Moltaro 0.0.36-beta

Release date: 2026-09-06

This release expands governed Task Definition configuration, makes C# business operations safer under retries and concurrency, and completes the managed-cloud workflow for provisioning and moving applications between Shared and Dedicated Runtime VMs.

Highlights

Task Definitions now expose a fixed transition matrix, mode-aware actor grants, execution and interruption policies, optional descriptions for interruption reasons, and governed due-date and Context admission rules.
Portal can provision a Runtime VM from the published Deployctl agent manifest and can restore or transfer a Managed App between eligible Shared and account-owned Dedicated Runtime VMs through an Available referenced backup.
C# commands, validation functions, collaboration reconciliation, role permissions, and schema-sensitive execution now retain deterministic evidence and fail safely when concurrent or ambiguous work occurs.
File Protection operations can be placed in normal Runtime Menus and remain available to users whose access is limited to authorized Sources.

Detailed changes

Tasks configuration and runtime policy

Every Task Definition has a fixed state-transition catalog for Idle, In Progress, Paused, Blocked, Postponed, and Done. Administrators can enable the supported transitions and configure the actor kinds allowed to initiate each transition, independently from Outcome actor grants.
Direct and Queue definitions expose their applicable execution settings, including Queue Responsible participation, postponement delay and lifetime limits, and Pause or Blocked warning thresholds. The configuration UI adds definition, Outcome, interruption-reason, and transition previews with optimistic-concurrency protection.
Creation policy can require, allow, or forbid a due date and can require a governed Context. Allowed Context definitions are selected from Entity and Board configuration metadata; saved admissions block deletion of their target definition until removed and do not grant access to runtime records.
Tasks automation contract 1.4.0 adds query and command operations for the new execution, transition, Outcome-grant, due-date, and Context configuration.

Managed hosting and Runtime VMs

Runtime VM provisioning now reads the web-style JSON emitted by the Deployctl agent release manifest. Invalid schema errors report the observed and expected versions and confirm that no Hetzner server was created.
Backup restore-as-new supports both Shared placement and an eligible account-owned Dedicated Runtime VM. The same backup, runtime, storage signer, diagnostics, ingress, and lifecycle contracts apply to both hosting tiers.
A Managed App can be transferred to a different eligible Runtime VM using a current Available referenced backup. Portal reserves target capacity, verifies runtime and file-body dependencies, stops the source under maintenance, restores the same application and storage identity on the target, switches placement only after target readiness, republishes ingress, and then removes the stopped source copy. Failure paths clean the target and recover the source, or fail closed if duplicate-runtime cleanup is uncertain.
Dedicated applications now receive the same supported backup, runtime, maintenance, ingress, storage, and administrative recovery controls as Shared applications.

Business logic, collaboration, and administration safety

Full runtime upgrades pin the exact Net Operation Project working revision approved by preflight. A source change invalidates the operation instead of silently building a different current revision during downtime.
Published synchronous commands declare whether they may grow, preserve, or reduce licensed usage. Non-neutral invocations serialize the final limit check and retain a durable pending marker after any ambiguous execution so a later request recomputes usage rather than trusting a stale snapshot.
Pre-commit validation failures persist structured issues on the Function Run and emit one idempotent DevLog entry with stable run, function, validation, and correlation identifiers. Recovery completes missing diagnostic delivery without duplicating the business operation.
The Package SDK adds atomic comment reconciliation for selecting one effective comment from primary and fallback identities. The operation is idempotent, preserves authorization and immutable identity rules, and records durable replay evidence.
Function snapshots bind reference values by stable field identity, avoiding stale comparisons after a field name changes. Workspace schema locks are acquired before transaction work without leaking a shared lock connection into request scopes.
Role and module-permission replacement uses current row versions and shared locking, so concurrent administrator, Package, and system-role mutations produce a conflict instead of silently overwriting one another.
Collaboration drawers keep message and attachment counts stable during refresh, render the correct empty state for the selected mode, and preserve the currently loaded bounded history.

Database and upgrade impact

Workspace databases gain persisted Task transition, actor-grant, interruption, due-date, and Context policy data; command license-usage classification and pending-mutation state; atomic comment-reconciliation evidence; and structured pre-commit validation diagnostics. Historical Task command receipts are extended with the new default creation policy. Existing Task Definitions keep due dates optional and Context optional, with no Context definitions admitted until configured. Existing command publications remain conservatively classified as usage-growing until rebuilt with an explicit declaration.

PortalDb has no schema change. Each Managed App requires normal full-runtime replacement downtime while its recovery point is captured, Workspace migrations are applied, pinned business projects are refreshed, and runtime readiness is verified. A schema downgrade cannot preserve Tasks policies, comment-reconciliation records, or validation/license evidence created after the upgrade; rollback requires the verified pre-release Workspace backup and the previous runtime.

Deployment and operator actions

Publish this version with full ReplaceRuntime for all three production Managed Apps. Do not prepare or apply a delta update.
Keep the current Runtime VM topology unchanged between preparation and production acceptance. Provision the CCX23 Dedicated VM and transfer OMS only as a separate, backup-based operation after this release is accepted.
Require a recent Available automatic backup for every Managed App and retain the pre-release Workspace and PortalDb recovery points until acceptance is complete.
The Runtime VM agent remains version 0.1.43; the provisioning correction is delivered by Portal and does not require a newer agent bundle.
After replacement, verify all component images and readiness, the three public application routes, one existing Tasks definition, one function-operation diagnostic view, and Portal Runtime VM provisioning/transfer controls before beginning the OMS move.

Compatibility and breaking changes

Package gateway contract 11 and Net Operation Project gateway contract 8 add the command license-usage mutation descriptor. Rebuild Package and Net Operation Project source against the delivered SDK before applying source that uses the new declaration; an older host rejects the newer generated gateway contract before executing it. Existing publications continue to work and are treated as usage-growing until explicitly rebuilt.

Custom administration clients that replace role or module permissions must send the current role and permission row-version values and handle an optimistic-concurrency conflict by reloading before retrying. The shipped WebApp already follows this contract. Other SDK and HTTP additions in this release are additive; no known persisted identifier, authentication, file-body, backup, or Managed App URL contract is intentionally removed.