> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/technical-guidelines-code-standards-and-tech-stack/source-basis-and-version-policy.md).

# Source Basis and Version Policy

### Purpose

This playbook is tailored for AIC engineering delivery. It converts current platform guidance, Microsoft .NET guidance, ReSharper tooling guidance, OWASP application security guidance, and AIC's operating controls into a practical engineering standard for customer projects.

This is not a vendor manual. It is an AIC operating standard. Vendor documentation is used to anchor the technology decisions; AIC standards define how teams must apply those technologies in delivery.

### Current Platform Position

As of 2026-05-25:

| Area                        | AIC position                                                                |
| --------------------------- | --------------------------------------------------------------------------- |
| Production .NET baseline    | .NET 10 LTS                                                                 |
| Production C# baseline      | C# 14 for .NET 10 projects                                                  |
| Innovation / preview track  | .NET 11 preview and C# 15 only with technical approval                      |
| API baseline                | ASP.NET Core on .NET 10                                                     |
| Data baseline               | EF Core 10 for mainstream ORM usage                                         |
| Windows desktop baseline    | WPF on modern .NET where Windows-only desktop delivery is required          |
| Cross-platform app baseline | .NET MAUI where mobile or cross-platform desktop delivery is justified      |
| Static analysis             | Roslyn analyzers, .editorconfig, ReSharper, ReSharper command-line tools    |
| Secure coding baseline      | Secure by design, OWASP ASVS, OWASP Top 10, AIC Security Assurance Playbook |
| Delivery baseline           | SoW-led, acceptance-driven, evidence-backed delivery                        |

### External Source Basis

The following sources were used when tailoring this playbook:

* Microsoft .NET releases, support and lifecycle guidance.
* Microsoft C# language versioning guidance.
* Microsoft .NET 10 and .NET 11 platform documentation.
* Microsoft ASP.NET Core Web API, Minimal API, OpenAPI and security documentation.
* Microsoft WPF documentation for modern .NET.
* Microsoft .NET MAUI documentation and platform support guidance.
* Microsoft EF Core release, testing and performance documentation.
* Microsoft .NET code analysis, coding conventions and testing documentation.
* JetBrains ReSharper documentation for inspections, code cleanup and command-line tools.
* OWASP ASVS and OWASP Top 10 for application security verification and awareness.
* AIC operating model: Framework Agreement as rules of engagement, SoW as execution unit, policies as operational enforcement, and technical/security controls as delivery evidence.

### Interpretation Rules

Use the following terms consistently:

| Term      | Meaning                                                                                                      |
| --------- | ------------------------------------------------------------------------------------------------------------ |
| MUST      | Mandatory for AIC delivery unless a written exception is approved.                                           |
| SHOULD    | Strong default. Deviation requires a reason recorded in the project decision log.                            |
| MAY       | Optional where the project context justifies it.                                                             |
| MUST NOT  | Prohibited unless a named accountable owner approves a formal exception.                                     |
| EXCEPTION | A written deviation approved through technical governance and recorded with risk, rationale and expiry date. |

### Version Policy

AIC projects MUST use supported runtime versions.

Default production projects MUST use .NET 10 LTS unless a customer, platform or compatibility constraint requires another supported version.

.NET 11 and C# 15 MAY be used for research, spikes, accelerators or controlled innovation work while they remain preview technology. They MUST NOT be used for production customer delivery unless the version is generally available, supported, approved in the Statement of Work or technical design authority, and compatible with customer support requirements.

AIC projects MUST pin SDK versions using `global.json` for reproducible builds.

AIC projects MUST keep runtime, SDK, NuGet packages, IDE tooling, analyzers and build agents on supported versions.

### Technology Decision Hierarchy

When guidance conflicts, apply this hierarchy:

1. Customer contract, regulation, classification or accreditation requirement.
2. AIC Security Assurance Playbook.
3. AIC Technical Guidelines and Code Standards.
4. Project architecture decision records.
5. Vendor documentation.
6. Developer preference.

### Required Evidence

Each project MUST retain evidence showing:

* target framework and SDK version
* language version
* repository configuration
* analyzer configuration
* coding standard configuration
* test strategy
* architecture decisions
* security decisions
* CI/CD configuration
* release evidence
* code review evidence
* exception records

### Review Cycle

This playbook SHOULD be reviewed:

* at least quarterly
* when a new .NET major version is released
* when Microsoft or JetBrains tooling changes materially
* when AIC changes its security or accreditation requirements
* after a significant delivery issue or defect trend
* after a project introduces a reusable accelerator or template

### Reference Links

Use the following primary sources when reviewing or updating this playbook:

* .NET releases and support: <https://learn.microsoft.com/en-us/dotnet/core/releases-and-support>
* .NET lifecycle dates: <https://learn.microsoft.com/en-us/lifecycle/products/microsoft-net-and-net-core>
* .NET support policy: <https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core>
* C# language versioning: <https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-versioning>
* What's new in .NET 10: <https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-10/overview>
* What's new in .NET 11: <https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-11/overview>
* What's new in C# 14: <https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-14>
* What's new in C# 15: <https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-15>
* ASP.NET Core APIs overview: <https://learn.microsoft.com/en-us/aspnet/core/fundamentals/apis>
* ASP.NET Core Web API: <https://learn.microsoft.com/en-us/aspnet/core/web-api/>
* ASP.NET Core OpenAPI: <https://learn.microsoft.com/en-us/aspnet/core/fundamentals/openapi/overview>
* ASP.NET Core security topics: <https://learn.microsoft.com/en-us/aspnet/core/security/>
* WPF overview: <https://learn.microsoft.com/en-us/dotnet/desktop/wpf/overview/>
* .NET MAUI documentation: <https://learn.microsoft.com/en-us/dotnet/maui/>
* .NET MAUI supported platforms: <https://learn.microsoft.com/en-us/dotnet/maui/supported-platforms>
* EF Core overview: <https://learn.microsoft.com/en-us/ef/core/>
* EF Core 10: <https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-10.0/whatsnew>
* .NET code analysis: <https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/overview>
* .NET coding conventions: <https://learn.microsoft.com/en-us/dotnet/csharp/fundamentals/coding-style/coding-conventions>
* .NET testing: <https://learn.microsoft.com/en-us/dotnet/core/testing/>
* ReSharper code inspections: <https://www.jetbrains.com/help/resharper/Code\\_Analysis\\_\\_Code\\_Inspections.html>
* ReSharper code cleanup: <https://www.jetbrains.com/help/resharper/Code\\_Cleanup\\_\\_Index.html>
* ReSharper InspectCode: <https://www.jetbrains.com/help/resharper/InspectCode.html>
* OWASP ASVS: <https://owasp.org/www-project-application-security-verification-standard/>
* OWASP Top 10: <https://owasp.org/Top10/2021/>