Moltaro 0.0.21-beta

Release date: 2026-08-20

This release restores the hottest governed Entity create, update, automation and managed-upload paths after the Unified Security cutover, makes Board item admission safely retryable, and adds configurable responsive widths to Entity Card items. It is intended to unblock everyday customer work while retaining fail-closed authorization and idempotency boundaries.

Highlights

• Governed Entity creates now preserve the authorized presentation, serialize concurrent creates, revalidate prepared writes, and keep trusted platform automation, import, blueprint, UI synchronization and assignment flows inside the same captured Security boundary.
• Managed attachment creation and Worker publication retain the Entity Security context while keeping end-user access fail closed.
• Board item admission now requires a caller-owned UUID operation key and returns the original result for an exact retry instead of creating a duplicate.
• Configurators can set a Card item’s responsive column span from 1 through 12; the same saved Card adapts to narrow drawers and wider detail pages.

Detailed changes

Governed Entity mutations and presentation

• Entity create is routed through one definition-scoped orchestration boundary for HTTP, application automation and Business Function Host calls. Concurrent creates for the same definition are serialized before their database transaction so transient serialization pressure does not exhaust retries.
• Final authorized create responses retain safe nested reference presentation data without widening public projections or exposing fields the actor cannot read. A denied final view rolls the create transaction back.
• Prepared writes keep their captured Security fingerprint through persistence. Role, schema, responsibility and mutation-effect drift is rejected instead of committing under a stale authorization decision.
• Calculated formula changes and calculated-only imports remain available when Security depends only on field permission assignment. Shape changes or statements that depend on calculated values still fail closed.
• Reference defaults, Markdown attachment adoption, entity responsibility assignments, projection/source targets and mutation effects now enter the same governed mutation pipeline. Trusted host operations receive an explicit system capability; ordinary users receive no implicit bypass.
• Entity create validation reports the exact required PascalCase member. The supported request contains OperationKey, EntityDefinitionKey, Values, ResponsibilityCandidates and ExpectedDefinitionRowVersion.

Managed attachments and uploads

• Managed upload-session creation and Worker-side publication capture the Entity mutation scope before storage work begins. Reauthorization cannot silently adopt a transaction opened outside the governed boundary.
• Trusted host-authenticated publication can complete system-owned attachment work without weakening owner, field, MIME/extension or runtime invariants for end users.
• The administrator full-access procedure now continues across Entity Definitions, reports every failed definition, and finishes with a non-zero result unless every eligible definition is verified.

Board replay safety

• Runtime and application-automation add-item requests require a non-empty UUID OperationKey. Repeating the exact logical admission with the same key returns the original Board item; reusing the key with changed input returns an idempotency conflict.
• Package authors must rebuild against the current Boards SDK and pass the UUID as the first AddBoardAutomationItemRequest constructor argument.

Responsive Card item layout

• Field, text-block and alert items on ordinary Card Surfaces accept ColumnSpan values from 1 through 12. Unset values retain the existing effective span of 1.
• Runtime layout clamps the authored span to the columns available in the current Card container, so one configuration remains usable in a narrow drawer and a wider detail surface.
• The visual Entity Surface editor, Configuration API options, Entity YAML, Package SDK descriptors, localizations and runtime adapters preserve the authored value. Invalid values return moltaro.ui.card.item.columnSpan.invalid.

Deployment safety

• Production release execution now runs target-runtime compatibility Check/Build against every pending Managed App before Portal backup, artifact publication, Portal/documentation deployment or application replacement. Failures are aggregated and stop the release before active runtime state changes.

Database and upgrade impact

There is no new Workspace or Portal schema migration and no bulk data rewrite. Managed Apps use sequential full runtime replacement, so each application has ordinary replacement downtime while its recovery point is created and its containers are replaced and verified.

Rollback uses the matching pre-release database, managed object-storage, runtime and configuration recovery point. Do not downgrade containers alone across the existing Unified Security cutover.

Deployment and operator actions

• Publish 0.0.21-beta with production ReplaceRuntime for all three Managed Apps. Do not prepare or apply a delta update package.
• Run the target-package compatibility preflight for the complete live fleet before Portal or runtime mutation. Stop the release if any Package .NET or Net Operation Project Check/Build fails.
• Replace Managed Apps sequentially from their generated recovery points and verify API, WebApp, Worker, PostgreSQL, RabbitMQ, exact package/image version and public routes after each application.
• Exercise the customer hot paths after replacement: sign-in, governed Entity list/detail/create/update, Reference selection, Board item admission and the managed attachment upload flow used by that application.
• If an Entity Definition still lacks verified administrator access, use the delivered docs/entity-security-administrator-full-access.md procedure and resolve every per-definition failure before normal Entity work resumes.
• Runtime VM agent remains 0.1.40; no DNS, storage provider, signer, license or secret format change is required.

Compatibility and breaking changes

Board Runtime API clients must replace the removed arbitrary string MutationIdempotencyKey with the required UUID OperationKey. Package and Net Operation Project consumers must rebuild against the current Boards Package SDK and pass that operation key when constructing an add-item request.

Entity create clients must use the current five-member request contract and regenerate from current OpenAPI when their generated model omits required members or still uses Fields/MutationIdempotencyKey. Required empty collections are represented as {} for Values and [] for ResponsibilityCandidates, not null or omission.

ColumnSpan is additive. Existing Card items with no value keep their current one-column-item behavior. Package .NET, Net Operation Project and Workspace UI host contract versions do not change.