Checkpoint.Core 0.3.0

• .NETStandard 2.0

  • BouncyCastle.Cryptography (>= 2.4.0)
  • Microsoft.Extensions.Http (>= 8.0.1)
  • Microsoft.Extensions.Logging.Abstractions (>= 8.0.2)
  • Microsoft.Extensions.Options (>= 8.0.2)
  • System.Net.Http.Json (>= 8.0.1)
  • System.Text.Json (>= 8.0.5)

• net8.0

  • BouncyCastle.Cryptography (>= 2.4.0)
  • Microsoft.Extensions.Http (>= 8.0.1)
  • Microsoft.Extensions.Logging.Abstractions (>= 8.0.2)
  • Microsoft.Extensions.Options (>= 8.0.2)
  • System.Text.Json (>= 8.0.5)
  • Wasmtime (>= 22.0.0)

0.3.0 — Hang fix follow-up to 0.2.9 (CRITICAL for anyone on 0.2.4–0.2.9)

0.2.9 (#1829) added ConfigureAwait(false) and a relative-URL fix in
McpInstructBuilder. 0.3.0 builds on that with the bounded-fetch +
negative-cache + URL-validation work needed to actually prevent the
hardwareworld.com class of hang, not just the synchronization-context
amplification of it. Anyone running 0.2.4–0.2.9 should upgrade.

Changes:
* PolicyEvaluator: cap lock-wait at 2s and policy-fetch at 3s via linked
 CancellationTokenSource. Worst-case per-request policy time bounded
 regardless of HttpClient timeout or retry behavior.
* PolicyEvaluator: short (10s) negative cache after a failed/null fetch so
 one slow backend doesn't cascade into per-request retries serialised
 through the SemaphoreSlim.
* PolicyEvaluator: stale-on-failure — if a refresh fails, keep serving the
 last-known-good policy rather than dropping to local-only enforcement.
* CheckpointModule / UseCheckpoint(): pre-warm the policy cache on
 initialization so the first real request never pays the cold-cache cost.
* CheckpointApiClient: per-call retry budget (1 retry, 3s total) for
 policy fetches; telemetry endpoints unchanged.
* PolicyCacheTtlMinutes default raised from 1 → 5 to cut steady-state
 policy traffic 5×. Set lower explicitly for rapid-rollout setups.
* ConfigureAwait(false) added to all library awaits (CheckpointModule,
 CheckpointMiddleware, PolicyEvaluator, CheckpointApiClient,
 SignatureVerificationHelper) — eliminates classic ASP.NET sync-context
 amplification on the .NET Framework adapter.
* Redirect branches now reject non-absolute / non-http(s) URLs from
 policy.RedirectUrl and Checkpoint:McpServerUrl. A relative URL like
 "/connect/{projectId}" used to 302 the request back into the customer's
 own host, looping through the same module and surfacing as a hung
 connection. When neither the policy URL nor the local McpServerUrl is
 an absolute http(s) URL, the module falls through to the default block
 response and emits a Trace warning identifying which value(s) were
 malformed. UrlHelpers.TryResolveAbsoluteRedirect / IsAbsoluteHttpUrl
 added for both adapters.

Note: Checkpoint.FailOpen catches *exceptions*, not *hangs*. Before 0.2.9
a slow policy fetch never threw, so FailOpen=true did not protect the
request path. With 0.2.9 the bounded-wait CTS makes this distinction
mostly moot, but the underlying behavior is unchanged.