# HG issue 131 — actual published 1.0.0 verification

Both real stable **Client 1.0.0** and **Contracts 1.0.0** were observed in the live
Gitea indexes at 2026-11-10 19:35:54 UTC and restored into a fresh isolated cache.
The future consumer patch was applied only to a separate SDK 2 consumer archive.
Application files in this working branch remain on 0.4.0, unchanged.

- Full Gateway owning project: **529 total, 523 passed, 0 failed, 6 existing live skips**.
- Restore, test and repository execution-count guard exits: **0 / 0 / 0**.
- All **3 real TLS/h2c wire cases passed** against the published packages.
- Strict default rejected with AuthenticationException **UntrustedRoot**, before RPC.
- Explicit opt-out and plaintext/stale-TLS-settings cases each completed one RPC.
- Both assets entries are **type=package, version=1.0.0**, from the actual Gitea
  source. No source ProjectReference override: the archived Gateway csproj is
  byte-identical to the normal consumer csproj.
- The only package folder is the task-isolated cache. Both copied test-bin DLL
  hashes equal the package DLL hashes. No package was packed or published here.

Actual package RepositoryCommit for BOTH packages:
`ea9f21c850fb618767e12690924f9966f1e433ac`.
Consumer archive base: `4ea379fa92e571492ff9f49889a5eb91e3ad1e1a`.
Applied patch SHA-256: `9452ee82b2bace7828a384b9f6048e9c931e8b4ec2078e0ee1baa175d0652fac`.

| Package | NuGet package SHA-256 | Consumed DLL SHA-256 |
|---|---|---|
| ZB.MOM.WW.HistorianGateway.Client 1.0.0 | `0a3f2836727671c07c0c393e705cc9737d2ed44258213a51fb4acf0d0ab7129e` | `b89a02e0d228ec549c4dfb755694f7f67b573a6077f06ff2781165e884fc5e12` |
| ZB.MOM.WW.HistorianGateway.Contracts 1.0.0 | `83ffd12bcbbf919c973ba522560e10aa93a4cb8c686a3232030a2cfa5f00995e` | `e60d3d4650be5d251982f7847404daf1b666f61d56e2b0ccb844af8677e97743` |

Proof metadata/source/hash/readback checks:
`/tmp/historiangw-131-published-20261110T193638Z/published-package-proof.json`.
Full run metadata (including typed TLS error and package readback):
`/tmp/historiangw-131-published-20261110T193638Z/metadata.json`.
Fresh actual-package TRX: `/tmp/historiangw-131-published-20261110T193638Z/test-results`.
Restore/test/guard logs: `/tmp/historiangw-131-published-20261110T193638Z`.

This completes the isolated SDK 2 owning-project proof. The coordinator separately
owns the consumer-master full solution build, Astra review, landing/push and issue
131 comment/closure. No issue action, package publication, or HG user-checkout
mutation was performed by this validation lane. The live AVEVA fixture skips do
not substitute for the three executed local wire tests.

---

# Earlier archived-source validation

Future consumer patch validated against exact archived HG source commit
`e4321915ebc5e0704a68ecad21b85c1cc1c80d6b`. Consumer archive base:
`18c22cf7eb042126226e540d9b979907328055c3`. Patch SHA-256:
`9452ee82b2bace7828a384b9f6048e9c931e8b4ec2078e0ee1baa175d0652fac`.

## Scope and isolation

Mode: **unreleased source project references**, not published-package verification.
At that earlier source-validation time, both feed indexes still listed only
0.4.0, 0.3.0, 0.2.0, 0.1.0. The published-package run below supersedes that pending
release-availability status.

The user's HG checkout was only read by git archive. Only the disposable archived
consumer Gateway csproj had its two package references replaced by project
references into the exact archived HG source. No package was packed or published;
no fake 1.0.0 was inserted into any feed/cache. Restore used an independent copied
NuGet cache, isolated HTTP cache and CLI home. The normal consumer files remain
on published 0.4.0.

## Actual execution

- Full Gateway owning project: **529 total, 523 passed, 0 failed, 6 existing live skips**.
- Test exit **0**; repository nonzero-execution guard exit **0**.
- All three new local wire tests passed; no new skip or expected application-result change.
- Strict default: base HistorianGatewayException -> RpcException Status Internal ->
  HttpRequestException -> AuthenticationException, certificate-chain **UntrustedRoot**.
  The test explicitly requires the typed TLS authentication failure; RPC calls = **0**.
- Explicit TLS opt-out: actual metadata RPC succeeds; calls = **1**.
- Plaintext with stale opt-out and nonexistent CA path: actual metadata RPC succeeds;
  calls = **1**.

The first source run compiled and executed but failed one new assertion because
it predicted the narrower HistorianGatewayUnavailableException type. The actual
TLS exception is the public base HistorianGatewayException; the corrected assertion
retains the required AuthenticationException graph and zero-RPC check. The fresh
second unfiltered run above passed. The six skipped cases are the existing AVEVA
live fixture tests; they are not a substitute for TLS wire coverage.

Completed UTC: `2026-11-10T19:33:17.272468+00:00`.
Actual metadata, typed TLS exception output and binary hashes:
`/tmp/historiangw-131-validation-20261110T193106Z/metadata-final.json`.
Fresh second-run TRX: `/tmp/historiangw-131-validation-20261110T193106Z/test-results2`.
Test log: `/tmp/historiangw-131-validation-20261110T193106Z/test2.log`.
Initial failed run and restore logs are retained in the same task directory.

Archived-source Client DLL SHA-256:
`87e995a43c63debdd8f648a8feb8d19d9110b45eb7b2b6906159077d90109862`.
Archived-source Contracts DLL SHA-256:
`ebaaa43ffc485288054eb864a59ec59264d8d9c4ea6871319fd7995192370751`.

That earlier run consumed source only. Actual stable-package proof is recorded
above. Consumer-master solution build/review/landing and issue handling are owned
by the coordinator; no issue comment/close was performed here.