Skip to content

Release 0.13.0

Choose a tag to compare

View all tags
@cdcavell cdcavell released this 02 Sep 19:53
· 54 commits to main since this release
v0.13.0
f05d5fc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ASI Backbone Learning v0.13.0 is an educational architecture release focused on design choice, critique, adoption boundaries, and authority selection.

Earlier releases established and expanded the governed-execution model. Version 0.13.0 goes further by asking a more mature set of questions:

When should a pattern be used, when should a simpler architecture win, and how can unsafe authority paths be recognized before they become production behavior?

This release adds new architecture guidance, completes the currently defined advanced hands-on lab scope, publishes a substantial practitioner article on roles, claims, and capability authority, expands regional and regulated-system material, and migrates the executable sample test projects to xUnit 4.

Highlights

Advanced Hands-On Lab Path Completed

Version 0.13.0 completes the currently defined Milestone 5 hands-on lab scope with three new advanced exercises.

Design a Regional and Tenant Policy Layer

Learners design an explicit multi-authority policy overlay for a conventional enterprise data-export scenario.

The exercise explores:

  • global, regional, tenant, application, and operation policy layers;
  • explicit authority and precedence;
  • mandatory narrowing;
  • delegated overrides;
  • composite provenance;
  • missing-policy behavior;
  • deterministic composition;
  • policy and resource drift;
  • execution-time freshness;
  • host-owned execution invariants.

The lab reinforces:

Registration order must not silently become policy authority.

Analyze a Deliberately Flawed High-Consequence Workflow

This synthesis-oriented lab begins with a plausible but intentionally unsafe account-disable workflow.

Learners must discover defects rather than being handed a predetermined checklist.

The exercise examines:

  • caller-controlled versus authoritative context;
  • AI recommendation versus policy authority;
  • acknowledgment and escalation;
  • stale approval caching;
  • broad standing credentials;
  • replay and concurrency;
  • fail-open dependency behavior;
  • alternate execution paths;
  • resource drift;
  • incomplete evidence;
  • decision versus execution semantics.

The core review question is:

What authority paths still work when the system's assumptions fail?

Critique AI-Owned Proposal and Execution Authority

This lab deliberately starts from an architecture where an AI agent owns:

Interpretation
      +
Tool proposal
      +
Policy-relevant context
      +
Safety judgment
      +
Credentials
      +
Execution
      +
Retries

Learners separate useful model autonomy from execution authority and redesign the workflow around host-owned enforcement.

Topics include:

  • host-owned tool registries;
  • typed proposal contracts;
  • schema and semantic validation;
  • authoritative context reconstruction;
  • credential isolation;
  • explicit governance outcomes;
  • acknowledgment and escalation;
  • scoped continuation authority;
  • retry boundaries;
  • execution evidence.

The recurring invariant remains:

AI proposes execution
        ≠
Authority to execute

The lab also explicitly examines lower-consequence scenarios where greater AI autonomy may be reasonable.

New Practitioner Article

Do You Need a Capability Token, or Are Roles and Claims Enough?

Version 0.13.0 publishes a substantial standalone architecture guide for .NET and ASP.NET Core developers.

The article rejects the common maturity-ladder assumption:

Roles
  ↓
Claims
  ↓
Capabilities

and replaces it with:

Choose the authority model that matches the lifecycle and trust boundary you actually have.

Three scenarios demonstrate where each model clearly fits.

Roles

Roles are appropriate when authority is stable, organizational, and consumed immediately within the same trusted host.

Claims and Resource Authorization

Claims and resource-based authorization become a better fit when trusted actor attributes and current resource state determine permission.

Capability Authority

A separately issued capability becomes useful when an allowed decision must become narrow continuation authority for a later or different executor.

The article also covers:

  • standing versus continuation authority;
  • identity claims versus caller assertions;
  • operation/resource/audience binding;
  • issuer trust;
  • capability provenance;
  • expiration versus freshness;
  • replay and atomic bounded use;
  • revocation and cancellation;
  • queue custody;
  • sender constraining versus audience binding;
  • capability validation patterns in ASP.NET Core;
  • threat modeling;
  • failure behavior;
  • when capability infrastructure is overengineering.

A central clarification is:

A capability is an authority-lifecycle concept, not simply a JWT with different claims.

Related standards are discussed where useful, including OAuth 2.0 Token Exchange, Rich Authorization Requests, DPoP, certificate-bound access tokens, and GNAP, without presenting those standards as interchangeable with the generic capability model.

Expanded Architecture Guidance

Version 0.13.0 adds several substantial architecture documents that broaden Learning beyond isolated governed-execution mechanics.

Growing Beyond a Simple Application Structure

Provides guidance for recognizing when a small application structure is still sufficient and when architectural decomposition begins to earn its cost.

The emphasis remains on deliberate evolution rather than premature abstraction.

Accountable Systems Infrastructure and Governed Execution

Connects the broader Accountable Systems Infrastructure framing to concrete governed-execution architecture.

The material focuses on observable responsibility boundaries rather than branding or framework adoption.

Intent-to-Execution Accountability Pattern

Explores the accountable path from proposed intent through authoritative context, decision, execution, and evidence.

The pattern makes responsibility explicit at each transition.

Constraint-Conditioned Decision Model

Adds a deeper architectural treatment of decisions conditioned by explicit constraints rather than hidden evaluator behavior.

This extends Learning's existing work on constraint composition, precedence, and policy evidence.

Governance Tool Selection and Composition

Examines how governance mechanisms should be selected and combined based on the problem they solve rather than accumulated as architectural ceremony.

The guidance reinforces an established principle:

Use the smallest architecture that preserves the required boundary.

Regional and Regulated-System Guidance

Two additional advanced documents deepen the application of governed execution to organizational and jurisdictional contexts.

Regional Policy and Operational Gateways

Explores how regional policy requirements interact with operational enforcement boundaries.

Topics include:

  • regional authority;
  • resource location;
  • policy overlays;
  • gateways;
  • execution-time validation;
  • provenance;
  • drift.

Governed Execution in Regulated Systems

Provides a careful architectural treatment of governed execution in systems subject to stronger oversight and evidence expectations.

The material remains explicitly technical and does not claim:

  • legal compliance;
  • regulatory certification;
  • automatic conformance;
  • jurisdiction-specific legal correctness.

The purpose is to improve system structure and evidence, not to replace legal or compliance review.

Adoption and Entry-Point Guidance

A new Adoption Personas and Entry Points document helps readers identify the parts of Learning most relevant to their situation.

This supports developers and architects approaching the repository from different starting points, including:

  • ordinary ASP.NET Core applications;
  • policy-driven systems;
  • distributed workflows;
  • AI-assisted applications;
  • higher-consequence operations;
  • architecture review and education.

The goal is to make Learning easier to enter without requiring readers to adopt the entire vocabulary or curriculum first.

xUnit 4 Migration

The executable Learning sample test projects have been migrated to xUnit 4.

Representative package changes include:

xunit.v3 3.2.2
        ↓
xunit.v3.mtp-off 4.0.0

xunit.runner.visualstudio 3.1.5
        ↓
xunit.runner.visualstudio 4.0.0

Microsoft.NET.Test.Sdk 18.8.1
        ↓
Microsoft.NET.Test.Sdk 18.9.0

The migration updates the repository's sample-testing foundation while preserving the architectural purpose of the tests:

Important boundary
      ↓
Observable invariant
      ↓
Executable verification

The sample suite remains teaching infrastructure rather than a production framework.

Roadmap Progress

Version 0.13.0 substantially advances the hands-on and architecture portions of the Learning roadmap.

The currently listed advanced lab objectives are now complete, including:

  • competing policy architecture comparison;
  • regional and tenant policy design;
  • high-consequence workflow critique;
  • AI proposal-versus-execution-authority critique.

Future labs should now be added selectively where a distinct learning gap is demonstrated rather than simply to increase lab count.

This reflects a shift from:

Build more examples

toward:

Identify missing reasoning
        ↓
Add only the material that closes that gap

Publication and Navigation Updates

This release updates the Learning publication surfaces to include the new material.

Changes include:

  • Articles archive and navigation;
  • Labs navigation;
  • Architecture navigation;
  • Advanced navigation;
  • Getting Started navigation;
  • contextual cross-links;
  • article backlog status;
  • roadmap status.

The goal remains to make related material discoverable without turning the documentation site into a dense link catalog.

Publication and Archival Metadata

Release metadata has been synchronized for the new educational snapshot:

CITATION.cff
version: 0.13.0
date-released: 2026-09-02

.zenodo.json
version: 0.13.0

This keeps GitHub release identity, citation metadata, and archival metadata aligned.

What v0.13.0 Represents

Version 0.12.0 focused heavily on distributed and time-sensitive governance.

Version 0.13.0 adds another layer of maturity:

Know the pattern
      ↓
Understand the boundary
      ↓
Compare alternatives
      ↓
Recognize failure paths
      ↓
Choose the smallest sufficient design
      ↓
Prove the critical invariant

The repository is increasingly not just a catalog of architectural patterns, but an environment for architecture reasoning, criticism, comparison, and implementation restraint.

A recurring theme across this release is:

More machinery is not automatically more governance, more security, or better architecture.

Release Scope

ASI Backbone Learning v0.13.0 remains an educational and architectural release.

It does not introduce:

  • a production governance engine;
  • an identity provider;
  • a capability-token standard;
  • a regulatory or compliance certification;
  • a legal framework;
  • an autonomous-agent runtime;
  • an AI model;
  • an AGI or ASI implementation;
  • a guarantee that one architecture is universally correct.

The examples, diagrams, samples, and labs are teaching artifacts intended to make trust, authority, policy, execution, evidence, and tradeoffs easier to examine.

The repository continues to pursue its core goal:

Teach architectural reasoning through explanations, executable evidence, competing designs, hands-on critique, and explicit trust boundaries.

Assets 2
Loading