Unreleased

This is the living release note for the next coordinated AppSurface version after 0.2.0-preview.14. It stays provisional until the next tag is cut.

What is taking shape

• Add merged public changes here as they land.

• Introduce managed coverage artifact defaults that remove verified redundant XML, retain bounded lossless history and warn about unmanaged growth. The coverage storage guide explains upgrade behavior and compatibility; the validation record tracks candidate proofs and acceptance requirements.

Verified Keycloak recipe sources — issue #887

• Add the repository-held Keycloak security recipe SDK and compiled checkout sample for reviewed input capture, offline materialization, deterministic archive repair, and immutable-image inspection. The migration guide covers the shared Aspire evidence contract. Both Keycloak packages remain held from publication pending separate coordinated prerelease authorization and actual published-byte adoption proof.

• Keep coverage-store identity mismatches fail-closed and add coverage storage new-domain to preview or create a fresh private empty domain without opening, editing, or migrating a degraded schema-v1 store. The coverage storage guide documents recovery limits. The issue #899 evidence record distinguishes native current-mount tests and a disposable APFS device-reassignment experiment from simulated mismatch decisions; native Windows, Linux and macOS current-mount lanes passed at c281c2ad, while the original mismatch cause and reboot or cloned-volume continuity remain unproven.

Included in the next coordinated version

Release and docs surface

• Add release-facing changes here as they land.

Application-owned Durable worker starter

The Durable worker quickstart introduces the ForgeTrust.AppSurface.Durable.Templates package and appsurface-durable-worker template for hosts that activate Work through an authenticated ASP.NET Core route. It generates a typed Work definition, passive PostgreSQL composition, distinct health endpoints, telemetry and standalone tests. The disposable first-Work proof exercises authorization, terminal completion, readiness and exported activity against restricted PostgreSQL roles using the canonical packaged role recipe.

The template uses the existing coordinated package publication path, with exact archive/feed installation, generated-content validation, ordinary startup on three native OS runners and separate five-sample timing evidence required before publication. Those candidate checks do not certify a downstream deployment. Generated code belongs to the application; subsequent template installation affects future projects. The initial shape guide explains compatibility and manual updates.

• RazorWire form interactions can add, duplicate, and remove nested model-bound rows while keeping each child collection scoped to its owning row. Nested templates use distinct ancestor and child index tokens; existing one-level templates retain the __index__ default. Parent duplication allocates fresh descendant keys, clears recognized hidden identities, and omits descendants already marked for deletion. Start with the MVC nested-collections quickstart for DateOnly fields, physical and mark removal, sparse-key validation redisplay, and ordinary form commands without JavaScript. Applications still own validation, persistence, deletion policy, and server commands. Follow the migration guidance to update the package and matching browser assets together and retain posted keys, attempted values, and errors after an invalid submission. The linked V4 fixture provides local, version-bound consumer proof; live Skoolit adoption and human first-use timing remain unverified.

Bounded HTTP readiness for typed Aspire tests and EvidenceHost — issue #867

The approved ForgeTrust.AppSurface.Evidence.Readiness package provides a BCL-only, deadline-bounded HTTP status probe for ordinary tests. Its typed Aspire fixture composes the existing profile builder, native resource health, explicit endpoint selection, and the HTTP condition under one cooperative startup budget. The Evidence.Aspire adapter adds that condition to an explicitly registered EvidenceHost resource while retaining the existing application lease as its sole owner.

Use the neutral readiness reference, typed fixture guide, Evidence.Aspire adapter guide, and EvidenceHost guide for defaults, ownership, cancellation, safe diagnostics, and alternatives. The standalone consumer and typed consumer are the canonical executable quickstarts; use the verification script for their package proofs.

Both version-bound Skoolit gate equivalences preserve a three-minute startup budget, 30 requests, three-second request timeout, 250 ms retry, UseProxy = false, and two-second ConnectTimeout. Those settings are consumer choices, not SDK defaults. Equivalence proof is not actual Skoolit adoption, and no latency or reliability improvement is claimed without measurements. Aspire 13.4.4 is the pinned verification baseline; later consumer-selected versions require their own verification. Runtime, live-resource, and packed-consumer results belong to the corresponding proof records, not to this documentation entry.

Aspire MessagePack security update

The Aspire integration now requires MessagePack 2.5.303, fixing Dependabot alert #14 and GHSA-qhrr-8q5h-9q3h. Malformed nested containers are rejected before they can reuse trailing bytes to justify excessive allocations during object deserialization. The supported Aspire 13.4.4 baseline is unchanged; retain the MessagePack security floor when updating Aspire.

• Applications using Cloud Run deployment bundles can observe one exact Job execution through IGcpCloudRunExecutionObserver or appsurface deployment gcp-cloud-run observe-execution. The observer compares captured execution configuration and current terminal evidence against the bundle, with bounded reads, cancellation, safe diagnostics, and distinct failure, unknown, and running outcomes. Optional projectNumber binds numeric execution namespaces to the declared project; v1 single-container Gen2 SQL configuration uses the documented implicit socket projection. Try the two offline consumers. Submission, recovery, and application acceptance remain caller-owned; the checked-in offline evidence makes no live provider-certification claim.

• Added native EvidenceHost acceptance for packed coverage storage and installed-package consumers, with reusable bounded command execution, owned workspace budgets, streaming artifact writes/verification, explicit coverage execution settings, and verified cross-platform coverage consumption. Existing coverage thresholds and source scope remain unchanged.

• Environment candidate inspection: ForgeTrust.AppSurface.Config adds names-only environment candidate plans for typed native keys, strict string keys, and direct composition paths. The inspector shares the host's frozen mapping snapshot and performs no source reads or value resolution. See the logical-key guide and packed consumer proof.

• Candidate inspection does not establish source presence, ownership, or complete aggregate policy. Applications retain those decisions and their inventory comparer.

• Payload-free Cloud Tasks activation: the optional ForgeTrust.AppSurface.Durable.CloudTasks package submits a caller-named empty wake to an existing Durable external-activation host using an explicit creator token source and worker OIDC target. Closed receipts distinguish acceptance, name conflict, definitive rejection, and uncertain outcomes; an uncertain result keeps recovery application-owned. The official SDK transport is bounded and has no application/GAX retries. Its local TLS fixtures observe two streams/one acceptance for one REFUSED_STREAM followed by success, four streams/zero acceptances for repeated refusal, four streams/zero acceptances for GOAWAY last-stream-id zero, and one accepted request with a lost response classified Indeterminate/ASCT305. These fixture results were observed with .NET SDK 10.0.402 and .NET runtime 10.0.13, and separately with .NET runtime 10.0.2. See the canonical activation reference and local package proof. Packed GCP and neutral-consumer isolation remain release gates; local fixtures do not prove Google-issued identity, live IAM, or real task delivery.

• AppSurface's repository EvidenceHost acceptance now selects solution coverage, package validation and native acceptance from the same checked-in policy locally and in CI. C# Git collection includes local branch/working-tree changes and event-pinned CI changes. Explicit profile combination unions requirements for mixed changes; unknown inputs retain every producer. Local execution captures dirty patch content, builds native candidates only when selected and rejects source drift. CI emits verified native, coverage and package lane manifests, retaining full-solution 95/85 aggregate and applicable 95/85 patch gates with existing tolerance and native fan-in. Package checks retain catalog, generated-documentation and packed-consumer proofs while avoiding duplicate restore/build steps. Collection, fan-in and verification use C#.

• The Durable worker template creates test hosts without configuration file reload watchers, preventing authored tests from stalling during builder construction on restricted hosts. Application reload defaults and acceptance timeouts remain unchanged.

• Caching lets a concrete Memo owner supply a shared TimeProvider and await registered background refreshes before shutdown. Existing constructors keep system time; the drain joins a snapshot without cancelling refreshes or treating failed refreshes as successful values.

• Tailwind recognizes styled version and completion messages as informational while retaining original stderr bytes. Unknown messages and unsupported escape sequences retain error severity.

• The native PostgreSQL template smoke uses short cluster paths on Linux and macOS so deeply nested temporary directories do not exceed PostgreSQL's Unix socket limit. Existing ownership checks and cleanup budgets still apply.

• RazorWire MVC publish preflight: contributors can run an opt-in Linux publish check before full solution coverage. It checks ordinary and static web asset destinations before copying, then checks file permissions in the finished scratch output. Ordinary publish and existing release checks keep their behavior.

Migration watch

• Record-breaking or behavior-changing guidance here before it moves into the tagged release note.

AppHost repository-relative asset paths — issue #865

AspireStartupContext now anchors default repository discovery at builder.AppHostDirectory and uses the nearest .git directory or file, including linked-worktree markers. Relative explicit applicationRoot values that were previously accepted now fail validation; supply a nonblank fully qualified path when constructing a context directly. When no root can be discovered, repository-path requests now fail with a helpful error instead of returning a silent relative path, while path-free profile and factory use remains available. Follow the canonical repository-relative assets guide for asset checks and recovery. This behavior change is covered by the pre-1.0 upgrade policy.