Stratara 4.3.0

A correctness release for the Orleans execution model's store readers, and the release that makes
Stratara say who acted. The native PostgreSQL commit-order reader could be switched off entirely by a
convention this framework's own API reference recommends — silently, in a deployment that reported
healthy. Beyond that, an actor acting on a tenant it holds no membership in can now hold a role the
host names, and work the platform starts for a tenant has a session shape of its own.

Upgrading:

• If you read the store in commit order on PostgreSQL, upgrade. A write context that applies
  ApplyRowVersionConvention(RowVersionMode.Uint) made every projection catch-up fail with
  42703: column s.xmin does not exist, for ever, without the host reporting unhealthy. A consumer
  who worked around it by unmapping EventStreamEntry.RowVersion can drop the workaround.
• Check what your CrossTenantRoles names mean on both role levels. The cross-tenant authorizer
  now also recognises a configured role held through the actor's own membership, so it permits
  operations it refused before.
• A host whose handlers append events needs AddCommandAuditing(). It always did; now it is
  refused before the commit instead of failing in the database.
• No schema change, no migration.

Added

• SessionContext.ForPlatform(tenantId): the session for work the platform starts on a tenant's
  behalf — a durable timer, a saga step, a sweep. It carries the reserved system actor identities, a
  fresh correlation id and a causation id of its own, so the work can append without a command having
  preceded it. Strict tenant isolation recognises the shape and permits it without consulting the
  cross-tenant authorizer, recorded under its own log event (114_104): the platform acting for a
  tenant is not one tenant acting on another. The data-owner check applies unchanged. A host that
  wants to decide for itself sets TenantIsolationOptions.AuthorizePlatformActor. Until now the
  sentinels existed, the documentation named them, and nothing in the framework acted on them — the
  honest session was refused by strict mode, and the session that passed claimed the tenant had acted.
• MembershipAuthorizationOptions.HomeTenantRoles: roles that resolve in the tenant the actor is a
  member of rather than in the tenant the request concerns. For an actor acting on a tenant it holds no
  membership in and never can: a machine key, which materialises one membership in the tenant it was
  issued for and serves many, or an operator administering a tenant they never joined — both were
  refused every role check. Configure it with AddMembershipAuthorization(o => o.HomeTenantRoles.Add("Service")).
  Empty by default, consulted only when the actor's tenant differs from the data owner's, and only the
  named roles cross.

Fixed

• The native PostgreSQL commit-order reader reads a store under any column mapping. It selected the
  event table with a wildcard, which returns no system column. A write context that applies the
  framework's own row-version convention maps the entry's row version onto PostgreSQL's xmin, so every
  catch-up of every projection grain failed with 42703: column s.xmin does not exist and retried for
  ever — no checkpoint written, nothing dead-lettered, the host reporting healthy and every write
  succeeding. The reader now names the columns the model maps. A consumer who worked around this by
  unmapping EventStreamEntry.RowVersion can drop the workaround.
• Entries committed together reach a store-reading projection in stream order. The native reader
  returned the entries of one commit in the order the database inserted the rows, which is not the order
  they were appended in: a stream created and appended to in one save could hand a projection version 2
  before version 1, and no retry could help, because the beginning was behind it in the same partition
  rather than late. Each stream's entries are now returned in version order, which is what the portable
  counter already did. Entries of different streams in one commit may still be interleaved in any order.

Changed

• The cross-tenant authorizer now recognises a configured platform role held through the actor's own
  membership. MembershipCrossTenantAuthorizerOptions.CrossTenantRoles is documented as the path for
  an operator who holds no membership in the tenant they administer, but the role was looked up through
  a role check that reads the subject tenant — the very tenant the option says the actor is not a member
  of. On the membership level it could therefore never pass, and a machine actor has no global role
  level at all, so for a machine actor the option did nothing. The actor's own membership is now
  consulted as well.
  This permits cross-tenant operations that were refused before. Before upgrading, check what the
  names in your CrossTenantRoles mean on both role levels: a host that configured "Admin" intending
  the global Identity role now also admits an actor holding a tenant-scoped membership role of the same
  name in its own tenant. "Admin", "Owner" and "TenantAdmin" collide between the two levels
  routinely. The widening is in the direction the requirement has always stated, and it reaches only
  actors holding a role the host itself named.

• Appending without a causation identity is refused before the commit. The session context carries a
  nullable causation id, but the store requires one of every entry, and only AddCommandAuditing()
  supplies it. A host that had not registered it met a 23502 not-null violation from the database that
  read like a schema fault. SaveChangesAsync now refuses the append before the transaction opens, with a
  message naming the registration. AddCommandServices() still does not register the auditing behaviours
  — where they sit in the pipeline is a consumer's decision.