V0.5.13/service update

.bot/README.md

@@ -7,4 +7,4 @@ This folder is reserved for local-only AI working material such as:
 - design alternatives
 - temporary agent state
 
-Keep this folder out of source control. Move only finalized, non-confidential guidance into `AGENTS.md` or `.github/copilot-instructions.md`.
+Keep this folder out of source control. Move only finalized, non-confidential guidance into `AGENTS.md`.

.docfx/Dockerfile.docfx

@@ -1,17 +1,16 @@
-ARG NGINX_VERSION=1.31-alpine
+ARG NGINX_VERSION=1.31-alpine
 
-FROM --platform=$BUILDPLATFORM nginx:${NGINX_VERSION} AS base
+FROM --platform=$BUILDPLATFORM dhi.io/nginx:${NGINX_VERSION} AS base
 RUN rm -rf /usr/share/nginx/html/*
 
-FROM --platform=$BUILDPLATFORM codebeltnet/docfx:2.78.5 AS build
+FROM --platform=$BUILDPLATFORM codebeltnet/docfx:2 AS build
 
 ADD [".", "docfx"]
 
 RUN cd docfx; \
     docfx build
 
-FROM nginx:${NGINX_VERSION} AS final
+FROM dhi.io/nginx:${NGINX_VERSION} AS final
 WORKDIR /usr/share/nginx/html
 COPY --from=build /build/docfx/wwwroot /usr/share/nginx/html
-
-ENTRYPOINT ["nginx", "-g", "daemon off;"]
+COPY nginx.conf /etc/nginx/conf.d/default.conf

.docfx/api/namespaces/Codebelt.SharedKernel.md

@@ -6,4 +6,6 @@ When domain code needs to talk about moments in time, traced requests, or immuta
 
 If you are issuing a token and need to express how long it remains valid, reach for `TimeToLive` and pass it to your issuer. If two systems must agree on what "now" means within a bounded margin, reach for `ClockSkew`. If you need an absolute timestamp, use `CoordinatedUniversalTime`. For traced request identifiers and opaque credentials, start with `CorrelationId` and `Secret`; both extend `Token` and inherit its minimum length, maximum length, and character-distribution checks.
 
+`CoordinatedUniversalTime.MinValue` provides the fixed UTC lower boundary (`0001-01-01T00:00:00.0000000Z`) for validity ranges, independent of the host's local time zone. `AccessKeyOptions.ValidFrom` uses this boundary by default.
+
 [!INCLUDE [](../../includes/availability-modern.md)]

.docfx/api/types/Codebelt.SharedKernel.CoordinatedUniversalTime.md

@@ -3,6 +3,8 @@ uid: Codebelt.SharedKernel.CoordinatedUniversalTime
 example:
 - *content
 ---
+`MinValue` is `0001-01-01T00:00:00.0000000Z` on every host. Its ticks are zero and its `DateTime.Kind` is `Utc`; the local time zone does not shift this boundary.
+
 The following example captures the current UTC moment as a `CoordinatedUniversalTime` and converts it back to a `DateTime` for downstream consumers, and parses a wire-format ISO 8601 string the same way. Use `CoordinatedUniversalTime.Now` for "now" snapshots and `FromString` when an external system hands you a UTC timestamp that still needs validation.
 
 ```csharp

.docfx/docfx.json

@@ -10,6 +10,7 @@
         }
       ],
       "dest": "api",
+      "memberLayout": "separatePages",
       "filter": "filterConfig.yml",
       "properties": {
         "TargetFramework": "net10.0"
@@ -63,7 +64,8 @@
     "template": [
       "default",
       "modern",
-      "templates/shared-kernel"
+      "templates/shared-kernel",
+      "templates/ms-style"
     ],
     "overwrite": [
       {
@@ -83,6 +85,10 @@
     "keepFileLink": false,
     "cleanupCacheHistory": false,
     "disableGitFeatures": false,
+    "sitemap": {
+      "baseUrl": "https://sharedkernel.codebelt.net/",
+      "changefreq": "monthly"
+    },
     "xrefService": [
       "https://xref.docs.microsoft.com/query?uid={uid}" ]
   }

.docfx/nginx.conf

@@ -0,0 +1,38 @@
+# Only successful asset responses and revalidation responses may be cached.
+map $status $fingerprinted_asset_cache_control {
+    default "no-store";
+    ~^2 "public, max-age=31536000, immutable";
+    304 "public, max-age=31536000, immutable";
+}
+
+server {
+    listen 8080;
+    server_name _;
+    # The ingress terminates TLS; keep redirects from exposing this container port.
+    absolute_redirect off;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # DocFX fingerprints these generated dependencies in their filenames. They can be
+    # cached permanently because changed content is published under a different URL.
+    location ~ "^/public/.+-[A-Z0-9]{8}(?:-[A-Z0-9]{8})?(?:\.min)?\.(?:(?:css|js)(?:\.map)?|woff2?)$" {
+        try_files $uri =404;
+        add_header Cache-Control $fingerprinted_asset_cache_control always;
+        add_header Vary "Accept-Encoding" always;
+    }
+
+    # Pages, navigation data, images, and DocFX entry assets keep stable URLs. Do not
+    # retain them across deployments, and ignore validators cached under an old policy.
+    location / {
+        # Nginx derives ETags from modification time and file size. Those values can be
+        # reused by files copied from different image layers, producing a false 304.
+        etag off;
+        if_modified_since off;
+        try_files $uri $uri/ =404;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
+        add_header Expires "0" always;
+        add_header Pragma "no-cache" always;
+        add_header Vary "Accept-Encoding" always;
+    }
+}

.github/CONTRIBUTING.md

@@ -35,7 +35,7 @@ Run tests one project at a time so a failing or hanging project is attributable.
 ```powershell
 $testProjects = Get-ChildItem test -Filter *.csproj -Recurse
 foreach ($project in $testProjects) {
-    dotnet test $project.FullName --configuration Release --no-restore
+    dotnet test --project $project.FullName --configuration Release --no-restore
 }
 ```