Neton Framework 1.0.0

The first stable release of Neton Framework: a Kotlin/Native server application framework for modular backend services and AI-native, specification-driven development.

Neton brings application assembly, dependency injection, HTTP APIs, security, data access, caching, jobs, storage and real-time communication into one coherent framework. Applications compile to native executables, with compile-time wiring instead of runtime classpath scanning.

This is a cumulative overview of the capabilities developed throughout the preview series, not merely a delta from the last beta. 1.0.0 is available on Maven Central under com.netonstream, licensed under Apache 2.0.

Framework, applications and AI-native development

• Neton Framework provides general-purpose server infrastructure and public contracts.
• Neton Application is a separate ecosystem of business modules and distributions built on Framework. Administration screens, account workflows and product modules are not Framework API contracts.
• neton-app is the public, general-purpose Framework starter, now using stable 1.0.0.
• Neton specifications and development skills guide developers and AI assistants through consistent architecture and executable acceptance. AI-native development does not require runtime model integration or an API key.

Complete capability overview

Application assembly and lifecycle

• Unified Neton.run entry point and Kotlin installation DSL.
• Typed service bindings, constructor-based wiring and KSP-generated controller, logic and module registration.
• Module manifests, declared dependencies and explicit initialization without runtime classpath scanning.
• Startup-time assembly followed by a frozen service context.
• Owned resource lifecycle, startup-failure cleanup, cancellation propagation and graceful shutdown.
• Generic module initialization and migration-source contracts without application-specific business dependencies.

Configuration and logging

• TOML configuration, environment-specific files, environment-variable and command-line overrides, and typed component configuration.
• Config SPI extension points separating application policy from infrastructure installation.
• Configuration validation and explicit merge/override semantics.
• Structured logging, levels, multiple sinks, asynchronous output and request trace context.
• Access/error logging integration and extensible logging contracts.
• Redacted configuration representations for sensitive database, Redis and storage settings.

HTTP APIs, routing and validation

• Kotlin route DSL and KSP-generated annotated controller routes, route groups and configurable mounts.
• Parameter/body binding, serialization integration and typed parameter converters.
• Middleware/interceptor hooks, consistent API envelopes and HTTP error mapping.
• Compile-time-generated DTO validation, including nested validation and common string, size, range and email constraints. Unsupported annotation use fails compilation instead of silently disabling validation.
• CORS configuration and route-level fixed-window rate limiting with local or Redis-backed counters.
• Trusted-proxy-aware client-address resolution through a shared request contract.
• Static files with GET/HEAD, content types, conditional requests, single-range responses and precompressed assets, including traversal and symlink-escape protections.
• Streaming responses and Server-Sent Events with cancellation-aware producer cleanup.

Security and cryptography

• Composable authenticators and guards, request-bound identity, role/permission checks and explicit anonymous access.
• JWT verification, RSA/JWKS integration, token-introspection extension points and session-version support.
• Request-bound SecurityContext and generated current-user injection instead of process-global identity.
• Password hashing, secure randomness, digest/HMAC, authenticated encryption, SecretBox and TOTP primitives.
• Shared OpenSSL 4 wrappers across HTTP/TLS, Security and Storage, avoiding conflicting OpenSSL major versions in one native executable.
• Regression coverage preserving stored PBKDF2 password hashes and SecretBox layouts.

TOTP primitives are Framework capabilities. Enrollment screens, recovery flows, CAPTCHA integrations and administrator policies belong to applications or Neton Application modules.

Database access and migrations

• Separate data entities, generated metadata/mappers and typed Table/Query APIs.
• CRUD, filtering, ordering, pagination, typed projections, joins and aggregate query building.
• Parameterized SQL through DbContext for queries outside the typed DSL.
• Explicit sessions and transactions with commit, rollback and cancellation handling. Nested transactions join the outer transaction; they are not independent savepoints.
• Atomic increment/decrement and affected-row results for guarded updates without read-modify-write races.
• Soft-delete, automatic-field and query-interceptor extension points.
• Versioned migration scripts, schema history and explicit up, status and verify commands. Production migrations are deployment actions, not implicit schema upgrades on service startup.

Default database publications use PostgreSQL through sqlx4k 1.17.0. MySQL/SQLite dialect and API-variant checks do not certify interchangeable drivers in the default publication.

Redis, caching and distributed coordination

• Managed Redis connections, command/value APIs, expiration and typed serialization helpers.
• Distributed-lock contracts and Redis-backed locking.
• Named L1/L2 caches combining bounded local storage and Redis, with TTL and explicit codecs.
• Cache population/eviction APIs and supported KSP-generated controller cache annotations.
• Explicit setTyped<T> and typed remember<T>, preserving the raw set(Any) wire format.
• Corrupt cached values treated as misses without payload logging.

Cache/lock annotations apply to supported generated controller handlers, not arbitrary methods through runtime AOP. The two-level cache requires Redis and does not silently degrade to local-only behavior.

Jobs and domain events

• Cron and fixed-rate schedules, manual job triggers and status snapshots.
• All-node or Redis-coordinated single-node execution.
• Shutdown stops new admission and drains accepted work before deadline-based cancellation.
• Typed domain events with synchronous, best-effort and retryable delivery contracts.
• Explicit persistence/codec ports for retryable events; missing wiring fails startup.
• Listener and serializer registration sealed after assembly, with conflict checks.

The event bus is not a bundled message broker. Durable delivery requires a store and delivery implementation; it does not imply exactly-once processing or global ordering.

File and object storage

• Provider-neutral storage operators with local-filesystem and S3-compatible implementations.
• Named sources, configurable source selection, read/write/delete, existence and metadata checks, listing, copying and moving objects; S3-specific presigned read/write URLs.
• S3 traffic through the Framework HTTP client with shared cryptographic signing primitives.
• Explicit partial overrides: unset values inherit; false, empty strings and default paths remain intentional overrides.
• Malformed source configuration and duplicate names rejected at startup.

The current byte-array storage API targets small files (up to 32 MiB), not multipart/resumable large-file transfer. Video transcoding, moderation and business-level media ownership are not supplied by the Framework storage module.

WebSocket and real-time services

• Optional neton-websocket, with stable business APIs in neton.websocket.
• DSL routes, annotated controllers, injectable handler objects and a built-in default engine.
• HTTP/1.1 upgrade integrated with authentication, rate limiting, parameter binding and Origin checks before protocol switching.
• Managed sessions, detached handshake/identity snapshots, connection IDs, text/binary messages and observable close results.
• Heartbeats, bounded queues, backpressure and resource-admission limits.
• Inbound delivery, rejection and validated-discard policies.
• Cancellation-aware sends, defined queue-drain behavior and bounded transport cleanup.
• Engine conformance testing and an explicitly opt-in, experimental engine SPI.

The SPI's status does not make ordinary WebSocket business APIs experimental. Compression, HTTP/2 or HTTP/3 extended CONNECT, and high-level Hub/typed-message APIs are outside this release. Queue byte budgets are not process-memory ceilings.

Built-in HTTP client, server and SMTP

Neton's own Kotlin/Native HTTP, I/O and TLS libraries provide the default transport beneath the application framework.

• HTTP/1.1 and HTTP/2 serving, TLS/ALPN, streaming responses, SSE and response compression.
• Outbound HTTP pooling, TLS, streaming, cancellation, timeouts and HTTP proxy support.
• Client-provider/capability contracts and conformance testing.
• Request/body admission controls and managed listener/connection cleanup.
• SMTP transport with implicit TLS, STARTTLS and authentication.

Request bodies are buffered within configured limits; response streaming is not an unbounded upload API. QUIC/HTTP/3 are part of the wider protocol ecosystem, not advertised as certified Framework 1.0 server features.

Developer tooling and extensibility

• Canonical versioned specifications and installable development skills in neton-docs.
• Guidance for generated wiring, ownership, request identity, migrations, lifecycle and executable acceptance.
• Public starter and examples covering HTTP, MVC, route groups, caching, SSE, WebSocket and database-backed acceptance.
• A single entry dependency and Framework BOM, with optional modules added explicitly.
• Compiled public API/ABI baselines, source-consumer checks and incremental KSP regression gates.

Runtime AI integration is independently versioned in neton-ai, outside the Framework BOM; its APIs remain experimental. Ktor, Hyper4k and Geario4k compatibility/comparison adapters are independent projects, not default transports or core release gates.

Getting started

Use Maven Central and neton-app for the complete native/KSP project setup.

commonMain.dependencies {
    implementation("com.netonstream:neton:1.0.0")

    // Optional modules aligned by the Framework BOM.
    implementation("com.netonstream:neton-security")
    implementation("com.netonstream:neton-database")
    implementation("com.netonstream:neton-websocket")
}

The entry dependency includes Core, Logging, HTTP and Routing. WebSocket and other optional modules must be added explicitly. Align neton-ksp with Framework when using generated APIs.

Versions and platform scope

• Kotlin compiler 2.4.20 and KSP 2.3.12, unchanged.
• sqlx4k 1.17.0, upgraded from 1.16.0.
• kotlinx-serialization 1.12.0, upgraded from 1.11.0.
• Full native runtime gates: macOS ARM64, Linux x64 and Windows x64.
• Linux ARM64 has a separate actual KSP execution gate, not full runtime certification.
• macOS x64 library compilation is not runtime certification; neton-database has no macOS x64 artifact.

Use the validated native toolchain. Arbitrary Kotlin compiler/KLIB-version compatibility and universal performance figures are not promised.

Migrating from previews

1. Align Framework, optional modules and KSP at 1.0.0 and recompile consumers.
2. Rename neton.ws to neton.websocket. Framework types use neton.websocket.annotations.WebSocket and neton.websocket.config.WebSocketConfig.
3. Replace global security-context calls with request-bound SecurityContext(httpContext) or current-user injection.
4. Use public database contracts rather than SQL adapter internals. Internal/experimental APIs retain explicit opt-in.
5. Version AI and compatibility adapters independently; the Framework BOM does not align them.
6. Use SourceOverrides for explicitly typed storage DSL helpers. StorageConfig.sources entries replace complete sources; source { } supports partial overrides.
7. Keep the shared OpenSSL 4 backend; do not reintroduce an OpenSSL 3 provider alongside default HTTP.

The stable baseline excludes explicitly internal/experimental APIs and KSP implementation details. Beta artifacts are not a binary-compatibility promise for 1.0.0.

Verification and provenance

• Tag: v1.0.0.
• Published source: e7a78204854464326ca878414968a96f4bdb2575.
• All 19 release gates passed, including ABI, source compatibility, incremental KSP, native tests, real PostgreSQL/Redis, candidate artifacts and the pinned public starter.
• Reference release gates include migrations, two healthy start/stop cycles, closed ports and zero remaining database connections within the recorded platform scope.
• 79 Maven coordinates / 345 payload files published with production signatures. Public payload sizes and SHA-256 values match the production manifest; public signatures match their verified production counterparts.
• Signing-key fingerprint: AA93E367430D0F9FC4CCB7AB4EC1381BAA4F649B.
• Public Maven Central consumption passed on macOS ARM64, Linux x64 and Windows x64, including release builds and two runtime cycles.
• A fresh, separate macOS ARM64 Central-only database consumer passed up/repeated up/status/verify, two release builds and two healthy shutdown cycles with zero database connections before cleanup. No Maven Local, staged repository or source substitution was used.
• Post-release Framework main-branch checks passed. Bookkeeping changes do not move the release tag or alter published artifacts.

Machine-readable evidence: production manifest, public artifact verification, and Central-only database runtime.

Resources

• Documentation
• Public starter
• Development skills
• Maven Central
• Release source
• Apache 2.0 license

Thank you to everyone who tested the previews and helped shape Neton's first stable release.