Implement resource policy CAS and integrate search and messaging acceptance fixtures

Author: KSemenenko

.github/workflows/ci.yml

@@ -105,6 +105,8 @@ jobs:
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=analyzers
       - name: Test prompt termination on Aspire resource failures
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=comparison '--KeyLoadTests:Filter=/*/*/AspireFailure*/*' --KeyLoadTests:ResultsDirectory=TestResults/aspire-failure --KeyLoadTests:ReportTrx=true
+      - name: Test Aspire recovery prerequisite ownership
+        run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=comparison '--KeyLoadTests:Filter=/*/*/PriorProbePrerequisiteTests/*' --KeyLoadTests:ResultsDirectory=TestResults/recovery-prerequisites --KeyLoadTests:ReportTrx=true
       - name: Test live benchmark progress capture
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=comparison '--KeyLoadTests:Filter=/*/*/ComparisonProgress*/*' --KeyLoadTests:ResultsDirectory=TestResults/live-benchmark-progress --KeyLoadTests:ReportTrx=true
       - name: Test live benchmark process entry
@@ -117,11 +119,8 @@ jobs:
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=unit
       - name: Run unit tests without CPU intrinsics
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=unit-scalar
-      - name: Build the previous storage executable
-        id: native5
-        run: bash scripts/Features/StorageRecovery/build-native5-probe.sh
       - name: Test recovery after process crashes
-        if: ${{ !cancelled() && steps.build.outcome == 'success' && steps.native5.outcome == 'success' }}
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
         run: dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=recovery
       - name: Save test results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -131,7 +130,6 @@ jobs:
           path: |
             **/TestResults/**
             artifacts/qualification/**
-            artifacts/native5-probe/**
           if-no-files-found: ignore
       - name: Save build diagnostics
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

docs/ADR/ADR-089-event-projection-lineage.md

@@ -18,6 +18,9 @@ REQ/AC-LINEAGE-001–005, original KL-097 and later KL-039; ADR-015/019/022/025/
 030/078/081/082. Ordered stages, exact worker/root scope, tests, baseline,
 migration/rollback, native data and public/RF3 integration are frozen there.
 This ADR becomes Implemented only after all required artifacts and evidence.
+The new private effect identity uses the stable integer `DistanceMetric` value
+as a key-codec-v1 scalar. Apply, eligibility and deletion use the identical key;
+the existing key codec and prior persisted records do not change.
 
 ```mermaid
 flowchart LR

docs/ADR/ADR-090-graph-search.md

@@ -17,6 +17,8 @@ intermediate JSON or edge payloads, use an independent read gate, cross partitio
 silently truncate a graph, or substitute ANN for an exact branch. A shared budget
 charges all roots/operators; shortest-hop identity deduplication prevents cycles
 and multiple paths from multiplying contributions.
+Label filtering requires the persisted graph field policy at canonical `/label`,
+including empty label filters; a plain `label` name cannot bypass that policy.
 
 Implementation contract:
 
@@ -43,6 +45,13 @@ Implementation contract:
    lifecycle_wave owns the bounded QueryExecution parser, manifest profile and
    mapped real-store lowering/parity tests. Scalar QueryPage stays unchanged.
 
+6. G3 strengthens the existing same-partition KL-056 path using deliberately
+   conflicting text/vector/graph branch ranks, a separately computed weighted
+   RRF oracle, current authorization, and actual direct/SQL .NET/MCP RF3 parity.
+   The exact frozen corpus/test ownership and private patch join are in
+   GraphRetrieval's G3 section. This adds qualification for existing contracts,
+   not a second executor or global distributed rank claim.
+
 No persisted data converter, automatic store migration, dependency change or
 physical placement change is involved. Nodes lacking the application capability
 cannot accept this request. Rollback removes endpoint admission and fails

docs/ADR/ADR-093-resource-policy-updates.md

@@ -0,0 +1,30 @@
+# ADR-093: Compare-and-set resource field policies
+
+Status: Accepted for implementation; qualification pending.
+
+Vector projection lineage and graph label authorization require current resource
+classifications, but ConfigureResource previously rejected every changed
+definition. A raw-store rewrite in a test would conceal this missing public flow.
+
+Decision: extend the existing authorized canonical ConfigureResource request with
+an optional expected schema version and admit only field/header policy changes,
+with an exact version increment. Physical shape, indexes, authority, quotas,
+paused state and typed schema remain immutable through this request. Full
+resource migrations remain explicit separate work. Blind replacement and a
+second policy store are rejected.
+
+Implementation contract: [ResourcePolicyUpdates](../Features/Authorization/ResourcePolicyUpdates.md),
+REQ/AC-RPOL-001–004 and AC-LINEAGE-004. Its ordered stages, exact root/Luna file
+ownership, native ID3 compatibility, current-version fences, tests, rollback,
+baseline and join conditions are mandatory. Persist through the existing RF3
+metadata apply gate and deduplicated outcome; no new dependency or data epoch.
+This ADR becomes Implemented only with all mapped implementation and evidence.
+
+```mermaid
+flowchart LR
+  Request[Existing signed request] --> Authority[Persisted administrator]
+  Authority --> CAS[Expected resource version]
+  CAS --> Shape[Only policy arrays may change]
+  Shape --> Commit[Canonical RF3 metadata and outcome]
+  Commit --> Reads[Current policies and version fences]
+```

docs/ADR/ADR-094-orleans-due-coordination.md

@@ -0,0 +1,56 @@
+# ADR-094: Orleans coordination of canonical recurring and saga due work
+
+Status: Accepted for S2 implementation; qualification pending.
+Date:2026-10-04. Integration owner:root. Coding owner:Luna cluster_wave.
+
+KL-100's S1 commands persist schedules and Waiting sagas but have no autonomous
+runtime. Adopt the exact bounded discovery, native service/coordinator/request
+chain, retry and lifecycle contract in
+[DueCoordination](../Features/Messaging/DueCoordination.md), REQ/AC-DUE-001..004
+and REQ/AC-JOBS-005. Existing canonical records and RF3 atomic transitions remain
+the authority; a disposable fixed-tail sweep avoids a new durable due-index
+format and prevents continuously arriving keys from extending a sweep forever.
+
+Implementation contract:
+
+1. Root freezes this specification and narrowly rehomes the existing native
+   identity scope/admission to Orleans ClusterRouting/Identity, preserving exact
+   claims, limits, RequestContext restoration and stable serializer identities.
+2. cluster_wave owns NEW Core Features/Messaging Queries/Models/Validation and
+   Orleans Features/Messaging GrainServices/Grains/Contracts/Execution, plus new
+   Messaging UnitTests Cases/Helpers/Assertions/Models. Native records retain
+   unchanged aliases/IDs. New transferred hint DTOs have explicit v1 aliases and
+   stable generated IDs; no persisted or public S1 discriminator changes.
+3. Root alone adds Core internal visibility, Server silo DI, AddGrainService and
+   native Graph transitions. All writes use a separate signed IRequestGrain and
+   the existing bounded ManagedCode Communication CQRS consumer. No direct Apply,
+   synthetic privileged scheduler principal, copied dispatcher or hosted timer
+   outside Orleans is allowed.
+4. Tests cover finite sweep/cursor/byte/deadline/corruption/cancellation bounds,
+   current creator authority and stable unknown-response retry. Actual Aspire
+   RF3 SDK/official MCP tests must observe autonomous emission/expiry, duplicates,
+   leader loss/restart, revocation, cancellation and healthy following calls.
+   Existing S1 process cut tests remain mandatory and prove only process durability.
+5. Root integrates, reviews, builds/formats/governance-checks, runs Aspire suites,
+   commits each completed stage and retains exact-source Linux original artifacts
+   before full KL-100 closure. Scoped tests and code presence do not close S2.
+
+Dependencies:ADR-092, existing queue admission, native request/identity boundaries,
+epoch7 reader admission, original quorum/leader/read-cut contracts. Rollout uses
+homogeneous capable readers; rollback stops due coordination while retaining all
+watermarks, outcomes, queues and saga state. No automatic data migration occurs.
+Failed pages/jobs remain observable with safe structured errors; no raw retained
+templates, credentials or subject/entity identities are logged.
+
+```mermaid
+sequenceDiagram
+  participant Service as Leader silo grain service
+  participant Coordinator as Partition coordinator grain
+  participant Request as Fresh request grain
+  participant Host as Node-local RF3 apply owner
+  Service->>Coordinator: Finite canonical due hint
+  Coordinator->>Request: Subject-only scoped identity and signed Batch
+  Request->>Host: Reload policy, ordered logged-time commit
+  Host-->>Coordinator: Native CQRS terminal outcome
+  Coordinator-->>Service: Joined settlement or explicit failure
+```

docs/Architecture.md

@@ -117,6 +117,12 @@ Task replies; the stream RPC/transport and durable-operation contracts remain
 pending. Native enumeration does not transfer node-owned storage or supply
 persisted authority, retry receipts or durability.
 
+[ResourcePolicyUpdates](Features/Authorization/ResourcePolicyUpdates.md) and
+[ADR-093](ADR/ADR-093-resource-policy-updates.md) freeze policy-only CAS through
+the existing RF3 metadata ConfigureResource path. Advancing its resource version
+invalidates existing read/index fences; physical schema and placement remain
+separate migrations. Implementation and public qualification are in progress.
+
 [ADR-052](ADR/ADR-052-timeseries-bounded-aggregates.md) accepts the additive
 [TimeSeries](Features/TimeSeries.md) latest/aggregate/window slice. New typed
 Abstractions DTOs mirror Client/Server/Core TimeSeries owners and real matching

docs/Features/Authorization/ResourcePolicyUpdates.md

@@ -0,0 +1,72 @@
+# ResourcePolicyUpdates within Authorization
+
+Accepted source contract: [ADR-093](../../ADR/ADR-093-resource-policy-updates.md).
+This closes the public metadata update gap exposed by AC-LINEAGE-004 without
+performing a physical resource, index, authority, quota or schema migration.
+Canonical feature ownership is Authorization. Existing ConfigureResource
+admission, persisted administrative authority, metadata RF3 and native outcomes
+remain the sole write path.
+
+`ConfigureResourceRequest` gains nullable `ExpectedSchemaVersion` at generated
+Orleans field ID3, omitted from public JSON when null. Null preserves create and
+identical-definition behavior and still rejects a changed existing definition.
+A non-null value is a compare-and-set on an existing resource. The replacement
+must increment SchemaVersion exactly once and may change only FieldPolicies and
+HeaderPolicies. All other definition properties must be canonically identical.
+No policy change may bypass the existing complete resource/path/budget validation.
+No-op version increments are invalid. Existing native aliases and IDs0–2 stay
+unchanged; older executors reject changed definitions rather than ignore policy.
+
+| Requirement | Acceptance and automated evidence |
+|---|---|
+| REQ-RPOL-001: authorized policy replacement is one canonical metadata commit | AC-RPOL-001: real ConfigureResource apply changes only policy arrays and advances the resource version; exact native persisted definition and original outcome survive reopen; owner data/vector/event bytes are unchanged. `ResourcePolicyUpdateTests` |
+| REQ-RPOL-002: concurrent/retried updates cannot restore stale authority | AC-RPOL-002: stale/missing expected version, missing resource, overflow, unchanged policy/version-only update, changed kind/domain/index/authority/quota/schema/paused state and malformed pointers fail with typed errors and no partial state; same original command retry reuses its receipt. `ResourcePolicyUpdateRejectionTests` |
+| REQ-RPOL-003: current reads reauthorize after policy ACK | AC-RPOL-003: projection reclassification, raw-field search denial, graph `/label` denial, and existing change-feed/live-query schema fences use the new persisted definition; old cursors cannot return cached sensitive payload. `EventProjectionPolicyTests`, `ResourcePolicyUpdateVisibilityTests` |
+| REQ-RPOL-004: public native clients and RF3 retain the trust boundary | AC-RPOL-004: SDK and official MCP ConfigureResource carry the CAS field through one request grain; current-policy queries on all replicas agree after ACK and fail closed after revocation/restart. `ResourcePolicyUpdateRf3Tests` |
+
+Ordered execution and task graph:
+
+1. Root approves this contract/ADR, owns request field, existing dispatcher join,
+   public transport/schema inventory and architectural/status documentation.
+2. Luna query_wave owns new Core/Features/Authorization/Commands/
+   ResourcePolicyUpdates.cs plus new UnitTests/Features/Authorization/{Cases,Helpers}
+   files and the existing EventProjection fixture's policy-update calls. Its
+   helper validates the nullable prior/new definition and expected version; it
+   owns no storage handles, routing, alternate authorizer or external side effect.
+   The root invokes it after reading previous metadata and before any write.
+3. The helper distinguishes Validation (invalid/no-op increment), RevisionConflict
+   (missing or stale CAS), UnsupportedCapability (physical/schema migration or
+   legacy changed-definition request) and ResourceExhausted (version overflow).
+   It cannot weaken the existing admin/tenant check or resource validation.
+4. Root reviews the complete diff and joins the helper, then builds the solution
+   and runs the actual Aspire unit/scalar/recovery and SDK/MCP RF3 entries. Worker
+   gates/Git are forbidden; no test run can race a shared binary replacement.
+   In parallel, Luna lifecycle_wave owns only new IntegrationTests/Features/
+   Authorization/{Cases,Helpers,Assertions}/ResourcePolicyUpdate* files. It uses
+   the actual SDK and official MCP client to qualify CAS, current read/use policy,
+   old cursor rejection and healthy following requests against Aspire RF3. No
+   shared fixture, transport, routing or production edits are delegated to it.
+5. Delivered-source Linux artifacts and every AC are required for closure. A
+   local focused pass is development evidence only.
+
+Baseline: full local Aspire Unit36 on unchanged build36 source has3019/3165
+passing and146 failures; policy reclassification is a diagnosed real product
+gap. No passing policy-update evidence exists yet. No packages or storage format
+change is required. SchemaVersion is already in text-generation and change-feed
+fences; store position invalidates committed RAM/cache cuts. Rollback disables
+new policy admission and retains the committed definition/version; it must never
+restore older policies or rewrite user data. Frontend N/A: existing admin API;
+SQL N/A for this stage: it does not advertise a new SQL management statement.
+
+```mermaid
+sequenceDiagram
+  participant Caller as SDK or official MCP
+  participant Request as Orleans request grain
+  participant Meta as Canonical RF3 metadata owner
+  Caller->>Request: ConfigureResource with expected version
+  Request->>Meta: Persisted admin authorization and CAS
+  Meta->>Meta: Validate policy-only replacement and commit
+  Meta-->>Caller: New persisted definition and version
+  Caller->>Request: Search or current page
+  Request->>Meta: Current resource policy and version fence
+```