chore(tooling): adopt final W14 enforcement

.github/workflows/ci.yml

@@ -20,9 +20,9 @@ permissions:
 
 jobs:
   ci:
-    uses: faustbrian/go-library-tools/.github/workflows/library-ci.yml@6c76f5c670d193ce369a7242d4c634f1117286e9 # v1.3.0 cohesion enforcement
+    uses: faustbrian/go-library-tools/.github/workflows/library-ci.yml@531e4db50fd81a7201257a7b488a0cf22d333aca # v1.4.0 public-first resolution
     with:
-      tooling_sha: 6c76f5c670d193ce369a7242d4c634f1117286e9
+      tooling_sha: 531e4db50fd81a7201257a7b488a0cf22d333aca
       release_dry_run: ${{ inputs.release_dry_run || false }}
 
   required:

.golib.yaml

@@ -1,6 +1,6 @@
 schema_version: 1
-tool_version: v1.3.0
-tool_checksums_sha256: 72d38d7d0cab33bfeb9345df6b141eacf9841c5d6817f597ff25b957dc8dc48f
+tool_version: v1.4.0
+tool_checksums_sha256: ba1b71d41dc9b58d5bfb411bc89ae2d45b6f3f778152714bfd1afeab0bef2f33
 
 manifest:
   modules: modules.json

.verification/by-input/mutation/ee29420c00b74caa48988accc1f3e64804927e11adeff3f1ed193e6c88a75abf.json

@@ -0,0 +1,19 @@
+{
+  "schema_version": 1,
+  "repository": "github.com/faustbrian/go-router",
+  "module": ".",
+  "package": ".",
+  "gate": "mutation",
+  "input_digest": "sha256:ee29420c00b74caa48988accc1f3e64804927e11adeff3f1ed193e6c88a75abf",
+  "verifier_digest": "sha256:9a9499ff68a8dfd49a0be7995590297a8ee563a1aa226bfd8b9361dc53058108",
+  "result": "passed",
+  "report_digest": "sha256:3ae9aeb641027eb399861cdcd1d8016bfe4fae05daaa52df3da0a8142a7a6e91",
+  "environment": {
+    "CGO_ENABLED": "1",
+    "GOARCH": "arm64",
+    "GOOS": "darwin",
+    "GOVERSION": "go1.26.6",
+    "gremlins_binary_sha256": "sha256:e05bf25d661b16ab96d6f2e17aed481d393930e0f24205cc341b010f887368a0"
+  },
+  "completed_at": "2026-09-03T16:22:56.515252Z"
+}

CHANGELOG.md

@@ -9,6 +9,10 @@ Versioning.
 
 ### Changed
 
+- Adopt the checksum-verified `go-library-tools` v1.4.0 CLI and immutable
+  shared workflow while preserving every existing repository gate.
+- Include authoritative online specification validation in the complete local
+  CI contract enforced by `make ci`.
 - Replace copied repository tooling with the checksum-pinned
   `go-library-tools` v1.2.0 specification-governance contract while retaining
   package-owned policy and verification evidence.
@@ -26,6 +30,8 @@ Versioning.
 
 ### Documentation
 
+- Preserve the reviewed Go release and RFC 9110 errata dispositions in an
+  append-only upstream authority history.
 - Make the [specification decision register](docs/specification-decisions.md)
   machine-auditable with monitored source and errata authorities, attributable
   conformance evidence, classified interoperability results, and durable

Makefile

@@ -8,6 +8,7 @@ check:
 ci:
 	$(GOLIB) repository check
 	$(GOLIB) cohesion check
+	$(GOLIB) specification check --online
 	$(GOLIB) check --all
 
 cohesion:

README.md

@@ -19,8 +19,8 @@ The minimum supported toolchain is Go 1.26.6. The package has no runtime
 dependencies and no global router, reflection discovery, controller resolver,
 container, session, template, or application lifecycle.
 
-See the versioned [Golib ecosystem index](https://github.com/faustbrian/go-library-tools/blob/v1.3.0/docs/ecosystem/README.md)
-and its [service-edge package guidance](https://github.com/faustbrian/go-library-tools/blob/v1.3.0/docs/ecosystem/design-language.md#package-families-and-selection)
+See the versioned [Golib ecosystem index](https://github.com/faustbrian/go-library-tools/blob/v1.4.0/docs/ecosystem/README.md)
+and its [service-edge package guidance](https://github.com/faustbrian/go-library-tools/blob/v1.4.0/docs/ecosystem/design-language.md#package-families-and-selection)
 for the shared design language and related packages.
 
 ## Five-minute start
@@ -77,6 +77,8 @@ reproducible.
 
 Run `make cohesion` to validate this module's catalog classification,
 ownership contract, documentation entry points, and ecosystem navigation.
+Run `make ci` for the complete local contract, including online specification
+source validation.
 
 ## License
 

modules.json

@@ -143,7 +143,7 @@
           "faq": "docs/faq.md",
           "changelog": "CHANGELOG.md",
           "pkg_go_dev": "https://pkg.go.dev/github.com/faustbrian/go-router",
-          "ecosystem_index": "https://github.com/faustbrian/go-library-tools/blob/v1.3.0/docs/ecosystem/README.md"
+          "ecosystem_index": "https://github.com/faustbrian/go-library-tools/blob/v1.4.0/docs/ecosystem/README.md"
         },
         "known_good_compatibility_sets": [],
         "delivery": {

specification/README.md

@@ -13,6 +13,8 @@ The canonical
 [`docs/specification-decisions.md`](../docs/specification-decisions.md)
 records every material interpretation, consequence, and condition for
 reconsideration behind this conformance matrix.
+Reviewed monitoring changes and their decision applicability are preserved in
+the append-only [`upstream-reviews.md`](upstream-reviews.md) history.
 
 ## Decision conformance matrix
 

specification/upstream-reviews.md

@@ -0,0 +1,66 @@
+# Upstream authority review history
+
+This append-only record preserves reviewed changes to the authorities monitored
+by [`monitoring.json`](monitoring.json). A monitoring digest changes only after
+the corresponding upstream delta has been classified against the applicable
+specification decisions.
+
+## 2026-09-03: Go releases feed
+
+- **Authority:** `go-releases`
+- **URL:** https://go.dev/dl/?mode=json&include=all
+- **Previous SHA-256:**
+  `c0696d6e5708cce9644204513ee4ecb994f3fd748065c54b0890158c34631207`
+- **Reviewed SHA-256:**
+  `638127a053a86576fc235aa196b26145c6f2fce8ce839ded767212a18d1c9415`
+- **Retrieved and reviewed:** 2026-09-03
+- **Applicability:** `ROUTER-DEC-001` and `ROUTER-DEC-005` for the newer
+  escaped-path redirect behavior; no current decision for the Go 1.26.7 h2c
+  deadline fix
+- **Disposition:** Behavior-neutral for the selected Go 1.26.6 contracts.
+
+The feed added Go 1.26.8 at commit
+`c293dd49cbe25e1fe8d97d94a5cb618e7b6d831e` and Go 1.27.1 at commit
+`862c888e612ac346c7c4d99c9392bdfd265f33b0` after the previous review.
+Comparing Go 1.26.6 with Go 1.26.8 shows that `request.go` and `url.go` are
+byte-identical. The only `server.go` change clears connection deadlines when an
+HTTP/1 connection upgrades to unencrypted HTTP/2; the router does not own
+server connections, deadlines, or h2c lifecycle.
+
+Go 1.27 changed escaped-path `ServeMux` redirect serialization, which directly
+intersects `ROUTER-DEC-001` and `ROUTER-DEC-005`. That change was separately
+reviewed and the router now preserves the selected Go 1.26.6 redirect wire
+behavior on later toolchains through focused executable evidence. No other
+candidate decision is affected by the reviewed release delta.
+
+The monitored `server.go`, `request.go`, and `url.go` URLs and SHA-256 values
+were independently verified against the immutable `go1.26.6` tag. The selected
+source and minimum supported Go version remain unchanged. Reconsider these
+decisions if the minimum supported Go version changes or a versioned
+compatibility decision adopts newer redirect serialization.
+
+## 2026-09-03: RFC 9110 errata
+
+- **Authority:** `rfc9110-errata`
+- **URL:** https://errata.rfc-editor.org/search/?rfc_number=9110&presentation=records
+- **Previous SHA-256:**
+  `38bd006c96f8963d58573f704c5313a5f81968b90738c03ade0b036ec7bbdf4b`
+- **Reviewed SHA-256:**
+  `1f6790054c0cdb2f2a70a94fa2b9c73b09a4ee0578a32b4a3006ed0ecfaac86d`
+- **Retrieved and reviewed:** 2026-09-03
+- **Applicability:** `ROUTER-DEC-003`
+- **Disposition:** Behavior-neutral because generated `Allow` field values
+  already use comma-space separation.
+
+[Errata ID 9162](https://errata.rfc-editor.org/eid9162/) was reported on
+2026-09-01 as a Technical erratum against RFC 9110 Section 5.2. It proposes
+changing the repeated-field combination wording from values separated by a
+comma to values separated by comma plus space so the rule matches its example.
+The erratum remains Reported, not Verified, and does not revise the immutable
+RFC 9110 source.
+
+`ROUTER-DEC-003` owns `Allow` construction, and the router already joins its
+sorted method values with comma plus space into one field value. No selected
+behavior, decision, source binding, or executable evidence changes. Reconsider
+this disposition if Errata ID 9162 becomes Verified or the router later accepts
+or combines repeated list-valued HTTP field lines.