Implement native request CQRS and fixed-voter admission

Use published ManagedCode.Communication 10.2.9 native streaming with scoped persisted identity, bounded stream settlement and authenticated request-protocol cohort admission. Add real Aspire RF3 cold-upgrade/follower-restart fixtures and truthful dependency-delivery evidence.

Local verification: full Release solution build and full formatter pass; native C0 6/6, C1 focused 59/59 and full unit 3060/3060 through Aspire. Scalar18 failed in AppHost shutdown without final child test reports; scalar19 is in progress. Recovery, real RF3 C1 faults and exact-source Linux acceptance remain pending. Private future phase/control patches are not included or claimed as tested.

Author: KSemenenko

.github/workflows/AGENTS.md

@@ -7,11 +7,11 @@
 
 ## Ownership and boundaries
 - Workflow changes belong to the feature or infrastructure contract they implement and must preserve the repository's single-repository, canonical-slice architecture. Workflow YAML is delivery infrastructure, not a place to hide missing product behavior.
-- Qualification and tests must run in GitHub Actions. Do not add local qualification shortcuts, skipped suites, fake runtime proof, unaudited performance values, or claims beyond the run's actual SHA and artifacts.
+- Delivered-source qualification must run in GitHub Actions. Owner correction 2026-10-03 permits local development tests through the same Aspire-owned entry point; those results cannot replace exact-source Linux qualification. Do not add local qualification shortcuts, skipped suites, fake runtime proof, unaudited performance values, or claims beyond the run's actual SHA and artifacts.
 - Keep permissions least-privileged, actions pinned, secrets out of logs, and Pages evidence bound to the successful source run/revision.
 
 ## Commands and evidence
-- CI test commands are the workflow's actual invocations: `dotnet build KeyLoad.slnx --no-restore --configuration Release`; `dotnet test --project tests/KeyLoad.UnitTests --no-build --no-restore --configuration Release`; equivalent commands for `tests/KeyLoad.IntegrationTests`, `tests/KeyLoad.RecoveryTests` and `tests/KeyLoad.ComparisonTests` as defined in `ci.yml`.
+- CI build commands are the workflow's actual invocations: `dotnet build KeyLoad.slnx --no-restore --configuration Release`. Owner correction 2026-10-03 requires every test caller to invoke `dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=<suite>` for the closed `analyzers`, `unit`, `unit-scalar`, `recovery`, `rf3`, `comparison` and `site` suites. Direct `dotnet test` is only the AppHost-composed child runner. AppHost owns Docker RF3 resources, discovered endpoints, readiness, runner dependencies, execution and shutdown; unit and recovery runners use that entry without requiring a fictitious RF3 topology. Preserve native reports, coverage, every required suite and exact-source Linux evidence.
 - Pages invokes `node --test site/scripts/measurements.test.mjs` and `node site/scripts/build.mjs` against the downloaded comparison artifact. Dispatch/inspect using the root workflow, retain run/job URLs, exact SHA and artifacts. These checks are not to be run locally as substitutes for CI qualification.
 
 ## Skills and protected risks

.github/workflows/ci.yml

@@ -160,6 +160,9 @@ jobs:
       - name: Build the genuine previous KeyLoad server image
         id: prior-images
         run: node scripts/Features/StorageRecovery/prepare-native5-server-image.mjs
+      - name: Build the genuine epoch-six RPC1 KeyLoad server image
+        id: rpc1-images
+        run: node scripts/Features/ClusterRouting/prepare-rpc1-server-image.mjs
       - name: Configure Docker image references
         shell: bash
         env:
@@ -168,11 +171,16 @@ jobs:
           KEYLOAD_PRIOR_SERVER_IMAGE: ${{ steps.prior-images.outputs.prior-server-image }}
           KEYLOAD_PRIOR_IMAGE_RECEIPT: ${{ steps.prior-images.outputs.prior-image-receipt }}
           KEYLOAD_PRIOR_SERVER_MANIFEST: ${{ steps.prior-images.outputs.prior-server-manifest }}
+          KEYLOAD_RPC1_SERVER_IMAGE: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_SERVER_IMAGE }}
+          KEYLOAD_RPC1_IMAGE_RECEIPT: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_IMAGE_RECEIPT }}
+          KEYLOAD_RPC1_SERVER_MANIFEST: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_SERVER_MANIFEST }}
         run: |
           test -n "$KEYLOAD_SERVER_IMAGE" && test -n "$KEYLOAD_RUNNER_IMAGE"
           test -n "$KEYLOAD_PRIOR_SERVER_IMAGE" && test -n "$KEYLOAD_PRIOR_IMAGE_RECEIPT" && test -n "$KEYLOAD_PRIOR_SERVER_MANIFEST"
+          test -n "$KEYLOAD_RPC1_SERVER_IMAGE" && test -n "$KEYLOAD_RPC1_IMAGE_RECEIPT" && test -n "$KEYLOAD_RPC1_SERVER_MANIFEST"
           printf 'KeyLoad__ContainerImages__Server=%s\nBenchmarks__ContainerImages__LoadGenerator=%s\nKEYLOAD_IMAGE_RECEIPT=%s\n' "$KEYLOAD_SERVER_IMAGE" "$KEYLOAD_RUNNER_IMAGE" "$RUNNER_TEMP/keyload-images/image-receipt.json" >> "$GITHUB_ENV"
           printf 'KEYLOAD_PRIOR_SERVER_IMAGE=%s\nKEYLOAD_PRIOR_IMAGE_RECEIPT=%s\nKEYLOAD_PRIOR_SERVER_MANIFEST=%s\n' "$KEYLOAD_PRIOR_SERVER_IMAGE" "$KEYLOAD_PRIOR_IMAGE_RECEIPT" "$KEYLOAD_PRIOR_SERVER_MANIFEST" >> "$GITHUB_ENV"
+          printf 'KEYLOAD_RPC1_SERVER_IMAGE=%s\nKEYLOAD_RPC1_IMAGE_RECEIPT=%s\nKEYLOAD_RPC1_SERVER_MANIFEST=%s\n' "$KEYLOAD_RPC1_SERVER_IMAGE" "$KEYLOAD_RPC1_IMAGE_RECEIPT" "$KEYLOAD_RPC1_SERVER_MANIFEST" >> "$GITHUB_ENV"
       - name: Find Chrome for admin tests
         shell: bash
         run: |

Directory.Packages.props

@@ -8,12 +8,13 @@
     <PackageVersion Include="Cartograph.Catalog" Version="0.1.0-alpha" />
     <PackageVersion Include="ZoneTree" Version="1.9.8" />
     <PackageVersion Include="ZoneTree.FullTextSearch" Version="1.0.9" />
-    <PackageVersion Include="ManagedCode.Communication" Version="10.2.7" />
-    <PackageVersion Include="ManagedCode.Communication.AspNetCore" Version="10.2.7" />
-    <PackageVersion Include="ManagedCode.Communication.Orleans" Version="10.2.7" />
+    <PackageVersion Include="ManagedCode.Communication" Version="10.2.9" />
+    <PackageVersion Include="ManagedCode.Communication.AspNetCore" Version="10.2.9" />
+    <PackageVersion Include="ManagedCode.Communication.Orleans" Version="10.2.9" />
     <PackageVersion Include="ManagedCode.TimeSeries" Version="10.0.3" />
     <PackageVersion Include="ManagedCode.Storage.FileSystem" Version="10.0.13" />
     <PackageVersion Include="ManagedCode.Orleans.Graph" Version="10.0.9" />
+    <PackageVersion Include="ManagedCode.Orleans.Identity.Core" Version="10.0.3" />
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
     <PackageVersion Include="ModelContextProtocol.Core" Version="2.2.0" />
     <PackageVersion Include="Microsoft.Orleans.Server" Version="10.3.1" />

docs/ADR/ADR-077-offline-native-data-epoch.md

@@ -397,3 +397,6 @@ The existing canonical GraphAndSeries.Append contract explicitly rejects reused
 TASK-NODE-EPOCH-COLD-SAMPLE-CONFLICT-ORACLE maps AC-EPOCH-010/011 to the root-owned NodeEpochRf3CurrentWorkload.RejectChangedEventReplayAsync join. Replace only the SDK and official MCP expected code with exact Conflict. Preserve the fresh command ID, original sample ID/timestamp/tags, changed value, both actual dispatched caller failures and the complete prior-series unchanged oracle, then continue every original retention/revocation/current-write/follower-recovery/snapshot/source-integrity assertion. No broader accepted-code set, retry, skip, tolerance or production change is authorized by this repair.
 
 Verification is root strict solution build/format/governance and renewed genuine Docker/Aspire RF3 on the delivered source, retaining full original reports. Normal/scalar/recovery gates remain required. Source correction alone does not qualify the cold fixture. Rollback changes only this test oracle; there is no public/data/schema/topology migration.
+## Delivered-source cold RF3 revocation oracle correction, 2026-10-04
+
+Related TASK-NODE-EPOCH-COLD-REVOCATION-ORACLE and existing AC-EPOCH-010/011: run37206566970 on377886f35928866f083806062b446056d64539e3 recorded87/88 with a failed ConfigureApiKey success assertion after its principal had been revoked. Source tracing independently confirms ExecuteConfigureApiKey requires an active persisted principal; the original report did not retain the safe error code. Preserve canonical database behavior. Root first adds an independent real secondary-key revocation oracle while the principal remains active, then revokes the principal while its original key remains active and requires the later key update to fail Unauthenticated. Preserve later follower loss/restart, SDK/official MCP denial, administrator health, migration/retention/snapshot/source checks and all immutable original receipts. Root owns the two StorageRecovery oracle files and the shared ClientApi success-assertion helper. Assert only a named defined ErrorCode in diagnostic text, never raw detail/body/credential. Full renewed Aspire Docker RF3 and exact-source Linux gates remain mandatory; this correction does not close the acceptance criteria or change a product contract.

docs/ADR/ADR-082-native-cqrs-streams.md

@@ -38,12 +38,34 @@ C0 changes only test infrastructure; canonical data epoch6, signed request envel
 
 C1 explicitly versions its RPC shape and homogeneous cold rollout independently of data-format upgrades in NativeCqrsRequestV2. Existing source still lacks application-RPC cohort validation until that implementation is qualified. The accepted peer-envelope/MAC upgrade prevents cross-version replica acknowledgements; separate discovery-MACv2 preserves authenticated observation of old versions. No mixed-node rolling compatibility or runtime legacy fallback is approved. Two compatible surviving RF3 voters remain the required failure topology; a reachable authenticated incompatible voter fails public admission/readiness with a bounded cache-detection delay.
 
+The C1 discovery client retains its constructor, ResolveAsync and IDisposable contract, and adds IAsyncDisposable for actual asynchronous silo cleanup. The owned admission/lifetime gate stops new attempts, cancels and joins admitted operations, then releases the HTTP handler, gate and credential bytes. Synchronous disposal starts the same shutdown and defers resource release until admitted work settles; it must not synchronously block Orleans or release a disposed gate. Root reviews this exact lifetime join; dedicated real-HTTP cancellation/concurrent shutdown tests and RF3 restart cleanup remain AC-CRS-003/004 requirements. No policy, storage or consensus authority moves into this disposable discovery state.
+
+AC-CRS-002/003 RF3 restart observation reuses the existing signed discovery endpoint, original native codec and MAC through a scoped IntegrationTests test-friend assembly reference. Root owns that compile-time test boundary and the accepted NativeCqrsRequestV2 helper contract. The restart wave deterministically chooses an actual follower from authoritative runtime statuses, stops it through inspected scoped fault injection and rejoins that same voter through Aspire. The oracle verifies exact bytes, request nonce, fixed identity and actual Orleans runtime generation before comparing pre/post restart records; it adds no product endpoint, protocol field or caller authority.
+
+AC-CRS-003 explicitly owns and disposes PeerSecurity's actual credential copy after admitted borrowers settle. Independent handlers borrow that owner; they cannot clear a live shared signer on their own disposal. The discovery exchange, actual server DI and test/observer fixtures own their respective signer instances. Signing bytes, nonce/replay rules and persisted authorization are unchanged; native disposal and use-after-disposal regressions accompany the full HTTP/RF3 lifecycle gates.
+
+AC-CRS-003 also hardens the existing canonical offline verifier/upgrade process owner. On an observation deadline, cancellation or bounded-output failure, it stops its own native process tree and awaits actual process exit and both output readers; no cleanup timeout or continuation can stand in for settlement. Root owns the shared helper change and retains all failures. Separate genuine child-process completion, cancellation and output-limit controls supplement the real image and Aspire RF3 gates.
+
+TASK-CRS-C1-FATAL uses published Communication10.2.9's native CqrsRuntimeFailures.FindFatal for direct and deeply nested AggregateException failures. New test-owned RequestCqrsFatalSettlement controls exercise native creation, pulls, disposal and activation cleanup, preserve exact preconstructed fatal identity with primary/disposal/activation precedence, and join every admitted cleanup before a healthy following stream. Ordinary failure and cancellation controls remain required. Owning publication and local mechanism tests alone do not qualify C1 or mark this ADR Implemented.
+
 Rollback of C0 removes unused test infrastructure; it cannot establish product stream readiness. Later product rollout, rollback, long-work checkpoint authority, terminal cancellation and fault qualification require their concrete accepted contracts. Frontend N/A: no UI. Required real SDK/MCP Docker/Aspire RF3, recovery, resource and exact-source Linux gates remain mandatory.
 
+TASK-CRS-C1-IMAGE/RF3 follow the accepted same-epoch image/AppHost contract in NativeCqrsRequestV2. The immutable prior executable is377886f35928866f083806062b446056d64539e3, data epoch6/RPC1/peer2, independently inventoried against all native Git blobs. A distinct ClusterRouting producer/proof binds that source separately from the actual current Linux docker-rf3 job. Root adds only an explicitly enabled ephemeral fixed-three-voter test image seam and preserves homogeneous current and native5 proofs. Genuine cold seed, mixed rejection, homogeneous current rollout/receipt preservation, homogeneous rollback, and two-survivor/rejoin waves use SDK/official MCP through owned Aspire resources; live HTTP/cache/shutdown controls remain separate. Per-voter admission, exact image/reference metadata, typed public rejection, finite bounds, cleanup/join ownership, files, worker roles and evidence are frozen in that feature contract before writes.
+
 ## C0 native test construction clarification
 
 Use the actual pinned Orleans10.3.1 IConfigureGrainTypeComponents/IGrainActivator pipeline to explicitly construct only the three empty-constructor test grains. Orleans retains instance attachment, scheduling, context, lifecycle and all routing; delegate disposal to DefaultGrainActivator and leave other grain activators intact. Use the pinned TUnit1.72.10 shared data-source factory for one per-session NativeCqrsClusterFixture with native async initialization/disposal. NativeCqrsActivation.cs and NativeCqrsDataSource.cs belong to the existing ClusterRouting test slice. No artificial constructor references, fabricated native observations or analyzer suppressions are permitted; source/compiler and runtime evidence remain separate.
 
 ## Owning Graph repair implementation contract
 
 The demonstrated C0 failure requires the accepted REQ/AC-GSE-001–004 contract in NativeCqrs.md. First stage exact native request tracking and the startup-only factory catalog; then the server-local delegating request and scoped native enumeration; then real owning client/silo policy, lifetime, identity, catalog and delegation regressions. The query worker owns only the reviewable /private/tmp patch and its scoped owning paths. Root owns application, formatter/full build/full native TUnit, patch version, commit/push, successful canonical release and verified NuGet delivery. Update KeyLoad's central Graph pin only after publication; rerun the unchanged six Aspire C0 tests and required full gates. Graph10.0.8 source does not contain this repair, so a package update alone is not a fix. Preserve native Orleans execution/cleanup and persisted database authorization; no migration, fallback authority or custom extension implementation is authorized. Original failed runtime artifacts remain part of the evidence chain. This ADR remains Accepted until the required product stages and qualification are complete.
+
+## C1 transport and outer failure boundary correction, 2026-10-04
+
+Accepted before delegated writes: TASK-CRS-C1-BOUNDARY applies the existing REQ/AC-CRS-002/003/004 at discovery and final SDK/MCP failure joins. Normalize only the already-defined native signed-handler transport-unavailable outcome into no fresh discovery observation; do not suppress authenticated protocol/identity/corruption failures or cancellation. Keep bounded cache invalidation and actual two-survivor RF3 qualification. At both MCP dispatch and outer HTTP middleware, fatal direct/nested-Aggregate failures escape through the published native fatal classifier, without a generic public result, exception replacement or raw logging. Private worker scopes and actual adapter invocation controls are specified in NativeCqrsRequestV2; root integrates and verifies all stages. Public wire, canonical persisted state and rollback compatibility are unchanged. This correction does not mark this ADR Implemented or waive any RF3, recovery or Linux acceptance gate.
+
+## Deterministic C1 RF3 phase observation, 2026-10-04
+
+Accepted before delegated implementation: TASK-CRS-C1-PHASE/CONTROL/FAULT use the exact native seams, optional silo-only observer, finite private AppHost controls, SDK/official-MCP outcome distinctions, authority/receipt/privacy oracles and worker scopes in NativeCqrsRequestV2. No public fault transport, canonical format, extra dispatcher or storage owner is added. Producer disposal is observed synchronously before deactivation scheduling, with every cleanup failure preserved. Migration of the stable command-partition activation still requires a separately frozen native scheduling/membership join and actual changed activation/silo evidence; a request activation's routine deactivation is not migration. Root owns control schema, AppHost/Server registration, fixture integration, original artifacts and final gates. Ordinary operation has no probe allocations or retained control state. Rollback disables the explicitly enabled ephemeral test profile; native request protocol/data contracts remain unchanged. This ADR remains Accepted until its full product and Linux qualification criteria pass.
+
+The exact private Version1 Owner/Arm/Release/Marker schema, file/memory bounds, disabled-mode contract, silo-only registration and ordered Server/AppHost/fixture integration are accepted in NativeCqrsRequestV2's "Accepted private phase-control schema and join" section before worker writes. Native migration is excluded from that schema. Private patches and local unit passes do not establish actual RF3 or delivered-source acceptance.

docs/AGENTS.md

@@ -12,7 +12,7 @@
 
 ## Commands and evidence
 - Static governance inventory check: `node scripts/Features/RepositoryGovernance/verify.mjs` (run by the lead integration owner as static validation; it is not a runtime test).
-- Product tests/builds and qualification are GitHub Actions only, using `.github/workflows/ci.yml`. Cite exact run/SHA/job/artifact evidence; do not claim a doc review is product qualification.
+- Delivered-source qualification uses Linux GitHub Actions in `.github/workflows/ci.yml`, with exact run/SHA/job/artifact evidence. Owner correction 2026-10-03 permits local development builds and tests; every KeyLoad test caller must use `dotnet run --project src/KeyLoad.AppHost --no-build --no-restore --configuration Release -- --KeyLoadTests:Suite=<suite>`, with AppHost-owned resources and shutdown. Unit/process runners use that entry without pretending to need RF3; RF3 tests use its discovered Docker topology and real SDK/official MCP clients. Label local results as development evidence; neither they nor a doc review replace product qualification.
 
 ## Skills and protected risks
 - Applicable skills: none installed; skill installation is prohibited by owner direction.