Wave 2: six evidence fixes, verified in parallel, plus the records they falsified

.github/ISSUE_TEMPLATE/release_checklist.yml

@@ -18,9 +18,18 @@ body:
     attributes:
       label: GitHub / nuget.org (one-time or per repo)
       options:
-        - label: Trusted Publishing registered for `release.yml` (and `release-nuget.yml` if NuGet-only OIDC) — see `docs/PUBLISHING.md`
+        - label: Trusted Publishing registered on nuget.org for workflow file `reusable-release-nuget.yml` — the REUSABLE workflow that runs `NuGet/login`, not `release.yml` or `release-nuget.yml`; a policy on a caller does not match (`docs/PUBLISHING.md`). `NUGET_USER` is the nuget.org profile name of whoever created the policy
         - label: Repo variables set (`NUGET_PUBLISH_MODE`, optional staging/post-push/SBOM) — `docs/GitHubRepoVariables.md`
         - label: Secrets present (`NUGET_USER` for OIDC, `NUGET_API_KEY` if apikey mode, optional `NUGET_STAGING_API_KEY`, `RELEASE_NOTIFICATION_WEBHOOK_URL`)
+  - type: checkboxes
+    id: before_tag
+    attributes:
+      label: Before you tag (docs/RELEASE_RUNBOOK.md steps 4-9)
+      options:
+        - label: "Step 4: VERSION, ci/published-version and consumer-template's AshlarConsumerPackageVersion bumped together on the release commit"
+        - label: "Steps 5-7: consumer trust rows rewritten, published-version docs bumped, PublicAPI Unshipped promoted to Shipped"
+        - label: "Step 8: rehearsed with a prerelease (release-nuget.yml, X.Y.Z-rc1) and the whole post-push chain went green"
+        - label: "Step 9: bash scripts/release/readiness-verdict-for-sha.sh <sha> printed VERIFIED and exited 0 for the exact commit being tagged"
   - type: checkboxes
     id: ship
     attributes:

.github/workflows/compose-gate.yml

@@ -39,6 +39,10 @@ jobs:
           set -euo pipefail
           mkdir -p test-results
           docker compose -f deploy/compose/docker-compose.test.yml up --build --abort-on-container-exit --exit-code-from test-ubuntu test-ubuntu
+          # The service's pinned filter (FullyQualifiedName~BaseFrameworkSmokeTests) exits 0 when it
+          # matches nothing, and the service then writes ok:true whether or not a test ran. Its TRX
+          # lands here through the ../../test-results volume; the guard fails the step if it ran nothing.
+          bash scripts/ci/zero-test-guard.sh test-results/ubuntu-baseframework.trx
           test -f test-results/ubuntu-results.json
           test -f test-results/ubuntu-logs.txt
 
@@ -77,6 +81,7 @@ jobs:
           path: |
             test-results/ubuntu-results.json
             test-results/ubuntu-logs.txt
+            test-results/ubuntu-baseframework.trx
             ${{ runner.temp }}/compose-test-summary.txt
           retention-days: 14
 

.github/workflows/cross-platform-tests.yml

@@ -55,6 +55,10 @@ on:
 #      - 'src/Ashlar.Tests.Application/**'
 #      - 'application/src/Ashlar.Tests.CLI/**'
 #
+# Every filtered `dotnet test` below pins -f and writes its own TRX, and each step ends with
+# scripts/ci/zero-test-guard.sh over those files. Before, each ran both target frameworks under ONE
+# LogFileName, so net10.0's TRX overwrote net8.0's ("WARNING: Overwriting results file") and a
+# framework whose filter matched nothing left no trace in the file the publish step read.
 jobs:
   cross-platform:
     name: Build & Test - ${{ matrix.os }}
@@ -86,117 +90,224 @@ jobs:
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
             --no-build \
             --blame-hang-timeout 450s \
             --filter "(FullyQualifiedName~BaseFrameworkSmokeTests|FullyQualifiedName~RuntimeStudioBlackBoxSmokeTests)" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=smoke-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=smoke-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
+            --no-build \
+            --blame-hang-timeout 450s \
+            --filter "(FullyQualifiedName~BaseFrameworkSmokeTests|FullyQualifiedName~RuntimeStudioBlackBoxSmokeTests)" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=smoke-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
           dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net8.0 \
             --no-build \
             --blame-hang-timeout 60s \
             --filter "FullyQualifiedName~RuntimeStudioWhiteBoxSmokeTests" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=smoke-whitebox-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=smoke-whitebox-net8.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net10.0 \
+            --no-build \
+            --blame-hang-timeout 60s \
+            --filter "FullyQualifiedName~RuntimeStudioWhiteBoxSmokeTests" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=smoke-whitebox-net10.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/smoke-net8.0-${{ matrix.os }}.trx test-results/smoke-net10.0-${{ matrix.os }}.trx test-results/smoke-whitebox-net8.0-${{ matrix.os }}.trx test-results/smoke-whitebox-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (playground)
         if: github.event.inputs.scope == 'playground'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
             --no-build \
             --blame-hang-timeout 900s \
             --filter "Category=Playground" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=playground-infra-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=playground-infra-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
+            --no-build \
+            --blame-hang-timeout 900s \
+            --filter "Category=Playground" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=playground-infra-net10.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 300s \
+            --filter "Category=Playground" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=playground-bg-net8.0-${{ matrix.os }}.trx" \
             --results-directory test-results
           dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 300s \
             --filter "Category=Playground" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=playground-bg-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=playground-bg-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/playground-infra-net8.0-${{ matrix.os }}.trx test-results/playground-infra-net10.0-${{ matrix.os }}.trx test-results/playground-bg-net8.0-${{ matrix.os }}.trx test-results/playground-bg-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (dogfood)
         if: github.event.inputs.scope == 'dogfood'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 180s \
+            --filter "FullyQualifiedName~Dogfood" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=dogfood-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 180s \
             --filter "FullyQualifiedName~Dogfood" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=dogfood-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=dogfood-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/dogfood-net8.0-${{ matrix.os }}.trx test-results/dogfood-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (integration)
         if: github.event.inputs.scope == 'integration' || github.event.inputs.scope == 'full'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 720s \
+            --filter "Category=Integration" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=integration-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 720s \
             --filter "Category=Integration" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=integration-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=integration-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/integration-net8.0-${{ matrix.os }}.trx test-results/integration-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (persistence)
         if: github.event.inputs.scope == 'persistence' || github.event.inputs.scope == 'full'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 60s \
+            --filter "FullyQualifiedName~InMemoryPersistenceTests" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=persistence-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 60s \
             --filter "FullyQualifiedName~InMemoryPersistenceTests" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=persistence-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=persistence-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/persistence-net8.0-${{ matrix.os }}.trx test-results/persistence-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (e2e)
         if: github.event.inputs.scope == 'e2e' || github.event.inputs.scope == 'full'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
             --no-build \
             --blame-hang-timeout 900s \
             --filter "Category=E2E" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=e2e-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=e2e-net8.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
+            --no-build \
+            --blame-hang-timeout 900s \
+            --filter "Category=E2E" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=e2e-net10.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/e2e-net8.0-${{ matrix.os }}.trx test-results/e2e-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (adaptation)
         if: github.event.inputs.scope == 'adaptation'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
             --no-build \
             --blame-hang-timeout 90s \
             --filter "Category=Adaptation" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=adaptation-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=adaptation-net8.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
+            --no-build \
+            --blame-hang-timeout 90s \
+            --filter "Category=Adaptation" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=adaptation-net10.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/adaptation-net8.0-${{ matrix.os }}.trx test-results/adaptation-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (trust)
         if: github.event.inputs.scope == 'trust' || github.event.inputs.scope == 'full'
         shell: bash
         run: |
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 180s \
+            --filter "FullyQualifiedName~Trust" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=trust-infra-net8.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 180s \
             --filter "FullyQualifiedName~Trust" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=trust-infra-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=trust-infra-net10.0-${{ matrix.os }}.trx" \
+            --results-directory test-results
+          dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net8.0 \
+            --no-build \
+            --blame-hang-timeout 60s \
+            --filter "FullyQualifiedName~Trust" \
+            --logger "console;verbosity=minimal" \
+            --logger "trx;LogFileName=trust-bg-net8.0-${{ matrix.os }}.trx" \
             --results-directory test-results
           dotnet test src/Ashlar.Tests.BackgroundAgents/Ashlar.Tests.BackgroundAgents.csproj \
+            -f net10.0 \
             --no-build \
             --blame-hang-timeout 60s \
             --filter "FullyQualifiedName~Trust" \
             --logger "console;verbosity=minimal" \
-            --logger "trx;LogFileName=trust-bg-${{ matrix.os }}.trx" \
+            --logger "trx;LogFileName=trust-bg-net10.0-${{ matrix.os }}.trx" \
             --results-directory test-results
+          bash scripts/ci/zero-test-guard.sh test-results/trust-infra-net8.0-${{ matrix.os }}.trx test-results/trust-infra-net10.0-${{ matrix.os }}.trx test-results/trust-bg-net8.0-${{ matrix.os }}.trx test-results/trust-bg-net10.0-${{ matrix.os }}.trx
 
       - name: Run tests (full Infrastructure)
         if: github.event.inputs.scope == 'full'

.github/workflows/distribution-matrix-gate.yml

@@ -191,7 +191,9 @@ jobs:
           dotnet test src/Ashlar.Tests.Infrastructure/Ashlar.Tests.Infrastructure.csproj \
             -f net10.0 \
             --filter "FullyQualifiedName~Ashlar.Tests.Infrastructure.Tests.VirtualProduction.FrameworkVirtualProdDemosTests.Virtual_prod_IAshlarClient_GetStatusAsync_matches_console_and_blazor_demos" \
+            --logger "trx;LogFileName=virtual-prod-client.trx" --results-directory test-results \
             --verbosity minimal
+          bash scripts/ci/zero-test-guard.sh test-results/virtual-prod-client.trx
 
   pack-hosting-graph-alignment:
     name: Pack script vs Ashlar.Hosting graph