[IanFrelinger]

Summary

The verified consumer's integration tests compile a fresh brick per run, and their net8 test host can roll forward to .NET 10. Those tests do not establish that one shipped signed DLL works on different runtimes. This change builds one net8 fixture against reference assemblies, signs it once, and distributes the unchanged deployment to nine actual-runtime consumers.

Changes

• Separate fixture, producer, and consumer projects; consumer builds cannot rebuild the fixture. The producer clearly labels the record as a synthetic test certification, not full gate admission.
• Execute the same signed artifact on .NET 8, 9, and 10 across Windows, Linux, and macOS. Restrict roll-forward to LatestPatch and assert the running version and selected library assets, including net8 assets on .NET 9.
• Assert artifact SHA-256 and loaded module MVID, execute before and after replacing the disk DLL, and refuse changed source/DLL, missing/invalid signatures, and foreign signers before loading another fixture. Include a wrong-runtime negative control.
• Aggregate all nine receipts and require identical artifact identity, complete runtime/platform coverage, and all ten checks. Retain logs and runtime configurations. The new workflow is advisory and does not change branch protection.
• Document usage and limitations; refresh the repository knowledge graph.

Testing

• One locally produced signed deployment passed all ten checks unchanged on Windows x64 using actual .NET 8.0.3, 9.0.21, and 10.0.12. All three wrong-runtime controls also refused without emitting receipts.
• The .NET 9 host selected the sample and contracts' net8.0 assets; each host's runtimeconfig uses LatestPatch.
• Evidence aggregation passed 14 valid/invalid receipt scenarios, including case-changed Base64 hashes, missing/duplicate checks, wrong module IDs/assets/runtime, and missing/duplicate matrix combinations.
• Dependency-boundary, testing-strategy, workflow-context, knowledge-graph freshness, PowerShell parsing, and diff whitespace checks passed.
• Hosted Verified Artifact Portability run 40153529132 passed: all nine combinations executed the same signed DLL on actual .NET 8.0.32, 9.0.21, and 10.0.13 across Windows x64, Linux x64, and macOS ARM64. All ten assertions per consumer, all nine wrong-runtime controls, and the final receipt aggregation passed.

Testing strategy (blast radius)

The executable probe exercises the existing verified consumer through real deployments and real runtime hosts. No production loader, verifier, or certification compiler API changes. NativeAOT, Mono, .NET Framework, other architectures, and NuGet package consumption are outside this matrix; the documentation states those limits.

Release

• Not a versioned release.