Status
Accepted (2026-07-12).
Context
The old template copied Domain/Application/Infrastructure framework source into new projects, exposing core implementation and letting customers modify or fork Framework/Platform — losing control of unified upgrades, security fixes, and commercial licensing.
Decision
The Consumer Solution owns only shell and business source: Host, readable composition root, composition manifest, config/deploy assets, the customer’s own src/Modules/**, test projects, version manifests, PackageReference, and business extension samples. It never copies src/Framework/** or src/Platform/** core source. Framework and Platform ship as version-consistent signed private NuGet packages; the customer restores only from an authenticated feed. Package families stay module-deep (BitzOrcas.Framework.*, BitzOrcas.Platform.<Module>.*, BitzOrcas.Profile.*, BitzOrcas.Licensing.*, BitzOrcas.Sdk).
Entitlement is three-layered and non-overlapping: Package Entitlement controls download (short-lived least-privilege feed tokens), Runtime License controls whether an edition/feature/version/environment/deployment can run, and tenant Feature/Entitlement is managed by the adopting business system and must not reuse the Runtime License state model. Revoking feed rights blocks future restore/upgrade but cannot recall cached packages — so commercial capability cannot depend on feed auth alone.
The License is a deep module: the Host calls only the stable License interface and never self-parses signature/clock/cache/device binding/grace. It centralizes the vendor public key + KeyId rotation, customer/product/edition/feature/version/environment checks, online activation/offline signed file/local lease cache/grace, and the explicit Valid/Grace/Expired/Revoked/Invalid/Unavailable states. A new deployment, forged license, or over-privileged feature fails closed; license expiry must not break customer export/backup/migration.
Consequences
Core implementation no longer lives in the customer source repo; security fixes and compat upgrades ship via package version; download/runtime/tenant-feature rights form three clear contexts. Most projects default to IsPackable=false and need systematic packaging; on-site debugging is harder (controlled symbols/diagnostics); DLLs remain decompilable, so private deployment has no absolute anti-tamper guarantee.