6 Commits

Include renames

Author	SHA1	Message	Date
Hein	f9c948ca4e	fix(tracing): address audit findings ... Default to TLS export with Insecure/TLSConfig/Headers options, parent-based ratio sampling (default 0.1), and no query string or Host in span attributes. Name spans by route template, record status and panics (re-raised), guard the tracer with atomic.Pointer, reject double init, add init timeout and attribute length limit, and move to semconv v1.26.0. Add tracing.insecure and tracing.sample_rate config keys and tests.	2026-09-30 13:39:50 +02:00
Hein	97fe88b3a6	fix(modelregistry): address audit findings ... Replace try-lock/sleep scheme with blocking locks, add ErrModelNotFound/ ErrModelExists/ErrInvalidModel sentinels, make RegisterModelWithRules atomic, snapshot in IterateModels, guard defaultRegistry access, cap the pointer-unwrap depth, and recover panics in callbacks and reflection. Security hooks now allow-by-default only on ErrModelNotFound. Add tests.	2026-09-30 13:26:55 +02:00
Hein	f66930c3c9	chore(gosec): enable gosec and address findings	2026-09-30 13:16:12 +02:00
Hein	652621a70e	ci: add race detector job	2026-09-30 13:09:44 +02:00
Hein	c7b4530689	fix(race): make make test-race pass across ./pkg/... ... Add a test-race target and run test-unit over ./pkg/... Production races: - logger: guard Logger/errorTracker with an RWMutex - security: copy UserContext for the async session-activity goroutine and track it with a WaitGroup Test fixes: - eventbroker, websocketspec: use atomics for state shared with workers - security: wait for async activity updates before touching sqlmock - mqttspec: build full HookContext, set SubscriptionID, pin the in-memory SQLite to one connection Update the cross-cutting audit (X1) with status and findings.	2026-09-30 13:07:47 +02:00
Hein	bc8bff7955	docs(audit): add audit reports for pkg/testmodels and pkg/tracing	2026-09-29 17:15:00 +02:00