# CRM AppRelease `0.2.0`

This directory is the first immutable CRM AppRelease publication input for
NexusCRM serviceification. It is metadata-only delivery evidence for the first
record-access slice; it is not a production route, AppService, image,
AppInstallation, Catalog serving pointer, or deployment.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.2.0`
- AppReleaseDigest:
  `sha256:28ff98fbdf13d52f5dcdda362d3cdcb0d9bd012cefe218a98ebb642eabf6e802`
- MetadataBundleDigest:
  `sha256:880a7d3785854feaf14a663500b5d63366ffa8b1ef8c661a3d3cbef6bdc3b47c`
- component count: `54`, exactly one per component in the source
  `salesforce-crm-standard/pack.json`
- source input revision: `03435cd941f25e983c90dddd836dcbd1ae1fccea`

`app-package.json` is canonical and reproducible from the exact source inputs.
The builder has an explicit closed conversion table for the 23 CRM component
kinds and canonicalizes their JSON through controlplane's neutral
`componentbehavior.CanonicalJSONV1`; an unknown kind or duplicate JSON key
fails closed.
Its file SHA-256 is only transport integrity; the release identity remains the
AppReleaseDigest above. `publisher-attestation.json` is detached and binds the
release tuple plus provenance. `publisher-public-key.json` is verification
material, not publisher trust: an operator must approve/register that exact key
through Catalog's independent trust authority before import.

There is no independently published CRM AppService, so neither this AppRelease
nor its L2 BOM binding contains a service artifact reference. Frontend bytes
also remain an independent release plane; the AppManifest contains only their
compatibility requirements.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.2.0-source \
  03435cd941f25e983c90dddd836dcbd1ae1fccea
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.2.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package.json
cmp /tmp/crm-app-package.json \
  ../../releases/io.nexuscrm.sfcrm/0.2.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.2.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.2.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.2.0/publisher-public-key.json
```