NimBus v4.0.0

NimBus 4.0.0 adds private networking, an operator MCP endpoint, a redesigned Monitor and a Failed messages page across all endpoints, and as a major release it makes the storage providers agree on missing rows and removes the deprecated API.

Highlights

• Added a private networking deployment mode (--network-mode private on nb infra apply and nb setup): every NimBus endpoint is reached only through private endpoints in your subnets, with a pre-flight DNS check and a cleanup path back to public mode. Public mode stays the default.
• Added an opt-in operator MCP endpoint, /mcp, to the WebApp: eleven read-only tools let AI agents inspect endpoint health, messages, metrics and failure classifications with the caller's NimBus roles. It uses its own Microsoft Entra app registration in Azure and needs no sign-in under Aspire.
• Improved the Monitor wall: a flat display with server-computed failing-since times and acknowledgements shared across devices.
• Added Failed messages, one page of failed and dead-lettered messages across every endpoint you can read.
• Fixed the storage providers disagreeing about missing rows and absent fields; Cosmos DB, SQL Server and in-memory now behave the same, pinned by conformance tests.
• Fixed SQL Server dropping the handoff fields on message rows and stamping status timestamps at datetime precision, which could return the wrong row as a session's latest update.
• Fixed the Resolver writing a retry audit entry before the event writes it records had succeeded.
• Fixed Admin → Storage containers offering to delete the Integration Intelligence containers.

Compatibility

⚠️ Breaking changes:

• Single-row getters on IMessageTrackingStore and IEndpointMetadataStore return null for a missing row on every provider; SQL Server and in-memory used to throw EndpointNotFoundException or MessageNotFoundException. SQL Server returns null, not "", for NULL optional strings. Cosmos DB GetEvent ignores removed and archived rows and returns the latest update, GetFailedMessage returns the newest message that carries ErrorContent, and GetEventById matches the stored {EventId}_{SessionId} id on every provider.
• The Service Bus defer API is removed: Defer, DeferOnly, ReceiveNextDeferred, ReceiveNextDeferredWithPop and RestoreNextDeferred on IMessageContext, and DeferAsync and ReceiveDeferredMessageAsync on IServiceBusSession. Legacy deferred sequence numbers no longer block a session, and a ContinuationRequest is completed without processing. If an endpoint ever used the defer API, let 3.x drain its deferred messages before upgrading; nb endpoint purge --state Deferred removes any left over.
• IPermanentFailureClassifier is removed; implement IFailureDispositionClassifier, which DefaultPermanentFailureClassifier now implements. StrictMessageHandler has one constructor with optional parameters, replacing the three that took IPermanentFailureClassifier.
• INimBusMessageStore includes IEndpointAcknowledgementStore, so custom aggregate stores must add its three members, and endpointacknowledgements is now a reserved endpoint id.
• Nullable annotations changed on public surface: IPublisherClient.Publish messageId, IServiceBusManagement.CreateCustomRule action and UpdateSubscription forwardTo, IEventJsonMasker.TryCollectSensitiveValues and IMessageContext.DeadLetter exception, plus model properties that are now string?. Implementations with nullable enabled see CS8767 until they match.
• The NimBus.Mcp stdio server is removed; it was never published as a package. Point MCP clients at the WebApp's /mcp, and use the NimBus.Agents REST SDK for agents that publish or subscribe on the bus.
• The Resolver namespace NimBus.Broker.Services is now NimBus.Resolver.Services, and the WebApp's generated storage-hook action is StoragehookReceiveAsync; the route is unchanged.

IResponseService.SendContinuationRequestToSelf and SessionState.DeferredSequenceNumbers are newly obsolete and are removed in v5.

On Cosmos DB, run nb infra apply before nb deploy apps: it declares the new endpointacknowledgements container, which the WebApp can't create under managed identity. SQL Server applies migrations 0020_EndpointAcknowledgements and 0021_MessageHandoff on startup; with VerifyOnly, run them from your pipeline first. Resubmit, skip and resubmit-with-changes answer 404 instead of 400 for a missing message, and the event lookup answers 404 instead of 500 for an unknown event. Monitor acknowledgements stored in the browser by 3.x are dropped. /mcp stays off until NimBus__Mcp__Enabled is set; see the operator MCP guide and private networking.

This release was validated at commit 0acf177 with the full .NET Release build and test suite in CI, live Cosmos DB and SQL Server conformance suites with no skipped tests, Service Bus emulator compatibility checks, the CRM/ERP end-to-end suite, 458 frontend tests, and the frontend production build. The /mcp Microsoft Entra sign-in is covered by tests with locally signed tokens and hasn't yet been piloted against a live tenant.

PRs: #138, #139, #140, #141, #142, #143, #144, #145, #146, #147, #148, #150, #151, #152, #153, #154, #155, #156, #157, #158

Commits: v3.11.0...v4.0.0