Arc (Release v20.60.0): New ICommandExecutionScope extension point — implementations are discovered automatically and participate in every command’s execution, beginning before the command runs and completing exactly once, in isolation, with the final CommandResult.
Arc (Release v20.60.0): Documentation for transactional commands and command execution scopes.
Studio (Release v0.10.1): Every toolbar and dialog renders on liquid glass, refracting the content behind it
Studio (Release v0.10.1): The top-right user and settings buttons fan out vertically with the metaball pour effect
Studio (Release v0.10.1): An Appearance page in the user dialog with six subtle selectable backgrounds and liquid-glass tuning sliders, previewed live over a module/feature/slice mock with a glass toolbar and dialog; choices persist in the browser
Studio (Release v0.10.0): Avatars are stored in object storage on the managed storage service, organized per tenant with Users and Personas folders
Studio (Release v0.9.0): The organization settings users page lists pending invitations with the invited email, role and time, and lets maintainers revoke them; revoking removes the pending invitation in Lobby so the emailed link can no longer be used
Studio (Release v0.9.0): Admin has a Vault page for navigating the compliance key store folder by folder, showing each secret’s version, creation time and masked values with an explicit reveal toggle
Studio (Release v0.9.0): Accepted invitations are now marked on the invitation’s own stream, so pending listings drop them automatically
Studio (Release v0.9.0): Every mail send is logged with the SMTP server response, making silent provider-side drops diagnosable
Screenplay (Release v1.1.0): A new `specification` construct inside a `slice` — Given/When/Then test scenarios, following the same sub-language pattern as Projection and Capture (`ISpecificationSyntaxVisitor`, `CompileSpecification`/`CompileSpecification` on `IScreenplayCompiler`)
Screenplay (Release v1.1.0): `split` and `nested` operations in the Capture (CDL) language, plus richer `when` trigger forms (`and`/`or` combinators, value transitions, template-literal expressions) and a `map` block on `children`
Screenplay (Release v1.1.0): `ICaptureSyntaxVisitor` and `CompileCapture`/`CompileCapture` on `IScreenplayCompiler` — Capture was previously parseable but had no visitor/compiler entry point, unlike Projection
Studio (Release v0.8.1): HashiCorp Vault deployed in production as Chronicle’s PII encryption-key storage, with the per-tenant keys bundled into every backup archive
Studio (Release v0.8.1): A migration script that moves the existing encryption keys from MongoDB into Vault, so PII encrypted before the switch stays readable
Studio (Release v0.8.0): Liquid-glass rendering for Core’s toolbars, dialogs and wizards — a WebGL glass surface with edge refraction, frost and chromatic aberration behind the existing components, adopted by swapping only import paths
Studio (Release v0.8.0): An About dialog with the Cratis Studio logo, copyright and running version/build, opened from a new (i) button in the top-right toolbar
Studio (Release v0.7.3): Rolling per-service/per-tenant backups every hour with a grandfather-father-son rotation: 24 hourly, 6 daily, weekly, monthly and yearly archives per tenant (#776)
Studio (Release v0.7.3): Vault-held PII encryption keys are exported per tenant and bundled inside each backup archive, so a restored event store can decrypt its data (#776)
Studio (Release v0.7.3): Avatars show for users and personas everywhere a person appears — slice assignment, chat/comments and brainstorming — with an initials fallback in a consistent per-person color
Studio (Release v0.7.3): Year dropdown and Hours/Days/Weeks/Months/Years filters on the Admin Backups page, matching the rolling backup structure (#776)
Screenplay (Release v1.0.0): Cratis.Screenplay NuGet package - the compiler for the Screenplay language: parser for the full grammar, plain data syntax tree, one visitor contract per language level (IApplicationSyntaxVisitor<T> through IProjectionSyntaxVisitor<T> and IConstraintSyntaxVisitor<T>), diagnostics with source positions, **/*.play file discovery and a compiler style diagnostic formatter
Screenplay (Release v1.0.0): Cratis.Screenplay.Tool NuGet package - the screenplay dotnet tool that finds and compiles every .play file beneath a directory and reports problems with source excerpts and carets
Screenplay (Release v1.0.0): Standalone projection compilation entry point for compiling the projection sub-language outside an enclosing slice
Screenplay (Release v1.0.0): Projection language reference as a sub-section of the Screenplay language documentation, plus a Compiler and CLI page covering installation and use
Studio (Release v0.7.2): Per-database backups organized per service and tenant: tenant databases go in {service}/{tenant}/, shared and default-tenant databases in the service root, with configurable schedule, retention, and volume size (#776)
Studio (Release v0.7.0): Translator slices can select events from other modules as external events to translate from (#636)
Studio (Release v0.7.0): Translator slices can add newly produced events directly in the event row, just like State Change slices (#636)
Studio (Release v0.7.0): Copy schema between a Translator’s command and its produced event, in both directions (#636)
Studio (Release v0.6.0): Hovering a slice now emphasizes it and every slice connected to it through produced→consumed event links, while fading the unrelated slices, so a slice’s reach across the model is visible at a glance (#304)
Studio (Release v0.6.0): A connection badge on a slice’s header whose tooltip lists which events the slice produces and consumes and to and from which slices (#304)
Studio (Release v0.5.0): Dragging a slice in the event model editor now validates whether the events it consumes are produced before the drop position. When a referenced event would not yet exist at that position, the drag ghost is shown in red with a stop sign and the reason (the missing events) beneath its header. Valid drops keep the neutral ghost, and the drop itself is not blocked. (#553)
Studio (Release v0.4.0): In a specification’s Then section, you can now add a specific command validation rule or event constraint as an expected error, in addition to a generic named error. The stored error references the rule or constraint by identity, so it keeps showing the correct name even after the rule or constraint is renamed. (#654)
Studio (Release v0.3.0): Release history: returning users are shown the release notes for versions published since their last visit — opening on the newest release with arrows to page back through the others, and a “Show all releases” toggle to browse the full history. First-time users see nothing; the last seen version is remembered in local storage. (#754)
Studio (Release v0.3.0): Release notes are served as static content at /release-notes (per-version markdown plus any referenced images) and are included in the Docker image.
Studio (Release v0.3.0): The release pipeline generates each version’s notes from the merged pull request description, downloading referenced images into the version folder as relative paths and appending the version to a manifest, then commits them so the release ships its own notes.
Studio (Release v0.2.0): First-time beta notice: a one-time welcome dialog shown the first time a user opens Studio, explaining that it is beta software with bugs and partially implemented features. The acknowledgement is remembered per browser in local storage, so the dialog appears once and never again. (#755)
Arc (Release v20.59.0): IAuthorizationQueryFilter for marking a query filter to be evaluated before other query filters.
Arc (Release v20.58.0): ArcOptions.ExposeExceptionDetails to control whether command and query error responses include exception messages and stack traces. It defaults to enabled only in the Development environment.
Arc (Release v20.58.0): IValidationFailure — an exception implementing it is surfaced as a command validation failure (HTTP 400) instead of a server error, so code that runs inside the command pipeline can reject a command as invalid by throwing.
Arc (Release v20.58.0): New analyzer ARC0013 — warns when a validator rule dereferences a member of a possibly-null concept (for example RuleFor(c => c.Order.Value)), which throws at validation time instead of producing a validation error. Validate the concept first, or guard the rule with .When(...).
Arc (Release v20.57.0): New analyzer ARC0013 — warns when a validator rule dereferences a member of a possibly-null concept (for example RuleFor(c => c.Order.Value)). Because model-bound input can be deserialized with a null concept, the rule throws at validation time instead of producing a validation error; the analyzer flags it in the editor and points to the fixes (validate the concept when required, or guard the rule with .When(...)).
Arc (Release v20.56.0): Queries can now be invoked with the HTTP QUERY method (RFC 10008), sending arguments, paging and sorting as a JSON request body instead of the URL query string — useful for large or sensitive query arguments that don’t belong in a URL.
Arc (Release v20.56.0): [QueryHttpMethod] attribute on a read model or a static query method declares the client transport in C#; it flows through proxy generation so the generated proxy uses that method by default (a method-level attribute overrides a read-model-level one).
Arc (Release v20.56.0): On the client, opt in per query with query.setHttpMethod(QueryHttpMethod.Query), globally with Globals.queryHttpMethod, or with QueryHttpMethod.Auto which prefers QUERY and falls back to GET (remembering the outcome per backend).
Arc (Release v20.56.0): Globals.queryHttpMethodResolver for choosing the transport per request, with a built-in lengthBasedQueryHttpMethod policy that keeps short queries on GET and prefers QUERY only when the URL would exceed a threshold.
Arc (Release v20.56.0): ArcOptions.GeneratedApis.EnableQueryHttpMethod (default true) to disable the QUERY endpoints and restrict queries to GET only.
Arc (Release v20.56.0): ISystemExecution for executing [Roles]/[Authorize] commands from server-side or background code (reactors, hosted services, sagas, command-to-command) as a trusted system actor carrying named roles, via an explicit using systemExecution.AsSystem(...) scope.
Arc (Release v20.56.0): [ExecuteCommandsAsSystem] attribute to run a reactor’s returned commands under declared roles automatically — opt-in; reactors without it are unchanged.
Chronicle (Release v16.1.1): Optional dedicated health endpoint port (Cratis:Chronicle:Health:Port) that publishes the health endpoint on its own HTTP/1.1 port, with TLS optionally disabled (Health:Tls) for orchestrator and load-balancer probes that cannot validate a self-signed certificate. When unset, the health endpoint stays on the main port.
Chronicle (Release v16.1.1): skipTlsValidation connection-string option (and SkipCertificateValidation on the client TLS options) to connect over TLS without validating the server certificate — for a trusted server on a trusted network. The built-in development connection string enables it so development works against the server’s self-signed certificate.
AuthProxy (Release v2.6.0): Invite.EmailClaim configuration (default email) naming the invite-token claim that carries the email an invitation was issued for. Set it to an empty string to disable email-binding enforcement.
AuthProxy (Release v2.6.0): invitation-email-mismatch.html well-known page, served (HTTP 403) when the signed-in account’s verified email does not match the invited email.
Chronicle (Release v16.0.5): Tls:Enabled=false runs Chronicle in cleartext: h2c gRPC on the main port and the Workbench, REST API, OAuth and health surface on ManagementPort (8080 by default). Use it when TLS is terminated upstream by a load balancer/ingress, or for local development with no certificate.
Chronicle (Release v16.0.5): Optional HealthPort exposes the /health endpoint on a dedicated plaintext port for orchestrator and load-balancer probes, while gRPC, the API and OAuth stay on TLS on the main port.
Studio (Release v0.1.1): Profile avatars are now served in multiple cached sizes (original, medium, small).
Studio (Release v0.1.0): Profile avatars are now served in multiple cached sizes (original, medium, small).
Arc (Release v20.60.0): Every model-bound command now runs in a transactional scope. The events a command returns from Handle() — and appends made through the explicit eventLog.Transactional style — commit atomically when the command succeeds and roll back if it fails for any reason, in both the all-in-one AddCratis setup and AddCratisArc().WithChronicle(). Constraint and concurrency violations from the commit surface on the CommandResult, attributed to the offending member so a form can attach the message to its field.
Arc (Release v20.60.0): Appends through an injected IEventLog behave identically to IEventStore.EventLog and every other event sequence — immediate and final, returning the real AppendResult — and are never silently swallowed: a failed immediate append during a command fails the command. Previously such a failure could be discarded, leaving the command reporting a false success.
Studio (Release v0.8.3): The About dialog shows the Cratis Studio wordmark in white instead of the logo mark on a tile, is titled ‘About’, and centers its Ok button
Studio (Release v0.8.3): A ‘Release notes’ link in the About dialog opens the release notes dialog with the full release history
Screenplay (Release v1.1.0): Capture’s `map`/`split` source values are now a full expression (property path or template literal) instead of a plain string, matching how Projection and capture `append` mappings already work
Studio (Release v0.8.0): The version info badge in the lower-right corner is replaced by the About dialog
Studio (Release v0.7.3): Backup archives are one bundle per organization per time slot instead of one timestamped file per database, and the Admin Backups page navigates them as folders with friendly slot names (#776)
Studio (Release v0.7.3): Uploaded avatars are stored on a persistent volume in production instead of the container filesystem, so they survive restarts and rollouts
Chronicle (Release v16.3.1): The projection declaration compiler now uses the Cratis Screenplay compiler for parsing; ILanguageService.Compile, code generation and PDL round tripping behave as before
Chronicle (Release v16.3.1): $causedBy identity property references are camelCase (subject, name, userName), consistent with the well known expressions
Chronicle (Release v16.3.1): Namespace qualified projection names round trip through compile and generate
Chronicle (Release v16.3.1): The projection language reference moved to the Screenplay documentation; Chronicle’s pages and the Workbench help panel link there
Screenplay (Release v1.0.0): The publish workflow now also publishes the NuGet packages using trusted publishing, and pull requests build and test the .NET solution
Studio (Release v0.7.0): External event cards now use a distinct light green so they read as external events wherever they appear (#636)
Studio (Release v0.3.2): Chat boxes and comments now show a user’s full display name, never their email address (#731)
Studio (Release v0.3.2): The brainstorming chat shows “You” for the current user and the display name for others, consistent with the event-modeling chat, and derives initials avatars from the resolved name (#640)
Arc (Release v20.59.0): Query filters now short-circuit on the first blocking verdict, and authorization filters run before other query filters, so an unauthorized-and-invalid query consistently returns 403 Forbidden.
Arc (Release v20.59.0): An observable query that has not yet produced its first result is now reported as not ready (202 Accepted, no exception, new isReady flag on the query result) rather than an error-shaped result, so callers no longer read a pending query as a crash.
Arc (Release v20.59.0): Behavior change: a command carrying a non-nullable concept property that arrives null is now rejected with 400 Bad Request. Previously such a command could succeed if its handler never dereferenced the value. Declare the concept nullable (Concept?) to keep it optional; the event source key is exempt.
Chronicle (Release v16.2.0): [PII] values are now protected with hybrid AES-256-GCM envelope encryption (a fresh per-value data key wrapped by the per-subject RSA key) instead of raw RSA. Values written by earlier versions continue to decrypt transparently.
Arc (Release v20.56.0): Every generated query endpoint now also accepts the QUERY method alongside GET; the GET behavior is unchanged. The OpenAPI/Swagger document notes the QUERY option on each query operation.
Arc (Release v20.56.0): [Roles]/[Authorize] commands can now be authorized from non-HTTP callers through the new server-side execution scope. HTTP requests are unaffected — the request principal stays authoritative and request data can never enter the scope.
Arc (Release v20.55.0): MVVM now defers MobX reactions to a microtask by default, so an observable that resolves mid-render no longer triggers React’s “Cannot update a component while rendering a different component” error. The default is overridable through the mobxreactionScheduler option.
Studio (Release v0.1.4): The Core, Admin, and Lobby images build for amd64 only — production runs on amd64 nodes, and the arm64 leg only ran under QEMU emulation, which is slow and crash-prone.
Chronicle (Release v16.1.1): The .NET client now validates the server certificate by default. A self-signed or otherwise untrusted certificate is rejected unless validation is skipped or a matching client certificate is configured.
Chronicle (Release v16.1.0): Fluent projection accessors that are not a simple member access (string interpolation, arithmetic, method calls, constants, or expressions that ignore the parameter such as _ => DateTimeOffset.UtcNow) now throw a descriptive InvalidPropertyExpression at definition time instead of silently mapping to nothing. This applies across the whole fluent projection surface — value/key accessors and target-property selectors. A projection that relied on such an accessor was already projecting nothing; it now fails loud at registration.
AuthProxy (Release v2.6.3): The publish pipeline now fails loudly if the frontend build output is empty, instead of silently shipping an image without the frontend.
AuthProxy (Release v2.6.1): Invite.EmailClaim now defaults to empty, so gateway email-binding enforcement is off by default. Set it (for example to email) to require the authenticated account’s verified email to match the invited email at the Phase-2 exchange. The verified email is forwarded to the exchange endpoint regardless of this setting, so the backend can still enforce the binding itself.
AuthProxy (Release v2.6.0): The Phase-2 invite exchange request now forwards the authenticating account’s provider-verified email and its verification status, so the backend can apply its own defense-in-depth check of invited-email vs. authenticated-email at accept time.
Chronicle (Release v16.0.5): The startup error for a missing production certificate now states that TLS can be disabled with Tls:Enabled=false, rather than only that a certificate is required.
Arc (Release v20.60.0): An unknown sortby field on a MongoDB-backed query now degrades to unsorted results instead of failing with an HTTP 500, matching the Entity Framework Core provider’s behavior.
Arc (Release v20.60.0): A failure while completing a command’s transaction — for example the event store being unreachable at commit — now surfaces as an exception outcome on the CommandResult instead of escaping as a raw exception to programmatic callers.
Studio (Release v0.10.4): Glass surfaces on the modeling canvas refract real content again instead of a black rectangle, and the selected background now shows through the canvas
Studio (Release v0.10.4): Zoomed canvases no longer displace what glass refracts, and panning/zooming no longer re-rasterizes the page per frame
Studio (Release v0.10.4): Toolbar sections and groups render as separate glass pills with real gaps, merging like metaballs as layouts morph; the canvas zoom controls are on glass; the prototype toolbar’s folder menus pour like metaballs
Studio (Release v0.10.4): Scene captures are skipped when the change is beyond every glass surface’s reach
Studio (Release v0.10.4): The appearance preview dialog is draggable to see the glass bend content behind it
Studio (Release v0.10.4): Personas and user profiles share one identical avatar upload flow with crop preview and selection
Studio (Release v0.10.4): Vault navigation in Admin responds to plain clicks through service, tenant and key levels
Studio (Release v0.10.4): Backup timestamps show the server’s own time, and Vault key exports appear beside every backup slot as their own downloadable files
Studio (Release v0.10.3): Glass surfaces no longer refract content from far away on the modeling canvas: the canvas composites as its own glass scene layer, drawn at its true on-screen rect, so CSS zoom no longer displaces the refraction
Studio (Release v0.10.3): Panning and zooming the canvas is pure GPU compositing - no more full-page re-rasterization per frame, which is what made the glass feel slow and jerky
Studio (Release v0.10.2): Selecting a background in the Appearance page now visibly applies everywhere - it paints on the body beneath every page, and glass surfaces refract it like the demo’s wallpaper
Studio (Release v0.10.2): The metaball fan-out treatment moved to the event modeling top bar’s view-options and menu fan-outs (opening downward); the user and settings buttons are plain toolbar buttons again
Studio (Release v0.10.0): Chat bubbles in the brainstorming editor and slice comments show the author’s real initials (from their display name, never a generic ‘You’) and a fallback color that deterministically follows the user
Studio (Release v0.10.0): Uploaded avatars no longer disappear on pod restarts or node moves
Studio (Release v0.8.1): Service images failed to build in the release pipeline after the liquid-glass package was introduced — the workspace and the new postinstall script are now part of the image build context
Studio (Release v0.8.0): Canvas zoom no longer goes blurry beyond 100% in Safari — zooming re-rasterizes at the effective resolution instead of stretching a fixed texture (#779)
Studio (Release v0.8.0): The observable-query SSE stream no longer drops roughly every minute in production, which made the whole UI flicker as every query resubscribed — the load balancer and ingress now keep long-lived streams alive
Studio (Release v0.7.3): Inviting a user from Organization settings now produces the invitation email and reaches the Lobby (the event never left the tenant’s own outbox before)
Studio (Release v0.7.3): Invitation emails are no longer sent multiple times when the service reconnects
Studio (Release v0.7.3): Uploading an avatar no longer crashes with an HTTP 500 (missing native font library in the container image)
Studio (Release v0.7.3): Uploading a persona avatar now works — the image appears immediately and no longer breaks persona lists after an upload
Studio (Release v0.7.3): Cluster-level MongoDB snapshots to object storage were failing on every run since day one because the storage service had no network endpoint; the endpoint is now derived from the provisioned service (#776)
Studio (Release v0.7.3): Brainstorming chat bubbles no longer enter an accidental edit mode on double-click
Studio (Release v0.7.3): The backup file table no longer renders a stray “false” on folder rows
Screenplay (Release v1.0.3): $causedBy.userName is now the accepted form for the username identity property, consistent with the camelCase well known expressions (subject, name, userName)
Studio (Release v0.7.2): The Admin Backups page failed to load its listing entirely; it now lists and downloads all backup archives from the backup volume (#776)
Studio (Release v0.7.2): Frontend Docker image builds (Core, Admin, Lobby) failed resolving PrimeReact 11 themes; PrimeReact stays on 10.x and PrimeIcons on 7.x until the theming migration
Studio (Release v0.7.1): Accepted organization invitations are now removed from the Admin invitations list; previously they lingered because the removal was bound to a Lobby inbox event the projection never observes.
Arc (Release v20.59.1): A command declaring more than one event-source-key concept now returns HTTP 400 (not a 500) when a secondary key arrives null, with the failure pointing at the offending field.
Arc (Release v20.59.1): Validation failures raised by a nested ConceptValidator<T> rule (for example RuleFor(x => x.Value)) now surface on the owning command form field. Previously the failure was reported against the concept’s inner Value member and was never displayed during write-time (blur/change) validation.
Studio (Release v0.3.2): Messages sent in a brainstorming chat are now attributed to the person who sent them rather than to the chat’s creator
Studio (Release v0.3.2): Profile pictures in chat were investigated and intentionally not wired up here. An avatar image endpoint already exists (GET /api/avatars/{userId}, backed by account profile avatars where the owner id is the user id), but none of the user models the chat consumes (AllUsers / StudioUser / StudioIdentityDetails) carry any “has avatar” flag or last-updated signal. Rendering avatars for arbitrary chat authors reliably (without a 404 request per avatar-less user and without a per-author query) needs that signal surfaced on the chat user model — a data-model addition that does not yet exist. This PR renders consistent initials avatars and leaves profile-picture support as a follow-up that requires that data source; no placeholder source was fabricated.
Studio (Release v0.3.1): The Given ”+” event picker in a State Change specification now offers only events that are produced (owned) by this slice and the slices before it, unique by their id — consumed/referenced events are no longer listed and an event is never shown twice (#620).
Studio (Release v0.3.1): A Given event placed in a specification now shows the event’s current name, resolved from the event by a stable id, so renaming the event updates the placed item and the picker — immediately and after a browser refresh — instead of keeping the name it was added with (#648).
Arc (Release v20.59.0): A command that receives a wrong-typed value for a Guid-, number-, or enum-backed concept property now returns 400 Bad Request instead of 500.
Arc (Release v20.59.0): Omitting a required (non-nullable) concept from a command now returns 400 Bad Request identifying the field, instead of 500.
Arc (Release v20.59.0): A command that depends on a must-exist read model which does not exist for its identifier now returns 400 Bad Request instead of a 500 that revealed the read model type.
Arc (Release v20.59.0): A query filter that throws no longer crashes the whole query into a 500, and a denied query can no longer be turned into a 500 by a later filter.
Arc (Release v20.59.0): Out-of-range or hostile paging on an observable query no longer overflows into a server error.
Chronicle (Release v16.2.1): An unset optional (nullable) scalar on a read model now materializes as null/absent instead of a type-default sentinel — e.g. a DateTimeOffset? no longer reads back as 0001-01-01 when its source event never fired, and an int? no longer reads back as 0.
Arc (Release v20.58.1): A command that fails role authorization now returns 403 Forbidden even when the command is also invalid, instead of a 400 validation error.
Arc (Release v20.58.0): Malformed or wrong-typed command request bodies now return HTTP 400 instead of HTTP 500.
Arc (Release v20.58.0): A command validator that throws while validating hostile or partial input now returns a validation error (HTTP 400) instead of HTTP 500.
Arc (Release v20.58.0): A command that targets an aggregate but provides no usable event source id now returns a validation error (HTTP 400) instead of crashing with HTTP 500, with a client-safe message that does not leak the read model type.
Arc (Release v20.58.0): A throwing command filter no longer aborts the filter chain or masks an earlier authorization result — a forbidden request now returns HTTP 403 instead of HTTP 500.
Arc (Release v20.58.0): Observable queries no longer fail with HTTP 500 (or leak the read model type name) on an unknown sort field, and now clamp a non-positive page size to a valid page — for both MongoDB and Entity Framework Core read models.
Chronicle (Release v16.2.0): [PII] values longer than ~245 bytes (long free-text fields, images) no longer throw a CryptographicException at append time — arbitrary-length PII now encrypts and decrypts.
Chronicle (Release v16.2.0): A root-level [Join] whose source stream key type differs from the read model’s key (for example a string organization number joined onto a Guid-keyed root) no longer permanently freezes the observer partition with an “Unrecognized Guid format” error, and no longer materializes a phantom root document keyed by the join value; the join backfills when the real entity row appears.
Chronicle (Release v16.2.0): IReadModels.GetInstanceById now returns null for an unseeded reducer-backed read model instead of throwing, matching projection-backed read models — so a reactor’s nullable pre-check no longer throws and freezes the partition.
Chronicle (Release v16.2.0): EventScenario (in Cratis.Chronicle.Testing) now short-circuits a multi-event Events(...) append on the first rejected event, returning that failed AppendResult instead of continuing and masking the rejection with a later event’s success.
Arc (Release v20.55.0): Observable (SSE/WebSocket) queries with a ConceptAs<T> parameter no longer fail — query arguments are now coerced to their declared parameter types on the streaming path, matching one-shot queries.
Arc (Release v20.55.0): A command whose Handle() returns a boxed IEnumerable<object> of EventForEventSourceId wrappers, or a mixed collection of plain events and wrappers, now appends the events instead of silently reporting success with nothing appended.
Arc (Release v20.54.6): Added a missing index.md landing page for the Reactors docs folder — it had a toc.yml and one topic page but no landing, so its bare URL 404’d and broke the Documentation site’s internal link check.
Studio (Release v0.1.5): Tenant resolution now works for the whole request pipeline — identity, authorization, queries, commands, and read models all bind to the signed-in user’s organization namespace instead of silently falling back to the shared Default namespace.
Studio (Release v0.1.5): The tenant header lookup is case-insensitive, tolerating HTTP/2 lowercasing of header names.
Studio (Release v0.1.4): Merging a labeled pull request produces a release again — the publish workflow token can now read pull requests to resolve the merged PR and its semver label.
Studio (Release v0.1.4): Docker image builds restore the extracted Prologue (1.0.2) and Stage (1.0.1) packages from nuget.org instead of failing on the unpublished 1.0.0 pins.
Arc (Release v20.54.5): Restore/build failure from a Cratis.Metrics.Roslyn package downgrade after updating to Cratis.Chronicle 16.1.0
Chronicle (Release v16.1.0): Observable read-model queries (ObserveById / ObserveSingle / live queries) now decrypt [PII] values when the projected document carries no explicit __subject, resolving the compliance subject the same way one-shot queries do.
Chronicle (Release v16.1.0): ReadModelScenario<T> now backfills a [Join] value regardless of seed order, for both root-level and child-collection joins and any key type.
Fundamentals (Release v7.16.6): The Types constructor no longer crashes application startup when a provider’s DefinedTypes or SelfBindings sequence throws TypeLoadException during enumeration (for example a generated provider referencing a type that a resolved assembly version no longer contains). The elements collected before the failure are kept and discovery continues.
Fundamentals (Release v7.16.5): Type discovery (ContractToImplementorsMap) no longer aborts the whole scan — and the process — when inspecting a type whose base or interface types throw TypeLoadException (for example when a referenced assembly resolves to a version that no longer contains a referenced type). The unloadable type is skipped and the remaining types are still discovered.
Fundamentals (Release v7.16.5): ProjectReferencedAssemblies now tolerates assemblies whose DefinedTypes fail to enumerate, matching the existing behavior of PackageReferencedAssemblies.
AuthProxy (Release v2.6.3): The React frontend is now built into the AuthProxy web root and bundled into the published image, instead of being written to a stale Ingress path and dropped.
Chronicle (Release v16.0.6): A model-bound [Join] whose key is an AutoMapped foreign key now resolves its joined value when the read-model row is created after the join-source event already exists. Previously these columns were left empty whenever the join source (e.g. an activated engagement) preceded the row-creating fact (e.g. an approved timesheet) — the common production ordering.
Chronicle (Release v16.0.5): Tls:Enabled=false no longer crashes the server on startup — it now produces a working plaintext server, matching the property’s documentation.
Studio (Release v0.1.1): Account Profile fields (name, middle name, last name, display name, bio, email) can now be edited and saved — the form previously accepted no input.
Studio (Release v0.1.1): Uploading a profile avatar no longer fails.
Arc (Release v20.54.3): CommandForm now calls the validateClientSide for validating things when the automatic serverside validation is turned off.
Chronicle (Release v16.0.4): Active (non-passive) read models with [PII] persisted to a SQL sink (PostgreSQL, SQL Server, SQLite) stalled and never materialized out of process — the query returned null indefinitely with no error or observer quarantine, and PII could fail to decrypt on read. MongoDB-backed read models were unaffected. (#3463)
Studio (Release v0.1.0): Account Profile fields (name, middle name, last name, display name, bio, email) can now be edited and saved — the form previously accepted no input.
Studio (Release v0.1.0): Uploading a profile avatar no longer fails.
Chronicle (Release v16.0.3): Fixed lock contention in the client’s scoped IEventStore resolution: a single process-wide lock serialized every resolution across all namespaces and requests, and held that lock across a blocking call, which could stall unrelated requests and surface as Cannot access a disposed object: GrpcChannel under concurrent load.
Chronicle (Release v16.0.3): Fixed an activation access violation in the projection replay job step (HandleEventsForObserver): it read the ambient Grain.GrainFactory property from code that runs off the grain’s activation thread, throwing “Activation access violation” and leaving the observer stuck without processing new events even though they were present in the log.
Chronicle (Release v16.0.3): [x] dotnet build (Debug + Release) for the affected client and kernel projects — zero warnings, zero errors
Chronicle (Release v16.0.3): [x] Verified against a downstream consumer app under Aspire-orchestrated concurrent startup — repeated onboarding flow runs now produce identical, deterministic pass/fail results instead of the prior non-deterministic 6-10/30 range with silent disposed-channel failures
Studio (Release v0.8.2): The liquid glass rendering of toolbars, dialogs and wizards — the chrome goes back to the standard Cratis Components look
Chronicle (Release v16.3.1): The internal PDL tokenizer, parser and AST - replaced by the Cratis.Screenplay syntax tree and visitor contracts
Chronicle (Release v16.1.1): The client disableTls connection-string option and the WithTlsDisabled/WithTlsEnabled builder methods. The server always serves TLS, so a plaintext client connection no longer connects to anything.
Arc (Release v20.58.1): Validation detail is no longer returned to a caller who is not authorized for a command endpoint — authorization is decided before validation runs.
Arc (Release v20.58.0): Exception messages and stack traces are no longer returned to clients in command and query responses outside the Development environment. The full detail is logged server-side and the correlation id is retained, so failures can still be traced without leaking internal information.
Chronicle (Release v16.1.1): The client no longer implicitly accepts self-signed or name-mismatched server certificates in production; validation must be skipped explicitly via skipTlsValidation.
AuthProxy (Release v2.6.0): Re-validate the invite token (RSA signature, issuer, audience, and lifetime) at the Phase-2 exchange forward and refuse to forward when it fails. HTTP-only cookies only block browser JavaScript, so an authenticated caller could otherwise hand a self-crafted token to the exchange endpoint.
AuthProxy (Release v2.6.0): Bind an invitation to its recipient: when the invite token targets a specific email, require the authenticating account’s verified email to match (respecting email_verified) and reject on mismatch, so an invitation can no longer be redeemed with a different account.
