Release 2.4.0

Summary

Release 2.4.0 expands NCAT’s secure application baseline with authenticated-by-default routed endpoints, stronger authentication-cookie handling, forwarded-header trust diagnostics, and a substantial new audit-accountability and operational-integrity surface.

This is a backward-compatible minor release within the stable 2.x package line.

Highlights

Authenticated-by-default routed endpoints

The default scaffold now configures an ASP.NET Core fallback authorization policy requiring an authenticated user for routed endpoints that do not contain authorization metadata.

Public routes must be declared intentionally with [AllowAnonymous], .AllowAnonymous(), or equivalent anonymous metadata.

The --authProvider none template option remains available as an explicit architectural opt-out. It disables application authentication, cookie authentication, and the authenticated fallback authorization policy in generated configuration.

Stronger authentication-cookie security

Local authentication cookies now use CookieSecurePolicy.Always by default.

Applications that require plain HTTP during local development may enable:

{
  "ProjectTemplate": {
    "Authentication": {
      "Cookie": {
        "AllowInsecureHttp": true
      }
    }
  }
}

This override is accepted only in the Development environment and is rejected during startup in Testing, Staging, Production, and other environments.

Forwarded-header trust diagnostics

NCAT now detects deployments where forwarded client-IP processing and rate limiting are enabled without a deployment-specific trusted proxy or network.

Outside Development, the application logs a startup warning when this configuration could cause multiple clients to share a proxy rate-limit partition or cause client-IP logs to identify the proxy rather than the originating client.

Deployments may opt into fail-fast validation with:

{
  "ProjectTemplate": {
    "ForwardedHeaders": {
      "RequireExplicitProxyTrust": true
    }
  }
}

NCAT continues to rely on ASP.NET Core’s trusted-proxy protections and does not parse or trust arbitrary raw X-Forwarded-For values.

Audit accountability and integrity

Release 2.4.0 introduces a framework-neutral audit-accountability model for correlating application mutations with host-owned workflow, archive, SIEM, or governance records.

New capabilities include:

• Structured audit context for actor, request, operation, retry-attempt, decision, tenant, organization, correlation, trace, and span identifiers.
• One MutationBatchId shared by all audit records produced during a logical save.
• Minimized mutation audit receipts that exclude audited entity values.
• Host-replaceable audit value policies supporting include, mask, hash, omit, and truncate dispositions.
• Versioned canonical mutation manifests with deterministic ordering.
• SHA-256 manifest hashing and retained-batch verification contracts.
• DbContext-specific audit state and mutation-receipt isolation.

Canonical manifest verification proves correspondence between a receipt and a retained protected-value mutation batch. It does not by itself guarantee immutable storage, actor authenticity, legal compliance, transaction durability, or archive completeness.

Audited transaction coordination

Applications may opt into IApplicationAuditedTransaction to coordinate:

• Business mutations.
• NCAT audit rows.
• Database-generated value completion.
• Mutation receipt generation.
• Optional database-local completion handoffs.

Coordinator-owned operations use the configured EF Core execution strategy and a relational transaction. Existing transactions may be joined through savepoints while preserving responsibility for the outer commit or rollback.

Direct SaveChanges and SaveChangesAsync remain supported for applications that do not opt into transaction coordination.

Durable audit-completion outbox

NCAT now includes an optional, provider-neutral audit-completion outbox.

The outbox supports:

• Atomic staging with the originating application transaction.
• Stable destination and mutation idempotency keys.
• Post-commit dispatch.
• Bounded exponential retry behavior.
• Deferred delivery when no publisher is registered.
• Retryable, terminal failure, and dead-letter states.
• Minimized health and operator query projections.

The outbox is a durable local handoff. It is not a distributed queue and does not promise exactly-once delivery.

Audit reconciliation, health, and metrics

New reconciliation services compare retained mutation audit batches with completion-outbox records and detect:

• Missing completion records.
• Missing retained audit batches.
• Audit record count mismatches.
• Canonical manifest verification failures.
• Incomplete generated values.
• Malformed correlation.
• Duplicate completion records.
• Stale pending or retry-ready delivery.
• Terminal delivery failures.
• Dead-lettered work.

Reconciliation findings use stable reason codes, severities, remediation states, and append-only remediation evidence.

NCAT also exposes audit-integrity health status and provider-neutral metrics for open findings, manifest failures, missing completions, backlog size, pending age, retries, and dead letters.

Security and quality improvements

This release also includes:

• Property-based testing for persistence normalization and canonicalization invariants.
• NuGet dependency lock files and expanded locked-restore validation.
• Updated .NET, Entity Framework Core, OpenTelemetry, testing, and supporting dependencies.
• Stronger GitHub Actions token-permission scoping.
• Immutable action pinning and runner monitoring.
• Expanded OpenSSF Scorecard and Best Practices integration.
• Improved CodeQL, dependency-review, OWASP Dependency-Check, and release-evidence workflows.
• Expanded migration, template, Docker, authorization, authentication, and cross-platform smoke-test coverage.
• Removal of obsolete source and test placeholders.

Compatibility

• NuGet package ID remains NetCoreApplicationTemplate.
• Template short name remains netcoreapp-template.
• Internal template identity and group identity are unchanged.
• Existing generated projects are not modified automatically.
• Strict forwarded-header validation remains opt-in.
• Audited transaction coordination, completion outbox, reconciliation, and hosted workers remain opt-in.
• NCAT remains independent of AsiBackbone and does not require an external governance, archive, SIEM, or audit product.

Install

dotnet new install NetCoreApplicationTemplate::2.4.0

Generate the default authenticated scaffold:

dotnet new netcoreapp-template -n ContosoSecurityPortal

Generate the explicit authentication-disabled variant:

dotnet new netcoreapp-template `
  --name ContosoNoAuth `
  --authProvider none

Upgrade guidance

Installing version 2.4.0 updates the locally installed template for future project generation. Existing applications generated from earlier versions are not automatically changed.

Consumers adopting the new defaults manually should review:

• Fallback authorization configuration and explicitly anonymous routes.
• Authentication-cookie HTTPS requirements.
• Trusted proxy and forwarded-header configuration.
• EF Core migrations for the new audit-completion and reconciliation records.
• Audit value minimization policies before enabling production auditing.
• Retry, dead-letter, reconciliation, health, and alerting thresholds before enabling the outbox or scheduled reconciliation worker.