Legacy and new, one security contract.
The five layers run behind a single B5 Secure pipeline on .NET 10 — ASP.NET Core minimal APIs and GraphQL alongside co-hosted ServiceStack v10, sharing the same schemes, keys, and telemetry. Old and new surfaces are governed by one security contract, so modernization never opens a seam between them.
1. Why co-host at all
Modernization usually creates a dangerous in-between: a new surface next to a legacy one, each with its own auth, its own keys, its own gaps. B5 refuses that seam. Legacy and modern endpoints are co-hosted behind a single security pipeline, so the security contract is identical no matter which stack actually serves the request.
2. One pipeline, two stacks
On .NET 10, ASP.NET Core minimal APIs and GraphQL run alongside co-hosted ServiceStack v10 — but every request, regardless of stack, traverses the same B1–B5 layers. There is no “legacy path” with weaker enforcement and no “new path” that re-implements security slightly differently. One pipeline, one definition of done.
3. Shared schemes, keys, telemetry
The co-hosted surfaces share the same authentication schemes, the same HSM-held keys by reference, and the same telemetry stream. That means one audit trail across both stacks, one place to rotate keys, and one consistent view for detection and response — rather than two partial pictures that have to be reconciled after an incident.
4. The calling convention
Co-hosting is configured once; both stacks register against the same pipeline.
// One pipeline governs minimal APIs, GraphQL, and ServiceStack v10
services.AddB5SecurityKit(o => o.Pipeline.Enforce(Layers.B1ToB5));
app.UseB5Pipeline(); // shared schemes + keys + telemetry
app.MapMinimalApis();
app.MapGraphQL();
app.MapServiceStack(); // co-hosted, same contract5. A seam-free migration posture
This is what makes incremental modernization safe. Teams can move endpoints from ServiceStack to minimal APIs — or stand up new GraphQL surfaces — without ever standing up a parallel, weaker security stack. The migration from .NET Framework to .NET 10 happens surface by surface while the security contract stays constant the entire way.
6. Where this lands in an audit
Co-hosting is the evidence for consistent enforcement and unified logging across a heterogeneous estate (NIST CSF PR.PS, DE.CM; SOC 2 CC7.2; ISO 27001 A.8.15–A.8.16). Reviewers do not have to assess two security models — there is one, and it covers everything the host serves.