Route authority and admission

A selected route must know which deployment is allowed to serve it. Troolio represents this with a route key, positive epoch, and deployment fingerprint in AtomicRouteFence. An authoritative store compares the fence under the same transaction or lock that commits events. Promotion increments the epoch, so an uncommitted request from an older deployment fails.

Trust boundaries

• TrustedAtomicCommandIngressAdapter binds the caller's command to an authenticated route and canonical request identity.
• IAtomicCommandCurrentPrincipal supplies current principal evidence; copied message headers do not grant permission.
• OrleansAtomicNoSubscriberRouteAuthority and OrleansAtomicSubscriberRouteAuthority review actor classes, handlers, and subscriber registrations before a selected path is admitted.
• IAtomicRouteClusterLeaseAuthority and selected-route silo admission keep the serving cohort aligned with the deployment record.

A matching completed receipt can be replayed after promotion only after the current owner/deletion checks and exact request, batch, and route fence comparison. A stale uncommitted request cannot write. The host owns authentication, authorization, process identity, deployment review, and retirement sequencing.

Operational use

Treat route promotion as a controlled deployment operation. Record the reviewed inventory and fingerprint, admit the new cohort, fence the old epoch, and verify pending operations before retiring it. Provider-specific admission is described in SQL Server and KurrentDB.

Example: Represent the current route

The fingerprint is a SHA-256 digest of the reviewed deployment. The host gets its current epoch from its route authority, then passes the fence into the selected commit request.

public static AtomicRouteFence Fence(long epoch, string deploymentHash) =>
    new("counter-route", epoch, deploymentHash);