01
Two release refs
No exported symbol may change across two consecutive tagged release refs.
Module Stability
Plumego separates its surface into four tiers. The 9 stable roots are the only surfaces with a long-term compatibility promise. Everything else has a label that tells you exactly how much to trust it.
Read across each row: what the tier promises, what to do with it, and which modules belong to it.
coreroutercontractmiddlewaresecuritystorehealthlogmetrics reference/standard-servicecmd/plumego x/restx/gatewayx/websocketx/observabilityx/tenantx/frontendx/messaging x/aix/datax/fileapix/openapix/resiliencex/rpcx/validatex/data/cachex/gateway/discoveryx/gateway/ipcx/messaging/mqx/messaging/pubsubx/messaging/schedulerx/messaging/webhookx/observability/devtoolsx/observability/ops These are the only modules with a long-term API compatibility promise. They are the recommended foundation for all production services built on Plumego.
Seven families have completed the promotion checklist: two consecutive tagged release refs with no API changes, release-backed snapshots, and owner sign-off. Safe to adopt, but check release notes before upgrading.
beta
CRUD resource controllers and REST conventions
owner: platform-apibeta
Proxy, rewrite, load balancing, and edge transport
owner: edgebeta
WebSocket hub and explicit route registration
owner: realtimebeta
Exporter, tracer, collector, and adapter wiring
owner: observabilitybeta
Per-tenant routing, quota enforcement, and JWT-backed policy
owner: tenantbeta
Static asset serving, SPA embedding, and pre-compressed delivery
owner: assetsbeta
Async messaging, queues, pubsub flows, and inbound webhook delivery
owner: messagingA module does not become stable by declaration. Beta requires two consecutive tagged release refs with no API changes, release-backed snapshots, and owner sign-off.
01
No exported symbol may change across two consecutive tagged release refs.
02
API snapshots are recorded at both refs and compared automatically by CI.
03
The module owner confirms compatibility obligations in writing before the status field changes.
machine-readable ledger
specs/extension-beta-evidence.yaml records release refs, snapshot paths, owner
sign-off state, and open blockers for every candidate module.
# promotion evidence for x/websocket
module: x/websocket
base_ref: v0.1.0
head_ref: v0.2.0
snapshot_base: docs/evidence/extension/snapshots/websocket-v0.1.0.json
snapshot_head: docs/evidence/extension/snapshots/websocket-v0.2.0.json
api_diff: none
owner_signoff: true Every check below is machine-executed. A release cannot proceed if any check fails.
# one command runs all gates
make gates
# gofmt -l . ← zero unformatted files
# go run ./internal/checks/dependency-rules ← stable roots cannot import x/*
# go run ./internal/checks/module-manifests ← every module declares its boundary
# go run ./internal/checks/reference-layout ← reference apps match canonical shape
# go test -race -timeout 30s ./... ← full race-detector test suite Start from the reference app, verify your module choices against the stability matrix, then expand.