Stratara.EventSourcing.Pipeline.CommandAudit 4.3.0

• net10.0

  • JetBrains.Annotations (>= 2026.2.0)
  • Stratara.Abstractions (>= 4.3.0)

A correctness release for the Orleans execution model's store readers, and the release that makes
Stratara say who acted. The native PostgreSQL commit-order reader could be switched off entirely by a
convention this framework's own API reference recommends — silently, in a deployment that reported
healthy. Beyond that, an actor acting on a tenant it holds no membership in can now hold a role the
host names, and work the platform starts for a tenant has a session shape of its own.

**Upgrading:**
- **If you read the store in commit order on PostgreSQL, upgrade.** A write context that applies
 `ApplyRowVersionConvention(RowVersionMode.Uint)` made every projection catch-up fail with
 `42703: column s.xmin does not exist`, for ever, without the host reporting unhealthy. A consumer
 who worked around it by unmapping `EventStreamEntry.RowVersion` can drop the workaround.
- **Check what your `CrossTenantRoles` names mean on both role levels.** The cross-tenant authorizer
 now also recognises a configured role held through the actor's own membership, so it permits
 operations it refused before.
- **A host whose handlers append events needs `AddCommandAuditing()`.** It always did; now it is
 refused before the commit instead of failing in the database.
- No schema change, no migration.

### Added

- **`SessionContext.ForPlatform(tenantId)`**: the session for work the platform starts on a tenant's
 behalf — a durable timer, a saga step, a sweep. It carries the reserved system actor identities, a
 fresh correlation id and a causation id of its own, so the work can append without a command having
 preceded it. Strict tenant isolation recognises the shape and permits it without consulting the
 cross-tenant authorizer, recorded under its own log event (`114_104`): the platform acting *for* a
 tenant is not one tenant acting *on* another. The data-owner check applies unchanged. A host that
 wants to decide for itself sets `TenantIsolationOptions.AuthorizePlatformActor`. Until now the
 sentinels existed, the documentation named them, and nothing in the framework acted on them — the
 honest session was refused by strict mode, and the session that passed claimed the tenant had acted.
- **`MembershipAuthorizationOptions.HomeTenantRoles`**: roles that resolve in the tenant the actor is a
 member of rather than in the tenant the request concerns. For an actor acting on a tenant it holds no
 membership in and never can: a machine key, which materialises one membership in the tenant it was
 issued for and serves many, or an operator administering a tenant they never joined — both were
 refused every role check. Configure it with `AddMembershipAuthorization(o => o.HomeTenantRoles.Add("Service"))`.
 Empty by default, consulted only when the actor's tenant differs from the data owner's, and only the
 named roles cross.

### Fixed

- **The native PostgreSQL commit-order reader reads a store under any column mapping.** It selected the
 event table with a wildcard, which returns no system column. A write context that applies the
 framework's own row-version convention maps the entry's row version onto PostgreSQL's `xmin`, so every
 catch-up of every projection grain failed with `42703: column s.xmin does not exist` and retried for
 ever — no checkpoint written, nothing dead-lettered, the host reporting healthy and every write
 succeeding. The reader now names the columns the model maps. A consumer who worked around this by
 unmapping `EventStreamEntry.RowVersion` can drop the workaround.
- **Entries committed together reach a store-reading projection in stream order.** The native reader
 returned the entries of one commit in the order the database inserted the rows, which is not the order
 they were appended in: a stream created and appended to in one save could hand a projection version 2
 before version 1, and no retry could help, because the beginning was behind it in the same partition
 rather than late. Each stream's entries are now returned in version order, which is what the portable
 counter already did. Entries of different streams in one commit may still be interleaved in any order.

### Changed

- **The cross-tenant authorizer now recognises a configured platform role held through the actor's own
 membership.** `MembershipCrossTenantAuthorizerOptions.CrossTenantRoles` is documented as the path for
 an operator who holds no membership in the tenant they administer, but the role was looked up through
 a role check that reads the subject tenant — the very tenant the option says the actor is not a member
 of. On the membership level it could therefore never pass, and a machine actor has no global role
 level at all, so for a machine actor the option did nothing. The actor's own membership is now
 consulted as well.
 **This permits cross-tenant operations that were refused before.** Before upgrading, check what the
 names in your `CrossTenantRoles` mean on both role levels: a host that configured `"Admin"` intending
 the global Identity role now also admits an actor holding a tenant-scoped membership role of the same
 name in its own tenant. `"Admin"`, `"Owner"` and `"TenantAdmin"` collide between the two levels
 routinely. The widening is in the direction the requirement has always stated, and it reaches only
 actors holding a role the host itself named.

- **Appending without a causation identity is refused before the commit.** The session context carries a
 nullable causation id, but the store requires one of every entry, and only `AddCommandAuditing()`
 supplies it. A host that had not registered it met a `23502` not-null violation from the database that
 read like a schema fault. `SaveChangesAsync` now refuses the append before the transaction opens, with a
 message naming the registration. `AddCommandServices()` still does not register the auditing behaviours
 — where they sit in the pipeline is a consumer's decision.