Release digest: August 31 - September 7, 2026 (Week 36)

Version movement

Repository	Previous version	Current version
AI	v0.1.1	v0.10.0
AI.Distribution	v0.2.0	v0.3.0
Ante	First release	v0.9.0
Arc	v22.7.0	v22.10.5
AuthProxy	v2.21.0	v2.22.0
Chronicle	v16.42.1	v17.0.4
Chronicle.Elixir	v2.2.0	v2.3.0
Chronicle.Kotlin	v2.10.0	v4.0.0
Chronicle.TypeScript	v3.1.1	v4.0.0
cli	v2.19.0	v2.19.1
Components	v4.0.0	v4.1.1
Fundamentals	v7.18.2	v7.18.4
release-action	v1.2.0	v1.3.0
Scene	v2.0.0	v3.2.0
Screenplay	v4.11.0	v4.12.1
Specifications	v4.0.1	v4.1.0
Stage	v3.10.1	v3.11.0

Added

Arc (Release v22.10.5): Chronicle 16.40.0: ChronicleOptions.RegistrationRetry — registering a client’s artifacts is now retried with an exponential backoff instead of failing host startup when the Kernel is busy. Five attempts by default, 2s growing to 30s, all configurable (cratis/chronicle#3869)
Arc (Release v22.10.5): Chronicle 16.40.0: Failed partition attempts carry what kind of failure they were — Handling, Timeout, Disconnected or Unknown — surfaced through the client SDK and the Workbench API (cratis/chronicle#3869)
Arc (Release v22.10.5): Chronicle 16.41.0: Behavior pattern mining across every event flowing through an event store, using a bounded streaming sketch so storage scales with distinct recurring behavior rather than event volume (cratis/chronicle#3857)
Arc (Release v22.10.5): Chronicle 16.41.0: IPatterns.GetPatternsAt on the .NET client — a scope plus an optional moment defaulting to now, with the day and the part of the day derived using the same rule the engine bucketed events with when it mined them. GetPatterns remains underneath for a context that is not a moment.
Arc (Release v22.10.5): Chronicle 16.41.0: ToTimeBucket() on DateTimeOffset, the engine’s own bucketing rule, so an application asking about a moment does not have to carry a second copy of it — a copy that would drift silently, returning nothing rather than failing
Arc (Release v22.10.5): Chronicle 16.41.0: IPatterns.GetScopes on the .NET client and the Patterns gRPC service, listing the scopes that hold established patterns — what a browsing surface needs before it can offer one
Arc (Release v22.10.5): Chronicle 16.41.0: Behavior patterns in the Workbench: a pivot over everything established, across scope,
Ante (Release v0.9.0): An optional Ante:HostOutcomeUrl backchannel: once configured, Ante can ask a host what happened to a specific onboarding attempt after Ante’s own publication (e.g. whether downstream provisioning succeeded or failed) via GET {url}/outcome?attempt={attemptId}. Left empty (the default), no lookup happens and every wizard behaves exactly as it does today. (#22)
Ante (Release v0.9.0): The lookup is authenticated and attempt-bound: it only ever answers for the verified owner of that exact attempt (ISignedInIdentity.IsVerifiedOwnerOf), and a non-owner, an unconfigured deployment, and an unreachable/malformed-response host all produce the identical “nothing to report” answer - it never reveals whether an attempt exists or leaks another actor’s outcome. (#22)
Ante (Release v0.9.0): The join and invited-organization-creation wizards show the host-reported outcome (pending/succeeded/failed, with a reason code on failure) on a completion screen once onboarding has published, with a “Continue” action that proceeds to the host on demand - never blocking, and never treating a host-reported failure as a failure of Ante’s own already-published onboarding. (#22)
Ante (Release v0.8.0): A locale-coordination module: a closed, versioned SUPPORTED_LOCALES set (English, en, today) with deterministic fallback for any unrequested/unsupported/malformed locale, applied to <html lang>/dir synchronously before first paint and threaded into CratisComponentsProvider (React Aria’s own dates/numbers/announcements). (#21)
Ante (Release v0.8.0): Locale-aware number formatting (Intl.NumberFormat-backed) wired into the stepper’s step-transition announcements (“Step 2 of 3”), the one place the lobby currently displays a formatted number. (#21)
Ante (Release v0.8.0): A trusted, lifecycle-managed loader for Ante:CustomCssUrl: loads via a real <link rel="stylesheet"> (never injected as text), deterministic ordering, deduplication, and a console-only failure fallback that leaves the default styling in place. Same-origin values are always allowed; cross-origin values must be https:; any other scheme is refused. (#21)
Ante (Release v0.8.0): A broken-image fallback for Ante:LogoUrl: a failed logo load now falls back to the neutral text wordmark instead of the browser’s broken-image icon. (#21)
Ante (Release v0.8.0): A minimal render-error recovery boundary wrapping the entire lobby, including provider initialization itself - degrades to a neutral, safe-language screen with a reload action on an uncaught render error, without ever surfacing the error’s message or stack. (#21)
Ante (Release v0.7.0): A small, versioned, closed-schema display-preferences module (text size, contrast, spacing, control size, motion) that applies deterministically before first paint, degrades safely on corrupt/future schema or denied storage, and stays in sync across same-origin tabs. (#20)
Ante (Release v0.7.0): A display-preferences menu (gear trigger + dialog) on all three onboarding journeys, reachable from the shared onboarding frame. (#20)
Ante (Release v0.7.0): ARIA tab/tabpanel semantics, step-transition focus, and a live-region step announcement on every onboarding CommandStepper, retrofitted at the app level since CommandStepper renders none of this and only reports step changes for header clicks - not Next/Previous (filed upstream as Cratis/Components#249). (#20)
Ante (Release v0.7.0): An error summary that takes keyboard focus the moment it appears, so a screen-reader user lands on it instead of finding it later by tabbing through the page. (#20)
Ante (Release v0.7.0): Semantic autocomplete on the name/organization fields, and a real <main> landmark with an <h1> heading on every onboarding frame. (#20)
Ante (Release v0.6.0): A bounded /healthz/ready readiness endpoint, separate from the existing /healthz liveness endpoint, reflecting MongoDB reachability with each dependency check individually bounded (3s) so a stuck dependency can never hang the whole probe. (#19)
Ante (Release v0.5.0): Ante deployments can now select a fixed Chronicle namespace independently of the event store, via Ante:Namespace — defaults to Chronicle’s own Default namespace, matching every existing deployment’s current behavior. (#18)
Ante (Release v0.5.0): Ante:InboxSourceStore lets a deployment declare which host store its inbox reactor is compiled against; a value that disagrees with the compiled constant fails startup loudly instead of being silently accepted and ignored. (#18)
Ante (Release v0.5.0): Ante now fails startup immediately, with a clear error, if Ante:EventStore or Ante:Namespace is left empty, or if Ante:InboxSourceStore cannot actually be honored by the current build. (#18)
AI (Release v0.10.0): Language-agnostic cratis-specification-by-example, so public-specifications stops resolving with zero skills of its own — naming, the for_/when_/and_ sentence path, layered given/ contexts, what not to specify, observable outcomes, and completion. Grounded in the CRSPEC0001–CRSPEC0007 analyzers, which make the same rules machine-enforced in C# (#174)
AI (Release v0.10.0): cratis-application-slice-specifications, cratis-chronicle-event-specifications and cratis-chronicle-read-model-specifications — the in-process scenario family, migrated from write-specs, write-specs-events and write-specs-readmodels (#174)
AI (Release v0.10.0): cratis-code-review, cratis-performance-review and cratis-security-review, migrated from the three legacy review skills (#174)
AI (Release v0.10.0): cratis-fundamentals-type-discovery, migrated from discover-implementations (#174)
AI (Release v0.10.0): cratis-arc-command-validation and cratis-chronicle-event-constraints — the two halves of add-business-rule, each with its own source file (#175, #177)
AI (Release v0.10.0): public-review and public-fundamentals-type-discovery profiles (#174)
Ante (Release v0.4.2): A Recorded status value on OrganizationSetupAcceptanceStatus and UserSetupAcceptanceStatus, between Pending and Accepted: a client that has submitted but is still waiting on publication now reads distinctly from one that never submitted at all, so it is never safe (or possible) to resubmit and never a dead end. (#17)
Ante (Release v0.4.2): A local “still processing” recovery phase, shared across all three wizards: after a bounded wait with no confirmation, the wizard offers “Check again” (resets the local wait without creating a new operation or restarting the flow) and directs to support - it never claims failure, and a later Accepted reading always wins and completes the hand-off automatically. (#17)
Ante (Release v0.4.2): RegistrationPage persists a versioned, opaque registration-id pointer per browser tab (sessionStorage) so a reload or a later return resumes the same durable registration - never a profile draft, identity claim, legal content, or token. Two tabs opened to /register each get an independent registration. A “Register a different organization” action supports deliberately starting a new one. (#17)
AI (Release v0.9.0): cratis-engineering-decision-record — how to consult, author, accept, and supersede a decision record in a repository’s decisions/ folder, including the closed status / stage / class / reversibility value sets and the two-way supersession contract (#250)
AI (Release v0.9.0): cratis-engineering-effect-boundaries — the effect-boundary contract: on publication, persistence, generation, propagation, and release, partial success is failure. No catch-and-continue, no defaulting to success on an unknown outcome. Grounded in the six real Cratis failure modes the 2026-08-24 review identified (#200)
AI (Release v0.8.0): cratis-chronicle-client-dotnet — connecting a standalone console, worker, or service without a host, assembly-scanning discovery, the registration wait, and the compatibility check Connect() now performs automatically. Verified against the Chronicle sources at tag v17.0.1. (#178)
AI (Release v0.8.0): cratis-chronicle-client-typescript — reflect-metadata and decorator setup, connection strings, @eventType(), eventLog.append, and the two conventions that decide whether a Node application works at all: handlers dispatch by camelCase method name, and artifact discovery is a runtime file glob that matches **/*.ts. Verified against Chronicle.TypeScript v4.0.0. (#178)
AI (Release v0.8.0): cratis-chronicle-client-kotlin — Gradle coordinates, the Spring Boot starter and its cratis.chronicle properties, @EventType classes, suspending append, ClassGraph discovery, and the blocking surface Java starts at. Verified against Chronicle.Kotlin v4.0.0. (#178)
AI (Release v0.8.0): cratis-chronicle-client-elixir — putting Chronicle.Client in a supervision tree, use Chronicle.Events.EventType, Chronicle.append/3 and its error tuples, reactors with @handles, model-bound read models, and waiting for the :registered lifecycle phase. Verified against Chronicle.Elixir v2.2.0, the version actually published on Hex. (#178)
AI (Release v0.7.0): cratis-lens-browser-extension — building and side-loading the extension, the /.cratis/* routes and forwarded-identity headers an Arc application must already serve, what an identity or tenant switch actually does, and the shape of the command and query requests the popup sends (#179)
AI (Release v0.7.0): cratis-screenplay-model-authoring — the .play file shape, the constructs the compiler accepts, the screenplay dotnet tool, and the boundary between what parses and what the executable semantic model admits (#179)
AI (Release v0.7.0): cratis-stage-rendering-and-sandbox — the CratisRendering facade, the STAGE-ESM admission rules, the generated artifact roster, and the cratis/stage and cratis/stage-specrunner containers (#179)
AI (Release v0.7.0): public-lens, public-screenplay and public-stage now ship content instead of a gap summary; public-modeling-screenplay-stage composes the two modeling profiles (#179)
Ante (Release v0.4.0): Legal-terms acceptance is now resolved authoritatively during command execution: LegalAcceptanceEvidence.Resolve reads the host’s ILegalDocumentSource exactly once per command and uses that single read for both rejecting the command and building the LegalTermsAccepted event, so the version recorded as evidence is always the version this resolution itself just confirmed - never merely the value the client submitted. (#15)
Ante (Release v0.4.0): A command that claims legal-terms acceptance while the host has no document source configured is now rejected instead of silently accepted - previously a client could set acceptedLegalTerms: true with nothing configured and an unsolicited LegalTermsAccepted event would still be appended. The shared preflight LegalTermsRules gained the mirror rule so the wizard’s eager /validate call surfaces the same rejection early. (#15)
Ante (Release v0.4.0): AcceptInvitation, SetupOrganization, and RegisterOrganization now validate FirstName/MiddleName/LastName through shared PersonalNameValidation rules: diacritics, combining marks, non-Latin scripts, apostrophes, hyphens, and the zero-width joiner/non-joiner some scripts need to render correctly are accepted, while Unicode control characters and text-direction-override characters are rejected, and each field is bounded to 100 characters (mirrored automatically into the generated client-side validator, so client and server agree on the limit). (#15)
Ante (Release v0.4.0): The three onboarding wizards now reset the legal-acceptance checkbox whenever the host publishes a new document version while a user is mid-flow, forcing a fresh review of the new text without touching the name fields already filled in.
AI (Release v0.6.0): cratis-arc-command — the [Command] record, how each Handle() return shape is dispatched, Provide(), what may reach the causation chain, and the generated proxy contract, with references for handler shapes, the command result, read-model injection and proxy generation (#175)
AI (Release v0.6.0): cratis-arc-command-execution — running an existing command through ICommandPipeline, its overloads, validation severity filtering and how to read a CommandResult (#175)
AI (Release v0.6.0): cratis-arc-query-paging — which read-model query return shapes Arc pages, the exact query-string contract, the per-provider sorting differences, and the paged frontend hooks (#175)
AI (Release v0.6.0): cratis-arc-observable-query-http — inspecting an observable query with plain HTTP, wait-for-first-result, Server-Sent Events or long polling, including the status codes and payload shape (#175)
AI (Release v0.6.0): cratis-arc-ef-core-migration — the DbContext base types Arc provides, what actually makes an EF Core read model injectable into a command, the cross-database column helpers, JSON columns, and the observation story (#175)
AI (Release v0.6.0): cratis-arc-authentication-authorization-and-identity — IProvideIdentityDetails and /.cratis/me, the three authorization attributes Arc evaluates, the forwarded-principal authentication contract, tenant resolution and the React identity surface, with references for authentication, authorization, tenancy, frontend and local development (#175)
AI (Release v0.5.0): Chronicle read model, projection, reducer, and reactor skills, on public-chronicle (#177)
AI (Release v0.5.0): Chronicle event modeling, event model diagram, and event type migration skills, on public-chronicle (#177)
AI (Release v0.5.0): A Chronicle namespace multi-tenancy skill, on public-chronicle-multi-tenancy (#177)
AI (Release v0.5.0): A cratis CLI operations skill covering contexts, connection resolution, machine-readable output, and the authorization discipline for replay, retry, and quarantine clearing, on public-cratis-cli (#177)
AI (Release v0.5.0): A Chronicle compliance skill covering [PII], [ComplianceDetails], compliance subjects, IPIIManager erasure and what crypto-shredding does to reads and writes, event redaction and revision, and IReadModels.Release, on public-chronicle-compliance (#177)
AI (Release v0.5.0): A browser Workbench skill covering screens, mutating operations, and the facts that decide whether to expose it, on public-chronicle-web-workbench (#177)
AI (Release v0.5.0): A terminal Workbench skill covering views, key bindings, the command palette, and its mutating actions, on public-cratis-cli-terminal-workbench (#177)
AI (Release v0.5.0): A Chronicle kernel tracing skill for contributors, on engineering-chronicle (#177)
Ante (Release v0.3.0): AcceptInvitation and SetupOrganization now reject a second acceptance of the same invitation at append time, via a Chronicle unique-event-type constraint (OneUseJoinTenantInvitation / OneUseCreateTenantInvitation) scoped to the invitation itself. This closes a race where two concurrent submits of the same invitation could both observe it as still pending before either append landed - a rejected second attempt now surfaces as a normal validation failure, never an exception. (#14)
Ante (Release v0.3.0): Organization-name uniqueness (UniqueOrganizationNameConstraint) now covers both InvitationToCreateTenantAccepted and OrganizationRegistrationCompleted under one coordinated constraint, so an invited tenant creation and a self-service registration can no longer claim the same name concurrently. (#14)
AI (Release v0.4.0): cratis-arc-react-page — DataPage list pages, toolbar menu items, command
AI (Release v0.4.0): cratis-components-toolbar — canvas-style icon toolbars, now including the
AI (Release v0.4.0): cratis-components-stepper-command-dialog — multi-step wizard dialogs,
AI (Release v0.4.0): cratis-application-react-specifications — Vitest, Sinon, and Chai should
AI (Release v0.4.0): cratis-components-schema-editor — SchemaEditor and ObjectContentEditor,
AI (Release v0.4.0): cratis-components-styling — the stylesheet imports an app must make, the
AI (Release v0.4.0): cratis-components-accessibility — dialog initial-focus discipline and the
AI (Release v0.3.0): cratis-specifications-csharp — C# Specification by Example with Cratis.Specifications: the Establish/Because/should_ pattern, the for_/when_/and_ hierarchy, reusable given/ contexts, the four in-process scenario helpers, and out-of-process Chronicle integration. Available through public-specifications-dotnet (#174)
AI (Release v0.3.0): cratis-specifications-typescript — TypeScript specifications with the given() helper, context classes, Sinon stubbing, and the Chai .should interface. Available through public-specifications-typescript (#174)
AI (Release v0.3.0): cratis-engineering-csharp-conventions — the Cratis C# house conventions: formatting, naming, records and primary constructors, nullable handling, XML documentation, custom exceptions, structured logging, dependency injection and service lifetimes, and the CUPID/domain-based philosophy. Available through engineering-base, and inherited by engineering-specifications (#174)
AI (Release v0.2.0): skills/cratis-governed-release-methodology/SKILL.md: real, actionable release-engineering methodology — picking an assurance tier before picking checks, what each supply-chain receipt (checksums/provenance/SBOM/canary/recovery) actually proves and for which artifact types, the eight-rung evidence ladder, the ten lifecycle phases a real install cycle must cover, semver release-intent labeling, and a non-circular release-path structure where no step can vouch for itself
AI (Release v0.2.0): profiles/public/public-methodology-governed-releases.json: a standalone leaf profile (composes nothing, is composed by nothing — same deliberate decoupling as the language profiles) so selecting it never implies a specific product or language
AI (Release v0.2.0): A resolver regression spec asserting the profile pulls in exactly its one skill and nothing else
Ante (Release v0.2.0): The invitation exchange now rejects a token whose exp claim is missing or already in the past, instead of recording a session that would authorize forever.
Ante (Release v0.2.0): The recorded session carries its own expiry (ExpiresAtUtc), copied verbatim from the token’s exp claim, so retrying the exchange with the same token - at-least-once delivery from the authentication proxy, a user double-submitting, a lost response - converges on the same session instead of creating a duplicate or extending its lifetime.
Ante (Release v0.2.0): InvitationIdentityProvider’s session fallback now stops honoring a session the instant it expires, independent of whenever a storage cleanup sweep gets around to removing it.
Ante (Release v0.2.0): A unique index backstops the single-session-per-login invariant, and a TTL index cleans up expired sessions in storage; both are installed at startup before the exchange endpoint is exposed to traffic.
Chronicle (Release v17.0.1): gRPC wire compatibility gate that runs before anything else builds, checking the contract at HEAD against every released minor of the current major and reporting each one. A major with no declared floor is compared in full. (#3873)
Chronicle (Release v17.0.1): CheckCompatibility on the connection service, so the kernel performs the one compatibility check for every client language instead of each SDK reimplementing it. A refused connection names the client version, the protocol version and the server version.
Chronicle (Release v17.0.1): The canonical descriptor set now ships inside the .NET, Kotlin, TypeScript and Elixir contracts packages, so a client hands the kernel exactly what it was built against.
Chronicle (Release v17.0.1): ProtocolVersion on the contracts, and ServerVersionInfo.ProtocolVersion on the server.
Chronicle (Release v17.0.1): AllPatterns and AllPatternScopes queries, so a namespace’s behavior patterns can be browsed without choosing a scope first. (#3857)
Chronicle (Release v17.0.1): Cross-cutting existence checks for event store, application and user: a command carrying one of those concepts is rejected when the thing it names does not exist, with no per-command wiring. A command that creates the entity opts its own property out.
AuthProxy (Release v2.22.0): Configure matching-tenant invitations to complete at the challenge ReturnUrl or continue to Lobby. (#109)
release-action (Release v1.3.0): A configurable no-release-labels input, defaulting to no-release.
Fundamentals (Release v7.18.4): Verify the packed config against exact registry-latest consumer versions with strict peer installation, a complete dependency-tree check, JSX/rule regressions, and a native compiler version assertion (#1109)
Chronicle (Release v16.45.2): Documentation for addressing a nested property in a migration, and for the case that needs no property operations at all — adding or removing an optional property at any depth, where the target generation’s schema drives both the filling and the dropping (#3949)
Chronicle (Release v16.45.0): ASP.NET Core health check for the client connection, registered automatically by AddCratisChronicle under the name chronicle with the chronicle and ready tags. AddChronicleHealthCheck(HealthStatus) registers it explicitly and chooses the failure status (#3943)
Chronicle (Release v16.45.0): CHR0051 reports a reducer method that declares its current read model as non-nullable (#3947)
Chronicle (Release v16.45.0): Documentation for the [Index] attribute, covering why the declaration lives on the read model and how it survives a replay (#3942)
Chronicle (Release v16.45.0): Documentation for the client health check (#3943)
Scene (Release v3.2.0): Canvas is back as a panel, and carries an Extent — the coordinate space a child’s Canvas.Left/Canvas.Top pair is measured against. It was dropped on the argument that FreeformArrangement already covers absolute placement, but the two sit at different levels: a FreeformArrangement arranges a layout slot’s content with one variant per size class, while a Canvas places elements inside a single coordinate space in the element tree. Without the panel there was nowhere for a free-placement design surface to land.
Scene (Release v3.2.0): isCanvas recognizes a canvas by its extent, the same way the other panel guards recognize theirs by the property each one alone declares. The old Canvas declared no properties at all, which is why nothing could tell it from a plain Panel — and why it could be removed without anything noticing.
Scene (Release v3.1.0): ScenePackage gained License and LicenseUrl; Theme gained the LicenseUrl to go with the License it already carried. A license name on its own does not tell an author what they are taking on — “PrimeUI Community / Commercial” says nothing about whether they qualify for the free tier or owe a fee. The link is the part that answers that, so the model carries it.
Stage (Release v3.11.0): join, all, every and remove via join blocks render as their model-bound attributes (#11)
Stage (Release v3.11.0): nested blocks render as a sibling record the read model holds through a nullable [Nested] property, with a clear with inside one becoming the class-level [ClearWith] that nulls it (#11)
Stage (Release v3.11.0): children blocks render as a sibling record plus an IEnumerable<T> collection carrying [ChildrenFrom], with remove with becoming a [RemovedWith] on that same property, nesting to any depth (#11)
Stage (Release v3.11.0): no automap renders as [NoAutoMap] on the read model (#11)
Arc (Release v22.10.0): --emit-interfaces renders types as plain TypeScript interfaces rather than classes carrying @field decorators, with no @cratis/fundamentals import for the decorators. A model that is only ever built and read needs neither, and a package that deliberately carries no dependencies cannot take one on. Documentation, base types and nullability are unchanged, so the output differs from the class form only in the ways the mode is for. (#2635)
Scene (Release v3.0.0): The panel vocabulary a canvas is drawn in — Canvas, StackPanel, DockPanel, WrapPanel and Grid on the existing Panel base, with RowDefinition, ColumnDefinition, GridLength, GridUnitType, Orientation and Dock. Studio’s prototype canvas models arrangement this way and Scene had no equivalent: a screen could say what an element is, but not that five of them sit in a grid.
Chronicle.Kotlin (Release v4.0.0): @FromEventSourceId maps a read model property to the event source id from a model-bound projection — the annotation counterpart of the fluent builder’s toEventSourceId(). The kernel does not act on it yet (Cratis/Chronicle#3924).
Chronicle.Kotlin (Release v4.0.0): ReadModelsJavaBridge.watch and observeMaterializedInstances take an onError consumer, so a Java caller can handle a faulted stream instead of losing it to an uncaught exception on a background dispatcher.
Chronicle.Kotlin (Release v3.1.0): Java can now reach the observer-relative tail sequence number, the event-count-capped read model replay, and live observation of a materialized page, through EventLogJavaBridge and ReadModelsJavaBridge.
Chronicle.Kotlin (Release v3.1.0): EventTypeDescriptor.parse is callable directly from Java, which is what lets a Java caller name an event type at all — EventTypeId and EventTypeGeneration are value classes Java cannot construct.
Arc (Release v22.9.0): CommandScenario<TCommand> implements IDisposable and IAsyncDisposable, disposing the service provider it builds and any disposable values extension packages place in Context (such as the Chronicle extender’s EventScenario); disposal is idempotent and Execute/Validate throw ObjectDisposedException after disposal (#2629)
Specifications (Release v4.1.0): Opt-in shared specification lifecycle for xUnit: add [assembly: Xunit.TestFramework("Cratis.Specifications.SpecificationTestFramework", "Cratis.Specifications.XUnit")] to a spec assembly and every eligible Specification class is constructed once, runs Establish/Because once, runs all its facts against that shared instance and runs Destroy once after the last fact (#38)
Specifications (Release v4.1.0): Automatic fallback to the stock per-fact lifecycle for anything not eligible for sharing - plain xUnit classes, theories, IDisposable specifications, and classes using fixtures or ITestOutputHelper - so the attribute is safe to add to an existing spec assembly (#38)
Specifications (Release v4.1.0): Class-fixture-style failure semantics in shared mode: a throwing Establish/Because fails every fact of the class with that exception, and Destroy failures surface as test class cleanup failures (#38)
Chronicle.Elixir (Release v2.3.0): Chronicle.Concept — a strongly-typed wrapper for a domain value, joining the existing use macro family alongside Chronicle.Events.EventType and Chronicle.ReadModels.ReadModel. Supports :string, :integer, :float, :boolean and :uuid, and rejects an unknown type at compile time (#40)
Chronicle.Elixir (Release v2.3.0): PII declared on a concept is resolved wherever that concept is used, in both events and read models — declare it once and every property using the type is encrypted (#40)
Chronicle.Elixir (Release v2.3.0): A concept declared with event_source_id: true cannot also be marked PII; the combination raises at compile time, because encrypting the identifier would make its own decryption key unfindable (#40)
Chronicle.Elixir (Release v2.3.0): no_auto_map/0 and no_auto_map/1 — turn Chronicle’s automatic property mapping off for a whole projection, or exclude specific fields. AutoMap was never sent to the kernel at all, so it silently fell back to the Inherit default and could not be turned off (#40)
Chronicle.Elixir (Release v2.3.0): not_rewindable: true and event_sequence: on a read model or projection. Both were hardcoded, so every projection was rewindable and pinned to the event log (#40)
Chronicle.Elixir (Release v2.3.0): A guide page covering concepts (#40)
Chronicle.TypeScript (Release v4.0.0): Event tags. @tag()/@tags() on an event type, reactor or reducer, @filterEventsByTag() to restrict which events reach an observer, tags on AppendOptions and EventContext, and tags in seeding. The wire fields were already being sent as empty arrays (#58)
Chronicle.TypeScript (Release v4.0.0): @subject() — the property a compliance release decrypts PII against, with a resolver that falls back to id exactly as before when the decorator is absent (#58)
Chronicle.TypeScript (Release v4.0.0): An operational surface on IProjections — getStateFor/getStateForModel, replay/replayForModel, getFailedPartitionsForModel, hasFor/hasForModel, getProjectionIdFor, and query for ad-hoc projection declarations. It previously had only discover and register, so nothing could inspect or operate a projection (#58)
Chronicle.TypeScript (Release v4.0.0): @fromAll, @noAutoMap, and @eventSequence/@eventLog for model-bound projections; root-level @clearWith is now honored (#58)
Chronicle.TypeScript (Release v4.0.0): IPIIManager.allowNewEncryptionKeyFor — re-authorize an encryption key for a subject after erasure (#58)
Chronicle.Kotlin (Release v3.0.0): @SetValue, @SetFromContext and @Passive for model-bound projections (#59)
Chronicle.Kotlin (Release v3.0.0): @Key and @ContextKey, with a key builder for composite and parent keys (#59)
Chronicle.Kotlin (Release v3.0.0): @Subject — the property a compliance release decrypts PII against, falling back to id as before when absent (#59)
Chronicle.Kotlin (Release v3.0.0): Model-bound @Unique and @RemoveConstraint (#59)
Chronicle.Kotlin (Release v3.0.0): @JsonSchemaType, for a type that serializes as something other than its own shape (#59)
Chronicle.Kotlin (Release v3.0.0): count(), increment(), decrement(), add().with() and subtract().with() on the declarative projection builder, plus noAutoMap()/autoMap() and toEventContextProperty() on from() (#59)
Chronicle.Kotlin (Release v3.0.0): Java can now build a declarative projection. join, on, set, nested, children, fromEvery and fromAll took a Kotlin KProperty1, which Java cannot construct, so explicit mapping was unreachable — every one now has a property-name overload, validated against the read model type. EventTypeMigrationBuilder gained the same treatment (#59)
Chronicle.Kotlin (Release v3.0.0): @Pii can be placed on a constructor parameter, so a Java record component is picked up without a use-site target (#59)
Chronicle.Kotlin (Release v3.0.0): EventSourceId — a ConceptAs<String> marker for concepts representing an event source identity (#59)
Arc (Release v22.8.0): Command property values are recorded on the causation of every event the command appends, keyed by camel-cased property name, so an event says what the command was asked to do and not only which command it was (#2625)
Arc (Release v22.8.0): [NotAudited] keeps a value off the causation chain — on a property, on a positional parameter, or on the command itself to exclude every property at once (#2625)
Arc (Release v22.8.0): ARCCHR0009 reports a command property whose name reads like a secret (Password, Token, ApiKey, Credential, Pin, Cvv and the like) and which is not marked [NotAudited] or [PII] (#2625)
Arc (Release v22.8.0): CommandCausation.PropertiesFor(Type, object) builds the causation properties for a command instance; the existing PropertiesFor(Type) is unchanged (#2625)
Chronicle (Release v16.44.0): Time Scrubber, on both the Projections and Read Models views: step a read model instance through its history one event at a time, with the state after each event and a hover describing the event and its properties.
Chronicle (Release v16.44.0): Snapshots of a read model instance can be asked for per event instead of per correlation, through a new Grouping on the snapshot request. It defaults to grouping by correlation, so existing callers are unaffected.
Chronicle (Release v16.44.0): A projection can be generated as client code in TypeScript, Kotlin and Elixir alongside C#, selectable in the Workbench’s generated-code panel. Languages whose client has no API for a given projection style are offered only for the styles they support.
Chronicle (Release v16.44.0): ILanguageService.GetLanguagesSupporting reports which languages can generate a given projection style.
Components (Release v4.1.0): PivotViewer accepts an optional title for the toolbar heading. Omit it and the heading
Screenplay (Release v4.12.0): Add domain-separated external stable-key factories for semantic and event-contract identities (#176)
Screenplay (Release v4.12.0): Add explicit stable application identity support for workspace compilation independently from the friendly application name (#176)
Screenplay (Release v4.12.0): Document externally assigned catalog identities and rename/move continuity (#176)
Chronicle (Release v16.43.0): MapValues on EventTypeMigration<TUpgrade, TPrevious> — declare which value in one generation is which value in the other, once, and Chronicle applies the map forward when upcasting and inverted when downcasting. Values the map does not mention are carried across unchanged.
Chronicle (Release v16.43.0): MapValues on the migration property builder, for a translation that applies to one direction only. A direction that declares its own transformation for a property keeps it, overriding what the value map derives.

Changed

Ante (Release v0.9.0): Documentation/configuration.md, Documentation/host-integration.md, Documentation/boundaries.md, and Documentation/wizards.md now describe the new setting, its contract, its trust boundary, and the completion-screen behavior it adds.
Ante (Release v0.9.0): Host-appended success/failure events, terminal-result precedence, quarantine, and replay reconciliation across restarts/replicas.
Ante (Release v0.9.0): Compliance-subject propagation on the host outcome itself (there is nothing to prop
Ante (Release v0.8.0): Documentation/configuration.md and Documentation/boundaries.md now describe Ante:CustomCssUrl’s real, working loading contract and its trust boundary, instead of a promise the frontend never implemented. (#21)
Ante (Release v0.8.0): A second UI locale - this PR builds the mechanism (closed supported-locale set, deterministic fallback, per-locale formatting/direction tables) but ships only the one reviewed locale (English) that existed before. Documentation/boundaries.md#localization states explicitly what adding another one requires: reviewed translations and matching backend validation-message localization together, not a translation file alone.
Ante (Release v0.8.0): Manual/browser verification of the CSS load
Ante (Release v0.7.0): Onboarding’s waiting/progress states now expose a role="status"/aria-live="polite" announcement (reusing ProgressSpinner’s own accessible label where a spinner is present). (#20)
Ante (Release v0.7.0): Keyboard focus now gets a reinforced, forced-colors-aware :focus-visible outline across this app’s own elements (@cratis/components already does this for its own controls). (#20)
Ante (Release v0.7.0): This app’s own CSS now honors prefers-reduced-motion, in addition to the explicit in-app motion preference. (#20)
Ante (Release v0.7.0): color-scheme relaxed from a hard dark to dark light, and <html> now declares lang="en", so native controls can still follow the operating system rather than the app overriding it outright. (#20)
Ante (Release v0.7.0): Cratis/Components#249 - CommandStepper renders no ARIA tab/tabpanel roles/relationships, and only reports step changes for header clicks, never Next/Previous (the path a linear wizard actually uses).
Ante (Release v0.7.0): Cratis/Arc#2661 - CommandForm’s auto-rendered field label has no htmlFor, so clicking the visible label text does not focus the field (the input still gets an accessible name via a separate aria-label fallback).
Ante (Release v0.7.0): Manual/browser accessibility evidence (screen reader pass, high-zoom and narrow/short-viewport checks, forced-colors visual QA) - the issue itself is explicit that computed CSS/S
Ante (Release v0.6.0): The generated OpenAPI document (/openapi/...) is now exposed only in Development - a non-development deployment must never publish its full command/query surface unauthenticated. (#19)
AI (Release v0.10.0): public-specifications carries a skill of its own for the first time; public-specifications-dotnet gains the application scenario family; public-arc gains command validation; public-chronicle gains event constraints (#174)
AI (Release v0.10.0): cratis-chronicle-event-constraints now reports Chronicle rather than Arc products, because it no longer inherits them from the shared Arc-scoped legacy source (#177)
Ante (Release v0.4.2): OrganizationSetupStatusSubscriptions / UserSetupStatusSubscriptions now seed every (re)connecting client’s live status from a fresh durable read instead of always starting Pending, and only ever move a client’s observed status forward (Pending → Recorded → Accepted), never backward - a stale, lagging read racing behind a durable publication another tab already observed can no longer regress that tab’s view.
Ante (Release v0.4.1): The wizards’ status polling (UserSetupAcceptanceStatusView / OrganizationSetupAcceptanceStatusView) now reports completion only once durable evidence confirms Published (the fact has reached Ante’s own outbox), never merely Recorded (committed to Ante’s local event log) and never from an in-memory flag set at command time. A required legal fact that has not yet reached the outbox keeps the status at pending even after the acceptance/registration event itself is published. (#16)
Ante (Release v0.4.1): OrganizationSetupProgress, the durable read model backing organization-setup status, now also covers self-service registration - replacing the invited-tenant-creation-only projection that existed before, since both flows already shared the same status view and subscription tracker.
Ante (Release v0.4.1): Because status is derived from durable read models rather than process-local state, a dropped connection, an Ante restart, or a reconnect landing on a different replica all resume correctly from the same evidence.
Ante (Release v0.4.1): Owner-scoped authorization on the status queries (denying cross-actor observation of someone else’s invitation/registration status).
AI (Release v0.9.0): A cross-check specification now fails when a blocker is listed as remaining while the state that resolves it holds, when a blocker is recorded as resolved without that state holding, when a tracked document names a workflow that does not exist, when a workflow recorded as retired reappears, or when the preview-assets workflow asserts a readiness value the generated file contradicts. Each of the five was proven by planting the defect and watching it go red (#258)
AI (Release v0.8.0): public-chronicle-client-dotnet, -typescript, -kotlin, and -elixir move from content-gap to preview-source-candidate and now list a target. No profile composes another, so no .NET-specific Chronicle content reaches a Kotlin, TypeScript, or Elixir subscriber. (#178)
AI (Release v0.8.0): The product coverage catalog records what was verified: the four Chronicle client capabilities move to candidate against their named versions, and Kotlin and Elixir become current-corpus languages. (#178)
AI (Release v0.8.0): public-chronicle-client-java and public-chronicle-client-python are unchanged. No Chronicle Java client repository exists — the JVM client is Chronicle.Kotlin, whose Java surface the Kotlin skill covers — and Chronicle.Python carries package scaffolding with no implementation and no published package. Their notes now state the verified reason each stays a gap. (#178)
AI (Release v0.7.0): Lens guidance records that no store listing exists anywhere in its repository — building from source and loading unpacked is the only install path (#179)
AI (Release v0.7.0): Lens guidance records that its command payload form receives no schema today: it reads an introspection property named schema while Arc emits payloadSchema/argumentsSchema, and its four fallback schema routes are not mapped by Arc, so every command form falls through to the empty state with no raw-JSON editor behind it (#179)
AI (Release v0.7.0): Lens guidance records that the tenant header name, base URL and page origin have no user interface, so an application resolving tenancy any other way cannot be driven by it, and that header rules match XMLHTTPREQUEST only — the observable-query WebSocket and SSE transports carry no injected headers (#179)
AI (Release v0.7.0): Screenplay guidance records that the screenplay tool only verifies and never writes, that an unknown construct inside a slice is a warning that silently drops its block, and that the executable semantic model admits only StateChange and StateView, so Automation and Translate slices parse and bind to nothing (#179)
AI (Release v0.7.0): Stage guidance records that there is no rendering CLI, that the renderer needs an executable semantic model Stage ships no way to produce from .play files, that an unsupported construct blocks the whole plan rather than emitting less, that the sandbox enforces neither modeled validation nor authorization and its modeled queries deny by default, and that nothing
AI (Release v0.6.0): public-arc, public-arc-ef-core and public-arc-identity now list real capabilities and move from planned-source-migration to preview-source-candidate (#175)
AI (Release v0.6.0): public-arc-react now composes public-arc, and engineering-arc-react now composes engineering-arc — resolving either React profile previously dropped every backend Arc capability it depends on (#175)
AI (Release v0.6.0): cratis-arc-observable-query-http is no longer excluded from the public review candidate package: the rewritten source carries no host, port or route from any private environment (#175)
AI (Release v0.5.0): public-chronicle, public-chronicle-compliance, public-chronicle-multi-tenancy, public-chronicle-web-workbench, public-cratis-cli, public-cratis-cli-terminal-workbench, and engineering-chronicle move to preview-source-candidate and list their targets, so selecting one now installs content rather than reporting a gap (#177)
AI (Release v0.4.0): public-arc-react and public-components leave planned source migration for
AI (Release v0.4.0): public-arc-react now composes public-arc. Frontend Arc usage depends on
AI (Release v0.4.0): engineering-arc-react now composes engineering-arc alongside
AI (Release v0.3.0): The three skills are self-contained. The rule content they previously linked to under .ai/rules is repository-only and cannot ship through a profile, so the folder and naming philosophy, the never-sleep discipline, the scenario family, the singleton/tenant lifetime rule, and the implementation-discovery rule are carried in the skills and their references instead of linked (#174)
AI (Release v0.3.0): Package versions are stated from the published Cratis.Specifications, Cratis.Arc.Testing, and Cratis.Chronicle.Testing releases rather than inherited from the legacy text (#174)
AI (Release v0.3.0): public-specifications-dotnet, public-specifications-typescript, and engineering-base carry real content and move to preview-source-candidate, with gap summaries describing what is still missing rather than everything (#174)
AI (Release v0.3.0): The three catalog targets are classified: capability kind, invocation, applicability, trust effects, dependency edges, source contracts, and authoring contract. Security disposition stays pending and evaluation statuses stay missing, because no review or evaluation has been run for them (#174)
AI (Release v0.3.0): Each source record and distribution component points at the canonical tree with matching repository-snapshot provenance, so the digest, the revision, and the shipped bytes agree. Each retained legacy twin is modeled as its own repository-only component, and the .claude/.agents/.github skill projections move onto it — those folder symlinks resolve into .ai/skills and never exposed the canonical tree (#174)
AI (Release v0.3.0): public-skill-sources-and-resources moves from blocked-by-distribution-decision to retire-after-evidence, and mcp-generated-guidance-references to retain. #266 replaced the generated distribution with direct installation from main, so nothing ab
AI (Release v0.2.0): catalog/v2/repository-inventory.json and related generated catalogs regenerated for the new skill and source (46 sources, up from 45)
AI (Release v0.2.0): distribution/public-evaluation-eligibility.json: the new skill is explicitly excluded from marketplace eligibility pending effect assessment — the same disposition an existing skill (cratis-chronicle-reactor) already has — not force-approved
Chronicle (Release v17.0.1): Every gRPC service is now derived from Arc [Command]/[ReadModel] artifacts in Core rather than hand-written, completing the migration #2908 started. Source/Clients/Api and Source/Kernel/Core/Services are gone; only Observers and the streaming services, whose server-to-client lifetime no command or query describes, remain hand-written.
Chronicle (Release v17.0.1): Patterns is served by artifacts like everything else. Its five queries — MatchingPatterns, UsualActions, PatternsForScope, AllPatterns, AllPatternScopes — read storage and the mining engine directly, and the contract is generated from them. (#3857)
Chronicle (Release v17.0.1): Query parameters that name a concept are declared as that concept rather than as string, so the value is validated on the way in instead of being cast inside the method. The wire is unchanged — a concept still travels as its primitive.
Chronicle (Release v17.0.1): The two event-sequence lookups that answered with a bare bool and ulong now answer with EventSourceEvents and EventSequenceTail. The value travels as the same primitive, one level in.
Chronicle (Release v17.0.1): The Workbench’s surfaces are served by Arc artifacts in the kernel, with proxies generated beside the features that use them rather than into a separate Api folder.
Fundamentals (Release v7.18.4): Custom configurations enabling additional react/* rules must explicitly register their own compatible plugin; disabled React-rule defaults and version detection remain available (#1109)
Fundamentals (Release v7.18.4): Use the verified current Node/Corepack toolchain for JavaScript CI and publishing (#1109)
Chronicle (Release v16.45.2): The JSON Schema title is no longer part of the schema comparison that guards EventTypeSchemaChanged. It carries the CLR record name, so comparing it made renaming a record a breaking change despite a pinned [EventType("...")] identifier and an unchanged property set. It stays in the stored schema for tooling (#3926)
Chronicle (Release v16.45.2): An event type migration can now address a property inside a nested object — pb.DefaultValue(m => m.Price.Description, "unspecified") writes where it belongs, and pb.RenamedFrom(m => m.Price.Amount, e => e.Amount) moves a top-level value into the object it now belongs to. Registration validates such a path segment by segment and rejects one that resolves nowhere (#3949)
Chronicle (Release v16.45.2): A DefaultValue whose target the generation’s schema does not declare is now rejected at registration instead of skipped. Validation still exempts a default when the target generation has no schema to resolve against (#3949)
Chronicle (Release v16.45.0): A client call made while the connection is down now fails instead of blocking its thread. A connect timeout surfaces as ConnectionTimedOut, acquiring the connect lock is bounded by the connect timeout, and a failed attempt starts a back-off during which calls fail immediately with ConnectionUnavailable. The watchdog still reconnects in the background, so a kernel that comes back is reachable again without restarting the client (#3948)
Chronicle (Release v16.45.0): A reducer method whose current read model parameter is non-nullable is now rejected at registration rather than silently excluded from dispatch. The current read model is null for the event that creates an instance, so the declaration can only ever be a mistake. Methods in a #nullable disable context are unaffected (#3947)
Chronicle (Release v16.45.0): An ASP.NET Core host no longer fails to start when the kernel is briefly unreachable; the connection failure is logged and the health check reports it until the connection comes up (#3943)
Scene (Release v3.2.0): The React renderer arranges a canvas: it becomes the positioned ancestor its children are placed against, sized to its extent, with a child that names any of Canvas.Left, Canvas.Top, Canvas.Right or Canvas.Bottom placed absolutely. A child that names none stays in flow rather than being pinned to the origin.
Scene (Release v3.2.0): The name follows @cratis/components’ Canvas, which is the surface a Cratis application actually draws one on, rather than introducing a second word for the same thing.
Scene (Release v3.1.0): Cratis.PrimeReact and every theme built on PrimeTek’s presets now point at the PrimeUI Community license; every other package points at ours. This stopped being uniform when PrimeReact 11 relicensed from MIT, and a package picker can now show the difference at the moment someone is choosing rather than leaving it to a banner in production.
Stage (Release v3.11.0): What no model-bound attribute can carry is now reported rather than dropped in silence: the system-wide subscription an all block declares, a per-block no automap, a children block that says nothing about its parent, a clear with inside children, a from naming events it does not map, and any mapping an earlier block already claimed (#13)
Stage (Release v3.11.0): Specs compile the rendered output against the real Cratis assemblies, so a wrong attribute name, argument or target fails rather than passing a string comparison (#13)
Scene (Release v3.0.0): @cratis/components 4. Components 4 owns its own markup, styling and types and no longer sits on PrimeReact, so scene.components and scene.blueprint.components take ^4.1.1 and their peer range moves with it — a breaking change for anyone consuming those two packages.
Scene (Release v3.0.0): scene.components no longer depends on PrimeReact at all. Its one PrimeReactProvider was in a spec, needed only because Components 3’s tooltip bottomed out in a PrimeReact component; Components 4 owns its own. primeicons stays as a Storybook-only devDependency, because the stories demonstrate the consumer-owned icon-font class string that Components 4’s Icon still accepts.
Scene (Release v3.0.0): scene.blueprint.components keeps its PrimeReact peers, and now supplies the provider itself. It composes blueprint.default’s shell, which reaches for PrimeReact directly in five places. Until Components 3 that provider came for free because CratisComponentsProvider wrapped PrimeReactProvider; under Components 4 it does not, so the Storybook preview declares both providers rather than relying on hoisting.
Scene (Release v3.0.0): scene.primereact and scene.blueprint.default are unchanged — they target PrimeReact deliberately.
Chronicle.Kotlin (Release v4.0.0): Breaking: the client moves to chronicle-contracts 16.44.1. It was pinned to 16.16.0 while the kernel had moved on, so every namespaces call answered UNIMPLEMENTED against a current kernel. Job and JobStep are now JobSummaryResponse and JobStepSummaryResponse, and a constraint’s removedWith is a repeated field.
Chronicle.Kotlin (Release v4.0.0): Breaking: builder configuration callbacks that exist for Java take a java.util.function.Consumer, and the ones Kotlin shares gained a Consumer overload. Java lambdas no longer need the return null; that only satisfied a Kotlin Function1 — 90 of them across the documentation, the samples and the test fixtures. Kotlin callers are unaffected.
Chronicle.Kotlin (Release v4.0.0): Four documentation workflows that told a Java reader they were unsupported now show the real Java form; the remaining Kotlin/Java parity gaps in the snippet set are closed.
Chronicle.Kotlin (Release v4.0.0): The samples pin mongo:8.2. mongo:8 refuses to start on Linux kernel 6.19 or newer, which a current Docker Desktop uses, so the compose file fell over before Chronicle came up.
Chronicle.Kotlin (Release v3.1.0): The compliance samples carry PII through ConceptAs types rather than bare strings. @Pii is declared once per kind of value, so every event and read model reusing that concept is PII-marked automatically and the sample files contain no @Pii of their own.
Chronicle.Kotlin (Release v3.1.0): Documentation snippets no longer spell out an explicit id on @EventType. The client already derives it from the type name, as the C# and TypeScript clients do; only the migration examples keep an explicit id, where two classes deliberately share one across generations.
Chronicle.Kotlin (Release v3.1.0): Twenty-one documentation pages that told a Java reader a workflow was unsupported now show the real Java form — among them applying @Pii to event properties, defining event type migrations, and observing a materialized page.
Chronicle.Kotlin (Release v3.1.0): The console and Spring Boot samples key their read models from the event context, so employees no longer share one storage key and overwrite each other.
Arc (Release v22.9.0): CommandScenario<TCommand> no longer registers a console logger by default — ILogger<T> resolves as a no-op, so no logging processor thread is spawned per scenario; opt in with scenario.Services.AddLogging(l => l.AddConsole()) before the first Execute/Validate to see log output (#2629)
Specifications (Release v4.1.0): Specification.InitializeAsync is now idempotent - Establish/Because run only on the first call per instance. Stock xUnit calls it exactly once per instance, so behavior without the opt-in is unchanged (#38)
Chronicle.Elixir (Release v2.3.0): The JSON schema generator descends into nested structs instead of flattening every non-numeric field to "string", so nested read models and structured event payloads register with an accurate schema (#40)
Chronicle.TypeScript (Release v4.0.0): compliance is a declared property on the JsonSchema type rather than written through a cast (#58)
Chronicle.Kotlin (Release v3.0.0): A class-level @Pii cascades to every property the class declares, matching .NET (#59)
Chronicle.Kotlin (Release v3.0.0): @Pii on a ConceptAs<T> is documented and specified for events and read models — declare it once on the concept and every property using it is encrypted (#59)
Chronicle.Kotlin (Release v3.0.0): chronicle-contracts moves from 16.13.4 to 16.16.0
Arc (Release v22.8.1): ARCCHR0009 no longer reports a property whose type cannot hold a secret — a date, a duration, a number, a bool, a Guid or an enum — however it is named, so AccessTokenExpiresAt is left alone while AccessToken is still reported (#2625)
Arc (Release v22.8.1): ARCCHR0009 honors [NotAudited] and [PII] on the property’s type, matching what the runtime already withholds, so marking a concept once covers every command that takes one (#2625)
Arc (Release v22.8.1): ARCCHR0009 judges a concept by the value it wraps, so a ConceptAs<string> holding a token is reported and a ConceptAs<DateTimeOffset> is not (#2625)
Arc (Release v22.8.0): Values Chronicle treats as personal data are withheld from the causation chain, honoring [PII] on the property, the declaring type, the positional parameter, and the concept — so a concept marked once carries the marking to every command that uses it (#2625)
Arc (Release v22.8.0): A recorded value is truncated at 1024 characters and marked where it was cut, since the causation travels on every event the command appends (#2625)
Chronicle (Release v16.44.0): The Workbench is built on @cratis/components 4 and imports from explicit subpaths; Workbench-local components that the library now provides have been removed.
Chronicle (Release v16.44.0): Projection code generation is now a seam with one generator per language. DeclarativeCodeGenerator and ModelBoundCodeGenerator moved into Cratis.Chronicle.Projections.Engine.DeclarationLanguage.CodeGeneration.CSharp, and LanguageService takes the discovered IInstancesOf<IProjectionCodeGenerator> rather than the two C# generators directly — code that constructs these types itself, rather than resolving them, needs updating.
Chronicle (Release v16.44.0): ILanguageService.GenerateDeclarativeCode and GenerateModelBoundCode take the language to generate for, defaulting to C#, so existing calls are unchanged.
Chronicle (Release v16.44.0): Generated C# declarative projections and model-bound records are formatted over multiple lines rather than one long line.
Chronicle (Release v16.44.0): The Backoffice sample correlates each generated command separately, so a generated history no longer looks like a single action.
Components (Release v4.1.0): The toolbar heading renders as a span sized by Components rather than a bare h1, so it no
Components (Release v4.1.0): The toolbar’s item count is sized to the filter button beside it, so the two read as one group.
Chronicle (Release v16.43.0): An event type generation whose enum only gained members, or had members renamed, no longer registers as EventTypeSchemaChanged. The wider member list replaces the registered schema instead. Removing or renumbering a member is still a schema change that needs a new generation.
Chronicle (Release v16.42.2): The pattern miner is a per-event-store-and-namespace grain owning the mining lifecycle — sketches, restore of established patterns, and deferred persistence — with the capture subscriber reduced to extracting features and forwarding each observed batch as a single call to its store’s miner.

Fixed

Chronicle (Release v17.0.4): Chronicle in-process tests no longer run consumer command execution scopes inside the kernel pipeline; avoids missing EventStoreName resolution and unintended nested consumer transactions. (#3973)
Chronicle (Release v17.0.3): Commands whose kernel-side handling depends on IUnitOfWorkManager, IEventLog, or IEventTypes (any consumer combining Arc.Chronicle’s TransactionalCommandScope/*CommandResponseValueHandler types with Cratis.Chronicle.Testing) failed to resolve inside the in-process kernel command pipeline used by EventScenario, EventStoreForTesting, and TestingServices - those interfaces fell back to auto-activating the real client implementations, which need a live connection the in-process kernel does not have.
Chronicle (Release v17.0.3): [x] dotnet build (Debug/Release) - zero warnings, zero errors
Chronicle (Release v17.0.3): [x] Full downstream consumer spec suite (719 specs exercising CommandScenario, TransactionalCommandScope, and every *CommandResponseValueHandler) passes against a locally packed Cratis.Chronicle.Testing build
Ante (Release v0.6.0): An unmatched request under /api, /openapi, /_invite or /healthz now gets a genuine 404 instead of falling through to the single-page application shell as a misleading 200. (#19)
Ante (Release v0.5.0): Fixed the organization-setup, join-tenant-acceptance, organization-registration, and legal-terms-acceptance outbox-forwarding reactors silently misrouting to a nonexistent inbox sequence — instead of the local event log — whenever Ante:EventStore was set to anything other than the literal "Ante". Any deployment already using a renamed store (as the README’s own “DirectLobby” example describes) was affected.
Ante (Release v0.5.0): Ante:InboxSourceStore does not retarget the inbox cross-subscription at runtime — Chronicle’s [EventStore] attribute requires a compile-time constant, tracked upstream as Cratis/Chronicle#3951. The setting exists solely to catch a mismatch against the compiled InboxSourceStore.Name constant at startup; retargeting it still requires editing that constant and rebuilding. Documented in full in Host Integration and Configuration, including the mirror-image constraint a host integrator hits writing their own reactor against a renamed Ante instance.
Ante (Release v0.5.0): The acceptance criterion calling for “a small reference host” demonstrating a nondefault store/source-store/namespace together is not implemented here — this repository has no existing sample/reference host project to extend (Ante itself is not yet deployed anywhere per the README), and building one is better scoped once the trust/compatibility decisions in #11 (this issue’s blocker) land. The independent configurability of all three settings is instead proven directly by specs and documented with a full non-default example.
AI (Release v0.10.0): CommandScenario<TCommand> does carry a Given builder, from Cratis.Arc.Chronicle.Testing. The legacy skill and the already-shipped cratis-specifications-csharp reference both stated the opposite, which documented seeding a read model for a concurrency-sensitive rule as impossible (#174)
AI (Release v0.10.0): EventScenario disables concurrency checking, so a concurrency specification written against it passes vacuously. Both the legacy skill and the shipped reference listed the assertions without saying so (#174)
AI (Release v0.10.0): [Singleton] is in Cratis.DependencyInjection, not Cratis (#174)
AI (Release v0.10.0): Command-side read-model injection is not keyed off [ReadModel], and has no slice or feature restriction — registration is global and comes from the backing projection, reducer, DbSet<T> or collection (#175)
AI (Release v0.10.0): IConstraintBuilder.Unique<TEvent> takes the message first and the name second, the reverse of the [Unique] attribute. Both convert implicitly from string, so the wrong order compiles and silent
Ante (Release v0.4.2): All three onboarding wizards (UserSetupPage, OrganizationSetupPage, RegistrationPage) no longer dead-end on a reload, a second tab, or returning later: each now derives whether to show the form or a waiting/recovering state from durable status rather than a flag that only the original submitting tab ever knew about. Previously a reload after submitting - but before publication reached Ante’s outbox - showed the form again, risking a rejected duplicate submission. (#17)
Ante (Release v0.4.2): RegistrationPage no longer loses track of an in-flight or already-published registration on reload: it previously minted a brand-new id on every mount (useMemo(() => Guid.create(), [])), so a reload queried status for an id that had never recorded anything and always showed the form again. (#17)
Ante (Release v0.4.2): UserSetupPage’s timedOut branch - documented in #16 as “reserved for future use, not… a shipped behavior” because nothing on the backend ever produced it - now has real, working behavior, applied identically to all three wizards. (#17)
Ante (Release v0.4.2): Resolving the host redirect URL is now wrapped so a malformed HostAppUrl configuration surfaces as the existing “could not determine where to take you next” message instead of an uncaught exception - setup has already published by that point, so nothing about the person’s submission is lost. (#17)
Ante (Release v0.4.1): Removed the pre-append success signals in AcceptInvitation, SetupOrganization, and RegisterOrganization - each called into the status-subscription tracker before its event was even appended, so a polling client could observe “accepted” before the fact existed in Ante’s own event log, let alone reached the outbox. (#16)
Ante (Release v0.4.1): All four outbox-forwarding reactors (JoinTenantAcceptanceOutbox, OrganizationSetupOutbox, OrganizationRegistrationOutbox, LegalTermsAcceptanceOutbox) now verify their append to the outbox actually succeeded and throw when it did not, instead of discarding the result - a failed append previously advanced the observer’s cursor and was never retried or published. Throwing lets Chronicle pause and retry the failing partition instead. (#16)
Ante (Release v0.4.1): Outbox-forwarded events now carry the exact correlation id, occurrence time, and compliance subject Ante recorded locally, rather than fresh defaults picked up from the forwarding reactor’s own execution context - a host comparing the local and outboxed copies now sees identical values on every field. (#16)
Ante (Release v0.4.1): LegalTermsAcceptanceOutbox had no spec coverage at all before this change.
AI (Release v0.9.0): The Fundamentals preview-assets workflow asserted previewRequestEligible is false, which the tracked readiness file has contradicted since npm ownership and the trusted publisher landed. It now asserts the readiness state against the schema’s enum, so the next dispatch no longer fails on a step recording real progress (#258)
AI (Release v0.9.0): npm-stage-contract.json named release-approved-ai-profiles.yml as the production publication path; that workflow was deleted with the generated-distribution pipeline. It now names the workflow that really publishes (#258)
AI (Release v0.9.0): Tracked distribution state that described a superseded model: the 2026-08-22 remote-repository blocker list, rollout-policy.json listing two permanently-true-by-design conditions as pending blockers, an update-bot contract claiming a deleted workflow was ready, and release-automation capabilities that are no longer implemented (#258)
Chronicle (Release v17.0.2): Include Cratis.Chronicle.Compatibility.dll in both Chronicle.Testing and Chronicle.XUnit.Integration so each package starts independently beside Arc (#3968).
Ante (Release v0.4.0): Fixed a client-side bug where the legal-acceptance checkbox and the accepted-version field could be silently reset by CommandForm’s reactive value re-application on any unrelated re-render (e.g. opening the terms/privacy dialog) - initialValues and currentValues passed to CommandStepper were recreated on every render, and a defined value in initialValues always wins over currentValues for the same key, so the previously-hardcoded acceptedLegalVersion: '' baseline was reasserted over the real version on every reactive pass.
Ante (Release v0.4.0): *Mononym / ma
AI (Release v0.6.0): The client ValidationResult shape: it carries members: string[] (camelCased on purpose) and a numeric severity, not a propertyName and a string sev
AI (Release v0.5.0): Reducer guidance no longer shows a non-nullable current-state parameter; that shape now throws at registration rather than being skipped (#177)
AI (Release v0.5.0): Reactor guidance no longer references ReactorSideEffect, which does not exist in Chronicle; EventForEventSourceId is the real per-event metadata carrier, and its reactor support shipped long ago rather than being upcoming (#177)
AI (Release v0.5.0): [OnceOnly] is documented as replay exclusion rather than per-event-source deduplication, so side effects are still required to be idempotent (#177)
AI (Release v0.5.0): Reactor guidance no longer states a two-parameter limit, and [Reactor] is documented without the isActive argument it does not have (#177)
AI (Release v0.5.0): Read model guidance attributes [ReadModel], [Path], and the Observe extensions to Arc rather than Chronicle, requires ISubject<...> rather than a concrete subject type on query methods, and points single-document reads at ObserveSingle and ObserveById (#177)
AI (Release v0.5.0): Projection guidance drops the removed [FromEventSequence] attribute, puts UsingKey and its siblings on the per-event builder where they live, and
Ante (Release v0.3.0): The eager organization-name check (AcceptedOrganizationName) previously only saw names claimed through invited tenant creation. It now also sees names claimed through self-service registration, so the friendly “an organization with this name already exists” message fires for that case too, instead of only surfacing as an append-time rejection.
Ante (Release v0.3.0): Releasing an organization-name claim when an accepted creation is later revoked/rolled back. There is no host-facing contract event today for reversing an accepted InvitationToCreateTenantAccepted or OrganizationRegistrationCompleted - Ante’s job ends the moment that event is appended, and revocation in this codebase only ever applies to a still-pending invitation (before acceptance), which never claimed a name in the first place. Wiring a RemovedWith<T>() release path would mean inventing a new cross-repo contract event, which is a product/protocol decision beyond this work package’s scope. “Failed acceptance must not strand a claim” is satisfied by construction instead: a rejected command never appends an event, so no claim is ever created for it.
Ante (Release v0.3.0): Real concurrent (parallel) append load tests, migration/collision rehearsal tooling, and mixed old/new writer detection from the issue’s broader acceptance criteria are infrastructure/ops concerns beyond a single constraint-level change, and aren’t exercised by this repo’s existing spec conventions (see the pre-existing UniqueOrganizationNameConstraint spec, which is also sequential, not parallel) - the kernel’s append-time constraint check is what actually provides the concurrency guarantee here, independent of how the spec drives it.
Ante (Release v0.3.0): [x] dotnet build -c Debug (solutio
AI (Release v0.4.0): The DataPage reference documented an entirely fictional prop surface —
Ante (Release v0.2.1): AcceptInvitation and SetupOrganization now reject a caller who has not verifiably exchanged the exact invitation they are acting on. Previously, any signed-in caller supplying a known invitation id could complete onboarding for that invitation under their own identity, even without ever exchanging its invite token - the invitation id alone (visible in a URL, a token, or a shared link) was treated as sufficient. (#13)
Ante (Release v0.2.1): SignedInIdentity’s session lookup no longer falls back to the most recently accepted session when the current request’s subject does not match the one recorded for an invitation. That fallback treated contradictory evidence (a different login than the one that exchanged the invitation) the same as missing evidence, which could resolve the wrong identity provider and compliance subject for the events an onboarding command appends.
Ante (Release v0.2.1): SignedInIdentity’s session lookup now also excludes expired sessions, closing a window where a session past its nominal expiry - but not yet swept by MongoDB’s periodic TTL cleanup - could still be picked.
Ante (Release v0.2.1): [x] dotnet build -c Debug - 0 warnings, 0 errors (regenerates proxies; command shapes unchanged)
Ante (Release v0.2.1): [x] dotnet build -c Release -p:CratisProxiesOutputPath= - 0 warnings, 0 errors
Ante (Release v0.2.1): [x] dotnet test - 78/78 passing, including new specs covering: a verified owner succeeds, a caller with no session/expired session/wrong-invitation session is rejected, contradictory subject evidence is rejected, and the jti-claim fast path verifies directly
Ante (Release v0.2.0): A repeated exchange for the same invitation no longer risks the earlier bug where each call was written independently, with no guard against extending the session’s effective lifetime on retry.
Ante (Release v0.2.0): Full signature verification of the invite token - this endpoint still only parses the token locally; the authentication proxy remains the actual trust boundary. Verifying that boundary depends on the proxy protocol still to be agreed in #11.
Ante (Release v0.2.0): Expiry enforcement on the jti/invite_type claims path the authentication proxy forwards per request (the primary identity-resolution path, ahead of the AcceptedInvitation session fallback this PR hardens) - also depends on the not-yet-finalized proxy contract from #11.
Ante (Release v0.2.0): [x] dotnet build (Debug) - 0 warnings, 0 errors, proxies unaffected (no [Command]/[ReadModel] surface changed)
Ante (Release v0.2.0): [x] dotnet build (Release, -p:CratisProxiesOutputPath=) - 0 warnings, 0 errors
Ante (Release v0.2.0): [x] dotnet test - 65/65 passed, including three new specs: successful exchange (now asserting the recorded expiry), an expired token being rejected, and a retried exchange establishing the same session both times
Ante (Release v0.2.0): [x] No frontend/TypeScript files touched - frontend gates not applicable to this change
Chronicle (Release v17.0.1): DateTimeOffset reached the wire as an empty message, so ten fields — job creation times, user timestamps, event query date ranges — carried no value to Kotlin, TypeScript and Elixir clients. .NET was unaffected, which is why it went unseen.
Chronicle (Release v17.0.1): The proto generator aborted for 22 of its 23 packages while exiting 0, so most generated contracts had silently stopped regenerating and an entire SequenceQueries service had never been emitted at all.
Chronicle (Release v17.0.1): Generated proto files and the descriptor set are now deleted and rewritten on every build, so a hand-applied edit to a generated file cannot survi
Chronicle (Release v16.45.3): Keyed model-bound child projections continue accepting updates after replay when an explicit event key matches the child key property. (#3922)
release-action (Release v1.3.0): Intentional no-release merges now report no-release instead of no-label, so workflows can distinguish suppression from missing version intent.
Fundamentals (Release v7.18.4): Remove the unused eslint-plugin-react dependency that made the shared config’s ESLint 10 peer graph invalid (#1109)
Fundamentals (Release v7.18.4): Keep native TypeScript 7 compilation separate from the official JavaScript API compatibility package used by lint and build tooling (#1109)
Chronicle (Release v16.45.2): A migration built from a nested property expression no longer fails registration with InvalidMigrationPropertyForEventType naming a property that exists one level down (#3949)
Chronicle (Release v16.45.2): A DefaultValue targeting a nested property no longer writes a top-level key with a dot in its name that the target generation’s schema then discards, leaving old events upcasting with the value missing and no error anywhere (#3949)
Chronicle (Release v16.45.1): [Index] on a record’s positional constructor parameter now declares an index, as the documentation says it does. Previously only [property: Index] worked, and the difference was invisible — nothing reported that a declaration had produced no index. (#3954)
Chronicle (Release v16.45.0): [AddFrom<T>] on a property of a [ChildrenFrom<T>] child no longer double-counts the event that creates the child entry. Accumulating child breakdowns produced exactly twice the value on the creating event, and every later event accumulated on top of that (#3940)
Chronicle (Release v16.45.0): A job left persisted as running with all of its steps already completed is now finalized instead of reported as already running. Such a job stayed wedged forever and its observer could never resubscribe, leaving reactors disconnected indefinitely (#3944)
Chronicle (Release v16.45.0): A read model’s declared indexes are now recreated on the collection a replay fills, so they survive the swap that ends the replay instead of being absent until the sink is rebuilt (#3942)
Arc (Release v22.10.4): Exclude child and nested model-bound types from standalone Chronicle command read-model registration, matching Chronicle’s projection discovery (#2587)
Arc (Release v22.10.4): Detect ambiguous command identities declared through positional [Key] parameters, without counting the same property twice (#2645)
Arc (Release v22.10.4): Correct read-model failure guidance to distinguish generated creation keys, unusable declared keys, absent state, and missing provider registrations
Arc (Release v22.10.3): Recognize [Key] on a positional record’s primary-constructor parameter when resolving a command’s event source id, so it behaves the same as [Key] on a property (#2645)
Arc (Release v22.10.3): Register each ICanResolveReadModelForCommand provider itself in DI (not just its per-type factories), so IEnumerable<ICanResolveReadModelForCommand> reflects every registered provider (#2645)
Chronicle (Release v16.44.2): Stopped a shutdown requested during kernel startup from crashing with an unhandled exception; it now stops gracefully and logs the shutdown (#3936)
Chronicle (Release v16.44.2): Fixed a NullReferenceException when an observer activates against an unset projection definition (#3934)
Chronicle (Release v16.44.2): ReactorScenario now surfaces what a reactor handler throws instead of swallowing the exception, so throwing reactors can be specced (#3933)
Chronicle (Release v16.44.2): In-memory event sequence storage now records the real identity that caused an event instead of hardcoding Identity.System, so in-process scenarios can assert event attribution (#3928)
Chronicle (Release v16.44.2): ReadModelScenario’s GetInstanceById now returns null for an instance that was never seeded instead of throwing (#3927)
Chronicle (Release v16.44.2): The client now keeps retrying artifact registration in the background after it fails on an otherwise healthy connection, instead of leaving observers disconnected indefinitely until the next reconnect (#3935)
Chronicle (Release v16.44.2): dotnet build (Debug and Release) — zero warnings, zero errors across every affected project
Chronicle (Release v16.44.2): dotnet test — zero failures across Core.Specs, Testing.Specs, DotNET.Specs, Storage.InMemory.Specs, Services.Specs
Chronicle (Release v16.44.2): #3936’s fix is top-level Program.cs startup/shutdown control flow, which has no automated spec coverage in this codebase and was not exercised against a live kernel process in this session — it was verified by code review only (catching OperationCanceledException, the base type TaskCanceledException derives from, around app.RunAsync is the standard .NET pattern for a cancellation requested during startup). Flagging this as unverified-at-runtime rather than claiming a manual test that wasn’t actually run.
Screenplay (Release v4.12.1): The invoicing sample declared layout MasterDetail/layout DashboardLayout nested inside the module and referenced them from screens as layout X. The current grammar declares the application shell as a top-level layout (with an arrangement), selected from a ui profile, while a module declares screen template/dialog template and a screen fills one with template X. The sample now matches the shape already used and compiler-verified in for_ScreenplayCompiler/invoicing.play.
Screenplay (Release v4.12.1): The editor’s symbol scanner (screenplay-language/symbols.ts) matched any two-token indented line as a typed property, without excluding reserved directive keywords. authorize <Policy>, produces <Event>, tag <Name>, validate csharp, and each concurrency dimension (sourceType/streamType/streamId <Value>) were all misread as properties and flagged “Unknown type” whenever the second token wasn’t coincidentally a declared concept or type — 16 false warnings on the invoicing sample alone. Directive lines are now excluded from property matching, honoring the existing @name escape for the rare property genuinely named after a reserved word.
Stage (Release v3.11.0): A key declared on a from block, or on one of its events, is carried onto [FromEvent]. Chronicle seeds every projection with the event source id and never derives routing from [Key], so a keyed projection was writing its documents under the event source id instead of the key it declared (#13)
Stage (Release v3.11.0): no automap was not read at all, so a projection that disabled automapping rendered with it enabled and mapped event properties the model deliberately excluded (#13)
Stage (Release v3.11.0): clear with on a read model emitted a class-level [ClearWith] that Chronicle only reads on a nested type, so it compiled and was then discarded (#13)
Arc (Release v22.10.1): In source-file grouping mode, two types sharing a short name could have one rewrite the other’s imports, producing TypeScript that does not compile. BuildImportPathFixups skipped any type whose file was already named after it — true that it needs no rewrite, but it also took that type out of conflict detection, so the other type claimed the short name unopposed and the fixup was applied to every import of either.
Arc (Release v22.10.0): A read-only dictionary is now recognized as a dictionary. IsDictionary only looked for IDictionary<,>, and IReadOnlyDictionary<,> is its sibling rather than its derivative — so a model exposing its dictionaries read-only, the natural shape for an immutable record, was not seen as holding dictionaries at all. IReadOnlyDictionary<string, IReadOnlyList<T>> now generates as Record<string, T[]> instead of a KeyValuePair[] referencing a type that was never imported. (#2634)
Arc (Release v22.10.0): Library mode no longer aborts on a model with two read-only dictionaries. Those unrecognized dictionaries put two closed instantiations of KeyValuePair<,> in one output file, and the duplicate-path guard stopped the entire run. With them recognized, CollectTypesInvolved takes only the value type as it always did for the mutable shape, and no KeyValuePair is emitted. (#2634)
Arc (Release v22.10.0): Library mode no longer aborts on an open generic either. It collected open definitions such as CompilationResult<T>, and walking one reached its own type parameter — which has no full name, so it produced a nameless descriptor landing on the definition’s own path. An open definition has no concrete shape to emit and a generic parameter is not a type, so both are skipped. (#2634)
Scene (Release v3.0.0): SceneTooltip passed a slot straight to Tooltip. Components 4 takes one focusable trigger element, which it clones to attach its own part attributes, and a Scene slot is a list — so it now wraps the slot in a single element rather than failing to type.
Chronicle.Kotlin (Release v4.0.0): Both console samples opened their live watch before seeding, and a watch on a read model with no instances throws (Cratis/Chronicle#3925) — so the subscription was lost on every fresh store. It now starts once seeding has given the projection something to watch.
Chronicle.Kotlin (Release v3.1.0): Connecting with artifact discovery on no longer fails to start. The classpath scan classified anonymous, local and inner classes as artifacts and then could not construct them — including the client’s own Java adapters — so registration threw before the first reactor was registered.
Chronicle.Kotlin (Release v3.1.0): Registering an event type or read model declared as a Java record with a primitive component (double, int, boolean) no longer throws while its schema is generated.
Arc (Release v22.9.0): AddCratisArcMeter no longer creates and abandons an undisposed Meter on every call after the first — the meter is created only when actually registered and is now owned and disposed by the service provider (#2629)
Fundamentals (Release v7.18.3): AddBindingsByConvention and AddSelfBindings no longer re-walk the full assembly reference closure on every call — the walk now runs only when an assembly no previous walk has processed is loaded, while assemblies loaded later still get their module constructors run on the next registration call (#1107)
Fundamentals (Release v7.18.3): Generated binding replay now guards duplicates with a set of registered service types instead of a linear scan of the service collection per binding, making the replay linear in the number of bindings (#1107)
Fundamentals (Release v7.18.3): Types.All is materialized once at construction instead of re-enumerating and re-hashing the full type universe on every iteration (#1107)
Chronicle.Elixir (Release v2.3.0): Only the first from_every declaration reached the kernel. The macro accumulated every call but the coordinator kept one, so a projection declaring context capture and property mapping separately silently lost all but one (#40)
Chronicle.Elixir (Release v2.3.0): Compliance metadata now lands on the individual leaf values in the schema rather than the object containing them, and is de-duplicated when a value is reached by both a concept marker and a redundant field-level pii (#40)
Chronicle.Elixir (Release v2.3.0): 150 documentation snippets that rendered an empty Elixir tab now show real code, and 21 that claimed “Elixir does not support this workflow yet” were false — append_many_for_event_sources/2, ReadModels.watch/2 and reactor side-effect returns among them (#40)
Chronicle.Elixir (Release v2.3.0): The README referenced Chronicle.EventType, Chronicle.ReadModel, Chronicle.Reactor, Chronicle.Reducer and Chronicle.Seeder; the real modules are nested under Chronicle.Events, Chronicle.ReadModels, Chronicle.Reactors, Chronicle.Reducers and Chronicle.Seeding (#40)
Chronicle.TypeScript (Release v4.0.0): A class-level @pii() did not mark the class’s own properties. A @pii()-adorned read model or event produced a schema with no compliance entries at all, so values the .NET client would encrypt were written in the clear (#58)
Chronicle.TypeScript (Release v4.0.0): Compliance metadata was written onto container nodes instead of the values underneath, so a @pii() composite value object stored one opaque ciphertext string where the schema still said object — releasing it returned a string and the read model failed to materialize. Metadata now lands on leaves and is de-duplicated (#58)
Chronicle.TypeScript (Release v4.0.0): An array of @pii()-marked concepts lost its classification entirely — every array was emitted with its element type discarded (#58)
Chronicle.TypeScript (Release v4.0.0): A model-bound projection was always pinned to event-log and always had AutoMap enabled; neither could be changed (#58)
Chronicle.TypeScript (Release v4.0.0): The compliance subject was a hardcoded id lookup that threw when absent, so a read model whose subject is not its id released against the wrong encryption key (#58)
Chronicle.TypeScript (Release v4.0.0): 196 documentation snippets that rendered an empty TypeScript tab now show real co
Arc (Release v22.8.2): Documentation in generated TypeScript proxies keeps apostrophes, quotes and ampersands as written, instead of arriving HTML-escaped as ', " and &
Arc (Release v22.8.1): The ARCCHR0009 documentation told you to mark a false positive [NotAudited], which silences the warning by withholding the value rather than recording it; it now says to suppress the diagnostic and keep the value (#2625)
Chronicle (Release v16.44.1): Event details in Sequences now shows the causation entry’s own properties when navigating Context → causation → properties, instead of falling back to the root event context
Chronicle (Release v16.44.1): Navigating into the second or later causation entry now shows that entry’s properties rather than the first entry’s
Chronicle (Release v16.44.1): The property navigation breadcrumb shows which array element was navigated through, as [0]
Components (Release v4.1.1): ObjectContentEditor now shows the correct content when navigating into an object or array nested inside an array element, instead of silently falling back to the root object while the breadcrumb showed the deeper path
Components (Release v4.1.1): Navigating into a property of the second or later element of an array now shows that element’s content rather than the first element’s
Components (Release v4.1.1): ObjectNavigationalBar renders array index segments in bracket notation ([0]), so the breadcrumb shows which element was navigated through
Chronicle (Release v16.44.0): The Time Machine found no snapshots for a read model instance whose projection is keyed by a property rather than the event source.
Chronicle (Release v16.44.0): A projection preview returned instances without their key, so opening one in the Time Machine had nothing to look up.
Chronicle (Release v16.44.0): The pivot viewer clipped tile titles, lost pinch-to-zoom on trackpads and touch devices, and could leave tiles unreachable after zooming in grouped mode.
Chronicle (Release v16.44.0): Selecting a read model instance did not stick, which left the Time Machine disabled; selecting an event in the sequence editor showed no details.
Chronicle (Release v16.44.0): A details pane no longer cramps the columns of the grid beside it.
Chronicle (Release v16.44.0): Disabled buttons are visibly disabled, and the projection editor’s help and source buttons stay insid
Components (Release v4.1.0): Card titles and value columns are measured and ellipsized to fit the card. Text longer than the
Components (Release v4.1.0): Pinch to zoom works again on trackpads, and on touch devices the viewport no longer gives the
Components (Release v4.1.0): The viewport keeps its place when a zoom change resizes the content. Zooming out far enough
Chronicle (Release v16.42.2): FacetSet now round-trips System.Text.Json — its deserialization constructor previously could not bind, so any behavior pattern crossing a serialization boundary threw.
cli (Release v2.19.1): Prevent Screenplay generation from reporting CLI0017 when NuGet content files are compiled through buildTransitive while package metadata marks them buildAction=None. (#104)

Security

Ante (Release v0.6.0): The identity backchannel’s outage warning no longer logs the organization name it was checking - private diagnostics never surface onboarding-specific facts, only the exception an operator needs to diagnose the outage. (#19)
Ante (Release v0.6.0): Startup validation of trust settings (key correspondence/strength, algorithms, audience/provider rules, session expiry) - the trust and compatibility contract to validate against is not yet agreed (WP-00, #11).
Ante (Release v0.6.0): An independent observer/publication-lag readiness indicator - needs durable publication and progress semantics first (WP-05, #16).
Ante (Release v0.6.0): A fully authorized route matrix integrating owner identity end-to-end - depends on WP-02, #13. Invitation-bound commands are already guarded today via ISignedInIdentity.IsVerifiedOwnerOf, not a new ASP.NET [Authorize] policy.
Ante (Release v0.6.0): Reviewing/replacing the InvitationTokenIssued public contract - the issue itself notes this needs compatible host agreement, out of scope here.
Ante (Release v0.6.0): [x] dotnet build -c Debug - 0 warnings, 0 errors (regenerates proxies)
Ante (Release v0.6.0): [x] dotnet build -c Release -p:CratisProxiesOutputPath= - 0 warnings, 0 errors
Ante (Release v0.6.0): [x] dotnet test - 217/217 passing, including new specs covering: a guarded route rejecting an unmatched/unauthorized request (ApiRouteGuard, for_ApiRouteGuard), a public onboarding route staying reachable, and health reflecting readiness within its bounds (AnteHealthChecks, MongoDbHealthCheck, including a real bounded-timeout proof)
Ante (Release v0.6.0): [ ] Frontend not touched - no lint/build required
AuthProxy (Release v2.22.0): AuthProxy specs: 2036 passed.
AuthProxy (Release v2.22.0): Aspire specs: 74 passed.
AuthProxy (Release v2.22.0): Focused current/callback/replay matrix:
AuthProxy (Release v2.22.0): Mutation check: 2/2 mutations killed.
AuthProxy (Release v2.22.0): Documentation limitation: the shared Documentation/web full check is unavailable because isolated runs timed out on unrelated Chronicle client generation; the source documentation stale-terminology scan and diff check passed.
AuthProxy (Release v2.22.0): Resolve nanoid to ^3.3.18, fixing GHSA-2v37-7h3g-55p8 (HIGH).
AuthProxy (Release v2.22.0): Pin security workflow actions to verified full SHAs with persist-credentials: false.
AuthProxy (Release v2.22.0): Add a frontend dependency audit job blocking HIGH/CRITICAL advisories.
AuthProxy (Release v2.22.0): Code review: APPROVE
AuthProxy (Release v2.22.0): Security review: APPROVE
AuthProxy (Release v2.22.0): Evidence SHA-256: c3d8b25ea41a9362c942bdc7491ac6692dca21b7dba0219bab2e641eb678c4c2