Release v1.7.0

Box Office now refuses what a tenant has not got and decides whether a tenant may start compute before the work starts.

Added

• Module gating: commands and queries in a namespace a module owns are refused with ModuleNotEntitled when the tenant does not have the module, a gated reactor asks IModuleGate.Admits(this) and skips the event, and an included module is always admitted. A module trial or grant stops admitting the day after its last day without any event. BoxOfficeOptions.EnforceModules turns enforcement off; it is on by default. (#45)
• Compute admission: IComputeAdmission.Admit(meter) decides before work starts whether the tenant may run it, returning admitted, AtConcurrencyLimit, AllowanceExhausted, BudgetReached, or parked until the next period starts, and End frees the concurrent slot. The concurrency limit is decided from the tenant's start and stop facts under a concurrency scope, so two starts for the last slot admit one. (#49)
• The first refusal for an allowance in a period records that it ran out and reports AllowanceExhausted to the operator once; later refusals in the period are logged and counted, and record nothing. (#49)
• SetComputeBudget and SetComputeConcurrencyLimit let a product's maintainers set a budget below the operator's allowance and a concurrency limit per meter, and the CurrentLimits query returns them, with generated proxies in @cratis/showrunner.boxoffice. (#49)
• BoxOfficeOptions.MaximumWorkDuration (12 hours by default) bounds how long admitted work that was never ended holds its concurrent slot.
• Documentation for module gating and compute admission.

Changed

• Register the BoxOffice.ManageCompute authorization policy next to BoxOffice.ManageSeats, to say who may set compute budgets and concurrency limits.
• Cratis.Showrunner.BoxOffice now references Cratis.Showrunner.BoxOffice.Offering, whose declared modules and meters gating and admission read. Compute admission needs AddBoxOfficeOffering and AddBoxOfficeMetering.