Reference Application 0.1.0-alpha.6

0.1.0-alpha.6 completes walkthrough Step 6: Persist and Verify Audit Evidence, the last walkthrough step. Every governed request now leaves durable evidence in the host-owned database, and each governed change is linked to the decision that permitted it in both directions.

Important

This is an alpha pre-release. The Reference Application is an example, not a product. Its sample rules illustrate patterns and are not recommendations for any specific domain.

Upgrade note

Governed POST operations now require the new database migration. They fail closed, with HTTP 500 and without executing, if their governance decision cannot be stored. Apply the migration explicitly; it never runs at startup:

Push-Location src/ReferenceApplication.Web
dotnet tool run dotnet-ef database update --project ../ReferenceApplication.Infrastructure --startup-project . --context ApplicationDbContext
Pop-Location

The AddGovernedAuditEvidence migration only creates tables. It alters no existing table.

What changed

The evidence chain

Evidence	Where it lives	Written by
Governance decision receipt	AsiBackbone audit ledger	LedgerDecisionReceiptSink, before the endpoint runs
Application change	GovernedOperationRecords	The governed endpoint, inside NCAT's audited transaction
Mutation audit	NCAT AuditRecords, carrying the decision audit record identifier	NCAT's save pipeline
Audit completion	NCAT audit-completion outbox	Staged in the same transaction as the change
Execution lifecycle event	AsiBackbone lifecycle events	AsiBackboneAuditCompletionPublisher, when the outbox dispatches

AsiBackbone in the host-owned database

AsiBackbone's EF Core model is applied to the NCAT ApplicationDbContext, with a host-owned migration. The host still owns the provider, connection string, migrations and retention.

Evidence stored exactly as created

NCAT's save pipeline canonicalizes strings (including HTML-entity decoding), truncates timestamps to milliseconds, and mutation-audits every change. AsiBackbone's evidence is now exempt from all three, so stored evidence matches what was hashed or signed, and the audit trail isn't audited itself. Application data is handled exactly as before.

Decision receipts and mutation links

Every governed POST operation records its decision, whether allowed, denied or challenged for acknowledgment. Every mutation in a governed request carries that decision's audit record identifier, an operation execution identifier, and the decision's correlation and trace identifiers.

Audit completion as AsiBackbone lifecycle evidence

NCAT's audit-completion outbox is now enabled. Its AsiBackbone destination turns each committed change into a lifecycle event linked to the decision. Delivery is:

• idempotent across redelivery;
• conflict-checked;
• deferred until the decision exists;
• rejected when the correlation or trace identifier doesn't match.

New governed operation

POST /api/v1/governed-operations/records is an administrator-governed operation that demonstrates the complete chain.

Tests

The suite now has 598 tests, 86 of them new.

• End-to-end tests run against databases created from the real migrations. They cover the full evidence chain, denials, decision outcomes, anonymous and ungoverned requests, invalid input, and failing closed.
• Component tests cover the model and migrations, exact evidence preservation, the receipt sink, the completion publisher and the audit context.
• Edge-case tests cover the Step 4 governance rules and the Step 5 capability validator.

Walkthrough status

Step	Status
1. Scaffold from NCAT	Complete (v0.1.0-alpha.1)
2. Add AsiBackbone packages	Complete (v0.1.0-alpha.2)
3. Register AsiBackbone services	Complete (v0.1.0-alpha.3)
4. Define governance rules	Complete (v0.1.0-alpha.4)
5. Govern endpoints	Complete (v0.1.0-alpha.5)
6. Persist and verify audit evidence	Complete (this release)

Versioning

Assemblies report version 0.1.0.0, and the informational version is 0.1.0-alpha.6+<commit>. The release uses AsiBackbone 7.2.1.

Changes

• Persist and verify audit evidence and complete walkthrough Step 6 (#21).
• Fix the Step 6 and database-setup instructions to apply the included migration instead of re-adding it (#31).

Full changelog: v0.1.0-alpha.5...v0.1.0-alpha.6