indrora · Oct 27, 2026 · Apr 21, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -10,9 +10,9 @@
 
 <!-- How was this validated? Check all that apply. -->
 
-- [ ] `just test` passes (unit tests)
-- [ ] `just integration-test` passes (requires `~/.env_certinext`)
-- [ ] `just coverage` shows no coverage regression
+- [ ] `make test` passes (unit tests)
+- [ ] `make integration-test` passes (requires `~/.env_certinext`)
+- [ ] `make coverage` shows no coverage regression
 - [ ] Terraform changes validated with `terraform plan`
 - [ ] Tested only docs/config — no runtime changes
 

diff --git a/.gitignore b/.gitignore
@@ -36,7 +36,14 @@ terraform/terraform.tfvars
 
 # Analysis / scratch — never commit
 analysis/
-
-# Local-only working notes — never commit
-DCV_BUILD_SUPPORT.md
-
+logs/*
+
+# AI
+handoffs/
+planning/
+plans/
+plan/
+.claude*
+CLAUDE.md
+.codex*
+AGENTS.md
diff --git a/CERTInext.IntegrationRunner/CERTInext.IntegrationRunner.csproj b/CERTInext.IntegrationRunner/CERTInext.IntegrationRunner.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
     <ImplicitUsings>disable</ImplicitUsings>
     <Nullable>warnings</Nullable>
     <LangVersion>12.0</LangVersion>

diff --git a/CERTInext.IntegrationRunner/Program.cs b/CERTInext.IntegrationRunner/Program.cs
@@ -1,4 +1,4 @@
-// Copyright 2026 Keyfactor
+// Copyright 2024 Keyfactor
 // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 // At http://www.apache.org/licenses/LICENSE-2.0
 

diff --git a/CERTInext.IntegrationTests/AlgorithmMatrixTests.cs b/CERTInext.IntegrationTests/AlgorithmMatrixTests.cs
@@ -1,4 +1,4 @@
-// Copyright 2026 Keyfactor
+// Copyright 2024 Keyfactor
 // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 // At http://www.apache.org/licenses/LICENSE-2.0
 

diff --git a/CERTInext.IntegrationTests/BlankRequestorLiveTests.cs b/CERTInext.IntegrationTests/BlankRequestorLiveTests.cs
diff --git a/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj b/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj
@@ -1,14 +1,14 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
     <ImplicitUsings>disable</ImplicitUsings>
     <Nullable>warnings</Nullable>
     <LangVersion>12.0</LangVersion>
     <IsPackable>false</IsPackable>
     <IsTestProject>true</IsTestProject>
-    <!-- Mirror the main project's DcvSupport flag. Default true → DCV test files are compiled in
-         (matches the default DCV build); -p:DcvSupport=false excludes them (GA no-DCV build). -->
-    <DcvSupport Condition="'$(DcvSupport)' == ''">true</DcvSupport>
+    <!-- Mirror the main project's DcvSupport flag. Default false → DCV test files are excluded
+         (matches the GA no-DCV build); -p:DcvSupport=true compiles them in with SUPPORTS_DCV. -->
+    <DcvSupport Condition="'$(DcvSupport)' == ''">false</DcvSupport>
     <DefineConstants Condition="'$(DcvSupport)' == 'true'">$(DefineConstants);SUPPORTS_DCV</DefineConstants>
   </PropertyGroup>
 
@@ -36,5 +36,9 @@
     <PackageReference Include="FluentAssertions" Version="6.12.0" />
     <PackageReference Include="Xunit.SkippableFact" Version="1.4.13" />
     <PackageReference Include="BouncyCastle.Cryptography" Version="2.6.2" />
+    <!-- Suppress TFM support build warnings for transitive dependencies -->
+    <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="8.0.0" />
+    <PackageReference Include="System.IO.Pipelines" Version="8.0.0" />
+    <PackageReference Include="System.Text.Encodings.Web" Version="8.0.0" />
   </ItemGroup>
 </Project>
diff --git a/CERTInext.IntegrationTests/CloudflareDomainValidator.cs b/CERTInext.IntegrationTests/CloudflareDomainValidator.cs
@@ -1,4 +1,4 @@
-// Copyright 2026 Keyfactor
+// Copyright 2024 Keyfactor
 // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 // At http://www.apache.org/licenses/LICENSE-2.0
 
@@ -23,7 +23,7 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// Credentials are read from the <see cref="IntegrationTestFixture"/>:
     /// <c>CERTINEXT_CF_API_TOKEN</c> and <c>CERTINEXT_CF_ZONE_ID</c>.
     /// </summary>
-    internal sealed class CloudflareDomainValidator : IDomainValidator
+    internal sealed class CloudflareDomainValidator : IDomainValidator, IDisposable
     {
         private const string CfApiBase = "https://api.cloudflare.com/client/v4";
 
@@ -113,17 +113,21 @@ public async Task<DomainValidationResult> CleanupValidation(string key, Cancella
         public Task ValidateConfiguration(Dictionary<string, object> configuration) => Task.CompletedTask;
         public Dictionary<string, Keyfactor.AnyGateway.Extensions.PropertyConfigInfo> GetDomainValidatorAnnotations() => new();
         public string GetValidationType() => "dns-01";
+
+        public void Dispose() => _http.Dispose();
     }
 
-    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory
+    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory, IDisposable
     {
-        private readonly IDomainValidator _validator;
+        private readonly CloudflareDomainValidator _validator;
 
         public CloudflareDomainValidatorFactory(string apiToken, string zoneId)
         {
             _validator = new CloudflareDomainValidator(apiToken, zoneId);
         }
 
         public IDomainValidator ResolveDomainValidator(string domain, string validationType) => _validator;
+
+        public void Dispose() => _validator.Dispose();
     }
 }
diff --git a/CERTInext.IntegrationTests/CnameResolverLiveDnsTests.cs b/CERTInext.IntegrationTests/CnameResolverLiveDnsTests.cs
diff --git a/CERTInext.IntegrationTests/ConnectivityTests.cs b/CERTInext.IntegrationTests/ConnectivityTests.cs
@@ -1,4 +1,4 @@
-// Copyright 2026 Keyfactor
+// Copyright 2024 Keyfactor
 // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 // At http://www.apache.org/licenses/LICENSE-2.0
 

diff --git a/CERTInext.IntegrationTests/DcvLifecycleTests.cs b/CERTInext.IntegrationTests/DcvLifecycleTests.cs
@@ -1,4 +1,4 @@
-// Copyright 2026 Keyfactor
+// Copyright 2024 Keyfactor
 // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 // At http://www.apache.org/licenses/LICENSE-2.0
 
@@ -40,17 +40,25 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// CERTINEXT_DCV_DOMAIN=&lt;subdomain to use, e.g. dcv-test.example.com&gt;
     /// </code>
     /// </summary>
-    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>
+    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>, IDisposable
     {
         private readonly IntegrationTestFixture _fixture;
         private readonly ITestOutputHelper _output;
+        private readonly List<IDisposable> _toDispose = new List<IDisposable>();
 
         public DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output)
         {
             _fixture = fixture;
             _output = output;
         }
 
+        public void Dispose()
+        {
+            foreach (var d in _toDispose)
+                d.Dispose();
+            _toDispose.Clear();
+        }
+
         // ---------------------------------------------------------------------------
         // Helpers
         // ---------------------------------------------------------------------------
@@ -69,11 +77,17 @@ private static string GenerateCsrPem(string commonName)
                 + "\n-----END CERTIFICATE REQUEST-----";
         }
 
-        private IDomainValidatorFactory BuildDnsFactory() =>
-            _fixture.IsCloudflareConfigured
-                ? (IDomainValidatorFactory)new CloudflareDomainValidatorFactory(
-                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId)
-                : new StubDomainValidatorFactory();
+        private IDomainValidatorFactory BuildDnsFactory()
+        {
+            if (_fixture.IsCloudflareConfigured)
+            {
+                var factory = new CloudflareDomainValidatorFactory(
+                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId);
+                _toDispose.Add(factory);
+                return factory;
+            }
+            return new StubDomainValidatorFactory();
+        }
 
         /// <summary>
         /// Runs <c>plugin.Synchronize</c> and returns every record that came out of the