release: v1.7.0 (lockstep); generalize ADR-001 (drop private consumer name)

The framework ADR must be self-contained: it described the motivating failure
modes by naming a specific downstream service and one of its internal ADRs, which
no framework reader has context for. Reworded to 'a downstream service' and to the
general authorization-boundary rationale.

CHANGELOG.md

@@ -6,6 +6,20 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.7.0] — 2026-08-14
+
+Minor — coordinated framework release (lockstep versioning). No API changes in this module.
+
+### Docs
+
+- Generalized **ADR-001** (request binding): removed the reference to a specific private consumer
+  service and its internal ADR; the motivation is now stated in general terms. The framework's ADRs
+  must be self-contained. No code change.
+
+### Changed
+
+- Bumped `contracts`, `core` to v1.7.0.
+
 ## [1.6.0] — 2026-08-13
 
 Minor — request binding from path and query, not only the JSON body.

README.md

@@ -1,6 +1,6 @@
 # einherjar/web
 
-[![version](https://img.shields.io/badge/version-v1.6.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
+[![version](https://img.shields.io/badge/version-v1.7.0-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)
 

docs/adr/ADR-001-request-binding.md

@@ -26,7 +26,7 @@ So the two most ordinary REST shapes — `GET /roles/{id}` and
 `HandlerFunc` and hand-write the decode, the validation call, the encoding and the
 status. This is a **correctness** problem, not only ergonomics: `HandlerFunc` is the
 single path by which a handler reaches production without `v.Struct(req)` ever
-running. Two failure modes followed, both observed in a consumer (`kch-core-svc`):
+running. Two failure modes followed, both observed in a downstream service:
 
 1. **Unvalidated bounds** — a list endpoint that forgets to clamp answers
    `?per_page=99999`; the validator that would refuse it is not in the code path.
@@ -73,8 +73,9 @@ validates the assembled struct once with the `valid.Validator` already in scope.
 There is no `header:` tag, in this version or a later one. Headers are middleware's
 concern (authentication, request identity, tenancy). A `header:` tag would make one
 specific mistake ergonomic — filling a tenant/actor identifier from a value the
-client fully controls — which `kch-core-svc`'s own ADR-007 forbids. Reducing that
+client fully controls, exactly the boundary a service's own authorization rules
-mistake to one word in a struct tag would make it likely rather than merely possible.
+exist to defend. Reducing that mistake to one word in a struct tag would make it
+likely rather than merely possible.
 
 ## Options considered
 

go.mod

@@ -3,8 +3,8 @@ module code.nochebuena.dev/einherjar/web
 go 1.26
 
 require (
-	code.nochebuena.dev/einherjar/contracts v1.6.0
+	code.nochebuena.dev/einherjar/contracts v1.7.0
-	code.nochebuena.dev/einherjar/core v1.6.0
+	code.nochebuena.dev/einherjar/core v1.7.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	golang.org/x/time v0.15.0

go.sum

@@ -1,7 +1,7 @@
-code.nochebuena.dev/einherjar/contracts v1.6.0 h1:Y+8B+m4kQR5l/6lMY7SYdvIbwhFOnliCXDv9oBCOUP4=
+code.nochebuena.dev/einherjar/contracts v1.7.0 h1:yhbtmvE8u6KXcuG95p888+4tDIiTXDf5z/siKrjGbrc=
-code.nochebuena.dev/einherjar/contracts v1.6.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
+code.nochebuena.dev/einherjar/contracts v1.7.0/go.mod h1:ccltUtrFb5+MEJdkx2VVEUL+xC5pupVlVVsMM8AlCWI=
-code.nochebuena.dev/einherjar/core v1.6.0 h1:6cQIYZliw0hcuk7Cy44swleLC1Ch8WFxTkkHsGxkAFk=
+code.nochebuena.dev/einherjar/core v1.7.0 h1:gdjNEgO8E/ALppyBldj27iKQQlWbL/OWV6asdxWLXqU=
-code.nochebuena.dev/einherjar/core v1.6.0/go.mod h1:azRKvJBtMWGp8jhveG1fZc9jlPTwXu8clvBdXIjTB9k=
+code.nochebuena.dev/einherjar/core v1.7.0/go.mod h1:IvSCG7XL4gNyoylwlClKj3jepWBLAKb2QKAgumTRkug=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=