JVM feature parity reference

Status key

Status	Meaning
Implemented	Available and covered by source tests, contract tests, integration tests, or runnable samples.
JVM-specific	Supported with an intentionally JVM-native shape.
Partial	Usable behavior exists, with the stated boundary still remaining.
Not planned	Outside the Spring Boot, model-bound framework direction.

Feature matrix

Area	Status	Current JVM contract
Model-bound commands	Implemented	@Command plus one public instance handle; KSP generates reflection-free handlers.
Kotlin command async	JVM-specific	suspend handlers run in an application-owned, bounded coroutine scope.
Java command async	JVM-specific	Generated adapters await CompletionStage without blocking request threads.
Command provide	Implemented	Regular, suspend, and CompletionStage preparation supports ordered provided values, control short-circuiting, and service fallback without runtime method reflection.
Tuple and alternative returns	Implemented	Kotlin Pair/Triple, CommandProvidedValues, CommandResponseValues, and ArcOneOf alternatives are flattened in declaration order.
Aggregate command responses	Implemented	Runtime and KSP recursively flatten Pair, Triple, ArcOneOf, and nested CommandResult values in declaration order. Source-visible @HandlesCommandResponseValues declarations classify custom server-consumed leaves, and built-in event/control leaves are handled consistently. Exactly one client leaf is projected into runtime, proxy, and OpenAPI metadata; multiple client leaves fail with ARCKSP0109, while handled-only commands expose no fake client response. Binary annotations alone remain undiscoverable: the JVM-specific dependency declaration resource and tracked index are required (see configuration); ArcResponseHandlerMetadataFunctionalTest exercises binary producer/consumer classification. Erased CommandResponseValues contents remain untyped metadata.
One-shot queries	Implemented	Static Java or @JvmStatic companion methods on @ReadModel; class-level @QueryHttpMethod defaults with method overrides; non-query companion/static helpers ignored unless explicitly query-annotated, while custom instance methods remain invalid; GET and optional RFC QUERY hosting with case-insensitive client argument names and fail-closed case collisions; generated performers inject interspersed service, QueryRequest, and QueryContext parameters without exposing them as client input. Omitted Kotlin client defaults execute at invocation, while supplied values, including explicit null, retain presence.
Concepts	Implemented	Kotlin classes and Java records implementing ConceptAs<T> serialize as their underlying scalar or enum value. KSP carries that shape through command, query, model, response, validation, TypeScript, OpenAPI, and Chronicle command-key contracts rather than exposing wrapper objects.
Polymorphic derived types	Implemented	@DerivedType writes _derivedTypeId, and code generation records every base-to-derivative mapping it saw — the declared interface plus each base class — on the generated ArcArtifactModule as real class references. The Spring Boot starter registers them into a DerivedTypeRegistry bean before Jackson reads anything, and ArcArtifactModuleRegistry.registerDerivedTypes does the same for explicit in-process registration; a DerivedTypeRegistrar bean adds a hierarchy code generation never processed, such as one that arrives only as a dependency binary. Arc .NET scans every loaded assembly at startup instead, so the JVM needs that registrar where .NET needs nothing. Reading fails closed on an identifier the registry cannot resolve, which matches .NET, and also when the discriminator is absent, where .NET returns null — an intentional divergence.
Temporal and UUID proxies	Implemented	Direct and concept-backed LocalDate, LocalTime, and UUID generate DateOnly, TimeOnly, and Guid from @cratis/fundamentals; UUID-to-Guid is an explicit .NET parity decision. Commands and GET query parameters serialize scalar strings, and returned generated models hydrate as class instances. Core and Spring disable WRITE_DURATIONS_AS_TIMESTAMPS, so Duration reads and writes ISO-8601 text, generates TypeScript string, and is OpenAPI string/duration; it is not Fundamentals TimeSpan because Java and C# wire formats differ. Tested Period behavior is limited to Core ISO-8601 round-trip and TypeScript string generation. OffsetTime generates as textual, untyped string; its offset-specific semantics are not hydrated into a class. LocalDateTime, Instant, OffsetDateTime, and ZonedDateTime remain JavaScript Date.
Observable queries	Implemented	ObservableState<T> is the Java-native counterpart of MutableStateFlow: a Flow.Publisher<T> that holds a current value, so a Java observable query answers a snapshot GET from it exactly as a Kotlin query returning a StateFlow does. Without it a Java application could only publish through a plain publisher, which has no current value and is therefore reported as not-ready on every snapshot however promptly it emits. ObservableStateTest and ObservableStateJavaConformanceTest cover replay, conflation, demand, cancellation and the asKotlinFlow unwrap. Primary reactive types are Kotlin Flow<T> / Flow<List<T>> and JDK Flow.Publisher<T> / Publisher<List<T>>; the optional arc-rxjava3 artifact also accepts RxJava 3 Observable<T>, ObservableSource<T>, and Subject<T>. Arc .NET uses IObservable<T> / ISubject<T>; the JDK primary equivalents are Flow.Publisher<T> and MutableStateFlow / SubmissionPublisher respectively, requiring no external dependency. reactor.core.publisher.Flux is rejected to preserve the Spring-free Source boundary; org.reactivestreams.Publisher is rejected because it is superseded by the JDK type. Observable performers use revision ordering, full/delta transfer with the omitted-mode legacy snapshot plus change set, renderers, interceptors, and per-emission guards; keyless or invalid-key collection deltas use Arc .NET-compatible serialized JSON set identity and surface field changes as remove plus add; infrastructure parameters are injected rather than subscription-bound, and omitted Kotlin client defaults remain omitted through every binder.
Observable HTTP and hubs	Implemented	Bounded GET and enabled RFC QUERY HTTP snapshots that serve a StateFlow source’s current value with 200 and report a source without one as not-ready with 202, direct GET SSE/WebSocket, multiplexed SSE/WebSocket hubs, revisions, heartbeats, caller/tenant capture, and terminal authorization behavior. cratis.arc.observable-queries.allowed-origins names the browser origins allowed to open a WebSocket; empty keeps Spring’s same-origin default, which a deployment wants and which makes every handshake from a separate dev server fail with a 403 a browser reports only as a socket that never opens. ArcObservableQueryWebSocketOriginTests reads the origins off the handler mapping Spring built. Fixed multiplexed routes are connection-anonymous while successful credentials are captured; every subscription is independently authorized and isolated. WebSocket support remains optional by classpath and configuration.
Query paging and sorting	Implemented	GET reserved parameters, structured QUERY bodies, QueryPage, calculated paging metadata, and iterable fallback rendering. QueryPagingSortingExecutionTest, QueryPagingSortingJavaConformanceTest, and ArcQueryPagingSortingHostingTests execute nonempty data through the default pipelines: iterable results sort before zero-based paging and retain the pre-page total even when descriptor flags are false; provider-owned QueryPage items/order/totals remain unchanged. Original arrays are normalized for output but bypass iterable sorting/paging/counting. QueryablePropertyAccessTest, QueryablePropertyAccessJavaConformanceTest, and ArcQueryPropertyAccessHostingTests cover public-only accessor selection, singleton/mixed-type rejection, Kotlin declaration visibility across Java inheritance, public bean/record getter semantics, and cancellation/fatal propagation. Private storage is not read as a substitute for a public accessor; inaccessible and absent keys fail without a sorted payload and host exception details remain redacted. This is a JVM visibility safeguard, not a serialization-annotation or per-field authorization policy. Generated convenience methods remain separately capability-driven; no automatic array paging or general .NET backend equality is claimed.
Query extension points	Implemented	Ordered QueryRendererFor<T> and InterceptReadModel<T> contracts apply to one-shot and observable results; GuardObservableQueryEmission rechecks each observable emission, and a suppressed emission leaves first-delivery status to the next delivered one. Configured renderers match the original value and own data/paging; the automatic iterable renderer is a fallback only when none match. Explicit QueryableQueryRenderer stages consume current data and preserve null/non-iterable projections, never restoring original rows. QueryRendererOwnershipTest, its Java conformance counterpart, and ArcQueryRendererOwnershipHostingTests cover discarded rows, projections, provider totals/no premature source enumeration, explicit ordering, cancellation, and both query transports. Existing application renderers—including identity/logging renderers—must explicitly opt into in-memory processing where wanted; this is a JVM behavioral correction, not a claim of .NET renderer equivalence.
Query health	Implemented	QueryHealthTracker exposes snapshots and a Flow; /.cratis/queries/health exposes the current connection/subscription health. Intentional divergence: Arc .NET declares the health read model [AllowAnonymous], while the JVM host requires an authenticated caller on both GET and QUERY whenever authentication handlers are registered, because the snapshot reports connection and subscription identifiers, remote IP addresses, user agents, and user identities. Applications with no authentication handler are unaffected.
Spring Data JPA	JVM-specific	Repository injection, generated QueryRequest/Pageable/Sort injection, exact Page<T> normalization, DECLARED contextual command read-model ownership, tenant-certified persistence units, and cold/shared observable Flow snapshots with demand-aware Java publishers. JPA notifications are explicit and in-process by default. Imperative command transactions are fixed-store, thread-bound opt-ins.
Spring Data MongoDB	JVM-specific	Repository injection, generated QueryRequest/Pageable/Sort injection, exact Page<T> normalization, FALLBACK contextual command read-model ownership, tenant-certified operations, and cold/shared observable Flow snapshots backed by reconnecting change streams with demand-aware Java publishers. Change streams require a replica set or sharded cluster. Imperative command transactions are fixed-store, thread-bound opt-ins.
Command and query-model validation	Implemented	Arc CommandValidator and QueryValidator contracts, severity thresholds, command validate routes, and stable envelopes apply in the real pipelines. When a Spring Validator bean exists, Jakarta validation automatically covers command and client-supplied typed one-shot/observable query-argument graphs; nested @Valid collections/maps and cycles retain stable member paths, while infrastructure parameters are neither required nor client-validated. An omitted Kotlin default has no pre-invocation value, so executable violations for that slot are ignored and the default executes at the model boundary.
Concept validation	Implemented	Reusable ConceptValidator<TConcept> rules apply across command and query object/record/collection/map graphs when supplied to the default validation filters. Spring auto-discovers ordered concept-validator beans alongside command/query validators, while replacement default filter beans remain authoritative (ArcConceptValidationTests, ConceptValidationJavaConformanceTest, and ArcConceptValidationHostingTests in Integrations/SpringBoot). Imperative bean rules remain server-only, separate from generated Jakarta validation metadata.
Shared fluent model validation	JVM-specific	FluentModelValidator<T> supports thirteen bounded literal rules, Kotlin/ordinary Java constructor authoring, generated module registration and concrete acyclic nested client composition. ContractTests/FluentValidationContractTest, runtime.fluent.contract.ts and ArcFluentValidationNativeFunctionalTest prove generated registration, real JVM/client rejection and indexed library invalidation. Dynamic/async predicates, warning severity, polymorphic/cyclic graphs and shared-model GET/observable transport remain unsupported; legacy annotation credit-card constraints remain server-only. See shared validation.
Member validation opt-out	JVM-specific	@IgnoreValidation cuts a logical member edge before getter/extractor access, including direct rules and descendant validation, without pruning authored fluent fingerprints or wire/binding metadata. Source/IgnoreValidationTest, Integrations/SpringBoot/ArcIgnoreValidationHostingTests, ContractTests/IgnoreValidationContractTest, IgnoreValidationJavaContractTest, and runtime.ignore-validation.contract.ts cover runtime, real Jakarta/HTTP, generated scenarios and real client/server behavior. ArcFluentValidationNativeFunctionalTest proves annotation/dependency edits, recovery and fresh-output equivalence. Owner imperative/class/group-sequence callbacks and executable parameter constraints remain active. Runtime bean-only getters are an explicit expansion; active shared graph limits and the fail-closed binary-record boundary remain. Manifest 8 requires producer/consumer regeneration; custom opaque validators require explicit factory integration. See the bounded contract.
Validation metadata	Implemented	KSP preserves exactly representable Jakarta constraints, recursive validation, and inherited concept rules in manifests/runtime descriptors. TypeScript validators merge concept and owning-member rules; unrepresentable client rules fail with ARCKSP0301. Phone and Url have client rules; credit-card constraints remain server-only because the pinned client runtime lacks one. JVM annotation coverage is intentionally broader than .NET DataAnnotations (Required, StringLength, MinLength, MaxLength, Range, RegularExpression, EmailAddress, Phone, Url, CreditCard): Hibernate @Range, Hibernate @Length, and Jakarta @Digits are additionally supported on the JVM. Annotation and DSL rules deliberately union rather than following ValidationRulesExtractor.MergeValidationRules precedence, because on the JVM both Jakarta and the DSL execute server-side — precedence would make the generated client weaker than the server. See conjunction, duplication and contradictions.
Authorization	Implemented	Anonymous, policy, role, and scheme metadata works through Arc pipelines and Spring principal capture. Operation-level metadata — @AllowAnonymous, @Authorize or @Roles — replaces the class declaration wholesale, matching Arc .NET’s AuthorizationEvaluator.IsAuthorized(MethodInfo), which resolves the method’s own metadata first and falls back to the declaring type only when the method declares none. An operation therefore both narrows and opens: a @Authorize read model can expose one @AllowAnonymous query, which is what a login screen needs, and an @AllowAnonymous class can close one operation with @Roles. ArcSymbolProcessorAuthorizationPrecedenceCompilationTest covers both directions through generated metadata and the real AuthorizationEvaluator, and the Kotlin sample’s AuthenticationQueryItem exercises the widening case over HTTP. Remaining intentional divergence, narrower than before: @AllowAnonymous combined with @Authorize/@Roles on the same declaration is a compile-time ARCKSP0108 error, where .NET silently prefers anonymous.
Authentication	Implemented	Ordered coroutine AuthenticationHandler and Java AsyncAuthenticationHandler chains run before Arc endpoints; the first handler that recognizes the request decides, a recognized failure is terminal and cannot be overridden by a later handler, and anonymous is the outcome only when no handler recognized the request. Failures are generic, the chosen principal is propagated, and the identity cache cookie is excluded from credentials. Multiplexed observable transport connections may remain anonymous, but protected query subscriptions still fail through the query authorization pipeline.
Host correlation	Implemented	A servlet filter on /* establishes one correlation identifier per request for every route in the host, Arc-owned or not, matching the placement of the Arc .NET CorrelationIdMiddleware. It is ordered ahead of Spring Security’s filter chain and the Arc authentication filter, reuses an inbound X-Correlation-ID only when it is a UUID, re-emits the canonical value as the request and response header, exposes it through ArcCorrelation.of(request), and binds it to SLF4J MDC for the servlet thread only. Coroutine-visible correlation still comes from CommandContext, QueryContext, and the observability starter’s thread-context element.
Introspection	Implemented	/.cratis/commands and /.cratis/queries return deterministic generated route, schema, authorization, transport, paging, and documentation metadata and omit infrastructure-owned query parameters. Defaulted client parameters report hasDefault, are absent from schema required, and expose no expression or invented value. UUID and supported terminal textual java.time values (LocalDate, LocalTime, LocalDateTime, Instant, OffsetDateTime, ZonedDateTime, OffsetTime, Duration, and Period) are scalar string schemas, including collection elements, rather than recursively described objects.
Identity	Implemented	Coroutine or Java asynchronous details provider, /.cratis/me, schema generation, client-readable identity cookie, and optional-provider startup validation.
Trusted platform identity headers	JVM-specific	Default-off Spring Security AuthenticationConverter and once-per-request chain filter consume the three x-ms-client-principal headers only through an explicit trusted-ingress policy (default deny). Canonical ID, name, roles, and provider collision handling follow the inspected Arc.Core/Identity/MicrosoftIdentityPlatformAuthenticationHandler.cs at Arc .NET 03200c1c52020e60e5d55c5ed38b5b189a899504; stricter bounded parsing and partial-submission rejection are deliberate JVM boundaries, not raw handler equivalence. SpringBoot’s ArcPlatformAuthenticationConverterTests, ArcPlatformIdentityAutoConfigurationTests, ArcPlatformIdentityHostingTests, ArcPlatformIdentityDisabledTests, ArcPlatformAuthenticationFilterTests, and compiled PlatformIdentityJavaConformanceTest/PlatformApplicationChainJavaConformanceTest prove parsing, optionality/backoff, real /.cratis/me, role/scheme/claim authorization, CSRF, existing identity preservation, and once-only execution. Application chains remain authoritative; the opt-in default protects every route. Unsigned base64 never proves sender identity; deployment ingress isolation/authentication remains the application’s responsibility.
Users and tenants	Implemented	Anonymous /.cratis/users and /.cratis/tenants aggregate ordered coroutine and Java asynchronous providers, deduplicate by identifier, and return redacted failures.
Tenancy	Implemented	Fixed/header/query/claim/subdomain/development resolvers, ordered composition, fail-closed required mode, claim-membership checks, request/subscription capture, and application override beans without thread-local state.
Kotlin ergonomics	JVM-specific	Reified service lookup; result fold/getOrThrow/onSuccess/validationOrNull; ordered response factories; and property views for Java-method contracts are Kotlin-only conveniences that preserve the Java ABI.
Java Core adapters	JVM-specific	Blocking and CompletionStage adapters cover command/query filters, authorization filters and policies, validators, command scopes and response handlers, and manual artifacts. JavaAsyncScope provides cancellable command/query/authentication/observable/health facades over a caller-owned executor. Caller-thread BlockingCommandPipeline execute/validate and BlockingQueryPipeline perform facades require explicit per-call or constructor-bound options; Spring supplies backing-off unbound beans. Source’s BlockingPipelineTest, BlockingRealPipelineInterruptionTest, and BlockingPipelineJavaConformanceTest, plus Integrations/SpringBoot’s ArcBlockingPipelineTests and BlockingPipelineJavaConformanceTest, cover context/results, validate nonexecution, cancellation/interruption cleanup, migrated bounded-scope/reentry rejection, and Java service injection. Blocking invocations normalize directly observed callback InterruptedException (including propagated worker exceptions) to cancellation after cleanup and set the caller interrupt flag; this does not prove physical caller interruption, and swallowed interruption is undetectable. Legacy coroutine and guard-only calls retain their behavior. These are opt-in blocking calls, not another async bridge: no hidden timeout or ambient identity, no arbitrary external-coroutine detection, and no guarantee that cancelling a stage stops external work; see Java calling limits.
TypeScript one-shot proxies	Implemented	Commands, queries, models, interfaces, derived types, enums, flags, paging hooks, validators, authorization metadata, and Kotlin/Java concepts erased to their underlying client types compile in strict mode against real @cratis packages. Query interfaces, descriptors, required arguments, properties, routes, validators, hooks, and imports include only client parameters; service, QueryRequest, and QueryContext parameters are omitted. Defaulted Kotlin parameters generate optional fields and call arguments and are excluded from requiredRequestParameters without copying a server literal. Strict contracts enable verbatimModuleSyntax, and generated interfaces use type-only imports where appropriate. Aggregate command metadata selects the single client leaf’s exact type and enumerable shape; handled-only commands use the response-less command contract. Concept validation rules merge with owning command/query rules. The DateOnly/TimeOnly/Guid change is source-breaking for consumers that assigned Date or scalar strings.
TypeScript observable proxies	Implemented	Enumerable and single-result observable classes, React hooks, paging/sorting/change-stream helpers, conditional queries, validation, transport, and HTTP preference metadata omit infrastructure parameters; Kotlin defaults are optional capability metadata without emitted values. For both query transports, named sorting helpers use return-model properties (including represented class-base properties), not request arguments; capability flags remain authoritative. QuerySortHelperTest and ArcProxyMappingRuntimeTest cover parameterless/parameterized queries, inherited fields, request-field exclusion, collision-safe helper storage and actual sorting actions; GeneratedTypeScriptProxiesTest asserts the real KSP-produced Kotlin/Java Spring Data clients select returned value rather than request label. The pinned .NET model-bound generator derives helper names from parameters, so this is a documented JVM correctness divergence. Provider-specific field support and unrepresented interface inheritance are not inferred.
.NET-derived proxy differential gate	Implemented	:GradlePlugin:test compares sorted paths for all regular output files, then untouched JVM bytes (including headers) against the prepared repository-local expected fixture. Expected-only preparation validates 16 source identities against a literal table and fixture descriptors, reconstructs uppercase SHA-256 headers independently from expected bodies, and leaves three indexes headerless. Queries use declaring-model identities. The complete preparation inventory includes expected LF/trailing-whitespace handling, FixtureModel quote/indent preparation, CreateFixtures quote/import/layout/hook preparation and exact-site suppression, and five literal type-only import rewrites for verbatimModuleSyntax. Historical namespace/query-name casing and removed timestamps/hashes remain embedded capture-time transformations. SetCommandValues, ClearCommandValues, and query helper types such as PerformQuery, SetSorting, SetPage, SetPageSize, and ChangeSet become type-only imports. At Commands/CreateFixtures.ts, one additional expected-side correction changes Command<ICreateFixtures, FixtureModel> to Command<ICreateFixtures, FixtureModel[]>; .NET already calls super(FixtureModel, true), so the scalar generic contradicts its enumerable runtime behavior. Only Models/Observe.ts also receives one exactly anchored expected-only formatting change: the zero-space blank line immediately before ObserveParameters.filter: string; becomes four spaces; ObserveOne.ts is excluded. ExpectedSortHelperPreparation additionally replaces the exact helper pairs in Models/All.ts, Models/Search.ts, and Models/Observe.ts with a literal return-field inventory after verifying unique anchors and fixed original block hashes; only All gains SortingActions imports, and the helper constructor no longer exposes its owner as query. Request parameters, routes, hooks and capability flags remain unchanged. This is an explicit semantic correction for the JVM’s returned-row helper behavior, not raw .NET output parity. Missing/duplicate correction anchors and misplaced suppressions fail preparation. Actual byte/path mutation tests include a changed body with a valid recomputed hash. Contracts/Shape.ts is a class, not interface-emission proof. No normalization transforms JVM output. Capture SDK/tool versions remain unverified. The fixture currently contains no Guid, DateOnly, or TimeOnly, so focused generator and contract tests cover that mapping. This remains a drift gate for the normalized fixture, not an exact raw .NET-output comparison; capture-time fixture preparation is not yet reproducible tooling.
TypeScript proxy and runtime gates	Implemented	:ContractTests:typeScriptBuild installs the locked real @cratis packages, verifies deterministic regeneration, and compiles generated proxies in strict mode with verbatimModuleSyntax and type-only interface dependencies. The runtime harness has five wired unit tests plus 33 behavioral runtime tests: four ignore-validation tests, four shared-fluent tests and 15 general tests in separate UTC processes, five calendar tests in separate UTC, and five in separate America/Los_Angeles processes. Parsed TAP summaries require exact test/pass totals and zero fail, cancelled, skipped, or todo results; Spring spawn errors fail cleanly. The behavioral gate verifies validation, typed and hydrated command responses, safe malformed envelopes, correlation, GET/QUERY, paging/sorting, identity, multiplexed/direct WebSocket, direct SSE, scalar calendar/UUID transport, timezone stability, and TimeOnly millisecond truncation; :ContractTests:check depends on it.
Chronicle event transactions	Implemented	Returned events are staged until the final command result succeeds and committed as ordered appendMany batches per selected store. Generated command event metadata supplies optional source type, stream type, stream ID, and subject defaults to immediate and staged appends; explicit routed values win and command causation is appended. A collection may mix plain events routed by the captured CommandContext.commandKey with explicit EventForEventSourceId values; item order and explicit source IDs are preserved and malformed mixtures fail before append. ChronicleCommandKeyRoutingTests and its Java conformance counterpart prove stateful key providers are not resolved a second time, including null-key rejection and explicit-route preservation. Separate enrollments from one execution frame reuse one generated command causation link. ChronicleStagedCausationTests exercises the pinned real SDK preflight with mocked gRPC transport: different explicit or nested-frame chains remain rejected under its single-chain batch contract, not flattened or split. This does not prove real-kernel acceptance or heterogeneous nested-command lineage support. Failed commands discard staged events. No cross-store distributed transaction is provided.
Chronicle concurrency	Implemented	EventsWithConcurrencyScopes carries ordered routed events and exact per-source Chronicle scopes through Kotlin and Java builders; violations map to machine-readable validation feedback.
Chronicle read models	Implemented	Chronicle-discovered read models are declared to the command resolver registry, resolved by generated command key and tenant store, and released through a query interceptor before one-shot or observable results leave the pipeline.
Chronicle command side effects	Implemented	Reactors can explicitly hand registered command values to ChronicleCommandSideEffectHandler; nested aggregates run sequentially through the real pipeline and stop on failure. Causing identity is preserved without roles unless the reactor declares exact system roles.
Chronicle scenarios	Implemented	A ServiceLoader extender gives CommandScenario an in-memory event log, ordered given history, append assertions, and deterministic constraint/concurrency rejection, with Kotlin extensions and Java static bridges. No Chronicle kernel is started.
OpenAPI	Implemented	The optional starter generates and caches OpenAPI 3.1 from artifact metadata, including reusable underlying scalar/format/enum schemas for Kotlin and Java concepts, and omits infrastructure-owned query parameters. Kotlin defaulted client parameters are non-required and carry no invented OpenAPI default. UUID, date, time, and duration wire values are scalar strings with uuid, date, time, and duration formats. Command result schemas expose only the unique client response leaf from ordered aggregate metadata and omit response for handled-only commands. The starter serves /v3/api-docs plus /.cratis/openapi.json; application beans/routes win. RFC QUERY is omitted because OpenAPI Path Items do not define it. Imperative concept validators are runtime behavior, not OpenAPI keywords.
Observability	Implemented	The optional starter decorates command execute/validate, one-shot and observable query open/subscription/emission, authentication, and identity-details execution with Micrometer observations. Stable low-cardinality tags exclude tenant, user, command values, and query arguments; correlation uses observation context plus optional OpenTelemetry baggage and SLF4J MDC.
Source documentation	Implemented	KSP reads Kotlin KDoc and Java Javadoc for commands, query methods, client query parameters, model types and properties, interfaces and properties, and enum declarations, and the manifest carries them as single-line summaries that runtime introspection and generated TypeScript JSDoc render. A member falls back to a Kotlin @property or Java @param tag; enum members, setters, backing fields, runtime query fields, and barrel files are deliberately undocumented, and OpenAPI keeps conventional descriptions. Only the first paragraph is captured, bounded at 512 Unicode code points. Comparable Arc .NET behavior has not been demonstrated here and is not claimed.
KSP diagnostics	Implemented	Stable ARCKSP codes cover configuration, commands, queries, proxy shapes, Jakarta validation metadata, enum values, interoperability warnings, and unclassified failures.
Measured cross-runtime proxy agreement	Partial	ArcGradlePluginFunctionalTest generates JVM proxies for Kotlin declarations mirroring the captured .NET fixture and compares them file by file against differential/captured, with both generators at segmentsToSkip 0. Confirmed from real output on both sides rather than from JVM-side assertion: the generated artifact sets match; routes match exactly; Address.ts and OrderKind.ts are byte-identical apart from the namespace casing each runtime echoes into the header Source field, with identical content hashes, which the test asserts so it cannot silently regress; and Guid, DateOnly, TimeOnly, DateTimeOffset/OffsetDateTime, enum, and nested-model mappings agree. Cosmetic divergences remain: .NET sorts members alphabetically while the JVM preserves declaration order, .NET emits one import per @cratis/fundamentals type while the JVM combines them, and the JVM emits type-only imports for verbatimModuleSyntax. Generated paging/sorting remains capability-driven on the JVM: QueryPage and exact Spring Page returns also advertise paging without adapter parameters. Core’s default renderer already sorts/pages runtime Iterable values independently of those flags, but KSP does not advertise that in-memory capability. Arc .NET’s enumerable helper generation is not proof of server behavior: at v22.14.0 its default renderer handles runtime IQueryable, not an arbitrary list or array. The inspected implementation and documentation establish this distinction; the empty capture fixture itself cannot prove pagination. CapturedProxyContract now checks exact relative paths (not basenames), capture checksums, fixed header identities, model/enum full bytes after expected-header-only preparation, and independent literal command/query contracts for routes, members, constructors, collection shape, parameters and methods. CapturedProxyContractTest mutates those contracts and file inventories to prove mismatches fail, including duplicate basenames and renewed hashes. This is Partial: command/query comparison is a bounded token contract with explicit import/order and capability exceptions, not raw byte equality, type-soundness of ignored hook calls, or general equivalence. JVM output bytes are never rewritten.
Reproducible Arc .NET proxy capture	Partial	GradlePlugin/src/test/resources/differential/capture/capture.sh regenerates real Arc .NET proxy output from published NuGet packages at pinned Cratis.Arc and Cratis.Arc.ProxyGenerator 22.14.0, matching Arc .NET’s v22.14.0 tag. It never reads, builds, or copies from a sibling checkout. The hardened harness pins SDK 10.0.400, both reflection/runtime frameworks at 10.0.11, the locked NuGet graph and archive/payload hashes; it preserves raw bytes and writes format-2 provenance with input hashes. Output must be a new lifecycle-managed .ai-work destination; existing paths and symlinks are refused and publication is atomic without replacement. test_capture.py covers corruption, exact normalization, failures and output safety. Two fresh normalized trees were verified equal to each other and the checked-in seven-file comparison fixture; complete raw trees/manifests are intentionally not byte-identical because they retain timestamps. Exactly one normalization is applied, to .NET output only: the generator’s wall-clock Time: header field, which the JVM generator does not emit and which otherwise makes the capture differ from itself every run. The newly authored fixture carries Guid, DateOnly, and TimeOnly, confirming from real .NET output rather than assertion that Arc .NET maps them to Guid/DateOnly/TimeOnly from @cratis/fundamentals, camel-cases enum members behind a Number descriptor, and imports nested models relatively. This is Partial: the older hand-prepared differential/dotnet drift gate remains separate and unchanged. The seven-file captured contract check above is narrower than a whole-generator or server equivalence proof. :GradlePlugin:verifyCapturedProxyBaseline now runs before the ordinary GradlePlugin tests and checks the reviewed seven-file baseline against its input hashes and SDK/runtime/package/tool pins, with mutation tests for stale scripts/locks, byte changes even after renewed snapshot hashes, metadata drift, symlinks and path inventories. This offline consistency gate needs no .NET installation, network, package-cache reads or retained .ai-work capture. verify_baseline.py --candidate requires a full raw/normalized capture and matching current inputs before emitting a review candidate. The receipt is not an attestation: its evidence digest does not by itself prove tool execution, and coordinated changes still require review. Fresh capture/provenance verification remains explicit, not a hidden network operation in ordinary JVM tests, and Linux capture execution has not been verified. No raw .NET output equivalence follows from this harness.
External TypeScript package mappings and type overrides	Implemented	proxies { mapType(...) } maps a JVM type to a TypeScript type with an optional npm package, and mapPackage(...) maps every model type under a JVM package to an npm package it is imported from by simple name. Mappings are consulted ahead of the generator’s built-in type map, so an entry corrects an existing mapping as well as declaring an unknown one; concepts unwrap first, so the underlying type is what a mapping matches, as in Arc .NET’s TypeExtensions.GetTargetType. A mapped type is excluded from emission, matching .NET’s IsFromMappedAssembly filter, so a local declaration and an external import never collide. The longest matching package wins. Blank components are named in warnings; unsafe or unrepresentable nonblank mappings and import collisions fail before output writes. Unpackaged overrides are limited to string, number, boolean, object, and Date with actual runtime constructors; manifest interfaces and numeric enums retain Object/Number descriptors and type-only imports. External classes require compatible Fundamentals field metadata; mappings never change server JSON. External map-value and polymorphic-base/derivative hydration remain unsupported. The standalone CLI takes the same values as repeatable --type-to-typescript and --package-to-npm options, with the same bounded three-part split. ArcProxyTypeMappingTest covers resolution, diagnostics, collision rejection and stale-file transitions. ArcProxyMappingRuntimeTest strictly compiles generated clients against the locked packages and executes primitive overrides, nested/list/interface/enum hydration and mapped command/query responses through a local HTTP fixture. ProxyMappingsJavaConformanceTest executes the public Gradle task/DSL from Java. Dependency declaration checking uses the repository’s existing skipLibCheck setting; generated TypeScript remains checked. The JVM keys package mappings on a JVM package prefix because it has no assembly identity to key on; .NET’s --exclude-type, --exclude-namespace, and --namespace-root options have no equivalent and none is claimed.
Artifact roots without commands or queries	JVM-specific	@ExportedType makes a public top-level concrete class, enum class, interface, or concept an explicit artifact root; unsupported targets fail with ARCKSP0306, covered by ArcSymbolProcessorExportedTypeCompilationTest and Kotlin/Java negative fixtures. Public concrete source identity providers and typed factory returns now automatically contribute supported details roots, including inherited generic specialization and anonymous providers behind typed factories. ArcSymbolProcessorIdentityCompilationTest covers Kotlin, ordinary compiled Java and later rounds; ArcIdentityDiscoveryFunctionalTest covers native correction, addition/removal and fresh-output equivalence. GeneratedIdentityArtifactsTest, IdentityArtifactsJavaContractTest and GeneratedTypeScriptProxiesTest cover the module, artifact manifest and generated client. The Kotlin sample generates SampleIdentityDetails.ts without an explicit export annotation. Identity-only compilations still emit the module, service entry and empty command/query lists. Erased, wildcard/star, unspecialized, inaccessible or unsupported details boundaries fail with ARCKSP0307. Discovery reads declarations, not bodies or runtime beans; dependency-only providers are not scanned wholesale, though source-visible bindings can use dependency generic signatures. Explicit export remains a fallback for supported source DTOs without such a declaration. No .NET output equivalence, assembly scanning, bulk DTO export or --library-mode equivalent is claimed.
Binary compatibility	Implemented	Checked .api baselines and apiCheck cover published runtime modules, integrations, testing, arc-ksp, and arc-gradle-plugin; changes require an intentional baseline update. Manifest format 8 adds explicit property validation-ignore metadata after format 7’s optional typed command event metadata, while retaining recursive type shapes, canonical query parameter sources, legacy JVM programmatic constructors, and source documentation. IgnoreValidationMetadataJavaConformanceTest calls the earlier property constructors and round-trips the explicit flag; IgnoreValidationMetadataTest rejects prior formats and missing flags. Rebuild metadata producers and consumers together. Earlier command constructor descriptors, including Kotlin default-argument bridges, remain available.
Runtime hardening	Implemented	Bounded coroutine admission/queueing, request bodies, timeouts, scope completion, observable connections/subscriptions/buffers/messages/tombstones, safe error redaction, and 413/429/503 fail-closed responses are implemented.
Testing	Implemented	Kotlin scenarios and blocking/asynchronous Java bridges exercise real command, query, and observable pipelines with services, filters, validators, authorization, renderers, interceptors, guards, and tenant context. Command-side read models can be pinned to a known state, optionally per command key, through Arc’s own ownership registry rather than a store. A Java-authored temporal contract executes a generated Java command and query through the public JavaAsyncScope and real pipelines. Chronicle adds its in-memory scenario extender rather than a separate fake pipeline.
Roslyn analyzers	JVM-specific	KSP compile-time diagnostics are the JVM substitute; Roslyn does not apply.
Controllers	Not planned	Arc generates model-bound Spring MVC endpoints.
Non-Spring hosting	Not planned	Arc targets Spring Boot; the Spring-free compiler/Gradle boundary does not promise another host.
Static file / SPA fallback hosting	Not planned	Use Spring Boot static-resource serving and application-configured Spring MVC fallback facilities, not Arc hosting APIs.
@FromRequest	Not planned	Existing QueryRequest/QueryContext injection and Spring binding cover the supported request inputs; no arbitrary request-injection API is promised.
@IgnoreAutoRegistration	JVM-specific	Command/query generation entry points are annotated declarations (@Command and @ReadModel), so those entry points need no opt-out annotation. Identity details additionally become automatic roots through public concrete source providers and typed factory returns, as covered by ArcSymbolProcessorIdentityCompilationTest; this discovery does not register runtime beans. Reachable-type traversal and diagnostic discovery also occur; this does not claim all discovery is annotation-only. ArcSymbolProcessor.process defines these entry points. In CodeGeneration/KSP, ArcSymbolProcessorCommandEventMetadataCompilationTest and ArcSymbolProcessorQueryDefaultsCompilationTest cover annotated command/query generation; ArcSymbolProcessorNegativeCompilationTest covers the missing-command warning.
@GenerateOneOf	Not planned	Runtime ArcOneOf alternatives already exist; generating union types is a separate capability and is not planned.
Screenplay	Not planned	No JVM equivalent is provided; Screenplay is outside this product’s scope. Existing in-process scenarios are not Screenplay parity.
Transparent query and Spring Data framework parameters	Implemented	Generated query performers inject exact QueryRequest, QueryContext, Spring Data Commons Pageable, and Sort values in declaration order, normalize exact non-null Spring Page<T> returns, and emit explicit paging/sorting capability flags. Command handlers resolve exact JPA/Mongo read-model parameters through ownership arbitration and captured tenant context; owned absence maps to Kotlin null, Java Optional.empty(), or deterministic dependencyUnavailable validation for required parameters without changing ordinary-service and resolver exception behavior.
Cross-store transactions	Not planned	Chronicle, JPA, and MongoDB scopes cannot form one distributed atomic transaction; applications must design for partial completion and compensation.
Paired command/query HTTP conformance	Partial	Explicit :ContractTests:httpConformanceTest runs nine common cases against three real processes: a newly authored ASP.NET task board from published Arc 22.14.0 (SDK 10.0.400, runtime 10.0.11, locked package/archive checks), plus the existing generated Kotlin and ordinary-Java Spring task boards. ContractTests/HttpConformance/contract.py asserts two distinct create IDs and typed responses, GET/QUERY identifier binding, complete enumerable snapshots, validate-route nonexecution, completion response/state, malformed-command 400 validation without mutation/parser details, and 404 status. Success flags/correlation UUIDs and QUERY cache policy are checked. Raw bodies are retained, not rewritten. The gate is opt-in, database-free, loopback-only, bounded and outside ordinary build/check. Harness tests cover mutation detection and process cleanup. This does not prove equivalent validation rules, authentication/authorization rejection, null/default handling, temporal precision, paging requests, streaming, persistence or aggregate lifecycle. Paging counts and framework 404 bodies demonstrably differ and remain outside shared equality assertions; overall parity is still Partial.
Full Arc .NET parity	Partial	The semantically normalized .NET-derived proxy fixture covers selected generated shapes, but neither that fixture nor the project claims exact raw-output compatibility or every Arc .NET feature, analyzer, persistence seam, or hosting model.

Ordered P0 parity backlog

1. Calendar and UUID proxy fidelity — complete. LocalDate/LocalTime/UUID now use DateOnly/TimeOnly/Guid, with scalar command and GET transport, generated-model hydration, strict import contracts, and timezone-separated runtime coverage.
2. Tenant-safe Spring Data command read models — implemented. Generated Kotlin/Java handlers resolve exact mapped read models through JPA DECLARED and MongoDB FALLBACK ownership. Tenant routing is certified and fail-closed; compatibility adapters remain fixed-store only.
3. Nested Chronicle transaction ownership — complete. Nested structured executions share one explicit root staging area with no savepoints; ignored child failure/cancellation makes the root rollback-only, late joins fail, and the root emits one ordered appendMany only after local scopes succeed.

The completed ownership slices do not create a distributed transaction. Imperative JPA and MongoDB scopes remain thread-bound opt-ins. MongoDB may commit before JPA fails, and both local stores may commit before Chronicle fails or has an indeterminate external outcome. Applications must continue to design for reconciliation, idempotency, and compensation.

Remaining temporal client limits

Raw 08:09:10.1235567 hydrates through the pinned TimeOnly as 08:09:10.123; because rounding would yield .124, the runtime contract proves truncation rather than rounding. Arc accepts and emits LocalTime values with up to seven fractional digits for 100 ns compatibility. Deserialization rejects eight or nine fractional digits, and serialization rejects values finer than 100 ns rather than rounding or truncating them. This server binding is distinct from the shared @cratis/arc generated-client limitation: explicit RFC QUERY bodies pass DateOnly or TimeOnly component objects to native JSON.stringify because those classes have no toJSON(). Prefer GET until upstream serialization uses the typed serializer or toJSON(). Guid is unaffected because it has toJSON(), and the JVM server continues to require scalar date/time strings.

JavaScript Date also cannot preserve every remaining JVM temporal distinction: mapping LocalDateTime invents a zone, while mapping OffsetDateTime or ZonedDateTime loses original offset or zone identity.

Server-side temporal precision

LocalTime is the only temporal type Arc guards at the 100 ns boundary .NET counts in. Every other type goes through JavaTimeModule as ISO-8601 text and keeps whatever the JVM holds, which for the date-time types and Duration is a full nanosecond — finer than a .NET tick can carry. The table states what the Kotlin mapper does; each row is demonstrated by a test.

JVM type	Arc wire value	Precision the JVM server keeps	Precision the .NET counterpart supports
LocalTime	HH:mm:ss with up to seven fractional digits	Exactly 100 ns. A finer value is refused on write, and eight or nine fractional digits are refused on read.	TimeOnly writes the round-trip format, which is seven fractional digits, or 100 ns ticks.
LocalDate	yyyy-MM-dd	No sub-day component exists to lose.	DateOnly writes the same round-trip date.
Instant, ZonedDateTime, LocalDateTime	ISO-8601 text	Full nanoseconds, so nine fractional digits survive a round trip.	DateTime and DateTimeOffset have no Arc converter and use the System.Text.Json default, which round-trips at most seven.
OffsetDateTime	ISO-8601 text with an offset	Full nanoseconds are written and read, but a read normalizes the value to UTC, so the original offset does not survive even though the instant does.	Same seven-digit ceiling.
Duration	ISO-8601 text	Full nanoseconds.	TimeSpan has no Arc converter and uses the System.Text.Json default, which is 100 ns ticks.
UUID	Lowercase dashed text	Exact. A read accepts upper case and normalizes it.	Guid has no Arc converter and uses the System.Text.Json default dashed form.

A JVM value with more than seven fractional digits is therefore representable on the Arc wire for every type except LocalTime, and a .NET peer reading it cannot hold the extra precision. Arc does not detect or reject that today outside LocalTime. Applications that must interoperate at exact precision should keep date-time values at or coarser than 100 ns themselves, or model the value as a LocalTime where the guard already exists.