Release 1.0.0

This is the first stable release of the AsiBackbone Reference Application. It establishes the stable 1.x compatibility contract defined by the Stable Release Policy v1, refreshes the integration baseline to NCAT 2.11.7 with AsiBackbone 7.5.2, and makes 1.x the supported security line.

The Reference Application remains an example, not a product: an ASP.NET Core reference host showing how NCAT and AsiBackbone fit together. Its sample governance rules illustrate patterns and are not recommendations for any specific domain.

Added

• The first stable 1.x compatibility contract for the Reference Application, covering the documented HTTP surface, reason codes, configuration section names, persisted governance evidence, supported upgrade boundary, and documented host integration extension points defined by the Stable Release Policy v1.

Changed

• Release metadata now identifies the repository as stable 1.0.0.
• The supported security line is now 1.x; the previous 0.x prereleases are no longer supported after 1.0.0.
• The integration baseline was refreshed to NCAT 2.11.7 with AsiBackbone 7.5.2, including the generated template changes and regenerated package lock files (#108, #109).
• The adopted NCAT version is now recorded in eng/ncat-baseline.json. Reproducibility validation requires the manifest and the annotated baseline tag to agree, and documentation regression tests keep the README, documentation home, and Step 1 current-baseline markers synchronized while preserving historical refresh examples (#112).
• Replaced the documentation logo, favicon, and social preview with the Reference Application glyph from the AsiBackbone glyph family. The social card now names this site instead of reusing the Learning card. File names and image dimensions are unchanged (#113).

Upgrade notes

• Database upgrades are supported from v0.1.0-alpha.11 onward and are tested on every pull request. See Upgrade between releases.
• Back up both the SQLite database and the Data Protection key ring before applying migrations.
• Migrations are forward-only. Roll back only by restoring that backup; do not run older application binaries against an upgraded database.
• 0.x prereleases no longer receive security fixes. Upgrade to 1.x, and report suspected vulnerabilities privately as the Security Policy describes.

Release validation

• The annotated v1.0.0 tag resolves to 8c4ba1c, and ./scripts/Validate-StableRelease.ps1 -RequireStable -Tag v1.0.0 passes against it.

Full changelog: v0.1.0-alpha.12...v1.0.0

Release 0.1.0-alpha.12

Summary

This prerelease completes the repository’s stable-readiness groundwork while remaining a 0.x prerelease. It adds production-shaped deployment validation, release-to-release upgrade testing, protected coverage floors, stronger governance observability, and a complete acknowledgment workflow.

Added

• A production-shaped Docker Compose configuration with external authentication, explicit host and proxy trust, encrypted persistent Data Protection keys, separate migrations, and no Development-only components.
• Automated upgrade validation from v0.1.0-alpha.11, including evidence preservation, schema parity, idempotency, backup guidance, and recovery boundaries.
• A versioned stable-release policy defining the 1.x compatibility contract, graduation gates, release procedure, and seven-day candidate soak.
• A complete host-owned acknowledgment workflow for consequential operations, including one-time challenges, actor binding, expiration, replay protection, and persisted evidence.
• OpenTelemetry spans and metrics for governance decisions, lifecycle events, and audit reconciliation, with privacy-safe dimensions.
• Repository-owned line and branch coverage gates for the total solution and both production assemblies.
• A repository-specific security policy and an automated NCAT baseline reproducibility check.
• Updated walkthrough package guidance and benchmark provenance checks.

Changed

• SQLite is now the repository’s only supported database provider. Selecting SQL Server or another unsupported provider fails during service registration with explicit guidance.
• Audit reconciliation is registered independently of the Development-only pipeline inspector.
• The NCAT baseline is updated to 2.11.6, and AsiBackbone packages are updated to 7.5.1.
• .NET SDK, ASP.NET container, GitHub Actions, and workflow-security dependencies are updated.

Fixed

• Reconciliation no longer reports the audit-completion outbox’s own bookkeeping writes as missing completions.
• Existing false-positive bookkeeping findings from v0.1.0-alpha.11 databases are resolved during reconciliation without weakening checks for governed records.

Upgrade notes

• Database upgrades are supported from v0.1.0-alpha.11.
• Back up both the SQLite database and Data Protection key ring before applying migrations.
• Migrations are forward-only; do not run older application binaries against an upgraded database.
• SQL Server is no longer presented as supported by this repository.

This remains a prerelease and does not yet establish the stable 1.x compatibility commitment.

Full changelog: v0.1.0-alpha.11...v0.1.0-alpha.12

Reference Application 0.1.0-alpha.11

What's Changed

• Close #30 review gaps: SSE heartbeat and notifier tests by @cdcavell in #44
• Migrate ApplicationDatabase explicitly in Docker Compose by @cdcavell in #51
• Name the Development log file after the application by @cdcavell in #52
• Require the container build and inspect its images in CI by @cdcavell in #53
• Report code coverage in CI with coverlet.MTP by @cdcavell in #54
• State the current NCAT 2.11.5 baseline in the documentation by @cdcavell in #55
• Document process-local governance evidence notifications by @cdcavell in #56
• chore(deps): update AsiBackbone to 7.3.0 by @cdcavell in #63
• Issue and verify signed capability tokens with AsiBackbone 7.4.0 by @cdcavell in #64
• Add a Development-only policy simulator to the governance explorer (#59) by @cdcavell in #65
• Add Development-only decision replay to the governance explorer (#60) by @cdcavell in #66
• Add a Development-only pipeline inspector to the governance explorer … by @cdcavell in #67
• Link pipeline inspector requests through decision trace IDs with AsiBackbone 7.5.0 (#61) by @cdcavell in #68
• Add preset failure-mode and attacker scenarios to the explorer (#62) by @cdcavell in #69
• Document the completed governance sandbox (#57) by @cdcavell in #70
• Prepare ReferenceApplication 0.1.0-alpha.11 by @cdcavell in #71

Full Changelog: v0.1.0-alpha.10...v0.1.0-alpha.11

Reference Application 0.1.0-alpha.9

What's Changed

• Add governance evidence explorer by @cdcavell in #36

Full Changelog: v0.1.0-alpha.8...v0.1.0-alpha.9

Reference Application 0.1.0-alpha.8

What's Changed

• Stream governance evidence notifications with Server-Sent Events by @cdcavell in #34
• Hash and verify governance evidence by @cdcavell in #35

Full Changelog: v0.1.0-alpha.7...v0.1.0-alpha.8

Reference Application 0.1.0-alpha.10

Summary

Completes the expanded eight-step integration walkthrough by making governance observable in a safe Development experience and adding repeatable measurements of host-owned governance overhead.

Added

• BenchmarkDotNet policy-evaluation and SQLite evidence-persistence scenarios, a recorded reference snapshot, and a weekly/on-demand artifact-producing workflow.
• A resettable Development-only demonstration database that clears the complete disposable evidence store and reapplies the checked-in migrations.
• An administrator-only bounded governance load demonstration with Server-Sent Events progress, cancellation, single-run concurrency, and hard iteration and duration ceilings.
• Walkthrough Step 8 with the benchmark procedure, results, measurement boundaries, and relationship to AsiBackbone's framework benchmark baseline.

Changed

• The Development demo identity and landing-page actions now lead directly into the governance explorer experience.
• The walkthrough index, README, documentation homepage, and application landing page now report all eight integration steps complete.
• Repository package metadata and project-reference lock entries now identify version 0.1.0-alpha.10.

Security

• Reset and load controls remain absent outside Development and require the documented administrator and antiforgery boundaries.
• The load demonstration makes no HTTP self-requests and persists no synthetic governance evidence.
• The Content Security Policy and production governance path remain unchanged.

Full changelog: v0.1.0-alpha.9...v0.1.0-alpha.10

Reference Application 0.1.0-alpha.7

What's Changed

• Add governance evidence query API by @cdcavell in #32
• Add Development-only demo identity controls by @cdcavell in #33

Full Changelog: v0.1.0-alpha.6...v0.1.0-alpha.7

Reference Application 0.1.0-alpha.6

0.1.0-alpha.6 completes walkthrough Step 6: Persist and Verify Audit Evidence, the last walkthrough step. Every governed request now leaves durable evidence in the host-owned database, and each governed change is linked to the decision that permitted it in both directions.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

Upgrade note

Governed POST operations now require the new database migration. They fail closed, with HTTP 500 and without executing, if their governance decision cannot be stored. Apply the migration explicitly; it never runs at startup:

Push-Location src/ReferenceApplication.Web
dotnet tool run dotnet-ef database update --project ../ReferenceApplication.Infrastructure --startup-project . --context ApplicationDbContext
Pop-Location

The AddGovernedAuditEvidence migration only creates tables. It alters no existing table.

What changed

The evidence chain

Evidence	Where it lives	Written by
Governance decision receipt	AsiBackbone audit ledger	LedgerDecisionReceiptSink, before the endpoint runs
Application change	GovernedOperationRecords	The governed endpoint, inside NCAT's audited transaction
Mutation audit	NCAT AuditRecords, carrying the decision audit record identifier	NCAT's save pipeline
Audit completion	NCAT audit-completion outbox	Staged in the same transaction as the change
Execution lifecycle event	AsiBackbone lifecycle events	AsiBackboneAuditCompletionPublisher, when the outbox dispatches

AsiBackbone in the host-owned database

AsiBackbone's EF Core model is applied to the NCAT ApplicationDbContext, with a host-owned migration. The host still owns the provider, connection string, migrations and retention.

Evidence stored exactly as created

NCAT's save pipeline canonicalizes strings (including HTML-entity decoding), truncates timestamps to milliseconds, and mutation-audits every change. AsiBackbone's evidence is now exempt from all three, so stored evidence matches what was hashed or signed, and the audit trail isn't audited itself. Application data is handled exactly as before.

Decision receipts and mutation links

Every governed POST operation records its decision, whether allowed, denied or challenged for acknowledgment. Every mutation in a governed request carries that decision's audit record identifier, an operation execution identifier, and the decision's correlation and trace identifiers.

Audit completion as AsiBackbone lifecycle evidence

NCAT's audit-completion outbox is now enabled. Its AsiBackbone destination turns each committed change into a lifecycle event linked to the decision. Delivery is:

• idempotent across redelivery;
• conflict-checked;
• deferred until the decision exists;
• rejected when the correlation or trace identifier doesn't match.

New governed operation

POST /api/v1/governed-operations/records is an administrator-governed operation that demonstrates the complete chain.

Tests

The suite now has 598 tests, 86 of them new.

• End-to-end tests run against databases created from the real migrations. They cover the full evidence chain, denials, decision outcomes, anonymous and ungoverned requests, invalid input, and failing closed.
• Component tests cover the model and migrations, exact evidence preservation, the receipt sink, the completion publisher and the audit context.
• Edge-case tests cover the Step 4 governance rules and the Step 5 capability validator.

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (v0.1.0-alpha.4)
5. Govern endpoints	Complete (v0.1.0-alpha.5)
6. Persist and verify audit evidence	Complete (this release)

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.6+<commit>. The release uses AsiBackbone 7.2.1.

Changes

• Persist and verify audit evidence and complete walkthrough Step 6 (#21).
• Fix the Step 6 and database-setup instructions to apply the included migration instead of re-adding it (#31).

Full changelog: v0.1.0-alpha.5...v0.1.0-alpha.6

Reference Application 0.1.0-alpha.5

0.1.0-alpha.5 completes walkthrough Step 5: Govern Endpoints. The Step 4 governance rules now protect real application endpoints, which are evaluated before their actions run.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

What changed

Governed sample API

/api/v1/governed-operations demonstrates governance on application endpoints:

Endpoint	Governance	Result
GET /api/v1/governed-operations	None; explicitly anonymous	Read-only description
POST …/administrator	Administrator rule	Runs for an administrator; anyone else gets 403
POST …/capability	Capability rule and a required capability grant	Runs for an actor holding the grant; anyone else gets 403
POST …/consequential	Administrator, capability, and acknowledgment requirements	An administrator holding the grant receives a 428 acknowledgment challenge; the action does not run in Step 5

Every POST requires an authenticated user, a valid antiforgery token, and governance approval. Governance adds a boundary; it doesn't replace authorization or antiforgery protection.

Capability grants

ClaimEndpointCapabilityGrantValidator checks each scope an endpoint declares against the actor's normalized application:permission claims on authenticated identities. Declaring a scope on an endpoint never proves that the actor holds it.

Problem Details for denials

Governance denials return a safe HTTP 403 Problem Details response with the application's usual trace and request correlation fields, without exposing policy internals.

Tests

The suite now has 512 tests. New end-to-end and unit tests cover:

• each endpoint's allow and deny paths;
• the acknowledgment challenge;
• combined administrator-and-capability requirements on the consequential endpoint;
• anonymous rejection by authorization;
• antiforgery enforcement;
• the validator's handling of unauthenticated identities and acknowledgment-required decisions.

AsiBackbone 7.2.1: capability before acknowledgment

This release uses AsiBackbone 7.2.1. That version validates capability grants for every governance decision that is not already denied (AsiBackbone/AsiBackbone#887). On the consequential endpoint, an administrator without the capability grant is therefore denied with 403 rather than offered an acknowledgment challenge.

On AsiBackbone 7.2.0, the framework skipped capability validation for acknowledgment-required decisions and returned a 428 challenge instead. A test now asserts the denial, including that no acknowledgment handshake is issued (#17).

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (v0.1.0-alpha.4)
5. Govern endpoints	Complete (this release)
6. Persist and verify audit evidence	Planned

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.5+<commit>.

Changes

• Govern application endpoints and complete walkthrough Step 5 (#18).
• Update AsiBackbone to 7.2.1 so a missing capability grant is denied before any acknowledgment challenge (#19).
• Record the 7.2.1 update in the 0.1.0-alpha.5 changelog entry (#20).

Full changelog: v0.1.0-alpha.4...v0.1.0-alpha.5

Reference Application 0.1.0-alpha.4

0.1.0-alpha.4 completes walkthrough Step 4: Define Governance Rules. The host now owns a versioned sample governance policy set and an AsiBackbone policy evaluator built from it. Application endpoints are not governed until Step 5.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

What changed

Sample governance rules

Each rule applies only to endpoints that carry its policy marker:

Marker	Rule	Outcome	Reason code
AdministratorActionPolicy	The authenticated actor holds a configured administrator role, using NCAT's own authorization settings	Allow or deny	referenceapplication.actor.administrator_required
ConsequentialActionPolicy	An otherwise-allowed operation requires explicit acknowledgment; a denial is never weakened	Acknowledgment required	referenceapplication.consequential.acknowledgment_required
CapabilityProtectedActionPolicy	The endpoint declares the referenceapplication.consequential.execute capability scope	Allow or deny	referenceapplication.capability.scope_required

Stable policy identity

The policy set is version 1.0.0 with a SHA-256 hash of its canonical definition. Both values are written into every endpoint governance decision, so changing what a rule means requires a deliberate version and hash change.

Evaluator registration

AddApplicationAsiBackbone registers the rules and a scoped policy evaluator built with AsiBackbone's default fail-closed evaluator. An endpoint that carries governance metadata but has no applicable rule is now evaluated and allowed; in Step 3 it was blocked because no evaluator was registered.

Configuration note

Keep EndpointGovernanceOptions.MetadataMode at its default, Full. Reduced mode drops declared capability scopes from the evaluation metadata, so the capability rule would reject every capability-protected endpoint.

Tests

The suite now has 495 tests. Besides unit tests for each rule and for the composed evaluator, new enforcement tests run each rule through AsiBackbone's real endpoint metadata and middleware:

• administrator endpoints block non-administrator and anonymous callers before the action runs, and execute for an administrator;
• consequential endpoints don't execute without acknowledgment;
• an incomplete capability declaration is rejected; and
• an administrator who passes governance is still rejected without a valid antiforgery token.

This guards against a metadata-format mismatch that would otherwise silently disable every rule.

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (this release)
5. Govern endpoints	Planned
6. Persist and verify audit evidence	Planned

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.4+<commit>.

Changes

• Define the sample governance rules and complete walkthrough Step 4 (#16).

Full changelog: v0.1.0-alpha.3...v0.1.0-alpha.4