Release v22.154.0

Added

• Opt-in signed forwarded-identity verification for both Arc hosts, with freshness and replay protection; it requires a compatible signer and separately provisioned integration keys, and is disabled by default. (part of #2837)
• Register ITenantMembership to verify that the caller belongs to a request-selected tenant; denied commands, queries and observable connections return 403 Forbidden.
• Startup diagnostics and documentation explain request-selected tenancy and explicitly configured trusted-ingress membership enforcement.
• CommandScenario gives the state you seed to protected read-model parameters of a command's Handle(), so specs give state and assert the outcome without configuring decision reads. (#3586)
• Analyzer ARCCHR0039 (Info) suggests taking a plain read-model parameter instead of IDecisionReads in a command's Handle(). (#3586)

Changed

• Given.ForEventSource(...).ReadModel(...) in CommandScenario now throws PinnedPerStreamReadModelIsNotSupported for a per-stream read model, whose route a source-only pin cannot identify. Seed such models with Given.ForEventSource(...).OnRoute(...).Events(...) instead.

Security

• Applications can opt in to caller-to-tenant membership verification across Arc entry points without changing existing defaults.

Deprecated

• CommandScenario.UseDecisionReads() is obsolete; the scenario selects decision reads from the command's declarations. Remove the call.