Merge pull request #1 from IntentProof/go-sdk-core

feat(sdk-go): core wrap, signing, outbox, and golden parity

Author: negillett

.github/workflows/ci.yml

@@ -21,9 +21,4 @@ jobs:
         run: go mod verify
 
       - name: Run tests
-        run: |
-          if [ -z "$(find . -name '*.go' -not -path './.git/*')" ]; then
-            echo "No Go source files found (project scaffold only)"
-            exit 0
-          fi
-          go test ./...
+        run: go test ./...

.github/workflows/release-signing-dry-run.yml

@@ -35,12 +35,7 @@ jobs:
         run: go mod verify
 
       - name: Run tests
-        run: |
-          if [ -z "$(find . -name '*.go' -not -path './.git/*')" ]; then
-            echo "No Go source files found (project scaffold only)"
-            exit 0
-          fi
-          go test ./...
+        run: go test ./...
 
       - name: Package module source archive
         run: |

README.md

@@ -4,25 +4,75 @@ Go SDK for emitting signed IntentProof execution events.
 
 ## Status
 
-Early scaffolding repo for IntentProof's Go SDK. Tracks the Node and
-Python SDK `wrap()` / exporter / outbox contract so a Go application
-can emit and verify the same signed execution events.
-
-## Planned scope
-
-- `wrap()` instrumentation helper
-- Correlation-id helpers
-- Event signing and canonical serialization (JCS)
-- Durable outbox and hosted ingest transport
+Core SDK aligned with the Node and Python SDKs: `Configure`, `Wrap`,
+`RunWithCorrelationID`, `Flush`, JCS canonicalization, Ed25519 signing,
+SQLite WAL outbox, and optional HTTP export to ingest.
 
 ## Module path
 
 ```text
 github.com/intentproof/intentproof-sdk-go
 ```
 
-SDK implementation and local development steps land in a follow-on
-change.
+## Quick start
+
+```go
+package main
+
+import (
+	"log"
+
+	"github.com/intentproof/intentproof-sdk-go/intentproof"
+)
+
+func main() {
+	if err := intentproof.Configure(intentproof.ConfigureOptions{
+		DBPath:  "./intentproof-outbox.db",
+		DataDir: "./.intentproof-sdk-go",
+	}); err != nil {
+		log.Fatal(err)
+	}
+
+	refund := intentproof.Wrap(
+		"Return funds to the customer",
+		"payments.refund.execute",
+		func(input map[string]any) map[string]any {
+			// call your payment provider here
+			return map[string]any{"id": "re_123"}
+		},
+	)
+
+	intentproof.RunWithCorrelationID("req_refund_ord_1042", func() {
+		_ = refund(map[string]any{
+			"amount_cents":   4999,
+			"payment_intent": "pi_123",
+		})
+	})
+
+	intentproof.Flush()
+}
+```
+
+## Local ingest
+
+- `INTENTPROOF_INGEST_URL` — hosted or local ingest base URL (normalized to
+  `/v1/events`).
+- `INTENTPROOF_USE_LOCAL_INGEST=1` — default local loop
+  `http://127.0.0.1:9787/v1/events`.
+- `INTENTPROOF_INGEST_TOKEN` — bearer token for hosted ingest.
+- `INTENTPROOF_TENANT_ID` — default tenant when `Configure` omits `TenantID`.
+- `INTENTPROOF_OUTBOX_PATH` — SQLite outbox path when `DBPath` is omitted.
+
+Default signing keys live under `~/.intentproof/sdk-go/keypair.json`.
+
+## Development
+
+```bash
+go test ./...
+```
+
+Cross-language signing fixtures under `testdata/fixtures/` match the Node and
+Python SDK conformance set.
 
 ## License
 

go.mod

@@ -1,3 +1,20 @@
 module github.com/intentproof/intentproof-sdk-go
 
 go 1.25.0
+
+require (
+	github.com/oklog/ulid/v2 v2.1.1
+	modernc.org/sqlite v1.50.1
+)
+
+require (
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	modernc.org/libc v1.72.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+)

go.sum

@@ -0,0 +1,54 @@
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
+github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
+modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
+modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
+modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.50.1 h1:l+cQvn0sd0zJJtfygGHuQJ5AjlrwXmWPw4KP3ZMwr9w=
+modernc.org/sqlite v1.50.1/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

intentproof/canon.go

@@ -0,0 +1,26 @@
+package intentproof
+
+import (
+	"github.com/intentproof/intentproof-sdk-go/internal/canon"
+)
+
+// Canonicalize returns the RFC 8785 canonical JSON encoding of v.
+func Canonicalize(v any) (string, error) {
+	b, err := canon.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// canonicalizeEvent returns canonical JSON for an unsigned execution event.
+func canonicalizeEvent(event map[string]any) (string, error) {
+	unsigned := make(map[string]any, len(event))
+	for k, v := range event {
+		if k == "signature" {
+			continue
+		}
+		unsigned[k] = v
+	}
+	return Canonicalize(unsigned)
+}

intentproof/canon_test.go

@@ -0,0 +1,41 @@
+package intentproof_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/intentproof/intentproof-sdk-go/intentproof"
+)
+
+func TestPolicyBodyCrossCheck(t *testing.T) {
+	body := map[string]any{
+		"schema":         "intentproof.policy.v1",
+		"policy_id":      "tnt.test",
+		"policy_version": int64(1),
+		"tenant_id":      "tnt",
+		"spec_version":   "1.0.0",
+		"scope":          map[string]any{"any_event_action_in": []any{"a"}},
+		"rules": []any{
+			map[string]any{
+				"id":       "r1",
+				"category": "required",
+				"severity": "high",
+				"spec":     map[string]any{"action": "a"},
+			},
+		},
+	}
+	got, err := intentproof.Canonicalize(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantBytes, err := os.ReadFile(filepath.Join("..", "testdata", "fixtures", "policy_body_canon.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := strings.TrimRight(string(wantBytes), "\r\n")
+	if got != want {
+		t.Fatalf("canonical mismatch:\nwant %q\ngot  %q", want, got)
+	}
+}