Workable.AspNetCore 1.1.80526.1

• net10.0

  • Workable.Abstractions (>= 1.1.80526.1)

# 1.1.080526.1

Date: 2026-08-05

## Added

- Added automatic outbound `HttpClient` profiling through `AddWorkableHttpClientProfiling()`. Workable uses the built-in `System.Net.Http` activity source, so existing `HttpClient` code does not need a wrapper or delegating handler. Each timing covers the outgoing request and its returned response and can include the HTTP method, sanitized URI, protocol version, response status, outcome, and transport error type.
- Added temporary full-profile capture rules for future workers. Operators can target a work definition, a stable actor/user id, or both; configure a match count and expiration; and manage rules from the work-definition and worker detail screens or the built-in HTTP API at `/workable/profiling/capture-rules`.
- Added `WorkerOptions.ProfilingCaptureMode` with `Bounded` and `Full` capture. A matched rule enables profiling and resolves the accepted worker to `Full`, bypassing the automatic instrumentation node limit while preserving normal authorization, privacy, and retention behavior. Durable SQL Server queues retain the resolved mode across delayed execution.
- Added a shared automatic-instrumentation extension model through `IWorkProfilingInstrumentationFactory`, `IWorkAutomaticProfiler`, and pending-instrumentation lifecycle contracts. SQL, HTTP, and future integrations now use the same admission, finalization, snapshot, and truncation behavior.
- Added required stable instrumentation identity to every profile node. Built-in keys include `application`, `workable.profiling`, `sql.client`, and `http.client`, allowing clients and custom integrations to classify entries without inspecting labels or context payloads.
- Added an HTTP-only profile filter to the admin UI alongside the SQL filter. SQL and HTTP filters use exact instrumentation identity and are enabled only when the selected system advertises the corresponding capability.
- Added profiling performance benchmarks covering automatic admission, HTTP capture and URI sanitization, SQL diagnostics, snapshot creation, finalization, and teardown.

## Changed

- Automatic SQL, HTTP, and custom instrumentation now share a configurable per-iteration limit of `500` nodes by default. Configure it with `ConfigureProfiling(maximumAutomaticInstrumentationNodes: ...)`. Explicit application entries created through `IWorkProfiler` do not consume this budget.
- Bounded profiles that exceed the automatic limit now retain one `Automatic instrumentation truncated` summary with omission counts grouped by instrumentation source. Full-capture workers intentionally bypass this node limit for targeted diagnostics.
- Registered HTTP profiling follows the existing development default: work definitions without explicit default options are profiled automatically outside Production. Production workers must still opt in through definition defaults, queue options, reconfiguration, or a targeted capture rule.
- HTTP capture is privacy-limited even in `Full` mode. Workable never retains request or response headers, bodies, URI query contents, URI fragments, URI user information, or exception messages. URI inspection and retained values are bounded, and malformed or unsafe URI forms are omitted rather than copied as raw text.
- Retained profile telemetry, explicit `Full` capture selection, and capture-rule administration now require system diagnostics permission on authorization-enabled systems. Callers without diagnostics permission still receive otherwise-authorized worker and iteration data, but profile fields are omitted. Creating a rule does not grant permission to queue matching work.
- The admin UI hides full-capture controls without diagnostics access, exposes capture-rule status and deletion to authorized operators, and includes sample-host diagnostics authorization for the profiling lab.
- Profile snapshots retain their instrumentation source throughout worker, iteration, HTTP, and admin UI contracts. This is a contract change for custom profile consumers and instrumenters: `WorkProfileSnapshotNode.Instrumentation` is required rather than optional or inferred.

## Fixed

- The admin UI now renews delegated Entra access tokens based on the server-reported token lifetime before SignalR negotiation and reconnect. A `401` invalidates the cached token, forces one refresh, and retries the shared realtime connection instead of repeatedly negotiating with an expired bearer token.
- In-flight HTTP and SQL operations are finalized as `Incomplete` before a worker profile snapshot is published. Late provider callbacks cannot mutate an already-published snapshot, and finalization waits for concurrent instrumentation registration windows without active spinning.
- HTTP activity sampling stops requesting full activity data after a bounded worker reaches its automatic-node limit and does not set the distributed-tracing recorded flag, avoiding unintended downstream sampling and unnecessary tag materialization.
- Automatic profile admission is lock-free and reserves capacity atomically, preventing concurrent SQL and HTTP bursts from overshooting the configured limit or forcing unrelated outbound requests through a global lock.
- Capture-rule matching now uses immutable selector indexes and atomic reservation/completion, avoiding a global administration lock or full rule scan on the queue hot path while preserving match counts when queue acceptance fails.
- SQL profiling now shares one lifecycle-managed observer across Workable systems, avoids process-wide command payload construction when no eligible profile is active, and uses the same bounded admission and pending-operation finalization path as HTTP profiling.
- Durable SQL Server queue serialization now round-trips explicit `Bounded` and `Full` capture modes, ensuring a targeted durable worker does not lose its capture decision before execution.
- Profile filtering and capture controls now honor system capability and diagnostics-access changes across worker and iteration navigation, preventing stale SQL, HTTP, or full-capture UI state from being offered for an ineligible system.
- Expanded backend, SQL Server integration, admin UI, security, lifecycle, concurrency, and performance regression coverage for automatic profiling, capture-rule authorization, token renewal, instrumentation identity, bounded growth, and durable capture behavior.