Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Source Basis and Version Policy

Purpose

This playbook is tailored for AIC engineering delivery. It converts current platform guidance, Microsoft .NET guidance, ReSharper tooling guidance, OWASP application security guidance, and AIC's operating controls into a practical engineering standard for customer projects.

This is not a vendor manual. It is an AIC operating standard. Vendor documentation is used to anchor the technology decisions; AIC standards define how teams must apply those technologies in delivery.

Current Platform Position

As of 2026-05-25:

Area
AIC position

Production .NET baseline

.NET 10 LTS

Production C# baseline

C# 14 for .NET 10 projects

Innovation / preview track

.NET 11 preview and C# 15 only with technical approval

API baseline

ASP.NET Core on .NET 10

Data baseline

EF Core 10 for mainstream ORM usage

Windows desktop baseline

WPF on modern .NET where Windows-only desktop delivery is required

Cross-platform app baseline

.NET MAUI where mobile or cross-platform desktop delivery is justified

Static analysis

Roslyn analyzers, .editorconfig, ReSharper, ReSharper command-line tools

Secure coding baseline

Secure by design, OWASP ASVS, OWASP Top 10, AIC Security Assurance Playbook

Delivery baseline

SoW-led, acceptance-driven, evidence-backed delivery

External Source Basis

The following sources were used when tailoring this playbook:

  • Microsoft .NET releases, support and lifecycle guidance.

  • Microsoft C# language versioning guidance.

  • Microsoft .NET 10 and .NET 11 platform documentation.

  • Microsoft ASP.NET Core Web API, Minimal API, OpenAPI and security documentation.

  • Microsoft WPF documentation for modern .NET.

  • Microsoft .NET MAUI documentation and platform support guidance.

  • Microsoft EF Core release, testing and performance documentation.

  • Microsoft .NET code analysis, coding conventions and testing documentation.

  • JetBrains ReSharper documentation for inspections, code cleanup and command-line tools.

  • OWASP ASVS and OWASP Top 10 for application security verification and awareness.

  • AIC operating model: Framework Agreement as rules of engagement, SoW as execution unit, policies as operational enforcement, and technical/security controls as delivery evidence.

Interpretation Rules

Use the following terms consistently:

Term
Meaning

MUST

Mandatory for AIC delivery unless a written exception is approved.

SHOULD

Strong default. Deviation requires a reason recorded in the project decision log.

MAY

Optional where the project context justifies it.

MUST NOT

Prohibited unless a named accountable owner approves a formal exception.

EXCEPTION

A written deviation approved through technical governance and recorded with risk, rationale and expiry date.

Version Policy

AIC projects MUST use supported runtime versions.

Default production projects MUST use .NET 10 LTS unless a customer, platform or compatibility constraint requires another supported version.

.NET 11 and C# 15 MAY be used for research, spikes, accelerators or controlled innovation work while they remain preview technology. They MUST NOT be used for production customer delivery unless the version is generally available, supported, approved in the Statement of Work or technical design authority, and compatible with customer support requirements.

AIC projects MUST pin SDK versions using global.json for reproducible builds.

AIC projects MUST keep runtime, SDK, NuGet packages, IDE tooling, analyzers and build agents on supported versions.

Technology Decision Hierarchy

When guidance conflicts, apply this hierarchy:

  1. Customer contract, regulation, classification or accreditation requirement.

  2. AIC Security Assurance Playbook.

  3. AIC Technical Guidelines and Code Standards.

  4. Project architecture decision records.

  5. Vendor documentation.

  6. Developer preference.

Required Evidence

Each project MUST retain evidence showing:

  • target framework and SDK version

  • language version

  • repository configuration

  • analyzer configuration

  • coding standard configuration

  • test strategy

  • architecture decisions

  • security decisions

  • CI/CD configuration

  • release evidence

  • code review evidence

  • exception records

Review Cycle

This playbook SHOULD be reviewed:

  • at least quarterly

  • when a new .NET major version is released

  • when Microsoft or JetBrains tooling changes materially

  • when AIC changes its security or accreditation requirements

  • after a significant delivery issue or defect trend

  • after a project introduces a reusable accelerator or template

Reference Links

Use the following primary sources when reviewing or updating this playbook:

  • .NET releases and support: https://learn.microsoft.com/en-us/dotnet/core/releases-and-support

  • .NET lifecycle dates: https://learn.microsoft.com/en-us/lifecycle/products/microsoft-net-and-net-core

  • .NET support policy: https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core

  • C# language versioning: https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-versioning

  • What's new in .NET 10: https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-10/overview

  • What's new in .NET 11: https://learn.microsoft.com/en-us/dotnet/core/whats-new/dotnet-11/overview

  • What's new in C# 14: https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-14

  • What's new in C# 15: https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-15

  • ASP.NET Core APIs overview: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/apis

  • ASP.NET Core Web API: https://learn.microsoft.com/en-us/aspnet/core/web-api/

  • ASP.NET Core OpenAPI: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/openapi/overview

  • ASP.NET Core security topics: https://learn.microsoft.com/en-us/aspnet/core/security/

  • WPF overview: https://learn.microsoft.com/en-us/dotnet/desktop/wpf/overview/

  • .NET MAUI documentation: https://learn.microsoft.com/en-us/dotnet/maui/

  • .NET MAUI supported platforms: https://learn.microsoft.com/en-us/dotnet/maui/supported-platforms

  • EF Core overview: https://learn.microsoft.com/en-us/ef/core/

  • EF Core 10: https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-10.0/whatsnew

  • .NET code analysis: https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/overview

  • .NET coding conventions: https://learn.microsoft.com/en-us/dotnet/csharp/fundamentals/coding-style/coding-conventions

  • .NET testing: https://learn.microsoft.com/en-us/dotnet/core/testing/

  • ReSharper code inspections: https://www.jetbrains.com/help/resharper/Code_Analysis__Code_Inspections.html

  • ReSharper code cleanup: https://www.jetbrains.com/help/resharper/Code_Cleanup__Index.html

  • ReSharper InspectCode: https://www.jetbrains.com/help/resharper/InspectCode.html

  • OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/

  • OWASP Top 10: https://owasp.org/Top10/2021/

PreviousSummary
NextEngineering Operating Model

Last updated

Was this helpful?