# CRM AppRelease `0.21.0`

This immutable CRM AppRelease preserves the complete `0.20.0` metadata,
Integration command registrations, Flow Actions, and saved Report/Dashboard
handler. It adds the sfcrm-owned approval lifecycle handler and declares its
existing private Runtime dependencies:

```text
ApprovalExecute + ApprovalRead
```

The handler serves the established submit, approve, reject, reassign, recall,
pending, latest-instance, and step-display Salesforce routes through the one
private Platform target. Runtime owns authorization, immutable Catalog
selection, transaction ownership, and durable replay. sfcrm owns the
Salesforce-compatible request and response projection. Approval metadata
administration, cloning, and notification-flow discovery remain outside this
runtime consumer slice and no legacy or process-local fallback is installed.
Known Salesforce selectors that neutral Approval v1 cannot represent fail
closed before the Runtime boundary instead of being silently discarded.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.21.0`
- AppReleaseDigest:
  `sha256:838c769d2c8881edaa13b880d56322290b5f950ebf5e520f5919d569061aa56d`
- MetadataBundleDigest:
  `sha256:7a8313c7d5640ffe88c09a9ef37b5b3b556bb34bd76459d74ae052197626f8e1`
- component count: `70` (unchanged)
- sfcrm provided capability count: `14`
- source input revision: `ac7bfb2c9d8846b29067754f0660efa12282c63a`
- source tree digest:
  `sha256:4074c494e8f6d0032e32bcb7b00696e8356dee314b7ed0d30c208543d8c316b5`
- contract module: `v0.2.25`
- wire module: `wire-go/v0.1.23`

This release adds no RPC, Runtime engine, serving binary, Gateway, metadata
authority, process-local fallback, deployment configuration, or production
activation. Production routing, metadata, Flow state, BOM, and deployed
services remain unchanged.

`app-package.json` is canonical and reproducible from the exact source input.
`publisher-attestation.json` binds that package to its source revision.
`publisher-public-key.json` is verification material only; it does not create
publisher trust.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.21.0-source \
  ac7bfb2c9d8846b29067754f0660efa12282c63a
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.21.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package-0.21.0.json
cmp /tmp/crm-app-package-0.21.0.json \
  ../../releases/io.nexuscrm.sfcrm/0.21.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.21.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.21.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.21.0/publisher-public-key.json
```