RuleGate 1.0.0

RuleGate 1.0.0 is the first stable release of the provider-independent authorization toolkit for .NET and Angular.

Highlights

• Promotes the frozen RuleGate 1.0 API from release candidate to stable without additional public API changes.
• Publishes all six synchronized NuGet packages and all three synchronized npm packages at 1.0.0.
• Supports .NET Core 3.1 and .NET 5–10, Angular 9–22 through the appropriate frontend package, YAML manifests, deterministic CLI generation, optional Keycloak helpers, diagnostics, atomic policy reload, and telemetry.
• Uses the MIT license for the stable package line.

Verification

The stable artifacts were verified against 1.0.0-rc.1, across the complete .NET and Angular consumer matrices, package signatures and provenance, deterministic/reproducible build checks, security gates, benchmarks, and bounded concurrency stress tests.

See CHANGELOG.md and the migration guide for complete details.

RuleGate 1.0.0-rc.1

RuleGate 1.0.0-rc.1 freezes the candidate 1.0 public API across the coordinated six-package NuGet family and three-package npm family.

Highlights

• Public API snapshots and deterministic API-freeze verification for every supported package surface
• Bounded YAML document, node, depth, scalar, collection, alias, and policy-complexity limits
• Stable manifest load and validation failure codes, requirement-depth protection, and deterministic fuzz coverage
• Byte-for-byte NuGet and npm artifact reproducibility checks
• Package-only consumer verification across .NET Standard 2.0, .NET Core 3.1, .NET 5-10, and Angular 9-22
• MIT licensing for RuleGate-owned source and packages

Breaking change from 0.9.0-preview.4

The ASP.NET Core integration now uses IRuleGateClock instead of exposing TimeProvider in its public API. Applications that replace RuleGate evaluation time must update their registration. See the RuleGate 1.0 migration guide.

Published packages

NuGet:

• Fotbiler.RuleGate.Abstractions
• Fotbiler.RuleGate.Core
• Fotbiler.RuleGate.Manifest
• Fotbiler.RuleGate.AspNetCore
• Fotbiler.RuleGate.Cli
• Fotbiler.RuleGate.Keycloak

npm:

• @fotbiler/rulegate-client
• @fotbiler/rulegate-angular-legacy
• @fotbiler/rulegate-angular

All packages above use version 1.0.0-rc.1.

Verification

• 22 .NET test runs plus package, CLI, generated-code, compatibility, concurrency, and 18/18 BenchmarkDotNet dry-run gates
• 26 Angular tests, 7 generator tests, exact-tarball Angular 22 production build, and Angular 9-22 package consumers
• GitHub Actions trusted publishing with npm provenance

See the changelog and roadmap for full details.

RuleGate 0.9.0-preview.4

Added

• Added .NET Standard 2.0 targets for Abstractions, Core, and Manifest and
  ASP.NET Core/Keycloak targets from .NET Core 3.1 through .NET 10.
• Added @fotbiler/rulegate-client for framework-independent frontend state
  and @fotbiler/rulegate-angular-legacy for Angular 12–19 applications.
• Added package-only compatibility consumers for .NET Core 3.1, .NET 5–10,
  and representative Angular 9–22 releases.
• Added a shared embedded RuleGate icon to all six NuGet packages and a
  maintainer guide for the external NuGet prefix-reservation application.

Changed

• Published all six synchronized NuGet packages and the three-package npm
  family at 0.9.0-preview.4.
• Modern @fotbiler/rulegate-angular now supports Angular 20–22 and delegates
  fail-closed snapshot storage to the framework-independent client.
• Public time-window contracts use TimeSpan, and subject role/permission
  collections use IReadOnlyCollection<string>, so portable targets do not
  expose APIs absent from .NET Standard 2.0.
• CLI product output and generated-source headers use RuleGate without the
  organization name.

Security

• Preserved strict unknown-configuration rejection and fail-closed behavior on
  legacy ASP.NET Core targets through the current configuration binder.
• Kept frontend projections as user-experience controls only; backend RuleGate
  evaluation remains the authorization boundary for every supported version.

Verification

• Added CI matrices that install the actual packed .nupkg and .tgz
  artifacts, run legacy .NET consumers in isolated containers, and build real
  Angular production consumers.
• Extended release verification to enforce package-specific target frameworks,
  NuGet icon metadata, the three-package npm family, and CLI product naming.

RuleGate 0.9.0-preview.3

RuleGate 0.9.0-preview.3 adds exporter-neutral observability and performance/concurrency hardening.

Highlights:

• standard .NET ActivitySource and Meter signals for authorization, policy lookup, source loading, and atomic reload
• closed, low-cardinality outcomes without identity, resource, policy, role, permission, claim, attribute, diagnostic, or exception values
• ambient ASP.NET Core trace correlation with host-owned OpenTelemetry SDK and exporters
• BenchmarkDotNet suites for requirement evaluation and immutable policy lookup
• concurrency, cancellation, race-condition, and bounded stress verification
• documented telemetry, benchmark, and thread-safety contracts

All six synchronized NuGet packages target .NET 8, .NET 9, and .NET 10. The independently versioned Angular npm package remains at 0.7.0-preview.1.

RuleGate 0.9.0-preview.2 — Policy Sources and Atomic Reload

RuleGate 0.9.0-preview.2 adds composable local policy sources and safe atomic policy reload.

Delivered

• in-memory, YAML file, embedded-resource, .NET configuration, and application-defined policy sources
• complete candidate compilation and validation before activation
• immutable combined snapshots with one atomic replacement
• preservation of the last valid snapshot after failed or cancelled reloads
• manual reload plus optional YAML and configuration change monitoring
• stable, value-safe reload diagnostics and structured logging
• deterministic concurrency, cancellation, watcher, and package-consumer coverage

All six RuleGate NuGet packages are published together at 0.9.0-preview.2 for .NET 8, .NET 9, and .NET 10. The independently versioned Angular npm package remains at 0.7.0-preview.1 and was not republished.

Documentation: Policy Sources and Atomic Reload

Full changes: CHANGELOG

RuleGate 0.9.0-preview.1

Explain and Lint

• Adds rulegate explain for deterministic, redacted authorization-decision trees.
• Preserves fail-closed and indeterminate outcomes while omitting subject, resource, role, permission, attribute, and literal values.
• Adds rulegate lint with stable findings for duplicates, contradictions, absorbed branches, excessive depth and size, ID collisions, unnecessary logical complexity, and risky negative operators.
• Supports human-readable and machine-readable JSON output for both commands.

Packages

All six NuGet packages are synchronized at 0.9.0-preview.1:

• Fotbiler.RuleGate.Abstractions
• Fotbiler.RuleGate.Core
• Fotbiler.RuleGate.Manifest
• Fotbiler.RuleGate.AspNetCore
• Fotbiler.RuleGate.Cli
• Fotbiler.RuleGate.Keycloak

The independently versioned Angular package remains at 0.7.0-preview.1 and is not republished by this release.

Verification

• 22 framework-specific test runs passed.
• Package metadata, contents, and symbol packages were verified.
• Package-only consumers passed on .NET 8, .NET 9, and .NET 10.
• Packaged CLI validation, testing, explanation, linting, and deterministic code-generation smoke tests passed.

See Explain and Lint and the changelog.

RuleGate 0.8.0-preview.2

Policy Testing CLI

• Adds rulegate test for deterministic authorization-policy fixtures.
• Supports allow, deny, and indeterminate expectations with optional exact failure-code assertions.
• Provides human-readable and JSON reports plus filtered test execution.
• Evaluates fixed timestamps and typed subject, resource, and context attributes through the production requirement pipeline.
• Fails closed for invalid manifests, fixtures, and unsupported input.

Packages

All six RuleGate NuGet packages are synchronized at 0.8.0-preview.2 and target .NET 8, .NET 9, and .NET 10. The independently versioned Angular npm package remains at 0.7.0-preview.1 and was not republished for this CLI milestone.

Verification

The release passed 22 framework-specific test runs, package metadata and symbol checks, package-only and Keycloak consumer tests, packaged CLI tests, generated C# compilation, and repository-signature verification.

See the policy testing guide and changelog.

RuleGate 0.7.0-preview.2

ASP.NET Core Enrichment Pipeline

• Adds public subject, resource, and context attribute-provider contracts.
• Runs providers asynchronously in deterministic subject, resource, and context order with cancellation propagation.
• Provides explicit fail, keep-existing, and replace-existing collision behavior.
• Fails closed on provider exceptions, missing trusted data, invalid attributes, cancellation, and default collisions.
• Adds scoped DI registration helpers and sensitive-value-safe structured diagnostics.
• Documents Minimal hosting, Startup, testing, lifetime, and trust-boundary guidance.

Packages

All six RuleGate NuGet packages are synchronized at 0.7.0-preview.2 and target .NET 8, .NET 9, and .NET 10. The independently versioned Angular npm package remains at 0.7.0-preview.1 and was not republished for this backend-only milestone.

Verification

The release passed the full test suite, package metadata and symbol checks, packed and public package-consumer tests, packaged CLI installation, generated C# compilation, and repository-signature verification across all supported .NET versions.

See the ASP.NET Core enrichment guide and changelog.

RuleGate 0.7.0-preview.1

First-Class Time and Context Policies

This preview adds first-class, fail-closed authorization requirements for:

• recurring timeWindow schedules with explicit time zones;
• bounded dateTimeWindow rules with explicit offsets;
• authentication and MFA age through contextAge;
• canonical trusted context such as authentication method, request channel, network zone, tenant, organization, trusted-device state, and identity type.

The Angular generator now accepts all current backend-only attribute, time, and context requirement kinds while producing frontend identifiers.

Packages

All synchronized NuGet packages are published at 0.7.0-preview.1 for .NET 8, .NET 9, and .NET 10:

dotnet add package Fotbiler.RuleGate.AspNetCore --version 0.7.0-preview.1
dotnet add package Fotbiler.RuleGate.Manifest --version 0.7.0-preview.1
dotnet tool install --global Fotbiler.RuleGate.Cli --version 0.7.0-preview.1

The Angular package is published independently at the coordinated version:

npm install @fotbiler/rulegate-angular@0.7.0-preview.1

Both the core packages and optional Keycloak helpers remain provider-independent. Request-derived context is never trusted automatically; applications must supply trusted values explicitly.

RuleGate 0.6.0-preview.2 — Attribute-to-Attribute Comparison

RuleGate 0.6.0-preview.2 adds built-in comparisons between subject, resource, context, and typed-literal operands.

Highlights:

• Ownership and organization-scope policies without custom evaluators
• Numeric normalization, date/time ordering, collection comparisons, and explicit ordinal string behavior
• Validated attributeComparison YAML syntax
• Fail-closed missing, unsupported, and incompatible operand handling
• Value-free comparison diagnostics and evaluation traces
• All six NuGet packages synchronized at 0.6.0-preview.2 for .NET 8, .NET 9, and .NET 10

The Angular npm package remains independently versioned at 0.5.0-preview.1.

Full changes: v0.6.0-preview.1...v0.6.0-preview.2