# CRM AppRelease `0.12.0`

This immutable CRM AppRelease activates the L1-owned effective-permission and
curated search-scope routes against the neutral Runtime effective-permission
and Catalog AppMetadata capabilities. All capabilities published by `0.11.0`
are preserved.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.12.0`
- AppReleaseDigest:
  `sha256:b5e635baef25f93e36bc12b099a5767e653133d82a68c0987312fdabb84d5a8f`
- MetadataBundleDigest:
  `sha256:ee6f67e3b7e630331e68b610227679fc1a1b46e4cbc2ff240dd16a2bcd7a749c`
- component count: `66`, exactly one per component in the source
  `salesforce-crm-standard/pack.json`
- source input revision: `b6a51ba24d59b1d44adfeddf85ef912d77037f54`

The AppManifest adds exactly two L1 service-handler capabilities:

- `io.nexuscrm.sfcrm.effective-permissions.v1` requires
  `runtime.permissions.read-effective.v1`;
- `io.nexuscrm.sfcrm.search-scope-order.v1` requires both
  `catalog.consumer.app-metadata-view.v1` and
  `runtime.permissions.read-effective.v1`.

The sfcrm production command installs the effective-permission and AppMetadata
ports together and advertises both handlers only with this release. Runtime
owns permission disclosure and immutable AppInstallation-scoped metadata;
sfcrm owns the Salesforce-compatible routes, response shape, and the
revision-matched search-scope intersection.

`app-package.json` is canonical and reproducible from the exact source inputs.
`publisher-attestation.json` binds the release tuple and exact source
provenance. `publisher-public-key.json` is verification material, not publisher
trust; Catalog's independent trust authority must approve that exact key before
import. The AppRelease contains no service image identity.

This artifact does not select an active AppInstallation, publish an AppService
image, switch traffic, or create a fallback. Those ownership changes remain
explicit M2/D3 activation gates.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.12.0-source \
  b6a51ba24d59b1d44adfeddf85ef912d77037f54
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.12.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package-0.12.0.json
cmp /tmp/crm-app-package-0.12.0.json \
  ../../releases/io.nexuscrm.sfcrm/0.12.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.12.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.12.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.12.0/publisher-public-key.json
```