Moltaro 0.0.20-beta

Release date: 2026-08-18

This release replaces legacy Entity authorization with Unified Security Statements, hardens collectible .NET package runtimes against memory retention, adds durable unload diagnostics, improves persisted Entity list behavior, and reduces idle RabbitMQ health-check load. The Entity security cutover requires a customer administrator action immediately after each runtime replacement.

Highlights

• Entity Instance access now follows one fail-closed Security Statements policy with SQL-before-pagination filtering, field-safe projection and no implicit Owner or Admin data-access shortcut.
• The delivered docs/entity-security-administrator-full-access.md guide gives administrators and automation agents an idempotent Configuration API procedure that grants the Admin role the complete live Entity permission catalog for every non-deleting Entity Definition.
• Package .NET and Net Operation Project runtimes isolate JSON metadata and other epoch-owned state, diagnose collectible runtime epochs that do not unload, and reject new source patterns that can escape the runtime lifetime.
• Entity lists and Reference pickers preserve actor intent more reliably across initialization, retries, surface changes and mobile layouts.
• Docker Compose runs one authenticated RabbitMQ health probe every 30 seconds, retaining the existing unhealthy-detection budget with materially less idle probe overhead.

Detailed changes

Unified Entity Security

• Entity authorization is configured per Entity Definition through immediately effective Security Statements, direct Permission Assignments, Responsibilities and assignment rules. Configuration mutations use unique operation keys, optimistic concurrency and dependency-safe deletion.
• Reads require the root View permission and apply the same captured policy in SQL before count and pagination. Field projection and mutation authorization use the same captured dependency state and fail closed when the configuration is missing, stale or incomplete.
• The Configuration API exposes the current permission catalog and stable role authoring options. Entity Definition portability uses strict MoltaroSecurityConfiguration YAML version 8 and atomic replacement.
• The prior Entity access model, field access rules, record assignments, relation inheritance and lifecycle policy data are not translated. The new configuration starts empty. Entity Definitions, Entity Instances, users, roles and Workspace User Groups remain unchanged.
• Because Owner and Admin no longer bypass Entity data authorization, customers must run the packaged administrator-access guide after replacement and then author the narrower business policies required for normal users.

Collectible .NET runtime safety and diagnostics

• Package .NET and Net Operation Project epochs own serializer metadata and invocation state that can observe collectible types. Epoch invalidation now performs the supported unload sequence without allowing package objects, exceptions, delegates or type metadata to remain in host-lifetime state.
• Administration > Monitoring > .NET runtime shows bounded, durable stuck-unload incidents with process/runtime identity, artifact/build correlation, status, timestamps and recent safe usage evidence. It does not expose source, arguments, serialized objects, secrets, stack traces or an unproven GC root.
• Incidents distinguish CurrentStuck, Collected and NoLongerObserved. Retention defaults to 14 days and can be set with Moltaro:Observability:RuntimeUnloadIncidentRetentionDays in the range 1-90.
• Package and project Check/Build now enforce MOLTARO040 through MOLTARO044: detached execution, long-lived callbacks, external event subscriptions and explicit host-lifetime escapes are errors; non-const static fields receive a lifetime-review warning. Diagnostics name supported async, scheduling, disposal and serialization alternatives. MOLTARO040 recognizes values that are immediately awaited before a synchronous consumer and epoch-owned Task caches whose assignment is returned directly to the caller; detached or otherwise unobserved work remains an error.

Entity list and Reference interaction

• Personal list filters, sorting and grid state are bound to the exact Entity, container and Table Surface. Stale state from another surface is rejected instead of being applied to the current list.
• Early local filter/sort intent survives asynchronous initialization while server-owned Saved, Shared and Global Default state remains out of local storage.
• Reference pickers serialize initialization and retry paths, re-resolve stale surface identity, retain valid user input and restore focus after realtime updates.
• Mobile Entity list actions and overflow handling are more predictable during list settling and narrow-layout interaction.

Attachments and file provenance

• Historical or trusted imported attachment relations can preserve an unknown creator without inventing a user identity. Ordinary managed uploads still retain their real creator, and an explicitly unknown actor remains rejected.
• File upload capabilities expose the deterministic active file-policy fingerprint. Trusted direct-database attachment writes require an effective actor and use the same extension/MIME policy as the managed upload boundary.

Operations and developer guidance

• Both delivered Docker Compose variants use the bounded authenticated RabbitMQ probe and keep API/Worker startup gated on broker health.
• Configuration documentation now shows the required source and target identifiers for InverseReference fields and the validation returned when a relation identifier is missing.
• Scheduled functions are documented as trusted in-process async execution with cooperative cancellation; obsolete child-runner deployment guidance is removed.

Database and upgrade impact

The Workspace schema changes substantially; Portal has no schema change. The upgrade installs the Unified Security Statements storage and then replaces the legacy Entity authorization and lifecycle-policy tables with the final direct configuration model. Legacy Entity access configuration and assignment data is deleted and is not converted. Business Entity Definitions, Entity Instances, users, roles and Workspace User Groups remain, but Entity data access is empty and fail-closed until the customer administrator applies the delivered guide.

Additional Workspace changes add durable collectible-runtime unload incidents, rename the stored record-matching actor trust flag without changing its value, and allow a historical attachment relation creator to be null. No attachment body or business Entity value is bulk-rewritten.

Deployctl creates a database recovery point and managed object-storage backup for each Managed App before its Workspace upgrade. Expect ordinary sequential full-replacement downtime for each application, followed by a customer access- configuration window during which business data remains inaccessible through Entity operations.

Rollback requires the complete matching pre-release Workspace database, managed object storage, runtime and configuration recovery point. Do not downgrade containers alone or manually recreate dropped grants: the deleted legacy authorization state can be recovered only from the verified backup.

Deployment and operator actions

• Publish 0.0.20-beta with production ReplaceRuntime for all three Managed Apps. Do not prepare or apply a delta update package.
• Publish Portal, StorageSigner, regenerated public documentation, the base runtime package and Runtime VM agent 0.1.40, then replace each Managed App sequentially from its generated recovery point.
• Notify each customer administrator before replacement and send the packaged docs/entity-security-administrator-full-access.md file. Confirm that an approved Owner, Admin or Configurator credential is available for the Workspace Configuration API; do not collect that credential in release evidence.
• After an upgraded API is healthy, the customer administrator must run the guide against that Workspace, verify all non-deleting Entity Definitions by read-back, and smoke-test the business operations their Admin role needs.
• Keep normal business use paused until the administrator bootstrap and smoke checks succeed. Then author any narrower user, role and Responsibility rules required by the customer’s operating model.
• After each replacement, verify exact API/WebApp/Worker/runtime versions, Workspace migration parity, database and RabbitMQ health, zero restart loops, administrator guide availability, and absence of unexpected authorization, package-runtime unload or migration errors. Observe host load to confirm the RabbitMQ health-check reduction.
• No new credential format, storage bucket, signer policy, DNS record, Portal setting or Runtime VM agent protocol is required. The unload incident retention setting is optional.

Compatibility and breaking changes

This release intentionally breaks the prior Entity authorization contract. Legacy access models, field access rules, assignment inheritance, record assignments and Owner/Admin data shortcuts are removed. Existing Entity data is not deleted, but every Entity operation fails closed until a valid Statement is assigned root View and the additional required permissions. Automation must move to the definition-scoped Security Configuration API and YAML version 8; older Entity security portability documents are rejected rather than adapted.

The trusted .NET package gateway remains contract version 10, Net Operation Project remains 7, and Workspace UI host remains 1; already installed compatible artifacts continue to run. The next Check/Build of unsafe Package or Net Operation Project source can fail on new MOLTARO040-MOLTARO044 diagnostics. Authors must remove detached work, process-global callbacks and other lifetime escapes instead of suppressing the diagnostics.

Packages that use direct-database attachment writes must supply a valid effective actor. Historical relations with no known creator remain readable. Clients that ignore the new operational-metrics incident collection remain compatible. The Runtime VM agent stays at 0.1.40.