---
title: Arc.Go parity
editUrl: https://github.com/Cratis/Arc.Go/edit/main/Documentation/parity.md
description: Versioned feature-by-feature compatibility with the pinned C# Arc contract.
lastUpdated: 2026-10-06T00:00:00.000Z
---


<!-- Copyright (c) Cratis. All rights reserved. -->
<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->

## Baseline v1

Arc.Go implements foundation contracts, backend pipelines and running snapshot
HTTP hosting with identity, protected discovery, observable SSE/WebSocket
transports and explicit graceful lifecycle. Ledger and
fixture format version: **1**. Descriptor format: `metadata.Version == 1`.
Work is tracked in [foundation issue 3](https://github.com/Cratis/Arc.Go/issues/3).

| Profile | Reference | Coverage |
| --- | --- | --- |
| Current C# authority | Arc commit `7c1e78075b737df64f69fddfaae83374f75e3612` | Source-derived foundation fixtures, behavioral tests and the bounded paired snapshot HTTP checkpoint below |
| Historical Kotlin comparison | C# Arc 22.14.0; Kotlin commit `23c93a3f70008f20d99c28868010b08e3123ea97` | Task-board assertions consulted; paired HTTP suite not run |
| Historical TypeScript comparison | C# Arc 22.45.0; TypeScript commit `cbb421aa1fb6e5f65deec746911ee3046dfb1af6` | Full-envelope expectations consulted; paired HTTP suite not run |

C# paths in the ledger are relative to `Source/DotNET/Arc.Core/` at the authority
revision above. Scalar naming/converter sources additionally pin Fundamentals
`d2accc4a79b6bcf2708213c97093ab5ba6c06381`.
[Fixture provenance](https://github.com/Cratis/Arc.Go/blob/main/ContractTests/fixtures/v1/README.md) identifies exact files,
versions and normalization. Those foundation fixtures are not live .NET captures;
the separate HTTP checkpoint below executes both hosts.

## Paired snapshot HTTP checkpoint

[Issue 38](https://github.com/Cratis/Arc.Go/issues/38) remains **Partial**.
`ContractTests/httpconformance` compares real Go and generated C# GET/QUERY
endpoints at the authority revision above, using SDK `10.0.401`, runtime
`10.0.12`, seven locked projects and exact Git-derived source membership.
`TestReferenceActivation` requires all four fixture performers and eight routes;
`TestPairedSnapshotHTTP` executes 36 requests across 14 fixed groups.

The recorded pair has **34 strict matches and two exact allowances**. Coverage
includes scalar/default binding, missing/empty/null inputs, count-before-window
sorting and paging, empty/out-of-range selections, malformed controls and failed
performers. Status, relevant headers, correlation, full envelopes, array order
and missing-versus-null values are compared. Only object order and JSON whitespace
are normalized; raw exchanges and differences remain separate from allowances.

Both allowances are limited to successful `plain-paging-control/page/GET` and
`plain-paging-control/page/QUERY`: only `$.paging.page` (C# 1, Go 0) and
`$.paging.size` (C# 2, Go 0) differ. Totals remain zero and all four rows remain
in the same order. Ordinary Go lists stay unpaged; use an explicit renderer for
paging rather than relying on request metadata being echoed. These allowances
never apply to failures or other requests.

The checkpoint corrects query failure envelopes: malformed QUERY integer input
retains its actual decoder cause without adding synthetic diagnostic causes;
invalid direction text reports the reference message; paging findings use
`Page`/`Size` members. `TestQueryReaderParityFailureEnvelopes` separately verifies
Go-side rejection before performer, renderer and business-factory activation,
including denial. That native denial test is not paired authentication evidence.

See the [corpus, exact allowances and run instructions](https://github.com/Cratis/Arc.Go/blob/main/ContractTests/httpconformance/README.md).
Preparation and native tests reject changed or incomplete provenance; the dedicated
workflow retains bounded captures and source/provenance manifests, not source
caches or binaries. Commands, authentication, HEAD, CSV, renderer failures,
provider databases, streams and browser clients remain outside this paired profile.
It does not establish the full CI matrix or whole-product parity.

## TypeScript proxy implementation boundaries

Work is tracked by [Arc.Go issue 20](https://github.com/Cratis/Arc.Go/issues/20).
The frontend authority is `Source/DotNET/Tools/ProxyGenerator` and
`Source/JavaScript` at `7c1e78075b737df64f69fddfaae83374f75e3612`
(Arc npm/NuGet `22.48.2`, Fundamentals npm `7.22.0`).

- **Approved deviation**: sorting helpers use declared sortable result
  (read-model) wire fields, not query arguments, per
  [Arc issue 2998](https://github.com/Cratis/Arc/issues/2998). Captured C# evidence
  must retain its argument-based helpers unchanged.
- **Scope**: portable validation-rule descriptors and declared derived-wire-model
  support are prerequisites, not optional reductions to a Go-only frontend API.
- **Portable rule foundation**: `validation.RuleDescriptor`, `ParseRules` and
  `NewPortable[T]` share explicit field-tag rules with the compiler without running
  application validators. UTF-16 length and JavaScript whitespace are used;
  unsupported rules, nonportable regex, unsafe numbers and dynamic severity fail
  explicitly. `validation/portable_test.go` characterizes the bounded foundation.
  Register the compiled validator explicitly for manual registrations; a `rules`
  tag alone does not activate runtime validation. TypeScript-enabled generated
  adapters register `NewPortable` for the supported command rules. The independent
  Go/locked-JavaScript rule corpus and production server rejection provide bounded
  paired evidence; query validation and other rule forms remain unsupported.
- **Declared derivatives**: `serialization.RegisterDerivedTypes` supplies a
  concurrency-safe process-wide discriminator contract for named interface bases
  and assignable concrete structs/pointers. Exact repetitions are idempotent;
  conflicts, reserved fields, custom codecs, absent/unknown discriminators and
  undeclared implementations fail. `serialization/derived_test.go` covers round
  trips and failure atomicity. An explicit default concrete model preserves
  ordinary base payloads without a discriminator; unknown IDs never fall back to
  that default. Go embedding alone does not declare inheritance.
- **Shared field selection**: reflection and compiler adapters use
  `internal/modelshape.Select`, keeping wire visibility and dominance in one kernel.
  The existing reflection corpus remains executable; compiler corpus parity is
  covered by `TestCompilerAndReflectAdaptersUseTheSameFieldCorpus`.
- **Descriptor graph and wire analysis**: tools coordinate the whole selected
  catalog before resolving routes and preserve adapter-only generation. The
  serialization-ready graph separates client fields, responses, cardinality,
  defaults, roles, HTTP preference and output selection from compiler attachments.
  `tools/internal/artifacts/graph_test.go` covers rich shared scalars, constants,
  argument presence, pages, result-field sorting declarations and conservative
  rejection boundaries. The actual CLI now emits supported model, command,
  snapshot-query, and declared observable-query families together with Go adapters. Rich dictionaries, non-string
  keys, and unsupported import/codec mappings fail rather than becoming an
  unhydrated or `any` surface. Precision warnings are deterministic.
- **Shared concept compiler analysis**: tools pin released Fundamentals.Go
  `v0.2.0` (including the classifier delivered at
  `24d60f07b6090f195cd07b9f1045fb540ff49fd7`) and use
  `concepts/conceptstypes.Underlying`, switching only on shared `ScalarKind` values.
  Valid concepts map to scalar constructors rather than wrappers; invalid
  declarations retain shared `ErrInvalidConcept`, `TypeError` and reason values.
  `TestConceptProjectionUsesTheSharedDeclarationCorpus` loads the pinned shared
  declaration corpus, including aliases, pointer layers and conservative failures.
  This replaces the former rejection-only seam from
  [Fundamentals.Go issue 15](https://github.com/Cratis/Fundamentals.Go/issues/15).
  Enum member names use the shared acronym-friendly `naming.CamelCase`; field
  selection still uses Arc's authoritative shared kernel, not preservation of all
  Go field spelling. The root runtime remains on Fundamentals.Go `v0.1.0`.
  Emitted proxies have strict locked-TypeScript and Node runtime evidence;
  the generated observable hooks have the bounded mounted evidence below, not
  browser or complete React parity.
- **Pinned reference baseline**: `ContractTests/ProxyComparison` retains historical
  `22.45.0` captures and fresh `22.48.2` executable captures, locked NuGet/npm
  dependencies, strict untouched-proxy compilation and real-runtime
  characterization tests. Captures remain untouched reference evidence. Separate
  Go-generated Models/Commands/Queries fixtures and the actual CLI Publication
  fixture provide emitted-proxy evidence. Mounted generated observable hooks have
  their separate bounded lane below; command/snapshot hooks and paired .NET
  execution of these generated proxies remain unverified.
- **Adapter defaults**: narrow command/model name and namespace options preserve
  the actual composition namespace without the removed `Builder.CommandNamespace`
  accessor. `TestGeneratedRegistrationOptionsPreserveNamespaceDefaults` covers
  the supported runtime options. The independent tools consumer regression
  `TestNamespaceLessAdaptersUseSupportedRegistrationDefaults` covers both global
  and configured composition namespaces, renamed artifacts and excluded queries;
  existing stale-output bootstrap coverage remains executable.
- **Profile agreement**: `Builder.ExpectGeneratedEndpoints` checks owned endpoints
  against the final complete catalog at Build, including manual artifacts and
  `/validate`. `generated_contract_test.go` covers copied inputs, overlap rejection,
  namespace/path drift, additional manual commands changing conventional routes,
  and terminal frozen registration. TypeScript-enabled adapters now emit these
  expectations and a fingerprint; the production CLI consumer accepts the agreed
  profile and rejects mismatched routes without a new root API.
- **Published families (Partial)**: `emit_typescript_models_test.go`,
  `emit_typescript_commands_test.go`, and `emit_typescript_queries_test.go` cover
  deterministic model/scalar/concept/enum, command, snapshot, and barrel plans;
  `emit_typescript_observable_test.go` and `observable_publication_test.go` add
  declared observable emissions, hook tuples, mixed publication, and source
  identity rejection without any output mutation.
  Strict real declarations and Node fixtures exercise rich hydration, portable
  command rules, signatures, defaults, and complete envelopes. The actual CLI
  `Publication/runtime.test.mjs` executes generated adapters over loopback HTTP,
  including command validation/execution, GET/QUERY snapshots, and independent
  server rejection. Nullable-element/default-grammar regressions and the pinned
  regex-key rejection (`Arc#3014`) remain explicit boundaries. Enumerable command
  response annotations retain the pinned C# element generic; runtime arrays and
  pinned null-write/numeric/temporal limits are characterized, not repaired.
- **Mixed publication (Go-specific)**: `output_test.go` and
  `production_cli_test.go` prove manifest owner/scope/hash checks, zero-write check
  mode, complete physical-path preflight, stale ownership, and interrupted
  write/rename/delete/manifest recovery. Empty files differ from absent files;
  no unmanifested file is automatically adopted, even with identical marked
  bytes. Publication is per-file atomic in a trusted single-writer workspace,
  not a durable cross-root transaction or ownership migration.
- **Generated observables (Partial)**: tools pin pushed Arc `78ebbf8` and released
  Fundamentals.Go `v0.2.0`. Exact Source/CurrentSource/State/Subject declarations
  unwrap owning-model emissions, including value Page/ObservedCollection, without
  generated workers or eager activation. Independent generated Go consumers prove
  admission/laziness, snapshots, failures, cancellation, and join-before-disposal.
  Observable collection proxies require one selected direct nonnullable ID/Id
  serialized as `id`, or no identity at all (C# JSON fallback); competing
  conventional members, including hidden/embedded ones, and a serialized `id`
  without ID/Id fail before publication. No arbitrary identity/provider inference.
  `ContractTests/observables/frontend/generated.test.mjs` executes actual CLI
  output with default WebSocket hub/Delta, shared socket, date/model hydration,
  exact envelopes/callback counts, argument replacement, independent cancellation,
  terminal Unauthorized, and cumulative joined-source/host counters. Its final
  collection is an independent test consumer, not React.
- **Mounted generated observables (Partial)**: `frontend/react.test.mjs` under
  `ContractTests/observables` executes actual generated `use`, `useChangeStream`
  and `useWithPaging` with Arc.React `22.48.2`, React and react-test-renderer
  `18.3.1`. Real providers explicitly select WebSocket hub/Delta, not the complete
  `<Arc>` wrapper's default SSE. Shared cache listeners reconstruct rich collections
  and hydrate change sets from real deltas; raw frames are asserted separately.
  Equal arguments do not reopen; alpha-to-beta replacement preserves the pinned
  cross-baseline change-stream diff. Zero-retention unmount awaits source closure
  and resource disposal before fallback cleanup. Default retention proves reuse
  followed by explicit disposal, not 30-second expiry. The separate paged mount
  proves tuple/request shape, reconstruction and replacement, not server-side
  windowing or totals. Same-key paging/sorting setter retention reproduces open
  [Arc issue 2869](https://github.com/Cratis/Arc/issues/2869), without compensating
  cache eviction or a Go server change. Joined socket/host cleanup is bounded.
- **Remaining frontend gaps**: proxy-only generation, query validation beyond the bounded
  snapshot-query string rules (see the generated snapshot-query validation row),
  unsupported model/rule/default/provider forms, custom import,
  interface/grouping/library modes, OpenAPI publication, browser hosts beyond the bounded
  Chromium coverage in the Real-browser observable conformance row, broader mounted-hook
  families, and full paired .NET parity. Opaque MongoDB `Source[Find]` generation requires
  explicit emission metadata; manual runtime support does not imply generation.
  The Node manual lane covers a wider transport matrix than the generated default
  case. The separate mounted lane adds named hook/cache reconstruction cases, not
  browser credentials/origins, DOM/StrictMode, suspense, network-failure reconnect,
  or every C# rich nullable/provider layout. The Real-browser observable conformance
  row adds Chromium cookie ownership, DOM/StrictMode and first-back-off reconnect;
  other browsers, cross-origin credentials and longer outages remain unverified. The pinned null-write issue remains
  [Fundamentals#1148](https://github.com/Cratis/Fundamentals/issues/1148).

## Status vocabulary

- **Implemented**: the named, bounded contract has executable regression evidence.
- **Partial**: the stated subset works; identified gaps remain.
- **Not implemented**: no working Go surface, even if the contract is understood.
- **Go-specific**: deliberate construction or behavior differences, described below.

## Feature ledger

| Feature | C# source | Go surface | Status | Behavioral/wire evidence and remaining scope |
| --- | --- | --- | --- | --- |
| Explicit artifact descriptors v1 | `Commands/ICommandHandler.cs`, `Queries/IQueryPerformer.cs` | `metadata.Catalog`, `Command`, `Query`, `TypeName` | Go-specific | `metadata/routes_test.go`; logical identities do not depend on Go package names. Handler/type-schema graphs await their owning slices; optional authorization metadata extends format 1, with keyed literals required for v0 struct compatibility |
| Stable query identity | `Queries/ModelBound/ModelBoundQueryPerformer.cs` | `Query.Identity` | Implemented | `TestQueryIdentityAndPathPrecedence`; includes model name independently of route |
| Literal route resolution | `Http/EndpointRouteHelper.cs`, `StringExtensions.cs`, endpoint mappers | `metadata.Resolve`, `DefaultOptions` | Implemented | `TestConventionalRoutes`, `TestNamespaceConflictsRestoreNames`; API prefix, skips, acronym/underscore casing, name fallback and GET/QUERY/POST/validate |
| Explicit path precedence | `Commands/CommandRoute.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs` | `Command.Path`, `Query.Path`, `ReadModelPath` | Implemented | `TestQueryIdentityAndPathPrecedence`, `TestDerivedCommandPathsAreValidated`; exact casing and query trailing slash; command paths must also yield a valid `/validate` path; empty method override disables model override |
| Collision/configuration diagnosis | `Queries/QueryEndpointMapper.cs` | `CollisionError`, `Resolve` | Go-specific | `TestCollisionsAreDeterministicAndInspectable`, `TestInvalidMetadataFailsExplicitly`; no first-performer-wins behavior |
| UUID wire value | Guid and concept converter | `concepts.UUID`, alias of `github.com/cratis/fundamentals.go/concepts.UUID` at `v0.0.0-20261002203106-9d83ef2578a5` | Partial | `ContractTests/scalars_test.go`, `concepts/scalars_test.go`, `concepts/aliases_test.go`; unchanged golden bytes, RFC order and shared-type identity/round trips; dashed input only, not every Guid.Parse spelling |
| Calendar/duration output | Fundamentals DateOnly/TimeOnly converters; System.Text.Json TimeSpan | `DateOnly`, `TimeOnly`, `TimeSpan`, aliases provided by `github.com/cratis/fundamentals.go/concepts` at `v0.0.0-20261002203106-9d83ef2578a5` | Implemented | `ContractTests/scalars_test.go`, `concepts/scalars_test.go`, `concepts/aliases_test.go`; unchanged canonical strings, zero values, full signed tick range and shared-type identity/round trips |
| Calendar input | Same converters | `ParseDateOnly`, `ParseTimeOnly`, `ParseTimeSpan`, forwarding to `github.com/cratis/fundamentals.go/concepts` at `v0.0.0-20261002203106-9d83ef2578a5` | Partial | Boundary and failure-atomicity tests; invariant input only, no culture-dependent parsing or DateOnly timestamp coercion |
| DateTime/DateTimeOffset | `JsonSerializerOptionsConfiguration.cs` (default System.Text.Json timestamp codecs) | `time.Time` through `serialization.Marshal`, `Unmarshal` | Partial | `TestTimestampWirePolicy` pins RFC3339Nano output: UTC `Z`, up to nine fractional digits, explicit offsets. C# DateTimeOffset emits `+00:00` for UTC and at most seven digits; DateTime suffix depends on kind. Not all C# timestamp input forms are accepted; no DateTimeOffset-specific codec |
| `ConceptAs<T>` → `Concept[T]` recognition | Fundamentals `Concepts/ConceptAs.cs`, `Json/ConceptAsJsonConverter.cs` at `d2accc4`; Arc `JsonSerializerOptionsConfiguration.cs` at `7c1e780` | `concepts.Concept[T]` alias; `serialization.ValidateType`, cached shared `Underlying` metadata | Partial | `ContractTests/concepts_test.go`: UUID forwarding, string/int, pointers, slices/map values, inspectable marker-only/nested rejection before encoding/binding, metadata-only concurrent plans, encoded fields checked with `CheckJSON`. Codecs remain application-owned; bounded GET/QUERY text binding is available through typed argument models; decimal/enum concepts and generated schema/proxy recognition remain incomplete |
| Model naming/nulls/numbers | `JsonSerializerOptionsConfiguration.cs` | `serialization.Marshal`, `Unmarshal` | Partial | `serialization/serialization_test.go`, `codec_regression_test.go`; acronym-preserving naming, exact case-sensitive binding, tags, null omission, numeric enums, nonfinite floats, JSON/text codecs, embedded-field promotion and standard Go omission tags. Complex dictionary keys, polymorphism and descriptor-generated codecs await later slices |
| Int32 enum JSON profile | Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`); Fundamentals `Json/EnumConverter.cs` (`14037b1`, package 7.19.6 consumed by Arc 22.48.2) | Opt-in `serialization.NewInt32Enum`, `Int32Enum.ParseJSON`, `ErrInvalidEnumValue`; generator-owned `//arc:enum parse=int32` declarations | Implemented | `serialization/enum_test.go`, `ExampleInt32Enum`; `ContractTests/EnumContract` compares 65 Int32 reads and 8 writes with captured C# output and hydrates the numeric results through TypeScript Fundamentals 7.22.0. Declared-only numeric input, case-insensitive original names, comma-separated names combined by OR even without Flags, any-Int32 decimal strings, an open output domain and scalar-null rejection are pinned parity; ASCII and case-unique declaration admission is a Go restriction. Opt-in `//arc:enum parse=int32` emits a parser declaration and failure-atomic `UnmarshalJSON`; `TestEnumGeneratedConsumerAndStableTypeScript` runs all 65 State/Access reads and 8 writes through generated parsers and ordinary Arc serialization, checks enum-only output and imported generated codec admission, and checks unchanged TS output. `TestEnumOnlyParserOptOutRemovesOwnedAdapter` pins owned cleanup; `TestEnumOnlyParserDoesNotEmitRegistrationSurface` compiles application-owned registration names without root runtime imports; `TestImportedEnumParserRejectsStaleMembersBeforePublication` refuses drifted imported parse maps when generating/checking TypeScript proxies; `TestImportedEnumParserGoOnlyCheckRequiresSelectingEnumPackage` pins Go-only checking through the enum package or `./...`, not its root-only consumer; `TestImportedEnumDoesNotAdmitHandWrittenCodec` rejects opaque imported application codecs. `TestEnumParserOpenAPICommandInputRefusesLocalAndImportedProfiles` pins parser behavior and explicit whole-document OpenAPI refusal for local/imported command inputs; directional OpenAPI schemas for this parser are not implemented. `TestEnumGeneratorRejectsInvalidDeclarationsBeforePublication` covers backing width, missing/case-colliding/non-ASCII names and conflicting hand-written codecs. The status covers only the pinned Int32 family; other backing widths, query-string binding and later Fundamentals flags behavior are unsupported. See [Int32 enums](/arc/go/backend/go/concepts/enums/) ([#32](https://github.com/Cratis/Arc.Go/issues/32)) |
| Complex-key dictionary codec | Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals dictionary converters | No generated codec | Not implemented | Generator rejects `arc:codec` with an explicit unsupported-family diagnostic; arbitrary complex-key dictionaries require an application-owned wire representation. `TestEnumGeneratorRejectsInvalidDeclarationsBeforePublication` verifies no output on an unsupported codec directive. Ordinary supported string-key maps are unchanged ([#32](https://github.com/Cratis/Arc.Go/issues/32)) |
| Geospatial codec | Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals geospatial converters | No generated codec | Not implemented | `arc:codec` reports this unsupported family before output; no automatic C# coordinate representation is inferred. Supply an explicit application codec and wire mapping instead ([#32](https://github.com/Cratis/Arc.Go/issues/32)) |
| Type/Uri codec | Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals Type/Uri converters | No generated codec | Not implemented | `arc:codec` reports this unsupported family before output; Go reflection types and URLs do not establish the CLR wire contract. Use an explicit wire value and mapping ([#32](https://github.com/Cratis/Arc.Go/issues/32)) |
| Enumerable model-to-concept codec | Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals enumerable/concept converters | No generated codec | Not implemented | `arc:codec` reports this unsupported family before output; ordinary slices and scalar concept forwarding are unchanged, not evidence for enumerable model-to-concept conversion ([#32](https://github.com/Cratis/Arc.Go/issues/32)) |
| Input presence and duplicates | `ArcOptions.cs`, `JsonSerializerOptionsConfiguration.cs`, command and query request readers | `serialization.Optional[T]`, `Some`, `Null` | Go-specific | `TestExactWireNames`, `TestNullStringPolicyAndOptionalOutput`, presence and atomic-binding tests; unknown properties including case variants ignored, exact duplicate declared names rejected. Present-null Optionals emit null; plain Go strings reject null unlike C# strings. GET/QUERY binding is covered separately below |
| Framework recursion safety | `JsonSerializerOptionsConfiguration.cs` (System.Text.Json traversal) | Model and envelope encoders | Go-specific | `TestFrameworkCyclesAndNestingUseSharedBudget`; one 64-level budget across validation State, command responses, query data/findings/change sets and Optional values. Application custom codecs own their recursion safety |
| Command result envelope/flags | `Commands/CommandResult.cs` | `commands.Result[R]`, `Details`, `Success`, `WithResponse` | Implemented | Nine command goldens plus exhaustive status/response-presence tests; pipeline exception conversion/redaction is covered separately below |
| Failed scalar response omission | `CommandResult<T>.ClearResponse` | `commands.NewResult` | Go-specific | `TestStatusPrecedenceAndFailedResponseOmission`; removes failed zero-valued responses rather than emitting C# default(T) |
| Query result envelope/flags | `Queries/QueryResult.cs` | `queries.Result[T]`, `Details`, `Success`, `NotReady` | Implemented | Eight query goldens, readiness and precedence tests; ready null is not pending |
| Paging response metadata | `Queries/PagingInfo.cs` | `queries.PagingInfo` | Partial | `TestPagingInfo` and page golden cover in-range semantics; out-of-range page counts return MinInt32 deterministically, without a runtime-specific C# overflow claim. request readers, active paging validation and opt-in rendering are covered below |
| Change-set envelope | `Queries/ChangeSet.cs` | `queries.ChangeSet` | Implemented | Delta golden, independent array copies and item encoding failures; diff and delivered transfer evidence have separate rows below |
| Validation findings | `Validation/ValidationResult*.cs` | `validation.Result`, `Severity`, `Reason` | Implemented | Four standalone goldens plus findings in results; open reasons, nil state omission and required members array |
| Standard status precedence | `Http/EndpointRouteHelper.cs` | Result `StatusCode` methods | Implemented | All constructed flag combinations; hosting tests add ingress 401, QUERY reader 400 and observable first-result wait 408 |
| Command/query shared lifecycle | `Commands/CommandPipeline.cs`, `Queries/QueryPipeline.cs` | `commands.Pipeline`, `queries.Pipeline` | Implemented | `ContractTests/pipelines_test.go`, `pipeline_failures_test.go`, `model_bound_test.go`; combined evaluator, query-from-command resource reuse, security continuity, correlation, distinct receipts, lazy dependencies, cleanup suppression and unchanged existing goldens. Backend execution only; no HTTP claim |
| Principal/context | `Authorization/CurrentPrincipalAccessor.cs` (`7c1e780`) | `identity.Principal`, `WithPrincipal`, `PrincipalFrom` | Go-specific | `identity/TestPrincipalSnapshot`, `TestPrincipalContexts`; immutable explicit contexts replace ambient accessors, preserving explicit anonymous shadowing; no authentication or authorization |
| System actor | `Authorization/SystemPrincipal.cs` (`7c1e780`) | `identity.System` | Implemented | `identity/TestSystemRoles`; C# subject/name/role claims, supplied roles only, no privileged bypass |
| Tenant context | `Tenancy/TenantIdAccessor.cs` (`7c1e780`) | `tenancy.WithTenant`, `TenantFrom` | Go-specific | `tenancy/TestTenantContexts`; nested/concurrent explicit contexts replace disposable ambient overrides; NotSet shadows parents |
| Tenant sentinel semantics | `Tenancy/TenantId.cs` (`7c1e780`) | `tenancy.ID`, `ParseID`, `Default` | Partial | `tenancy/TestTenantSentinelsAndCodecs`, `FuzzTenantText`, `FuzzTenantJSON`; zero internally represents `[NotSet]`, named Default remains distinct; Go maps `""` to NotSet whereas C# keeps `""` as a distinct tenant. Go also rejects controls, invalid UTF-8 and surrounding whitespace and accepts JSON strings only |
| Correlation | `Execution/CorrelationIdResolver.cs` (`7c1e780`) | `correlation.ID`, `Parse`, `Normalize`, `Resolve`; `WithID`/`FromContext` delegate to Fundamentals.Go at `66acfed` | Partial | `correlation/TestCorrelationParsingAndReplacement`, `TestCorrelationContextPrecedence`, `FuzzCorrelationParse`, `TestSharedCorrelationContext`, `TestSharedCorrelationNilContextPanics`; UUID alias, bidirectional shared context, read-only access, zero shadowing, cancellation and nil-context semantics unchanged; dashed input subset, no other Guid spellings |
| Receipt metadata | `OperationContextScope.cs` (`7c1e780`) | `execution.WithReceivedAt`, `ReceivedAt`, `Capture`, `NewContext` | Go-specific | `execution/TestReceiptNormalizationAndOverrides`, `TestExplicitMetadata`; UTC value contexts replace ambient leases; pipeline receipts/correlation are covered by `ContractTests/TestCommandQuerySharedScopeCompositionEquivalence`; HTTP forwarding is covered by `TestHTTPReceiptPrecedesAuthenticationAndNestedReceiptIsFresh` |
| Fundamentals DI/scopes | `HostBuilderExtensions.cs` (`7c1e780`) | Fundamentals.Go `dependencyinjection` and optional `container` at `0fd6b51`; `execution.ResourcesFrom`, `Resolve`, `ContextGuard` | Go-specific | `execution/background_test.go`, `dependencies_test.go`: lazy exact-key resolution, fresh scopes, security guards including factory-internal resolution, joined errors and synchronous cleanup. Arc's guarded resolver passes Fundamentals `ditest.RunResolver`; no root resolve or implicit command completion. Container lifetimes/graph implementation is Fundamentals-owned, not duplicated in Arc |
| Startup graph checks | `ArcApplicationBuilder.cs` (`7c1e780`) | Fundamentals.Go `dependencyinjection/container.Registry.Build` at `0fd6b51` | Go-specific | Optional declared-edge validation without activation belongs to Fundamentals (its `container` tests and `ditest.RunDeclaredGraph`). Arc does not import the container at runtime or reproduce its test suite; hidden closure captures cannot be checked |
| Typed invocation/failure | `Validation/ValidatorInvoker.cs`, `IValidationFailure.cs` (`7c1e780`) | `validation.Validator[T]`, `Invoke`, `Failure`, `Reject` | Partial | `validation/TestInvokeCopiesAndPreservesRejection`, `TestInvokeRedactsAndPreservesCancellation`; synchronous typed callbacks, wrapped rejection preservation, redacted infrastructure failures and cancellation; no FluentValidation discovery, declarative rule IR or generator projection; bounded graph support is recorded below |
| Command severity policy | `Commands/CommandValidationResults.cs` (`7c1e780`) | `validation.Policy`, `NewPolicy`, `Filter` | Implemented | `validation/TestSeverityMatrix`; default Error-only, strict allowances, inclusive floors, Unknown blocking with floors; unsupported Go numeric findings conservatively block |
| Header allowance | `Commands/CommandEndpointMapper.cs` (`7c1e780`) | `validation.AllowedFromHeader` | Go-specific | `validation/TestAllowedHeader`, `FuzzAllowedFromHeader`; one supported signed decimal int32 only; untrusted Error capped at Warning, unsupported enum bypass closed; caller must use default policy for ignored input; HTTP forwarding is covered by `TestAllowedSeverityHeaderFiltering` |
| Authentication chain | `Authentication/Authentication.cs`, `AuthenticationResult.cs` (`7c1e780`) | `authentication.Chain`, `Handler`, `HostPrincipal` | Implemented | `authentication/TestTerminalOrderAndCopies`, `TestInvalidAndCancellation`, `TestTrustedHostAndConcurrentContexts`; terminal success/failure and no rescue, copied handlers and trusted typed host identity only; authenticated result requires an authenticated principal, unlike C#'s nonnull-only result check; `TestAuthenticationClonesRequestContextHeadersAndURL` pins caller-isolated context/headers/URL; Body is shared and handlers must not read it; no auto credential/header/cookie adapter |
| Authentication ingress | `Http/AuthenticationMiddleware.cs` (`7c1e780`) | Application ingress | Go-specific | `TestTerminalCredentialsAndCorrelation`, `TestAnonymousAuthorizationDenialIs403AndCredentialFailureIs401`; explicit credential failure 401 including public operations, anonymous exhaustion proceeds to authorization, ordinary denial 403; differs from C# blanket credential requirement and anonymous failure exemption |
| Declaration compilation | `Authorization/AuthorizationDeclarations.cs` (`7c1e780`) | `metadata.Authorization`, `authorization.Registry.Build` | Partial | `metadata/TestAuthorizationDescriptorRoundTripAndRoutes`, `authorization/TestBuildValidationAndFreeze`, `TestPrecedenceAndFallback`, `TestRolesAndPolicyOrdering`; all levels validated, method replacement, role OR/requirement AND and copied graph; frozen explicit fallback replaces dynamic discovery; `TestReadModelDeclarationsMustAgree` rejects conflicting declarations across queries of one read model (including nil vs explicit); named schemes rejected |
| Native policies | `Authorization/ArcAuthorizationPolicyRuntime.cs` (`7c1e780`) | Direct `Registry.Register`, `PolicyFunc` | Partial | `authorization/TestGuestConjunction`, `TestPolicyFailureCancellationAndConcurrency`; guest opt-in requires policy-only conjunction, errors fail closed; borrowed concurrently-callable values/closures are primary. `RegisterPolicy[P]` now accepts lazy operation-scoped factories (see below); policy factories may call execution.Resolve with a DI-backed scope. optional exact dependency manifests are checked by pipeline Build without activation; direct authorization Build remains provider-independent |
| Staged evaluation | `Authorization/AuthorizationEvaluation.cs` (`7c1e780`) | `Evaluator.Prepare`, `Prepared.Evaluate(ctx, resource)`, `Check` | Partial | `authorization/TestPreparedSecurityAndZero`, `TestRecheckAfterPolicyCallback`, `TestPolicyPanicRemainsBoundaryOwned`; principal/tenant continuity, no policy invocation at Prepare or after role denial, cancellation and fresh concurrent tenant evaluations. `TestGuestPolicyReceivesEmptyPrincipalAndRetainsCallerContinuity`, `TestGuestIdentityChangeDuringPolicyInvalidatesVerdict` pin empty anonymous policy input with original-caller continuity; `TestUnknownRuntimeTargetIsRedactedAndNotConfiguration` pins non-disclosing runtime lookup errors distinct from configuration errors. Container-neutral: `EvaluateScoped` guards operation-scope lifetime/security; borrowed DI scopes can be checked with execution.Scope.CheckOwner; pipeline enforcement is covered by the command/query rows below |
| Tenant selectors/membership | `Tenancy/SubdomainTenantIdResolver.cs`, `TenantHost.cs`, Header/Query/Claim/Fixed resolvers (`7c1e780`) | `tenancy.NewResolver`, `ResolverFunc`, `Membership`, `Require` | Partial | `tenancy/TestSelectorDefaultsAndInputs`, `TestSubdomainHostMatrix`, `TestInvalidOptionsAndMembershipSeparation`, `FuzzResolveHost`; ASCII/punycode only, Unicode explicitly rejected rather than IDNA-normalized; ambiguous header/query values rejected, malformed query encoding fails, DNS/port lengths validated; optional independent membership callback is a Go-specific seam, not a C# membership catalog; `TestClaimSelectorIgnoresUnauthenticatedIdentity` requires authentication for claim tenancy, stricter than C# `ClaimTenantIdResolver.cs`, which reads a claim without checking authentication; no development override or routing |
| Identity details/view | `Identity/IdentityProvider.cs`, `IdentityProviderContext.cs`, `IProvideIdentityDetails.cs` (`7c1e780`) | `identity.DetailsProvider[T]`, `ProvideDetails`, `View[T]` | Partial | `identity/TestDetailsFreshSnapshotAndNonAuthority`, `TestDetailsDenialErrorsAndCancellation`, `TestViewNilDetailsAndBoundedRecursion`; anonymous suppression, fresh callback, safe view with trusted roles, copied claims, unwrapped details and bounded wire encoding. Explicit adapter subject instead of C# sub-claim inference; display fallbacks only; no forwarded-name fallback, endpoint, schema or provider discovery/registration |
| Security seam composition | Same authentication/authorization/validation/tenancy/identity sources (`7c1e780`) | Explicit foundation composition | Go-specific | `ContractTests/TestSecuritySeamsRemainIndependent`; failed credentials terminal, public declarations do not bypass membership, nonblocking warnings do not imply authorization, malicious details remain display-only; no HTTP or pipeline conformance claim |
| HTTP hosting/discovery | Endpoint mappers and hosting (`7c1e780`) | Root Builder/Application | Partial | Hosting ledger below records snapshot endpoints, identity, discovery and lifecycle. Direct SSE, direct WebSocket and collection-transfer hubs are recorded below; locked Node client evidence is recorded below; browser execution is partially covered in the Real-browser observable conformance row (Chromium only); full schema generation remains unverified |
| Observable sources and declaration | `Queries/ObservableQueryHandler.cs`, `ObservableQueryElementOperations.cs` (`7c1e780`) | `observable.Source`, `Stream`, `Subject`, `State`; `queries.RegisterObservable` | Go-specific | `observable` lifecycle tests and `queries/TestObservableRegistrationAndPendingCurrentSnapshots`; explicit source registration and bounded independently owned handles instead of runtime observable discovery |
| Observable current/pending/wait execution | `Queries/ObservableQueryHttp.cs` (`7c1e780`) | `queries.Request.WithWait`, `ObservablePipeline`, observable HTTP snapshots | Implemented | `queries/TestObservableRegistrationAndPendingCurrentSnapshots`, suppression/wait/reader tests and root `TestObservableHTTPPendingWaitAndHEADDoNotActivateSource`, `TestObservableHTTPEnumerableMessageAndHEAD`; 202 pending, 408 bounded waits, completion diagnostics, QUERY no-store, enumerable 400 and nonactivating HEAD; streaming transport evidence is recorded separately below |
| Uniform observable interception and guards | `Queries/ObservableQueryElementOperations.cs`, `QueryPipeline.cs` (`7c1e780`) | `AddEmissionGuard`, `Invocation.SetSubscriptionScope` | Go-specific | Guard isolation, denial, masking, subscriber-tenant, callback-failure and terminal-frame tests in `queries/observation_test.go`; every source candidate uses authorization and detached interception; JSON-round-trippable scope data, bounded wait and retained failed-opening cleanup are deliberate hardening. Channel factories return an owned cleanup-capable handle even with a startup error or invalid channel, rather than losing cleanup on a canceled opening context |
| Hub revision operation semantics | `Queries/ObservableQuerySubscriptionStates.cs`, `ObservableQuerySubscriptionRevision.cs` (`7c1e780`) | `internal/streaming.Subscriptions`, `Revision`, `ConnectionOwner` | Implemented | `internal/streaming/subscriptions_test.go` covers equal-revision unsubscribe, delayed controls, legacy upgrade, token-owned termination, capacity, drain and lexical parsing; real SSE hub controls additionally prove duplicate/stale subscribe and equal-revision unsubscribe without reactivation |
| Revision tombstone retention and owner security | Same subscription state sources (`7c1e780`) | Connection-lifetime high-water marks and verified ownership snapshots | Go-specific | Tombstones are never evicted while a connection lives; new IDs reject at capacity rather than C# two-minute/1024-entry eviction. Retired workers count until joined. Stable verified subject, authentication state, tenant presence and independent anonymous evidence replace display-name/anonymous equivalence; real-listener SSE tests prove independent per-connection HttpOnly ownership cookies, exact tenant/subject matching, same-origin controls and an explicit origin allowlist. Anonymous connections are additionally capped by actual peer IP; forwarded peer headers are ignored. Cookies and connections expire after a bounded lifetime, with closed cookies removed on later eligible hub responses |
| Observable application lifetime | Hosting lifetime and observable subscription operation (`7c1e780`) | `Options.Observable`, admitted `ObservablePipeline`, `Application.Shutdown` | Go-specific | Root observable lifetime tests prove observations are canceled/joined before unary drain and user hooks, and failed admission after source activation retains timed-out cleanup for later Shutdown. Limits count opening and retired operations; callback cancellation is never treated as a join. `TestShutdownCanResumeResourceJoinWithoutRepeatingDisposal` and `TestShutdownJoinsChannelFactoryCleanupRetainedAfterFailedStartup` prove explicit resource-join and partial channel startup retries; `queries/TestFailedChannelStartupRetainsCleanupPanicUntilProducerJoins` proves unknown cleanup completion retains producer ownership, resources and capacity, and later shutdown preserves panic diagnostics without repeating disposal |
| Direct observable SSE | `Queries/ClientObservableSSE.cs`, `ClientEnumerableObservableSSE.cs`; JavaScript `ServerSentEventQueryConnection.ts` (`7c1e780`) | Observable endpoint negotiation, `internal/streaming.SSEWriter` | Implemented | Real-listener direct SSE tests match independent frame bytes and prove flush visibility, pending-without-synthetic-data, HTTP/2 headers, QUERY no-store, null profiles, terminal denial and disconnect/shutdown. Bounded writes, safe source-error frames and never failing an application-owned subject harden the reference; locked Node client direct SSE snapshots, model hydration, cancellation and terminal denial run in `ContractTests/observables/frontend` |
| Acknowledged connection writer and retained bytes | `Queries/ObservableQueryDemultiplexer.cs` serialized sends (`7c1e780`) | `internal/streaming.Writer`, `Budget` | Partial | Deterministic writer tests prove immutable copies, write acknowledgement, legacy fences, obsolete-job suppression, terminal retirement, byte/job overload and timed-out close retaining in-flight reservations. Connection/global byte budgets deliberately harden the reference. The SSE hub integrates one acknowledged writer with application/connection byte and job budgets, serialized JSON Ping keepalives and legacy replacement fences. Direct SSE uses its synchronous writer without a queue. `queries/TestCancellationAfterCandidateReservationRestoresBothBudgets` proves candidate release when cancellation follows reservation |
| Observable SSE hub and controls | `Queries/ObservableQueryDemultiplexer.cs`, `ObservableQuerySSESubscribeRequest.cs`; JavaScript `ServerSentEventHubConnection.ts` (`7c1e780`) | Fixed SSE GET/HEAD and subscribe/unsubscribe POST routes | Implemented | Real-listener hub tests prove Connected-before-data, full QueryResult envelopes, empty control bodies, creation-time 401/Unauthorized, live denial isolated to its subscription, HTTP/2, origin/owner rejection, capacity/tombstones, POST-independent resources and truthful shutdown after failed opening cleanup. Duplicate JSON keys and malformed controls explicitly return 400. Both hubs deliver full/delta/legacy collection transfers; `ContractTests/observables/frontend` executes the pinned SSE hub client for all three modes, replacement and equal-revision unsubscribe using an explicit fixture session owner, not browser cookies |
| Direct observable WebSocket | `Queries/WebSocketConnectionHandler.cs`, `ClientObservable.cs`; JavaScript direct connection (`7c1e780`) | Observable GET upgrade, `internal/websockettransport` | Implemented | Real-listener `TestDirectWebSocketDataFragmentedPingAndOrderlyCompletion` pins Data wrapping, WebSocket-before-SSE negotiation, fragmented application Ping, echoed millisecond Pong and orderly completion. Pre-upgrade denial/origin rejection and nonactivating HEAD are tested. Compression is disabled; local bounded writes acknowledge delivery, not browser receipt |
| Observable WebSocket hub | `Queries/ObservableQueryDemultiplexer.cs`; JavaScript `WebSocketHubConnection.ts` (`7c1e780`) | Fixed GET/HEAD `/.cratis/queries/ws` | Implemented | Real-listener tests cover Connected, two subscriptions, legacy-to-revision upgrade, duplicate/stale controls, equal-revision unsubscribe, isolated Error/Unauthorized, Ping/Pong and joining hijacked sockets on Shutdown. Shared writer/owner/byte budgets apply. JSON controls use payload and string/null arguments; invalid/binary controls close the physical connection. Full/delta/legacy transfer and replacement baseline resets are tested on real connections; `ContractTests/observables/frontend` also executes the pinned default WebSocket/delta client, all three hub modes, same-ID replacement and equal-revision unsubscribe |
| Observable collection differences | `Queries/ChangeSetComputor.cs`, `ObservedCollection.cs` (`7c1e780`) | `queries.ComputeChanges`, `ObservedCollection`, `WithCollectionIdentity` | Implemented | Collection tests pin first-added-all, last duplicate value/encounter order, null IDs, reordered/empty collections, immutable removals and JSON-set fallback. Registration compiles exported ID/Id extraction, independently of command key tags. Known hints are verified against the complete intercepted diff and fall back on incomplete hints or broken generation/version continuity; no comparison-speed optimization is claimed. The custom extractor does not make differently named JSON identity fields stock-client compatible |
| Observable collection transfer | `Queries/ObservableQueryDemultiplexer.cs` (`7c1e780`) | `Observation.Run`, full/delta/legacy hub transfers | Implemented | `TestHubCollectionTransferModesOnBothRealTransports`, query transfer/observation tests and streaming baseline-budget tests: first delta full, subsequent delta without data, legacy full plus changes, full without changes, identity-less full fallback, fresh replacement baselines, masked removals and suppression continuity. Candidate state commits only after callback/write acknowledgement, never queue admission; failed delivery and cancellation discard reservations. Serialized baselines do not alias source/callback values and share connection/application limits with frames. Delivery means local write/flush, not browser acknowledgement. Known hints are fully verified rather than trusted shortcuts |
| Observable known-change hints | `Queries/ObservedCollection.cs`, `ChangeSetComputor.cs` (`7c1e780`) | Value `ObservedCollection[T]` and continuity fallback | Go-specific | `queries/observed_collection_test.go` and collection tests verify suppressed-middle, generation/predecessor and malformed/incomplete hint fallback against complete intercepted snapshots. Conservative verification, not a claimed comparison-speed optimization; hints never authorize omitting detected changes |
| Generated observable adapters | Model-bound observable discovery (`7c1e780`) | Separate tools module, `RegisterArtifacts` and typed `RegisterObservable` performer | Partial | `observable_analysis_test.go`, independent `testdata/observable_consumer_test.go`, and `TestProductionCLIRealClientFixtureIndependentConsumption` consume pushed Arc `78ebbf8` without workspace/replace. Exact Source/CurrentSource/*State/*Subject declarations and aliases normalize owning-model single/pointer/list/array/value Page/value ObservedCollection emissions. Manual/generated metadata and lazy admission, current/pending, failure, cancellation and join-before-disposal are executable. No arbitrary provider/nested-source inference, pointer wrappers, or generated lifecycle workers |
| JavaScript/browser observable compatibility | JavaScript `Globals.ts`, `ObservableQueryFor.ts`, connection factory/hub connections; `Arc.React/queries/useObservableQuery.ts` (`7c1e780`) | Real Arc registration/pipelines/subjects/Serve plus locked Node client | Partial | `ContractTests/observables/frontend/run.mjs` executes @cratis/arc 22.48.2 with Fundamentals 7.22.0, Node 26.8.1/npm 12.0.2 and pinned ws/EventSource polyfills. Default one-connection WS/delta, SSE hub, Full/Delta/Legacy hub results, class hydration, both direct full transports, equal-revision unsubscribe, same-ID fresh-baseline replacement, stale captured-control rejection, nil-ready/pending perform, pending WS argument replacement, cancellation and all-four terminal denial/cleanup pass. Delta final collection uses an explicitly independent test-consumer reducer, not an Arc React hook. The separate production-generated default WS/Delta case adds exact callback counts, argument replacement, date/model hydration and cumulative source/host joins using the same fixture; strict hook compilation covers both decorator modes. The separate mounted React lane is recorded below. Real-browser cookie ownership, StrictMode and failure reconnect are recorded in the browser row below; cross-origin browsers and Guid hydration remain unverified; see `ContractTests/observables/README.md` for exact cases and gaps |
| Mounted generated observable React hooks | `Arc.React/queries/useObservableQuery.ts`, `useChangeStream.ts`; JavaScript `QueryInstanceCache.ts` (`7c1e780`, npm 22.48.2) | Production-generated proxies and Go fixture, real providers, React/test-renderer 18.3.1 | Partial | `ContractTests/observables/frontend/react.test.mjs` executes non-StrictMode explicit WS hub/Delta: shared `use`/`useChangeStream` cache, initial/delta rich hydration and actual collection reconstruction, equal/changed arguments with cross-baseline diff, separate paged tuple/requests/reconstruction, zero-retention unmount joins before fallback, default-retention reuse plus explicit disposal, and joined socket/host cleanup. Plain source slices do not prove paging windows/totals. Same-key setter retention characterizes [Arc#2869](https://github.com/Cratis/Arc/issues/2869), not a fix. No complete Arc wrapper, browser/DOM/StrictMode, suspense, 30s expiry, reconnection or broader transport/hook claim |
| Real-browser observable conformance | JavaScript `ServerSentEventHubConnection.ts`, `WebSocketHubConnection.ts`, `ReconnectPolicy.ts`; `Arc.React/Arc.tsx`, `queries/useObservableQuery.ts`; `Queries/ObservableQueryDemultiplexer.cs` (`7c1e780`, npm 22.48.2) | Real Arc host `clientfixture.NewBrowser`/`ServeBrowser`, production-generated `All.use` under the exported `<Arc>` wrapper in headless Chromium | Partial | `ContractTests/browser/run.mjs` (locked playwright-core 1.63.0, Chromium only, React/React DOM 18.3.1 development build) runs seven cases against `ContractTests/internal/browser/host`: default `<Arc>` SSE hub with one `EventSource`, an `HttpOnly`/`SameSite=Strict` path-scoped owner cookie unreadable by page script and attached by the browser, and 404 without lifecycle effects for a second profile's controls; WebSocket hub over one socket without a cookie; `StrictMode` double mount with default and zero retention keeping one live source, with unmount joining it; reconnect after a real joined server close through the pinned `ReconnectPolicy` with a new connection, owner and fresh baseline; terminal `Unauthorized` remaining mounted and unauthorized across a real host restart and a bounded 2500ms reconnect/retry window, with no new subscribe POST or source; and `SIGTERM` joined shutdown observed by both transports. `clientfixture/TestBrowserHost*` prove the restart/join host contract; `ContractTests/browser/host.test.mjs` proves joined startup-failure cleanup and forced-termination fallback. Separate Linux `browser.yml` workflow, not a required local gate. No Firefox/WebKit, TLS `Secure` cookies, cross-origin/credentialed CORS, authenticated principals, HTTP/2 connection limits, suspense, paging hooks, direct per-query transports or `ReconnectPolicy` exhaustion ([#21](https://github.com/Cratis/Arc.Go/issues/21)) |
| Chronicle watches | Chronicle read-model watches (`7c1e780`) | Future optional SDK source adapter | Not implemented | Keyed reads and Arc sources do not implement an authoritative Chronicle watch; no append-notification substitute |
| MongoDB bindings and BSON materialization | `MongoDB/DefaultMongoDatabaseNameResolver.cs`, `MongoCollectionAdapter.cs`, `ConceptSerializer.cs`, `MongoDBDefaults.cs`, `DateOnlySerializer.cs`, `TimeOnlySerializer.cs`, `TimeSpanSerializer.cs` (`7c1e780`, under `Source/DotNET`) | Optional `integrations/mongodb`: `Collection`, `NewCollection`, `DatabaseName`, `NewRegistry` | Partial | Module unit/race tests and independent literal BSON fixtures cover tenant defaults/case/Unicode, borrowed client/config snapshots, private registries, UUID subtype 4/RFC bytes, legacy concepts, checked numbers, null/zero/empty and failure-atomic decoding. Go uses required JSON names with optional BSON storage overrides, explicit collection names, UTC-noon DateOnly and checked rather than rounded numeric reads. Binding/registry construction performs no provider reads or publication; snapshot execution and the mandatory application-owned release callback are covered by the adjacent Partial MongoDB snapshot-rendering row. No reflection-invoked ConceptValue, global registry mutation or Optional/decimal/polymorphic mapping; real Chronicle sink layout/release remains unproved. See [storage profile](https://github.com/Cratis/Arc.Go/blob/main/integrations/mongodb/README.md) |
| MongoDB snapshot rendering | `Arc.Core/Queries/QueryableQueryRenderer.cs`, MongoDB collection operations (`7c1e780`, under `Source/DotNET`) | Optional `integrations/mongodb`: `Find`, `RendererOptions`, `NewRenderer`, `Renderer.Execute` | Partial | `renderer_test.go` records frozen authorized count/find predicates, server sort/window, bounds, failures, detached cleanup and raw release-before-interception. `snapshot_example_test.go` executes external manual namespace registration through the real Arc pipeline and pinned driver's no-database wire mock. Primary/majority with simple collation is an explicit Go profile, not atomic count+find; retry configuration stays application-owned. Chronicle release mapping is application-owned, requires unchanged count/order/identity and unique decoded identities, and never decodes protected sink fields before release. `provider_*_integration_test.go` adds MongoDB 8.0.15 task-owned replica-set evidence through actual registered Arc renderer/HTTP: two tenants and forbidden rows, matching serialized count/find coordinates/predicates/collation, server sorting/windowing, multi-batch getMore, refetch insert/update/delete/filter entry/exit/reorder/refill, codec round trip/decode retraction, synthetic raw release, integer/string and UUID representation collisions, isolated count/find/getMore failpoints, canceled-request killCursors, empty/bounded pages, denied no-I/O ingress, borrowed-client reuse and outer resource-close failure and HTTP encoding/paging retraction against pushed root `d4fec76`. Count overflow remains bounded fake evidence, not billions of live rows. Independent no-database and Linux Go 1.27 live CI lanes; see [MongoDB guide](/arc/go/backend/go/mongodb/). Still no real Chronicle sink/compliance or sharded/multi-member/failover claim; bounded watch evidence is recorded separately below |
| MongoDB watches | `MongoDB/MongoDBWatcher.cs`, `MongoCollectionExtensions.cs`, `MongoDBJoinedObserveBuilder.cs` (`7c1e780`, under `Source/DotNET`) | Optional `integrations/mongodb`: `Watcher`, `Observe[T]`, `Source[Find[T]]` and manual existing-renderer registration | Partial | `filter_guard_test.go` covers pre-encoding cycle/depth guards (including nil/self-referential recursive pointer types), bounded byte production and hook-free failure. `filter_zeroer_test.go` and `discovery_regression_test.go` reject application `bson.Zeroer` before encoding/discovery across pointer method sets, named containers, nested fields and concepts without invoking `IsZero`; required JSON/text concept codecs remain supported. `filter_raw_test.go` covers recursive raw document/array/code-with-scope validation, canonical array keys, failure-atomic malformed envelopes and a lossless valid BSON corpus with duplicate ordered document keys. `filter_inline_test.go` rejects exported BSON inline fields before nil pointers or empty typed containers can bypass static inspection, including nested inline types and the driver's exact/legacy tag tokens. Ordinary recursive structs and BSON byte-preservation cases remain supported. All instruction paths use Go-specific 64-level/16-MiB graph, static-type and BSON bounds; filters with application encoding hooks, exported inline fields or opaque vectors fail diagnostically. `stream_context_test.go` verifies that streams retain only Open's cancellation channel/copied deadline, not performer metadata/context methods, and release that state after continued/concurrent Next joins. Go-specific cancellation classification is fixed on first observation: at/after the copied deadline means DeadlineExceeded, otherwise Canceled. Earlier cancellation observed late and custom causes cannot be reconstructed; Next's supplied context preserves its actual error. `find_snapshot_test.go`, `watcher_test.go`, `observe_test.go` and compiled observation example cover lossless BSON instruction detachment, bounded database-owned fanout, initial handoff ordering, tenant/client/query identity, admission/overflow, cancellation and continued joins, terminal resnapshot recovery, and fresh renderer scope views. `observation*_integration_test.go` adds MongoDB 8.0.15 task-owned ordinary Aggregate change-stream evidence through actual Arc Open/Run and the existing registered renderer: cursor-before-baseline and blocked-render/delivery barriers; every full candidate compared with authorized unary count/find/release/interception; insert/update/replace/delete/filter entry/exit/off-page/reorder/refill/totals; independent principals/tenants/models/collections and same versus distinct clients; fresh row filters and revoked membership/policy denial before render I/O; metadata projection/batch64/no UpdateLookup; local overflow, startup cancellation, continued cleanup joining and cleanup timeout; terminal CursorNotFound/injected history loss without resume aggregate; cleanup-joined same-owner fresh Open with first-full Delta baseline then unary-compared changes; drop/rename termination. Natural small-oplog expiry remains unverified, as do sharding/multi-member/failover and real Chronicle sink/compliance. The existing tagged Linux provider CI lane includes these contracts. Source-only non-wait snapshots remain pending; no C# current/replay, single/null, joins, resume tokens, transparent reset, browser recovery or generated opaque-provider proxies. Explicit reopen creates the new baseline; no root driver/API change. Module README records lifecycle and differences |
| Multiple application instances | `Queries/ObservableQueryDemultiplexer.cs`, `MongoDB/MongoDBWatcher.cs` (`7c1e780`, under `Source/DotNET`) | Independent Applications, each owning its client, `mongodb.Watcher`, pipeline and hub registry; no distributed registry or broker | Partial | `integrations/mongodb/two_instance_integration_test.go` in the tagged Linux MongoDB 8.0.15 lane runs two Arc applications behind a real loopback HTTP router. Each instance holds its own per-tenant-database cursors and delivers the same database change with per-principal and per-tenant row isolation. SSE hub controls for a connection on the other instance, or from a wrong subject, tenant or anonymous owner, return 404 without opening resources. Transport loss ends that instance's streams while the survivor continues; recovery is an explicit new connection and subscription with a full baseline, and unsubscribe/resubscribe resets the delta baseline. Shutdown joins invocation resources exactly once, issues one killCursors per observed database and leaves the borrowed client usable. Owner affinity for SSE hub controls is a deployment requirement and all limits are per instance. Not multi-process, crash, real load-balancer, browser, WebSocket-hub, failover or sharding evidence; no transparent resume. See [multiple instances](/arc/go/backend/go/mongodb/multiple-instances/) ([#27](https://github.com/Cratis/Arc.Go/issues/27)) |
| Proxy generation/OpenAPI | ProxyGenerator/OpenAPI | Route descriptors, generated Go adapters and generated-contract prerequisites | Partial | The generation ledger below records Go adapters, actual CLI model/command/snapshot/observable-query publication, locked TypeScript/Node execution, and untouched C# captures; bounded mounted observable reconstruction is recorded above. Opaque provider-source/proxy-only generation, OpenAPI publication, browser and broader hook conformance remain unsupported or unverified; the internal OpenAPI renderer checkpoint is recorded in the generation ledger |
| Chronicle integration | Arc Chronicle integration (`7c1e780`) | Optional `integrations/chronicle` module and `sdk` adapter | Partial | Returned events, command transactions, keyed models, aggregates, reactor command effects and append observation are covered in the Chronicle ledger below. No root Chronicle dependency; no protected decisions, watches or snapshots |
| Operation resources and admission | `Authorization/AuthorizationEvaluation.cs`, `OperationContextScope.cs` (`7c1e780`) | `execution.Scope`, `OpenScope`, `BorrowScope`, `RunWithResources`, `Resolver`, `CheckOwner` | Go-specific | `execution/scope_test.go`, `resources_test.go`, `panic_test.go`, `dependencies_test.go`: owned/borrowed disposal, close-once forwarding, joined admitted resolutions, expiring non-closing resolver views, principal/tenant presence; `execution/resource_join_test.go` preserves at-most-once Close and explicitly retryable ResourcesJoiner.Join, caches ordinary failures including context errors, retains non-context Join failures and typed/panic diagnostics across resumptions, and exposes ErrScopeJoinPending only for incomplete joins; `execution/scope_startup_join_test.go` and root `TestShutdownRetainsExplicitJoinAfterPartialResourceStartup` retain pending resource-opening cleanup through PendingScopeError.Scope; every pending owned Scope.Close result exposes the same capability, including successful unary opening (`TestRunWithResourcesRetainsPendingScopeAfterSuccessfulOpening`), with automatic reclaim by observable admission and explicit caller ownership elsewhere; optional DI ContextChecker/ScopeOwner checks. Arc owns structural Resources/OpenResources; Fundamentals deliberately has no lifecycle package. Unreleased `Run` and `services` are removed; migrate to RunWithResources and optional ResourcesFrom |
| Model declaration and field metadata | Model-bound command/read-model attributes and `Authorization/AuthorizationDeclarations.cs` (`7c1e780`) | `metadata.InspectModel`, `Model`, `ParseQueryTags`, descriptor additions | Go-specific | `metadata/model_test.go`, `internal/modelshape/fields_test.go`; optional blank-field declarations, explicit wire keys/identity, strict tag grammar, method selection and unchanged default routes. No runtime source-comment discovery or projections; build-time adapter generation is recorded below |
| Model/concept graph validation | `Validation/ModelGraphValidator.cs`, `ValidatorInvoker.cs`, `ConceptValidator.cs` (`7c1e780`) | `validation.Registry`, `Graph`, `ModelValidator`, `RegisterScoped`, `RegisterScopedConcept`, `ValidateTags` | Partial | `validation/graph_test.go`, `registry_test.go`, `tags_test.go`; exact runtime types, pointer identity, owning collection paths without indices, concept suppression and safe failures. Model Validate methods are a Go addition. Required tags are top-level only; maps are opaque, depth is capped at 64, rich rule IR remains ARC-GO-28; optional scoped manifests are checked without activation by `Graph.CheckDependencies` |
| Scoped policies and catalog compatibility | `Authorization/AuthorizationEvaluation.cs`, `AuthorizationConfigurationValidator.cs` (`7c1e780`) | `authorization.RegisterPolicy`, `Prepared.EvaluateScoped`, `Evaluator.CheckCatalog` | Partial | `authorization/scoped_test.go`; no factory during Build or before role denial, guest opt-in, explicit failure without a required scope, expiring views and copied declaration comparison. Policies remain borrowed; `ContractTests/TestBothPipelineBuildsCheckSharedDependencyManifests` verifies optional exact keys at pipeline Build. `authorization/dependencies_test.go` checks copied manifests and effective catalog subsets; `validation/dependencies_test.go` checks graph manifests. Hidden closure dependencies cannot be checked |
| Model-bound command registration | `Commands/ModelBound/ModelBoundCommandHandler.cs` | `commands.Register`, `Handle`, `Void`, `Invoke` | Go-specific | `commands/TestComposableRegistration`, executable Examples and `ContractTests/model_bound_test.go`; exact method sets and direct adapters replace reflective invocation. Type-only registration supports the dependency-free void signature; arbitrary signatures need a handwritten or generated typed adapter (see the generation ledger below) |
| Command ownership and metadata | `Commands/CommandHandlerProviders.cs` | Command registration and descriptors; `Registry.AddBuildCheck`, `BuildView.ContainsCommandType` | Go-specific | `commands/registration_test.go`, `build_checks_test.go`; exact pointer/value types, immutable snapshots, deterministic duplicate rejection and integration checks before freezing (including late registration and failed-build retries); pin public identities explicitly when renaming a type |
| Execute/Validate and stage suppression | `Commands/CommandPipeline.cs` | `Execute`, `Validate`, scoped variants | Implemented | `commands/pipeline_test.go`, `validate_test.go`, `ContractTests/model_bound_test.go`; Validate excludes preparation, handling, consumers and completion participants; validation success is advisory |
| Pipeline resources | `Commands/CommandPipeline.cs`, `Queries/QueryPipeline.cs` | `OpenResources`, `ScopeFactory`, scoped execution | Go-specific | `ContractTests/TestCommandQuerySharedScopeCompositionEquivalence`; manual, resource and guarded Fundamentals container paths emit identical envelopes. Borrowed queries never dispose command resources or enlist in command completion; expiring Go views replace service-provider overloads |
| Pipeline model/concept validation | `Validation/ModelGraphValidator.cs`, `ValidatorInvoker.cs`, `Queries/QueryValidator.cs`, `QueryArgumentsModels.cs` | Shared `validation.Graph`, model methods and typed validators | Partial | `commands/validate_test.go`, `queries/pipeline_test.go`, `ContractTests/TestSharedGraphAndModelConventionsBlockBothPipelines`; bounded graph/required-tag subset; model Validate is a Go convention, not CLR discovery or full DataAnnotations |
| Command stage-specific severity | `Commands/CommandValidationResults.cs` | Command policy boundaries | Implemented | `commands/validate_test.go`, `outcome_test.go`; input-stage findings use severity floors; warning-only rejection errors filtered out at input stages no longer accompany successful results (`TestFilteredWarningErrorsNeverAccompanySuccessfulResults`); returned Handle warnings remain blocking |
| Provide payload/control distinction | `Commands/CommandProvideInvoker.cs`, `CommandHandlerArgumentResolver.cs` | `WithProvide`, `WithPreparation`, `Prepare` | Go-specific | `commands/preparation_test.go`; exact typed payloads replace assignability/tuple searches; no fallback to DI for a missing payload |
| Protected decision-read root seam (#31) | `Chronicle/ReadModels/CommandDecisionReads.cs`, `DecisionDependencySafety.cs` (`7c1e78075b737df64f69fddfaae83374f75e3612`) | `WithProtectedDecisions`, `WithUnprotectedDecisions`, `AddDecisionProvider`, `DecisionSource`, `ReadDecision`, `VerifyDecision`, `DecisionEvidence` | Partial | `commands/decision_pipeline_test.go`, `decision_reads_test.go`, `decision_expiry_test.go`, `decision_failure_test.go` and `ExampleWithProtectedDecisions` cover callback-free profile admission, target-local shared acquisition, repeated enrollment, separate validation provenance and foreign/nil/expired/overwritten read refusal before Handle, including nil-interface evidence and overwritten cached rereads before enrollment and return. Go admits no model/custom validators or operations; only Provide payloads implementing DecisionEvidence and explicit verification are inspected. No root Chronicle dependency. Provider transaction conflicts, release/compliance and lost acknowledgements are provider responsibilities, covered for Chronicle by the protected decision-read row in the Chronicle ledger; this seam alone makes no persistence or authenticated server-proof guarantee |
| Raw versus response metadata | `Commands/CommandPipeline.cs` | Return type, `ResponseKind`, explicit response contracts | Go-specific | `commands/registration_test.go`, `outcome_test.go`; raw returns and client responses are distinct; dynamic consumers may leave response metadata unknown; typed Execute checks the actual response rather than rejecting unknown metadata; unrelated typed consumers preserve known response metadata (`TestTypedUnrelatedEventHandlerPreservesKnownOrderIDResponse`) |
| Additive consumers and outcomes | `Commands/CommandResponseValueHandlers.cs` | Response handlers, `Outcome`, `Respond`, `Effects`, `Values` | Partial | `commands/outcome_test.go`; bounded explicit graphs, additive consumers (exact concrete keys or implemented interface keys) and control-before-effect preflight instead of automatic tuple inspection; manual flat operations are recorded below |
| Flat command operations and recovery | `Arc.Core/Commands/CommandOperationExecution.cs`, `CommandOperationBoundary.cs`, `Arc.Core.Specs/Commands/for_CommandOperationExecution` (`7c1e78075b737df64f69fddfaae83374f75e3612`) | `Operation`, `Operations`, `RegisterOperation`, `WithOperations`, compatible scope registration, backend `Recovery`/`OperationOutcomes` | Partial | `commands/operations_test.go`, `operation_execution_test.go`, `operation_boundaries_test.go`, `operation_example_test.go` cover exact declarations, copied membership, whole dependency preflight, sequential entry/reverse recovery, all five existing dispositions, cancellation/panic, sticky nesting, resource lifetime and HTTP privacy. [Operation reference](/arc/go/backend/go/commands/operations/) records manual registration, unified typed dependency bundles, explicit erased Outcome participation, no arbitrary container discovery, generated operation adapters, receipts or durable workflows. The Chronicle integration supplies the operation-classified terminal; see the Chronicle operation commit row below ([#30](https://github.com/Cratis/Arc.Go/issues/30)) |
| Nested execution and completion | `Commands/CommandPipeline.cs` | Bound executor and entered execution participants | Go-specific | `commands/execution_test.go`, `concurrency_test.go`; sticky per-frame execution failures, advisory nested Validate during Execute, expiring executors and reverse completion of entered participants (`TestNestedValidateFailureIsAdvisoryDuringExecute`). No automatic rollback or commit guarantee |
| Guarded integration state | `Chronicle/Commands/CommandTransaction.cs`, `CommandCausationScope.cs` (`7c1e780`, under `Source/DotNET`) | `NewStateKey`, root/frame state, `ParentCommandContext` | Go-specific | `commands/state_test.go`; only bound children share root state, frame membership is isolated, expired callbacks and security/correlation changes fail. Private typed keys replace ambient ownership; borrowed mutation capabilities must still check admission |
| Terminal completion ordering | `Chronicle/Commands/TransactionalCommandScope.cs`, `Arc.Core/Commands/CommandPipeline.cs` (`7c1e780`, under `Source/DotNET`) | `DeferredCommitParticipant`, `AddDeferredCommitParticipant` | Go-specific | `commands/completion_test.go`; begins first, completes after ordinary participants independent of registration order; failures/cancellation prevent commit, validation-only execution skips activation. One provider only; concrete persistence is supplied by the optional Chronicle module |
| Persistence observation | `Chronicle/Commands/TransactionalCommandScope.cs` (`7c1e780`, under `Source/DotNET`) | `CompletionReport`, `ReportCommit`, `CompletionError`, `Result.Completion` | Go-specific | `commands/completion_test.go`; committed/unknown evidence survives failure, early completion and disposal; every failed scalar/object response is removed; no HTTP fields or automatic retry. Provider-reported facts, not interception of immediate SDK appends |
| Return admission before nil flattening | `Chronicle/Commands/SingleEventCommandResponseValueHandler.cs` (`7c1e780`, under `Source/DotNET`) | `ReturnAdmission`, static exact types and dynamic checks | Go-specific | `commands/return_admission_test.go`; opt-in typed-nil rejection, static no-response metadata, all-leaf preflight, additive consumers, explicit Respond preserved. No inferred event registration or slice classification |
| Command read-model ownership and presence | `Arc.Core/Queries/ReadModelForCommandServiceCollectionExtensions.cs`, `Chronicle/ReadModels/ReadModelServiceCollectionExtensions.cs` (`7c1e780`, under `Source/DotNET`) | `RegisterReadModelProvider`, `ResolveReadModel`, `RequireReadModel`, `ReadModelOrNil` | Partial | `commands/read_models_test.go`, `ExampleRegisterReadModelProvider`; exact-type declared/fallback/override ownership, optional absence versus present zero, invalid keys and release errors. Duplicate owners fail instead of C# replacement ordering. Providers own coordinate-aware caching/release; the optional Chronicle module supplies typed materialization |
| Errors, redaction and cancellation | `Commands/CommandResult.cs`, `Queries/QueryResult.cs`, `ExceptionDetailRedactor.cs` | Result helpers and pipeline finalizers | Implemented | Command/query pipeline tests and `ContractTests/pipeline_failures_test.go`; original local errors remain inspectable, failed response/data/change sets are suppressed, production messages are redacted |
| Namespace queries and directed functions | `Queries/ModelBound/ReadModelExtensions.cs`, `ModelBoundQueryPerformer.cs` | `queries.Register`, `Function`, `Invoke` | Go-specific | Namespace/function Examples and `ContractTests/TestModelBoundPipelinesMatchExistingGoldens`; unnamed value-receiver namespace methods and explicit functions use direct composition; build-time discovery is recorded in the generation ledger below |
| Model/query metadata inheritance | `Queries/ModelBound/QueryPerformerProvider.cs`, `Queries/QueryEndpointMapper.cs` | Read-model registration and query options | Go-specific | `queries/registration_test.go`; method replacement, pinned identity, logical namespaces, exact types and deterministic conflicts; no package-path identity inference |
| GET/QUERY argument binding | `Queries/QueryStringQueryRequestReader.cs`, `BodyQueryRequestReader.cs`, `ModelBound/ModelBoundQueryPerformer.cs` | Typed argument models, request readers and custom bindings | Partial | `queries/binding_test.go`, `request_test.go` and three fuzz targets; explicit requiredness, bounded scalar grammar, transport omission and custom JSON-node bindings; direct empty nonstring input uses missing/default rules, and boolean text accepts only trimmed case-insensitive true/false. HTTP mapping/no-store is covered by `TestGETHEADQUERYReadersAndSnapshotNegotiation` |
| Paging, sorting and ordinary lists | `Queries/Paging.cs`, `QueryableQueryRenderer.cs` | Parameters, `Page`, `SliceRenderer` | Partial | `queries/request_test.go`, `renderer_test.go`; active paging validation with `Page`/`Size` findings, safe wire-field sort columns, count-before-page and no double paging. The paired snapshot checkpoint covers bounded GET/QUERY cases; plain lists remain unpaged with zero page/size metadata, unlike C# request-metadata echo in the two exact allowances above |
| Exact rendering and interception | `Queries/QueryRenderers.cs`, `ReadModelInterceptors.cs` | Typed renderers and read-model interceptors | Go-specific | `queries/renderer_test.go`, `interceptors_test.go`; exact renderer keys, ordered sequential items and explicit pointer/value interceptor types; register supported wire-field comparers instead of reflected property guessing |
| Authorized snapshot execution | `Queries/QueryPipeline.cs`, `QueryFilters.cs` | `Perform`, `PerformScoped` | Implemented | `queries/pipeline_test.go`, `concurrency_test.go`, cross-lane contracts; dependency construction delayed through validation; declaration recheck before invocation; no hosting or streaming claim |
| Safe failures and ready-null | `Queries/QueryResult.cs`, `QueryPipeline.cs` | Query finalizer and snapshot results | Implemented | `queries/TestNilProviderOutputSkipsRendererAndInterceptors`, `TestTypedPerformFailuresAreReadyCorrelatedAndFailed`, ready-null/panic/cancellation/cleanup tests and cross-lane contracts; successful null is ready, never pending; nil provider outputs skip rendering/interception; typed failures retain correlation and suppress data/change sets |
| Shared Chronicle read-model seam | `Queries/ModelBound/ReadModelAttribute.cs` | Ordinary tagged read-model structs | Go-specific | `integrations/chronicle/examples/sharedmodel/model_test.go` proves separate offline registration, concept wire names and namespace-query HTTP serving; `internal/integration/shared_model_test.go` appends events, materializes the same model and serves Arc direct/HTTP queries across namespaces. No embedded Arc base, shared registry or Arc projection ownership |
| Later integrations | Observable queries and Chronicle operations/recovery | Snapshot adapters and first-slice Chronicle integration | Partial | Generated command/query adapters and Chronicle support are recorded in their ledgers; observable transports and bounded source-only MongoDB watches are covered above; Chronicle watches, protected decisions and durable operation recovery remain unsupported |
| Command/query test scenarios | Arc `Source/DotNET/Testing` CommandScenario/QueryScenario (`7c1e780`) | `arctest` package | Go-specific | `arctest` tests and examples; explicit builder configuration instead of discovery; results returned rather than stored in LastResult; `NewObservableQuery` adds synchronous full-result capture with result/byte/time limits, real admission/interception/guards and explicit cancellation/cleanup join. Tests prove producer joining, pending timeout, typed preflight and cleanup failure preservation at the capture limit. HTTP/hub/browser behavior, Chronicle seeding and operation-recovery assertions remain separate or unsupported |
| Full product compatibility | All C# surfaces | None | Not implemented | Foundation tests do not certify whole-product or HTTP conformance |

## Generation ledger

C# sources below use Arc `7c1e78075b737df64f69fddfaae83374f75e3612`, relative
to `Source/DotNET/Arc.Core/`. The experimental [generator](/arc/go/backend/go/generation/)
provides Go adapters and bounded TypeScript model/command/snapshot/observable-query
proxies. Frontend sources additionally use `Source/DotNET/Tools/ProxyGenerator` and
`Source/JavaScript` at the same revision. OpenAPI and Screenplay publication, opaque provider-source
generation, and proxy-only output remain unsupported; their internal checkpoints
are recorded below.

| Feature | C# source | Go surface | Status | Evidence and intentional boundary |
| --- | --- | --- | --- | --- |
| Command discovery and stage adapters | `Commands/ModelBound/ModelBoundCommandHandler.cs`, `Commands/CommandProvideInvoker.cs`, `CommandHandlerArgumentResolver.cs` | `tools/cmd/arc-gen`, `RegisterArtifacts`, `ArcBindings` | Go-specific | `ContractTests/TestGeneratedAndManualAdaptersHaveEquivalentStaging`, `TestGeneratedPreparationControlsAndPointerCommands`, tools `TestBootstrapRegenerationAndExecutableConsumer`; opted-in source directives and typed adapters replace CLR discovery. Exact Provide payload and stage-specific dependencies; no service construction during generation or registration |
| Read-model query discovery and metadata | `Queries/ModelBound/QueryPerformerProvider.cs`, `ModelBoundQueryPerformer.cs`, `Authorization/AuthorizationDeclarations.cs` | Generated namespace-method/function adapters and public registration options | Go-specific | `ContractTests/TestGeneratedMetadataMatchesManualMetadata`, `TestGeneratedAndManualAdaptersHaveEquivalentStaging`; command/query identity, authorization replacement, argument binding and runtime validation preserved. Unnamed value receivers or explicitly directed functions replace static CLR methods; supported snapshot shapes and exact declared observable source emissions, with independent observable consumer evidence above |
| Dependency binding | `Commands/CommandHandlerArgumentResolver.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs` | Generated exact dependency manifests, optional `ArcBindings`, `execution.Resolve` | Go-specific | `ContractTests/TestGeneratedDefaultBindingsRequireDependencyCatalog`, `TestGeneratedAndManualAdaptersHaveEquivalentStaging`; plain callbacks and Fundamentals container paths, denial/Validate-only suppression. Validator/policy constructor dependencies use the same exact keys and callbacks (see the directive row below); no standalone validator/policy-only package generation or Chronicle-specific parameter injection |
| Constructor service authoring | `HostBuilderExtensions.cs`, `Commands/CommandHandlerArgumentResolver.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs` (`7c1e780`) | Opt-in `-bindings-config`, shared Fundamentals `bindingtypes` planner, separate `RegisterServices(di.Registrar)` | Partial | Tools `service_bindings_test.go`, `service_bindings_publication_test.go`, and compiled external `testdata/servicebindings` consumers cover exact keys/directives, lazy constructors, stage suppression, borrowed interface forwarding, failed-result disposal, strict duplicates and explicit Existing lifetime attestations. Production CLI consumers resolve immutable Arc `78ebbf8` and Fundamentals.Go `v0.2.0` without workspace/replace. Symbol/import-cycle/main/internal preflight leaves all outputs unchanged on analysis failure; existing writer and manifest ownership remain authoritative. Manual closures and `ArcBindings` remain supported. Foreign-owner tests model one-owner composition, not an actual Chronicle generator integration. No implicit import discovery or operation-adapter parity; validator/policy directives are recorded separately below. See [constructor services](/arc/go/backend/go/generation/constructor-services/) ([#13](https://github.com/Cratis/Arc.Go/issues/13)) |
| Validator and policy directives | `Validation/ValidatorInvoker.cs`, `Validation/ModelGraphValidator.cs`, `Authorization/ArcAuthorizationPolicyRuntime.cs` (`7c1e780`) | `//arc:validator`, `//arc:policy name=`, shared zero instances and lazy constructor factories in `RegisterArtifacts` | Go-specific | Tools `TestValidatorAndPolicyDirectivesMatchManualRegistrationInAnExternalConsumer` compiles and executes a workspace-free consumer against the tools runtime pin, comparing manual and generated validation/authorization outcomes with explicit callbacks and optional DI scopes. `TestValidatorModelsCanUseExportedAliasesInAnExternalConsumer` compares generated and manual validation for exported aliases of private model types, including generic aliases. `TestValidatorAndPolicyDirectiveDiagnostics` rejects lookalike types, wrong signatures and duplicate registrations with source positions, including aliased duplicates separated by another model. The compiled consumer's `TestGeneratedScopedRegistrationsDeclareDependencyKeys` isolates missing validator and policy dependencies, checks their runtime error identities, and accepts both explicit callbacks. Typed model/concept validators, scoped dependency keys and anonymous-policy opt-in use the existing public registrars; directives replace CLR discovery, not FluentValidation rule translation. A validator/policy-only package is explicitly rejected; see [validator and policy generation](/arc/go/backend/go/generation/validators-and-policies/) ([#13](https://github.com/Cratis/Arc.Go/issues/13)) |
| Source diagnostics and regeneration | Model-bound discovery and configuration validation | `arc-gen -check`, source-position diagnostics, owned output | Go-specific | tools `TestDiagnostics`, `TestBuildTagsAndDeletedMethods`, `TestStaleOutputCleanupIsOwnedAndScoped`, `TestFailedPackageDoesNotPublishOtherOutputs`, `TestSymlinkOutputIsNeverFollowed`; selected packages/configuration only, no init execution, atomic per-file writes but no multi-file transaction. Unsupported signatures fail explicitly; tools tags remain deferred |
| TypeScript proxy golden comparison ([#20](https://github.com/Cratis/Arc.Go/issues/20)) | ProxyGenerator and JavaScript at `7c1e78075b737df64f69fddfaae83374f75e3612`, pinned C# generator/client `22.48.2`; imported `ProxyComparison/Fixtures.cs` at Arc.TypeScript `2f546a89c35d49726b78ed2bf573fff8d77b056e` | Production arc-gen CLI, matched Go source, file-by-file named-fragment comparison | Implemented | `ContractTests/ProxyComparison/comparison.test.mjs` generates and checks all nine files of the pinned fixture (models, enum, command, snapshot and observable queries, barrel) against unchanged C# captures, strictly compiles live output against the locked client packages, and rejects changed fragments, extra fields/files and missing/stale allowances. Exact file/fragment/token allowances document syntax, metadata and the approved result-field sorting correction ([Arc#2998](https://github.com/Cratis/Arc/issues/2998)); the barrel matches without allowance. Identity-less observable collections (no `ID`/`Id`, no serialized `id`) are admitted like the C# `ChangeSetComputor` JSON fallback and client JSON/position reconciliation; tools `TestIdentityLessObservableCollectionsPublishLikeCSharp`. Evidence is limited to this fixture; HTTP and rendered-hook behavior are in their own rows; see the [comparison boundary](https://github.com/Cratis/Arc.Go/blob/main/ContractTests/ProxyComparison/README.md) |
| TypeScript models and command proxies | ProxyGenerator model/command templates and JavaScript Fields/Command (`7c1e780`) | CLI TypeScript profile, shared wire graph, portable generated validators | Partial | Tools fixture/renderer tests and strict locked Models/Commands fixtures cover rich constructors, concepts, numeric enums, declared derivatives, response cardinality, portable rules and exact wire names. Production CLI loopback tests execute actual generated adapters; no mounted React or browser claim |
| TypeScript snapshot-query proxies | ProxyGenerator query template and JavaScript QueryFor (`7c1e780`) | Model-owned single/list/array/Page proxies, endpoint expectations, result-field sorting helpers | Partial | Tools query/analyzer regressions and strict Queries/Publication fixtures cover GET/QUERY exposure, required arguments, original-Go defaults, signatures and rich hydration. Sorting is the approved result-field allowlist deviation; no provider paging/sorting or nullable collection elements; generated string query validation has its own row below; observable output has its separate bounded row below |
| TypeScript observable-query proxies | ProxyGenerator `Templates/ObservableQuery.hbs`, JavaScript ObservableQueryFor and Arc.React hooks (`7c1e780`) | Mixed-family CLI, observable sorting/hook planner and shared publication lane | Partial | Production CLI/independent consumers, strict locked Observables and generated frontend fixtures cover emission cardinality, hook tuples, inherited perform, required arguments, rich hydration, and conservative identity validation. Actual generated default WS hub/Delta executes sharing, exact changes/callbacks, argument replacement, cancellation, terminal denial and joined shutdown. The separate mounted lane executes generated `use`, `useChangeStream` and `useWithPaging` with actual rich reconstruction, argument/cache behavior and joins; see the mounted ledger for setter/paging limits. Wider manual transports are separate; no browser, all-provider-layout or full nullable-shape claim |
| Shared wire-contract analysis | ProxyGenerator/OpenAPI type mapping, query readers and result contracts (`7c1e780`) | Internal contract graph v2, explicit server/codec assertions and separate TypeScript admission | Partial | Tools `wire_contract_test.go`, `contract_edges_test.go`, `wire_regressions_test.go` and independently compiled `testdata/wire-contract` witnesses cover input/output presence, numeric widths, temporal string codecs, nil omission versus codec-produced null, typed validation state and encoded-null envelope omission. Resolved endpoints remain shared with adapters; unknown custom contracts require explicit assertions. Existing TypeScript consumers remain checked. The internal OpenAPI renderer checkpoint is recorded below; no CLI publication or hosting is implied and Generate still refuses OpenAPI requests |
| Mixed output ownership and recovery | ProxyGenerator publication boundary; Go-specific safety contract | Manifest, pending journal and zero-write `-check` | Go-specific | Actual CLI and publisher negative cases preserve user/recovery evidence on unsupported input, physical path collisions, intervening empty files and unmanifested identical output. Per-file atomicity/process recovery only; no durable cross-root transaction, automatic legacy adoption or concurrent-writer claim |
| Generated snapshot-query validation | `Queries/QueryValidator.cs`, `Queries/Filters/FluentValidationFilter.cs` and its `and_the_member_names_are_compared_with_the_client` specification; JavaScript `Arc/queries/QueryFor.ts`, `QueryValidator.ts` (`7c1e780`) | arc-gen registers `validation.NewPortable[A]` through `queries.WithValidator` and emits matching TypeScript validators | Partial | Tools `TestQueryValidationProductionConsumer`, `TestQueryValidationRefusesUnprovedContractsWithoutMutation`, `TestQueryValidationAliasesRuntimeNameAndReservesValidator`; `ContractTests/ProxyComparison/QueryValidation` executes Arc client 22.48.2. `notNull`, `notEmpty`, `minLength`, `maxLength` and `length` on snapshot query strings reject GET/QUERY before the business method and before `fetch`, with exact member names, messages, severities and UTF-16 boundaries; Warning and Info findings also block. Empty HTTP strings count as missing, matching the built-in reader. Unproved rules, observable validation, server defaults and optional nonnullable rule-bearing strings are refused without changing existing output. The pinned client lets descriptor instance fields override transported arguments after client validation, so client validation is not a security boundary; no browser or mounted-hook claim |
| Declaration diagnostics (ARC0001-0006, ARC0014, ARC0019) | `Arc.Core.CodeAnalysis/ReadModelAnalyzer.cs` (0001, 0014), `CommandAnalyzer.cs` (0002-0004), `CommandProvideAnalyzer.cs` (0005), `InjectedReadModelAnalyzer.cs` (0006), `AuthorizationAttributeAnalyzer.cs` (0019), under `Source/DotNET` at `7c1e780` | `arc-vet` declaration analyzer, directive identities and imported Go analysis facts | Go-specific | `tools/internal/artifacts/TestDeclarationDiagnostics` checks exact source positions/spans for every rule, positive/negative, build-tag, alias, generated and lookalike fixtures; `tools/cmd/arc-vet/TestArcVetCommandContracts` checks driver output, imported command/read-model aliases and admission errors alongside findings. Exact payload identity replaces C# assignability; implicit owning-model snapshot shapes diagnose missing/incorrect error results, while unrelated implicit helpers stay outside discovery. Go 1.27 generic methods have version-gated coverage. ARC0002 requires package-level artifact opt-in and exempts same-package typed manual registrations (including aliases/inference), response-value handlers and other selected artifact kinds; negative CLI fixtures cover the supported manual command path. `TestDeclarationDiagnosticsManualRegistrationLimits` and CLI fixtures cover cross-package and generic-wrapper registrations: these still warn unless the command type has `arc:ignore`, the documented suppression. Pointer read models still require an absence-aware resolver. No arbitrary registration callback, blank-field metadata or Chronicle projection inference. [Rule meanings and pinned analyzer mapping](/arc/go/backend/go/generation/arc-vet/) ([#34](https://github.com/Cratis/Arc.Go/issues/34)) |
| ARC0007 command record preference | `Arc.Core.CodeAnalysis/ModelBoundRecordAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Commands use structs; Go has no class-versus-record declaration choice. See [language differences](/arc/go/backend/go/generation/arc-vet/#c-rules-that-do-not-apply-to-go) |
| ARC0008 read-model record preference | `Arc.Core.CodeAnalysis/ModelBoundRecordAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Read models use structs; no CLR record equality/immutability declaration |
| ARC0009 concept record preference | `Arc.Core.CodeAnalysis/ConceptRecordAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Named Go concepts and codecs do not inherit `ConceptAs<T>` and have no class-versus-record choice |
| ARC0010 synchronous Task wrapping | `Arc.Core.CodeAnalysis/CommandHandleTaskWrappingAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Handlers return synchronous values/errors; Go has no Task/async/await return wrapping |
| ARC0011 role nameof preference | `Arc.Core.CodeAnalysis/RolesLiteralAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | No nameof or attribute arguments; role directives use explicit strings rather than compiler-linked enum-member names |
| ARC0012 built-in exception preference | `Arc.Core.CodeAnalysis/ArcArtifactBuiltInExceptionAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Returned Go errors are not a CLR built-in exception hierarchy; domain error design and panic safety remain caller responsibilities |
| ARC0013 FluentValidation concept dereference | `Arc.Core.CodeAnalysis/ValidatorConceptDereferenceAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | Go validation has no FluentValidation expression-tree selectors over nullable ConceptAs references; ordinary pointer safety is still required |
| ARC0020 unenforced ASP.NET attributes | `Arc.Core.CodeAnalysis/AuthorizationAttributeAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | No ASP.NET attribute family or host integration assembly exists in Go |
| ARC0021 ASP.NET authentication schemes | `Arc.Core.CodeAnalysis/AuthorizationAttributeAnalyzer.cs` (`7c1e780`) | Not applicable to Go | Go-specific | No ASP.NET AuthenticationSchemes attribute setting exists; unsupported generator directive options fail admission |
| Authoring diagnostics (ARC0015) | `Arc.Core.CodeAnalysis/QueryParameterConceptTypeAnalyzer.cs` (`7c1e780`, under `Source/DotNET`) | `tools/cmd/arc-vet`, sharing arc-gen declaration admission and the Fundamentals concept classifier | Partial | Tools `TestAuthoringDiagnostics`, `TestAuthoringDiagnosticsRespectBuildTags` and `cmd/arc-vet` `TestArcVetCommandContracts`: reports a direct conversion of an exported top-level primitive argument field to a concept inside admitted `arc:readmodel`/`arc:query` bodies, including aliases and build-tag selection, skipping generated files, with text exit status 3 and standard `-json` reports. A syntax check, not dataflow: no local copies, closures, pointers, nested or promoted fields, fixes or suppressions. Declaration diagnostics and non-applicable C# rules are recorded separately above; operation and decision analyzers remain outside this scope. See the [arc-vet README](https://github.com/Cratis/Arc.Go/blob/develop/tools/cmd/arc-vet/README.md) ([#34](https://github.com/Cratis/Arc.Go/issues/34)) |
| OpenAPI 3.1 document | `Source/DotNET/OpenApi` transformers, for example `OpenApi/ModelBound/CommandOperationTransformer.cs` (`7c1e780`) | `arc-gen -openapi-out` and profile `openapi.out`: a deterministic OpenAPI 3.1.1 `.json` file rendered from the finalized v2 wire graph, owned through the arc-gen manifest and verified by `-check` | Partial | tools `output_artifacts_test.go` covers CLI publication, `-check` drift and hand-edit refusal, stale-file removal, manifest ownership with and without TypeScript, identical bytes for reordered packages and whole-document refusal without writing; `openapi_document_test.go`, `openapi_codec_test.go`, `openapi_codec_refusal_test.go`, `openapi_query_test.go`, `openapi_query_boundary_test.go` and `openapi_query_arguments_test.go` cover exact graph projection, injective component names, exact integer bounds, query arguments as GET parameters and paging/sorting parameters, and QUERY carried in an `x-cratis-query` extension with a JSON body schema (`arguments`, `paging`, `sorting`) rather than aliased to GET or POST. Opt-in offline `//go:build ignore` proofs (`openapi_arguments_consumer_test.go` and siblings) load the document with kin-openapi v0.149.0 through an alternate manifest not admitted to the tools module and validate GET/HEAD requests while QUERY stays unrouted. C# evidence is the existing pinned HTTP response captures for the envelopes plus source-derived witnesses of `CommandOperationTransformer.cs` and `QueryOperationTransformer.cs` in `openapi_document_test.go`; the document is not a byte port of the C# OpenAPI 3.0 route catalog. Refuses observable queries and streams, authorization and identity customizations, validation rules, opaque/UUID/date/float codecs, derived models and model/map/presence/validated arguments. Deliberately not implemented: HTTP exposure (`MapOpenApi()`), an embedded explorer and security schemes; the document is a file only ([#24](https://github.com/Cratis/Arc.Go/issues/24)) |
| Screenplay metadata export | `Source/DotNET/Screenplay/IScreenplayGenerator.cs`, `Emission/ApplicationSyntaxBuilder.cs`, `Emission/Queries/QuerySyntaxBuilder.cs`, `Emission/Types/ScreenplayPrimitiveTypes.cs` (`7c1e780`); Cratis.Screenplay 4.48.1 grammar (`e5b5698`) | `arc-gen -screenplay-out` and profile `screenplay.out` (formatVersion 2): a partial `.play` file from the shared Graph, owned through the arc-gen manifest and verified by `-check` | Partial | tools `output_artifacts_test.go` covers CLI publication, `-check` drift, stale-file removal, manifest ownership and identical bytes for reordered packages; `screenplay_test.go` and `screenplay_grouping_test.go` byte-compare `testdata/screenplay/metadata.play`, preserve input, group interleaved namespaces deterministically and refuse ambiguous or unrepresentable shapes without document bytes. `testdata/screenplay/contract.md` records compilation by the pinned Screenplay compiler fixture. Descriptive metadata only (commands, read models, snapshot and observable queries; String, Bool, Uuid, Int, Decimal and DateTime), with SPG diagnostics stating that events, projections, reactions, validation and authorization are not modeled. Deliberately not implemented: the embedded event-model viewer and any HTTP route; the export is a file only ([#37](https://github.com/Cratis/Arc.Go/issues/37)) |

## Chronicle integration ledger

The C# source below is `Source/DotNET/Chronicle` at Arc
`7c1e78075b737df64f69fddfaae83374f75e3612`, unless an Arc.Core path is stated.
Go evidence lives under `integrations/chronicle`; kernel tests use
`cratis/chronicle:19.29.4-development`. The adapter pins Chronicle.Go
`9e0c8d5ba5f1` and root Arc.Go `3e2a69270f46`, without workspace replacements. This deliberate SDK baseline includes captured-client preparation and fail-closed profile corrections; it does not establish classified decision, watch, replay or general compliance support.

| Feature | C# source | Go surface | Status | Evidence and remaining boundary |
| --- | --- | --- | --- | --- |
| Optional integration and core independence | `ArcBuilderExtensions.cs` | `Integration.Install`, `sdk.New`, nested module | Go-specific | `scripts/check-boundaries.py`, root no-container gate; SDK imports confined to adapter/examples/tests, root manifests unchanged. Nested tags use `integrations/chronicle/vX.Y.Z`; publication deferred |
| Shared-provider captured client composition | `ArcBuilderExtensions.cs`, Chronicle registered-first generic-host resolution specs (`7c1e780`) | Public SDK Capture/PrepareClient, explicit `BindValue`, borrowed `sdk.New`, Arc `ScopeFactory`/`DependencyCatalog` | Go-specific | `sdk/composition_test.go`, executable `composition_example_test.go` and kernel `internal/integration/composition_test.go` verify exact shared client/collaborator identity, no setup transport or early factory activation, unprepared probes without poisoning preparation, callback/cleanup Close safety, joined preparation cleanup and borrowed-client survival through an actual transport probe. The kernel witness retains the configured resolver, excludes inherited origins, records confirmed immediate persistence despite handler failure, and joins command resources before provider disposal. Configure the resolver before Capture; prepare does not connect/register/attach/catch up. `OwnClient=false` and explicit client/provider shutdown remain application-owned; ordinary constructor/closure wiring stays supported. No operation-terminal compatibility or broader SDK safety claim |
| Semantic source selection and response override | `Commands/EventSourceExtensions.cs`, `CommandContextExtensions.cs` | `EventSourceID`, provider/value interfaces, `arc:"key"`, response selection | Implemented | `integration_test.go` covers named identity versus raw UUID fields, nil declaration, provider panic, wrapper targets and response retargeting. Explicit key tags replace CLR attributes; no Id-by-name convention |
| Returned events and ordered cross-source batches | `Commands/SingleEventCommandResponseValueHandler.cs`, `EventsForEventSourceIdCommandResponseValueHandler.cs` | Bare registered events, `Events`, `EventForSource`, `EventsWithScopes` | Go-specific | Unit ordering/preflight tests, SDK immutable snapshot test, kernel command tests; explicit collections rather than covariance, A1/B1/A2 order preserved. `sdk/adapter_test.go` verifies returned-event decoding preserves frozen SDK naming/codecs and propagates malformed-content failures. Rich Go wrappers can override route/subject/causation |
| Command-owned transaction and failed responses | `Commands/TransactionalCommandScope.cs`, `CommandTransaction.cs` | Terminal participant, private root state, SDK UnitOfWork/Owner | Implemented | `integration_test.go`, `sdk/transactions_test.go`, kernel `commands_test.go`; nested root ownership, atomic rejection, input validation, lost acknowledgement/no retry, scalar response retraction. No distributed transaction |
| Persistence disposition and immediate append observation | `Commands/TransactionalCommandScope.cs` | Completion reports, `sdk.ResolveAppendOrigin` and SDK `Sequence.OnAppend` subscription | Partial | Kernel `immediate_test.go` proves ignored rejection rolls back deferred work and confirmed immediate persistence survives later failure. Unit and kernel `shared_correlation_test.go` keep rejected/committed owner outcomes separate in both completion orders. `sdk/append_observation_test.go`, `origin_execution_test.go` and kernel `internal/integration/origin_test.go` cover exact nonzero typed-origin attribution, independent roots with the same correlation, nested inheritance, other coordinates, denied/validation masking and zero-origin refusal. Configure the SDK client with `chronicle.WithAppendOriginResolver(sdk.ResolveAppendOrigin)` before `sdk.New`; the adapter cannot retrofit an existing client. Correlation never determines ownership, and owner-unit commits use distinct SDK origins. Unsubscribe prevents new callbacks and joins admitted callbacks. Always check direct SDK results, including pre-dispatch errors, other sequences and low-level handles; this is not general interception of every external persistence path |
| Constraint/concurrency mapping | `Commands/ConstraintViolationExtensions.cs`, `ConcurrencyViolationExtensions.cs` | `CommitResult.Failure`, `CommitError` | Implemented | `validation_test.go` plus kernel unique/concurrency rejection/readback; mixed diagnostics retained, explicit JSON member names improve on C# casing-only fallback, BeforeFirst is described as no events |
| Per-target configured concurrency | `Commands/ConcurrencyScopeBuilder.cs` | `ConfigureCommand` flags and `ScopeResolver` | Implemented | `concurrency_test.go`; independent actual A/B targets and frame caching; `configuration_test.go` rejects unregistered and pointer/value-mismatched configuration at Build without activation, including Install before registration. SDK calls public `ResolveScope` from Chronicle.Go#43. Opaque resolved expectations are retained as provider tokens rather than guessed or reread |
| Keyed model injection and ownership | `ReadModels/ReadModelServiceCollectionExtensions.cs`, Arc.Core `Queries/ReadModelForCommandServiceCollectionExtensions.cs` | Typed `sdk.BindReadModel`, core Require/optional resolvers | Partial | `models_test.go`, kernel active/passive projection and namespace tests; typed SDK reads retain absence/progress, successful frame caching, failures never cached. Explicit bindings remain necessary because Go has no runtime generic registration; current generator needs handwritten injection adapters |
| Read-model release/compliance | `ReadModels/ReadModelServiceCollectionExtensions.cs` | Owning SDK Reader.Get and release contract | Partial | Unit unreleased-value refusal and kernel model reads; no duplicate release of kernel-owned reads. Full encrypted-value/compliance authoring is SDK capability-limited; model progress is not protected-decision evidence |
| Aggregate history, typed mutation and loaded checks | `Aggregates/AggregateRootFactory.cs`, `AggregateRootMutation.cs`, `AggregateRootEventHandlers.cs` | `DefineAggregate`, `OnAggregateEvent`, `AggregateRoot` | Partial | `aggregate_test.go`, kernel competing decisions with rejected-target absence; no-match versus position zero, fold ordering, callback expiry, ignored failures poison transaction. `TestIncompatibleAggregateRoutesOnSameSourceFailBeforeCommit` and kernel `TestIncompatibleAggregateRoutesOnSameSourceRejectWithoutPersistence` cover the source-label restriction: differing aggregate types/routes on one source fail closed. Chronicle C# 19.29.1 `Transactions/UnitOfWork.cs` rejects conflicting scopes in strict ordered mode but overwrites them in legacy aggregate mutation; Go never drops a loaded check. The pinned SDK binds labels to source IDs, so source+route labels require an upstream contract change. Buffered history and no snapshots; non-pointer event-struct callbacks replace reflective methods. `sdk/history_test.go` proves exact registered ID/generation decoding through frozen SDK naming/codecs, refusal of unknown/mismatched/malformed content and zero aggregate folds after any history decode failure; no alternate-generation substitution or automatic local migration |
| Early aggregate commitment | `Aggregates/AggregateRoot.cs` | Shared-owner `AggregateRoot.Commit` | Implemented | `aggregate_early_test.go`, `TestAggregateEarlyCommitCannotCreateSuccessor`, `TestEarlyAggregateCommitCannotIgnoreNestedLookupFailure`, kernel `TestGuardedEarlyAggregateCommitAgainstKernel`; root guard rejects ignored denied/validation/lookup and ancestor failures before persistence, successful nested work shares one owner, nested Validate remains advisory, no successor after commit, later failures retract responses but retain committed reports |
| Reactor command execution and returned effects | `Reactors/CommandSideEffectExecutor.cs`, `CommandResultHandler.cs`, `CommandsResultHandler.cs` | `ReactorCommands`, `sdk.CommandEffects`, `DeliveryFrom` | Implemented | Bridge unit tests and kernel `reactors_test.go`; real Arc commands before acknowledgement, stop-on-failure, earlier commits survive, failed observer partition, per-event metadata. SDK keeps per-batch reactor activation; each command owns a fresh Arc operation. Kernel `reactor_redelivery_test.go` keeps the delivery unacknowledged while commands run, commits earlier commands before a later one completes, records a failed partition at the original position after rejection, runs no later command before recovery, and joins reactor and command resources at shutdown ([#14](https://github.com/Cratis/Arc.Go/issues/14)). No deduplication guarantee |
| Identity, tenant mapping and bounded causation | `Commands/CommandCausation.cs`, `CommandCausationValues.cs`, `Tenancy/TenantNamespaceResolver.cs` | Trusted actor mapper, exact namespace resolver, explicit Audit policy | Go-specific | Anonymous-actor tests, kernel tenant/reactor tests, asymmetric GUID SDK fixture. Unknown nested/PII properties are not reflected into audit data; explicit approved values only, bounded per-value/total metadata. Event actor metadata never grants roles |
| Frozen selected-store catalogs | `ArcBuilderExtensions.cs` and Chronicle client catalogs | SDK `Client.Catalogs` | Implemented | SDK adapter uses Chronicle.Go#42 without connection at construction; typed bindings still verify producer ownership |
| Chronicle operation commit and compensation | `Chronicle/Commands/TransactionalCommandScope.cs`, Arc `Commands/CommandOperationExecution.cs`, `CommandOperationBoundary.cs` (`7c1e780`, under `Source/DotNET`) | Installed integration's sole `AddOperationCommitParticipant` terminal, read-only `ObserveCommit`, operation-frame `AggregateRoot.Commit` refusal | Partial | `operations_test.go` and executable `operation_example_test.go` cover observation recorded by the authorized filter and opened by the terminal Begin before Provide/Handle/operations, validation failure and validation-only without observation or Begin, every completion driving recovery, pre-entry Committed/Unknown/Mixed refusal, fail-closed `ErrUnsupported` without an `AppendObserver`, empty operation commands and explicit-commit refusal with unchanged ordinary commands. Kernel `internal/integration/operations_test.go` runs against `cratis/chronicle:19.29.4-development`: no persisted work, constraint-rejected NotCommitted, confirmed immediate Committed, Unknown through an injected lost append acknowledgement, handler-time confirmed/unknown immediate appends refusing operation entry with persisted readback, Mixed, committed deferred work, retained `*chronicle.EventStore` compensating writes after the terminal step, fresh-origin attempts, tenant isolation and refused explicit commits that persist nothing. `scripts/check-chronicle-snippet.py` gates the operation excerpt against its compiled example. Missing `sdk.ResolveAppendOrigin` on a client cannot be detected and is a documented precondition; direct application appends by filters/validators before terminal Begin are unattributed and outside observation (unit regression). A rejected handler append can still admit operations before rollback/compensation. No generated operation adapters, nested workflows, durable recovery or retries. See [Chronicle guide](/arc/go/backend/go/chronicle/#compensate-operations-against-chronicle-outcomes) ([#30](https://github.com/Cratis/Arc.Go/issues/30)) |
| Protected decision reads (#31) | `ReadModels/CommandDecisionReads.cs`, `DecisionDependencySafety.cs` | `sdk.EnableDecisions`, `sdk.ReadDecision`, `sdk.Decision`, `Integration.EnrollDecision`, `DecisionParticipant` | Implemented | Kernel `internal/integration/decisions_test.go` against `cratis/chronicle:19.29.4-development`: an event-log fold sees a just-committed booking and refuses the stale decision; a competing append after enrollment rejects a two-source batch as `NotCommitted` with a concurrency violation and nothing of the batch persisted; a lost batch acknowledgement stays `OutcomeUnknown` with persisted readback and no retry; a validation-only filter read folds without beginning or enrolling and is never the identity execution reuses, while execution shares one read between filter and Provide; classified (`WithPII`) models fail with `DecisionReadRefused`/`protected-model`, unregistered models with both `ErrNotRegistered` and `ErrDecisionRead`, unmarked commands with `ErrDecisionProfile`, and unprotected commands receive an unenrolled advisory snapshot. `sdk/decisions_test.go` covers invalid arguments, unregistered models and frozen-routing failures preserving their cause plus `ErrDecisionRead` only in active protected invocations, without reaching Handle or acquisition; store mismatches retain both identities through root admission. Kernel `TestUnrelatedAppendDoesNotRejectTheDecisionBatchAgainstTheKernel` proves conflict guards cover dependency event types for the read key, not unrelated events on the same source. `decisions_test.go` covers one lazily begun transaction under serialized concurrent enrollment, refusal and unsupported participants poisoning ignored work into rollback, and validation-only refusal before Begin; `sdk/decision_reads_test.go` covers foreign evidence, typed Check, classified/unsupported refusal and participant state without RPC; `ExampleEnableDecisions` compiles the composition. Enrollment uses the command's own SDK unit, never `transactions.FromContext`. Classified models are refused rather than released, so no admitted path releases twice. SDK tokens are opaque evidence, not authenticated server proof; the pinned protocol cannot atomically bind definitions or in-place history changes. The protected profile admits no validators (root seam row). See [Chronicle decision reads](/arc/go/backend/go/chronicle/decision-reads/) |
| Watches, snapshots, automatic historical migration, durable operation recovery | Read-model watch and aggregate/operation surfaces | None | Not implemented | No protection or recovery promise from snapshot injection. Registered historical generations decode with their exact descriptors; unknown generations fail explicitly. No automatic migration, append or command retry |

Chronicle.Go requests [#42](https://github.com/Cratis/Chronicle.Go/issues/42),
[#43](https://github.com/Cratis/Chronicle.Go/issues/43),
[#44](https://github.com/Cratis/Chronicle.Go/issues/44), and
[#45](https://github.com/Cratis/Chronicle.Go/issues/45) are delivered in the pinned
SDK. No fallback is retained for their missing APIs: catalogs, configured scope
resolution, pre-ack command effects and append notifications are all used. Their
issues remain open pending upstream release. The limitations above are integration
or SDK contract boundaries, not silent substitutes for undelivered hooks.

## Hosting and discovery ledger

All C# paths below use Arc `7c1e78075b737df64f69fddfaae83374f75e3612` and are
relative to `Source/DotNET/Arc.Core/`. [Hosting issue 17](https://github.com/Cratis/Arc.Go/issues/17)
tracks this slice. Evidence is Go-owned unless the bounded paired snapshot
checkpoint is named explicitly; none establishes browser execution.

| Feature | C# source | Go surface | Status | Evidence and caller implications |
| --- | --- | --- | --- | --- |
| Root composition and explicit registration | `ArcApplication.cs`, `ArcApplicationBuilder.cs` | NewBuilder, Build, registrar seams | Go-specific | `TestBuilderCombinedFrozenComposition`, `ExampleNewBuilder`; explicit typed adapters, no redundant AddArc/UseArc calls, no runtime package scanning; `TestBuilderNamespaceHintIsNotAnExportedMethod` pins root/child namespace defaults without exporting CommandNamespace (unreleased implementation hint removed) |
| Build without activation | `ArcApplicationBuilder.cs` | Single-attempt Build | Implemented | `TestBuilderFailedAttemptIsTerminal`, `TestOpaqueSchemaRequiresOverrideWithoutActivation`; failure is terminal at root, use a new builder to retry |
| POST Execute/Validate | `Commands/CommandEndpointMapper.cs` | Application command routes | Implemented | `TestCommandsExecuteValidateAndTransportFailures`, `TestNineTaskBoardConformanceCases`; validate invokes no business handler and emits no response |
| Traditional action handlers | `Arc/Commands/CommandActionFilter.cs`, `Arc.Specs/Commands/for_CommandActionFilter/when_executing` (`7c1e780`, under `Source/DotNET`) | `NewActionHandler`, `ActionOptions[T]`, `ActionResult`, mounted with `Builder.Handle` | Go-specific | `action_handler_test.go`, `action_severity_test.go`, `ExampleNewActionHandler`: a case-insensitive `/validate` path binds and validates but never invokes the action or Raw; findings reject before the action; errors, panics, blocking and invalid-severity findings suppress Response and Raw with production redaction; zero and false responses are retained and nil omitted; Raw keeps its own status, headers and body; body, query and media limits; Warning policy with `X-Ignore-Warnings`; canceled requests never run the action. An explicit adapter replaces the MVC action filter: no command registry, Provide, catalog authorization, scope, transaction, response handlers or event consumers, so protect routes with middleware. Source-derived witnesses, not paired MVC execution. See [traditional actions](/arc/go/backend/go/commands/traditional-actions/) ([#35](https://github.com/Cratis/Arc.Go/issues/35)) |
| Request-value merge into action bodies | `Arc/ModelBinding/FromRequestModelBinder.cs` (`BindModelAsync`, `DefaultValueChecker<T>`), `Arc.Specs/ModelBinding/for_FromRequestModelBinder/when_model_is_provided_partially_by_both_binders.cs` (`7c1e780`, under `Source/DotNET`) | Opt-in `ActionOptions.FromRequest` | Partial | `TestActionRequestPinnedDefaultMerge`, `TestActionHandlerExplicitRequestMergeAndContext`: default body members (missing, zero, false, null) take nondefault request values; body nondefaults, explicit empty strings and non-nil scalar pointers, including zero, win; request values are cloned. Go-specific: a caller-written FromRequest replaces ASP.NET binder discovery, wire names match exactly, null plain strings count as missing, and only flat built-in scalars and scalar pointers are admitted, not concepts, codecs, collections or embedded fields ([#35](https://github.com/Cratis/Arc.Go/issues/35)) |
| GET/QUERY snapshots | `Queries/QueryEndpointMapper.cs` | Application snapshot routes | Implemented | `TestGETHEADQUERYReadersAndSnapshotNegotiation`, task-board nine cases; no SSE negotiation or synthetic wait |
| Paired snapshot HTTP | `Queries/QueryEndpointMapper.cs`, `QueryableQueryRenderer.cs`, `BodyQueryRequestReader.cs`, `QueryStringQueryRequestReader.cs` (`7c1e780`) | `ContractTests/httpconformance`, real Application GET/QUERY endpoints | Partial | `TestPairedSnapshotHTTP`: 36 requests / 14 groups, 34 strict matches plus two exact ordinary-list page/size allowances described above. `TestReferenceActivation`, comparator, provenance and joined-lifecycle regressions fail closed. No command, authentication, HEAD, provider, streaming or browser parity claim |
| Task-board HTTP conformance | Kotlin nine-case suite, Arc 22.14.0 / Arc.Kotlin `23c93a3` | `ContractTests/TestTaskBoardHTTPConformance` (in-process and child process) | Implemented | Nine cases covered; no live .NET comparison |
| HEAD, routing and canonical paths | `Http/EndpointRouteHelper.cs`, endpoint mappers | Explicit HEAD and private ServeMux | Go-specific | `TestExactRoutingMethodsAndCanonicalPaths`, `TestRealListenerHEADAndGracefulShutdown`, `FuzzCanonicalRouting`; empty 404/405, lexical Allow, no path redirects, literal trailing slash; `TestRawCatchAllCannotStealFrameworkRoutes`, `TestRawExactOwnershipConflictsStillFailBuild`, `TestReservedUnknownRoutesBypassRawAuthentication` pin SPA/subtree fallbacks with Arc-table priority and reserved-prefix 404; reference `Http/HttpListenerEndpointMapper.cs` MapFallbackToFile |
| Static files and SPA fallback | `StaticFileExtensions.cs`, `Http/StaticFileOptions.cs`, `Http/StaticFilesMiddleware.cs`, `Http/FallbackMiddleware.cs`, `Http/HttpListenerEndpointMapper.cs`; `Arc.Core.Specs/Http/for_StaticFilesMiddleware` and `for_FallbackMiddleware` under `Source/DotNET` | Public `Builder.Handle`, standard `fs.Sub` and `http.ServeContent`; example-local unexported `newStaticSite`, not an importable Arc API | Partial — embedded static-site composition | `ExampleBuilder_Handle_staticFiles` in [compiled example](https://github.com/Cratis/Arc.Go/blob/main/static_files_example_test.go) and `TestStaticSite...` in [HTTP tests](https://github.com/Cratis/Arc.Go/blob/main/static_files_test.go) cover a public, nonpersonalized site using immutable embedded assets or trusted read-only regular, seekable files with prompt filesystem operations. GET/HEAD serves `/assets/<file>`; `/`, `/app` and extensionless `/app/...` select only the fixed `index.html`. Tests cover actual bytes/media/length and empty HEAD, missing asset/index, redacted filesystem errors, rejected methods, traversal/ambiguous paths, directories, known API success/error/denial/405, unknown API exclusion, mapped/unmapped/disabled/mixed-case reserved paths, terminal authentication rejection, no implicit raw-handler authorization, site-only header isolation, file closure, concurrent requests and joined host/application shutdown. Later read/close failures cannot retract publication and never append a shell. Deliberate Go differences are HEAD support, narrow fallback eligibility, reserved-route protection and site-only `no-store`, versus C# GET-only configurable roots/default files and broad first-root fallback. C# authority above is source/spec inspection, not new execution. See [hosting profile](/arc/go/backend/go/core/hosting/#serve-an-embedded-public-site): `fs.Sub`/`os.DirFS` are not symlink sandboxes; no writable/symlink filesystem confinement, browser, paired C#, broad-host or gap-free parity claim. The broader [issue 36](https://github.com/Cratis/Arc.Go/issues/36) profile remains Partial, not complete |
| Credentials and anonymous exhaustion | `Http/AuthenticationMiddleware.cs` | Authentication ingress | Go-specific | `TestAnonymousAuthorizationDenialIs403AndCredentialFailureIs401`; terminal failed credentials 401, operation denial 403 even anonymous |
| Tenant selection/membership | `Tenancy/*TenantIdResolver.cs` | Options.Tenancy/TenantResolver, pipeline membership | Implemented | `TestCommandsExecuteValidateAndTransportFailures`, `TestMiddlewareCompositionAndRawHandlerCapabilities`; header selection and borrowed raw metadata, membership stays pipeline-owned; `TestIngressErrorsAreLoggedWithoutRequestSecrets` pins invalid selectors as 400 malformedRequest findings (including queries), with original errors logged locally |
| Correlation and immediate receipt | `Execution/CorrelationIdResolver.cs`, `OperationContextScope.cs` | Ingress, internal one-use receipt marker | Implemented | `TestTerminalCredentialsAndCorrelation`, `TestHTTPReceiptPrecedesAuthenticationAndNestedReceiptIsFresh`, `TestHTTPReceiptForwardingIsPrivateToEndpointPipeline`; header/envelope equality, endpoint receipt captured before authentication, nested and repeated raw-handler commands get distinct fresh receipts; middleware/readers/identity/discovery providers never receive the pipeline forwarding marker |
| HTTP severity allowance | `Commands/CommandEndpointMapper.cs` | AllowedFromHeader forwarding | Go-specific | `TestAllowedSeverityHeaderFiltering`, `validation/TestAllowedHeader`; Error capped at Warning, repeats ignored, floors preserved |
| Redaction and atomic publication | `ExceptionDetailRedactor.cs`, HTTP writers | Bounded encode-before-commit publication | Implemented | `TestAtomicPublicationFailuresPreserveStatusPrecedence`; failed data/state removed, denial/validation precedence retained, no command retry or rollback promise |
| Fresh identity and legacy cookies | `Identity/IdentityProvider.cs` ExpireLegacyCookie, `Http/HttpListenerRequestContext.cs` RemoveCookie, `Identity/IdentityEndpointMapper.cs` | Typed/scoped details registration, me | Implemented | `TestIdentityFreshUnwrappedAndLegacyCookieExpired`, `TestLegacyCookieExpiryPreservesRemovalAttributesWithSecureDefault`, `TestLegacyCookieSecureExceptPlainHTTPLocalDevelopment`, `TestScopedIdentitySuppressesActivationAndCleanupSuppressesSuccess`; no cookie authentication, 401/403 stay empty, cleanup suppresses success; empty-value deletion at `/`, past expiry and no HttpOnly/SameSite/Max-Age. Go-specific security hardening: Secure by default (including remote HTTP behind HTTPS ingress); only plain-HTTP requests with a `localhost` or loopback `Host` and no direct or forwarded HTTPS signal omit Secure for development. `Forwarded`/`X-Forwarded-Proto` HTTPS only tightens the policy, including localhost backend Hosts; forwarded headers cannot relax it or establish identity. No new proxy-trust contract ([#66](https://github.com/Cratis/Arc.Go/issues/66)) |
| Logging and SSE allocation hardening | `Queries/ClientObservableSSE.cs` diagnostics/framing (`7c1e780`); Go host logging boundary | `internal/logging.Sanitize`, builder and standalone command/query pipeline logger boundaries, `internal/streaming.SSEWriter` | Go-specific | `TestRequestCompletionSanitizesBeforeHostLogHandler`, `TestSnapshotFailureSanitizesBeforeHostLogHandler`, `queries/TestObservableFailureSanitizesBeforeHostLogHandler`, `commands/TestCallbackFailureSanitizesBeforeHostLogHandler`, `internal/logging/TestHandlerSanitizesGroupsAndPreservesErrorChains` remove CR/LF and other controls from strings, errors and Stringers, including grouped and derived attributes, before host handlers. `internal/logging/TestHandlerPreservesStringerJSONValues` preserves UUID correlation strings in JSON logs and sanitizes Stringer text before serialization. Printable text, error classification and `errors.Is`/`errors.As` traversal remain available; host level policy, record metadata and error returns are preserved. `internal/streaming/TestSSEFrameSizeValidatesBeforeAddingOverhead` checks the platform allocation ceiling before adding eight framing bytes; existing configured response/queue limits and frame bytes are unchanged. No caller migration beyond control-free diagnostic values and the Secure cookie policy above ([#66](https://github.com/Cratis/Arc.Go/issues/66)) |
| Discovery exposure | `Introspection/DiscoveryExposure.cs` | IntrospectionOptions | Implemented | `TestDiscoveryExposureMatrix`, `TestDisabledCatalogsDoNotDisableIdentityDiscovery`; production unavailable without explicit capability, enabled controls only catalogs |
| Catalog DTOs/summaries/schemas | `Introspection/*IntrospectionMetadata.cs` | Compiled catalogs, RegisterSchema | Partial | `TestCatalogsSchemasAndRoles`, `TestOpaqueSchemaRequiresOverrideWithoutActivation`; schema bounds and opaque-codec overrides replace complete .NET exporter; recursion/rich rules/polymorphism remain unsupported |
| Development users/tenants | `Identity/IdentityEndpointMapper.cs` | AddUsersProvider/AddTenantsProvider | Implemented | `TestDiscoveryFixturesAreUnwrapped`, `TestDiscoveryProvidersAreLazyOrderedAndNotDeduplicated`; ordered lazy aggregation, empty arrays and no deduplication |
| Explicit forwarded identity | `Identity/MicrosoftIdentityPlatformAuthenticationHandler.cs`, `Identity/UntrustedForwardedIdentityHeaders.cs` | MicrosoftIdentityPlatform, optional slog Logger | Partial | `TestForwardedIdentityExplicitTrustAndReservedClaims`, `authentication/TestUntrustedForwardedIdentityWarnsOncePerProcess`; unsigned-header trust opt-in, repeated/oversized input rejection, trust-off headers ignored with one value-free Warn per process across adapter instances; nil logger disables diagnostics; no JWT/OIDC verification |
| Owned/embedded graceful lifecycle | `ArcApplication.cs`, `ArcApplicationExtensions.cs` | Start, Serve, Run, Shutdown, app pipelines | Go-specific | `TestStartRollbackIncludesFailingHook`, `TestShutdownCancelsThenJoinsDirectOperations`, real listener; explicit ownership, cooperative deadlines, no restart or detached disposal |
| Backend operation diagnostics | `Observability/PipelineMetrics.cs`, `Observability/OperationOutcomes.cs` (`7c1e780`) | Optional `Options.Diagnostics`, command/query `PipelineOptions.Diagnostics`, `observability.Recorder` | Partial | `observability/recorder_test.go`, `commands/diagnostics_test.go`, `queries/diagnostics_test.go`, root `diagnostics_test.go` and `observability/ExampleRecorder`: bounded recorder-wide registered labels (default/max 1000, unknown/overflow `_other`), command execute/validate and snapshot-query outcomes, typed/scoped preflight, admission, nested attempts, unchanged receipts/results and explicit synchronous export outside producer locks. Cumulative counts/seconds replace C# meter histograms; a bounded recent-event ring may drop events without losing metrics. No payload/error values enter observations. `diagnostics_http_test.go` adds matched HTTP pre-dispatch failures and independent nested authentication calls; command/query nil-context regressions preserve one logical rejection and unchanged results. `queries/diagnostics_observation_test.go`, `diagnostics_retained_test.go` and internal forwarding specs distinguish opening, consumption, acknowledged data and actual joined cleanup. EOF remains success after Close; suppression, denial, obsolete/canceled/failed delivery do not increment served data; timed-out/panicking/pending cleanup remains retained until native ownership releases. Delivered metrics do not fill the event ring. No exporter runs during execution; no tracing provider, histogram buckets or complete observability parity claim. See [backend diagnostics](/arc/go/backend/go/core/diagnostics/) ([#33](https://github.com/Cratis/Arc.Go/issues/33)) |
| Protected aggregate query health | `Queries/QueryHealth.cs`, `QueryHealthTracker.cs` (`7c1e78075b737df64f69fddfaae83374f75e3612`) | `Options.QueryHealth`, `QueryHealthName`, `/.cratis/queries/health`, optional native `queries.HealthReporter` | Partial | `query_health_test.go` and `ExampleQueryHealth`: absent by default including Development and raw fallbacks; copied nonempty administrative roles guard HTTP, backend Perform/PerformScoped/Open and hub subscriptions before state/source access. A private ordinary observable pipeline excludes application resource/factory/filter/validator state and rechecks each emission. Current plus one-second cancellation-aware consumer sampling starts no publisher worker. Synchronized aggregate query-label and protocol/state counts omit IDs, principals, clients, arguments, cached data and exceptions; native observation counts exclude health itself and overlap hub operations, so totals are neither additive nor globally atomic. Deliberately protected, opt-in and aggregate-only rather than C# anonymous detailed topology; no ping/pong/client details, automatic exporter or complete #33 parity claim. See [protected query health](/arc/go/backend/go/queries/query-health/) ([#33](https://github.com/Cratis/Arc.Go/issues/33)) |
| Middleware and diagnostics | `Http/HttpListenerEndpointMapper.cs` HandleRequest, HTTP host middleware | Use, slog Logger, owned server ErrorLog | Go-specific | `TestMiddlewareCompositionAndRawHandlerCapabilities`, constructor-failure tests; first outermost, metadata before middleware, optional writer capabilities preserved; `TestIngressErrorsAreLoggedWithoutRequestSecrets` pins error-only logging at Warn for client selector faults and Error for server faults, with credential reasons/headers excluded |
| Admitted request panic recovery | `Http/HttpListenerEndpointMapper.cs` HandleRequest, `ExceptionDetailRedactor.cs` | Ingress recovery and owned server logging | Go-specific | `TestIngressRecoversMiddlewareAndRawPanics`, `TestIngressDoesNotRewriteCommittedResponsesAndPropagatesAbort`, `TestOwnedServerUsesConfiguredSlogErrorLogger`, `TestSwitchingProtocolsCommitsTheObservedResponse`; before commitment, command/query redacted 500 or empty 500 for endpoints without envelopes; after commitment/hijacking, log only; http.ErrAbortHandler retains net/http abort semantics; nil logger stays silent |
| Third-party host and middleware recipes | Hosting, command/query and validation contracts listed above (`7c1e780`); adapters are Go-specific | Single unpublished `recipes/` module; [recipe guides](/arc/go/backend/go/recipes/) | Go-specific | Chi/Gin/Echo and browser-origin mount tests preserve command/query envelopes, direct streaming, disconnect cleanup and coordinated HTTP/Arc shutdown with active SSE. Browser-origin regressions check trusted/attacker direct and hub WebSocket handshakes, hub SSE, warning preflight and correlation exposure. JWT tests verify credentials and access-token restrictions; OpenTelemetry tests bridge trace context and logs; playground validation tests cover portable-rule coexistence, wire names, anonymous embedding and memberless errors. Pinned dependencies remain outside runtime graphs; no browser execution, paired C# adapter run or arbitrary middleware/version claim ([#23](https://github.com/Cratis/Arc.Go/issues/23)) |
| Default observable client, OpenAPI, browser parity | Observable handlers, OpenAPI, JavaScript clients (`7c1e780`) | Raw transport contracts and locked Node client lane | Partial | Default @cratis/arc WS/delta and explicit SSE/direct modes execute through `ContractTests/observables/frontend`; see the observable ledger for limits. The separate mounted observable hook lane has bounded explicit WS/Delta evidence. OpenAPI publication, browser and broader React parity remain unimplemented or unverified. Neither Node polyfills, independent class-test reduction nor mounted Node hooks prove browser behavior |

Discovery deliberately applies `no-store, private` and merged `Vary: Cookie` to
catalogs/schema as well as identity/development listings; current C# does not
uniformly apply those headers. Raw handlers cannot steal reserved routes. Schema
bounds fail explicitly, never publish empty placeholders for unsupported shapes.
Framework recipes add no runtime dependencies; their installed-version adapter
matrix remains application-owned. CI's other OS/Go lanes and CodeQL are remote-only.

## Intentional differences and migration

- Plain constructors and closures remain first-class. Arc runtime packages import
  no Fundamentals container; the DI contracts may appear transitively through
  execution. `examples/nocontainer` imports no DI package and exercises the
  foundation flows; `scripts/check-no-container.py` enforces the dependency boundary.
- Dependency keys are exact, with no assignability search or root resolve.
  Fundamentals owns the optional container and graph validation. Use borrowed
  interface forwarding for one owned concrete instance; Arc forwards operation
  cleanup at most once even for a non-idempotent adapter. The unreleased `services`
  and `execution.Run` APIs are removed rather than wrapped. Use `RunWithResources`,
  `ResourcesFrom` and guarded `execution.Resolve`, or plain `ResourcesAs`.

- Supply explicit stable namespaces/type names instead of CLR discovery. Moving Go
  source does not change routes or subscription names. Full descriptors will grow
  with pipeline/generator work; v1 does not pretend to describe unsupported schema.
- Resolve rejects duplicate identities and case-insensitive method/path collisions
  rather than silently skipping a performer. Give each conflicting artifact an
  explicit path. Wildcards, relative/escaped paths, whitespace, repeated explicit
  slashes and dot segments fail instead of adopting host-dependent behavior.
  Derived paths are also checked: root and trailing-slash command paths are rejected
  because C#'s literal `/validate` concatenation yields repeated slashes. Use
  `/create`, not `/create/`; configure a non-root conventional command route.
- A zero result fails closed (unauthorized); use success constructors or explicitly
  set `Authorized` and query `Ready`. C# default construction is authorized/ready.
- A failed command never carries a response, even for a non-nullable scalar.
  This avoids C# `ClearResponse` retaining `default(T)` under null-only omission.
- Binding is case-sensitive like C# Arc's default body serializer; use the exact
  wire name. Only exact repeats of declared names are rejected rather than using
  C#'s last-value-wins behavior. Case variants are unknown fields and do not fail.
- Present-null Optional model properties are written as null to preserve presence
  through a round trip. C# `WhenWritingNull` omits ordinary null properties instead.
  Consumers must handle explicit null; use missing Optionals when omission is wanted.
- Claim tenancy ignores unauthenticated principals and returns NotSet even if they
  carry tenant claims. C# `ClaimTenantIdResolver.cs` at `7c1e780` reads claims
  without checking authentication; Arc.Go requires an authenticated adapter before
  treating a claim as a selector. Membership remains a separate check.
- Plain Go strings reject null, unlike C# reference-type strings under Arc's default
  options (nullable-annotation enforcement is not enabled). Use `*string` or
  `Optional[string]` to accept null without confusing it with an empty string.
- `time.Time` retains Go's RFC3339Nano JSON codec: UTC `Z`, explicit offsets and up
  to nine fractional digits. C# DateTimeOffset uses `+00:00` at UTC and tick
  precision (at most seven digits); C# DateTime also has kind-dependent suffixes.
  Normalize to common precision/forms or provide a codec for exact DateTimeOffset
  spelling; this slice does not implement the full C# timestamp input grammar.
- Arc.Go's UUID and calendar/duration scalars alias Fundamentals.Go's shared
  types; existing imports, constructors, parsers and wire formats are unchanged.
  `Concept[T]` is the shared interface declaration, recognized through cached
  `Underlying` metadata without executing application methods. Supply all four
  text/JSON codecs; marker-only and nested concepts fail preflight with inspectable
  Fundamentals errors. Unlike C# inheritance and converter-created instances, Go
  uses explicit methods and constructors. HTTP text binding and bounded discovery schemas are implemented; generated schema
  and proxy metadata remain later work.
- Use invariant calendar text and dashed UUIDs. Go deliberately does not guess a
  server culture. Input forms outside those documented codecs must be normalized
  by the caller or a custom codec.
- Paging totals outside the int32 page-count range return MinInt32; avoid such
  metadata. C# uses an unchecked conversion whose overflow behavior is not certified
  by these fixtures. In-range calculations follow its double-precision ceiling.
- Arc's naming policy preserves leading acronyms (`ID`, `URLValue`). Add `json:"id"`
  explicitly where the wire name should be lowercase. Plain `encoding/json` does
  not implement Arc's model policy; use `serialization.Marshal`/`Unmarshal`.
- Foundation serialization is a bounded explicit-registration fallback, not the
  future generated descriptor codec. Exported embedded fields use standard Go
  promotion; nil unexported embedded pointers cannot be allocated during binding.
  Go omission tags honor `IsZero` and standard empty-kind rules. JSON/text codecs
  own their behavior; pointer-receiver marshalers require addressable values.
  Nil model slices/maps/pointers are omitted like C# null properties; initialize
  slices/maps when an empty collection must be present. Framework envelope arrays
  are separately normalized to `[]`.
  Arbitrary Unicode escaping/property order is not a byte-identity promise; literal
  scalar fixtures and canonical envelope bytes are the tested boundary.

## Next slices

ARC-GO-04 provides immutable execution metadata and explicit service scopes;
05 provides typed validation and container-neutral security foundations; 06/07
provide backend command/query execution through manual typed adapters; 08 adds
hosting. Scoped policies and validators can resolve through guarded optional DI
resources. Generated adapters and source diagnostics remain unfinished: issues
[10](https://github.com/Cratis/Arc.Go/issues/10) and
[13](https://github.com/Cratis/Arc.Go/issues/13) are partially delivered, and
[12](https://github.com/Cratis/Arc.Go/issues/12) is not complete until required
generated examples pass. Historical paired HTTP and real
browser consumers belong after those boundaries exist. Chronicle integration must
use Chronicle.Go's transaction participant/owner contract, not a second Arc UoW.