# CRM AppRelease `0.3.0`

This immutable CRM AppRelease adds the query capability required by the first
D2A synchronous-read family while preserving the record-access capability from
`0.2.0`. It is a Catalog installation input, not a production route, service
image, AppInstallation, serving pointer, or deployment.

- App: `io.nexuscrm.sfcrm`
- semantic version: `0.3.0`
- AppReleaseDigest:
  `sha256:2aca321c7a1ce14a4ea819bab2e4f82508919d36b0c1c9edc0df29935004b35c`
- MetadataBundleDigest:
  `sha256:05591b7cfc8f14631d484066ff8244388e3b1bb74a8288c9c79fc01cad105213`
- component count: `60`, exactly one per component in the source
  `salesforce-crm-standard/pack.json`
- source input revision: `b567cd2a163b6cdfef68a6476050736e8cd849c2`

The AppManifest declares exactly two L1 service-handler capabilities:

- `io.nexuscrm.sfcrm.query.v1` requires `runtime.records.query.v1`;
- `io.nexuscrm.sfcrm.ui.record-access.v1` requires
  `runtime.records.evaluate-access.v1`.

`app-package.json` is canonical and reproducible from the exact source inputs.
The builder has an explicit closed conversion table for the 23 CRM component
kinds and canonicalizes their JSON through controlplane's neutral
`componentbehavior.CanonicalJSONV1`; an unknown kind or duplicate JSON key
fails closed. Its file SHA-256 is transport integrity only; the release
identity is the AppReleaseDigest above.

`publisher-attestation.json` binds the release tuple and exact source
provenance. `publisher-public-key.json` is verification material, not publisher
trust; Catalog's independent trust authority must approve that exact key before
import. The AppRelease contains no service image identity. L2 binds the
independently published AppService image in its immutable BOM.

Rebuild and verify:

```bash
git worktree add /tmp/nexuscrm-app-packs-0.3.0-source \
  b567cd2a163b6cdfef68a6476050736e8cd849c2
cd tools/crm-app-release
GOWORK=off go test ./... -count=1
GOWORK=off go run . build \
  --pack-root /tmp/nexuscrm-app-packs-0.3.0-source/salesforce-crm-standard \
  --output /tmp/crm-app-package-0.3.0.json
cmp /tmp/crm-app-package-0.3.0.json \
  ../../releases/io.nexuscrm.sfcrm/0.3.0/app-package.json
GOWORK=off go run . verify \
  --package ../../releases/io.nexuscrm.sfcrm/0.3.0/app-package.json \
  --attestation ../../releases/io.nexuscrm.sfcrm/0.3.0/publisher-attestation.json \
  --public-key ../../releases/io.nexuscrm.sfcrm/0.3.0/publisher-public-key.json
```