# CRM AppRelease `0.13.0`

This immutable CRM AppRelease moves the L1-owned Salesforce
`/search/scopeOrder` route from the legacy process-local composition to the
neutral Runtime Search and Catalog AppMetadata capabilities. All capabilities
published by `0.12.0` are preserved.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.13.0`
- AppReleaseDigest:
  `sha256:6c41b0aa430c6d135c87a286ec8df245faae7a91c5fa59daf8e05a328f3d7474`
- MetadataBundleDigest:
  `sha256:ee6f67e3b7e630331e68b610227679fc1a1b46e4cbc2ff240dd16a2bcd7a749c`
- component count: `66`, exactly one per component in the source
  `salesforce-crm-standard/pack.json`
- source input revision: `fa93bc1af6242d52e15434a5ffbfd4844fc18e0c`

The existing `io.nexuscrm.sfcrm.search-scope-order.v1` handler now requires:

- `catalog.consumer.app-metadata-view.v1`;
- `runtime.search.records.v1`.

sfcrm obtains the eligible object order and object display facts from one
immutable AppMetadata view, passes the exact Catalog revision to Runtime, and
requires matching Catalog, SecurityEpoch, schema, and engine receipts. Runtime
owns effective read authorization and viewer MRU order; sfcrm owns the
Salesforce-compatible route, labels, key prefixes, URLs, and response shape.

`app-package.json` is canonical and reproducible from the exact source inputs.
`publisher-attestation.json` binds the release tuple and exact source
provenance. `publisher-public-key.json` is verification material, not publisher
trust; Catalog's independent trust authority must approve that exact key before
import. The AppRelease contains no service image identity.

This artifact does not select an active AppInstallation, publish an AppService
image, switch traffic, or create a fallback. Those ownership changes remain
explicit M2/D3 activation gates.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.13.0-source \
  fa93bc1af6242d52e15434a5ffbfd4844fc18e0c
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.13.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package-0.13.0.json
cmp /tmp/crm-app-package-0.13.0.json \
  ../../releases/io.nexuscrm.sfcrm/0.13.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.13.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.13.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.13.0/publisher-public-key.json
```