Arc (Release v22.10.5): Chronicle 16.40.0: ChronicleOptions.RegistrationRetry — registering a client’s artifacts is now retried with an exponential backoff instead of failing host startup when the Kernel is busy. Five attempts by default, 2s growing to 30s, all configurable (cratis/chronicle#3869)
Arc (Release v22.10.5): Chronicle 16.40.0: Failed partition attempts carry what kind of failure they were — Handling, Timeout, Disconnected or Unknown — surfaced through the client SDK and the Workbench API (cratis/chronicle#3869)
Arc (Release v22.10.5): Chronicle 16.41.0: Behavior pattern mining across every event flowing through an event store, using a bounded streaming sketch so storage scales with distinct recurring behavior rather than event volume (cratis/chronicle#3857)
Arc (Release v22.10.5): Chronicle 16.41.0: IPatterns.GetPatternsAt on the .NET client — a scope plus an optional moment defaulting to now, with the day and the part of the day derived using the same rule the engine bucketed events with when it mined them. GetPatterns remains underneath for a context that is not a moment.
Arc (Release v22.10.5): Chronicle 16.41.0: ToTimeBucket() on DateTimeOffset, the engine’s own bucketing rule, so an application asking about a moment does not have to carry a second copy of it — a copy that would drift silently, returning nothing rather than failing
Arc (Release v22.10.5): Chronicle 16.41.0: IPatterns.GetScopes on the .NET client and the Patterns gRPC service, listing the scopes that hold established patterns — what a browsing surface needs before it can offer one
Arc (Release v22.10.5): Chronicle 16.41.0: Behavior patterns in the Workbench: a pivot over everything established, across scope,
Studio (Release v0.97.0): An AI tab in the per-application settings overlay: a toggle switch for enabling AI use in that application’s kanban slice work (off by default), and — while enabled — a dropdown for the code generation process the backend allows: No code generation, Screenplay only code generation, or Screenplay with Agent on top (#312)
Studio (Release v0.97.0): AI icon-button capabilities across the app (e.g. the event-model and per-slice/feature/module/domain “generate” buttons) are now hidden entirely, not just disabled, whenever AI is disabled for their application
Studio (Release v0.97.0): Assigning a slice to an AI agent is now rejected — by the backend, independent of the UI — when AI is not enabled for the application; the slice/feature assignment pickers filter agents out of the candidate list accordingly
Studio (Release v0.97.0): Marking a slice “Ready for Implementation” is rejected by the backend when the slice is assigned to an AI agent and the application’s configured process is “No code generation”
Studio (Release v0.97.0): Code generation itself now honors the application’s configured process: it is skipped entirely when disabled, and “Screenplay only” always renders without agent involvement even when a slice happens to be assigned to an agent
Ante (Release v0.9.0): An optional Ante:HostOutcomeUrl backchannel: once configured, Ante can ask a host what happened to a specific onboarding attempt after Ante’s own publication (e.g. whether downstream provisioning succeeded or failed) via GET {url}/outcome?attempt={attemptId}. Left empty (the default), no lookup happens and every wizard behaves exactly as it does today. (#22)
Ante (Release v0.9.0): The lookup is authenticated and attempt-bound: it only ever answers for the verified owner of that exact attempt (ISignedInIdentity.IsVerifiedOwnerOf), and a non-owner, an unconfigured deployment, and an unreachable/malformed-response host all produce the identical “nothing to report” answer - it never reveals whether an attempt exists or leaks another actor’s outcome. (#22)
Ante (Release v0.9.0): The join and invited-organization-creation wizards show the host-reported outcome (pending/succeeded/failed, with a reason code on failure) on a completion screen once onboarding has published, with a “Continue” action that proceeds to the host on demand - never blocking, and never treating a host-reported failure as a failure of Ante’s own already-published onboarding. (#22)
Ante (Release v0.8.0): A locale-coordination module: a closed, versioned SUPPORTED_LOCALES set (English, en, today) with deterministic fallback for any unrequested/unsupported/malformed locale, applied to <html lang>/dir synchronously before first paint and threaded into CratisComponentsProvider (React Aria’s own dates/numbers/announcements). (#21)
Ante (Release v0.8.0): Locale-aware number formatting (Intl.NumberFormat-backed) wired into the stepper’s step-transition announcements (“Step 2 of 3”), the one place the lobby currently displays a formatted number. (#21)
Ante (Release v0.8.0): A trusted, lifecycle-managed loader for Ante:CustomCssUrl: loads via a real <link rel="stylesheet"> (never injected as text), deterministic ordering, deduplication, and a console-only failure fallback that leaves the default styling in place. Same-origin values are always allowed; cross-origin values must be https:; any other scheme is refused. (#21)
Ante (Release v0.8.0): A broken-image fallback for Ante:LogoUrl: a failed logo load now falls back to the neutral text wordmark instead of the browser’s broken-image icon. (#21)
Ante (Release v0.8.0): A minimal render-error recovery boundary wrapping the entire lobby, including provider initialization itself - degrades to a neutral, safe-language screen with a reload action on an uncaught render error, without ever surfacing the error’s message or stack. (#21)
Ante (Release v0.7.0): A small, versioned, closed-schema display-preferences module (text size, contrast, spacing, control size, motion) that applies deterministically before first paint, degrades safely on corrupt/future schema or denied storage, and stays in sync across same-origin tabs. (#20)
Ante (Release v0.7.0): A display-preferences menu (gear trigger + dialog) on all three onboarding journeys, reachable from the shared onboarding frame. (#20)
Ante (Release v0.7.0): ARIA tab/tabpanel semantics, step-transition focus, and a live-region step announcement on every onboarding CommandStepper, retrofitted at the app level since CommandStepper renders none of this and only reports step changes for header clicks - not Next/Previous (filed upstream as Cratis/Components#249). (#20)
Ante (Release v0.7.0): An error summary that takes keyboard focus the moment it appears, so a screen-reader user lands on it instead of finding it later by tabbing through the page. (#20)
Ante (Release v0.7.0): Semantic autocomplete on the name/organization fields, and a real <main> landmark with an <h1> heading on every onboarding frame. (#20)
Ante (Release v0.6.0): A bounded /healthz/ready readiness endpoint, separate from the existing /healthz liveness endpoint, reflecting MongoDB reachability with each dependency check individually bounded (3s) so a stuck dependency can never hang the whole probe. (#19)
Ante (Release v0.5.0): Ante deployments can now select a fixed Chronicle namespace independently of the event store, via Ante:Namespace — defaults to Chronicle’s own Default namespace, matching every existing deployment’s current behavior. (#18)
Ante (Release v0.5.0): Ante:InboxSourceStore lets a deployment declare which host store its inbox reactor is compiled against; a value that disagrees with the compiled constant fails startup loudly instead of being silently accepted and ignored. (#18)
Ante (Release v0.5.0): Ante now fails startup immediately, with a clear error, if Ante:EventStore or Ante:Namespace is left empty, or if Ante:InboxSourceStore cannot actually be honored by the current build. (#18)
AI (Release v0.10.0): Language-agnostic cratis-specification-by-example, so public-specifications stops resolving with zero skills of its own — naming, the for_/when_/and_ sentence path, layered given/ contexts, what not to specify, observable outcomes, and completion. Grounded in the CRSPEC0001–CRSPEC0007 analyzers, which make the same rules machine-enforced in C# (#174)
AI (Release v0.10.0): cratis-application-slice-specifications, cratis-chronicle-event-specifications and cratis-chronicle-read-model-specifications — the in-process scenario family, migrated from write-specs, write-specs-events and write-specs-readmodels (#174)
AI (Release v0.10.0): cratis-code-review, cratis-performance-review and cratis-security-review, migrated from the three legacy review skills (#174)
AI (Release v0.10.0): cratis-fundamentals-type-discovery, migrated from discover-implementations (#174)
AI (Release v0.10.0): cratis-arc-command-validation and cratis-chronicle-event-constraints — the two halves of add-business-rule, each with its own source file (#175, #177)
AI (Release v0.10.0): public-review and public-fundamentals-type-discovery profiles (#174)
Ante (Release v0.4.2): A Recorded status value on OrganizationSetupAcceptanceStatus and UserSetupAcceptanceStatus, between Pending and Accepted: a client that has submitted but is still waiting on publication now reads distinctly from one that never submitted at all, so it is never safe (or possible) to resubmit and never a dead end. (#17)
Ante (Release v0.4.2): A local “still processing” recovery phase, shared across all three wizards: after a bounded wait with no confirmation, the wizard offers “Check again” (resets the local wait without creating a new operation or restarting the flow) and directs to support - it never claims failure, and a later Accepted reading always wins and completes the hand-off automatically. (#17)
Ante (Release v0.4.2): RegistrationPage persists a versioned, opaque registration-id pointer per browser tab (sessionStorage) so a reload or a later return resumes the same durable registration - never a profile draft, identity claim, legal content, or token. Two tabs opened to /register each get an independent registration. A “Register a different organization” action supports deliberately starting a new one. (#17)
AI (Release v0.9.0): cratis-engineering-decision-record — how to consult, author, accept, and supersede a decision record in a repository’s decisions/ folder, including the closed status / stage / class / reversibility value sets and the two-way supersession contract (#250)
AI (Release v0.9.0): cratis-engineering-effect-boundaries — the effect-boundary contract: on publication, persistence, generation, propagation, and release, partial success is failure. No catch-and-continue, no defaulting to success on an unknown outcome. Grounded in the six real Cratis failure modes the 2026-08-24 review identified (#200)
AI (Release v0.8.0): cratis-chronicle-client-dotnet — connecting a standalone console, worker, or service without a host, assembly-scanning discovery, the registration wait, and the compatibility check Connect() now performs automatically. Verified against the Chronicle sources at tag v17.0.1. (#178)
AI (Release v0.8.0): cratis-chronicle-client-typescript — reflect-metadata and decorator setup, connection strings, @eventType(), eventLog.append, and the two conventions that decide whether a Node application works at all: handlers dispatch by camelCase method name, and artifact discovery is a runtime file glob that matches **/*.ts. Verified against Chronicle.TypeScript v4.0.0. (#178)
AI (Release v0.8.0): cratis-chronicle-client-kotlin — Gradle coordinates, the Spring Boot starter and its cratis.chronicle properties, @EventType classes, suspending append, ClassGraph discovery, and the blocking surface Java starts at. Verified against Chronicle.Kotlin v4.0.0. (#178)
AI (Release v0.8.0): cratis-chronicle-client-elixir — putting Chronicle.Client in a supervision tree, use Chronicle.Events.EventType, Chronicle.append/3 and its error tuples, reactors with @handles, model-bound read models, and waiting for the :registered lifecycle phase. Verified against Chronicle.Elixir v2.2.0, the version actually published on Hex. (#178)
AI (Release v0.7.0): cratis-lens-browser-extension — building and side-loading the extension, the /.cratis/* routes and forwarded-identity headers an Arc application must already serve, what an identity or tenant switch actually does, and the shape of the command and query requests the popup sends (#179)
AI (Release v0.7.0): cratis-screenplay-model-authoring — the .play file shape, the constructs the compiler accepts, the screenplay dotnet tool, and the boundary between what parses and what the executable semantic model admits (#179)
AI (Release v0.7.0): cratis-stage-rendering-and-sandbox — the CratisRendering facade, the STAGE-ESM admission rules, the generated artifact roster, and the cratis/stage and cratis/stage-specrunner containers (#179)
AI (Release v0.7.0): public-lens, public-screenplay and public-stage now ship content instead of a gap summary; public-modeling-screenplay-stage composes the two modeling profiles (#179)
Ante (Release v0.4.0): Legal-terms acceptance is now resolved authoritatively during command execution: LegalAcceptanceEvidence.Resolve reads the host’s ILegalDocumentSource exactly once per command and uses that single read for both rejecting the command and building the LegalTermsAccepted event, so the version recorded as evidence is always the version this resolution itself just confirmed - never merely the value the client submitted. (#15)
Ante (Release v0.4.0): A command that claims legal-terms acceptance while the host has no document source configured is now rejected instead of silently accepted - previously a client could set acceptedLegalTerms: true with nothing configured and an unsolicited LegalTermsAccepted event would still be appended. The shared preflight LegalTermsRules gained the mirror rule so the wizard’s eager /validate call surfaces the same rejection early. (#15)
Ante (Release v0.4.0): AcceptInvitation, SetupOrganization, and RegisterOrganization now validate FirstName/MiddleName/LastName through shared PersonalNameValidation rules: diacritics, combining marks, non-Latin scripts, apostrophes, hyphens, and the zero-width joiner/non-joiner some scripts need to render correctly are accepted, while Unicode control characters and text-direction-override characters are rejected, and each field is bounded to 100 characters (mirrored automatically into the generated client-side validator, so client and server agree on the limit). (#15)
Ante (Release v0.4.0): The three onboarding wizards now reset the legal-acceptance checkbox whenever the host publishes a new document version while a user is mid-flow, forcing a fresh review of the new text without touching the name fields already filled in.
AI (Release v0.6.0): cratis-arc-command — the [Command] record, how each Handle() return shape is dispatched, Provide(), what may reach the causation chain, and the generated proxy contract, with references for handler shapes, the command result, read-model injection and proxy generation (#175)
AI (Release v0.6.0): cratis-arc-command-execution — running an existing command through ICommandPipeline, its overloads, validation severity filtering and how to read a CommandResult (#175)
AI (Release v0.6.0): cratis-arc-query-paging — which read-model query return shapes Arc pages, the exact query-string contract, the per-provider sorting differences, and the paged frontend hooks (#175)
AI (Release v0.6.0): cratis-arc-observable-query-http — inspecting an observable query with plain HTTP, wait-for-first-result, Server-Sent Events or long polling, including the status codes and payload shape (#175)
AI (Release v0.6.0): cratis-arc-ef-core-migration — the DbContext base types Arc provides, what actually makes an EF Core read model injectable into a command, the cross-database column helpers, JSON columns, and the observation story (#175)
AI (Release v0.6.0): cratis-arc-authentication-authorization-and-identity — IProvideIdentityDetails and /.cratis/me, the three authorization attributes Arc evaluates, the forwarded-principal authentication contract, tenant resolution and the React identity surface, with references for authentication, authorization, tenancy, frontend and local development (#175)
AI (Release v0.5.0): Chronicle read model, projection, reducer, and reactor skills, on public-chronicle (#177)
AI (Release v0.5.0): Chronicle event modeling, event model diagram, and event type migration skills, on public-chronicle (#177)
AI (Release v0.5.0): A Chronicle namespace multi-tenancy skill, on public-chronicle-multi-tenancy (#177)
AI (Release v0.5.0): A cratis CLI operations skill covering contexts, connection resolution, machine-readable output, and the authorization discipline for replay, retry, and quarantine clearing, on public-cratis-cli (#177)
AI (Release v0.5.0): A Chronicle compliance skill covering [PII], [ComplianceDetails], compliance subjects, IPIIManager erasure and what crypto-shredding does to reads and writes, event redaction and revision, and IReadModels.Release, on public-chronicle-compliance (#177)
AI (Release v0.5.0): A browser Workbench skill covering screens, mutating operations, and the facts that decide whether to expose it, on public-chronicle-web-workbench (#177)
AI (Release v0.5.0): A terminal Workbench skill covering views, key bindings, the command palette, and its mutating actions, on public-cratis-cli-terminal-workbench (#177)
AI (Release v0.5.0): A Chronicle kernel tracing skill for contributors, on engineering-chronicle (#177)
Ante (Release v0.3.0): AcceptInvitation and SetupOrganization now reject a second acceptance of the same invitation at append time, via a Chronicle unique-event-type constraint (OneUseJoinTenantInvitation / OneUseCreateTenantInvitation) scoped to the invitation itself. This closes a race where two concurrent submits of the same invitation could both observe it as still pending before either append landed - a rejected second attempt now surfaces as a normal validation failure, never an exception. (#14)
Ante (Release v0.3.0): Organization-name uniqueness (UniqueOrganizationNameConstraint) now covers both InvitationToCreateTenantAccepted and OrganizationRegistrationCompleted under one coordinated constraint, so an invited tenant creation and a self-service registration can no longer claim the same name concurrently. (#14)
AI (Release v0.4.0): cratis-arc-react-page — DataPage list pages, toolbar menu items, command
AI (Release v0.4.0): cratis-components-toolbar — canvas-style icon toolbars, now including the
AI (Release v0.4.0): cratis-components-stepper-command-dialog — multi-step wizard dialogs,
AI (Release v0.4.0): cratis-application-react-specifications — Vitest, Sinon, and Chai should
AI (Release v0.4.0): cratis-components-schema-editor — SchemaEditor and ObjectContentEditor,
AI (Release v0.4.0): cratis-components-styling — the stylesheet imports an app must make, the
AI (Release v0.4.0): cratis-components-accessibility — dialog initial-focus discipline and the
AI (Release v0.3.0): cratis-specifications-csharp — C# Specification by Example with Cratis.Specifications: the Establish/Because/should_ pattern, the for_/when_/and_ hierarchy, reusable given/ contexts, the four in-process scenario helpers, and out-of-process Chronicle integration. Available through public-specifications-dotnet (#174)
AI (Release v0.3.0): cratis-specifications-typescript — TypeScript specifications with the given() helper, context classes, Sinon stubbing, and the Chai .should interface. Available through public-specifications-typescript (#174)
AI (Release v0.3.0): cratis-engineering-csharp-conventions — the Cratis C# house conventions: formatting, naming, records and primary constructors, nullable handling, XML documentation, custom exceptions, structured logging, dependency injection and service lifetimes, and the CUPID/domain-based philosophy. Available through engineering-base, and inherited by engineering-specifications (#174)
AI (Release v0.2.0): skills/cratis-governed-release-methodology/SKILL.md: real, actionable release-engineering methodology — picking an assurance tier before picking checks, what each supply-chain receipt (checksums/provenance/SBOM/canary/recovery) actually proves and for which artifact types, the eight-rung evidence ladder, the ten lifecycle phases a real install cycle must cover, semver release-intent labeling, and a non-circular release-path structure where no step can vouch for itself
AI (Release v0.2.0): profiles/public/public-methodology-governed-releases.json: a standalone leaf profile (composes nothing, is composed by nothing — same deliberate decoupling as the language profiles) so selecting it never implies a specific product or language
AI (Release v0.2.0): A resolver regression spec asserting the profile pulls in exactly its one skill and nothing else
Ante (Release v0.2.0): The invitation exchange now rejects a token whose exp claim is missing or already in the past, instead of recording a session that would authorize forever.
Ante (Release v0.2.0): The recorded session carries its own expiry (ExpiresAtUtc), copied verbatim from the token’s exp claim, so retrying the exchange with the same token - at-least-once delivery from the authentication proxy, a user double-submitting, a lost response - converges on the same session instead of creating a duplicate or extending its lifetime.
Ante (Release v0.2.0): InvitationIdentityProvider’s session fallback now stops honoring a session the instant it expires, independent of whenever a storage cleanup sweep gets around to removing it.
Ante (Release v0.2.0): A unique index backstops the single-session-per-login invariant, and a TTL index cleans up expired sessions in storage; both are installed at startup before the exchange endpoint is exposed to traffic.
Studio (Release v0.96.0): Named, parametrizable queries (e.g. AuthorById(id)) can now be declared on a State View slice’s read model, with a lightweight authoring dialog reachable from the slice header (#26)
Studio (Release v0.96.0): A State View slice’s read model can be marked as materializing (projected and persisted) or passive (computed on demand), toggled directly from the read model card (#21)
Studio (Release v0.96.0): A feature’s rendered content on the canvas can be collapsed vertically (row height), independent of the existing horizontal (mini-width) collapse (#13)
Studio (Release v0.96.0): A feature can be marked enabled or disabled in the model (#9)
Studio (Release v0.96.0): A read-only progress board shows every slice in a project grouped into columns by status, filterable by event model/module/feature, reachable from the project menu (#11)
Studio (Release v0.96.0): Events appended by a background AI agent (e.g. event-model generation) are now attributed to that agent’s own identity in the event log, instead of the generic system identity (#318)
Studio (Release v0.96.0): #9 covers only the modeled enable/disable flag — gradual rollout by audience or percentage, and gating generated output, are out of scope (Studio generates no source code from the model today; only Mermaid/Screenplay export and LLM model generation exist).
Studio (Release v0.96.0): #12 (representing external reference data) and #186 (full event tagging with Project/Application/Domain tags) need a product/design decision or are blocked upstream (Arc#2570) respectively — see the linked issues for details.
Studio (Release v0.96.0): #190 (identity editor) is explicitly blocked upstream on Cratis/Screenplay#119.
Studio (Release v0.95.0): Rule notes on the event model canvas — a fourth sticky-note type capturing a business invariant as a plain sentence, with a Never/Eventually kind switch and the ability to attach it to a read model or a slice (#178)
Studio (Release v0.95.0): A first deterministic static analysis check over the Screenplay document: flags an event a projection or reaction consumes that nothing in the document produces (#184)
Studio (Release v0.95.0): A microphone button on the event model canvas toolbar, reusing the existing dictation control (mic toggle, device selection, live volume waveform) from the AI generate dialog (#175)
Studio (Release v0.95.0): A seed data grid on the event model canvas — add, edit, and remove seed events (event source id, event type, property values) for an event model (#19)
Studio (Release v0.95.0): Rule notes and seed events are not yet round-tripped through Screenplay export/import — sticky notes (the existing precedent) aren’t either, and Screenplay’s own language has no concept of a canvas annotation or a per-model seed grid to carry either one. That mapping is separate follow-up work.
Studio (Release v0.95.0): The microphone button ships the UI affordance only; continuous listening that feeds the modeling agent and triggers creation from speech depends on the MCP server work (#137) and is out of scope here.
Studio (Release v0.95.0): The seeding editor ships the deterministic grid only; the AI wizard half of #19 (pick event types + a count, generate from a prompt) is out of scope here.
Studio (Release v0.95.0): The Screenplay analyzer ships one check as a first cut; further checks (unreachable states, projections referencing missing artifacts, contradicting declarations) are follow-up work on the same ScreenplayStaticAnalyzer entry point. A canvas-facing “problems panel” is a separate, larger effort this change does not attempt — the new EventModel.AnalysisDiagnostics query is not yet wired into any UI.
Chronicle (Release v17.0.1): gRPC wire compatibility gate that runs before anything else builds, checking the contract at HEAD against every released minor of the current major and reporting each one. A major with no declared floor is compared in full. (#3873)
Chronicle (Release v17.0.1): CheckCompatibility on the connection service, so the kernel performs the one compatibility check for every client language instead of each SDK reimplementing it. A refused connection names the client version, the protocol version and the server version.
Chronicle (Release v17.0.1): The canonical descriptor set now ships inside the .NET, Kotlin, TypeScript and Elixir contracts packages, so a client hands the kernel exactly what it was built against.
Chronicle (Release v17.0.1): ProtocolVersion on the contracts, and ServerVersionInfo.ProtocolVersion on the server.
Chronicle (Release v17.0.1): AllPatterns and AllPatternScopes queries, so a namespace’s behavior patterns can be browsed without choosing a scope first. (#3857)
Chronicle (Release v17.0.1): Cross-cutting existence checks for event store, application and user: a command carrying one of those concepts is rejected when the thing it names does not exist, with no per-command wiring. A command that creates the entity opts its own property out.
AuthProxy (Release v2.22.0): Configure matching-tenant invitations to complete at the challenge ReturnUrl or continue to Lobby. (#109)
release-action (Release v1.3.0): A configurable no-release-labels input, defaulting to no-release.
Fundamentals (Release v7.18.4): Verify the packed config against exact registry-latest consumer versions with strict peer installation, a complete dependency-tree check, JSX/rule regressions, and a native compiler version assertion (#1109)
Chronicle (Release v16.45.2): Documentation for addressing a nested property in a migration, and for the case that needs no property operations at all — adding or removing an optional property at any depth, where the target generation’s schema drives both the filling and the dropping (#3949)
Stagehand (Release v2.50.0): A maintainer can invite somebody who is not a trusted GitHub team member by email, through the DirectLobby (Ante) - InviteTenantMember on the Users settings page. (#507)
Stagehand (Release v2.50.0): Pending DirectLobby invitations are listed alongside the existing GitHub-login roster, with the shareable invitation link and a copy-to-clipboard action once Ante has minted a token. There is no email sending - the operator hands the link over.
Stagehand (Release v2.50.0): Accepting a DirectLobby invitation automatically grants the invitee membership in the tenant they were invited to.
Stagehand (Release v2.49.9): The DirectLobby — an Ante instance with event store DirectLobby — deploys behind lobby.cratis.direct with its own AuthProxy and the invitation-token public key wired in; the stack activates when the lobby OAuth app’s credentials are configured and the redirect remains until then. (#763)
Chronicle (Release v16.45.0): ASP.NET Core health check for the client connection, registered automatically by AddCratisChronicle under the name chronicle with the chronicle and ready tags. AddChronicleHealthCheck(HealthStatus) registers it explicitly and chooses the failure status (#3943)
Chronicle (Release v16.45.0): CHR0051 reports a reducer method that declares its current read model as non-nullable (#3947)
Chronicle (Release v16.45.0): Documentation for the [Index] attribute, covering why the declaration lives on the read model and how it survives a replay (#3942)
Chronicle (Release v16.45.0): Documentation for the client health check (#3943)
Stagehand (Release v2.49.0): Stagehand is now served at cratis.direct alongside the existing host, with its own dedicated GitHub OAuth app — activates when the app’s credentials are configured, a no-op until then.
Stagehand (Release v2.49.0): lobby.cratis.direct is reserved for the tenant lobby and meanwhile redirects to cratis.direct, with its certificate provisioned up front.
Stagehand (Release v2.47.0): Environments can now be created, renamed, and removed from the UI — previously resources could never be registered on a fresh system because no environment could be defined. (#750)
Stagehand (Release v2.47.0): The Environments & resources management now also lives in Settings → Operations, where the rest of the operational setup is configured. (#750)
Stagehand (Release v2.46.0): Multitenancy and tenant onboarding: tenants can be registered, named, and onboarded, with Chronicle namespaces isolating each tenant’s events, observers, and read models. (#507)
Stagehand (Release v2.46.0): Tenant selection endpoint (/api/internal/tenants/selectable) for the AuthProxy Selection strategy, so users belonging to multiple tenants pick one at sign-in. (#507)
Stagehand (Release v2.46.0): Tenant-scoped encryption keys: PII protection keys are provisioned per tenant namespace. (#507)
Stagehand (Release v2.45.1): Every intake pipeline gate now appends an explicit pass event when an issue clears it: vision check, security check, content moderation, labeling, and type classification each record the fact with the gate’s descriptive name.
Stagehand (Release v2.45.1): Issues now show a Journey tab everywhere an issue opens, listing every pipeline gate the issue has passed with the gate’s descriptive name and the exact time it happened.
Stagehand (Release v2.45.1): The journey is available for historical issues as well — a reconciliation sweep starts screening for issues that never went through the gates.
Stagehand (Release v2.45.1): Dynamic operational resources (Environments): operators can register the resources an environment consists of — clusters, databases, stores, external services — with an extensible resource-type model. (#750)
Stagehand (Release v2.45.1): Each resource type contributes probing, health reporting, diagnostics, and operator actions through a technology-agnostic core, so new resource kinds plug in without touching the host. (#750)
Stagehand (Release v2.45.1): A background prober continuously samples registered resources and records health transitions as events, giving a queryable operational history per resource. (#750)
Stagehand (Release v2.45.0): Cluster access supports a real certificate authority: paste a CA once and generated kubeconfigs carry certificate-authority-data instead of insecure-skip-tls-verify, with the live client verifying TLS; unconfigured clusters keep today’s behavior. (#287)
Stagehand (Release v2.45.0): Discord conversations can be restricted to an author allow-list (empty = today’s behavior). (#249)
Stagehand (Release v2.45.0): Speaking-engagement discovery: register venues with their announcement pages, and a scheduled (or run-now) pass has a dedicated agent (Herald) read them for open calls-for-papers, surfacing potential engagements in Talks. (#194)
Stagehand (Release v2.45.0): A Blog page in the Content module (visible once a repository is assigned as blog): “To write” with issue creation, and “Published”. (#230)
Stagehand (Release v2.45.0): The worker images carry UI skills for React and PrimeReact work — one vendored (pinned, with provenance), one written in-house because the requested source carries no license (flagged for your confirmation). (#118)
Stagehand (Release v2.45.0): Attachments that only appear in issue comments now resolve through the authenticated exchange too. (#736)
Stagehand (Release v2.43.0): The watchdog now watches the pipeline itself: an alarm when issues arrive but nothing gets screened, a backlog alarm for issues stuck unclassified, and a self-healing sweep that re-kicks screening for stranded issues every 15 minutes. (#720)
Stagehand (Release v2.43.0): Pull requests are reconciled on the 15-minute sweep — a missed PR webhook no longer means waiting a day. Per-repository watermarks stop the window advancing past a failed repository. (#712)
Stagehand (Release v2.43.0): Duplicate GitHub webhook deliveries are skipped (keyed by delivery id, claim released on failure so a manual redelivery still works). (#710 — dedup only; async processing remains open there)
Stagehand (Release v2.43.0): Renaming an issue in Stagehand now reaches GitHub instead of being silently reverted by the next sync. (#709)
Stagehand (Release v2.43.0): Outage tracking works: outages project their status, timeline, actions and filed issues, active outages actually list, and resolution verification is a settled poll instead of a sleep that guaranteed duplicates. (#714)
Stagehand (Release v2.43.0): Work items expose CanStop/CanRetry server-side — the buttons and the commands now share one rule. (#722, first increment)
Stagehand (Release v2.42.2): Every deploy is followed by a smoke suite: the deployed pod runs the version just released, the public edge serves, and the issues/repositories queries answer with an authorized principal from inside the cluster. (#723)
Stagehand (Release v2.42.2): A publish run now fails loudly when a release was cut but production did not get it. (#706)
Stagehand (Release v2.42.2): scripts/verify-consolidation.sh proves a consolidation branch still contains every folded pull request’s changes (commit survival, content survival, spec-count ratchet) — verified to reproduce both historical damage incidents and stay quiet on a known-good consolidation. Documented in .agents/PROJECT.md. (#707)
Stagehand (Release v2.42.0): Every issue’s detail dialog now has a Journey tab showing each pipeline step the issue went through — vision check, security/content screening, classification, labeling, type identification and triage decisions — in order, with timestamps and outcomes, so it is visible at a glance whether the pipeline did what it was supposed to. Built as an IssueJourney read model with child projections over the existing step events; repeats (relabeling, reclassification) each appear as their own step. (#635)
Stagehand (Release v2.41.0): Issue filings now record their outcome: a failed GitHub filing appends IssueFilingFailed with the refusal reason, and a new IssueFilingStatus read model (Requested/Filed/Failed) makes every filing attempt inspectable. A filing GitHub refuses is no longer silently swallowed. (#683)
Stagehand (Release v2.41.0): Approving a pull request is now enforced server-side: failing checks or blocked/conflicted mergeability reject the merge with a clear message instead of relying on browser-only gating. (#652)
Stagehand (Release v2.41.0): GitHub attachment images are downloaded through an authenticated API exchange (signed URL from body_html), so images on issues from private repositories actually mirror instead of 404ing forever. The image cache key ignores rotating signed-URL query strings. (#618, #685)
Studio (Release v0.94.0): Real health endpoints on every Studio service, reporting the resources it depends on: MongoDB
Studio (Release v0.94.0): /health/live and /health/ready alongside /health. Liveness deliberately checks nothing
Stagehand (Release v2.40.0): GitHub-hosted images and attachments referenced in an issue or comment are now downloaded and served locally, in the same structure used for images created through Stagehand - the URL in the mirrored body is rewritten to point at the local copy instead of GitHub’s, and a failed download degrades gracefully by leaving the original GitHub URL in place. (#685)
Stagehand (Release v2.40.0): Opening a pull request now recovers when GitHub reports one is already open for the branch, instead of failing the run. (#684)
Stagehand (Release v2.40.0): Worker agents are now told how to actually fetch a GitHub-hosted image or file attachment themselves - re-fetching the issue or comment with the full+json media type to get a short-lived signed URL - rather than asking a person to paste its contents. (#687, following on from #211)
Studio (Release v0.93.1): Shared.Hosting owns single-page application hosting: UseSinglePageApplicationFiles and
Stagehand (Release v2.39.0): The Pi harness now supports Headroom, a context-compression proxy that reduces token consumption on model requests. Set STAGEHAND_HEADROOM=1 to route Pi’s model requests through the proxy when it is available, including its azure-openai-responses provider. (#586, #646)
Stagehand (Release v2.39.0): The work dispatcher now records causation for agent work dispatch, capturing which AI provider, model, reasoning effort, and prompts produced the events that follow. (#643)
Stagehand (Release v2.39.0): The Effort enum lets you configure how much reasoning each agent uses when its AI provider runs a completion - Low, Medium, High (the default), or ExtraHigh - shown and editable from the Agents settings panel. (#643)
Stagehand (Release v2.39.0): Three new agents handle specialized work: Roadie executes scheduled runs of defined tasks from the palette, and Medic fixes reported bugs - joining Bard (content authoring) and Wright (investigations, implementations, reviews) as job-mode agents. (#640)
Stagehand (Release v2.39.0): An OpenAI provider can now be configured with a ChatGPT subscription instead of a metered API key, for use by the Job agents (Wright and Bard) - sign in from Settings → AI with “Sign in with ChatGPT”.
Stagehand (Release v2.39.0): Agent sessions now report their resource usage - CPU time and peak memory - with a new “Agent resource usage” dashboard chart and a per-issue “Resource usage” tab.
Stagehand (Release v2.39.0): The Triage board now shows a “Fix the build” button when a pull request’s checks have failed. (#662)
Stagehand (Release v2.39.0): Chat is now scoped to individual modules - each module has its own set of topics and chat history, and Chat appears first in every module’s navigation. (#639)
Stagehand (Release v2.39.0): You can now schedule sequences of issues that wait on real evidence - a release, a merged pull request, a published package - rather than just closing, via the new “Schedule chain” dialog and Chains page. (#450)
Stagehand (Release v2.39.0): The Backlog filter now includes toggles to hide issues by status: “Hide in progress”, “Hide awaiting review”, and “Hide waiting”. (#434)
Stagehand (Release v2.39.0): Filter facets with many options now offer inline search to reduce scrolling in the Backlog filter panel.
Stagehand (Release v2.38.0): Docker worker containers now bind-mount the shared repository cache when one is configured, so they clone with git clone --shared instead of fetching fresh from GitHub on every run - the behavior Kubernetes already had. (#617)
Stagehand (Release v2.38.0): Branch names now support an optional type/ prefix from a fixed vocabulary (fix, feat, chore, docs, refactor, test). (#617)
Stagehand (Release v2.38.0): Discord and LinkedIn outlets are now added through kind-specific commands that each carry only the fields they need, and the Outlets panel shows a dialog per kind - Discord asks for a webhook URL, LinkedIn does not. (#622)
Stagehand (Release v2.38.0): Merged pull requests are now removed from the Triage board by the periodic reconciliation sweep, which settles issues whose merge bookkeeping never ran because the association was missing, mistargeted, or recorded after the merge. (#580)
Stagehand (Release v2.38.0): Dead branches - stagehand/work-* branches deleted on origin but still tracked locally - are now identified and removed by a scheduled job. (#567)
Stagehand (Release v2.38.0): Tasks defined in code are now discovered and registered automatically at startup: implement IFormalTask, mark the class with [FormalTaskArea], and the module that owns each task is tracked with it. (#566)
Stagehand (Release v2.38.0): The Pi harness now routes model requests through Headroom when STAGEHAND_HEADROOM=1, extending token optimization beyond Claude Code to Pi’s anthropic, openai, and stagehand-openai-compatible providers. Routing is fail-open - if Headroom does not start, every provider falls back to its direct endpoint. azure-openai-responses is deliberately left unrouted pending verification against a live Azure resource. (#586, #646)
Stagehand (Release v2.38.0): Issues with a plan now show a “has a plan” tag on the triage board. (#634)
Stagehand (Release v2.38.0): Issues now carry the reason triage was skipped, whether the vision guardian judged them and what it concluded, and security and content screening severities - each shown as a tag in the backlog and on the issue. (#621)
Stagehand (Release v2.38.0): Cached mirrors now survive a worker borrowing from them: a 24-hour maintenance sweep folds accumulated packs together at every run and prunes unreachable objects only when no unit of work is Running or WaitingForAnswer. (#503)
Stagehand (Release v2.38.0): An ActivePlans query exposes only the plans still generating, so the Backlog no longer loads the entire plan history to filter it. (#636)
Stagehand (Release v2.38.0): You can now edit an issue’s description from the issue detail view - revise the markdown, save, and the change posts to GitHub and mirrors back through the webhook. (#635)
Stagehand (Release v2.38.0): A task can now be associated with an agent from your Application Context when it is defined or reconfigured, with the agent’s avatar, name, and description shown in the dropdown. (#637)
Studio (Release v0.93.0): The agents settings page shows, per agent, whether it can actually reach a model — “Ready”, or
Studio (Release v0.93.0): Autonomous mode explains up front that it needs a configured Code generation and Analysis agent,
Studio (Release v0.93.0): A Teardown - Registry workflow, so the retired registry VM can actually be destroyed rather than
Stagehand (Release v2.36.0): The triage board’s “Fix build errors” action now does something: it sends an agent at the pull request whose checks are failing, with instructions to fix only what broke. (#608)
Stagehand (Release v2.36.0): Search filtering for groups and repositories in the task repository scope picker, and a clear button once repositories are selected. (#609)
Studio (Release v0.92.1): A node image reaper on the batch pool, clearing exited containers and pruning the images they were holding down once the disk passes 70% — well below kubelet’s own image GC, which does not start until 85% and shares that line with eviction. It runs as a DaemonSet rather than a CronJob because a node under DiskPressure rejects new pods outright, so anything that must be scheduled to do the cleanup cannot land exactly when the cleanup is needed. Tunable with batchImagePruneAtPercent.
Studio (Release v0.92.0): A Screenplay document can be compiled into the Scene object model a renderer executes. Studio could already compile a .play document into the event model its canvas draws, but the screens the same document describes — screen, layout, form, theme, ui profile — went nowhere, which is why exporting one wrote Screens: []. (Cratis/StudioIssues#165)
Studio (Release v0.92.0): The event model’s topic chat is now @cratis/components’ ChatSidebar, so the chat surface is the shared one rather than a local copy of it.
Studio (Release v0.92.0): An analyzer project for corpus rules that are decidable from the syntax tree, running on every project under Source, starting with the AutoMap contract.
Studio (Release v0.92.0): Lint now enforces two conventions that were previously only written down: PrimeReact’s dialog cannot be imported in place of the Cratis wrappers, and @cratis/components is imported by subpath rather than through its root barrel.
Studio (Release v0.92.0): A check that every no-explicit-any lint exemption still exists, is still a generated file, and still needs the exemption.
Scene (Release v3.2.0): Canvas is back as a panel, and carries an Extent — the coordinate space a child’s Canvas.Left/Canvas.Top pair is measured against. It was dropped on the argument that FreeformArrangement already covers absolute placement, but the two sit at different levels: a FreeformArrangement arranges a layout slot’s content with one variant per size class, while a Canvas places elements inside a single coordinate space in the element tree. Without the panel there was nowhere for a free-placement design surface to land.
Scene (Release v3.2.0): isCanvas recognizes a canvas by its extent, the same way the other panel guards recognize theirs by the property each one alone declares. The old Canvas declared no properties at all, which is why nothing could tell it from a plain Panel — and why it could be removed without anything noticing.
Scene (Release v3.1.0): ScenePackage gained License and LicenseUrl; Theme gained the LicenseUrl to go with the License it already carried. A license name on its own does not tell an author what they are taking on — “PrimeUI Community / Commercial” says nothing about whether they qualify for the free tier or owe a fee. The link is the part that answers that, so the model carries it.
Stagehand (Release v2.35.0): Separate reactor pairs handle label and type identification during issue classification, decoupling the decision of what to apply from the GitHub call that applies it. (#557)
Stagehand (Release v2.35.0): The FilingOnGitHub reactor observes issue filing requests, calls GitHub, and registers the created issue locally. (#557)
Stagehand (Release v2.35.0): The IssueGitHubMirror passive read model tracks an issue’s current type and labels as mirrored from GitHub, removing the race in classification decisions. (#557)
Stagehand (Release v2.34.0): The operational watchdog monitors the Stagehand itself, checking every five minutes that recurring sweeps are still running, Chronicle connections are reachable, failed partitions are not stuck, recent jobs have not failed, and the production cluster is healthy. (#190)
Stagehand (Release v2.34.0): The watchdog re-registers lost sweep reminders and asks affected sweeps for an immediate pass; conditions it cannot safely fix are raised as alerts. An Operations tab shows its status, last pass and recent corrections, with a Run now button. (#190)
Stagehand (Release v2.34.0): Outages can be recorded in any environment with a severity, tracked with typed actions, shown as a timeline, and marked resolved and verified. (#519)
Stagehand (Release v2.34.0): Outages of High or Critical severity automatically file a GitHub issue. (#519)
Stagehand (Release v2.34.0): Tasks can be scoped to functional areas — Operations, Issues, Builds, Alerts — rather than only to repositories or groups. (#565)
Stagehand (Release v2.34.0): Agent sessions can route model requests through Headroom, a container-local context-compression proxy, enabled with Stagehand:Worker:Headroom. It fails open in every direction, so it can never fail a unit of work. (#556)
Stagehand (Release v2.34.0): Notification preferences are configurable per user in settings: operational failures, contact from outside the team, and agents needing an answer. (#530)
Stagehand (Release v2.34.0): A separate Admin API key can be configured per AI provider, which is what the AI Usage report needs to work. (#516)
Stagehand (Release v2.34.0): Worker Jobs declare CPU, memory and ephemeral-storage requests to the Kubernetes scheduler, so the fleet stops overpacking onto a single node and filling its disk. Requests only, never limits. (#438)
Stagehand (Release v2.34.0): Unclassified issues can be re-triaged from the settings panel, with a backfill reactor that re-screens open issues that are unclassified or missing labels. (#430)
Stagehand (Release v2.34.0): Pull requests always receive a release label. When the language model fails or returns unparseable JSON, a deterministic fallback classifies the change from its file paths — no-release for documentation, specs, CI and tooling; patch otherwise. (#535)
Stagehand (Release v2.34.0): Consolidation work items show a descriptive title, such as “Consolidating #123, #124, and #125”. (#577)
Stagehand (Release v2.34.0): Pull requests that become disconnected from their issues can be merged directly from the triage board. (#560)
Stage (Release v3.11.0): join, all, every and remove via join blocks render as their model-bound attributes (#11)
Stage (Release v3.11.0): nested blocks render as a sibling record the read model holds through a nullable [Nested] property, with a clear with inside one becoming the class-level [ClearWith] that nulls it (#11)
Stage (Release v3.11.0): children blocks render as a sibling record plus an IEnumerable<T> collection carrying [ChildrenFrom], with remove with becoming a [RemovedWith] on that same property, nesting to any depth (#11)
Stage (Release v3.11.0): no automap renders as [NoAutoMap] on the read model (#11)
Stagehand (Release v2.32.0): Agents now have persistent identities in the event store, displaying their configured names on every action they take. (#526)
Stagehand (Release v2.32.0): Agent memory is now shared across all containers an organization spins up, persisted to the repository cache volume under .agent-memory/<owner>/memory.jsonl. (#518)
Stagehand (Release v2.32.0): AI providers now support concurrency limits, configurable per provider to prevent overload on rate-limited APIs. (#184)
Stagehand (Release v2.32.0): A new Talks section in Settings and dedicated Talks page for managing talk creation and submission workflows. (#152)
Stagehand (Release v2.32.0): Editable Markdown component for inline editing of formatted text in dialogs and forms.
Stagehand (Release v2.32.0): Repository settings synchronization now detects when issues are disabled on a repository and removes it from the work queue. (#495)
Stagehand (Release v2.32.0): Webhook signature verification now handles malformed input gracefully instead of returning 500 errors. (#242)
Stagehand (Release v2.32.0): Work dispatch now tracks scheduling state with grace periods to prevent the same issue from being scheduled twice or the same work item from being dispatched twice. (#256)
Stagehand (Release v2.32.0): NFS mount options now include soft timeouts to prevent indefinite hangs if the repository cache becomes unreachable, converting silent failures into visible errors. (#520)
Stagehand (Release v2.32.0): Scheduler now receives poke events when work leaves the running state or an issue closes, ensuring timely dispatch of pending work.
Arc (Release v22.10.0): --emit-interfaces renders types as plain TypeScript interfaces rather than classes carrying @field decorators, with no @cratis/fundamentals import for the decorators. A model that is only ever built and read needs neither, and a package that deliberately carries no dependencies cannot take one on. Documentation, base types and nullability are unchanged, so the output differs from the class form only in the ways the mode is for. (#2635)
Stagehand (Release v2.31.1): Worker Jobs can declare CPU and memory — ContainerRuntime__CpuRequest, CpuLimit, MemoryRequest, MemoryLimit. Each is optional and an unset one is omitted, so a cluster that has not been sized keeps the Job specification it had.
Scene (Release v3.0.0): The panel vocabulary a canvas is drawn in — Canvas, StackPanel, DockPanel, WrapPanel and Grid on the existing Panel base, with RowDefinition, ColumnDefinition, GridLength, GridUnitType, Orientation and Dock. Studio’s prototype canvas models arrangement this way and Scene had no equivalent: a screen could say what an element is, but not that five of them sit in a grid.
Studio (Release v0.90.0): Blueprint page — configure a ui profile and preview a blueprint live, on a route in the application. Pick a base component library, then a styling package, then whatever those make available, then a blueprint; the page shows the resolved override order, what dependency resolution pulled in, component-name collisions and which package wins each, and the themes compatible with the profile. Preview any of the blueprint’s gallery screens through the real Scene engine, switch theme with no reload, and switch between the eight application-shell menu modes. (Cratis/StudioIssues#80, Cratis/StudioIssues#160)
Studio (Release v0.90.0): Studio.Editor — a package split into a preview surface that consumes Scene.Engine and Scene.React unmodified, and editing chrome layered on top of the data-scene-id attribute the renderer already emits. Design-mode affordances are injected by the chrome rather than being a mode inside the renderer, so what you preview is what ships. (Cratis/StudioIssues#156)
Studio (Release v0.90.0): Designer surfaces in that package: form field mapping (Cratis/StudioIssues#157), a computed navigation tree that shows where each entry comes from (Cratis/StudioIssues#158), string resource keys and missing translations (Cratis/StudioIssues#159), ui profile collision and theme filtering (Cratis/StudioIssues#160), freeform artboard variant detection (Cratis/StudioIssues#161), and starter/gallery theme selection for the new-project wizard (Cratis/StudioIssues#162).
Stagehand (Release v2.30.0): Triage now shows pull requests Stagehand opened that no issue points at any more. Every card on the board is built from issues, so such a pull request did not merely lose its actions — it disappeared. Fifteen were stranded this way on 2026-09-02, including #473 (the release label being dropped on large pull requests) and #474 (the Triage build being broken) — both of which were separately diagnosed and fixed by hand, because nobody could see the pull request already existed.
Stagehand (Release v2.30.0): Work can be aimed at a pull request rather than at issues, so Fix merge conflict works on those pull requests. Scheduling by issue is not equivalent: a consolidation supersedes an earlier one by re-associating every issue onto its own pull request, so scheduling by issue would send the agent at whichever pull request those issues moved to — the wrong one, and usually already merged.
Stagehand (Release v2.29.0): Triage shows when a pull request cannot be merged. A conflicted one is marked merge conflict and a pull request GitHub is refusing for another reason is marked merge blocked, so the card explains why the merge button does nothing instead of looking ready.
Stagehand (Release v2.29.0): A Fix merge conflict action on a conflicted item sends an agent to resolve it: merge the base branch into the pull request’s own branch, settle the conflicts keeping both intentions, run the repository’s gates and push. The pull request keeps its history and its review — nothing is rebased, force-pushed or merged.
Stagehand (Release v2.28.1): Chat with an issue’s plan and give an agent new instructions, putting the item back into the development queue.
Stagehand (Release v2.28.1): Comment on issues from Stagehand.
Stagehand (Release v2.28.1): System-wide configuration for how many workers may run at once.
Stagehand (Release v2.28.1): A watchdog for stuck work, and a startup sweep that picks up work left queued behind a restart.
Chronicle.Kotlin (Release v4.0.0): @FromEventSourceId maps a read model property to the event source id from a model-bound projection — the annotation counterpart of the fluent builder’s toEventSourceId(). The kernel does not act on it yet (Cratis/Chronicle#3924).
Chronicle.Kotlin (Release v4.0.0): ReadModelsJavaBridge.watch and observeMaterializedInstances take an onError consumer, so a Java caller can handle a faulted stream instead of losing it to an uncaught exception on a background dispatcher.
Stagehand (Release v2.27.0): A watchdog sweep that notices work which has been queued far longer than it should be, removes whatever is holding it back, and raises an alert when the queue has stopped moving altogether
Stagehand (Release v2.27.0): A startup job that runs the same recovery on every boot, and records what it found in the job’s own history — a restart is the most likely moment to have produced the condition
Stagehand (Release v2.27.0): Chat on an item: tell the agent something new and it goes back to work through the ordinary pipeline. A running session is told directly, work already queued has the instruction added to it, and anything else schedules a fresh run carrying it
Stagehand (Release v2.27.0): The individual checks behind a pull request’s verdict, shown on the item — which check failed, and a link straight to it, instead of a card that only says “checks failed”
Stagehand (Release v2.27.0): ConsolidateWork accepts input, so a consolidation can be re-run with new instructions like any other work
Chronicle.Kotlin (Release v3.1.0): Java can now reach the observer-relative tail sequence number, the event-count-capped read model replay, and live observation of a materialized page, through EventLogJavaBridge and ReadModelsJavaBridge.
Chronicle.Kotlin (Release v3.1.0): EventTypeDescriptor.parse is callable directly from Java, which is what lets a Java caller name an event type at all — EventTypeId and EventTypeGeneration are value classes Java cannot construct.
Arc (Release v22.9.0): CommandScenario<TCommand> implements IDisposable and IAsyncDisposable, disposing the service provider it builds and any disposable values extension packages place in Context (such as the Chronicle extender’s EventScenario); disposal is idempotent and Execute/Validate throw ObjectDisposedException after disposal (#2629)
Specifications (Release v4.1.0): Opt-in shared specification lifecycle for xUnit: add [assembly: Xunit.TestFramework("Cratis.Specifications.SpecificationTestFramework", "Cratis.Specifications.XUnit")] to a spec assembly and every eligible Specification class is constructed once, runs Establish/Because once, runs all its facts against that shared instance and runs Destroy once after the last fact (#38)
Specifications (Release v4.1.0): Automatic fallback to the stock per-fact lifecycle for anything not eligible for sharing - plain xUnit classes, theories, IDisposable specifications, and classes using fixtures or ITestOutputHelper - so the attribute is safe to add to an existing spec assembly (#38)
Specifications (Release v4.1.0): Class-fixture-style failure semantics in shared mode: a throwing Establish/Because fails every fact of the class with that exception, and Destroy failures surface as test class cleanup failures (#38)
Chronicle.Elixir (Release v2.3.0): Chronicle.Concept — a strongly-typed wrapper for a domain value, joining the existing use macro family alongside Chronicle.Events.EventType and Chronicle.ReadModels.ReadModel. Supports :string, :integer, :float, :boolean and :uuid, and rejects an unknown type at compile time (#40)
Chronicle.Elixir (Release v2.3.0): PII declared on a concept is resolved wherever that concept is used, in both events and read models — declare it once and every property using the type is encrypted (#40)
Chronicle.Elixir (Release v2.3.0): A concept declared with event_source_id: true cannot also be marked PII; the combination raises at compile time, because encrypting the identifier would make its own decryption key unfindable (#40)
Chronicle.Elixir (Release v2.3.0): no_auto_map/0 and no_auto_map/1 — turn Chronicle’s automatic property mapping off for a whole projection, or exclude specific fields. AutoMap was never sent to the kernel at all, so it silently fell back to the Inherit default and could not be turned off (#40)
Chronicle.Elixir (Release v2.3.0): not_rewindable: true and event_sequence: on a read model or projection. Both were hardcoded, so every projection was rewindable and pinned to the event log (#40)
Chronicle.Elixir (Release v2.3.0): A guide page covering concepts (#40)
Chronicle.TypeScript (Release v4.0.0): Event tags.@tag()/@tags() on an event type, reactor or reducer, @filterEventsByTag() to restrict which events reach an observer, tags on AppendOptions and EventContext, and tags in seeding. The wire fields were already being sent as empty arrays (#58)
Chronicle.TypeScript (Release v4.0.0): @subject() — the property a compliance release decrypts PII against, with a resolver that falls back to id exactly as before when the decorator is absent (#58)
Chronicle.TypeScript (Release v4.0.0): An operational surface on IProjections — getStateFor/getStateForModel, replay/replayForModel, getFailedPartitionsForModel, hasFor/hasForModel, getProjectionIdFor, and query for ad-hoc projection declarations. It previously had only discover and register, so nothing could inspect or operate a projection (#58)
Chronicle.TypeScript (Release v4.0.0): @fromAll, @noAutoMap, and @eventSequence/@eventLog for model-bound projections; root-level @clearWith is now honored (#58)
Chronicle.TypeScript (Release v4.0.0): IPIIManager.allowNewEncryptionKeyFor — re-authorize an encryption key for a subject after erasure (#58)
Studio (Release v0.89.0): Extract module, feature, slice, specification, sticky-note, and prototype-window layout from the exact selected event models. (Cratis/StudioIssues#260)
Studio (Release v0.89.0): Fail closed on scope drift, malformed projection state, hierarchy defects, ambiguous ordering, and globally colliding layout identities. (Cratis/StudioIssues#260)
Studio (Release v0.88.0): Deterministic application, domain, and selected-event-model capture with exact retained scope and typed malformed-input diagnostics. (Cratis/StudioIssues#278)
Studio (Release v0.88.0): Disjoint declaration ownership validation that reports both conflicting owners and blocks partial composition. (Cratis/StudioIssues#278)
Studio (Release v0.88.0): Exact-byte workspace composition with stable document metadata and a versioned materialized-state revision fingerprint. (Cratis/StudioIssues#278)
Studio (Release v0.88.0): A pure authoritative workspace-input boundary for future catalog, ESM, and execution-plan snapshots. (Cratis/StudioIssues#289)
Chronicle.Kotlin (Release v3.0.0): @SetValue, @SetFromContext and @Passive for model-bound projections (#59)
Chronicle.Kotlin (Release v3.0.0): @Key and @ContextKey, with a key builder for composite and parent keys (#59)
Chronicle.Kotlin (Release v3.0.0): @Subject — the property a compliance release decrypts PII against, falling back to id as before when absent (#59)
Chronicle.Kotlin (Release v3.0.0): Model-bound @Unique and @RemoveConstraint (#59)
Chronicle.Kotlin (Release v3.0.0): @JsonSchemaType, for a type that serializes as something other than its own shape (#59)
Chronicle.Kotlin (Release v3.0.0): count(), increment(), decrement(), add().with() and subtract().with() on the declarative projection builder, plus noAutoMap()/autoMap() and toEventContextProperty() on from() (#59)
Chronicle.Kotlin (Release v3.0.0): Java can now build a declarative projection.join, on, set, nested, children, fromEvery and fromAll took a Kotlin KProperty1, which Java cannot construct, so explicit mapping was unreachable — every one now has a property-name overload, validated against the read model type. EventTypeMigrationBuilder gained the same treatment (#59)
Chronicle.Kotlin (Release v3.0.0): @Pii can be placed on a constructor parameter, so a Java record component is picked up without a use-site target (#59)
Chronicle.Kotlin (Release v3.0.0): EventSourceId — a ConceptAs<String> marker for concepts representing an event source identity (#59)
Stagehand (Release v2.25.0): GitHub App identities: deployments can now register separate Apps per agent, so commits and comments are attributable to specific agents rather than a shared bot (#216).
Stagehand (Release v2.25.0): GitHubAppIdentityId type representing one GitHub App identity, with General as the default identity every deployment starts with.
Stagehand (Release v2.25.0): GitHubAppIdentityCatalog declaring which agent identities are available (currently General and Wright).
Stagehand (Release v2.25.0): Configuration sections Stagehand:GitHubApps:{identity}:* for each identity’s App credentials, replacing the singular Stagehand:GitHubApp:* (which still works as a fallback for General).
Stagehand (Release v2.25.0): Query endpoints to resolve App status for a specific identity or all identities at once.
Stagehand (Release v2.25.0): A new OptionalRepositorySelectorField component for selecting a repository with an optional “none” value, useful in settings where choosing not to use a repository is valid.
Stagehand (Release v2.25.0): Work items now display a semantic branch name derived from their issue titles, making branches more human-readable than GUID-based names (#382). Falls back gracefully to GUID-based naming if semantic naming fails.
Stagehand (Release v2.25.0): The top bar now remembers which page you last visited in each module, and returns you there when you click the module button (#397).
Stagehand (Release v2.25.0): The issues being developed view now displays tabs for work details when a related work item exists, including Overview, Plan, Steps, and Log sections (#
Arc (Release v22.8.0): Command property values are recorded on the causation of every event the command appends, keyed by camel-cased property name, so an event says what the command was asked to do and not only which command it was (#2625)
Arc (Release v22.8.0): [NotAudited] keeps a value off the causation chain — on a property, on a positional parameter, or on the command itself to exclude every property at once (#2625)
Arc (Release v22.8.0): ARCCHR0009 reports a command property whose name reads like a secret (Password, Token, ApiKey, Credential, Pin, Cvv and the like) and which is not marked [NotAudited] or [PII] (#2625)
Arc (Release v22.8.0): CommandCausation.PropertiesFor(Type, object) builds the causation properties for a command instance; the existing PropertiesFor(Type) is unchanged (#2625)
Stagehand (Release v2.24.0): Cluster namespaces can now be associated with the repository whose code runs there and the Chronicle event store it targets, configurable through the Settings page (#331, #333, #336).
Stagehand (Release v2.24.0): The issue details panel now groups its controls into three sections: what the issue is, how it is worked, and what to do with it, for better clarity (#367).
Chronicle (Release v16.44.0): Time Scrubber, on both the Projections and Read Models views: step a read model instance through its history one event at a time, with the state after each event and a hover describing the event and its properties.
Chronicle (Release v16.44.0): Snapshots of a read model instance can be asked for per event instead of per correlation, through a new Grouping on the snapshot request. It defaults to grouping by correlation, so existing callers are unaffected.
Chronicle (Release v16.44.0): A projection can be generated as client code in TypeScript, Kotlin and Elixir alongside C#, selectable in the Workbench’s generated-code panel. Languages whose client has no API for a given projection style are offered only for the styles they support.
Chronicle (Release v16.44.0): ILanguageService.GetLanguagesSupporting reports which languages can generate a given projection style.
Stagehand (Release v2.23.0): You can now select multiple repositories at once in the Backlog filter, instead of viewing one repository at a time (#353).
Stagehand (Release v2.23.0): The repository selector component now clears its selection when you click the X button (#349).
Stagehand (Release v2.21.4): The busy indicator dialog is registered at the app root, so useBusyIndicator can be used and every busy indicator looks the same
Studio (Release v0.87.0): Adapt typed Studio declaration identities into verified, materialized Screenplay catalogs and slice/event identity maps (Cratis/StudioIssues#260)
Studio (Release v0.87.0): Preserve persisted identity and event-contract revision continuity with typed stale, drift, retirement, and malformed-input failures (Cratis/StudioIssues#260)
Studio (Release v0.87.0): Define a typed application layout sidecar that cannot enter catalog, ESM, plan, or snapshot canonical contracts (Cratis/StudioIssues#260)
Stagehand (Release v2.21.2): Scheduling:StepTimeout — how long one step of a scheduling pass is given before the pass moves on without it (default 2 minutes)
Components (Release v4.1.0): PivotViewer accepts an optional title for the toolbar heading. Omit it and the heading
Studio (Release v0.86.0): Compile explicit-identity Screenplay workspaces into canonical ESM and semantic execution-plan snapshots with package-owned diagnostics and revisions (Cratis/StudioIssues#289)
Studio (Release v0.86.0): Resolve requested slices only through authoritative SliceId-to-SemanticId assignments and reject missing, stale, or wrong-kind mappings (Cratis/StudioIssues#289)
Studio (Release v0.86.0): Reject incomplete snapshot authority metadata through distinct typed outcomes before package compilation (Cratis/StudioIssues#289)
Stagehand (Release v2.21.0): Issues in Triage’s “Needs you” can be selected and their pull requests consolidated into one, opened by the acting agent with the conflicts resolved
Stagehand (Release v2.21.0): The pull requests a consolidation absorbed are closed automatically once the pull request that replaced them merges
Stagehand (Release v2.20.4): Settings are scoped to the module they belong to, and each module keeps its own settings folder — the dialog opened from Product shows Product’s settings rather than all four groups (#213)
Screenplay (Release v4.12.0): Add domain-separated external stable-key factories for semantic and event-contract identities (#176)
Screenplay (Release v4.12.0): Add explicit stable application identity support for workspace compilation independently from the friendly application name (#176)
Chronicle (Release v16.43.0): MapValues on EventTypeMigration<TUpgrade, TPrevious> — declare which value in one generation is which value in the other, once, and Chronicle applies the map forward when upcasting and inverted when downcasting. Values the map does not mention are carried across unchanged.
Chronicle (Release v16.43.0): MapValues on the migration property builder, for a translation that applies to one direction only. A direction that declares its own transformation for a property keeps it, overriding what the value map derives.
Stagehand (Release v2.20.0): A plan can be edited by hand, on an issue or on a group, instead of standing as whatever the agent produced (#197)
Stagehand (Release v2.20.0): A plan can be planned again with input describing what was wrong with it — the input travels with that run, not with the issue (#197)
Stagehand (Release v2.20.0): The navigation floats behind a hamburger on a phone and can be collapsed to icons on a desktop, and the choice is remembered (#229)
Stagehand (Release v2.20.0): A group is locked once its issues are scheduled: it cannot be renamed, re-prompted, replanned, rescheduled, disbanded, or have members moved in or out while an agent is acting on it
Stagehand (Release v2.20.0): A group is disbanded automatically once every one of its issues is closed
Studio (Release v0.97.0): The per-slice “generate content” button now resolves the application it targets explicitly, rather than only reading the currently routed application, so it renders correctly even from views that list multiple applications
Studio (Release v0.96.2): Studio’s own agent now reaches the MCP AuthProxy over its in-cluster Service address when one is configured (Cratis:Studio:Mcp:InternalUrl), falling back to the existing public URL when it isn’t (e.g. local development, where Mcp is not co-deployed) — no behavior change for any environment where InternalUrl is unset (#309)
Ante (Release v0.9.0): Documentation/configuration.md, Documentation/host-integration.md, Documentation/boundaries.md, and Documentation/wizards.md now describe the new setting, its contract, its trust boundary, and the completion-screen behavior it adds.
Ante (Release v0.9.0): Host-appended success/failure events, terminal-result precedence, quarantine, and replay reconciliation across restarts/replicas.
Ante (Release v0.9.0): Compliance-subject propagation on the host outcome itself (there is nothing to prop
Ante (Release v0.8.0): Documentation/configuration.md and Documentation/boundaries.md now describe Ante:CustomCssUrl’s real, working loading contract and its trust boundary, instead of a promise the frontend never implemented. (#21)
Ante (Release v0.8.0): A second UI locale - this PR builds the mechanism (closed supported-locale set, deterministic fallback, per-locale formatting/direction tables) but ships only the one reviewed locale (English) that existed before. Documentation/boundaries.md#localization states explicitly what adding another one requires: reviewed translations and matching backend validation-message localization together, not a translation file alone.
Ante (Release v0.8.0): Manual/browser verification of the CSS load
Ante (Release v0.7.0): Onboarding’s waiting/progress states now expose a role="status"/aria-live="polite" announcement (reusing ProgressSpinner’s own accessible label where a spinner is present). (#20)
Ante (Release v0.7.0): Keyboard focus now gets a reinforced, forced-colors-aware :focus-visible outline across this app’s own elements (@cratis/components already does this for its own controls). (#20)
Ante (Release v0.7.0): This app’s own CSS now honors prefers-reduced-motion, in addition to the explicit in-app motion preference. (#20)
Ante (Release v0.7.0): color-scheme relaxed from a hard dark to dark light, and <html> now declares lang="en", so native controls can still follow the operating system rather than the app overriding it outright. (#20)
Ante (Release v0.7.0): Cratis/Components#249 - CommandStepper renders no ARIA tab/tabpanel roles/relationships, and only reports step changes for header clicks, never Next/Previous (the path a linear wizard actually uses).
Ante (Release v0.7.0): Cratis/Arc#2661 - CommandForm’s auto-rendered field label has no htmlFor, so clicking the visible label text does not focus the field (the input still gets an accessible name via a separate aria-label fallback).
Ante (Release v0.7.0): Manual/browser accessibility evidence (screen reader pass, high-zoom and narrow/short-viewport checks, forced-colors visual QA) - the issue itself is explicit that computed CSS/S
Ante (Release v0.6.0): The generated OpenAPI document (/openapi/...) is now exposed only in Development - a non-development deployment must never publish its full command/query surface unauthenticated. (#19)
AI (Release v0.10.0): public-specifications carries a skill of its own for the first time; public-specifications-dotnet gains the application scenario family; public-arc gains command validation; public-chronicle gains event constraints (#174)
AI (Release v0.10.0): cratis-chronicle-event-constraints now reports Chronicle rather than Arc products, because it no longer inherits them from the shared Arc-scoped legacy source (#177)
Ante (Release v0.4.2): OrganizationSetupStatusSubscriptions / UserSetupStatusSubscriptions now seed every (re)connecting client’s live status from a fresh durable read instead of always starting Pending, and only ever move a client’s observed status forward (Pending → Recorded → Accepted), never backward - a stale, lagging read racing behind a durable publication another tab already observed can no longer regress that tab’s view.
Ante (Release v0.4.1): The wizards’ status polling (UserSetupAcceptanceStatusView / OrganizationSetupAcceptanceStatusView) now reports completion only once durable evidence confirms Published (the fact has reached Ante’s own outbox), never merely Recorded (committed to Ante’s local event log) and never from an in-memory flag set at command time. A required legal fact that has not yet reached the outbox keeps the status at pending even after the acceptance/registration event itself is published. (#16)
Ante (Release v0.4.1): OrganizationSetupProgress, the durable read model backing organization-setup status, now also covers self-service registration - replacing the invited-tenant-creation-only projection that existed before, since both flows already shared the same status view and subscription tracker.
Ante (Release v0.4.1): Because status is derived from durable read models rather than process-local state, a dropped connection, an Ante restart, or a reconnect landing on a different replica all resume correctly from the same evidence.
Ante (Release v0.4.1): Owner-scoped authorization on the status queries (denying cross-actor observation of someone else’s invitation/registration status).
AI (Release v0.9.0): A cross-check specification now fails when a blocker is listed as remaining while the state that resolves it holds, when a blocker is recorded as resolved without that state holding, when a tracked document names a workflow that does not exist, when a workflow recorded as retired reappears, or when the preview-assets workflow asserts a readiness value the generated file contradicts. Each of the five was proven by planting the defect and watching it go red (#258)
AI (Release v0.8.0): public-chronicle-client-dotnet, -typescript, -kotlin, and -elixir move from content-gap to preview-source-candidate and now list a target. No profile composes another, so no .NET-specific Chronicle content reaches a Kotlin, TypeScript, or Elixir subscriber. (#178)
AI (Release v0.8.0): The product coverage catalog records what was verified: the four Chronicle client capabilities move to candidate against their named versions, and Kotlin and Elixir become current-corpus languages. (#178)
AI (Release v0.8.0): public-chronicle-client-java and public-chronicle-client-python are unchanged. No Chronicle Java client repository exists — the JVM client is Chronicle.Kotlin, whose Java surface the Kotlin skill covers — and Chronicle.Python carries package scaffolding with no implementation and no published package. Their notes now state the verified reason each stays a gap. (#178)
AI (Release v0.7.0): Lens guidance records that no store listing exists anywhere in its repository — building from source and loading unpacked is the only install path (#179)
AI (Release v0.7.0): Lens guidance records that its command payload form receives no schema today: it reads an introspection property named schema while Arc emits payloadSchema/argumentsSchema, and its four fallback schema routes are not mapped by Arc, so every command form falls through to the empty state with no raw-JSON editor behind it (#179)
AI (Release v0.7.0): Lens guidance records that the tenant header name, base URL and page origin have no user interface, so an application resolving tenancy any other way cannot be driven by it, and that header rules match XMLHTTPREQUEST only — the observable-query WebSocket and SSE transports carry no injected headers (#179)
AI (Release v0.7.0): Screenplay guidance records that the screenplay tool only verifies and never writes, that an unknown construct inside a slice is a warning that silently drops its block, and that the executable semantic model admits only StateChange and StateView, so Automation and Translate slices parse and bind to nothing (#179)
AI (Release v0.7.0): Stage guidance records that there is no rendering CLI, that the renderer needs an executable semantic model Stage ships no way to produce from .play files, that an unsupported construct blocks the whole plan rather than emitting less, that the sandbox enforces neither modeled validation nor authorization and its modeled queries deny by default, and that nothing
AI (Release v0.6.0): public-arc, public-arc-ef-core and public-arc-identity now list real capabilities and move from planned-source-migration to preview-source-candidate (#175)
AI (Release v0.6.0): public-arc-react now composes public-arc, and engineering-arc-react now composes engineering-arc — resolving either React profile previously dropped every backend Arc capability it depends on (#175)
AI (Release v0.6.0): cratis-arc-observable-query-http is no longer excluded from the public review candidate package: the rewritten source carries no host, port or route from any private environment (#175)
AI (Release v0.5.0): public-chronicle, public-chronicle-compliance, public-chronicle-multi-tenancy, public-chronicle-web-workbench, public-cratis-cli, public-cratis-cli-terminal-workbench, and engineering-chronicle move to preview-source-candidate and list their targets, so selecting one now installs content rather than reporting a gap (#177)
AI (Release v0.4.0): public-arc-react and public-components leave planned source migration for
AI (Release v0.4.0): public-arc-react now composes public-arc. Frontend Arc usage depends on
AI (Release v0.4.0): engineering-arc-react now composes engineering-arc alongside
AI (Release v0.3.0): The three skills are self-contained. The rule content they previously linked to under .ai/rules is repository-only and cannot ship through a profile, so the folder and naming philosophy, the never-sleep discipline, the scenario family, the singleton/tenant lifetime rule, and the implementation-discovery rule are carried in the skills and their references instead of linked (#174)
AI (Release v0.3.0): Package versions are stated from the published Cratis.Specifications, Cratis.Arc.Testing, and Cratis.Chronicle.Testing releases rather than inherited from the legacy text (#174)
AI (Release v0.3.0): public-specifications-dotnet, public-specifications-typescript, and engineering-base carry real content and move to preview-source-candidate, with gap summaries describing what is still missing rather than everything (#174)
AI (Release v0.3.0): The three catalog targets are classified: capability kind, invocation, applicability, trust effects, dependency edges, source contracts, and authoring contract. Security disposition stays pending and evaluation statuses stay missing, because no review or evaluation has been run for them (#174)
AI (Release v0.3.0): Each source record and distribution component points at the canonical tree with matching repository-snapshot provenance, so the digest, the revision, and the shipped bytes agree. Each retained legacy twin is modeled as its own repository-only component, and the .claude/.agents/.github skill projections move onto it — those folder symlinks resolve into .ai/skills and never exposed the canonical tree (#174)
AI (Release v0.3.0): public-skill-sources-and-resources moves from blocked-by-distribution-decision to retire-after-evidence, and mcp-generated-guidance-references to retain. #266 replaced the generated distribution with direct installation from main, so nothing ab
AI (Release v0.2.0): catalog/v2/repository-inventory.json and related generated catalogs regenerated for the new skill and source (46 sources, up from 45)
AI (Release v0.2.0): distribution/public-evaluation-eligibility.json: the new skill is explicitly excluded from marketplace eligibility pending effect assessment — the same disposition an existing skill (cratis-chronicle-reactor) already has — not force-approved
Chronicle (Release v17.0.1): Every gRPC service is now derived from Arc [Command]/[ReadModel] artifacts in Core rather than hand-written, completing the migration #2908 started. Source/Clients/Api and Source/Kernel/Core/Services are gone; only Observers and the streaming services, whose server-to-client lifetime no command or query describes, remain hand-written.
Chronicle (Release v17.0.1): Patterns is served by artifacts like everything else. Its five queries — MatchingPatterns, UsualActions, PatternsForScope, AllPatterns, AllPatternScopes — read storage and the mining engine directly, and the contract is generated from them. (#3857)
Chronicle (Release v17.0.1): Query parameters that name a concept are declared as that concept rather than as string, so the value is validated on the way in instead of being cast inside the method. The wire is unchanged — a concept still travels as its primitive.
Chronicle (Release v17.0.1): The two event-sequence lookups that answered with a bare bool and ulong now answer with EventSourceEvents and EventSequenceTail. The value travels as the same primitive, one level in.
Chronicle (Release v17.0.1): The Workbench’s surfaces are served by Arc artifacts in the kernel, with proxies generated beside the features that use them rather than into a separate Api folder.
Studio (Release v0.94.5): AuthProxyDeployment now backs its DataProtection key-ring volume with a dedicated in-cluster NFS server (AuthProxyKeysNfsServer) instead of a ReadWriteOnce PersistentVolumeClaim - the same shape already used and proven for RepositoryCacheNfsServer/SourceCodeNfsServer. Each AuthProxy deployment (Core, Lobby, MCP) gets its own dedicated server, keeping the same failure isolation the old per-service RWO claims had.
Studio (Release v0.94.5): With the volume no longer single-writer, each AuthProxy Deployment now uses RollingUpdate (maxSurge: 1, maxUnavailable: 0) instead of Recreate, taking the volume handover off the critical path of every deploy and every node event for the auth proxies - the front door, per the issue’s own measurements (up to ~7 minutes of Multi-Attach blocking on a deploy, over 8 minutes on an unplanned node loss).
Studio (Release v0.94.5): [x] dotnet build -c Debug - zero errors (668 warnings, matching this project’s pre-existing baseline; the new file’s StyleCop SA1402/SA1649/SA1633 warnings mirror the identical, already-accepted pattern on RepositoryCacheNfsServer.cs/SourceCodeNfsServer.cs)
Studio (Release v0.94.5): [x] dotnet build -c Release - zero errors, same warning baseline
Studio (Release v0.94.5): [ ] pulumi preview against a real environment, by whoever applies this (deliberately not run here)
Stagehand (Release v2.50.5): The event-schema release guard can now acknowledge a deliberate, window-managed schema change via Deployment/acknowledged-schema-changes.txt, so a change going through the scale-down + registry-repair procedure ships instead of being blocked forever; unacknowledged changes still hard-stop the release. (#738)
Studio (Release v0.94.2): Chronicle moves from 16.44.1 to 16.45.1, client and kernel together. Beyond the index fix this brings connection back-off and failure reporting that no longer hides projection, reducer and job errors.
Fundamentals (Release v7.18.4): Custom configurations enabling additional react/* rules must explicitly register their own compatible plugin; disabled React-rule defaults and version detection remain available (#1109)
Fundamentals (Release v7.18.4): Use the verified current Node/Corepack toolchain for JavaScript CI and publishing (#1109)
Chronicle (Release v16.45.2): The JSON Schema title is no longer part of the schema comparison that guards EventTypeSchemaChanged. It carries the CLR record name, so comparing it made renaming a record a breaking change despite a pinned [EventType("...")] identifier and an unchanged property set. It stays in the stored schema for tooling (#3926)
Chronicle (Release v16.45.2): An event type migration can now address a property inside a nested object — pb.DefaultValue(m => m.Price.Description, "unspecified") writes where it belongs, and pb.RenamedFrom(m => m.Price.Amount, e => e.Amount) moves a top-level value into the object it now belongs to. Registration validates such a path segment by segment and rejects one that resolves nowhere (#3949)
Chronicle (Release v16.45.2): A DefaultValue whose target the generation’s schema does not declare is now rejected at registration instead of skipped. Validation still exempts a default when the target generation has no schema to resolve against (#3949)
Stagehand (Release v2.50.1): The application’s canonical host is now app.cratis.direct; the apex cratis.direct remains the landing site on GitHub Pages, and stagehand.cratis.io continues to serve as the legacy host.
Stagehand (Release v2.50.0): AddTenantMember no longer requires the caller to already be a tenant member when the call is a trusted system flow (no HTTP request behind it at all) rather than a real user request - the same distinction its cross-cutting authorization filter already draws for the equivalent maintainer check.
Chronicle (Release v16.45.0): A client call made while the connection is down now fails instead of blocking its thread. A connect timeout surfaces as ConnectionTimedOut, acquiring the connect lock is bounded by the connect timeout, and a failed attempt starts a back-off during which calls fail immediately with ConnectionUnavailable. The watchdog still reconnects in the background, so a kernel that comes back is reachable again without restarting the client (#3948)
Chronicle (Release v16.45.0): A reducer method whose current read model parameter is non-nullable is now rejected at registration rather than silently excluded from dispatch. The current read model is null for the event that creates an instance, so the declaration can only ever be a mistake. Methods in a #nullable disable context are unaffected (#3947)
Chronicle (Release v16.45.0): An ASP.NET Core host no longer fails to start when the kernel is briefly unreachable; the connection failure is logged and the health check reports it until the connection comes up (#3943)
Stagehand (Release v2.49.7): The deployment now serves the cratis tenant namespace: events in Direct+es+cratis, read models in Direct+cratis — the durable form of the migration-window cutover. (#507)
Stagehand (Release v2.49.6): The product’s Chronicle event store and MongoDB database are renamed from Stagehand to Direct; deploying this requires the accompanying data-migration window (the deploy intentionally crash-loops until the migration runs — see the rebrand decision record). (#507)
Stagehand (Release v2.49.6): The tenancy migration scripts now support a combined store rename and namespace move (Stagehand/Default → Direct/cratis), including the Vault key segment move.
Stagehand (Release v2.49.5): Stagehand’s canonical public host is now cratis.direct, served by the primary AuthProxy whose GitHub OAuth app has moved there; stagehand.cratis.io remains served as a legacy host so existing links keep working.
Stagehand (Release v2.49.5): lobby.cratis.direct now redirects to the canonical domain and no longer depends on the dormant second-proxy configuration.
Stagehand (Release v2.48.0): The weekly digest is now a master/detail view: digests listed on the left with actions, the selected digest’s full content on the right. (#749)
Stagehand (Release v2.46.0): Tenant resolution now flows through a Stagehand-owned ITenantIdResolver, defaulting to the single built-in tenant until multitenancy is switched on — behavior is unchanged for existing installations until the rollout flags are flipped.
Stagehand (Release v2.45.1): The intake pipeline reports progress per gate instead of only recording the final classification outcome, so a stalled issue shows exactly which gate it never cleared.
Stagehand (Release v2.45.1): Operational visibility moves from hard-coded checks to the registered-resource model; existing behavior is unchanged until resources are registered (the feature ships dormant).
Stagehand (Release v2.45.0): Commands dispatched from reactors and endpoints no longer discard their results silently — ~150 call sites route through a helper that logs every refusal with its reason. (#252)
Stagehand (Release v2.45.0): Read-model constructors no longer hide missing projection wiring behind defaults in the high-traffic models (Issue, WorkItem, FinishedWorkItem, PullRequest, Alert, Plan, ReconciliationState) — including the epoch-dated LastActivityAt and fake-empty FailureReason. The remaining low-traffic models are inventoried for opportunistic cleanup. (#254)
Stagehand (Release v2.45.0): By-id queries for removable read models are honestly nullable — verified against the Chronicle kernel that removed instances resolve to null, correcting the premise this issue was filed under. (#255)
Stagehand (Release v2.45.0): Transient LLM failures retry with bounded backoff at the shared completion layer, and every LLM-driven reactor logs a skipped outcome instead of dropping it invisibly. (#257)
Stagehand (Release v2.45.0): Usage reports aggregate in MongoDB instead of scanning whole collections into memory; correlated build failures filter server-side. (#262)
Stagehand (Release v2.45.0): The sidebar and dashboard badges read lightweight count queries instead of subscribing to entire growing collections, and Content Creation observes only its own issues. (#263)
Stagehand (Release v2.45.0): Single-instance settings read models return one instance instead of a one-element collection. (#296)
Stagehand (Release v2.45.0): Push subscription secrets are no longer exposed by a queryable read model — the query surface carries endpoint metadata only. (#248)
Stagehand (Release v2.45.0): Endpoint authentication is centralized with RequireAuthorization instead of hand-rolled lambda checks. (#250)
Stagehand (Release v2.45.0): Worker-reported token, cost and duration values
Stagehand (Release v2.43.0): Issue status has transition rules: a closed issue only clears, and an issue already being worked cannot be silently re-queued — the races that resurrected merged cards are rejected server-side. (#708)
Stagehand (Release v2.43.0): GitHub installation tokens are minted once per hour instead of once per API call, with single-flight refresh; rate-limited reads back off with Retry-After honored (idempotent reads only — writes are never retried). (#711)
Stagehand (Release v2.43.0): The daily sync no longer churns: image-bearing issues stop re-appending identical bodies every pass, identical body changes no-op, and webhook deliveries no longer append phantom assignee/milestone facts — backlog ordering follows real activity again. (#717)
Stagehand (Release v2.43.0): Reactors with re-delivery risk are guarded: alert-investigation propagation, reopened-issue triage and question responses carry age guards; triage comments deduplicate; the Marketing backlog has one writer and its reducer no longer quarantines on first events; PlanChat survives malformed session ids and out-of-order messages. (#713, #715)
Stagehand (Release v2.43.0): 24 read models with no projection are marked passive, removing dead observers. (#716)
Stagehand (Release v2.43.0): The vulnerable OpenTelemetry 1.9.0 pins in Deployment are lifted to 1.18.0 and the Composition ASPIRE010 diagnostic is deliberately resolved, making the solution-wide Release gate runnable. (#718)
Stagehand (Release v2.43.0): The deployment’s MaxConcurrentWork setting is real again: it seeds the dispatch limit when no runtime concurrency was ever configured, and an explicit “no limit” is honored. (#529)
Stagehand (Release v2.42.2): A release is now cut only after the tree it describes has built, specced and linted — a failing spec no longer leaves behind a public GitHub release, a tag or release notes for a version that never shipped. (#706)
Stagehand (Release v2.42.2): Merging a pull request now comments “Merged in — will be released and deployed by the pipeline” on the issues it covers, instead of claiming they are fixed before anything has deployed. The close still happens at merge time; deploy-gated closure remains open under #706. (#706)
Stagehand (Release v2.42.2): The /health endpoint is reachable without signing in, so outside probes reach the running instance rather than the sign-in redirect. (#723)
Studio (Release v0.94.0): Kubernetes startup and readiness probes ask /health/ready; liveness asks /health/live.
Stagehand (Release v2.40.0): PR and release-note descriptions must now use a markdown bullet list under every section, with no prose paragraphs or numbered lists - shown with an example in the instructions agents are given. (#684)
Stagehand (Release v2.40.0): A consolidation’s own description is now written from the pull requests it actually replaces, so a consolidated release’s notes cover everything it absorbed. (#684)
Stagehand (Release v2.40.0): Every worker prompt whose work becomes (or updates) a pull request now tells the agent to fix whatever a build or test run turns up, not just confirm the run happened. (#686)
Stagehand (Release v2.40.0): An agent asking a question on an issue no longer @-mentions the reporter itself - Stagehand already does that when it posts the question, so writing it twice produced a doubled-up mention. (#687)
Studio (Release v0.93.1): Core, Admin, Lobby, Marketplace and the GitHub integration call the shared hosting instead of each
Stagehand (Release v2.39.0): Backlog status filtering now works correctly when selecting planned or unplanned issues; both default to inactive so you see all issues unless you explicitly filter to one or the other. (#651)
Stagehand (Release v2.39.0): The dashboard’s failed-partitions check now distinguishes “no failures found” from “could not check everything”, so recovery is no longer inferred for partitions that simply were not checked. (#644)
Stagehand (Release v2.39.0): The dispatcher now resolves the acting agent from a unit of work’s purpose - Wright by default, Bard for content authoring, Roadie for task runs, Medic for bug fixes - each running under its own harness and provider. Bug-classified issues, and issue groups made up only of bugs, are now automatically routed to bug-fixing work instead
Stagehand (Release v2.38.0): Branch name parsing recognizes and preserves the type/slug format; an unrecognized type is dropped and the remai
Stagehand (Release v2.36.4): Images are published to and pulled from GitHub Container Registry (ghcr.io/cratis). Publishing
Stagehand (Release v2.36.4): Image pins are bare name:tag, resolved against the configured registry and owner. A fully
Studio (Release v0.93.0): Studio no longer hosts a language model. Every AI feature runs on a provider the organization
Studio (Release v0.93.0): Chat mentions, slice assignment and spoken hand-offs only offer agents that can answer. Agents that
Studio (Release v0.93.0): The first-run panel says plainly that Studio brings no model and that a provider and an agent are
Studio (Release v0.93.0): A purpose now tries every agent that could serve it, in order, rather than only the best one — so an
Studio (Release v0.93.0): Enabling autonomous mode and picking a slice’s implementation agent both resolve the agent’s
Studio (Release v0.93.0): An agent can no longer be pointed at a provider that could not run it.
Studio (Release v0.93.0): Container images are published to and pulled from GitHub Container Registry (ghcr.io/cratis,
Studio (Release v0.93.0): The compute and batch pools each run two nodes instead of three.
Studio (Release v0.92.2): The batch pool is now only batch2 on PREMIUM-4xCPU-8GB; the 40 GB STARTER-4xCPU-8GB nodes are retired. Measured while retiring them, those nodes went from 9% to kubelet’s eviction threshold in forty minutes of ordinary CI load — a runner alone writes ~2.6 GB of ephemeral storage, against containerd already holding ~26 GB of the 30 GB in use.
Studio (Release v0.92.2): The pool has three nodes rather than the two the old one had. A node allocates 4 CPU and 7.8 Gi, a runner requests 1 CPU and 3 Gi, and arcMaxRunners is 3 — so three runners alone want 9 Gi, more than two nodes can offer before Cratis/Stagehand’s agent workers and the DaemonSets are counted. The scheduler was already reporting 0/8 nodes are available: 1 Insufficient cpu, 1 Insufficient memory against pending runner pods.
Stagehand (Release v2.36.0): “Fix build errors” is no longer offered on a card whose pull request also has a merge conflict. A conflicted pull request’s checks usually do not run at all, so two competing fix buttons only asked which to press first.
Studio (Release v0.92.1): The batch pool moves from STARTER-4xCPU-8GB (40 GB standard) to PREMIUM-4xCPU-8GB (100 GB maxiops), the plan compute2 already runs. UpCloud offers no 80 GB shape — /1.3/plan has exactly three 4xCPU-8GB plans, at 40, 100 and 160 GB — so 100 GB is the smallest that clears the target.
Studio (Release v0.92.1): The batch pools are now conditional on their config keys, as the compute pools already were, because a node group’s plan cannot change in place. This is phase one of the same add-drain-remove migration: batch2 is created alongside batch and both carry the same tainted batch label, so runners and agent workers land on either. Phase two deletes the batchNode* keys once the old nodes are drained.
Studio (Release v0.92.0): Chronicle moves to 16.44.1 and the production kernel image moves with it, Stage to 3.11.0, AuthProxy to 2.21.0, Arc to 22.10.1, and on the frontend Scene to 3.1.0 and Fundamentals to 7.18.3.
Studio (Release v0.92.0): The Chronicle observer check reports how long each partition has been failing, how many attempts it has taken, and how many other partitions of the same observer are affected, instead of only the most recent attempt.
Studio (Release v0.92.0): The three brainstorming region commands express their appends through the return type rather than injecting the event log, and state which stream their events belong to instead of leaving it to resolve by property order.
Studio (Release v0.92.0): The ban on any is lifted only for the generated proxies that actually need it, rather than for directory globs that had also stopped matching, over-reached into hand-written code, and outlived their reason.
Scene (Release v3.2.0): The React renderer arranges a canvas: it becomes the positioned ancestor its children are placed against, sized to its extent, with a child that names any of Canvas.Left, Canvas.Top, Canvas.Right or Canvas.Bottom placed absolutely. A child that names none stays in flow rather than being pinned to the origin.
Scene (Release v3.2.0): The name follows @cratis/components’ Canvas, which is the surface a Cratis application actually draws one on, rather than introducing a second word for the same thing.
Scene (Release v3.1.0): Cratis.PrimeReact and every theme built on PrimeTek’s presets now point at the PrimeUI Community license; every other package points at ours. This stopped being uniform when PrimeReact 11 relicensed from MIT, and a package picker can now show the difference at the moment someone is choosing rather than leaving it to a banner in production.
Stagehand (Release v2.35.0): Filing an issue records the intent and returns; the GitHub call is now the reactor’s. A refusal from GitHub is therefore no longer reported back to the person filing — the request stays in the log and nothing is registered locally. (#557)
Stagehand (Release v2.34.0): Issue classification is split into separate reactor pairs for labels and types, so deciding what to apply is decoupled from the GitHub call that applies it, and an IssueGitHubMirror read model removes the race in classification decisions. (#557)
Stagehand (Release v2.34.0): Comment posting to GitHub is unified behind a GitHubCommentPoster reactor; investigation reporting and question answering now emit events instead of
Stage (Release v3.11.0): What no model-bound attribute can carry is now reported rather than dropped in silence: the system-wide subscription an all block declares, a per-block no automap, a children block that says nothing about its parent, a clear with inside children, a from naming events it does not map, and any mapping an earlier block already claimed (#13)
Stage (Release v3.11.0): Specs compile the rendered output against the real Cratis assemblies, so a wrong attribute name, argument or target fails rather than passing a string comparison (#13)
Stagehand (Release v2.32.0): AI provider harness compatibility is now determined by IHarnessSupport strategy implementations instead of switches in Work dispatch logic. (#279)
Stagehand (Release v2.32.0): Account Profile Dialog is now larger for better visibility of linked accounts and settings.
Stagehand (Release v2.32.0): Agents view can now be sorted by different columns.
Stagehand (Release v2.32.0): Transferred issues now correctly appear in the backlog immediately after transfer. (#496)
Stagehand (Release v2.32.0): Pull request descriptions now display bullet points for completed items, making it easier to track what was done. (#373)
Stagehand (Release v2.32.0): Agent naming now updates identities retroactively — renaming an agent renames it across all past events it caused. (#526)
Stagehand (Release v2.32.0): Repository list now filters to show only repositories with issues enabled. (#495)
Studio (Release v0.91.0): @cratis/components 4 across every workspace. Components 4 owns its markup, styling and types outright and no longer sits on PrimeReact. It defines nine primitive slots — button, iconButton, textInput, textArea, checkbox, radio, switch, progress, surface — that a presentation library fills, and everything above them (DataTable, DataPage, CommandForm, Dialogs, Dropdown, Toolbar, Chat, Canvas, TimeMachine, ObjectNavigationalBar) is Components’ own and library-agnostic. (Cratis/StudioIssues#313)
Studio (Release v0.91.0): PrimeReact is now a selected library rather than an implicit dependency. Each application mounts PrimeReactProvider itself, outside CratisComponentsProvider, and registers primeReactUiLibrary from @cratis/components.primereact. @cratis/components.mui fills the same nine slots, so swapping is a change of one registration rather than a rewrite.
Studio (Release v0.91.0): The PrimeUI license goes straight to PrimeReactProvider. Components never receives it and takes only a non-secret boolean attestation, which is the documented arrangement — the adapter refuses to render without both.
Studio (Release v0.91.0): 29 files move onto Components’ own controls — TextInput, TextArea, Checkbox, Switch, Radio — and PrimeReact’s compound forms (Checkbox.Root/Box/Indicator and friends) collapse into the single components Components 4 ships.
Studio (Release v0.91.0): Theming moves into the application.styledMode() is gone from Components 4, so the preset, dark selector and cascade-layer order it used to assemble now live in .frontend/primeReactTheme.ts and .frontend/cratisPreset.ts, shared by all seven applications rather than repeated in each.
Studio (Release v0.91.0): The PrimeReact 10 palette is vendored into .frontend/. Components 4 removed the primereact-v10-palette export; Studio’s CSS names those variables in roughly 1400 places, so the palette becomes Studio’s own.
Studio (Release v0.91.0): Components’ overlay layering is CSS. The zIndex block every application passed to the provider is gone in Components 4, and its tiers now live in .frontend/components-overlay-layering.css at the same values. This is load-bearing rather than cosmetic: overlays portal to the body and Components’ own tokens stop at 1400, below ZIndex.fullScreenOverlay (9999).
Stagehand (Release v2.31.1): Production workers now run on Cratis/Studio’s tainted ci node pool (ContainerRuntime__NodePoolWorkload) instead of the pool running the services, and reserve 1 CPU / 2Gi with ceilings of 1500m / 4Gi.
Stagehand (Release v2.31.1): CPU throttles. A worker over 1500m runs slower and nothing else. That makes the CPU ceiling the one bound that protects a node’s kubelet at no cost to an agent run, so it can sit below the observed 3.10-core peak on purpose.
Stagehand (Release v2.31.1): Memory kills. A worker over its ceiling is OOM-killed and the agent session is lost. 4Gi therefore sits above the observed 3529 MiB maximum — a 2Gi ceiling would have killed roughly one run in five.
Scene (Release v3.0.0): @cratis/components 4. Components 4 owns its own markup, styling and types and no longer sits on PrimeReact, so scene.components and scene.blueprint.components take ^4.1.1 and their peer range moves with it — a breaking change for anyone consuming those two packages.
Scene (Release v3.0.0): scene.components no longer depends on PrimeReact at all. Its one PrimeReactProvider was in a spec, needed only because Components 3’s tooltip bottomed out in a PrimeReact component; Components 4 owns its own. primeicons stays as a Storybook-only devDependency, because the stories demonstrate the consumer-owned icon-font class string that Components 4’s Icon still accepts.
Scene (Release v3.0.0): scene.blueprint.components keeps its PrimeReact peers, and now supplies the provider itself. It composes blueprint.default’s shell, which reaches for PrimeReact directly in five places. Until Components 3 that provider came for free because CratisComponentsProvider wrapped PrimeReactProvider; under Components 4 it does not, so the Storybook preview declares both providers rather than relying on hoisting.
Scene (Release v3.0.0): scene.primereact and scene.blueprint.default are unchanged — they target PrimeReact deliberately.
Studio (Release v0.90.0): “UI template” is now “screen template” throughout — the domain, the editor, the routes and the user-visible text. A layout is an application’s base navigational shell and there is one; a screen template is a reusable shape inside it, at module, feature or slice level, and there are many. The two used to share a word. Stored events are unaffected: every [EventType] keeps its original identifier.
Studio (Release v0.90.0): The HTTP routes for the ten screen template endpoints change with the rename, from /api/.../features/ui-template/set-feature-ui-template to /api/.../features/screen-template/set-feature-screen-template and the same for the rest. Anything still holding an old route gets a 404. The frontend proxies, the generated C# clients and the MCP catalog are all regenerated here, so nothing in the repository points at the old routes.
Studio (Release v0.90.0): The PrimeUI license key is read as STUDIO_PRIMEUI_LICENSE everywhere — the applications already read that name, so the build now supplies it under that name too. The repository secret keeps PrimeTek’s own name, PRIMEUI_LICENSE; only the build-time variable carries the prefix Vite needs to expose it. Documented under Development → PrimeUI License.
Stagehand (Release v2.30.0): The merge-conflict prompt now tells the agent to expect part of the change to be merged already, and to resolve a conflict against something the base branch now contains by taking the base branch’s version rather than adding a second copy of it.
Stagehand (Release v2.29.0): Approve is no longer offered on a pull request that cannot merge because of conflicts, with the reason stated on the item. A merge blocked for another reason still offers Approve, since approving here is the review and is usually what clears the block.
Stagehand (Release v2.28.1): Improved mobile experience across the board; header widgets no longer clip.
Stagehand (Release v2.28.1): Work selection is driven by the URL, so a view can be linked to.
Stagehand (Release v2.28.1): Backlog can be filtered by planned and unplanned, and by type.
Stagehand (Release v2.28.1): Investigating, scheduled and developing issues are hidden from the backlog.
Stagehand (Release v2.28.1): Consolidated and grouped items go through the same pipeline as any other work, and are queued rather than shown as needing you.
Stagehand (Release v2.27.4): Collapsing only goes as far as the issues agree: they are bucketed by column, and by which of the two reasons put them in “Needs you” — the same rule a group card already follows, so a card never speaks for a member it would be describing wrongly. That bucketing is now shared between the two paths rather than written twice.
Chronicle.Kotlin (Release v4.0.0): Breaking: the client moves to chronicle-contracts 16.44.1. It was pinned to 16.16.0 while the kernel had moved on, so every namespaces call answered UNIMPLEMENTED against a current kernel. Job and JobStep are now JobSummaryResponse and JobStepSummaryResponse, and a constraint’s removedWith is a repeated field.
Chronicle.Kotlin (Release v4.0.0): Breaking: builder configuration callbacks that exist for Java take a java.util.function.Consumer, and the ones Kotlin shares gained a Consumer overload. Java lambdas no longer need the return null; that only satisfied a Kotlin Function1 — 90 of them across the documentation, the samples and the test fixtures. Kotlin callers are unaffected.
Chronicle.Kotlin (Release v4.0.0): Four documentation workflows that told a Java reader they were unsupported now show the real Java form; the remaining Kotlin/Java parity gaps in the snippet set are closed.
Chronicle.Kotlin (Release v4.0.0): The samples pin mongo:8.2. mongo:8 refuses to start on Linux kernel 6.19 or newer, which a current Docker Desktop uses, so the compose file fell over before Chronicle came up.
Stagehand (Release v2.27.3): A container started by an older runtime still works: the inline variable is read when no file was delivered.
Stagehand (Release v2.27.2): The decision moved to a static the specs can reach. Both of its failure modes are silent in production, which is a poor thing to leave unpinned.
Studio (Release v0.89.1): Upgraded Cratis Fundamentals to 7.18.3 and the Arc family to 22.9.0 — service registration no longer redoes process-invariant discovery work per container, and the command-scenario test harness no longer leaks a logger thread and service provider per spec.
Studio (Release v0.89.1): Upgraded Cratis Specifications to 4.1.0 and opted every spec assembly into its shared specification runner: a spec class is constructed once, Establish/Because run once, and every fact asserts against that single execution.
Studio (Release v0.89.1): Backend specs run their testhosts in parallel again; the job timeout drops from 45 to 20 minutes now that the suite no longer crawls under per-fact pipeline rebuilds.
Studio (Release v0.89.1): TypeScript proxies regenerated under the Arc 22.9.0 generator — doc comments are no longer HTML-escaped (comment-only drift).
Chronicle.Kotlin (Release v3.1.0): The compliance samples carry PII through ConceptAs types rather than bare strings. @Pii is declared once per kind of value, so every event and read model reusing that concept is PII-marked automatically and the sample files contain no @Pii of their own.
Chronicle.Kotlin (Release v3.1.0): Documentation snippets no longer spell out an explicit id on @EventType. The client already derives it from the type name, as the C# and TypeScript clients do; only the migration examples keep an explicit id, where two classes deliberately share one across generations.
Chronicle.Kotlin (Release v3.1.0): Twenty-one documentation pages that told a Java reader a workflow was unsupported now show the real Java form — among them applying @Pii to event properties, defining event type migrations, and observing a materialized page.
Chronicle.Kotlin (Release v3.1.0): The console and Spring Boot samples key their read models from the event context, so employees no longer share one storage key and overwrite each other.
Arc (Release v22.9.0): CommandScenario<TCommand> no longer registers a console logger by default — ILogger<T> resolves as a no-op, so no logging processor thread is spawned per scenario; opt in with scenario.Services.AddLogging(l => l.AddConsole()) before the first Execute/Validate to see log output (#2629)
Specifications (Release v4.1.0): Specification.InitializeAsync is now idempotent - Establish/Because run only on the first call per instance. Stock xUnit calls it exactly once per instance, so behavior without the opt-in is unchanged (#38)
Chronicle.Elixir (Release v2.3.0): The JSON schema generator descends into nested structs instead of flattening every non-numeric field to "string", so nested read models and structured event payloads register with an accurate schema (#40)
Chronicle.TypeScript (Release v4.0.0): compliance is a declared property on the JsonSchema type rather than written through a cast (#58)
Stagehand (Release v2.26.1): The push subscription’s authentication secret is never written to the causation chain, so it cannot reach the event log in the clear
Studio (Release v0.88.1): API keys and the credential-link token are never written to the causation chain, so they cannot reach the event log in the clear — the provider keys are already encrypted in the events they belong to, and the causation now gets the same treatment
Chronicle.Kotlin (Release v3.0.0): A class-level @Pii cascades to every property the class declares, matching .NET (#59)
Chronicle.Kotlin (Release v3.0.0): @Pii on a ConceptAs<T> is documented and specified for events and read models — declare it once on the concept and every property using it is encrypted (#59)
Chronicle.Kotlin (Release v3.0.0): chronicle-contracts moves from 16.13.4 to 16.16.0
Arc (Release v22.8.1): ARCCHR0009 no longer reports a property whose type cannot hold a secret — a date, a duration, a number, a bool, a Guid or an enum — however it is named, so AccessTokenExpiresAt is left alone while AccessToken is still reported (#2625)
Arc (Release v22.8.1): ARCCHR0009 honors [NotAudited] and [PII] on the property’s type, matching what the runtime already withholds, so marking a concept once covers every command that takes one (#2625)
Arc (Release v22.8.1): ARCCHR0009 judges a concept by the value it wraps, so a ConceptAs<string> holding a token is reported and a ConceptAs<DateTimeOffset> is not (#2625)
Arc (Release v22.8.0): Values Chronicle treats as personal data are withheld from the causation chain, honoring [PII] on the property, the declaring type, the positional parameter, and the concept — so a concept marked once carries the marking to every command that uses it (#2625)
Arc (Release v22.8.0): A recorded value is truncated at 1024 characters and marked where it was cut, since the causation travels on every event the command appends (#2625)
Stagehand (Release v2.24.1): The Chronicle client packages and the local development kernel containers now all run 16.44.0.
Studio (Release v0.87.1): The Chronicle client packages, the local development kernel container and the production kernel now all run 16.44.0.
Stagehand (Release v2.24.0): Upgraded to @cratis/components 4, which dropped PrimeReact entirely in favor of a nine-slot adapter that renders presentation primitives through PrimeReact 11 when a PrimeUI license is configured, falling back to native Components rendering otherwise. The app’s styling, theming and component provider stack have been restructured accordingly (#356).
Stagehand (Release v2.24.0): The chat sidebar now sits below modal dialogs instead of on top of them, making dialogs properly modal (#368).
Stagehand (Release v2.24.0): Items being retried now move to scheduled instead of remaining in retrying (#375).
Stagehand (Release v2.24.0): Work items on the board are now sent only when they have a defined status, filtering out incomplete items (#371).
Chronicle (Release v16.44.0): The Workbench is built on @cratis/components 4 and imports from explicit subpaths; Workbench-local components that the library now provides have been removed.
Chronicle (Release v16.44.0): Projection code generation is now a seam with one generator per language. DeclarativeCodeGenerator and ModelBoundCodeGenerator moved into Cratis.Chronicle.Projections.Engine.DeclarationLanguage.CodeGeneration.CSharp, and LanguageService takes the discovered IInstancesOf<IProjectionCodeGenerator> rather than the two C# generators directly — code that constructs these types itself, rather than resolving them, needs updating.
Chronicle (Release v16.44.0): ILanguageService.GenerateDeclarativeCode and GenerateModelBoundCode take the language to generate for, defaulting to C#, so existing calls are unchanged.
Chronicle (Release v16.44.0): Generated C# declarative projections and model-bound records are formatted over multiple lines rather than one long line.
Chronicle (Release v16.44.0): The Backoffice sample correlates each generated command separately, so a generated history no longer looks like a single action.
Stagehand (Release v2.23.0): The Backlog’s repository filter changed from single-select to multi-select behavior - click repositories to add or remove them from the filter (#349, #353).
Stagehand (Release v2.23.0): The repository selector component now uses PrimeReact’s Select for improved search and display capabilities (#349).
Stagehand (Release v2.21.4): A render failure is contained to the part of the screen that failed — a page that cannot render leaves the shell and navigation usable, and an overlay that cannot render takes only itself
Components (Release v4.1.0): The toolbar heading renders as a span sized by Components rather than a bare h1, so it no
Components (Release v4.1.0): The toolbar’s item count is sized to the filter button beside it, so the two read as one group.
Studio (Release v0.86.0): Update Screenplay to 4.12.0 for externally assigned stable semantic identities and display-name-independent workspace identity (Cratis/StudioIssues#289)
Stagehand (Release v2.21.0): Consolidating a selection that spans more than one repository is refused with a warning naming them, rather than attempted — a consolidated pull request is one branch in one repository
Stagehand (Release v2.20.5): Every dialog opens through Arc’s useDialog rather than being rendered inline behind a boolean, so opening one, passing it input, and closing it work the same way everywhere
Stagehand (Release v2.20.4): The navigation’s collapse control sits beside the brand, where the thing it acts on is named
Studio (Release v0.85.11): Align Arc 22.6.2, Chronicle 16.42.0, Stage 3.10.0, Screenplay 4.10.0, and the Chronicle kernel across Debug and Release (Cratis/StudioIssues#288)
Studio (Release v0.85.11): Adopt 149 reviewed, byte-for-byte deterministic generated proxy changes, including the required board-history range contract and additive barrel exports (Cratis/StudioIssues#291)
Studio (Release v0.85.11): Complete the remaining PrimeReact 11 and Components 3 compatibility migration exposed by a fresh frontend dependency graph (Cratis/StudioIssues#288)
Chronicle (Release v16.43.0): An event type generation whose enum only gained members, or had members renamed, no longer registers as EventTypeSchemaChanged. The wider member list replaces the registered schema instead. Removing or renumbering a member is still a schema change that needs a new generation.
Chronicle (Release v16.42.2): The pattern miner is a per-event-store-and-namespace grain owning the mining lifecycle — sketches, restore of established patterns, and deferred persistence — with the capture subscriber reduced to extracting features and forwarding each observed batch as a single call to its store’s miner.
Stagehand (Release v2.20.0): Triage suggests at most three labels, each a single word, and reuses a label the repository already has over coining a new one that differs only in casing
Stagehand (Release v2.20.0): The Weekly Digest page shows the digest itself, not only the language model’s few-hundred-character description of it — and any previous digest can be selected and read (#240)
Stagehand (Release v2.20.0): Chronicle upgraded to 16.42.1, with the local development kernel image pinned to the same version instead of a floating latest tag
Chronicle (Release v17.0.4): Chronicle in-process tests no longer run consumer command execution scopes inside the kernel pipeline; avoids missing EventStoreName resolution and unintended nested consumer transactions. (#3973)
Chronicle (Release v17.0.3): Commands whose kernel-side handling depends on IUnitOfWorkManager, IEventLog, or IEventTypes (any consumer combining Arc.Chronicle’s TransactionalCommandScope/*CommandResponseValueHandler types with Cratis.Chronicle.Testing) failed to resolve inside the in-process kernel command pipeline used by EventScenario, EventStoreForTesting, and TestingServices - those interfaces fell back to auto-activating the real client implementations, which need a live connection the in-process kernel does not have.
Chronicle (Release v17.0.3): [x] dotnet build (Debug/Release) - zero warnings, zero errors
Chronicle (Release v17.0.3): [x] Full downstream consumer spec suite (719 specs exercising CommandScenario, TransactionalCommandScope, and every *CommandResponseValueHandler) passes against a locally packed Cratis.Chronicle.Testing build
Studio (Release v0.96.3): With the startupProbe fix (#1340) landed, Prometheus’s server was getting far enough into startup to hit a real limit instead of being killed mid-replay by the liveness probe: it was getting OOMKilled (exit 137) replaying a WAL that grew past 500 segments — partly organic growth, partly self-inflicted by the crash-loop itself leaving an unclean shutdown behind on every prior cycle. Raised the memory request/limit from 512Mi/1Gi to 1Gi/2Gi, confirmed there’s ample headroom on the node pool (~55% utilized). (#334)
Studio (Release v0.96.1): Prometheus’s server had no startup probe, only a liveness probe with a ~75s budget — but WAL replay on this deployment’s volume takes several minutes, so the kubelet was killing it mid-replay on every single start. This had been crash-looping in production for 6+ hours, and silently failed every deploy’s Helm release regardless of what the deploy actually changed. Same fix shape as Chronicle’s missing startupProbe. (#334)
Stagehand (Release v2.50.13): Reactors that reacted to an event before its own read model had projected no longer strand permanently when projection lag outlasts the retry budget. Triage and auto-investigation already polled for the read model; the same wait now covers alert investigation propagation, auto-merge classification, plan generation, pull-request review evaluation, pull-request association, work-status propagation, plan reporting and investigation reporting. Ordinary lag resolves within the wait; only pathological lag falls through to Chronicle’s retry. (#769)
Stagehand (Release v2.50.12): The Triage sidebar badge now counts the issues that actually need a person, using the same rule as the Triage board’s “needs you” column: every waiting issue, plus every up-for-review issue whose repository is human-gated or whose pull request cannot merge on its own (conflicted or blocked). An automatic repository’s pull request that can still merge itself is no longer counted, and the badge label reads “needs you” instead of the stale “awaiting merge”. (#807)
Stagehand (Release v2.50.11): Scheduling ad-hoc work to investigate a build failure no longer files a duplicate GitHub issue in the target repository - the Stagehand’s own Failed builds view already gives that visibility, so the auto-filed issue was only noise. Other ad-hoc work (chat, brainstorming cards, alerts, manually scheduled work) still gets its issue filed as before. (#829)
Stagehand (Release v2.50.10): Content moderation now preserves the original content alongside the moderation/flag outcome, so a flagged item can be reviewed and restored instead of being lost when it is moderated. (#824)
Stagehand (Release v2.50.9): Backlog’s leading count now agrees with the active filter scope instead of showing an org-wide total next to a repo-scoped list - it read as if hundreds of rows were hidden when a repository (or other) filter was active, when the filter and the in-flight-plan exclusion were both working correctly. (#837)
Stagehand (Release v2.50.9): The Backlog’s issue-row list is now windowed (50 rows per page with a paginator) instead of mounting every filtered issue at once, avoiding a large unbounded render once a filter is cleared against a big untriaged pile.
Ante (Release v0.6.0): An unmatched request under /api, /openapi, /_invite or /healthz now gets a genuine 404 instead of falling through to the single-page application shell as a misleading 200. (#19)
Ante (Release v0.5.0): Fixed the organization-setup, join-tenant-acceptance, organization-registration, and legal-terms-acceptance outbox-forwarding reactors silently misrouting to a nonexistent inbox sequence — instead of the local event log — whenever Ante:EventStore was set to anything other than the literal "Ante". Any deployment already using a renamed store (as the README’s own “DirectLobby” example describes) was affected.
Ante (Release v0.5.0): Ante:InboxSourceStore does not retarget the inbox cross-subscription at runtime — Chronicle’s [EventStore] attribute requires a compile-time constant, tracked upstream as Cratis/Chronicle#3951. The setting exists solely to catch a mismatch against the compiled InboxSourceStore.Name constant at startup; retargeting it still requires editing that constant and rebuilding. Documented in full in Host Integration and Configuration, including the mirror-image constraint a host integrator hits writing their own reactor against a renamed Ante instance.
Ante (Release v0.5.0): The acceptance criterion calling for “a small reference host” demonstrating a nondefault store/source-store/namespace together is not implemented here — this repository has no existing sample/reference host project to extend (Ante itself is not yet deployed anywhere per the README), and building one is better scoped once the trust/compatibility decisions in #11 (this issue’s blocker) land. The independent configurability of all three settings is instead proven directly by specs and documented with a full non-default example.
AI (Release v0.10.0): CommandScenario<TCommand> does carry a Given builder, from Cratis.Arc.Chronicle.Testing. The legacy skill and the already-shipped cratis-specifications-csharp reference both stated the opposite, which documented seeding a read model for a concurrency-sensitive rule as impossible (#174)
AI (Release v0.10.0): EventScenario disables concurrency checking, so a concurrency specification written against it passes vacuously. Both the legacy skill and the shipped reference listed the assertions without saying so (#174)
AI (Release v0.10.0): [Singleton] is in Cratis.DependencyInjection, not Cratis (#174)
AI (Release v0.10.0): Command-side read-model injection is not keyed off [ReadModel], and has no slice or feature restriction — registration is global and comes from the backing projection, reducer, DbSet<T> or collection (#175)
AI (Release v0.10.0): IConstraintBuilder.Unique<TEvent> takes the message first and the name second, the reverse of the [Unique] attribute. Both convert implicitly from string, so the wrong order compiles and silent
Stagehand (Release v2.50.8): Recurring reconciliation passes (PullRequestSynchronizer, IssueSynchronizer, MissedItemReconciliation, IssueJanitor) no longer compare external truth against a read model whose projection is still catching up — they now consult a shared IProjectionQuiescence guard and defer to their next scheduled run while any read model they depend on is behind. This is the general fix for the reconciliation-vs-lagging-projection defect that mass-duplicated events (the acute ClosePullRequest instance was already fixed by an idempotency guard). The guard reads Chronicle observer state (the same mechanism the watchdog uses) and fails closed. (#778)
Ante (Release v0.4.2): All three onboarding wizards (UserSetupPage, OrganizationSetupPage, RegistrationPage) no longer dead-end on a reload, a second tab, or returning later: each now derives whether to show the form or a waiting/recovering state from durable status rather than a flag that only the original submitting tab ever knew about. Previously a reload after submitting - but before publication reached Ante’s outbox - showed the form again, risking a rejected duplicate submission. (#17)
Ante (Release v0.4.2): RegistrationPage no longer loses track of an in-flight or already-published registration on reload: it previously minted a brand-new id on every mount (useMemo(() => Guid.create(), [])), so a reload queried status for an id that had never recorded anything and always showed the form again. (#17)
Ante (Release v0.4.2): UserSetupPage’s timedOut branch - documented in #16 as “reserved for future use, not… a shipped behavior” because nothing on the backend ever produced it - now has real, working behavior, applied identically to all three wizards. (#17)
Ante (Release v0.4.2): Resolving the host redirect URL is now wrapped so a malformed HostAppUrl configuration surfaces as the existing “could not determine where to take you next” message instead of an uncaught exception - setup has already published by that point, so nothing about the person’s submission is lost. (#17)
Ante (Release v0.4.1): Removed the pre-append success signals in AcceptInvitation, SetupOrganization, and RegisterOrganization - each called into the status-subscription tracker before its event was even appended, so a polling client could observe “accepted” before the fact existed in Ante’s own event log, let alone reached the outbox. (#16)
Ante (Release v0.4.1): All four outbox-forwarding reactors (JoinTenantAcceptanceOutbox, OrganizationSetupOutbox, OrganizationRegistrationOutbox, LegalTermsAcceptanceOutbox) now verify their append to the outbox actually succeeded and throw when it did not, instead of discarding the result - a failed append previously advanced the observer’s cursor and was never retried or published. Throwing lets Chronicle pause and retry the failing partition instead. (#16)
Ante (Release v0.4.1): Outbox-forwarded events now carry the exact correlation id, occurrence time, and compliance subject Ante recorded locally, rather than fresh defaults picked up from the forwarding reactor’s own execution context - a host comparing the local and outboxed copies now sees identical values on every field. (#16)
Ante (Release v0.4.1): LegalTermsAcceptanceOutbox had no spec coverage at all before this change.
AI (Release v0.9.0): The Fundamentals preview-assets workflow asserted previewRequestEligible is false, which the tracked readiness file has contradicted since npm ownership and the trusted publisher landed. It now asserts the readiness state against the schema’s enum, so the next dispatch no longer fails on a step recording real progress (#258)
AI (Release v0.9.0): npm-stage-contract.json named release-approved-ai-profiles.yml as the production publication path; that workflow was deleted with the generated-distribution pipeline. It now names the workflow that really publishes (#258)
AI (Release v0.9.0): Tracked distribution state that described a superseded model: the 2026-08-22 remote-repository blocker list, rollout-policy.json listing two permanently-true-by-design conditions as pending blockers, an update-bot contract claiming a deleted workflow was ready, and release-automation capabilities that are no longer implemented (#258)
Chronicle (Release v17.0.2): Include Cratis.Chronicle.Compatibility.dll in both Chronicle.Testing and Chronicle.XUnit.Integration so each package starts independently beside Arc (#3968).
Ante (Release v0.4.0): Fixed a client-side bug where the legal-acceptance checkbox and the accepted-version field could be silently reset by CommandForm’s reactive value re-application on any unrelated re-render (e.g. opening the terms/privacy dialog) - initialValues and currentValues passed to CommandStepper were recreated on every render, and a defined value in initialValues always wins over currentValues for the same key, so the previously-hardcoded acceptedLegalVersion: '' baseline was reasserted over the real version on every reactive pass.
AI (Release v0.6.0): The client ValidationResult shape: it carries members: string[] (camelCased on purpose) and a numeric severity, not a propertyName and a string sev
AI (Release v0.5.0): Reducer guidance no longer shows a non-nullable current-state parameter; that shape now throws at registration rather than being skipped (#177)
AI (Release v0.5.0): Reactor guidance no longer references ReactorSideEffect, which does not exist in Chronicle; EventForEventSourceId is the real per-event metadata carrier, and its reactor support shipped long ago rather than being upcoming (#177)
AI (Release v0.5.0): [OnceOnly] is documented as replay exclusion rather than per-event-source deduplication, so side effects are still required to be idempotent (#177)
AI (Release v0.5.0): Reactor guidance no longer states a two-parameter limit, and [Reactor] is documented without the isActive argument it does not have (#177)
AI (Release v0.5.0): Read model guidance attributes [ReadModel], [Path], and the Observe extensions to Arc rather than Chronicle, requires ISubject<...> rather than a concrete subject type on query methods, and points single-document reads at ObserveSingle and ObserveById (#177)
AI (Release v0.5.0): Projection guidance drops the removed [FromEventSequence] attribute, puts UsingKey and its siblings on the per-event builder where they live, and
Ante (Release v0.3.0): The eager organization-name check (AcceptedOrganizationName) previously only saw names claimed through invited tenant creation. It now also sees names claimed through self-service registration, so the friendly “an organization with this name already exists” message fires for that case too, instead of only surfacing as an append-time rejection.
Ante (Release v0.3.0): Releasing an organization-name claim when an accepted creation is later revoked/rolled back. There is no host-facing contract event today for reversing an accepted InvitationToCreateTenantAccepted or OrganizationRegistrationCompleted - Ante’s job ends the moment that event is appended, and revocation in this codebase only ever applies to a still-pending invitation (before acceptance), which never claimed a name in the first place. Wiring a RemovedWith<T>() release path would mean inventing a new cross-repo contract event, which is a product/protocol decision beyond this work package’s scope. “Failed acceptance must not strand a claim” is satisfied by construction instead: a rejected command never appends an event, so no claim is ever created for it.
Ante (Release v0.3.0): Real concurrent (parallel) append load tests, migration/collision rehearsal tooling, and mixed old/new writer detection from the issue’s broader acceptance criteria are infrastructure/ops concerns beyond a single constraint-level change, and aren’t exercised by this repo’s existing spec conventions (see the pre-existing UniqueOrganizationNameConstraint spec, which is also sequential, not parallel) - the kernel’s append-time constraint check is what actually provides the concurrency guarantee here, independent of how the spec drives it.
Ante (Release v0.3.0): [x] dotnet build -c Debug (solutio
AI (Release v0.4.0): The DataPage reference documented an entirely fictional prop surface —
Ante (Release v0.2.1): AcceptInvitation and SetupOrganization now reject a caller who has not verifiably exchanged the exact invitation they are acting on. Previously, any signed-in caller supplying a known invitation id could complete onboarding for that invitation under their own identity, even without ever exchanging its invite token - the invitation id alone (visible in a URL, a token, or a shared link) was treated as sufficient. (#13)
Ante (Release v0.2.1): SignedInIdentity’s session lookup no longer falls back to the most recently accepted session when the current request’s subject does not match the one recorded for an invitation. That fallback treated contradictory evidence (a different login than the one that exchanged the invitation) the same as missing evidence, which could resolve the wrong identity provider and compliance subject for the events an onboarding command appends.
Ante (Release v0.2.1): SignedInIdentity’s session lookup now also excludes expired sessions, closing a window where a session past its nominal expiry - but not yet swept by MongoDB’s periodic TTL cleanup - could still be picked.
Ante (Release v0.2.1): [x] dotnet test - 78/78 passing, including new specs covering: a verified owner succeeds, a caller with no session/expired session/wrong-invitation session is rejected, contradictory subject evidence is rejected, and the jti-claim fast path verifies directly
Ante (Release v0.2.0): A repeated exchange for the same invitation no longer risks the earlier bug where each call was written independently, with no guard against extending the session’s effective lifetime on retry.
Ante (Release v0.2.0): Full signature verification of the invite token - this endpoint still only parses the token locally; the authentication proxy remains the actual trust boundary. Verifying that boundary depends on the proxy protocol still to be agreed in #11.
Ante (Release v0.2.0): Expiry enforcement on the jti/invite_type claims path the authentication proxy forwards per request (the primary identity-resolution path, ahead of the AcceptedInvitation session fallback this PR hardens) - also depends on the not-yet-finalized proxy contract from #11.
Ante (Release v0.2.0): [x] dotnet build (Debug) - 0 warnings, 0 errors, proxies unaffected (no [Command]/[ReadModel] surface changed)
Ante (Release v0.2.0): [x] dotnet test - 65/65 passed, including three new specs: successful exchange (now asserting the recorded expiry), an expired token being rejected, and a retried exchange establishing the same session both times
Ante (Release v0.2.0): [x] No frontend/TypeScript files touched - frontend gates not applicable to this change
Chronicle (Release v17.0.1): DateTimeOffset reached the wire as an empty message, so ten fields — job creation times, user timestamps, event query date ranges — carried no value to Kotlin, TypeScript and Elixir clients. .NET was unaffected, which is why it went unseen.
Chronicle (Release v17.0.1): The proto generator aborted for 22 of its 23 packages while exiting 0, so most generated contracts had silently stopped regenerating and an entire SequenceQueries service had never been emitted at all.
Chronicle (Release v17.0.1): Generated proto files and the descriptor set are now deleted and rewritten on every build, so a hand-applied edit to a generated file cannot survi
Studio (Release v0.94.6): Importing or previewing an event model no longer silently drops an event reference spelled with an equivalent GUID format (N/B/P/X), different casing, or surrounding whitespace — references now resolve by parsed GUID identity. (Cratis/StudioIssues#331)
Studio (Release v0.94.6): A malformed or unknown event reference, or two owned events declaring the same identity, is now rejected with an actionable failure before any canvas command runs, instead of silently continuing with a broken document. (Cratis/StudioIssues#331)
Studio (Release v0.94.6): Exporting a Screenplay folder no longer repeats a feature’s contribution (e.g. a navigation entry) once per slice — it now appears only once, on the feature’s own document, so merging the folder back no longer multiplies it. (Cratis/StudioIssues#332)
Stagehand (Release v2.50.6): Closing a pull request is now idempotent: the mirror only records a PullRequestClosed when the pull request is actually open, so a re-close appends nothing. Previously the periodic synchronizer decided to close off the eventually-consistent mirror read model, and whenever that projection lagged it re-issued the close every sweep — appending a duplicate PullRequestClosed each time (~826 per pull request in production) and flooding the event store with hundreds of thousands of spurious events. The guard uses a strongly-consistent passive state, so it holds even under read-model lag.
Studio (Release v0.94.4): Importing an event model no longer silently drops a consumed event’s reference when its producing slice lives in a module declared later in the same document. Producer slices across every module are now created before any consumer slice is imported, instead of per module. (Cratis/StudioIssues#330)
Studio (Release v0.94.4): Exporting a Screenplay folder no longer flattens nested features to the module’s top level. A slice several features deep (e.g. Sales/Shared/Details) now keeps its true ancestry in the exported file, so it no longer gets folded together with an unrelated feature that happens to share a leaf name under a different parent (e.g. Returns/Shared/Details). (Cratis/StudioIssues#329)
Chronicle (Release v16.45.3): Keyed model-bound child projections continue accepting updates after replay when an explicit event key matches the child key property. (#3922)
Studio (Release v0.94.3): Chronicle’s StatefulSet had no startup probe, only readiness/liveness — its measured ~73s cold start (and longer during recovery) exceeded the ~105s the liveness probe alone tolerated, so a cold or recovering start got killed mid-startup and crash-looped the shared kernel. Added a TCP startup probe on port 35000 with 400s of headroom (Cratis/StudioIssues#323, Cratis/StudioIssues#326)
Studio (Release v0.94.3): The cluster health watchdog reached the Kubernetes API by the kubernetes.default.svc DNS name, which depends on coredns — exactly what a node incident can disrupt, defeating the watchdog during the incidents it exists to report. It now uses the kubelet-injected KUBERNETES_SERVICE_HOST/KUBERNETES_SERVICE_PORT_HTTPS instead (Cratis/StudioIssues#320)
Studio (Release v0.94.3): The repository-cache and source-code NFS servers had no readiness/liveness probes, so a dead nfsd process left the pod reporting Ready while every consumer’s mount silently stopped working. Both now have a TCP probe on port 2049 (Cratis/StudioIssues#316)
Studio (Release v0.94.3): The cluster watchdog reported a pod stuck on normal ContainerCreating identically to one that never got scheduled, and treated any connection failure to a core pod — including a plain connection-refused from a still-starting or crash-looping container — as the same “likely wedged in Chronicle’s IProjectionsManager.Ensure()” diagnosis as a genuine hang. Pending findings now include the actual wait reason, crash-looping/not-ready pods are skipped, and a connection-refused failure is reported as its own, less alarming finding (Cratis/StudioIssues#317)
release-action (Release v1.3.0): Intentional no-release merges now report no-release instead of no-label, so workflows can distinguish suppression from missing version intent.
Studio (Release v0.94.2): Read-model properties that queries filter by are now indexed, so those queries stop scanning whole collections as the data grows. They had no effect before Chronicle 16.45.1, whatever they looked like in the source.
Studio (Release v0.94.2): The subscription read model no longer risks failing on a lifecycle event that arrives without the checkout that creates it. Every step of the state machine now handles the subscription not being there.
Stagehand (Release v2.50.4): AutoInvestigation no longer schedules a fresh investigation from a redelivered IssueScreened/IssueClassified evaluation that produced the same idempotence key as one it already scheduled - the loop that gave one issue five investigations in thirty-six minutes. (#822)
Stagehand (Release v2.50.4): AutoInvestigation no longer reacts to comments or cross-reference notes authored by the Stagehand’s own GitHub App identity - only a genuine change to the issue’s body or a comment from a real person schedules another investigation.
Stagehand (Release v2.50.4): An issue triage has already judged actionable now gets a fresh investigation when a real person adds new information in a comment (previously only the very first classification could ever trigger one).
Stagehand (Release v2.50.4): A per-issue cap (three investigations per issue per 24 hours by default) refuses further scheduling once reached, with the reason recorded on the issue.
Stagehand (Release v2.50.4): [x] dotnet build (Debug) - zero warnings, zero errors
Stagehand (Release v2.50.4): [x] dotnet build (Release, -p:CratisProxiesOutputPath=) - zero warnings, zero errors
Stagehand (Release v2.50.4): [x] dotnet test --no-build - 4149 passed, 20 pre-existing failures unrelated to this change (see note below)
Stagehand (Release v2.50.4): [x] Mutation-tested by hand: disabling either author check turns the corresponding new specs red; restored afterwards
Stagehand (Release v2.50.4): [x] New specs cover: self-comment doesn’t trigger, a cross-reference-flavored self-comment doesn’t trigger, a genuine human comment does trigger, a redelivered classification is declined with a recorded reason, the per-issue cap holds, and a full replay of the incident’s timeline schedules exactly one investigation
Fundamentals (Release v7.18.4): Remove the unused eslint-plugin-react dependency that made the shared config’s ESLint 10 peer graph invalid (#1109)
Fundamentals (Release v7.18.4): Keep native TypeScript 7 compilation separate from the official JavaScript API compatibility package used by lint and build tooling (#1109)
Stagehand (Release v2.50.3): The cross-tenant directory is pinned to the Default namespace again: after the cratis cutover every directory operation (tenant listing, membership, invitations and their outbox forwarding to the DirectLobby) had silently moved into the tenant namespace, where the lobby’s inbox never looks. (#507)
Chronicle (Release v16.45.2): A migration built from a nested property expression no longer fails registration with InvalidMigrationPropertyForEventType naming a property that exists one level down (#3949)
Chronicle (Release v16.45.2): A DefaultValue targeting a nested property no longer writes a top-level key with a dot in its name that the target generation’s schema then discards, leaving old events upcasting with the value missing and no error anywhere (#3949)
Stagehand (Release v2.50.2): Inviting the first member ever no longer refuses with “already been invited”: passive invitation and membership state now carries an existence flag, so a default instance materialized from an empty stream is distinguishable from real state. (#507)
Chronicle (Release v16.45.1): [Index] on a record’s positional constructor parameter now declares an index, as the documentation says it does. Previously only [property: Index] worked, and the difference was invisible — nothing reported that a declaration had produced no index. (#3954)
Stagehand (Release v2.49.8): The projection wait in issue triage and auto-investigation now stays under Chronicle’s 30-second subscriber timeout, so heavy catch-up load produces clean retries instead of subscriber timeouts that fail the partition. (#769)
Chronicle (Release v16.45.0): [AddFrom<T>] on a property of a [ChildrenFrom<T>] child no longer double-counts the event that creates the child entry. Accumulating child breakdowns produced exactly twice the value on the creating event, and every later event accumulated on top of that (#3940)
Chronicle (Release v16.45.0): A job left persisted as running with all of its steps already completed is now finalized instead of reported as already running. Such a job stayed wedged forever and its observer could never resubscribe, leaving reactors disconnected indefinitely (#3944)
Chronicle (Release v16.45.0): A read model’s declared indexes are now recreated on the collection a replay fills, so they survive the swap that ends the replay instead of being absent until the sink is rebuilt (#3942)
Studio (Release v0.94.1): Live queries now stop observing when the last client disconnects, instead of holding a database connection for the lifetime of the server. Studio no longer gets progressively slower the longer it has been running — measured on a server that had degraded to 7.6s, the same query answers in 0.15s.
Studio (Release v0.94.1): The organization’s agents and configured AI providers left two subscriptions open per viewer; they were the largest single source of the slowdown.
Studio (Release v0.94.1): The signed-in user’s details are resolved once per request instead of several times, removing repeated database round trips from every authenticated request.
Studio (Release v0.94.1): A server that loses its connection to Chronicle no longer accumulates blocked threads until it runs out of memory. It now reports itself unhealthy and is taken out of rotation, where before it could grow to thousands of stuck threads while still appearing to run (Cratis/Chronicle#3948).
Stagehand (Release v2.49.4): Issue triage and auto-investigation activate again: the projection-race fix in v2.49.3 named its awaiter interface outside the DI naming convention, so production could not resolve it and every screened issue failed. The interface now matches its implementation the way the convention requires. (#769)
Arc (Release v22.10.4): Exclude child and nested model-bound types from standalone Chronicle command read-model registration, matching Chronicle’s projection discovery (#2587)
Arc (Release v22.10.4): Detect ambiguous command identities declared through positional [Key] parameters, without counting the same property twice (#2645)
Stagehand (Release v2.49.3): Issue triage and auto-investigation no longer strand permanently when an issue’s events arrive before its read model: the reactors now wait briefly for the projection themselves, with Chronicle’s retry as the backstop only for pathological lag. (#769)
Stagehand (Release v2.49.2): Post-merge bookkeeping no longer re-runs its GitHub side effects when a catch-up or replay hands it historical pull-request closures - stale events are skipped the same way the other guarded reactors skip history. (#770)
Stagehand (Release v2.49.2): Deleting a pull request’s branch now treats an already-deleted branch as success instead of failing the observer partition. (#770)
Arc (Release v22.10.3): Recognize [Key] on a positional record’s primary-constructor parameter when resolving a command’s event source id, so it behaves the same as [Key] on a property (#2645)
Arc (Release v22.10.3): Register each ICanResolveReadModelForCommand provider itself in DI (not just its per-type factories), so IEnumerable<ICanResolveReadModelForCommand> reflects every registered provider (#2645)
Stagehand (Release v2.49.1): Resource probing stays enabled across deploys now that production has operational resources registered; previously the activation-time flag would silently revert on the next deploy. (#750)
Stagehand (Release v2.48.0): Pull requests with a merge conflict now sit in the «Needs you» board column instead of «scheduled», also while an automatic conflict-resolution fix is merely queued. (#744)
Stagehand (Release v2.48.0): Opening resource usage on an issue no longer crashes when worker-reported numbers are missing; formatting is null-safe and the backend now rejects absurd CPU/memory values the same way it rejects bad token and cost values. (#747)
Stagehand (Release v2.48.0): The chat now slides in beside the work without blocking the rest of the app; the same button slides it out. (#748)
Stagehand (Release v2.48.0): The Chronicle connection check now reports unhealthy when Chronicle is unreachable, instead of always healthy. (#755)
Stagehand (Release v2.48.0): Agent work stuck behind a configuration impediment in a provider pool now shows the specific credential problem instead of a generic pool message. (#746)
Stagehand (Release v2.45.1): Agent worker pods start again: the worker Job’s pod spec now pins the agent user’s numeric UID (1655) so Kubernetes can verify the runAsNonRoot assertion — since 2.44.0 every worker pod failed with CreateContainerConfigError and no agent work could run. (#756)
Stagehand (Release v2.44.0): Release-severity SA1204 (static member ordering) in RespondingToQuestion introduced by the wave-3a merge resolution — caught by the new verify-before-tag pipeline before anything was cut, published or deployed.
Stagehand (Release v2.42.1): Approving from a multi-repository card now sends one merge per pull request, keyed by owner/repo#number — previously two PRs sharing a number resulted in only one being merged while both reported approved. (#663)
Stagehand (Release v2.42.1): An approve click that matches no pull requests now reports a failure instead of a success toast over zero commands. (#663)
Stagehand (Release v2.42.1): The Approve button is no longer offered on merge-blocked items, and only appears when the full pull-request association is present. (#652)
Stagehand (Release v2.42.1): Retry is no longer offered on items without a failed run. (#654)
Stagehand (Release v2.42.1): The issue-creation dialog no longer resets the chosen repository when the AI expansion arrives, and no longer auto-selects a repository that cannot accept new issues (the auto-select pinning an issues-disabled repository was what made filing look impossible). (#726)
Stagehand (Release v2.42.1): Retry discovery for an organization now sends the required tracking policy instead of always failing validation. (#695)
Stagehand (Release v2.42.1): Cluster-namespace association changes and notification-preference failures now surface errors through the standard command feedback instead of silently discarding results or rendering raw exception text.
Stagehand (Release v2.41.0): Agent re-seeding on deploy no longer wipes live configuration: seeding now merges, preserving the operator-set provider, pool, model, harness and effort — the silent killer of classification after any seeded-agent change. (#725)
Stagehand (Release v2.41.0): The daily GitHub consolidation sweep no longer dies on the first failing repository or step: each of its five passes and each repository is fault-isolated, and the heartbeat records completion even with partial failures. (#645)
Stagehand (Release v2.41.0): A repository misreported as issues-disabled now heals: a failed GitHub read logs a warning instead of silently leaving the flag stuck. (#683, #726)
Stagehand (Release v2.41.0): Comment synchronization no longer deletes mirrored comments when a GitHub page read fails or is rate-limited — failure is no longer treated as absence.
Stagehand (Release v2.41.0): Issue webhooks register the issue before image synchronization runs, so a slow image download can no longer make GitHub’s 10-second delivery timeout swallow the whole issue.
Stagehand (Release v2.41.0): The failed-partition watchdog can see the Chronicle store again: watched-server addresses parse correctly for both bare host:port and full URI forms (the same defect existed twice). (#607)
Stagehand (Release v2.41.0): Dispatch can no longer destroy a live worker: launching checks whether the previous attempt’s Job is still alive and records an impediment instead of deleting it mid-session. (#500)
Stagehand (Release v2.41.0): A refused StartWork after container launch is retried and surfaced as an impediment instead of being silently discarded.
Stagehand (Release v2.41.0): Answered questions no longer strand work items in WaitingForAnswer forever (which also permanently blocked repository-cache maintenance).
Stagehand (Release v2.41.0): Worker callback tokens are only revoked after the outcome is recorded, so harness retries no longer get 401 and lose the result.
Stagehand (Release v2.41.0): Pull-request association and status propagation now redeliver under read-model lag instead of silently associating nothing — the “Approve says no associated pull request” class. (#663)
Stagehand (Release v2.41.0): CompleteWork and AskQuestion now guard against already-terminal work, like FailWork always did.
Studio (Release v0.93.1): The document served for / and every client-side route now sends no-cache. It previously went
Chronicle (Release v16.44.2): Stopped a shutdown requested during kernel startup from crashing with an unhandled exception; it now stops gracefully and logs the shutdown (#3936)
Chronicle (Release v16.44.2): Fixed a NullReferenceException when an observer activates against an unset projection definition (#3934)
Chronicle (Release v16.44.2): ReactorScenario now surfaces what a reactor handler throws instead of swallowing the exception, so throwing reactors can be specced (#3933)
Chronicle (Release v16.44.2): In-memory event sequence storage now records the real identity that caused an event instead of hardcoding Identity.System, so in-process scenarios can assert event attribution (#3928)
Chronicle (Release v16.44.2): ReadModelScenario’s GetInstanceById now returns null for an instance that was never seeded instead of throwing (#3927)
Chronicle (Release v16.44.2): The client now keeps retrying artifact registration in the background after it fails on an otherwise healthy connection, instead of leaving observers disconnected indefinitely until the next reconnect (#3935)
Chronicle (Release v16.44.2): dotnet build (Debug and Release) — zero warnings, zero errors across every affected project
Chronicle (Release v16.44.2): dotnet test — zero failures across Core.Specs, Testing.Specs, DotNET.Specs, Storage.InMemory.Specs, Services.Specs
Chronicle (Release v16.44.2): #3936’s fix is top-level Program.cs startup/shutdown control flow, which has no automated spec coverage in this codebase and was not exercised against a live kernel process in this session — it was verified by code review only (catching OperationCanceledException, the base type TaskCanceledException derives from, around app.RunAsync is the standard .NET pattern for a cancellation requested during startup). Flagging this as unverified-at-runtime rather than claiming a manual test that wasn’t actually run.
Screenplay (Release v4.12.1): The invoicing sample declared layout MasterDetail/layout DashboardLayout nested inside the module and referenced them from screens as layout X. The current grammar declares the application shell as a top-level layout (with an arrangement), selected from a ui profile, while a module declares screen template/dialog template and a screen fills one with template X. The sample now matches the shape already used and compiler-verified in for_ScreenplayCompiler/invoicing.play.
Screenplay (Release v4.12.1): The editor’s symbol scanner (screenplay-language/symbols.ts) matched any two-token indented line as a typed property, without excluding reserved directive keywords. authorize <Policy>, produces <Event>, tag <Name>, validate csharp, and each concurrency dimension (sourceType/streamType/streamId <Value>) were all misread as properties and flagged “Unknown type” whenever the second token wasn’t coincidentally a declared concept or type — 16 false warnings on the invoicing sample alone. Directive lines are now excluded from property matching, honoring the existing @name escape for the rare property genuinely named after a reserved word.
Stagehand (Release v2.36.3): The GitHub settings tab no longer reports “Issues disabled on GitHub” for repositories that have issues enabled.
Stagehand (Release v2.36.3): The sweep that closes issues deleted on GitHub now actually runs. It had been skipping every repository. (#628)
Stagehand (Release v2.36.2): An issue deleted on GitHub is now mirrored as closed even if the deletion was missed at the time — during downtime, or on a dropped webhook delivery. (#628)
Stagehand (Release v2.36.1): Work waiting for a person now appears in the triage board’s “Needs you” column. A repository that never chose a review gate defaults to Human, as the settings tab has always shown — the board disagreed and sent that work to “PR open”.
Stagehand (Release v2.36.1): An issue closed on GitHub no longer keeps a card on the triage board. It kept one whenever it was closed while sitting at “for review”, advertising work to review on something already finished.
Stagehand (Release v2.36.1): An issue deleted on GitHub is now mirrored as closed. A deleted issue never appears in what reconciliation reads, so it stayed in the backlog as an open mirror of something that no longer existed.
Stagehand (Release v2.36.1): Fixed the build: three issue-creation dialogs imported commandFailureMessage and useToast twice after the pull request consolidation, and FileIssueDialog declared toast twice.
Stagehand (Release v2.36.0): Issue-creation dialogs now show why creation failed instead of closing as though it had worked. Applies to all five: the backlog, alerts, brainstorming cards, chat messages, and failed Chronicle partitions. (#610)
Stagehand (Release v2.36.0): GitHub App token resolution now works for installations created before the app identity system existed, which is what made issue creation fail in the first place. (#610)
Stagehand (Release v2.35.2): Opening the filter in the Backlog no longer breaks the page — the repository facet renders, and picking repositories narrows the list again. (#611)
Stagehand (Release v2.35.2): The Boards filter in Brainstorming, which shares the same filter button, is fixed by the same change.
Studio (Release v0.92.0): A read model keyed on a Guid-backed identity while its events are appended on a name no longer freezes that organization’s projection with Unrecognized Guid format while every pod stays green.
Studio (Release v0.92.0): The GitHub integration workspace’s ci script called tsc directly rather than through yarn g:compile, so it died with “command not found” and that workspace’s TypeScript was never compiled by anything.
Stagehand (Release v2.35.1): Merging a pull request that covers many issues now completes its bookkeeping. Each covered issue is closed on its own partition rather than all of them inside one handler, so the work no longer grows toward the subscriber timeout and stops being abandoned partway through. (#604)
Stagehand (Release v2.35.0): Labels and types identified during classification now actually reach GitHub. Both new integration reactors executed their command with no caller established, so deny-by-default refused it into a discarded CommandResult — nothing was applied, nothing was logged, and no partition failed. (#557)
Stagehand (Release v2.35.0): An explicit release decision on an issue is no longer dropped from FileIssue, which stopped compiling in Release when the rewrite removed the analyzer suppression covering its provided repository (Cratis/Arc#2615). (#557)
Stagehand (Release v2.33.2): Applying a roadmap plan a second time no longer recreates the group or re-opens issues a person has since moved on. (#290)
Stagehand (Release v2.33.2): Ad-hoc work no longer files duplicate GitHub issues when the first attempt is interrupted part-way through a multi-repository fan-out. (#290)
Stagehand (Release v2.33.2): A weekly digest is no longer re-analyzed on re-delivery, which paid for the language model a second time and could republish a digest that was already public. (#290)
Stagehand (Release v2.33.2): The marketing backlog page renders again - it referenced a package that does not exist and left required props off both the data page and the detail panel, so the frontend did not compile.
Stagehand (Release v2.32.2): Merging a pull request no longer buries the issues it closes under repeated “Fixed in …” comments. The bookkeeping now checks GitHub for its own comment before posting, so a handler that is retried or replayed does nothing instead of commenting and closing again. (#290)
Stagehand (Release v2.32.2): Post-merge bookkeeping no longer reads the whole event log on every merge. Two full scans per event were what pushed it past Chronicle’s 30 second subscriber timeout on a large store, and a timed-out handler is retried with its GitHub writes already sent - which is what produced the duplicate comments. (#290)
Stage (Release v3.11.0): A key declared on a from block, or on one of its events, is carried onto [FromEvent]. Chronicle seeds every projection with the event source id and never derives routing from [Key], so a keyed projection was writing its documents under the event source id instead of the key it declared (#13)
Stage (Release v3.11.0): no automap was not read at all, so a projection that disabled automapping rendered with it enabled and mapped event properties the model deliberately excluded (#13)
Stage (Release v3.11.0): clear with on a read model emitted a class-level [ClearWith] that Chronicle only reads on a nested type, so it compiled and was then discarded (#13)
Stagehand (Release v2.32.0): Agent-opened issues no longer receive automatic comments from the system. (#378)
Stagehand (Release v2.32.0): Issues without associated problems are now classified correctly instead of being marked as blocked. (#515)
Stagehand (Release v2.32.0): Items marked as blocked now correctly disable the approve button. (#513)
Stagehand (Release v2.32.0): Images added on GitHub are now visible in Stagehand immediately. (#517)
Stagehand (Release v2.32.0): Race condition in work scheduling that could dispatch the same item twice under concurrent passes. (#256)
Stagehand (Release v2.32.0): “Needs you” items on the backlog now display correctly with accurate filtering and status. (#381)
Stagehand (Release v2.32.0): Backlog now correctly freezes the top of the list to prevent scroll loss when viewing pinned items. (#492)
Stagehand (Release v2.32.0): In-progress filter now accurately shows only issues currently being worked on. (#493)
Studio (Release v0.91.0): Dropdown, DataTable and the form controls now hand their change handler the value rather than an event, and a cleared selection is explicitly null — every selection handler converts it. DataPage’s callbacks are annotated because TDataType appears only inside TQuery’s constraint, so nothing infers it; Components 3 got away with it by typing the event loosely.
Studio (Release v0.91.0): Button severity becomes tone, and the glass Stepper pass-through types against Components’ own StepperParts rather than PrimeReact’s stepper props.
Arc (Release v22.10.1): In source-file grouping mode, two types sharing a short name could have one rewrite the other’s imports, producing TypeScript that does not compile. BuildImportPathFixups skipped any type whose file was already named after it — true that it needs no rewrite, but it also took that type out of conflict detection, so the other type claimed the short name unopposed and the fixup was applied to every import of either.
Arc (Release v22.10.0): A read-only dictionary is now recognized as a dictionary.IsDictionary only looked for IDictionary<,>, and IReadOnlyDictionary<,> is its sibling rather than its derivative — so a model exposing its dictionaries read-only, the natural shape for an immutable record, was not seen as holding dictionaries at all. IReadOnlyDictionary<string, IReadOnlyList<T>> now generates as Record<string, T[]> instead of a KeyValuePair[] referencing a type that was never imported. (#2634)
Arc (Release v22.10.0): Library mode no longer aborts on a model with two read-only dictionaries. Those unrecognized dictionaries put two closed instantiations of KeyValuePair<,> in one output file, and the duplicate-path guard stopped the entire run. With them recognized, CollectTypesInvolved takes only the value type as it always did for the mutable shape, and no KeyValuePair is emitted. (#2634)
Arc (Release v22.10.0): Library mode no longer aborts on an open generic either. It collected open definitions such as CompilationResult<T>, and walking one reached its own type parameter — which has no full name, so it produced a nameless descriptor landing on the definition’s own path. An open definition has no concrete shape to emit and a generic parameter is not a type, so both are skipped. (#2634)
Scene (Release v3.0.0): SceneTooltip passed a slot straight to Tooltip. Components 4 takes one focusable trigger element, which it clones to attach its own part attributes, and a Scene slot is a list — so it now wraps the slot in a single element rather than failing to type.
Studio (Release v0.90.0): The reusable frontend build action supplied the
Stagehand (Release v2.29.1): The push-driven mergeability refresh no longer runs for historical pushes. It was guarded with a [Replay] no-op, which covers a replay but not a catch-up — an observer resuming behind delivers its backlog as ordinary live events, leaving such a guard inert.
Stagehand (Release v2.28.2): Every pull request now gets a release label, whatever its size. The label was decided as a by-product of the auto-merge classification, which deliberately skips reading a diff once a change is past 15 files or outside the paths a repository allows auto-merge to consider — so the larger the change, the more certain it was to end up with no label at all. The consolidation of seventeen issues changed 358 files and came out unlabeled, which left the publish workflow with nothing to cut a version from.
Stagehand (Release v2.28.2): A change whose diff went unread is now asked what release it warrants as its own narrower question, judged from the names of the files it touched rather than their diffs, so it scales to any size. The merge decision keeps its existing limits, and a person’s decision on the issue still outranks both.
Stagehand (Release v2.28.2): no-release is accepted as an answer to that question — the fourth release intent the publish pipeline understands, and the right one for a change that ships nothing.
Stagehand (Release v2.28.1): Approve is hidden rather than shown greyed out when an item cannot be approved, with the blocking reason stated on the item instead. (#425)
Stagehand (Release v2.28.1): Issues sharing one pull request collapse into a single card instead of one card each.
Stagehand (Release v2.28.1): Pull request checks are shown on consolidated and grouped items.
Stagehand (Release v2.28.1): Workers no longer fail to start on a large prompt - it is delivered as a file rather than an environment variable, which an argument list could not hold.
Stagehand (Release v2.28.1): A worker whose job is stuck deleting is released rather than deadlocking every later dispatch.
Stagehand (Release v2.28.1): A transient cluster refusal no longer fails the work it was launching; it records an impediment and stays queued.
Stagehand (Release v2.27.4): Issues associated with the same pull request collapse into a single card, named after the pull request. Against production’s current board that turns 19 cards into 3 — one per pull request.
Stagehand (Release v2.27.4): Consolidating counts distinct pull requests rather than issues that have one. Counted by issue, a single collapsed card read as “17 pull requests” and was allowed through, which folds a pull request into itself.
Chronicle.Kotlin (Release v4.0.0): Both console samples opened their live watch before seeding, and a watch on a read model with no instances throws (Cratis/Chronicle#3925) — so the subscription was lost on every fresh store. It now starts once seeding has given the projection something to watch.
Stagehand (Release v2.27.3): The prompt travels as a file on the volume the credentials already use, and the container specification carries only its path. Both runtimes land on the same contract, so the entrypoint has one code path rather than one per runtime.
Stagehand (Release v2.27.3): The entrypoint reads it with jq --rawfile instead of passing it as an argument. argv has the same limit, so moving the problem one exec along would have fixed nothing.
Stagehand (Release v2.27.3): A prompt past 512 KiB is cut with a marker telling the agent its instructions were truncated, rather than refused — the Secret it shares with the credentials holds 1 MiB, and refusing would leave the work queued behind an impediment it could never clear.
Stagehand (Release v2.27.2): A Job with a deletion timestamp and no running pod is reported as gone rather than alive, so the work is resumed instead of parked for a day. A deletion that still has a pod on it stays alive — that worker is pushing what it committed from its SIGTERM trap, and taking it for dead launches a second one onto the same branch.
Studio (Release v0.89.1): Three BoardActivity spec classes re-stubbed mocks or re-ran the action under test inside individual facts; they are restructured to one action per spec class with assertion-only facts, as the spec conventions require.
Stagehand (Release v2.27.1): Worker Jobs now ask the scheduler to spread them across nodes rather than stacking them on one. The constraint is a preference (ScheduleAnyway), not a bound: a cluster with genuinely no room still schedules, because leaving workers Pending would trade an occasional dead node for a silent dispatch stall — the failure #437 exists to end. Real resource requests need measuring against the largest tracked repository first (#438).
Stagehand (Release v2.27.0): Work whose previous worker can never finish terminating is now freed. A worker Job is named after the work it runs, foreground deletion waits for confirmation its pod is gone, and a pod on a node that has stopped reporting can never give it — so the Job kept the name and every dispatch after it answered 409 object is being deleted, indefinitely
Stagehand (Release v2.27.0): Work is no longer failed when the cluster refuses to start a worker. A pod’s service account token is bound to the pod, so every request the Stagehand still has in flight when its own pod is deleted comes back 401 — which a deploy guarantees. That was caught by the generic handler, which fails the work, and failing work clears the status of every issue it covers. On 2026-09-01 it took out 22 units of work covering 27 issues in fifteen minutes, and every one of those issues left the board. A refusal that is about the cluster now records an impediment and leaves the work queued; a rejection the work itself caused still fails it
Stagehand (Release v2.27.0): A consolidation no longer offers to approve the very pull requests it is folding away (#435)
Stagehand (Release v2.27.0): Approve is hidden, with the reason stated, while a pull request’s checks are failing or an agent is still working — a greyed-out button still read as “nearly ready” (#425)
Stagehand (Release v2.27.0): The issues an open consolidation covers no longer appear as their own cards beside it (#431)
Stagehand (Release v2.27.0): A consolidation takes its column from the consolidation itself — queued while it waits for a worker, developing while it runs — instead of from issues that sit at “for review” throughout, which put in-flight consolidations under “Needs you”
Chronicle.Kotlin (Release v3.1.0): Connecting with artifact discovery on no longer fails to start. The classpath scan classified anonymous, local and inner classes as artifacts and then could not construct them — including the client’s own Java adapters — so registration threw before the first reactor was registered.
Chronicle.Kotlin (Release v3.1.0): Registering an event type or read model declared as a Java record with a primitive component (double, int, boolean) no longer throws while its schema is generated.
Arc (Release v22.9.0): AddCratisArcMeter no longer creates and abandons an undisposed Meter on every call after the first — the meter is created only when actually registered and is now owned and disposed by the service provider (#2629)
Fundamentals (Release v7.18.3): AddBindingsByConvention and AddSelfBindings no longer re-walk the full assembly reference closure on every call — the walk now runs only when an assembly no previous walk has processed is loaded, while assemblies loaded later still get their module constructors run on the next registration call (#1107)
Fundamentals (Release v7.18.3): Generated binding replay now guards duplicates with a set of registered service types instead of a linear scan of the service collection per binding, making the replay linear in the number of bindings (#1107)
Fundamentals (Release v7.18.3): Types.All is materialized once at construction instead of re-enumerating and re-hashing the full type universe on every iteration (#1107)
Chronicle.Elixir (Release v2.3.0): Only the first from_every declaration reached the kernel. The macro accumulated every call but the coordinator kept one, so a projection declaring context capture and property mapping separately silently lost all but one (#40)
Chronicle.Elixir (Release v2.3.0): Compliance metadata now lands on the individual leaf values in the schema rather than the object containing them, and is de-duplicated when a value is reached by both a concept marker and a redundant field-level pii (#40)
Chronicle.Elixir (Release v2.3.0): 150 documentation snippets that rendered an empty Elixir tab now show real code, and 21 that claimed “Elixir does not support this workflow yet” were false — append_many_for_event_sources/2, ReadModels.watch/2 and reactor side-effect returns among them (#40)
Chronicle.Elixir (Release v2.3.0): The README referenced Chronicle.EventType, Chronicle.ReadModel, Chronicle.Reactor, Chronicle.Reducer and Chronicle.Seeder; the real modules are nested under Chronicle.Events, Chronicle.ReadModels, Chronicle.Reactors, Chronicle.Reducers and Chronicle.Seeding (#40)
Chronicle.TypeScript (Release v4.0.0): A class-level @pii() did not mark the class’s own properties. A @pii()-adorned read model or event produced a schema with no compliance entries at all, so values the .NET client would encrypt were written in the clear (#58)
Chronicle.TypeScript (Release v4.0.0): Compliance metadata was written onto container nodes instead of the values underneath, so a @pii() composite value object stored one opaque ciphertext string where the schema still said object — releasing it returned a string and the read model failed to materialize. Metadata now lands on leaves and is de-duplicated (#58)
Chronicle.TypeScript (Release v4.0.0): An array of @pii()-marked concepts lost its classification entirely — every array was emitted with its element type discarded (#58)
Chronicle.TypeScript (Release v4.0.0): A model-bound projection was always pinned to event-log and always had AutoMap enabled; neither could be changed (#58)
Chronicle.TypeScript (Release v4.0.0): The compliance subject was a hardcoded id lookup that threw when absent, so a read model whose subject is not its id released against the wrong encryption key (#58)
Chronicle.TypeScript (Release v4.0.0): 196 documentation snippets that rendered an empty TypeScript tab now show real co
Arc (Release v22.8.2): Documentation in generated TypeScript proxies keeps apostrophes, quotes and ampersands as written, instead of arriving HTML-escaped as ', " and &
Arc (Release v22.8.1): The ARCCHR0009 documentation told you to mark a false positive [NotAudited], which silences the warning by withholding the value rather than recording it; it now says to suppress the diagnostic and keep the value (#2625)
Stagehand (Release v2.24.2): Bard now has its own avatar instead of falling back to initials.
Stagehand (Release v2.24.0): The kubeconfig generation for clusters now correctly uses the namespace name instead of the full namespace object (#331).
Chronicle (Release v16.44.1): Event details in Sequences now shows the causation entry’s own properties when navigating Context → causation → properties, instead of falling back to the root event context
Chronicle (Release v16.44.1): Navigating into the second or later causation entry now shows that entry’s properties rather than the first entry’s
Chronicle (Release v16.44.1): The property navigation breadcrumb shows which array element was navigated through, as [0]
Components (Release v4.1.1): ObjectContentEditor now shows the correct content when navigating into an object or array nested inside an array element, instead of silently falling back to the root object while the breadcrumb showed the deeper path
Components (Release v4.1.1): Navigating into a property of the second or later element of an array now shows that element’s content rather than the first element’s
Components (Release v4.1.1): ObjectNavigationalBar renders array index segments in bracket notation ([0]), so the breadcrumb shows which element was navigated through
Chronicle (Release v16.44.0): The Time Machine found no snapshots for a read model instance whose projection is keyed by a property rather than the event source.
Chronicle (Release v16.44.0): A projection preview returned instances without their key, so opening one in the Time Machine had nothing to look up.
Chronicle (Release v16.44.0): The pivot viewer clipped tile titles, lost pinch-to-zoom on trackpads and touch devices, and could leave tiles unreachable after zooming in grouped mode.
Chronicle (Release v16.44.0): Selecting a read model instance did not stick, which left the Time Machine disabled; selecting an event in the sequence editor showed no details.
Chronicle (Release v16.44.0): A details pane no longer cramps the columns of the grid beside it.
Chronicle (Release v16.44.0): Disabled buttons are visibly disabled, and the projection editor’s help and source buttons stay insid
Stagehand (Release v2.23.2): Anything GitHub delivered while the Stagehand was restarting is now picked up as soon as it comes back, instead of waiting up to fifteen minutes — or indefinitely, when deploys followed each other more closely than that
Stagehand (Release v2.23.1): The repository picker renders again — it was built against a component that does not exist in this version of PrimeReact, so every page using it fell back to a broken control
Stagehand (Release v2.23.0): Images in issues and comments now render correctly (#355).
Stagehand (Release v2.23.0): Labels are consistently applied to issues again (#354).
Stagehand (Release v2.23.0): Batch pull requests that address multiple issues no longer close unrelated issues as fixed on merge (#330).
Stagehand (Release v2.23.0): A queued release is no longer silently cancelled when the next merge occurs - the release will be cut as scheduled (#350).
Stagehand (Release v2.23.0): The Weekly Digest now displays more useful information (#337).
Stagehand (Release v2.21.4): The release notes dialog no longer crashes every page when a new release has notes to show
Stagehand (Release v2.21.4): Creating or editing a brainstorming board no longer crashes the page
Stagehand (Release v2.21.3): A plan for work covering several issues is recorded on the group they share, instead of being refused and leaving the finished work stuck running and holding a dispatch slot
Stagehand (Release v2.21.2): A plan can be recorded for work covering several issues that share no group — it goes on each issue it covers, instead of being rejected and leaving the work stuck running and holding a slot
Stagehand (Release v2.21.2): A single stuck step in a scheduling pass no longer stops work being dispatched — each step is bounded and isolated, and one that hangs is reported by name
Stagehand (Release v2.21.1): Work is dispatched again — the scheduler no longer deadlocks against a poke raised by its own pass, which left scheduled work sitting untouched and every reminder tick undelivered
Components (Release v4.1.0): Card titles and value columns are measured and ellipsized to fit the card. Text longer than the
Components (Release v4.1.0): Pinch to zoom works again on trackpads, and on touch devices the viewport no longer gives the
Components (Release v4.1.0): The viewport keeps its place when a zoom change resizes the content. Zooming out far enough
Stagehand (Release v2.20.4): A unit of work whose previous worker is still shutting down stays scheduled and says so, instead of being marked failed and disappearing from the Agents view
Stagehand (Release v2.20.4): Modal dialogs cover and block the navigation instead of opening underneath it
Stagehand (Release v2.20.4): Settings, the issue detail and four other content-only dialogs have a close button again, and respond to Escape and a backdrop click
Stagehand (Release v2.20.4): Triage’s “Needs you” column is back on the right-hand end — five columns were laid out in a four-column grid
Stagehand (Release v2.20.4): The Pull Requests navigation entry has an icon; pi pi-git-pull-request is not a PrimeIcon, so it rendered as nothing
Stagehand (Release v2.20.4): The frontend entry point is type-checked — App.tsx lives in a dot-directory, which TypeScript’s ** glob skips, so a missing import there was a blank page at runtime rather than a build failure
Studio (Release v0.85.11): Eliminate all 95 package-candidate compiler, analyzer, nullability, and specification warnings without suppressions (Cratis/StudioIssues#288)
Studio (Release v0.85.11): Unify Arc and Screenplay transitive nodes across all Debug assets while preserving exact Release runtime dependencies (Cratis/StudioIssues#288)
Stagehand (Release v2.20.2): The “What changed” tab on a pull request shows the diff again instead of failing to load
Chronicle (Release v16.42.2): FacetSet now round-trips System.Text.Json — its deserialization constructor previously could not bind, so any behavior pattern crossing a serialization boundary threw.
Stagehand (Release v2.20.1): Stagehand starts again — the Chronicle client is back on 16.41.0, the version the kernel it connects to runs
cli (Release v2.19.1): Prevent Screenplay generation from reporting CLI0017 when NuGet content files are compiled through buildTransitive while package metadata marks them buildAction=None. (#104)
Stagehand (Release v2.20.0): The Agents master list showed initials instead of the agent’s picture, because the avatar was addressed by the work item’s own agent reference rather than the roster agent’s id, and the two do not always agree on casing
Stagehand (Release v2.20.0): The Overview tab stopped part-way down its pane instead of filling it
Studio (Release v0.96.2): The raw mcp Kubernetes Service has no authentication of its own. It trusts the x-ms-client-principal header its own dedicated AuthProxy (mcp-auth-proxy) sets, and authenticates nothing itself. Pointing Studio’s own agent at mcp’s in-cluster address directly — instead of through mcp-auth-proxy — would let any pod in the cluster call it and forge any organization’s identity via a spoofed principal header. This PR never does that: McpOptions.InternalUrl targets mcp-auth-proxy’s in-cluster ClusterIP address (http://mcp-auth-proxy), never the raw mcp service.
Studio (Release v0.96.2): Each AuthProxyDeployment instance fronts exactly one configured backend, not several dispatched by request Host. Confirmed by reading both Cratis/Studio (Deployment/Networking/AuthProxyDeployment.cs) and the actual Cratis/AuthProxy source: MicroserviceReverseProxyConfigProvider builds YARP routes purely from the configured Services map and matches by request path (/api/... + an optional Microservice-ID header/query param for a multi-service deployment); with a single configured service — which is what mcp-auth-proxy always is — it emits a plain catch-all route with no Host involvement at all. ClientCredentialsServiceResolver (the client-credentials token issuance/validation path) resolves the same way: by route prefix, never by Host. So calling mcp-auth-proxy over its in-cluster address instead of its public hostname changes nothing about which backend it forwards to or how it authenticates.
Studio (Release v0.96.2): Token issuance and validation are also Host-independent.ClientCredentialsTokenProtector mints and validates the bearer with IDataProtectionProvider (the AuthProxy’s own persisted key ring) and embeds the target service name + route prefix in the protected payload; ClientCredentialsBearerAuthenticationHandler checks the token’s embedded service/prefix against the resolved route, never the request’s Host. Reaching the exact same pod over its ClusterIP address instead of its public hostname is therefore indistinguishable to it from a call arriving through the public ingress — it is the same process, the same key ring, the same route table.
Studio (Release v0.96.2): Net effect: this change skips only the public DNS/load-balancer/ingress hop. The AuthProxy’s
Ante (Release v0.6.0): The identity backchannel’s outage warning no longer logs the organization name it was checking - private diagnostics never surface onboarding-specific facts, only the exception an operator needs to diagnose the outage. (#19)
Ante (Release v0.6.0): Startup validation of trust settings (key correspondence/strength, algorithms, audience/provider rules, session expiry) - the trust and compatibility contract to validate against is not yet agreed (WP-00, #11).
Ante (Release v0.6.0): An independent observer/publication-lag readiness indicator - needs durable publication and progress semantics first (WP-05, #16).
Ante (Release v0.6.0): A fully authorized route matrix integrating owner identity end-to-end - depends on WP-02, #13. Invitation-bound commands are already guarded today via ISignedInIdentity.IsVerifiedOwnerOf, not a new ASP.NET [Authorize] policy.
Ante (Release v0.6.0): Reviewing/replacing the InvitationTokenIssued public contract - the issue itself notes this needs compatible host agreement, out of scope here.
Ante (Release v0.6.0): [x] dotnet test - 217/217 passing, including new specs covering: a guarded route rejecting an unmatched/unauthorized request (ApiRouteGuard, for_ApiRouteGuard), a public onboarding route staying reachable, and health reflecting readiness within its bounds (AnteHealthChecks, MongoDbHealthCheck, including a real bounded-timeout proof)
Ante (Release v0.6.0): [ ] Frontend not touched - no lint/build required
AuthProxy (Release v2.22.0): Documentation limitation: the shared Documentation/web full check is unavailable because isolated runs timed out on unrelated Chronicle client generation; the source documentation stale-terminology scan and diff check passed.
AuthProxy (Release v2.22.0): Resolve nanoid to ^3.3.18, fixing GHSA-2v37-7h3g-55p8 (HIGH).
AuthProxy (Release v2.22.0): Pin security workflow actions to verified full SHAs with persist-credentials: false.
Stagehand (Release v2.50.2): Accepting an invitation now requires one to actually exist — previously a default-materialized membership read as a pending invitation, which would have admitted any authenticated caller once roster-gated sign-in activates.
