.0.11 

func (v VerifiedBuildTools) GoToolchain() GoToolchainIdentity

func (VerifiedBuildTools) HostPlatform added in v2026.0.11 

func (v VerifiedBuildTools) HostPlatform() core.Platform

func (VerifiedBuildTools) Validate added in v2026.0.11 

func (v VerifiedBuildTools) Validate() error

Validate proves the retained tool identities and observation seal.

type VerifiedLatest 

type VerifiedLatest struct {
	// contains filtered or unexported fields
}

VerifiedLatest proves both the outer selection and nested manifest.

func VerifyLatest 

func VerifyLatest(request VerifyLatestRequest) (VerifiedLatest, error)

func (VerifiedLatest) Document 

func (v VerifiedLatest) Document() LatestDocument

func (VerifiedLatest) Fact 

func (v VerifiedLatest) Fact() LatestFact

Accessors project the immutable authenticated value. Operations accepting a VerifiedLatest validate its private seal once at ingress.

func (VerifiedLatest) Manifest 

func (v VerifiedLatest) Manifest() VerifiedManifest

func (VerifiedLatest) Validate 

func (v VerifiedLatest) Validate() error

Validate proves that VerifyLatest issued the private witness and that its complete closure was authenticated. Cryptographic and canonical body verification run exactly once before the witness is sealed.

type VerifiedManifest 

type VerifiedManifest struct {
	// contains filtered or unexported fields
}

VerifiedManifest is a private-witness proof that one exact manifest document authenticated against caller-selected authority.

func VerifyManifest 

func VerifyManifest(request VerifyManifestRequest) (VerifiedManifest, error)

func (VerifiedManifest) Artifacts 

func (v VerifiedManifest) Artifacts() ArtifactSet

func (VerifiedManifest) Document 

func (v VerifiedManifest) Document() ManifestDocument

Accessors project the immutable authenticated value. Operations accepting a VerifiedManifest validate its private seal once at ingress.

func (VerifiedManifest) DocumentDigest 

func (v VerifiedManifest) DocumentDigest() ManifestDocumentDigest

func (VerifiedManifest) DocumentIntegrity added in v2026.0.11 

func (v VerifiedManifest) DocumentIntegrity() ArtifactIntegrity

func (VerifiedManifest) Identity 

func (v VerifiedManifest) Identity() ManifestIdentity

func (VerifiedManifest) Metadata added in v2026.0.11 

func (v VerifiedManifest) Metadata() MetadataSet

func (VerifiedManifest) Offering 

func (v VerifiedManifest) Offering() core.Offering

func (VerifiedManifest) Provenance added in v2026.0.11 

func (v VerifiedManifest) Provenance() BuildProvenance

func (VerifiedManifest) PublicationIntegrity added in v2026.0.55 

func (v VerifiedManifest) PublicationIntegrity(role PublicationRole) (ArtifactIntegrity, error)

PublicationIntegrity returns the exact integrity occupying one release publication role. Release owns this projection so every publisher and authority shares the manifest's compiler-visible slot order.

func (VerifiedManifest) TotalExtent 

func (v VerifiedManifest) TotalExtent() core.ByteCount

func (VerifiedManifest) Validate 

func (v VerifiedManifest) Validate() error

Validate proves that VerifyManifest issued the private witness and that its complete closure was authenticated. Authentication and document hashing run once, before the seal is issued, rather than on every accessor.

func (VerifiedManifest) Version 

func (v VerifiedManifest) Version() core.ReleaseVersion

type VerifiedRepository added in v2026.0.16 

type VerifiedRepository struct {
	// contains filtered or unexported fields
}

VerifiedRepository is proof that the observed checkout was clean and its exact HEAD matched the requested release commit. It retains the Git executable that produced that proof so later release work can reach it without inheriting an ambient PATH.

func VerifyRepository added in v2026.0.16 

func VerifyRepository(
	ctx context.Context,
	request RepositoryVerificationRequest,
) (VerifiedRepository, error)

VerifyRepository observes the real Git repository through Primitive Process. It retains the verified Git executable plus fixed-size commit and root facts; status output stops at the first byte and is never world-built.

func (VerifiedRepository) Commit added in v2026.0.16 

func (r VerifiedRepository) Commit() core.BuildCommit

func (VerifiedRepository) GitExecutable added in v2026.0.128 

func (r VerifiedRepository) GitExecutable() core.AbsolutePath

func (VerifiedRepository) Root added in v2026.0.16 

func (r VerifiedRepository) Root() core.AbsolutePath

Root, GitExecutable, and Commit return the exact repository facts that were verified.

func (VerifiedRepository) Validate added in v2026.0.16 

func (r VerifiedRepository) Validate() error

Validate rechecks the retained proof facts.

type VerifyLatestRequest 

type VerifyLatestRequest struct {
	ExpectedOffering core.Offering
	Document         LatestDocument
	LatestKeys       attest.TrustedKeys
	ManifestKeys     attest.TrustedKeys
}

func (VerifyLatestRequest) Validate 

func (r VerifyLatestRequest) Validate() error

Validate proves both caller-selected authority sets, document structure, and the expected selection stream before authentication.

type VerifyManifestRequest 

type VerifyManifestRequest struct {
	ExpectedOffering core.Offering
	Document         ManifestDocument
	TrustedKeys      attest.TrustedKeys
}

func (VerifyManifestRequest) Validate 

func (r VerifyManifestRequest) Validate() error

Validate proves document structure, caller authority, and expected stream.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.