# CRM AppRelease `0.27.0`

This immutable CRM AppRelease preserves the complete `0.26.0` Catalog handler
surface and updates the packaged `nexuscrm-ai-connect` public OAuth client for
resource-bound MCP authorization. The client retains its stable Client ID,
S256 PKCE requirement, read-only scope, explicit consent policy, and Claude
callback allowlist, while allowing only the authorization-code grant and
disabling refresh-token issuance.

MCP resource access is deliberately access-token-only: the L0 authorization
policy rejects resource-bound clients that can issue refresh tokens. This is a
client policy correction, not dynamic registration or a new public-client
surface. Other agents remain supported through administrator-provisioned
connected apps with their own registered callbacks.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.27.0`
- AppReleaseDigest:
  `sha256:0809e2a0ba2e1096577856fded3c2b2cac498b063e050b9647d3a6c13b159df7`
- MetadataBundleDigest:
  `sha256:5a9106cfa5ebb2cb07cd5be69bf24ec26cf7c2af84602d7fe43474e7f55c448e`
- component count: `70` (unchanged)
- sfcrm provided capability count: `16` (unchanged)
- source input revision: `6570c62fbf5df7e73fe9b6d59419557f74ea654f`
- source tree digest:
  `sha256:9eca5894f9d9a4c772882cff984a5dfe3f699fe8d39995dfa9fdb2209067be7f`
- contract module: `v0.2.28`
- wire module: `wire-go/v0.1.25`

This release changes no runtime handler, deployed routing, active metadata,
Flow state, or BOM. Historical `0.26.0` remains immutable and reproducible.

`app-package.json` is canonical and reproducible from the exact source input.
`publisher-attestation.json` binds that package to its source revision.
`publisher-public-key.json` is verification material only; it does not create
publisher trust.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.27.0-source \
  6570c62fbf5df7e73fe9b6d59419557f74ea654f
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.27.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package-0.27.0.json
cmp /tmp/crm-app-package-0.27.0.json \
  ../../releases/io.nexuscrm.sfcrm/0.27.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.27.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.27.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.27.0/publisher-public-key.json
```