feat: publish Gamertan Web Foundations preview source

Export the reviewed application-neutral package set through the exact public allowlist. Development history and private application evidence remain outside this canonical source root. Developed with material AI assistance under maintainer review. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-16 15:05:40 -04:00
commit 3a4b6db9b8
54 changed files with 4523 additions and 0 deletions
@@ -0,0 +1,53 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Gamertan Web Foundations
+
+> Status: unreleased development work toward `v0.1.0-preview.1`. No install
+> coordinate is promised until the reviewed public snapshot is tagged.
+
+Small, composable Go packages for the unglamorous boundaries of a careful web
+application: request identity, structured request logs, browser security,
+passwords and sessions, permissions, SQLite persistence, and private analytics.
+
+This is a toolkit, not an application framework. Your application keeps its
+router, HTTP policy, HTML, authorization decisions, cache behavior, and
+deployment. Each package works with `net/http` and can be adopted independently.
+
+The first preview targets modest Linux servers, local files, SQLite, and normal
+Go binaries. It requires no Redis, message broker, hosted identity provider,
+telemetry service, or JavaScript framework.
+
+## Packages
+
+- `requestmeta`: trusted-proxy resolution, HTTPS/origin metadata, and request IDs.
+- `requestlog`: bounded versioned records, middleware, sinks, and private JSONL.
+- `websec`: headers, origin checks, CSRF, redirects, body limits, and rate limits.
+- `abuse`: application-classified request abuse with pluggable persistence.
+- `auth`, `authhttp`, `authsqlite`: passwords, sessions, permissions, cookies,
+  and a no-CGO SQLite adapter.
+- `analytics`: safe and sensitive aggregate projections over request records.
+
+The copyable starter under `starters/basic` demonstrates the packages without
+turning them into a router or template system.
+
+## Security boundary
+
+Client addresses are accepted from forwarding headers only when the immediate
+peer and every skipped proxy are explicitly trusted. Sensitive request fields
+are off by default. Cryptographic entropy failures fail closed. Logs and account
+databases remain private application data and never belong in source releases.
+
+See [SECURITY.md](SECURITY.md), [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md),
+the [application adoption contract](docs/ADOPTION.md), and
+[docs/SERVICES_ROADMAP.md](docs/SERVICES_ROADMAP.md).
+
+## Licensing
+
+This is a multi-license repository with exact file-level SPDX identifiers:
+
+- embeddable packages and adapters: MPL-2.0;
+- future standalone network services and operational machinery: AGPL-3.0-only;
+- starters, examples, and reusable configuration: 0BSD.
+
+See [LICENSES.md](LICENSES.md). No standalone auth or logging server is included
+in this preview.