yolo

.editorconfig

@@ -197,6 +197,7 @@ dotnet_diagnostic.IDE0060.severity = suggestion   # unused parameter
 
 # Permanently off — deliberate choices, not backlog.
 dotnet_diagnostic.CA1848.severity = none          # LoggerMessage source-gen delegates: not adopting
+dotnet_diagnostic.CA1873.severity = none          # Guarded log args: companion to CA1848; IsEnabled wrapping every call is noise without source-gen
 dotnet_diagnostic.CA2007.severity = none          # ConfigureAwait: no SynchronizationContext in ASP.NET Core
 
 # ── Analyzer rules: cleared backlog ─────────────────────────────────────────────────────────────────

.github/workflows/dev-container.yml

@@ -6,9 +6,9 @@ on:
     paths:
       - 'build/**'
       - 'docker/**'
-      - 'Runtime/**'
-      - 'Services/**'
-      - 'Craft.csproj'
+      - 'src/Craft/**'
+      - 'src/Craft.Configuration/**'
+      - 'src/Craft.Contracts/**'
       - 'Craft.sln'
       - 'tests/**'
       - 'Directory.Build.props'
@@ -73,9 +73,9 @@ jobs:
           context: .
           file: build/Dockerfile
           # Always re-resolve the base image instead of reusing whatever the runner or the GHA layer
-          # cache already has. The Dockerfile intentionally floats on the `8.0-*` tag so .NET runtime
+          # cache already has. The Dockerfile intentionally floats on the `10.0-*` tag so .NET runtime
           # patches are picked up automatically — but that only works if the tag is actually
-          # re-resolved. Without this, a patched runtime (e.g. 8.0.28 -> 8.0.29, six High CVEs) can sit
+          # re-resolved. Without this, a patched runtime (e.g. 10.0.9 -> 10.0.10) can sit
           # unapplied in published images while every project-level dependency scans clean.
           pull: true
           platforms: linux/amd64,linux/arm64
@@ -87,7 +87,7 @@ jobs:
             COMMIT_SHA=${{ github.sha }}
             IMAGE_TAG=dev
             BUILD_CONFIGURATION=Debug
-            DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }}
+            DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'mcr.microsoft.com' }}
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:dev
           labels: |
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}

.github/workflows/regression.yml

@@ -9,9 +9,9 @@ on:
     paths:
       - 'build/**'
       - 'docker/**'
-      - 'Runtime/**'
-      - 'Services/**'
-      - 'Craft.csproj'
+      - 'src/Craft/**'
+      - 'src/Craft.Configuration/**'
+      - 'src/Craft.Contracts/**'
       - 'Craft.sln'
       - 'tests/**'
       - 'Directory.Build.props'
@@ -22,9 +22,9 @@ on:
     paths:
       - 'build/**'
       - 'docker/**'
-      - 'Runtime/**'
-      - 'Services/**'
-      - 'Craft.csproj'
+      - 'src/Craft/**'
+      - 'src/Craft.Configuration/**'
+      - 'src/Craft.Contracts/**'
       - 'Craft.sln'
       - 'tests/**'
       - 'Directory.Build.props'
@@ -105,8 +105,13 @@ jobs:
       - uses: actions/checkout@v4
 
       # Build the AzureTables image the E2E stack runs (compose references it as craft:ci).
+      # --pull re-resolves floating 10.0-* bases; DOTNET_REGISTRY defaults to MCR until the GHCR
+      # CyberDrain mirror publishes .NET 10 tags (override via repo variable).
       - name: Build image
-        run: docker build -f build/Dockerfile -t craft:ci .
+        run: >
+          docker build --pull -f build/Dockerfile
+          --build-arg DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'mcr.microsoft.com' }}
+          -t craft:ci .
 
       # Brings up Azurite + the SUT (combined role), asserts every subsystem PASS/FAIL, and exits
       # non-zero on any failure. pwsh, docker, and docker compose are preinstalled on ubuntu-latest.

.github/workflows/release-container.yml

@@ -45,9 +45,9 @@ jobs:
           context: .
           file: build/Dockerfile
           # Always re-resolve the base image instead of reusing whatever the runner or the GHA layer
-          # cache already has. The Dockerfile intentionally floats on the `8.0-*` tag so .NET runtime
+          # cache already has. The Dockerfile intentionally floats on the `10.0-*` tag so .NET runtime
           # patches are picked up automatically — but that only works if the tag is actually
-          # re-resolved. Without this, a patched runtime (e.g. 8.0.28 -> 8.0.29, six High CVEs) can sit
+          # re-resolved. Without this, a patched runtime (e.g. 10.0.9 -> 10.0.10) can sit
           # unapplied in published images while every project-level dependency scans clean.
           pull: true
           push: true
@@ -57,7 +57,7 @@ jobs:
             APP_VERSION=${{ steps.version.outputs.app_version }}
             COMMIT_SHA=${{ github.sha }}
             IMAGE_TAG=latest
-            DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }}
+            DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'mcr.microsoft.com' }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:latest
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ steps.version.outputs.app_version }}

.gitignore

@@ -22,11 +22,11 @@ Thumbs.db
 # Logs
 *.log
 
-# Local settings (contains secrets)
-# CRAFT ships no appsettings.json — appsettings.example.jsonc is the annotated reference, and real
-# config comes from App__* env vars or a file the downstream app supplies. Anything matching
-# appsettings*.json here is therefore somebody's local override, which is exactly the file most likely
-# to hold a storage connection string. Keep it out of the repo.
+# Local settings
+# CRAFT ships no appsettings.json — appsettings.example.jsonc is the annotated reference.
+# Local secrets belong in `dotnet user-secrets` (UserSecretsId on Craft.csproj), not in a JSON file.
+# Anything matching appsettings*.json here is therefore a non-secret override (or a mistake); keep it
+# out of the repo either way.
 appsettings.json
 appsettings.*.json
 local.settings.json

Craft.sln

@@ -3,31 +3,84 @@ Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.0.31903.59
 MinimumVisualStudioVersion = 10.0.40219.1
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Craft", "Craft.csproj", "{5360BB79-F828-400C-B848-7429B0040F82}"
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Craft", "src\Craft\Craft.csproj", "{5360BB79-F828-400C-B848-7429B0040F82}"
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{BF4CE7B8-A874-4059-B557-5368C7A013EA}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Craft.Tests", "tests\Craft.Tests\Craft.Tests.csproj", "{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Craft.Configuration", "src\Craft.Configuration\Craft.Configuration.csproj", "{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Craft.Contracts", "src\Craft.Contracts\Craft.Contracts.csproj", "{C4EDF6C2-F305-4415-9882-D703465BBE3A}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
 		Release|Any CPU = Release|Any CPU
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|x64.Build.0 = Debug|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Debug|x86.Build.0 = Debug|Any CPU
 		{5360BB79-F828-400C-B848-7429B0040F82}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{5360BB79-F828-400C-B848-7429B0040F82}.Release|Any CPU.Build.0 = Release|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Release|x64.ActiveCfg = Release|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Release|x64.Build.0 = Release|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Release|x86.ActiveCfg = Release|Any CPU
+		{5360BB79-F828-400C-B848-7429B0040F82}.Release|x86.Build.0 = Release|Any CPU
 		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|x64.Build.0 = Debug|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Debug|x86.Build.0 = Debug|Any CPU
 		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|Any CPU.Build.0 = Release|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|x64.ActiveCfg = Release|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|x64.Build.0 = Release|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|x86.ActiveCfg = Release|Any CPU
+		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1}.Release|x86.Build.0 = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|x64.Build.0 = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Debug|x86.Build.0 = Debug|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|Any CPU.Build.0 = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|x64.ActiveCfg = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|x64.Build.0 = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|x86.ActiveCfg = Release|Any CPU
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C}.Release|x86.Build.0 = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|x64.Build.0 = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Debug|x86.Build.0 = Debug|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|x64.ActiveCfg = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|x64.Build.0 = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|x86.ActiveCfg = Release|Any CPU
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A}.Release|x86.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
 	EndGlobalSection
 	GlobalSection(NestedProjects) = preSolution
+		{5360BB79-F828-400C-B848-7429B0040F82} = {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
 		{185BC64D-BDDD-4684-BEDC-66F9BE9671E1} = {BF4CE7B8-A874-4059-B557-5368C7A013EA}
+		{C2867D09-61BF-4DED-9892-4BBB0AD9B34C} = {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
+		{C4EDF6C2-F305-4415-9882-D703465BBE3A} = {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
 	EndGlobalSection
 EndGlobal

Directory.Build.props

@@ -1,11 +1,12 @@
 <Project>
 
   <!--
-    Shared build settings for every project in the repo (Craft.csproj and anything under tests/).
+    Shared build settings for every project in the repo (src/Craft*, tests/).
     Per-project settings stay in the .csproj; anything that should be true everywhere lives here.
 
-    NOTE for build/Dockerfile: this file must be COPYied alongside Craft.csproj *before* `dotnet restore`,
-    otherwise restore and build evaluate different properties.
+    NOTE for build/Dockerfile: this file must be COPYied *before* `dotnet restore` of
+    src/Craft/Craft.csproj (and its ProjectReferences), otherwise restore and build evaluate
+    different properties.
   -->
 
   <PropertyGroup>