Reference Application 0.1.0-alpha.4

0.1.0-alpha.4 completes walkthrough Step 4: Define Governance Rules. The host now owns a versioned sample governance policy set and an AsiBackbone policy evaluator built from it. Application endpoints are not governed until Step 5.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

What changed

Sample governance rules

Each rule applies only to endpoints that carry its policy marker:

Marker	Rule	Outcome	Reason code
AdministratorActionPolicy	The authenticated actor holds a configured administrator role, using NCAT's own authorization settings	Allow or deny	referenceapplication.actor.administrator_required
ConsequentialActionPolicy	An otherwise-allowed operation requires explicit acknowledgment; a denial is never weakened	Acknowledgment required	referenceapplication.consequential.acknowledgment_required
CapabilityProtectedActionPolicy	The endpoint declares the referenceapplication.consequential.execute capability scope	Allow or deny	referenceapplication.capability.scope_required

Stable policy identity

The policy set is version 1.0.0 with a SHA-256 hash of its canonical definition. Both values are written into every endpoint governance decision, so changing what a rule means requires a deliberate version and hash change.

Evaluator registration

AddApplicationAsiBackbone registers the rules and a scoped policy evaluator built with AsiBackbone's default fail-closed evaluator. An endpoint that carries governance metadata but has no applicable rule is now evaluated and allowed; in Step 3 it was blocked because no evaluator was registered.

Configuration note

Keep EndpointGovernanceOptions.MetadataMode at its default, Full. Reduced mode drops declared capability scopes from the evaluation metadata, so the capability rule would reject every capability-protected endpoint.

Tests

The suite now has 495 tests. Besides unit tests for each rule and for the composed evaluator, new enforcement tests run each rule through AsiBackbone's real endpoint metadata and middleware:

• administrator endpoints block non-administrator and anonymous callers before the action runs, and execute for an administrator;
• consequential endpoints don't execute without acknowledgment;
• an incomplete capability declaration is rejected; and
• an administrator who passes governance is still rejected without a valid antiforgery token.

This guards against a metadata-format mismatch that would otherwise silently disable every rule.

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (this release)
5. Govern endpoints	Planned
6. Persist and verify audit evidence	Planned

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.4+<commit>.

Changes

• Define the sample governance rules and complete walkthrough Step 4 (#16).

Full changelog: v0.1.0-alpha.3...v0.1.0-alpha.4