Jason-Doyle · Jason-Doyle · Sep 4, 2026 · Sep 4, 2026
@@ -78,9 +78,16 @@ jobs:
       - name: Check formatting
         shell: bash
         run: test -z "$(gofmt -l .)"
+      - run: go build ./...
       - run: go test ./...
       - run: go test -race ./...
       - run: go vet ./...
+      - name: Smoke test both command-line tools
+        shell: bash
+        run: |
+          go run ./cmd/worldcut-go --require-satisfied \
+            ../../examples/coherent-deployment.json > /dev/null
+          go run ./cmd/worldcut-github-ci-go --help > /dev/null
 
   python:
     name: Python ${{ matrix.python }}

@@ -2,6 +2,38 @@
 
 ## Unreleased
 
+- Added Go integrations to the `ports/go` module, closing the gap where the Go
+  port shipped a verifier but no adapters or integrations:
+  - `adapters.CaptureGitHead`, `adapters.CaptureHTTPObservation`, and
+    `adapters.CaptureKubernetesObservation`, behavior-compatible with the
+    TypeScript adapters, including exact branch-ref resolution, strong-ETag
+    promotion only, refused redirects, unread-and-closed response bodies, and
+    opaque Kubernetes `resourceVersion` handling;
+  - `githubactions.VerifyLatestWorkflow` and
+    `githubactions.InspectWorkflowEvidence`, the latest-completed-push
+    deployment gate and evidence coverage report, built on `net/http` with an
+    injectable client, API base URL, clock, and identifier source;
+  - `agenticdatakernel.ObservationFromResolution`, the structural Agentic Data
+    Kernel adapter, with no runtime kernel dependency;
+  - the `worldcut-github-ci-go` command, equivalent to `worldcut-github-ci`,
+    including stable JSON errors, exit status 2 unless the contract is
+    satisfied, and `verified_sha`/`workflow_run_id` in `GITHUB_OUTPUT`.
+- Added a Go construction API so captured observations can be verified without
+  hand-assembling protocol JSON: `VerificationInput`, `ContractAssumptions`,
+  `SupportedAssumptions`, `ParseVerificationInput`, `VerifyDecisionContract`,
+  requirement constructors, `SnapshotJSONValue`, `ParseTimestamp`, and
+  `FormatTimestamp`. Constructed inputs are encoded and then validated by the
+  existing `ParseInput` path, so there is no second or weaker validation route,
+  and parsed snapshots and results remain mutation isolated. `ParseInput`,
+  `Verify`, and `VerifyJSON` are unchanged, and protocol 0.1 and engine 0.1.2
+  outputs are unchanged.
+- Added the stable Go integration error codes `WORLDCUT_GITHUB_API_ERROR`,
+  `WORLDCUT_GITHUB_RESPONSE_INVALID`, and `WORLDCUT_ADK_RESOLUTION_INVALID`,
+  plus `NewError`, `WrapError`, and cause unwrapping in `ErrorCode`.
+- Added a Go GitHub Actions deployment-gate example workflow and documented the
+  Go integrations in the port README, root README, `docs/INTEGRATIONS.md`,
+  `docs/AGENTIC_DATA_KERNEL.md`, and `docs/VALIDATION.md`. The Go module keeps
+  its single `jcs` dependency and adds no GitHub, Kubernetes, or cloud SDK.
 - Added OIDC trusted-publishing workflows for Python `0.1.1` on PyPI and
   `WorldCut`/`WorldCut.Tool` `0.1.1` on NuGet.org, including protected tag
   validation, exact-artifact checks, and language-specific GitHub releases.

@@ -57,10 +57,13 @@ results, as described in
 | Port | Protocol / engine | Status |
 | --- | --- | --- |
 | TypeScript | 0.1 / 0.1.2 | Reference package with documented integrations |
-| [Go](ports/go) | 0.1 / 0.1.2 | Independent conformant verifier and CLI; integrations not yet included |
+| [Go](ports/go) | 0.1 / 0.1.2 | Independent conformant verifier, Go construction API, Git/HTTP/Kubernetes adapters, GitHub Actions gate, Agentic Data Kernel adapter, and two CLIs |
 | [Python](ports/python) | 0.1 / 0.1.2 | [`worldcut`](https://pypi.org/project/worldcut/0.1.1/) package and `worldcut-py` CLI for Python 3.11+ |
 | [.NET](ports/dotnet) | 0.1 / 0.1.2 | [`WorldCut`](https://www.nuget.org/packages/WorldCut/0.1.1) library and [`WorldCut.Tool`](https://www.nuget.org/packages/WorldCut.Tool/0.1.1) CLI for .NET 8 and .NET 10 |
 
+Python and .NET currently implement the verifier and CLI only. The adapters
+and integrations are available in TypeScript and Go.
+
 Go is available through its public module tag, Python `0.1.1` is live on PyPI,
 and .NET `0.1.1` is live on NuGet.org. The Python release includes PEP 740
 digital attestations bound to this repository and its protected release
@@ -366,6 +369,9 @@ npm run feasibility
 
 Set `WORLDCUT_SAMPLE_GIT_REPO` to inspect another local Git repository.
 
+The Go port implements the same three adapters in
+[`ports/go/adapters`](ports/go/adapters).
+
 ## GitHub Actions deployment gate
 
 The package includes a production-oriented gate for the latest completed
@@ -391,6 +397,10 @@ In GitHub Actions the CLI writes `verified_sha` and `workflow_run_id` to
 [`examples/github-actions/deployment-gate.yml`](examples/github-actions/deployment-gate.yml)
 and [`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md).
 
+The Go port provides the same gate as `worldcut-github-ci-go` and
+`githubactions.VerifyLatestWorkflow`. See
+[`examples/github-actions/deployment-gate-go.yml`](examples/github-actions/deployment-gate-go.yml).
+
 ## Agentic Data Kernel
 
 `observationFromAgenticDataResolution` converts an eligible Agentic Data Kernel
@@ -403,6 +413,9 @@ See
 [`docs/AGENTIC_DATA_KERNEL.md`](docs/AGENTIC_DATA_KERNEL.md)
 for the namespaced `basis.worldcut` contract and effect-gating guidance.
 
+The Go equivalent is
+`agenticdatakernel.ObservationFromResolution`.
+
 ## JSON Schemas
 
 Immutable protocol 0.1 schemas are published with the package:

@@ -1,7 +1,9 @@
 # Agentic Data Kernel integration
 
 WorldCut can consume resolved Agentic Data Kernel assertions without taking a
-runtime dependency on the kernel package.
+runtime dependency on the kernel package. The adapter is available in
+TypeScript (`observationFromAgenticDataResolution`) and Go
+(`agenticdatakernel.ObservationFromResolution`).
 
 The integration is structural by design:
 
@@ -115,6 +117,38 @@ const observation = observationFromAgenticDataResolution(resolution, {
 The unresolved candidates remain relevant audit evidence and should be
 persisted with the verification record.
 
+## Go
+
+The Go port provides the same structural adapter, with the same rejections and
+the same `WORLDCUT_ADK_RESOLUTION_INVALID` error code:
+
+```go
+import (
+	worldcut "github.com/Jason-Doyle/WorldCut/ports/go"
+	adk "github.com/Jason-Doyle/WorldCut/ports/go/integrations/agenticdatakernel"
+)
+
+head, err := adk.ObservationFromResolution(headResolution, adk.Options{})
+if err != nil {
+	return err
+}
+ci, err := adk.ObservationFromResolution(ciResolution, adk.Options{
+	AllowResolvedWithConflict: true,
+})
+if err != nil {
+	return err
+}
+
+result, err := worldcut.VerifyDecisionContract(worldcut.VerificationInput{
+	Contract:     contract,
+	Observations: []worldcut.Observation{head, ci},
+})
+```
+
+`Resolution` and `Assertion` are structural Go types. The kernel object and
+`basis` values are supplied as ordinary Go values and are snapshotted, so the
+returned observation never aliases caller state.
+
 ## Persisting verification
 
 Persist the complete WorldCut input and result as an immutable kernel artifact,

@@ -1,5 +1,22 @@
 # Integrations
 
+Integrations are available in TypeScript and Go. Both implement the same
+behavior; the tables below give the TypeScript name first and the Go name
+second.
+
+| Integration | TypeScript | Go |
+| --- | --- | --- |
+| GitHub Actions gate | `verifyLatestGitHubWorkflow` | `githubactions.VerifyLatestWorkflow` |
+| GitHub evidence coverage | `inspectGitHubWorkflowEvidence` | `githubactions.InspectWorkflowEvidence` |
+| GitHub gate CLI | `worldcut-github-ci` | `worldcut-github-ci-go` |
+| Git | `captureGitHead` | `adapters.CaptureGitHead` |
+| HTTP | `captureHttpObservation` | `adapters.CaptureHTTPObservation` |
+| Kubernetes | `captureKubernetesObservation` | `adapters.CaptureKubernetesObservation` |
+| Agentic Data Kernel | `observationFromAgenticDataResolution` | `agenticdatakernel.ObservationFromResolution` |
+
+The Python and .NET ports implement the verifier only. There is no
+TypeScript-only integration in the list above.
+
 ## GitHub Actions deployment gate
 
 `verifyLatestGitHubWorkflow` checks the latest completed `push` run for an
@@ -34,6 +51,29 @@ await deployCommit(verification.verifiedSha);
 Use a numeric workflow ID or a filename such as `ci.yml`. Display names are
 not accepted because they are not unambiguous identifiers.
 
+In Go:
+
+```go
+verification, err := githubactions.VerifyLatestWorkflow(ctx, githubactions.Options{
+	Repository: "acme/payments",
+	Branch:     "main",
+	Workflow:   "ci.yml",
+	Token:      os.Getenv("GITHUB_TOKEN"),
+})
+if err != nil {
+	return err
+}
+if verification.VerifiedSHA == nil {
+	return fmt.Errorf("deployment blocked: %s", verification.Result.Verdict)
+}
+return deployCommit(ctx, *verification.VerifiedSHA)
+```
+
+The Go gate uses `net/http` only. `Options` accepts an injectable HTTP client,
+API base URL, clock, and observation identifier source, so the gate is tested
+without network access. Response bodies are bounded, redirects are refused,
+and a token is never included in an error message.
+
 The command-line gate is:
 
 ```sh
@@ -43,6 +83,15 @@ worldcut-github-ci \
   --workflow ci.yml
 ```
 
+The Go gate takes the same flags:
+
+```sh
+worldcut-github-ci-go \
+  --repository acme/payments \
+  --branch main \
+  --workflow ci.yml
+```
+
 It exits with code `2` unless the contract is satisfied. In GitHub Actions it
 writes `verified_sha` and `workflow_run_id` to `GITHUB_OUTPUT`.
 
@@ -57,28 +106,44 @@ Deploy `verifiedSha` or an immutable artifact built from that SHA. Never verify
 
 See
 [`examples/github-actions/deployment-gate.yml`](../examples/github-actions/deployment-gate.yml)
-for a `workflow_run` example.
+and
+[`examples/github-actions/deployment-gate-go.yml`](../examples/github-actions/deployment-gate-go.yml)
+for `workflow_run` examples.
 
 ## Native metadata adapters
 
+Both implementations return an error rather than a success-shaped observation
+when a provider call fails, and neither invents dependency or validity
+metadata.
+
 ### Git
 
-`captureGitHead` validates and resolves an exact local branch ref and returns
-its full commit SHA. Revision expressions such as `main~1` are rejected.
+`captureGitHead` and `adapters.CaptureGitHead` validate and resolve an exact
+local branch ref and return its full commit SHA. Revision expressions such as
+`main~1` are rejected.
 
 ### HTTP
 
-`captureHttpObservation` promotes only a syntactically valid strong ETag into
-an exact version witness. Weak ETags and `Last-Modified` remain descriptive
-metadata.
+`captureHttpObservation` and `adapters.CaptureHTTPObservation` promote only a
+syntactically valid strong ETag into an exact version witness. Weak ETags, the
+wildcard, unquoted values, and `Last-Modified` remain descriptive metadata.
+Redirects are never followed and the response body is never read.
 
 ### Kubernetes
 
-`captureKubernetesObservation` records `metadata.resourceVersion` as an opaque
-version token. Clients must not sort, parse, or treat it as a timestamp.
+`captureKubernetesObservation` and `adapters.CaptureKubernetesObservation`
+record `metadata.resourceVersion` as an opaque version token. Clients must not
+sort, parse, or treat it as a timestamp.
 
 ## Agentic Data Kernel
 
 The structural adapter validates kernel resolution and assertion lifecycle
 semantics before producing a WorldCut observation. See
 [Agentic Data Kernel integration](AGENTIC_DATA_KERNEL.md).
+
+## Building a contract from captured observations
+
+The captured observations are ordinary protocol observations. In TypeScript
+pass them to `verifyDecisionContract`; in Go pass them to
+`worldcut.VerifyDecisionContract`, which applies exactly the same validation
+and canonicalization as the JSON transport path.
@@ -10,6 +10,12 @@ Python and .NET use registry-specific protected tag workflows:
 
 Current registry status:
 
+- Go `ports/go/v0.2.0` is the published module tag. It adds the adapters, the
+  GitHub Actions gate, the
+  Agentic Data Kernel adapter, `worldcut-github-ci-go`, and the Go
+  construction API. Every change is backward compatible with `v0.1.0` —
+  `ParseInput`, `Verify`, and `VerifyJSON` keep their signatures and outputs —
+  so a minor version, not a major one, is correct.
 - .NET `0.1.1` is published as
   [`WorldCut`](https://www.nuget.org/packages/WorldCut/0.1.1) and
   [`WorldCut.Tool`](https://www.nuget.org/packages/WorldCut.Tool/0.1.1).

@@ -31,6 +31,31 @@ This establishes that GitHub exposes the fields required by this integration
 for the inspected workflow history. It does not establish the same coverage
 for other providers or prove that an arbitrary workflow is trustworthy.
 
+### Go implementation parity
+
+On 4 September 2026 the same public repository, branch, and workflow were
+queried with both implementations. The TypeScript gate
+(`node dist/github-ci-cli.js`) and the Go gate (`worldcut-github-ci-go`)
+returned the same `branchSha`, the same `verifiedSha`, the same workflow run
+identity, the same `CONTRACT_SATISFIED` verdict, and the same two satisfied
+requirement summaries. The verification-record digests differ, as they must,
+because each run carries its own observation timestamps and observation
+identifiers.
+
+`inspectGitHubWorkflowEvidence` and `githubactions.InspectWorkflowEvidence`
+returned identical coverage over the same 20 completed push runs:
+
+| Measurement | Result |
+| --- | ---: |
+| Completed `push` runs inspected | 20 |
+| Runs with complete dependency and conclusion evidence | 20 |
+| Evidence coverage | 100% |
+| Conclusions | 19 `success`, 1 `cancelled` |
+
+This is a single live observation of one public repository. It is not a
+continuous parity guarantee; the enforced cross-language guarantee remains the
+verifier differential suite.
+
 ## Package artifact
 
 `npm run test:package`:

@@ -0,0 +1,41 @@
+name: Deploy verified main with the Go gate
+
+on:
+  workflow_run:
+    workflows:
+      - CI
+    branches:
+      - main
+    types:
+      - completed
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  gate:
+    if: github.event.workflow_run.event == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: stable
+
+      # The Go gate ships in the ports/go/v0.2.0 module tag.
+      - name: Install the WorldCut Go gate
+        run: go install github.com/Jason-Doyle/WorldCut/ports/go/cmd/worldcut-github-ci-go@v0.2.0
+
+      - name: Verify latest completed CI run
+        id: worldcut
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          worldcut-github-ci-go \
+            --repository "$GITHUB_REPOSITORY" \
+            --branch main \
+            --workflow ci.yml
+
+      - name: Deploy the immutable verified revision
+        run: |
+          echo "Deploy exactly ${{ steps.worldcut.outputs.verified_sha }}"