Version Upgrade Notes

This page tracks important changes on the NcfPackageSources development branch. The 2026-07 section retains the historical baseline checked on 2026-07-27; the Repository/background tenant scope upgrade was added on 2026-10-02 and the AIKernel local fine-tuning update on 2026-10-09. Project versions, Register versions, and published NuGet versions can differ; verify each separately during an upgrade.

AIKernel Local Fine-Tuning Upgrade (2026-10-09)

The current source lists Senparc.Xncf.AIKernel project version 0.16.4 and the companion fine-tuning Worker version 1.1.0. These are source versions, not confirmation that either package has been publicly released.

  • AIKernel adds an administrator-only local fine-tuning console backed by a separate authenticated Python Worker. Training remains disabled by default. Worker profiles are stored in the database; authentication keys belong in secure host configuration, not in the database or browser.
  • The Worker supports CPU/CUDA training through PyTorch and PEFT, and native Apple Silicon training through MLX. Available backends and methods are determined by Worker capability preflight. Worker 1.1 adds complete catalog paging and a persistent SQLite storeId; the legacy array APIs still return only the latest 100 records.
  • Training exports adapters and checkpoints for separate evaluation and inference deployment. It does not automatically resume interrupted jobs or publish an inference model.
  • Upgrade existing AIKernel installations through module management to apply the Worker-profile database migration. Deploy a matching Worker, configure its key through a secret store/environment, and enable training only after preflight and a real smoke test succeed.

See the AIKernel local fine-tuning guide for deployment requirements, validation steps, and operational limits.

Repository and Background Tenant Scope Upgrade (2026-10-02)

These are project versions in the development source for this upgrade, not a statement that these NuGet packages have been publicly released:

ProjectSource project version
Senparc.Ncf.Core0.30.2-preview9
Senparc.Ncf.Repository0.20.10-preview9
Senparc.Ncf.XncfBase0.28.1
Senparc.Xncf.Tenant0.15.14
Senparc.Xncf.WeixinManager0.24.11
Senparc.Xncf.NeuCharWorkflow0.4.3
Senparc.Xncf.XncfModuleManager0.15.11

Data-Access Boundaries

  • XNCF Services inject and reuse existing repositories. Use ServiceBase for ordinary CRUD and RepositoryBase.GeAll(...) for composed filters, projections, and cancellable queries.
  • WeixinClaw and workflow business queries no longer access DbContext directly. Ordinary business code does not duplicate tenant/soft-delete controls or call IgnoreQueryFilters().
  • Module menu permissions are saved through the existing SysRolePermissionService; tenant cache queries reuse TenantInfoRepository.
  • The base repository now provides SavePropertiesAsync. Workflow runtime updates save only selected properties, avoiding overwrites of a newer definition's GraphJson or Revision with stale runtime data.
  • Installation, migrations, table creation, and backups are infrastructure operations rather than ordinary business CRUD; this upgrade does not mechanically rewrite them.

Background Tenant Scopes

  • Core provides IBackgroundTenantScopeFactory. XncfBase registers the factory; the Tenant module's IBackgroundTenantProvider reuses the existing enabled-tenant cache.
  • ForEachEnabledTenantAsync runs callbacks in independent initialized tenant scopes. TryCreateScopeAsync creates a scope for a specified enabled tenant and returns null when none matches.
  • Single-tenant mode uses the default scope. Multi-tenant mode throws for a missing Provider or invalid data instead of falling back to global access.
  • WeixinClaw has removed cache reflection and repeated tenant setup, and now consistently handles task cancellation, completion, and disposal. Other background implementations are not automatically migrated by the new API.

Upgrade and Validation

  1. Upgrade mutually compatible library/module versions and rebuild the host. Do not equate source versions with published NuGet versions.
  2. No new entity or database migration is required for this change. Restart the host to activate the new DI registrations.
  3. Verify tenant isolation, soft deletion, and business filters in ordinary requests and newly created background scopes.
  4. Verify that disabled tenants receive no new execution scopes and that existing account polling is canceled after scanning. Verify single-tenant mode without a tenant registry.
  5. Verify shutdown, repeated scans, and cancellation-callback disposal without exceptions or deadlocks. Ensure workflow runtime saves do not overwrite a newer graph definition or revision.

2026-09-20 (Developer-MAF-V3-Spark)

  • Affected modules: Senparc.Ncf.XncfBase (XncfDatabaseDbContext), Senparc.Xncf.Tenant, Senparc.Areas.Admin (login / tenant management / AdminChat), Senparc.Web (site host)
  • Change type: behavior change (when multi-tenancy is enabled) / new features / defect fixes
  • Key changes:
    • XNCF database multi-tenant engine: XncfDatabaseDbContext.SetGlobalQuery is now aligned with SenparcEntitiesDbContextBase — when multi-tenancy is enabled, entities implementing IMultiTenancy but not IIgnoreMulitTenant automatically get a TenantId == current request tenant Id global query filter (stacked with the soft-delete filter); SaveChanges/SaveChangesAsync automatically stamp the current TenantId onto new entities. In single-tenant mode (the default, EnableMultiTenant: false) only the soft-delete filter applies — behavior is identical to previous versions.
    • Defect fix (TenantInfo mapping): restored the [NotMapped] new string TenantId shadow property on the TenantInfo model. The TenantInfos table (tenant registry) intentionally stores no TenantId column; without the shadow, EF Core maps the base-class int TenantId to a non-existent column and every tenant query fails at runtime.
    • JWT login tenant resolution: AdminUserInfoService.LoginAsync now behaves like the Cookie login — when multi-tenancy is enabled and the login supplies a TenantKey, the tenant is resolved and SetTenantInfo applied before the admin account query (previously the query ran before tenant resolution, so under the LoginInput rule that tenant's accounts were not found); the resolved TenantKey is written into the JWT claim so the LoginInput rule also works for JWT (desktop/backend) authentication. Unknown/disabled tenants return the same generic "wrong account or password" message.
    • Tenant management page (/Admin/TenantInfo): new Admins column (admin account count per tenant); new guarded delete handler OnPostDeleteAsync — the in-use tenant cannot be deleted, at least one enabled tenant must remain, and tenants with existing admin accounts cannot be deleted (prevents orphaned accounts) — returning localized, specific reasons on failure.
    • AdminChat per-account isolation: all session/message endpoints (list, detail, send, archive, delete, feedback) and Harness trajectory operations perform ownership checks against the logged-in admin; cross-account access returns "session not found or forbidden". Message feedback additionally has defensive ownership validation. Super administrators (administrator role) get a new Usage Stats panel: per-account session counts (total/active/archived/deleted), message counts, last-active time — counts only, no content; with multi-tenancy enabled the statistics are constrained by the tenant filter.
  • Upgrade steps:
    • Pull the latest code and re-run dotnet restore / dotnet build (see the NcfPackageSources source guide).
    • No new database migrations (everything uses the existing TenantId columns); back up the database before upgrading.
    • If you plan to enable multi-tenancy: confirm business tables already have the TenantId column; plan legacy-data ownership (TenantId = 0 is system-wide data and invisible to specific tenants once enabled — update legacy rows' TenantId to the target tenant Id at the database level if needed); choose a TenantRule (DomainName / RequestHeader / LoginInput).
  • Rollback guidance:
    • Single-tenant deployments need no action. For multi-tenant deployments rolling back the code, the TenantId columns and stamped values remain and do not affect single-tenant mode (no filtering is applied).
  • Verification checklist:
    • Single-tenant (default): login and all module query/write behavior match pre-upgrade (soft-delete filter unchanged).
    • Multi-tenant + LoginInput: entering the tenant name on the login page logs in that tenant's account; JWT login with TenantKey returns a valid token containing the TenantKey claim; a wrong tenant name returns the generic "wrong account or password".
    • Multi-tenant + DomainName/RequestHeader: different domains/headers resolve to different tenants with mutually invisible data; new entities are stamped with the current TenantId automatically.
    • Tenant management page: the Admins column values are correct; deleting the in-use tenant / the last enabled tenant / a tenant with accounts is each rejected with the corresponding message.
    • AdminChat: account A cannot access account B's sessions (not listed; direct access returns "not found or forbidden"); the super-admin Usage Stats panel shows only per-account counts and last-active time — no content fields.
    • All 166 Senparc.Areas.Admin unit tests pass (including the new AdminChatAccountIsolationTests).

2026-09-19 (Developer-MAF-V3-Spark)

  • Affected module(s): Senparc.Xncf.Sandbox, Senparc.Xncf.Sandbox.Abstractions
  • Change type: Added / Changed
  • Key change(s):
    • External JupyterLab control: a new AI-callable Function 创建 Notebook (LabCreateNotebook) writes nbformat-4 .ipynb files into the running Lab workspace for Python or C# (dotnet-interactive, kernel C# .NET SDK). The notebook source uses the Jupyter percent-file convention (# %% code-cell separator, # %% [markdown] markdown cells; an optional title becomes the first markdown heading). The existing 执行 Lab 命令 Function gains an optional StdinContent parameter (up to 32 KB) executed via docker exec -i, so commands can be piped into terminal programs or REPLs inside the container.
    • Optional extra port mappings at creation: JupyterLab sandboxes (jupyter-python / jupyter-csharp) accept an optional ExtraPortMappings string at creation (max 8 mappings; ; or , separated): 3000 (auto-allocated loopback host port), 9000:3000 (explicit loopback host port), *:3000 (auto host port on 0.0.0.0), *:9000:3000 (explicit external host port). Loopback binding is the default; 0.0.0.0 exposure is opt-in. Invalid entries, out-of-range ports, and duplicate host ports are rejected at creation. The NCF preview workload is unchanged and remains hardened.
    • Session alias: sessions support an optional display alias (≤ 128 characters), settable at creation and changeable/clearable any time via the new 修改别名 (UpdateAlias) Function; the admin session list shows alias and extra-port columns with an inline rename dialog.
    • Quota raised: per-user concurrent sessions 2 → 10; global concurrent sessions 20 → 50.
    • Persistence: two new nullable columns SandboxSession.Alias and SandboxSession.ExtraPorts are added by migrations for all six providers (Sqlite / SqlServer / MySql / Dm / Oracle / PostgreSQL). Both survive container destroy and are never cleared by the runtime — only manual rename/clear changes them.
  • Upgrade action(s):
    • Pull the latest code, re-run dotnet restore / dotnet build (see NcfPackageSources Source Guide).
    • Run the Senparc.Xncf.Sandbox database migration (20260918120000_AddAliasAndExtraPorts) in the host site; back up databases before upgrading.
  • Rollback guidance:
    • Both columns are additive and nullable; old code ignores them. Rollback is safe as long as the migration is not reversed; reversing the migration drops alias/port history.
  • Validation checklist:
    • Migration succeeds across all supported databases; existing sessions keep working with Alias / ExtraPorts null.
    • Creating a JupyterLab sandbox with ExtraPortMappings binds the requested ports (loopback by default; *: entries reachable on 0.0.0.0); invalid entries fail fast with a clear error.
    • 创建 Notebook produces a valid .ipynb for both Python and C# kernels, opens in JupyterLab, and respects the Overwrite flag.
    • 执行 Lab 命令 with StdinContent pipes input into the target command (e.g. a REPL) and times out as before.
    • Alias can be set at creation, renamed, and cleared from the admin list; the alias column renders for all rows.
    • A user can now hold up to 10 concurrent sessions; the global cap is 50.

2026-09-18 (Developer-MAF-V3-Spark)

  • Affected module(s): Senparc.Areas.Admin
  • Change type: Added
  • Key change(s):
    • Function global Provit access control via database policies (Senparc.Areas.Admin): global Provit (cross-module floating invocation) access for a Function was previously constrained only in code (FunctionRenderAttribute: AllowGlobalPivot / GlobalPivotRoleCodes / GlobalPivotPermissionCodes). Administrators can now store a per-Function database policy in a new ADMIN_NeuCharFunctionProvitAccess table (unique on ModuleUid + FunctionKey), following an ontology-style subject–resource–effect model: resource = (ModuleUid, FunctionKey); subjects = admin users, role codes and/or permission codes (any match passes); effect = Inherit (0) / Open (1) / Restricted (2) / Deny (3). A non-inherit policy overrides the code attributes — it can expose a Function the code does not declare global, or deny one the code allows; Inherit (or an absent policy) falls back to the code baseline.
    • Caching: all policy rows are cached in FullNeuCharFunctionProvitAccessCache (CO2NET cache strategy, same pattern as FullSystemConfigCache); every write invalidates the cache, and a database failure degrades gracefully to the code baseline.
    • Module-clear resilience: policy rows are intentionally not deleted when an XNCF module is uninstalled (module uninstall only drops the module's own DbContext tables). They remain as "orphan" policies and automatically re-apply after the module is reinstalled; only manual clearing on the management page performs a hard delete.
    • Management page: new Access Control page under the NeuCharPivot menu (/Admin/NeuCharPivot/Access, super admin only, page authorization AdminOnly). Each row shows the full decision context — module/Function identity, code baseline, current DB policy, and the resulting effective policy — with single-row editing (policy mode, user/role/permission pickers, remark) and batch operations: apply Open / Restricted / Deny / Inherit, or clear, across all selected rows.
    • Migrations synced for all six providers (Sqlite / SqlServer / MySql / Dm / Oracle / PostgreSQL); unit tests extended (DB override semantics, Restricted subject matching, orphan retention, binding normalization).
  • Upgrade action(s):
    • Pull the latest code, re-run dotnet restore / dotnet build (see NcfPackageSources Source Guide).
    • Run database migrations in the host site for Senparc.Areas.Admin (adds ADMIN_NeuCharFunctionProvitAccess); back up databases before upgrading.
  • Rollback guidance:
    • The new table is additive; no existing behavior changes unless a policy row is created. On rollback, existing policy rows are simply ignored by the old code (which only reads code attributes).
  • Validation checklist:
    • ADMIN_NeuCharFunctionProvitAccess migration succeeds across all supported databases.
    • Access Control page lists every catalog Function plus orphan policies; code baseline, DB policy and effective policy columns render correctly.
    • Saving an Open policy on a code-restricted Function allows any signed-in admin via global Provit; a Deny policy on a code-allowed Function rejects all global Provit access.
    • A Restricted policy grants access only to bound users / roles / permission codes (any match), and rejects accounts with none of the bindings.
    • Uninstalling a module keeps its policy rows (shown as orphans); reinstalling the module re-applies them automatically.
    • Batch open / restrict / deny / inherit / clear operate on the selected rows and the list refreshes with updated counts.

2026-09-06 / f668bf650..eca233bea (Developer-MAF-V3)

  • Affected module(s): Senparc.Areas.Admin, Senparc.Xncf.AIKernel, Senparc.Web (site host), Senparc.Xncf.NeuCharPivot (Provits)
  • Change type: Added / Changed
  • Key change(s):
    • NeuBell WebHook (WebAPI) notification settings (Senparc.Areas.Admin): administrators register WebHook endpoints per NeuBell provider (or all); on NeuBell item add/remove the system dispatches an asynchronous POST (fire-and-forget, SemaphoreSlim(4) gate). Per-setting provider filter, per-event toggles (added/removed), enable switch, optional HMAC-SHA256 signature (X-NeuBell-Signature: t=<unix>,v1=<hex>), and a test-send action. New table ADMIN_NeuBellWebHook with migrations for Sqlite / SqlServer / MySql / Dm / Oracle / PostgreSQL; an IHostedService monitor (polling via NeuBellWebHook:PollingIntervalSeconds, default 30s / min 5s, wake-on-change via the NeuBell change stream) diffs per-provider baselines to avoid false positives on restart or transient snapshot failure. Management page /Admin/NeuBell/Index (super admin only), linked from the footer NeuBell drawer.
    • AIKernel: token-usage monitoring with real-time aggregation and async per-run progress; the AI model list page shows usage directly.
    • Admin menu: left-menu search filter plus a menu "config mode" where first-level menus can be drag-reordered; saving really updates the stored Sort values.
    • Provits (NeuCharPivot): create Provits one by one, create/modify them via AI Chat, and build a "Provit Panel" bound to a special page (e.g. admin home admin-home) composing Provit Blocks from any XNCF module, with drag sorting and AI-assisted block editing.
    • Admin Chat Harness mode: optional long-task mode based on Microsoft Agent Framework (MAF) — step budget, timeout control, [[DONE]] completion marker, execution steps returned to the UI; simple chat remains default.
    • CloudflareProtect (Senparc.Web): new CloudflareProtect SystemConfig section (off by default); when enabled, fixed-window rate limiting + security headers activate immediately from the first request of a site visit.
  • Upgrade action(s):
    • Pull the latest code, re-run dotnet restore / dotnet build (see NcfPackageSources Source Guide).
    • Run database migrations in the host site for Senparc.Areas.Admin (adds ADMIN_NeuBellWebHook); back up databases before upgrading.
    • Optionally configure NeuBellWebHook:PollingIntervalSeconds (default 30s) and CloudflareProtect in appsettings.json; both are safe defaults.
  • Rollback guidance:
    • Keep previous NuGet packages and migration baselines; the ADMIN_NeuBellWebHook table is additive and not required for rollback. Restore from backup if a schema change misbehaves.
  • Validation checklist:
    • ADMIN_NeuBellWebHook migration succeeds across all supported databases.
    • Footer NeuBell drawer shows the "WebHook Settings" entry; /Admin/NeuBell/Index is reachable for super admin only.
    • Creating/saving/toggling/deleting a WebHook works; the test button returns success against a reachable endpoint.
    • A NeuBell item add/remove triggers exactly one POST to matching endpoints; disabled / non-matching / non-subscribed endpoints are not called.
    • AIKernel model list page displays token usage; the token monitor advances asynchronously per run.
    • Admin left-menu search filters results; config-mode drag reorder persists real Sort values.
    • Provits can be created one-by-one and via AI Chat; a Provit Panel bound to admin-home renders blocks from multiple modules.
    • Admin Chat Harness mode runs a long task and reports execution steps; Simple mode is unchanged.
    • With CloudflareProtect.Enabled=true, the site enforces rate limiting and security headers from the first request.

2026-08-29 / 8ccc5316b..f668bf650 (Developer-MAF-V3)

  • Affected module(s): Senparc.Xncf.AgentsManager, Senparc.Xncf.NeuCharWorkflow, Senparc.Ncf.XncfBase, Senparc.Ncf.Database, Senparc.Xncf.XncfBuilder
  • Change type: Added / Changed
  • Key change(s):
    • AgentsManager supports a Human-in-the-Loop policy: task execution can require human approval with configurable max chat rounds and tool permissions; groups automatically include human participants, and approval protocol content is excluded from the shared message history.
    • AgentsManager introduces independent AgentExecutionTask management (with multi-database migrations), AgentTemplate model binding, and empty-output-token retry; the agent editor can be opened in a new window, and the task management UI is refactored.
    • NeuCharWorkflow adds global NeuCharPivot floating invocation: [FunctionRender] gains an AllowGlobalPivot attribute for role-based access control, and functions not explicitly allowed cannot be invoked globally.
    • NeuCharWorkflow adds a Workflow Analytics page: filter by date range, workflow ID, and status, with data retrieval and summary generation.
    • NeuCharWorkflow adds a Human Input node: user prompts and external resume support, including external key validation.
    • NeuCharWorkflow standardizes timestamps on DateTimeOffset (UTC); replay supports "load more events"; AbortRun can target a specific execution log ID; the workflow function calling provider supports larger loop iterations with scoped service isolation.
    • ChatGroupService uses IServiceScopeFactory for isolated scope execution, refines turn token logic, and logs approval call IDs; ContextSharingRoundRobinGroupChatManager excludes approval protocol content when updating message history.
    • New AgentModelRequestDiagnostics for diagnosing agent model request failures and extracting errors, with automatic sensitive-data redaction.
    • NeuCharWorkflowExpressionEngine switches JSON serialization to custom JsonSerializerOptions so non-ASCII characters (e.g. Chinese text) are preserved.
    • Versions & dependencies: XncfBuilder template bumped to 1.1.7, Senparc.Ncf.Database bumped to 0.21.8-preview8 (enhanced multi-database support matrix logging), and version bumps across multiple projects.
    • The download page supports source selection (auto / local / GitHub) and displays MD5 fingerprints; localization resources updated in multiple languages.
    • New local database configuration sample SenparcConfig.config; NCF Desktop updated to 0.10.1-build10066 (Linux / macOS / Windows).
  • Upgrade action(s):
    • Pull the latest code, then re-run dotnet restore / dotnet build (see NcfPackageSources Source Guide).
    • Run database migrations in the host site for affected modules (AgentsManager, etc.); back up databases before upgrading.
  • Rollback guidance:
    • Keep previous NuGet packages and migration baselines; database schema changes are not designed for direct downgrade, restore from backup when necessary.
  • Validation checklist:
    • AgentExecutionTask migrations succeed across all supported databases; task creation, filtering, and execution records work correctly.
    • Human-in-the-Loop approval, human participation, max rounds, and tool permissions behave as configured.
    • NeuCharPivot global invocation only allows functions marked AllowGlobalPivot; unauthorized calls are rejected.
    • Workflow Analytics page filters correctly by date / workflow / status and generates summaries.
    • Download page source switching works, MD5 fingerprints display correctly, and localization is complete.
    • NCF Desktop 0.10.1 downloads and starts correctly.

For API examples and constraints, see Multi-Tenant Configuration and Background Work, the Repository Guide, and the Service Guide.

Upgrade Summary (2026-07)

1. Runtime Migration to .NET 10

  • The simulated Senparc.Web host now targets net10.0.
  • The local http profile uses http://localhost:5000, the https profile uses https://localhost:5111, and Docker HTTPS uses port 5001.
  • Check the SDK, CI images, Docker base images, and deployment hosts together instead of changing only TargetFramework.

2. AI, Prompt, and Agent Workflows

  • The AgentsManager Register version is now 0.3.22.
  • MAF/Agent workflows continue to expand with Prompt streaming, chat archiving, pending tasks, and batch-task capabilities.
  • AIKernel -> PromptRange -> AgentsManager is part of the default installation combination. KnowledgeBase/RAG remains an explicit, scenario-driven installation and configuration step.

3. Six-Language Localization

  • Site, admin, and installer resources cover zh-CN, en, ja, fr, es, and ru.
  • Function request parameters can bind resource keys through [LocalizedDescription].
  • When adding a language, update resource files, SupportedCultures, the UI selector, and fallback-language tests together.

4. XNCF Template Structure

  • The source template package is currently 0.13.0; the XncfBuilder project version is 0.37.0-preview5.
  • Template 0.13.0 adds an EventBus round-trip example under Application/Events and Application/EventHandlers.
  • New templates place Function implementations and DTOs under Application/AppServices and Application/DTOs.
  • Functions are discovered from [FunctionRender] methods on AppServiceBase. Do not restore the retired IXncfFunction or Register.Functions model.

5. Installer and Desktop Host

  • First-time installation preselects Administrator, PromptRange, XncfBuilder, MCP, AIKernel, and AgentsManager.
  • A confirmation list is shown before state is written; cancelling the dialog does not install modules.
  • The desktop host includes dynamic update sources, download progress, high-DPI, and WebView improvements. Private update sources should be tested for address resolution, package integrity, rollback, and configuration preservation.

6. MCP Routing and Version Boundaries

  • The MCP project NuGet version is 0.4.0-preview3, while its module Register.Version remains 0.1.0; they serve different purposes.
  • A module with EnableMcpServer => true is automatically mapped as mcp-<lowercase-module-name-with-dots-replaced-by-hyphens>.
  • The MCP module SSE endpoint is /mcp-senparc-xncf-mcp/sse; do not duplicate registration in Startup.
  • McpAccessToken is not currently enforced on the automatic mapping path. Add authentication, rate limiting, a tool allowlist, and auditing before external exposure.

7. Version-Upgrade Record Rules

  • A version window must include commits after the merge base and current uncommitted changes.
  • Recursively inspect affected .cs, .csproj, .props, and their importers instead of bumping a single project.
  • Every functional .cs change needs matching coverage in the current release-note block, without duplicating existing entries.
  • Track Register.Version, assembly/project version, template package version, and published NuGet version separately.
  1. Pin the target commit or release tag; do not use “latest” as a reproducible baseline.
  2. Install the .NET 10 SDK and verify global.json, CI, and container images.
  3. Upgrade NCF/XNCF packages, then migrate retired Function and template paths based on compiler feedback.
  4. Review installer defaults, localization resources, MCP exposure policy, and desktop update sources.
  5. Complete database migrations in an isolated environment before production deployment.

Post-Upgrade Validation Checklist

  • Start the host with an explicit launch profile and verify the protocol on ports 5000 and 5111.
  • Verify all six installer defaults, confirmation, cancellation, and repeated entry into the install flow.
  • Verify module installation, enablement, menus, permissions, and database migrations.
  • Confirm [FunctionRender] discovery, execution, and localized parameter text.
  • Confirm there is one MCP route mapping, the SSE endpoint connects, and external access is authenticated and rate-limited.
  • Exercise critical AI/Prompt/Agent streaming, archive, pending-task, and batch-task paths.
  • Switch among all six languages and verify safe fallback for missing resources.
  • Test desktop update-source resolution, progress, failed-upgrade rollback, and preservation of user settings.
  • Confirm there are no persistent database, model-service, network, or background-task errors.

Related documentation: