Preliminary package-readiness report: Syncfusion.Blazor.Toolkit 1.0.2

[PureWeen]

Sharing a preliminary, evidence-backed package assessment of Syncfusion.Blazor.Toolkit 1.0.2 for review and correction.

This covers all 60 package-level checks, including the promoted scaffolder/AI guidance. It is not a component assessment, certification, security clearance, or assumption that Syncfusion has agreed to every requirement in the assessment baseline. The baseline includes explicit operational extensions; those are policy questions, not automatic product defects.

• Initial assessment: September 21, 2026; validated follow-up: September 22, 2026; this issue updated: September 23, 2026.
• Exact nupkg: 5,151,489 bytes
• SHA-256: 06934c512f9c42497fb37464f36d1b0cd7b987624bf2dab01c77b8a80865705d
• Canonical report baseline: bundled rubric 2.0.1, using the readiness skill from dotnet/skills#1171, pinned to commit 469e9ef25700275da49981998a51e159bf7e2ba8. The later asset/policy collection described below used the updated skill at 3dc450a113d47a2458817256c116b0dc786748ee (rubric 2.1.0); its 60 package requirement definitions are unchanged. Those supplemental observations are not a migrated or newly scored canonical report.
• Generated-app checks used .NET SDK 10.0.401. The exact package, official documentation, public source comparison, execution outcomes and selected evidence were retained.

Outcome overview

Result	Count	Meaning
Verified	16	Direct evidence satisfies the check within its stated scope.
Gap	12	Direct evidence conflicts with a rubric check. These are not 12 independent security defects; one is an unapproved operational extension.
Owner evidence required	19	A release record, approval, qualification or other owner-held fact remains needed.
Not tested	13	The required fact is not established. This includes missing release artifacts and documentation, not just unrun executable tests.
Not applicable	0	No row was excluded on an unsupported no-surface assumption.
Incomplete/unassigned	0	All 60 checks have an explicit outcome; that does not mean all testing is complete.

Correction from the validated follow-up: SUP-07 changed from not tested to verified. The public release and bug-fix PRs, including syncfusion/blazor-toolkit#44 and syncfusion/blazor-toolkit#37, establish public tracking. Strict application of PR37's two complete JS fix transitions to the retained 1.0.1 assets matches the corresponding 1.0.2 assets after CRLF-only normalization, establishing a shipped-version link beyond date ordering. The initial omission was assessor-side; labels and a standalone GitHub Issue are not mandatory. This is the only status change: the gap and owner-evidence counts are unchanged.

What looked good

• Toolkit 1.0.2 includes its MIT license, and the repository URL/commit, authors and project URL fields are populated. Presence of the commit field is separate from establishing the exact release-source mapping.
• The exact nupkg's author and NuGet.org repository signatures verified successfully. This is a package-signature result, not a claim that contained DLLs are signed.
• The public repository contains a library threat model, private disclosure contact, response targets and servicing policy. Those published facts are credited without treating them as proof of every historical release operation.
• Six actual generated configurations built and ran: Web App Server, static, WebAssembly and Auto, plus standalone WebAssembly and PWA. All 18 default page checks passed, and all five applicable counter increment/reset checks passed.
• All 35 unique dependency archives from those generated configurations passed NuGet signature verification, including NuGet.org repository signatures. The templates emit literal package versions and no custom feed configuration.
• Both inspected templates declare only the standard SDK restore post-action, not arbitrary script post-actions. Generation was performed in a dedicated template hive and output tree.
• A separate copy upgraded to Toolkit 1.0.2 also built and passed its page/counter smoke checks. This did not change the original generated defaults.
• The retained GitHub-reviewed NuGet advisory lookup returned no matches for the assessed package's 51 resolved package/version pairs, including the target. The public .NET feed's lack of vulnerability data was not mistaken for a clean scan; this is a bounded assessment-time check, not a release-time or comprehensive security audit or a fresh scan performed for this issue edit.
• A real repository-level SPDX 2.3 SBOM exists through GitHub Dependency Graph. Its availability is credited; its release applicability is discussed below.

Gaps identified

Concrete observations and requested follow-up

Checks	Observed result	Requested follow-up
SCF-02	The Auto template produces RZ10012 for <ReconnectModal />. Its generated server _Imports.razor omits the server Layout namespace even though the component file exists. Browser inspection finds an unresolved reconnectmodal element and no reconnect dialog; the Server variant renders the actual dialog. Initial navigation/counter interaction still works.	Correct the Auto template's namespace/import generation and verify the actual reconnect dialog renders.
AI-03	The promoted chart guidance calls AddSyncfusionBlazor() and its CLI setup names Syncfusion.Blazor.Toolkit.Charts. Fresh metadata inspection of all three Toolkit 1.0.2 DLLs finds AddSyncfusionBlazorToolkit().	Align the skill and linked setup references with the actual Toolkit package and API, and retain a release-bound accuracy check.
AI-04, AI-05	The chart guidance recommends Syncfusion.Blazor.Themes. The exact inspected 34.2.2 package's LICENSE.txt applies the Essential Studio Enterprise Edition software agreement, not Toolkit's MIT license. The guidance does not pin a Themes version.	Remove or replace the proprietary dependency recommendation in Toolkit-specific guidance. The observation is specific to the inspected recommendation/version, not an assertion about every historical version.
BEQ-24	The official 1.0.2 patch release notes explicitly label breaking changes, including TextBox Multiline removal and the CheckBox tri-state sequence change, while the public development policy describes compatible patch releases.	Clarify any compatibility/experimental exception or the intended versioning and migration policy. We have not independently established the prior obsoletion duration.
LP-05	The shipped nuspec uses license type="file" with LICENSE.txt, rather than the license expression required by this rubric. The license itself is present and MIT.	If this baseline applies, populate the expression in the actual packaging path. This is not a claim that NuGet file-based licensing is invalid.
PI-01, PI-02	All three shipped DLLs (net8.0, net9.0, net10.0) lack public-key/strong-name signature material and PE certificate data; Windows reports NotSigned for every DLL.	Address the assembly-signing baseline with the intended publisher identity. Keep this separate from the successful nupkg signature verification and from any claim of exploitability.

The Auto-template observation is reproducible with the authenticated Templates 1.0.1 archive (SHA-256 4ed11da10bafec48216256ffd756e44c125a9889c9b266ca24cac6d32f3afc16) and a dedicated hive:

dotnet new install .\Syncfusion.Blazor.Toolkit.Templates.1.0.1.nupkg --debug:custom-hive .\template-hive
dotnet new blazortoolkitweb --name SfAuto --output .\auto --interactivity Auto --no-restore --no-https --no-update-check --debug:custom-hive .\template-hive
dotnet restore .\auto\SfAuto.slnx
dotnet build .\auto\SfAuto.slnx --configuration Release --no-restore

Inspect auto\SfAuto\Components\App.razor and its _Imports.razor. The retained assessment used controlled restore sources; source availability may require environment-specific configuration.

Generated-version and licensing evidence

Toolkit 1.0.2's README promotes an unversioned Templates installation. The authenticated Templates 1.0.1 package and all six actual generated configurations reference Toolkit 1.0.1 after transformation.

The exact emitted Toolkit 1.0.1 package has a zero-byte LICENSE.txt entry; Toolkit 1.0.2's corresponding entry is nonempty. We did not transfer the template package's MIT license or Toolkit 1.0.2's license to that older dependency. Please explain or update the generated-version selection and its licensing/release-alignment evidence (SCF-03, SCF-06).

The apparent standalone source ProjectReference is an XML comment, not an active reference. Active WebAssembly/Auto references point only to generated client projects. No unintended source-project dependency is being alleged.

Conditional/program-alignment checks

• SCF-01: the promoted generator uses dotnet new, whereas this bundled baseline calls for dotnet scaffold integration and contribution through dotnet/scaffolding.
• AI-01, AI-02: the inspected source-hosted skills have usage guidance, but the captured upstream plugin inventory has no Syncfusion entry and the inspected source inventory has no eval.yaml or CODEOWNERS. Please provide the relevant contribution, evaluation and ownership evidence or a valid exception for a particular reference-only skill.
• CI-01: public-tag PR CI restores/builds/tests but has no package-production step. This is an unapproved operational extension, not a universal requirement for a valid open-source package or proof that no private packaging exists.

These points need baseline/applicability discussion; they should not be conflated with the reproduced template rendering defect.

SBOM, provenance and remaining evidence

The public repository SBOM endpoint returned an SPDX 2.3 document describing syncfusion/blazor-toolkit@main, generated on request. The captured document contains 331 entries: 308 npm, 13 NuGet, nine Actions and the repository.

It is not established as the Toolkit 1.0.2 release SBOM. Against the 50 resolved NuGet package/version pairs for the assessed three-TFM configuration, it has no exact versioned matches: six pairs have name-only matches, and 44 have no matching names. This demonstrates a correspondence limitation of this repository document, not missing entries in an unseen release SBOM. Source/dev packages are not automatically distributed JS/CSS.

The retained 1.0.2 release has no uploaded assets or SBOM link in its body, and the five comparison-tag CI artifacts are expired. This does not mean that the public source archive is unavailable. The actual package publishing pipeline and a complete release-publication inventory have not been established, so publication with the release is unverified, not disproved; no absence of private processes is inferred.

Please identify the release-specific SBOM and its publication location for PI-06, and its dependency coverage for PI-07. Existing release provenance is also useful for PI-10 and PI-11, but those two are unapproved additional checks, not new baseline acceptance conditions. An attestation lookup for the distributed digest returning 404 does not prove no upload-byte attestation exists: repository countersigning can change package bytes.

Other focused requests:

• Release source/build mapping: connect the package-declared commit 2e0b7905fcb6e66678478776a22ec6ea7449761f to accessible release source. The public v1.0.2 tag points to 27cf7a7cd24964bcc7468c955166cdda50d95f3e. Structured inspection of all three DLLs found CodeView, SHA256 PdbChecksum and Reproducible entries, but no embedded Portable PDB; no sidecar PDB is shipped. Matching external PDBs or release build records could help establish correspondence. The flags do not establish a reproduced build, and different commits do not by themselves prove different compiled code. Retrieval failures are not proof of deletion or closed source; consumer builds were not substituted for original-library analyzer diagnostics.
• Bundled asset/notice coverage: the supplemental reconstruction below narrows content correspondence to 67 of 68 static assets. The remaining whole-file uncertainty is the isolated CSS bundle: its Border section is mapped, but the NumericTextBox section's source remains unresolved. Please provide that source/generation mapping and any existing applicable upstream/notice inventory. Inline-style resemblance is not CSS-isolation provenance, and build-time npm dependencies are not automatically shipped third-party assets.
• Product-specific policies: identify a public advance-EOL commitment applicable to the MIT Toolkit (SUP-06). A supported Toolkit package-version statement (SUP-04) and trim/AOT support scope (TA-07) would also help, but both are unapproved additional checks. No new support-lifetime promise or particular matrix format is being demanded. Framework/browser compatibility documentation is credited but does not settle these separate facts.
• Owner-held records: release reviews, scan bindings, publishing controls, support ownership, qualification and applicable RAI approval remain bounded requests. Please do not post secrets, private security-review material or undisclosed vulnerability details publicly; confirm availability and arrange an appropriate private channel where necessary.

Supplemental asset and public-policy observations

These observations were collected on September 22, 2026, after the validated follow-up. They strengthen the evidence without independently changing a canonical status or establishing full provenance, licensing compliance or support-policy absence.

Generated styles: the public tag's gulpfile.js and package.json supplied the actual recipe, inputs and Sass version. No further recipe or general repository copy is requested from Syncfusion.

Asset group	Entries	Established correspondence
Direct public source files	44	Existing matches after leading UTF-8 BOM removal and CRLF-to-LF normalization.
Combined Fluent and high-contrast SCSS	2	Independently reconstructed from the public recipe; matches after the same normalization.
Minified CSS compiler payloads	20	Byte-equal after accounting for exactly one terminal LF appended by the native Sass CLI.
High-contrast minified CSS payload	1	The same CLI adjustment, plus the explicitly declared BOM/CRLF normalization.
CSS-isolation bundle	1	Whole-file correspondence unresolved; Border mapped, NumericTextBox authoring source/generation still unestablished.

The official native Dart Sass 1.51.0 compiler was used with compressed output and source maps disabled, not the vendor's Gulp/build targets. Its pinned CLI implementation appends that terminal LF. The original outputs and raw mismatches were preserved; compiler-payload equality is not being described as raw CLI-file equality. The separate global numerictextbox.min.css match does not resolve the isolated NumericTextBox CSS source. These results do not by themselves close LP-04, PI-08 or PI-09.

Public policies: actual dynamic KB/forum/feedback results were collected, rather than treating empty HTML containers as search results. The global KB toolkit query produced 102 rows representing 85 unique articles, with duplicate rows reconciled and an empty tail page captured; none was categorized as Blazor or identified the exact Blazor Toolkit name. The Blazor forum query yielded 5 results, whose rendered pages were inspected; the Blazor feedback query yielded 2 older charting requests. Focused eol queries yielded one unrelated KB GeoLocation result, 11 forum results whose rendered pages were inspected, and no feedback results. The explicit lifecycle discussion found concerned Azure Maps API v1, not this Toolkit library.

No applicable Toolkit advance-EOL commitment, supported-package-version statement or trim/AOT matrix was established in that collection. Complete narrow keyword-result inventories are not a complete public-policy corpus. Broader end of support queries matched ordinary words separately and were not exhaustively enumerated; attachments and separately paginated thread content were not exhaustively covered. Accordingly, no public-policy absence gap is asserted, and SUP-06, SUP-04 and TA-07 remain unresolved.

The specific remaining evidence requests are collected in the focused request comment. No credentials, signing keys, confidential source or unreviewed private records should be posted publicly.

Additional local checks (September 23, 2026)

This supplement adds observations, not new scored outcomes. The counts and all 60 canonical check outcomes remain unchanged. The template checks below exercised the exact shipped Toolkit 1.0.2 package; the library builds exercised the public comparison tag, whose correspondence to the shipped DLLs remains unconfirmed. Those are different evidence boundaries.

Auto reconnect defect: reproduced with 1.0.2, minimal fix confirmed

The existing SCF-02 finding remains reproducible after upgrading an isolated copy of the Auto template's server and client references to Toolkit 1.0.2. The generated source still produces RZ10012 for ReconnectModal and renders an unresolved <reconnectmodal> element rather than the dialog. Upgrading the library alone does not fix the template.

In a separate control generated with the application name SfAuto, adding this one source-level import to SfAuto\Components\_Imports.razor removed RZ10012:

@using SfAuto.Components.Layout

The corrected control rendered one real reconnect dialog and zero unresolved reconnect elements on each of three pages, while its counter still incremented and reset. The original failing fixture was preserved. This confirms the namespace-resolution fix and dialog markup, not a simulated network-loss/reconnection lifecycle test. Other application names require their corresponding server-component namespace.

Expanded exact-package smoke coverage

Using SDK 10.0.401, five additional configurations from the authenticated Templates 1.0.1 snapshots were tested with their Toolkit references explicitly changed to 1.0.2:

Configuration	Restore/build	Page checks	Counter
Static SSR	Passed	3 passed	Static; interaction not expected
Web App / WebAssembly	Passed	3 passed	Increment/reset passed
Web App / Auto	Passed, with the existing reconnect warning	3 passed	Increment/reset passed
Standalone WebAssembly	Passed	3 passed	Increment/reset passed
Standalone WebAssembly / PWA	Passed	3 passed	Increment/reset passed

All 15 checks of /, /counter, and /weather, and four applicable counter checks, passed without captured runtime errors or failing HTTP responses. Expected route headings were also confirmed. No new diagnostic code/message pairs appeared relative to the retained 1.0.1 controls; this does not mean the builds were warning-free. Existing Auto and standalone/PWA source warnings remain, as does the assessment feed's NU1905 vulnerability-audit-data limitation.

The earlier Server-only 1.0.2 control was not rerun in this five-case matrix. The tested upgrades are assessor-selected compatibility variants, not a claim that Syncfusion has updated the template defaults. These checks do not establish full accessibility, later Auto-to-WebAssembly transitions, PWA offline operation, trimming, or AOT compatibility.

Public-tag library builds: successful compilation, not warning-clean

Comparison source only: commit 27cf7a7cd24964bcc7468c955166cdda50d95f3e, not an established mapping to the distributed DLLs.

The public library project was built in Release for all three declared targets using pinned SDK 10.0.401, with RunAnalyzers=true and RunAnalyzersDuringBuild=true. Its source, editorconfig, warning policy and default Version=1.0.0 were left unchanged. Previously verified public-recipe outputs from native Dart Sass 1.51.0 were supplied as generated stylesheet inputs, retaining their original CLI bytes. This satisfies the project's existing condition for skipping npm/Gulp: the npm/Gulp release pipeline was not executed or validated.

Target	Build exit	BL0005	BL0007	RZ10012
net8.0	0	39	132	1
net9.0	0	39	132	1
net10.0	0	39	132	1

Each target had 171 distinct unsuppressed Blazor analyzer diagnostics, deduplicated by code, message and location: parameter assignments outside their component (BL0005) and component parameters that are not auto-properties (BL0007). These are not 171 proven runtime bugs, and repeated diagnostics across frameworks must not be added together as independent defects. Other C#, .NET and style warnings were also emitted.

The RZ10012 identifies an unrecognized ChartIndicatorContainer at src/Components/Charts/Chart/SfChart.razor:46. No chart runtime failure is asserted. Trim/AOT analyzers also emitted warnings, including IL2026 and IL3050 on reflection/JSON serialization paths; no trimmed or AOT application was published and executed for this supplement.

These observations have no established earlier-release diagnostic baseline and are not labeled new regressions. They do not resolve BEQ-21 for the actual release or establish that the shipped DLLs have the same diagnostics. Release-bound source/build correspondence and the applicable build configuration are still needed.

Generated isolated CSS and remaining release evidence

All three builds generated the same 354-byte isolated CSS bundle, byte-for-byte equal to the Border section of the 696-byte shipped bundle, including its generated scope identifiers. The generated bundle does not contain the shipped NumericTextBox section.

This makes the existing request more specific: please identify the release-specific NumericTextBox isolation source or generation step, together with the source/project and build configuration that produced the shipped DLLs. The observed difference does not establish its cause or imply a licensing violation.

Rebuilt DLL hashes also differ from the distribution. Because the public project defaults to version 1.0.0 and the original release overrides/compiler configuration remain unestablished, a byte mismatch alone is not evidence of different functional code. This was not a reproduced library release.

The prepared report ZIP includes these selected observations and a machine-readable summary. Raw build logs, SARIF, binary logs and browser captures remain outside the public bundle because they can contain local paths or environment details. No canonical status changes are implied by this supplement.

Complete outcome index

The following preserves all 60 rows and their statuses from the validated September 22 follow-up. The supplemental observations above do not re-score this index. Requirement wording is from the assessment baseline, not an assertion that every program-specific condition is already an agreed Syncfusion commitment.

Verified (16)

• LP-01 - Uses an OSI-approved, non-copyleft license.
• LP-06 - NuGet RepositoryUrl is populated.
• LP-07 - NuGet RepositoryCommit identifies the commit SHA.
• LP-08 - NuGet Authors is populated.
• LP-09 - NuGet ProjectUrl is populated.
• PI-03 - Every shipped .nupkg is NuGet-signed for package integrity.
• PI-04 - NuGet.org repository signature is present where expected.
• SEC-01 - Maintain a documented security/threat model for the library.
• SEC-04 - Publish SECURITY.md with a private disclosure contact.
• SEC-07 - Do not ship known unpatched High/Critical CVEs in any direct or transitive dependency.
• SUP-02 - Publish a single support point of contact.
• SUP-03 - Publish a stated response SLA.
• SUP-05 - Security patch cadence is documented.
• SUP-07 - Track non-security accessibility bugs and other shipped-version issues publicly.
• SCF-04 - Generated projects use signed nuget.org packages, no preview-only/internal/non-public feeds, and pinned partner versions.
• SCF-05 - No execution of arbitrary scripts during scaffolding.

Gap (12)

• LP-05 - NuGet PackageLicenseExpression is populated.
• PI-01 - Every shipped assembly is strong-name signed.
• PI-02 - Every shipped assembly is Authenticode-signed using the partner's verified publisher identity.
• BEQ-24 - Follow SemVer, mark experimental APIs [Experimental], and ship [Obsolete] guidance for at least one minor version before removal.
• CI-01 - PR CI restores, builds, tests, and packages relevant targets.
• SCF-01 - In-scope scaffolders integrate with dotnet scaffold, not dotnet new, and are contributed to dotnet/scaffolding under its quality bar.
• SCF-02 - Generated code follows the accessibility and Blazor patterns in sections 3 and 4.
• AI-01 - Contribute partner AI skills to the dotnet-blazor plugin in dotnet/skills.
• AI-02 - Meet dotnet/skills contribution guidance for format, evals, and ownership.
• AI-03 - Update skills for accuracy on each .NET release day and promptly when partner-library changes affect recommended patterns.
• AI-04 - Generated code depends only on .NET and qualifying partner libraries.
• AI-05 - Generated code does not depend on proprietary or closed-source libraries.

Owner evidence required (19)

• LP-03 - All direct and transitive dependencies use OSI-approved, non-copyleft licenses.
• PI-05 - OIDC/trusted publishing is used instead of long-lived publish secrets.
• PI-12 - Release evidence is retained long enough for validation and incident response.
• SEC-02 - Complete a library security review before shipping.
• SEC-03 - Address all identified threats and review findings, or explicitly accept them with documented justification before release.
• SEC-05 - Vulnerabilities are reported and fixed privately and disclosed only after a fix is available.
• SEC-06 - Dependency vulnerability scanning runs on every release; PR scanning is optional.
• SEC-08 - Ship vulnerability fixes in line with .NET servicing, typically the next monthly Patch Tuesday after a fix is ready.
• SEC-09 - Consider an out-of-band release for critical issues with known exploitation.
• CI-05 - Dependency scans and release checks are required gates.
• CI-06 - Default and release refs require appropriate review/checks.
• CI-07 - Untrusted build execution is separated from privileged signing/publishing.
• CI-08 - Signing/publishing consumes a verified immutable artifact.
• SUP-01 - Identify an active maintainer providing timely security, accessibility, and engineering support.
• SUP-08 - Use coordinated disclosure for security issues; do not disclose publicly until a fix is available.
• SUP-10 - Microsoft may stop promoting a partner library if it no longer adheres to these requirements.
• SCF-03 - Generated dependencies are limited to .NET and qualifying partner libraries, with no proprietary or closed-source dependencies.
• SCF-06 - Update scaffolders when library patches or updates affect generated output.
• AI-06 - New AI skills complete Responsible AI (RAI) review before merge.

Not tested (13)

• LP-02 - Public source repository for shipped versions.
• LP-04 - Required third-party license and notice files are preserved.
• LP-10 - Every packaged binary is attributable to public partner source or a referenced NuGet/npm package with a clear upstream; released partner binaries map to the public source commit.
• PI-06 - An SPDX or CycloneDX SBOM is published with every release.
• PI-07 - The SBOM enumerates direct and transitive dependencies.
• PI-08 - Bundled third-party JS/CSS upstream components and versions are listed in the SBOM.
• PI-09 - Required bundled third-party license and notice files are preserved.
• PI-10 - SBOM and provenance bind to the exact final signed NuGet package digest.
• PI-11 - Build provenance connects source SHA, workflow, dependencies, signatures, and publication.
• BEQ-21 - Library code builds with no new .NET or Blazor BL* analyzer warnings on supported TFMs; an accepted migration plan is not a substitute.
• TA-07 - The supported trim/AOT matrix is documented.
• SUP-04 - Supported versions are documented.
• SUP-06 - Publicly provide sufficient advance EOL notice for customer migrations and Microsoft promotion removal.

Not applicable (0)

None.

Full report

Updated report bundle prepared for attachment: syncfusion-toolkit-1.0.2-public-update-20260923-local-checks.zip.

The bundle contains the unmodified validator-generated September 22 follow-up reader, evidence index, canonical JSON/validation files and selected retained evidence, its comparison with the originally published assessment, and separately labeled asset/policy and September 23 local-check supplements with machine-readable summaries. Raw browser captures, build logs, SARIF, binary logs and unrelated assessment history are excluded. All earlier reports and ZIPs are preserved rather than overwritten.

Current canonical follow-up validation-manifest SHA-256: d05d493bb5408dac3c20f89c3b29ff7267ce56c9c5a12cfd7c5f3e8a8bcc2df9.

Original published assessment validation-manifest SHA-256: 501be5aaf4e0935160ba87a3f487c23333a1637c646718a7f8b43417f2882111. The follow-up is a separately identified validated lineage, not an in-place edit or original-chain revision 0002. The later supplemental observations have not been incorporated into a new canonical input manifest.

How to provide feedback

Please reference the check ID when correcting a fact or supplying evidence. A useful response identifies the package/version, relevant source or artifact, public link or approved private location, and how it addresses the requested fact.

For a corrected package or template, please identify the new version and exact artifact so the affected checks can be repeated. An existing release artifact or documented exception is also useful; a missing item in this assessment is not automatically a missing item in Syncfusion's process.

Important limitations

• This is a preliminary package-only assessment, not certification, a release recommendation, a full component audit or an assertion of an agreed program contract.
• Counts are check outcomes, not a readiness percentage or a count of distinct bugs. Unknowns and owner-evidence requests are not established defects.
• Release-bound original-library analyzer validation remains blocked by source correspondence. The public-tag builds are comparison-source execution, not that validation; template/consumer success does not close the check.
• Browser smoke results do not establish full accessibility compliance, all Auto transitions, AOT behavior or complete PWA offline operation.
• SUP-07 is verified for public shipped-version tracking, not runtime correctness or component accessibility conformance.
• Supplemental asset matching establishes file-content correspondence only; completed public searches do not establish a complete policy corpus. No additional status change is implied.
• Source comparison, published policy, actual execution and owner-held records remain distinct. Structural report verification establishes artifact integrity, not factual truth or organizational approval.

[PureWeen]

Focused evidence request for Toolkit 1.0.2

Could Syncfusion help with the specific links or release records below? The public repository, stylesheet build recipe, repository-level SBOM, and valid NuGet package signatures are already credited. These requests concern facts not yet established for the shipped release, not assertions that the records do not exist.

Package: Syncfusion.Blazor.Toolkit 1.0.2
SHA-256: 06934c512f9c42497fb37464f36d1b0cd7b987624bf2dab01c77b8a80865705d

Requested release evidence

1. Identify the public source used for the shipped DLLs (LP-02, LP-10, BEQ-21). The package declares commit 2e0b7905fcb6e66678478776a22ec6ea7449761f, while the retained public v1.0.2 tag resolves to 27cf7a7cd24964bcc7468c955166cdda50d95f3e. Please identify the applicable public source commit/build inputs for the net8.0, net9.0 and net10.0 DLLs and explain that difference. An existing release build record or matching public PDB/symbol-package location could help verify the mapping; PDBs are not the only acceptable route. Different commit IDs alone do not prove different compiled code. This connection is needed so our original-library analyzer results can be attributed to the shipped release rather than only to comparison source.

2. Point to the SBOM published for this release (PI-06, PI-07). We have the GitHub repository-main SPDX SBOM. Is there an SPDX or CycloneDX SBOM specifically covering Toolkit 1.0.2? Please link the document and its release/publication location. We will separately assess its publication association and dependency coverage. If one is generated or published after release, please identify that timing rather than treating it as evidence of original release-time publication.

3. Clarify the remaining asset provenance (LP-04, PI-08, PI-09). In particular, where is the authoring source or generation step for the NumericTextBox portion of the packaged CSS-isolation bundle? We have not located a corresponding SfNumericTextBox.razor.css in the public tag. If an existing release inventory identifies bundled third-party JS/CSS, upstream versions and applicable license/notice obligations, please link it. We already have gulpfile.js, package.json and the public style inputs; completing the available reconstruction and comparisons remains our work. We are not asserting a missing required notice merely because an attribution remains unresolved.

4. Identify the applicable advance end-of-support notice policy (SUP-06). Please link any public commitment to advance notice that applies specifically to the MIT-licensed Toolkit, or clarify if no such commitment is published. A commercial-product policy is useful only if its applicability to Toolkit is established. We are still completing public support-document coverage, so this is not a claim that no policy exists.

Optional clarification, not new baseline acceptance conditions

The following are additional rubric checks whose adoption has not been established. They are not being presented as baseline defects or mandatory remediation requests. If applicable records already exist, links would help:

• Supported Toolkit package versions (SUP-04): which package versions are supported, including whether 1.0.2 is covered. This is distinct from supported .NET versions and does not request a new support-lifetime promise.
• Trimming/AOT support scope (TA-07): a statement of supported Toolkit versions and configurations, rather than project flags alone.
• Release provenance (PI-10, PI-11): existing records connecting source, the actual build/publishing workflow, dependencies, signatures and publication, including any binding to the final distributed package digest. Any upload-versus-distribution digest difference caused by NuGet signing should be accounted for.

How to respond

For each item, a specific link/artifact, applicable version, and short explanation of what it establishes is sufficient to start reassessment. If unavailable, please distinguish "not produced", "not published for 1.0.2", "exists but is private", or "not applicable" with a reason. Public-source and publication checks still need public evidence; a private record is not automatically a substitute.

No credentials, signing keys, confidential source or unreviewed private logs should be posted. No additional public bug-tracking material is requested for SUP-07; the existing public release and bug-fix PRs are already credited.

This comment requests evidence and clarification. It does not replace the original assessment snapshot or silently revise its counts.