--- title: "Release digest: November 2 - 9, 2026 (Week 45)" description: "Cratis releases for November 2 - 9, 2026: AI, Ante, Arc, Arc.Elixir, Arc.Kotlin, Arc.TypeScript, AuthProxy, Choreography, Chronicle, Chronicle.Elixir…" editUrl: "https://github.com/Cratis/.github/edit/main/release-digests/2026-11-02-to-2026-11-09.md" --- ## Week in numbers - **336 releases**: 203 with new features, 120 with fixes, 7 with breaking changes. - **508 merged pull requests** and **599 issues closed**. - From merge to release: median **< 1 minute** (90% within 13 minutes). - Busiest repository: [Chronicle](https://github.com/Cratis/Chronicle) (56 releases). - Current daily release streak: **97 days**. ## Version movement | Repository | Previous version | Current version | | --- | --- | --- | | [AI](https://github.com/Cratis/AI) | [v7.129.0](https://github.com/Cratis/AI/releases/tag/v7.129.0) | [v7.148.0](https://github.com/Cratis/AI/releases/tag/v7.148.0) | | [Ante](https://github.com/Cratis/Ante) | [v1.6.0](https://github.com/Cratis/Ante/releases/tag/v1.6.0) | [v1.12.0](https://github.com/Cratis/Ante/releases/tag/v1.12.0) | | [Arc](https://github.com/Cratis/Arc) | [v22.159.0](https://github.com/Cratis/Arc/releases/tag/v22.159.0) | [v22.182.1](https://github.com/Cratis/Arc/releases/tag/v22.182.1) | | [Arc.Elixir](https://github.com/Cratis/Arc.Elixir) | First release | [v1.0.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v1.0.0) | | [Arc.Kotlin](https://github.com/Cratis/Arc.Kotlin) | [v7.11.0](https://github.com/Cratis/Arc.Kotlin/releases/tag/v7.11.0) | [v7.11.1](https://github.com/Cratis/Arc.Kotlin/releases/tag/v7.11.1) | | [Arc.TypeScript](https://github.com/Cratis/Arc.TypeScript) | [v0.57.2](https://github.com/Cratis/Arc.TypeScript/releases/tag/v0.57.2) | [v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0) | | [AuthProxy](https://github.com/Cratis/AuthProxy) | [v2.40.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.40.0) | [v2.57.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.57.0) | | [Choreography](https://github.com/Cratis/Choreography) | [v1.33.1](https://github.com/Cratis/Choreography/releases/tag/v1.33.1) | [v2.3.1](https://github.com/Cratis/Choreography/releases/tag/v2.3.1) | | [Chronicle](https://github.com/Cratis/Chronicle) | [v19.115.4](https://github.com/Cratis/Chronicle/releases/tag/v19.115.4) | [v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0) | | [Chronicle.Elixir](https://github.com/Cratis/Chronicle.Elixir) | [v3.16.1](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.16.1) | [v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0) | | [Chronicle.Go](https://github.com/Cratis/Chronicle.Go) | [v0.11.1](https://github.com/Cratis/Chronicle.Go/releases/tag/v0.11.1) | [v0.12.0](https://github.com/Cratis/Chronicle.Go/releases/tag/v0.12.0) | | [Chronicle.Kotlin](https://github.com/Cratis/Chronicle.Kotlin) | [v7.3.1](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.3.1) | [v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0) | | [Chronicle.Mcp](https://github.com/Cratis/Chronicle.Mcp) | [v2.0.0](https://github.com/Cratis/Chronicle.Mcp/releases/tag/v2.0.0) | [v2.1.0](https://github.com/Cratis/Chronicle.Mcp/releases/tag/v2.1.0) | | [Chronicle.TypeScript](https://github.com/Cratis/Chronicle.TypeScript) | [v6.54.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.54.0) | [v6.61.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.61.0) | | [cli](https://github.com/Cratis/cli) | [v3.119.0](https://github.com/Cratis/cli/releases/tag/v3.119.0) | [v3.125.0](https://github.com/Cratis/cli/releases/tag/v3.125.0) | | [Components](https://github.com/Cratis/Components) | [v4.39.0](https://github.com/Cratis/Components/releases/tag/v4.39.0) | [v4.40.0](https://github.com/Cratis/Components/releases/tag/v4.40.0) | | [DirectPublic](https://github.com/Cratis/DirectPublic) | First release | [v3.57.1](https://github.com/Cratis/DirectPublic/releases/tag/v3.57.1) | | [Eventmodelers-Build-Kit-CSharp](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp) | First release | [v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2) | | [Eventmodelers-Build-Kit-Java](https://github.com/Cratis/Eventmodelers-Build-Kit-Java) | [v1.0.0](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.0) | [v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1) | | [Eventmodelers-Build-Kit-Kotlin](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin) | [v1.0.0](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.0) | [v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1) | | [Fundamentals](https://github.com/Cratis/Fundamentals) | [v7.32.1](https://github.com/Cratis/Fundamentals/releases/tag/v7.32.1) | [v7.33.1](https://github.com/Cratis/Fundamentals/releases/tag/v7.33.1) | | [Fundamentals.Kotlin](https://github.com/Cratis/Fundamentals.Kotlin) | [v0.8.0](https://github.com/Cratis/Fundamentals.Kotlin/releases/tag/v0.8.0) | [v0.9.0](https://github.com/Cratis/Fundamentals.Kotlin/releases/tag/v0.9.0) | | [Montage](https://github.com/Cratis/Montage) | First release | [v0.0.1](https://github.com/Cratis/Montage/releases/tag/v0.0.1) | | [Prompter](https://github.com/Cratis/Prompter) | [v0.14.1](https://github.com/Cratis/Prompter/releases/tag/v0.14.1) | [v0.14.17](https://github.com/Cratis/Prompter/releases/tag/v0.14.17) | | [release-action](https://github.com/Cratis/release-action) | [v1.5.1](https://github.com/Cratis/release-action/releases/tag/v1.5.1) | [v1.5.2](https://github.com/Cratis/release-action/releases/tag/v1.5.2) | | [Scene](https://github.com/Cratis/Scene) | [v4.86.0](https://github.com/Cratis/Scene/releases/tag/v4.86.0) | [v5.1.0](https://github.com/Cratis/Scene/releases/tag/v5.1.0) | | [Screenplay](https://github.com/Cratis/Screenplay) | [v5.1.0](https://github.com/Cratis/Screenplay/releases/tag/v5.1.0) | [v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0) | | [Screenplay.Generation](https://github.com/Cratis/Screenplay.Generation) | [v0.19.0](https://github.com/Cratis/Screenplay.Generation/releases/tag/v0.19.0) | [v0.20.0](https://github.com/Cratis/Screenplay.Generation/releases/tag/v0.20.0) | | [Showrunner](https://github.com/Cratis/Showrunner) | [v1.14.0](https://github.com/Cratis/Showrunner/releases/tag/v1.14.0) | [v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0) | | [Specifications](https://github.com/Cratis/Specifications) | [v5.2.1](https://github.com/Cratis/Specifications/releases/tag/v5.2.1) | [v5.2.3](https://github.com/Cratis/Specifications/releases/tag/v5.2.3) | | [Stage](https://github.com/Cratis/Stage) | [v4.215.0](https://github.com/Cratis/Stage/releases/tag/v4.215.0) | [v5.4.0](https://github.com/Cratis/Stage/releases/tag/v5.4.0) | ## Added - **AI** ([Release v7.148.0](https://github.com/Cratis/AI/releases/tag/v7.148.0)): A `published-contracts.md` rule: before changing behavior at a trust boundary or wire/protocol surface, find the published contract and its conformance vectors and cite them in the issue and pull request (or state that none exists); when a change conflicts with a vector the contract wins, so change the contract through its owner first; repositories that implement a contract run its pinned vectors as executable specs in CI (#1087) - **Chronicle.TypeScript** ([Release v6.61.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.61.0)): Add `.setOnce(property)` to fluent projections and the `setOnce` option to `@setFrom` and `@setFromContext`, so a property keeps the first value it receives. - **Chronicle.TypeScript** ([Release v6.61.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.61.0)): Add dictionary keys to fluent projections, so events can project into keyed dictionary entries. - **Chronicle.TypeScript** ([Release v6.61.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.61.0)): Add `.toCausedBy()` to map a property from the identity that caused the event. - **Chronicle.TypeScript** ([Release v6.61.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.61.0)): Add `.prepend()`, `.orderBy()` and `.orderByDescending()` to children in fluent projections and the matching `prepend`, `orderBy` and `orderByDescending` options to `@childrenFrom`, so new children can be placed first or sorted (#282) - **Chronicle.Elixir** ([Release v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0)): `set_once:` sets a property or dictionary entry only while it has no value, so the first event wins. - **Chronicle.Elixir** ([Release v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0)): Dictionary entries keyed by a value from the event: key sources `{:event_content, field}`, `{:event_context, field}` and `{:caused_by, :subject | :name | :user_name}`, with set, set once, add, subtract, count, increment, decrement and remove operations. - **Chronicle.Elixir** ([Release v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0)): `{:caused_by, :subject | :name | :user_name}` maps a property from the identity that caused the event; a bare `:caused_by` still reads the event field of that name. - **Chronicle.Elixir** ([Release v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0)): In-memory projection testing evaluates set once and dictionary entries the way the kernel does. - **Chronicle.Elixir** ([Release v3.21.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.21.0)): `children` takes `prepend: true` to insert new children first, or `order_by: :field`, `[asc: :field]` or `[desc: :field]` to insert them sorted, matching the .NET client's `Prepend()`, `OrderBy()` and `OrderByDescending()` (#216) - **Chronicle.Kotlin** ([Release v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0)): Key dictionary entries on a read model from an event property, the event context or who caused the event, with `DictionaryKey.fromEvent`, `fromContext` and `fromCausedBy` on `set`, `count`, `increment`, `decrement` and `add`. - **Chronicle.Kotlin** ([Release v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0)): Remove a dictionary entry by key with `removeKey`. - **Chronicle.Kotlin** ([Release v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0)): Set a property, or a dictionary entry, only while it has no value with `setOnce`, so the first event that produces a value wins. - **Chronicle.Kotlin** ([Release v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0)): Set a property from the identity of whoever caused an event with `toCausedBy`. - **Chronicle.Kotlin** ([Release v7.8.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.8.0)): Keep children prepended or sorted by a child property, with `prepend`, `orderBy` and `orderByDescending` on fluent children and on `@ChildrenFrom` (#176) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A dictionary entry in a projection can be keyed by a property of the event's content, for example `slots.$eventContent.slot`, alongside the existing event context and caused by keys. Set, set once, add, subtract, increment, decrement and count all accept such a key. An event whose key is missing or null skips the mapping, and a key path the event type does not have fails when the projection is registered (#5756) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A dictionary key can be removed with the `$remove` operation, and every sink (MongoDB, SQL and in-memory) removes the entry instead of leaving it as null. Removing a key that does not exist does nothing (#5756) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): Set once assigns a property only when it has no value yet, on the root, on children, on nested objects and on dictionary entries, so a read model can keep who created an entry and when (#5757) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): Children can be ordered: new children can be prepended or kept sorted by a child property, ascending or descending. Equal values are ordered by the child's identifier, and MongoDB, SQL, in-memory and the projection engine all store the same order. Appending stays the default, and updating an existing child never moves it (#5758) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): The .NET client supports these operations in fluent projections (`SetOnce`, `RemoveKey`, dictionary keys from event content and children ordering) and in model-bound projections through the `SetFrom`, `SetFromContext` and `ChildrenFrom` attributes. They are also supported by `ReadModelScenario` and recognized by the projection analyzers (#5759) - **Chronicle** ([Release v19.149.0](https://github.com/Cratis/Chronicle/releases/tag/v19.149.0)): Read a Neo4j server address and password from mounted files: `serverFile` on a named Neo4j sink, and `serverFile` and `passwordFile` on the `neo4j` section, with the same startup checks as the other file settings (#5771) - **cli** ([Release v3.125.0](https://github.com/Cratis/cli/releases/tag/v3.125.0)): `cratis build connect`, `run`, `once` and `status`: a builder host for Cratis Studio. It registers the machine with a short code, agrees the protocol version, claims slices, keeps the claim alive, runs the kit's verification commands (a failing command reports the slice as failed, never built), commits on the kit's branch and reports the outcome. Builds run with Claude Code natively, with Codex, Gemini CLI, Cursor, GitHub Copilot CLI or OpenCode over the Agent Client Protocol, or with any generator through `--exec`. Credentials stay in the operating system's credential store and are never written into prompts, orders, outcomes or logs. (#560) - **cli** ([Release v3.125.0](https://github.com/Cratis/cli/releases/tag/v3.125.0)): `cratis build init --kit ` installs a build kit from Studio (checksum verified) or from Git (`#`, `--kit-folder`), scaffolds an empty project or prepares an existing codebase whose conventions the first build learns, writes the kit's instructions and skills where the chosen agent reads them, and records the installation in `.cratis/build/kit.json`. `cratis build kit validate` checks a kit for authors. (#561) - **cli** ([Release v3.125.0](https://github.com/Cratis/cli/releases/tag/v3.125.0)): `cratis build run --modeling --board --agent ` connects a local coding agent to a Studio board: it shows as connected, people hand it work by mentioning it in the board chat, and it answers there. It proposes changes for a person to confirm, or acts at once with `--unattended`; what it changes on the board is attributed to it. (#562) - **cli** ([Release v3.125.0](https://github.com/Cratis/cli/releases/tag/v3.125.0)): `cratis studio fetch --context --id --format markdown|json|yaml|toon [--out ]` fetches the context of part of a model for an AI agent or a pipeline, with the same Studio connection as `cratis build`. (#563) - **AI** ([Release v7.147.0](https://github.com/Cratis/AI/releases/tag/v7.147.0)): `cratis-check-handoff.mjs` checks a session handoff written with the `cratis-session-handoff` skill before the session ends: every template section is present, recorded commits and branches match the repository, and every running job has a complete watch row. Errors fail the check; warnings are advisory unless `--strict` is given (#1082) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): A `Production` is reconciled into Chronicle: a StatefulSet of the `cratis/chronicle` production image behind a headless Service whose port is named `chronicle` for `chronicle+srv://` discovery, a certificate from a cert-manager certificate authority, generated administrator and client credentials, and a connection Secret reported in `status.connectionSecretName` (part of #15) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): Replicas above one form one Orleans cluster through the database, and changing `version` rolls the StatefulSet (part of #15) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): `database.mode: Managed` runs MongoDB through the Percona operator, with pinned images, automatic upgrades off, TLS disabled, an 8Gi memory limit and settings for members, size, storage class and node placement (part of #16) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): `graph.mode` (`None`, `Managed` or `External`) and `graph.edition` (`Community` or `Enterprise`) give a Production a Neo4j for graph projections, with its password mounted from a Secret and a `GraphReady` condition (part of #98) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): SQL storage and named sinks are applied to the kernel from mounted Secrets, and a duplicate, unknown or unconfigured sink blocks the Production with a condition naming it (part of #99) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): An application on a Production reads its named MongoDB sinks: each sink's connection is mounted as a file and `Cratis__MongoDB__Sinks____ServerFile` names it, for the Cratis Arc release with Cratis/Arc#3770; SQL sinks, which Arc cannot read, are named by the warning condition `SinksReadable` (#99) - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): `application.graph` binds the graph of the Production to Cratis.Arc.Neo4j through `Cratis__Neo4j__…`, with the password from a `secretKeyRef`, and a `GraphBound` condition (part of #98) - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): `set once = ` assigns a projection property only while it has no value, for values such as who created an entry and when (#1220) - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): Dictionary entries keyed from the event's content with `.$eventContent.`, and from `$causedBy.subject`, `.name` or `.userName`, alongside the existing `$eventContext` keys - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): `remove .$eventContent.` deletes a dictionary entry - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): `insert first`, `insert last` and `sort by [ascending|descending]` in a `children` block control where new children are placed - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): Diagnostics `PLAY0956` to `PLAY0963` for misplaced or invalid dictionary keys, `remove` lines and children ordering, reported alike by the C# and TypeScript compilers and the editor - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): Semantic model version 43 executes set once and ordered children in specifications - **Arc** ([Release v22.182.0](https://github.com/Cratis/Arc/releases/tag/v22.182.0)): Read read models from Chronicle named MongoDB sinks: configure `Cratis:MongoDB:Sinks:` with `Server` or `ServerFile`, and an injected `IMongoCollection` for a read model marked `[Sink("")]` (or Arc's `[ReadModelSink("")]`) reads from that server, including observable queries (#3770) - **Arc** ([Release v22.182.0](https://github.com/Cratis/Arc/releases/tag/v22.182.0)): Arc follows the Chronicle client's `DefaultSinkName` for the read models it registers. - **Arc** ([Release v22.182.0](https://github.com/Cratis/Arc/releases/tag/v22.182.0)): Misconfigured MongoDB sinks stop startup with a message naming the sink; a read model naming an unconfigured sink fails with `UnknownMongoDBSink`. - **AI** ([Release v7.146.0](https://github.com/Cratis/AI/releases/tag/v7.146.0)): A `cratis-session-handoff` skill for long sessions that near their context limit, finish a milestone or must continue in a fresh session. It keeps a running `.ai-work//STATE.md` note and gives one handoff template with fixed sections: verified facts apart from hypotheses, the user's constraints verbatim, a table of running jobs and watches with what to do when each finishes, the next step and the files to read first. Resuming re-verifies mutable facts before acting on them. (#1081) - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): Forwarded identity v2: ES256-signed envelope carrying the credential id, issuer, subject and verified authentication time, with key lifetime and readiness reporting. Signing refuses when trusted context is missing. - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): Protected browser-session evidence with a stable credential id created at sign-in from verified Cratis Identity realm evidence only. The id and authentication time survive session renewal; legacy or incomplete sessions are refused. - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): Gateway configuration for the backend tenant header, and removal of that header from inbound requests so callers cannot spoof it. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): Model-bound graph projections with `@Graph`, `@Node`, `@Edge`, `@EdgeSource`, `@EdgeTarget`, `@EdgeFrom` and `@EdgeRemovedWith`, reusing `@Key`, `@FromEvent` and the existing property mapping annotations (`@SetFrom`, `@SetFromContext`, `@Increment`, `@Count`, ...). - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): `@RemovedWith(..., detach = true)` to remove a node together with its edges. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): Fluent graph projections through `IGraphProjection` and `IGraphProjectionBuilder`, usable from Kotlin (property references) and Java (property names and lambdas), including identified edges and counters. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): `ChronicleOptions.withDefaultGraphSinkTypeId` (defaults to Neo4j) and `WellKnownSinkTypes.NEO4J` / `IN_MEMORY_GRAPH`. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): Validation errors such as `NodeMustHaveExactlyOneKey`, `EdgeMustHaveOneSourceAndOneTarget` and `EdgeCanHaveOnlyOneIdentifyingKey`. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): Documentation: [Graph projections](https://github.com/Cratis/Chronicle.Kotlin/blob/main/Documentation/guides/graph-projections.md). - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): Model-bound graph projections with `@graph`, `@node`, `@edge`, `@graphKey`, `@edgeSource`, `@edgeTarget`, `@nodeFrom`, `@nodeRemovedWith` (with `detach`), `@edgeFrom` and `@edgeRemovedWith`, reusing the existing property mapping decorators (`@setFrom`, `@setFromContext`, `@increment`, `@count`, ...). - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): Fluent graph projections with `@graphProjection` and `IGraphProjection.define(builder)`, including identified edges, conditional updates and counters. - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): `eventStore.graphs` to discover, register and inspect graph projections; graphs register automatically with the other artifacts. Invalid graphs are reported in `graphs.failures` and are not registered. - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): `ChronicleOptions.defaultGraphSinkTypeId` (defaults to Neo4j) and `WellKnownSinks.InMemoryGraph`. - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): Validation errors such as `NodeMustHaveExactlyOneKey`, `EdgeMustHaveOneSourceAndOneTarget` and `EdgeCanHaveOnlyOneIdentifyingKey`. - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): Documentation: [Graph projections](https://github.com/Cratis/Chronicle.TypeScript/blob/main/Documentation/graph-projections.md). - **Arc** ([Release v22.181.0](https://github.com/Cratis/Arc/releases/tag/v22.181.0)): `StateAwareAuthorizationPolicy` base class: implement `GetKey`, `Read` and `Decide` and register it as a named policy. It fails closed: no key, no recorded state, a failed read and a rejecting decision all deny without throwing, and `OnDenied` reports a `StateDenialReason` so a denial stays distinguishable from an exception. (part of Cratis/StudioIssues#1387) - **Arc** ([Release v22.181.0](https://github.com/Cratis/Arc/releases/tag/v22.181.0)): Documentation of the pattern, including that the read is an admission check that does not enrol in decision reads and does not revoke granted access. - **AI** ([Release v7.145.0](https://github.com/Cratis/AI/releases/tag/v7.145.0)): A universal `code-health.md` rule for source files: touched files end at Code Health 9.5 or higher (new files aim for 10) and never decline. Files that cannot safely reach 9.5 in the change are reported with before and after scores and added to the repository's Code Health uplift issue. Generated code is never refactored, and missing CodeScene tools never block work (#1077) - **AI** ([Release v7.145.0](https://github.com/Cratis/AI/releases/tag/v7.145.0)): "No fix loops" guidance: Code Health is handled once per touched file, a score check never triggers an extra build or test run, and a second Code Health round is itself a finding that names its cause (#1077) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Opt-in fresh authentication for protected paths: AuthProxy can require a recent sign-in, challenges the upstream provider for re-authentication, and forwards the validated authentication time in the signed principal. It refuses requests whose freshness cannot be proven, including non-cookie, on-behalf and method-override requests. - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Cratis Identity provider profile with a documented stable provider key. (#260) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Opt-in verified upstream claims in the signed sign-in notification, sourced from the validated access token. (#286) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Revoked bearer tokens are refused at the edge through issuer introspection, with caches isolated per cache window. (#285) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Per-path opt-in to authorization passthrough on anonymous routes, so the caller's own credentials reach the backend. (#283) - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): `cratis-screenplay-reverse-engineering` skill: reverse engineers a website, its documentation, network captures or a shipped executable into an evidence-backed Screenplay model scoped to the areas you choose, then renders it and walks the running Stage application to check fidelity against the original. (#1056) - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): The reverse-engineering fidelity check keeps a ledger of observed behaviors, closes a row only when every observed case kind passes on the running app, requires a negative control for each check, and never counts an unrun or undecided check as a pass. (#1056) - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): One starting point for understanding an existing system: point the event-modeling skill at any mix of source code, a running system, captures and documentation, and it routes each input to reverse engineering, legacy extraction or Prologue capture and merges the results into one Screenplay model. (#1066) - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): A shared evidence format across reverse engineering, legacy extraction and Prologue, so a rule seen in a capture, stated in documentation and found in code is one row with combined strength. (#1066) - **Arc** ([Release v22.179.0](https://github.com/Cratis/Arc/releases/tag/v22.179.0)): The TypeScript proxy generator now runs for projects targeting .NET 11. (part of #3762) - **Stage** ([Release v5.3.0](https://github.com/Cratis/Stage/releases/tag/v5.3.0)): Set `CRATIS_CHRONICLE_CONNECTION_STRING_FILE` to a mounted file holding a Chronicle connection string and the sandbox entrypoint starts no kernel of its own and does not wait for port 35000. Input validation, `--warm` and the warm handoff restart are unchanged (#1040) - **Stage** ([Release v5.3.0](https://github.com/Cratis/Stage/releases/tag/v5.3.0)): The entrypoint prints the connection with the password masked, and an unreadable or empty file exits with code 78 before anything starts - **Stage** ([Release v5.3.0](https://github.com/Cratis/Stage/releases/tag/v5.3.0)): A "Use an external Chronicle kernel" section in the Stage container documentation - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): ESM v42: `ExecutableScreens.Admit` adds each screen's data, actions, navigation and layout to its slice. Data is keyed to query identities, actions to command identities with every input as a command property identity, and navigation to screen identities. A reference the executable model does not hold refuses admission with a reason that names the screen. See [UI contract](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/ui-contract.md#screens-in-the-executable-model). (#1187) - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): `UiContractBuilder.For(ExecutableSemanticModel)` reads the stack-neutral `screenplay-ui/1` contract from an ESM v42 model alone. Its members match the ones read from the sources. - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): `screenplay export --screens` writes the ESM v42 model with its screens, and MCP `read-workspace` with `view: "executable-model"` and `screens: true` pages it. - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): Published JSON Schema `esm-v42.schema.json`. - **Arc** ([Release v22.178.0](https://github.com/Cratis/Arc/releases/tag/v22.178.0)): `ForwardedIdentityV2Headers` exposes the complete signed forwarded identity v2 header set publicly: the signature header name, the exact covered header names, the covered prefix families and `Includes(name, tenantHeader)`. Applications that accept other credentials on selected endpoints can refuse forwarded identity there without duplicating the names. Arc's own canonicalization and envelope verification use the same definitions, so the set cannot drift (#3759) - **Chronicle** ([Release v19.148.0](https://github.com/Cratis/Chronicle/releases/tag/v19.148.0)): Client option `caCertificatePath` to trust a custom certificate authority when connecting to Chronicle. - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Agents and scripts can wait for the sandbox to become ready with `/stage/status?wait`, and recorded journeys can be replayed against the sandbox with a result per step (#1018) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Rendered applications can opt in to signed forwarded identity verification (part of #981) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): In a sandbox with modeled users, the application's top bar offers a picker for the acting user; it is limited to the local machine unless remote access is enabled, and never appears in rendered or published applications (#1021) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): A warning when a read model property receives a value of a secret concept (#1031) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): An ESM feature matrix documents what the sandbox and the renderer run and refuse - **Chronicle** ([Release v19.147.1](https://github.com/Cratis/Chronicle/releases/tag/v19.147.1)): The kernel logs a warning on every start naming any System databases from before 19.117 that remain after their content was moved, with what to do about them. - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): `Cratis.Arc.Mcp` package: enable with `WithMcp()` and `MapCratisArcMcp()`; commands and queries are served only when marked `[ExposeOverMcp]` or declared through `McpBuilder.Expose()` / `ExposeQuery`; custom tools plug in through `IMcpToolSource` (#3712). - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): Protected resource metadata, `401` challenges, and credential-kind profiles (`PatOnly`, `OAuthOnly`, `Combined`) with scope ceilings, alternative scope sets, and `McpOptions.ReadScope` / `WriteScope` / `WriteScopes` (#3712). - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): `IMcpToolAuthorizer` to narrow access per tool, distinguishing listing from calling; `McpRefusals` so host middleware can write Arc-shaped refusals (#3712). - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): Origin allow-list, public-origin configuration, and fail-closed startup validation (#3712). - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): MCP documentation covering setup, scopes, authorizers, and hosting on a capability port (#3712). - **Ante** ([Release v1.11.0](https://github.com/Cratis/Ante/releases/tag/v1.11.0)): `Ante:HostOutcomes` with `Disabled` (default) and `DurableRequired` modes. In `DurableRequired`, Ante accepts host provisioning outcome events (started, succeeded, failed, requires new invitation) only as short-lived RS256-signed proofs bound to a configured host key, audience, operation and attempt. The first terminal outcome wins. (#194) - **Ante** ([Release v1.11.0](https://github.com/Cratis/Ante/releases/tag/v1.11.0)): Completion screens that show the durable outcome, including a "needs a new invitation" message in English and Norwegian. (#194) - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Atomic key-store fences for MongoDB, SQL, Azure Key Vault and in-memory key stores, with request-scoped erasure confirmation across stores (part of #4979) - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Bounded protected-value release leases that fail closed on timeout or cancellation (part of #4979) - **Screenplay** ([Release v6.7.0](https://github.com/Cratis/Screenplay/releases/tag/v6.7.0)): A `screen` can carry `sketch `, `mockup ` (one line per HTML page) and `image ` lines that name files beside the model, relative to the model root. They are kept in source, printed, carried through the AST and MCP tools, and never change what the screen does. The compiler reports `PLAY0950` for a line without a path and `PLAY0951` for an image that is not PNG, JPG, GIF, SVG or WebP or a mockup that is not an HTML page; opening a model root (CLI, MCP) warns with `PLAY0952` about a file that is missing or outside the root. See [Sketches, mockups and images](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/screens.md#sketches-mockups-and-images). (#1191) - **Screenplay** ([Release v6.7.0](https://github.com/Cratis/Screenplay/releases/tag/v6.7.0)): `shows event ` and `shows readmodel ` in a slice place a linked copy of an element declared in another slice. The event model board draws a placed event again with `sourceEventId` pointing at its declaration and lists placed read models on the slice; renaming the declaration renames every placement. `PLAY0953` refuses a malformed line, `PLAY0954` warns about an unknown element and `PLAY0955` about an element the slice already declares or shows twice. See [Show an element in more than one slice](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/slices.md#show-an-element-in-more-than-one-slice). (#1193) - **Screenplay** ([Release v6.7.0](https://github.com/Cratis/Screenplay/releases/tag/v6.7.0)): Model notes have a new `issue` kind that links the anchored element to issues in an external tracker. Each reference names its `tracker` (`github`, `jira`, `linear` or `other`), the issue key as `id` and an optional `url`; `list-model-notes` filters by `kind: "issue"` and by issue key. See [Link elements to issues](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/model-notes.md#link-elements-to-issues). (#1192) - **Screenplay** ([Release v6.7.0](https://github.com/Cratis/Screenplay/releases/tag/v6.7.0)): Monaco and the VS Code extension complete, explain and highlight `sketch`, `mockup`, `image` and `shows`. - **Ante** ([Release v1.10.0](https://github.com/Cratis/Ante/releases/tag/v1.10.0)): The optional per-client rate limit now also covers the invitation exchange and status endpoints (#197) - **Ante** ([Release v1.10.0](https://github.com/Cratis/Ante/releases/tag/v1.10.0)): Host backchannel calls from Ante can carry credentials, so a host can require authenticated calls (#221) - **Screenplay** ([Release v6.6.0](https://github.com/Cratis/Screenplay/releases/tag/v6.6.0)): `storyline [""]` names an ordered path through a model, such as a user journey. Each step names a module, feature, slice, command, event, read model, query, screen or reaction, with an optional note. Renaming or moving an element rewrites the steps that name it, a step that names nothing warns with `PLAY0942`, and storylines never change the executable model. See [Storylines](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/storylines.md). (#1189) - **Screenplay** ([Release v6.6.0](https://github.com/Cratis/Screenplay/releases/tag/v6.6.0)): The MCP tool `list-storylines` lists every storyline with its steps resolved to the elements they name; storylines are edited with `propose-ast` and `propose-source`. - **Screenplay** ([Release v6.6.0](https://github.com/Cratis/Screenplay/releases/tag/v6.6.0)): `trace-lineage` starts from a command, event or read-model property or a screen field, and traces `upstream`, `downstream` or `both`. Downstream follows the value through productions, projections and reaction invocations to the queries and screens that show it. (#1190) - **Screenplay** ([Release v6.6.0](https://github.com/Cratis/Screenplay/releases/tag/v6.6.0)): `screenplay lineage <address> [<folder>]` prints the same trace as text or JSON, with `--direction`, and exits 1 when the trace has breaks. See [Trace a value's lineage](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/tool.md#trace-a-values-lineage). - **Screenplay** ([Release v6.5.0](https://github.com/Cratis/Screenplay/releases/tag/v6.5.0)): `screenplay export --format openapi` writes an OpenAPI 3.1 description of every command and query: route, method, request and response shapes, authorization (the policy expression and each policy's condition) and observable queries. The routes are the ones an application rendered by the Cratis renderer serves. From .NET, use `ApiDescription.For(model)` and `OpenApiDocument.Write` in `Cratis.Screenplay.Api`. See [HTTP API description](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/api-description.md). (#1186) - **Screenplay** ([Release v6.5.0](https://github.com/Cratis/Screenplay/releases/tag/v6.5.0)): `screenplay export --format ui` writes the stack-neutral `screenplay-ui/1` contract of every screen: the data it shows, the commands it issues with their inputs, where it leads and how it is laid out, with Scene templates, components, toolbars and outlets as an optional `scene` layer. Screens carry their semantic identities and HTTP routes when the model has an executable model. From .NET, use `UiContractBuilder` and `UiContractJson` in `Cratis.Screenplay.Ui`. See [UI contract](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/ui-contract.md). (part of #1187) - **Screenplay** ([Release v6.5.0](https://github.com/Cratis/Screenplay/releases/tag/v6.5.0)): The MCP `read-workspace` tool pages the same documents as the `api-description` and `ui-contract` views. (part of #1186) - **AI** ([Release v7.142.0](https://github.com/Cratis/AI/releases/tag/v7.142.0)): Each release attaches a versioned Screenplay session bundle, `screenplay-session.zip` with its `.sha256` checksum, to the GitHub release. It contains stack-neutral guidance for reading a Screenplay model and building a slice from a build order, as a Claude Code plugin with a system-prompt addition, an `AGENTS.md` form for agents over the Agent Client Protocol, and a single self-contained context document. A `bundle.json` manifest describes the bundle's schema version, version, source commit, forms, skills and file checksums. See `Documentation/screenplay-session-bundle.md` for how to fetch, verify and inject it. (#1048) - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): Graphs that name a sink are registered with the kernel under that sink name when Stage runs a model; `Stage__Graph__SinkType` still chooses the sink type (#1014) - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): Rendered read models and graph records that name a sink carry `[Sink("<Name>")]`, and the rendered `docker-compose.yml` configures the development kernel with one configuration per declared sink, on its MongoDB for read models and on Neo4j for graphs - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): The published package `manifest.json` lists the declared sinks with their kinds (`readmodels` or `graphs`), and an empty list when there are none - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): Rendering refuses a query over a read model stored in a named sink with `STAGE-ESM-069`, because the pinned Arc reads rendered queries from the application's own database - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): A reference page on how named sinks are carried when running and rendering - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): Consumer bindings and producer grants, managed at runtime through generated commands and queries, bootstrapped from configuration with runtime state taking precedence, and audited as events in the system event log (#5734) - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): A federation pull service on the dedicated federation listener. It authenticates a peer by its pinned client certificate, serves only public event types that the grant and the consumer's subscriptions cover, rate limits each link, and never forwards event types carrying protected personal data - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): A consumer that pulls from the producer's outbox into the named inbox, resumes after a restart or reconnect without duplicating events, rejects events that originated in the receiving store, and backs off per link so a slow or denied link never stalls another - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): A Federation page in the Workbench showing bindings, grants, link state, lag, delivery counts and where each value came from, with dialogs to add, change, revoke and remove - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): Federation metrics and documentation of the security model, producer grant and consumer binding setup - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The Screenplay read surface skill teaches where a read model is stored: `sink <Name> for readmodels|graphs` at the application root, a bare `sink <Name>` line in the read model, the rule that the line is a property unless the name is a declared sink, `@sink <Type>` for the property, and no sink on a `passive` read model. (#1049) - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The Screenplay projections skill shows a graph in a named sink (`sink People for graphs`) and says that a projection, reducer or graph projection writes to its target's sink and never names one. - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The Screenplay model authoring and toolchain skills list `sink` among the application-root declarations, the `PLAY0931`–`PLAY0939` diagnostics with their severities, and the syntax-schema members `ApplicationSyntax.sinks`, `SinkSyntax`, `ReadModelSyntax.sink` and `GraphSyntax.sink`. - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The Chronicle read model and projection skills teach `[Sink("name")]` on read model and graph types, the client defaults `DefaultSinkName` and `DefaultGraphSinkName`, analyzer `CHR0069` and the replay a sink change causes. - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The Chronicle hosting skill shows the Kernel `sinks` configuration with a MongoDB and a SQL sink, Neo4j graph sinks, the environment-variable form, and keeping read models in a different engine than the events. - **AuthProxy** ([Release v2.53.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.53.0)): Traces for sign-in notification, identity resolution, tenant resolution, invite exchange and bearer token validation, plus metrics for sign-ins, identity denials, identity cache requests, bearer validations, invite exchanges and upstream errors. Spans and metrics carry only low-cardinality outcome values, never tokens, claim values, subjects or tenant ids. W3C trace context is forwarded to backends. (#152) - **AuthProxy** ([Release v2.53.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.53.0)): A telemetry page in the configuration documentation, including the exported names and how to send telemetry to Azure Monitor or Application Insights. (#152) - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): A design system and themes reference for `cratis-screenplay-ui-composition`, with a complete example (modes, tokens, a component with variants and states, words, rules, palette, values and per-mode values), a profile that selects a second theme, and the new diagnostics `PLAY0916` to `PLAY0930`. (#1053) - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): A review check in `cratis-screenplay-model-review` for one design system per application, themes that implement it and no raw colors in profiles. - **Chronicle** ([Release v19.145.0](https://github.com/Cratis/Chronicle/releases/tag/v19.145.0)): Read connection settings from mounted files with `storage.connectionDetailsFile`, `sinks.configurations.<name>.connectionDetailsFile` and, for a Neo4j sink, `sinks.configurations.<name>.passwordFile`. Each file is read once at startup and trimmed of a trailing newline; setting a value together with its file, or naming a missing, unreadable or empty file, stops startup with a message naming the settings and the path, never the contents (#5740) - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): Named sinks in the Kernel: an optional `sinks` section names sink configurations of type `MongoDB`, `SQL` or `Neo4j`, each with its own connection, and `sinks.readModels` and `sinks.graphs` choose the defaults. Read models can now live in a different server or engine than the events, and one Kernel can serve several Neo4j servers. Invalid configuration stops the Kernel at startup with a message naming the configuration (#5735) - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): `[Sink("name")]` for read model types (model-bound, projection and reducer) and graph types, and `ChronicleOptions.DefaultSinkName` and `DefaultGraphSinkName` in the .NET client - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): A `Name` field on the `SinkDefinition` contract; empty means the default sink, so existing clients keep working - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): Analyzer CHR0069 reports `[Sink]` combined with `[Passive]` - **Screenplay** ([Release v6.4.0](https://github.com/Cratis/Screenplay/releases/tag/v6.4.0)): Named sinks: declare `sink <Name> for readmodels` or `sink <Name> for graphs` at the application root, and store a read model or graph there with a bare `sink <Name>` line. Everything else keeps using its kind's default sink. (#1182) - **Screenplay** ([Release v6.4.0](https://github.com/Cratis/Screenplay/releases/tag/v6.4.0)): `SemanticCompilation.Sinks`, `ReadModelSinks` and `GraphSinks` expose the declared sinks and each read model's and graph's choice. They sit outside the executable model, so adding or changing a sink leaves the ESM bytes and revision unchanged; renderers must include them in hashed render input. - **Screenplay** ([Release v6.4.0](https://github.com/Cratis/Screenplay/releases/tag/v6.4.0)): Diagnostics `PLAY0931` to `PLAY0939` for malformed, duplicate, unknown, mismatched, repeated and unused sinks, a sink on a passive read model, and a property named `sink` whose type differs only in case from a sink, reported by both the C# and TypeScript compilers. - **Screenplay** ([Release v6.4.0](https://github.com/Cratis/Screenplay/releases/tag/v6.4.0)): Renaming a sink renames every `sink` line that names it, including read models in other files, and `find-references` finds them; a property named `sink` is left alone. - **Screenplay** ([Release v6.4.0](https://github.com/Cratis/Screenplay/releases/tag/v6.4.0)): Sink highlighting, hover and completion in the Monaco editor and the VS Code extension, a Sinks documentation page, and named sinks in the Invoicing and Organization samples. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): The `design system <Name>` construct, one per application: `modes`, `default theme`, `tokens` by category (color, space, size, radius, border, shadow, font, type, motion, opacity, z), `components` with parts, variants and states, `words` (voice and naming) and `rules` such as `contrast text on background at least 4.5`. See [Design system](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/design-system.md). (#1194) - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): A `theme` can `implement` the design system with a `palette`, mode-independent `values` and a block per mode. Every color token needs a value in every mode, and a theme that only lists `compatible with` packages keeps working. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): Compiler diagnostics `PLAY0916` to `PLAY0930` for malformed blocks, a second design system, unknown modes, duplicate or undeclared tokens, missing mode values, unresolved or cyclic references, parts that take the wrong token category, an invalid default theme, a profile selecting a theme that does not implement the design system, and contrast below a rule. See the [diagnostics catalogue](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/diagnostics.md). - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): `DesignSystemResolver` in `Cratis.Screenplay.Design` resolves the theme and mode a `ui profile` selects into a flat token map and resolved component parts, so Stage, Scene and Direct do not reimplement reference resolution. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): The MCP `ui-profiles` tool now also returns the design system, every theme and each theme's resolved values per mode, and the profile's selected theme and mode. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): The TypeScript compiler, Monaco editor and VS Code extension understand the design system: parsing, validation, highlighting, hover, completion and conformance vectors held to the C# compiler. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): A quick fix, in C# workspaces and in the editors, moves a profile's deprecated `accent`, `corners` and `font` into the theme the profile uses. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): `Samples/Invoicing` and `Samples/AcmeCommerce` (one shared design system, one theme per domain) show the construct. - **Screenplay** ([Release v6.2.0](https://github.com/Cratis/Screenplay/releases/tag/v6.2.0)): A JSON Schema (draft 2020-12) for every released ESM version, downloadable at `https://raw.githubusercontent.com/Cratis/Screenplay/main/Documentation/screenplay/esm/esm-v<major>.schema.json` (and `esm-v<major>.<minor>.schema.json` for a released minor). Each schema names every member its version writes, how objects nest and the JSON type of every value, and refuses members the version does not write. `EsmJsonSchema` in `Cratis.Screenplay.Semantics.Serialization` lists the versions and generates the same text. See [Executable model JSON Schema](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/executable-model-schema.md). (#1183) - **Screenplay** ([Release v6.2.0](https://github.com/Cratis/Screenplay/releases/tag/v6.2.0)): `ModelDifference.Slices` groups a model comparison by slice: each added, removed, renamed, moved or changed slice with its changed declarations and the slices that depend on it, the changed declarations no slice owns, and the unchanged slices affected through dependencies. Renames and moves are reported as such when both models carry persisted identities. See [Group changes by slice](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/model-comparison.md#group-changes-by-slice). (#1185) - **Screenplay** ([Release v6.2.0](https://github.com/Cratis/Screenplay/releases/tag/v6.2.0)): The MCP `semantic-diff` tool and `read-proposal` with `view: "semantic-diff"` return the same per-slice summary as an unpaged `slices` object. (part of #1185) - **Screenplay** ([Release v6.2.0](https://github.com/Cratis/Screenplay/releases/tag/v6.2.0)): `screenplay diff` ends its text report with the slice summary, and its `--format json` report carries it as `difference.slices`. (part of #1185) - **Chronicle** ([Release v19.143.0](https://github.com/Cratis/Chronicle/releases/tag/v19.143.0)): A dedicated federation listener, opt-in through the `Federation` configuration section, on its own port and certificate. It is HTTP/2 only, TLS 1.3 only, requires a client certificate and answers 404 for everything outside the federation service (part of #5734) - **Chronicle** ([Release v19.143.0](https://github.com/Cratis/Chronicle/releases/tag/v19.143.0)): Certificate pinning by SHA-256 of the public key, grants bounded to public event types, and a guard that rejects events originating in the receiving store and drops redelivered events (part of #5734) - **Chronicle** ([Release v19.143.0](https://github.com/Cratis/Chronicle/releases/tag/v19.143.0)): Decision record 0027 and a Federation configuration page describing the security model (part of #5734) - **Screenplay** ([Release v6.1.0](https://github.com/Cratis/Screenplay/releases/tag/v6.1.0)): `screenplay export [<file.play|folder>] [--format esm] [--scope <Module>[.<Feature>...][.<Slice>]] [--output <path>]` writes the canonical executable model bytes, identical to `SemanticModelSerializer.Serialize`, with `schemaVersion` and `revision`. `--scope` keeps one module, feature or slice together with the application-wide declarations its references need. (#1184) - **Screenplay** ([Release v6.1.0](https://github.com/Cratis/Screenplay/releases/tag/v6.1.0)): `screenplay diff <before> <after> [--format text|json]` compares two model versions with the library model comparison and prints added, removed, renamed and moved declarations, member changes, contract-breaking event changes, specification outcome changes and direct dependants. The JSON form carries the full `ModelDifference`. - **Screenplay** ([Release v6.1.0](https://github.com/Cratis/Screenplay/releases/tag/v6.1.0)): `screenplay rename <address> <new-name> [<folder>] [--kind <kind>]` renames a declaration through the same proposal and apply as MCP, keeping its semantic identity and writing `.screenplay/identities.json`. (#1188) - **Screenplay** ([Release v6.1.0](https://github.com/Cratis/Screenplay/releases/tag/v6.1.0)): `ExecutableSemanticModelScope.Select(model, scope)` narrows an executable model to one module, feature or slice from .NET. - **Showrunner** ([Release v1.18.0](https://github.com/Cratis/Showrunner/releases/tag/v1.18.0)): `Production` takes `database.kind`: `MongoDB` (the default), `PostgreSql` or `SqlServer`, the SQL engines for an `External` database only (part of #99) - **Showrunner** ([Release v1.18.0](https://github.com/Cratis/Showrunner/releases/tag/v1.18.0)): `Production` takes `sinks`: default `readModels` and `graphs` names, and named `configurations` of kind `MongoDB`, `PostgreSql`, `SqlServer` or `Neo4j`, each with a connection Secret or, for Neo4j, the Production's graph (part of #99) - **Showrunner** ([Release v1.18.0](https://github.com/Cratis/Showrunner/releases/tag/v1.18.0)): Production sinks are validated with problems that name the sink: duplicate names, unknown kinds, a default naming a missing sink, Neo4j for read models and SQL or MongoDB for graphs (part of #99) - **Showrunner** ([Release v1.18.0](https://github.com/Cratis/Showrunner/releases/tag/v1.18.0)): `Performance` takes `application.sinks`, the named sinks a traditional application uses; with `productionRef` the `SinksMapped` condition reports whether the Production configures each one, and a missing sink blocks the Performance before anything is applied (part of #99) - **Showrunner** ([Release v1.18.0](https://github.com/Cratis/Showrunner/releases/tag/v1.18.0)): Stage Manager documentation describes Production storage kinds, named sinks and the Chronicle kernel configuration they map to (part of #99) - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): Slots carry their role and whether they are routed, and outlets of actions, filters, tabs, stats and navigation reach Scene with their defaults, refinements and contributions. (#1007) - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): `fits`, `opens dialog|drawer|in slot`, `for item|for screen`, `enabled when`, `confirm`, `choose from query … show …` pickers and `show <Screen> by <param> from <element>.selection` are translated into Scene. - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): A routed slot is part of the address: opening a screen in it, the chosen tab of the slot that owns the tabs, and a routed page's filter values survive a reload or a shared link. Back and forward move through routed slot changes and tabs; dialogs, drawers and panels never change the address. - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): A `runs` hook issues its command directly with the resolved inputs, asks its `confirm` first, and refreshes the page's queries. - **Stage** ([Release v4.228.0](https://github.com/Cratis/Stage/releases/tag/v4.228.0)): `Stage:Published:Storage:Type` selects the database the bundled Chronicle kernel stores in: `MongoDB` (the default), `PostgreSql` or `MsSql`. On the SQL engines the Notes read models are stored in the same database. An unknown type refuses to start with code 78, naming the accepted types. (#1013) - **Stage** ([Release v4.228.0](https://github.com/Cratis/Stage/releases/tag/v4.228.0)): When `CRATIS_CHRONICLE_CONNECTION_STRING_FILE` names a readable, non-empty file, a published application uses that external Chronicle kernel: no kernel is started in the container and `Stage:Published:Storage:*` is not required. A connection with `auth=none` is still refused with code 78. - **Scene** ([Release v5.1.0](https://github.com/Cratis/Scene/releases/tag/v5.1.0)): `OutletButton.display` (C# `OutletButton.Display`) says what a button of an outlet of actions shows: `iconAndTitle` (the default), `icon` or `title`. An icon-only button keeps its title as its accessible name. An unknown value is reported as `unknownButtonDisplay`. - **AuthProxy** ([Release v2.52.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.52.0)): An opt-in `OnBehalf` setting, off by default, that leaves out the `x-cratis-on-behalf-actor` header on on-behalf grant checks and session started/ended notifications. The attestation is unchanged, and the default behavior is unchanged. The on-behalf sessions documentation describes the receiver contract: verify the attestation fully and read the actor from it. (#266) - **Showrunner** ([Release v1.17.0](https://github.com/Cratis/Showrunner/releases/tag/v1.17.0)): The Stage Manager chart has a `managedNamespaces` value: the namespaces the operator manages Performances in. It defaults to the release namespace. (#94) - **AuthProxy** ([Release v2.50.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.50.0)): `Authentication:ExternalTokenTenantBinding` setting. When enabled, a token from an external issuer is accepted only if it carries exactly one configured tenant claim (optionally mapped to a tenant through issuer-scoped mappings). A token whose tenant differs from the addressed tenant is refused with 403. Headers, routes and tool arguments only select a target and never constrain the credential. Startup validation rejects incomplete settings, and a startup warning appears when external bearer tokens are configured without it. (part of #270) - **AuthProxy** ([Release v2.49.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.49.0)): `BackendTls:RequireTlsOnIdentityHops` setting that makes startup validation refuse any identity-bearing backend, callback, notifier or verifier target that is not HTTPS, with the backend TLS policy applied to it, outside local development. Loopback in local development stays allowed. (part of #265) - **AuthProxy** ([Release v2.49.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.49.0)): The backend TLS policy now also applies to capability verification when the setting is on. (part of #265) - **Arc** ([Release v22.175.0](https://github.com/Cratis/Arc/releases/tag/v22.175.0)): A public opt-in on the verified-caller builder, reached through the personal access token installation, that installs browser signed-forwarding verification together with personal access token verification under the single installation marker. Capability-gated endpoints stay token-only. (#3747) - **Chronicle** ([Release v19.140.0](https://github.com/Cratis/Chronicle/releases/tag/v19.140.0)): `Jobs:MaxActiveStepsPerJob` limits how many steps a single job keeps active at once. It defaults to four times the effective maximum parallel steps, and never less than 32. A job with thousands of steps, such as the catch-up of an observer with thousands of partitions, used to activate a grain for every step at once, holding memory for all of them although only `Jobs:MaxParallelSteps` can run. It now starts that many steps and starts the next one each time a step reaches an outcome. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Slots with a role (`page`, `pane` or `panel`) and `routed [by <param>]`, `primary` and `optional`. (part of Cratis/StudioIssues#1327) - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Outlets: `outlet <name> of actions|filters|tabs|stats|navigation [for item|for screen] [in <slot>]` with `default` items. Lower levels write `inherits`, `extends` or `overrides`, `hide <id>` and `before|after <id>`, and any module or feature can `contribute to <outlet>`. (#1178) - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Outlet items: `button` and `group`, `filter <id> title "…" sets <Query>.<param>`, `tab <id> title "…" shows <Screen>`, `stat <id> title "…" value from <Query>.<field>`, and navigation `item … target …`. Dialog and drawer templates declare their buttons as `outlet actions of actions` with the built-ins `runs close` and `runs submit`. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Placement and hooks: `fits <role>, …` on a slice's screen, and `opens dialog|drawer|in slot <name>`, `runs`, `for item|for screen` and `enabled when <condition>` on a button or item. A State Change slice may have no screen when a `runs` hook issues it. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Form pickers with `field <property> choose from query <Query> show <field>`, inferred when the property's concept is the key of a read model a list query returns. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): `show <Screen> by <param> from <element>.selection` in a slot. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): New checks: `runs` on a slice whose inputs need a form, `opens in slot` naming a missing, filled or unfitting slot, `hide`/`before`/`after` naming an item the inherited outlet does not have, items of the wrong kind, filters and stats bound to the wrong query, and screens that show data bound to nothing. The codes are listed on the diagnostics page. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): `screenplay migrate <path> --from <version> [--to <version>] [--dry-run] [--report <file>]` rewrites a model from one version to the next, one step at a time. It keeps comments, layout and file encoding, reports anything it cannot decide as needing review with the file and line, and exits 0 when everything migrated, 2 when a file needs review and 1 on failure. It is also available as the MCP `migrate` tool and the VS Code command *Screenplay: Migrate document*. (#1179) - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): The MCP server, CLI, Monaco language service (including rename and find references) and the VS Code grammar understand every new form. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Slots carry a role (`page`, `pane` or `panel`), `routed` with route parameters, `primary` and `optional`. `resolveSlotRole` (C# `SlotRoles.Resolve`) gives the role of a slot that declares none. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Outlets as item lists of kind actions, filters, tabs, stats or navigation, each with a typed item schema and defaults on the layout or template. Each level resolves `inherits`, `extends` or `overrides` with `hide` and `before`/`after`, own items never move above inherited ones, and any module or feature can contribute. `effectiveOutlet` returns the resolved items with their provenance ("Catalog + Products"), and the engine builds a screen's outlet chain from the document. (#289) - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Placement: a screen lists what it `fits`, and `resolvePlacement` (C# `PlacementResolver.Resolve`) picks the first fit the page has free for an automatic action, checks an explicit slot, and explains its choice. Run directly is offered only when every command input has a source. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Enablement derived from the subject (`for item`), authorization and `enabled when`, reported with the reason. Inspection reports outlet provenance, placement decisions and enablement reasons. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): `scene.react` renders outlets of every kind, routed slots and the `panel` role. Hosts plug in their router through `SceneRouterProvider` or the `router` prop of `SceneNavigationHost`; without one, route state is kept in memory. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Foundation layouts and templates declare slot roles and outlets, and every blueprint inherits them. Dialog and drawer templates offer an actions outlet with Cancel and Submit. - **Arc** ([Release v22.174.0](https://github.com/Cratis/Arc/releases/tag/v22.174.0)): An endpoint selector on the capability options that names the endpoints the gate protects, by route pattern or endpoint metadata type. With no selector the gate behaves as before. (part of #3739) (#3745) - **Chronicle** ([Release v19.139.0](https://github.com/Cratis/Chronicle/releases/tag/v19.139.0)): Fencing and recovery for event-sequence content mutations, with per-event-store receipt digest keys and internal secret storage on Azure Key Vault, SQL and MongoDB (#3920) - **Chronicle** ([Release v19.139.0](https://github.com/Cratis/Chronicle/releases/tag/v19.139.0)): SQL event storage records the original content and revision history of a revised event in place, keeps legacy content current for mixed-version readers during a rolling upgrade, and exposes history through the event query and appended-events reads (#5400) (#5462) - **Arc** ([Release v22.173.0](https://github.com/Cratis/Arc/releases/tag/v22.173.0)): Public personal access token persistence, recovery, and policy ports let hosts supply their own adapters. These are a trusted-host security contract, not a sandbox; checked issuance and owner bindings remain framework-owned. The framework-independent refusal suite ships in the PAT assembly. (part of #3739) - **Arc** ([Release v22.173.0](https://github.com/Cratis/Arc/releases/tag/v22.173.0)): Ambiguous or keyed PAT adapter registrations now refuse host startup. Hosts without adapters still fail closed, and credential record text omits verifiers. - **Chronicle** ([Release v19.138.0](https://github.com/Cratis/Chronicle/releases/tag/v19.138.0)): Per-store storage for the unique constraint encoding key in SQL, not yet used by constraint evaluation (#4384) - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Explicit event store access grants (`EventStoreAccessGranted`, `EventStoreAccessRevoked`) that cover one event store, one namespace, or all of them, with administration commands, configured grants for bootstrap clients and a preflight check. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Opt-in enforcement of event store access (`EnforceStoreEntitlements`), applied to gRPC services, command and query paths and long-running event streams (reactors and reducers need Read and Manage). Streams end when the grant is withdrawn. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Opt-in `EnforceAdministratorPolicyForOperations` and `EnforceDestructiveOperations` settings that restrict System store, kernel-scope and destructive operations to administrators. A startup warning is logged while they are unset, because they will default to on in the next major release. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Store-scoped compliance capabilities: releasing data and managing encryption keys are authorized per event store. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Connection identifiers are reserved across the cluster through expiring, renewable leases, so a connection id can only be reused by the caller that owns it. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Documentation for the access and connection behavior options and upgrade notes. - **Arc** ([Release v22.172.0](https://github.com/Cratis/Arc/releases/tag/v22.172.0)): Personal access token format, verifier and issuance with scope, lifetime and resource-key limits; secrets are stored only as domain-separated hashes. (part of #3713) - **Arc** ([Release v22.172.0](https://github.com/Cratis/Arc/releases/tag/v22.172.0)): Configurable refusal of retired credential namespaces under every authorization scheme, with no fallback to other credential sources. (part of #3713) - **Arc** ([Release v22.172.0](https://github.com/Cratis/Arc/releases/tag/v22.172.0)): `Cratis.Arc.PersonalAccessTokens.Chronicle` audit events, projection and idempotent outbox delivery; Chronicle is audit-only and never the revocation authority. (part of #3713) - **Arc** ([Release v22.172.0](https://github.com/Cratis/Arc/releases/tag/v22.172.0)): Documentation for personal access tokens in the identity section. - **Stage** ([Release v4.227.0](https://github.com/Cratis/Stage/releases/tag/v4.227.0)): Published hosting mode, selected with `Stage:Mode=Published` or `--published`. The host leaves Scalar and OpenAPI, the Workbench proxy, the read-model browser, `/stage/load`, admission, spec runs and lifecycle routes unmapped, refuses warm mode and the EventModel engine, and ignores sandbox persona headers. Unknown or contradictory mode settings stop the host at startup (part of #917) - **Stage** ([Release v4.227.0](https://github.com/Cratis/Stage/releases/tag/v4.227.0)): In-process OIDC sign-in for published hosts as a second option beside AuthProxy, reusing the `Cratis:Authentication:*` settings. The host refuses to start without valid authentication configuration, and policies are enforced against the real principal (part of #917) - **Stage** ([Release v4.227.0](https://github.com/Cratis/Stage/releases/tag/v4.227.0)): Startup checks for published hosts that refuse an unauthenticated or non-loopback kernel connection and missing persistent storage (part of #917) - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): `ObserverDeliveryContext` (with `ObserverDeliveryContext.Current`), `ObserverDeliveryKind` and `IObserverDeliveryScope` let applications see which event store, namespace and observer a reactor, reducer, projection or occurrence delivery belongs to, and run code around each delivery. - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): Running the server with `--verify-encryption-keys` counts the encryption keys that Vault or Azure Key Vault holds under earlier names, and exits, so the key layout can be checked before an upgrade. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): `user` declarations in a model (Screenplay 5.11) become the sandbox's users. Set `Stage:Sandbox:Users` (`Stage__Sandbox__Users=true`) and Stage lists them at `/.cratis/users`, each with the roles and claims of the personas it plays. The user Lens selects is the caller for every request; a user that plays no persona is signed in with no roles. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): `Stage:Development`: Stage now decides for itself whether it is in development and tells ASP.NET Core and Arc, instead of inheriting it from `ASPNETCORE_ENVIRONMENT`. The sandbox is development unless this is `false`; a published application never is. The configuration files the process started with still load as before. - **Arc** ([Release v22.171.0](https://github.com/Cratis/Arc/releases/tag/v22.171.0)): `useQuery` and `useQueryWithPaging` accept an opt-in `timeoutMs` read deadline so a query that never returns can be surfaced as an error (#3691) - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): `cratis-arc-neo4j` skill for reading a Neo4j graph from Arc: setup, the tenant-aware `IGraphSession`, the per-namespace database naming and single-database mode, in the `cratis/arc/core` profile. (#1032) - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): Graph projections in `cratis-screenplay-projections` (`graph`, `node`, `edge`, `projection ... => graph`) and `given graph` / `then graph` steps in `cratis-screenplay-specifications`. - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): Graph projections in `cratis-chronicle-projection` (attributes, the fluent `IGraphProjection`, graph sinks, `GraphScenario`) and the `node`/`edge` DSL in `cratis-chronicle-client-elixir`. - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): Graph rendering in `cratis-stage-rendering-and-sandbox`: what Stage renders, the Neo4j wiring and the graph refusals. - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): Graph, node, edge and graph sink in the glossary. - **Screenplay** ([Release v5.11.0](https://github.com/Cratis/Screenplay/releases/tag/v5.11.0)): `user` declarations at the top level, one line each. A user holds the roles of the personas it plays, may play several, and with no persona is authenticated with no roles. Like a persona, a user is authoring metadata and never part of the executable model, so there is no new ESM version and a model without users compiles exactly as before. See decision 0141. - **Screenplay** ([Release v5.11.0](https://github.com/Cratis/Screenplay/releases/tag/v5.11.0)): `PLAY0887` for a malformed `user` line or a line nested under it (reported by both compilers), `PLAY0888` for a user that plays an unknown persona, and `PLAY0889` for a repeated user name. - **Screenplay** ([Release v5.11.0](https://github.com/Cratis/Screenplay/releases/tag/v5.11.0)): `users` in the syntax JSON of an application, written only when present, and a `users` conformance document held by both compilers. - **Screenplay** ([Release v5.11.0](https://github.com/Cratis/Screenplay/releases/tag/v5.11.0)): Highlighting, hover, completion and the grammar for `user` in the Monaco language service and the VS Code extension. - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): `Cratis:AuthProxy:CredentialBinding` `Resource` and `Environment` settings bind sessions, selection cookies and AuthProxy-issued tokens to the deployment; ones issued for another resource or environment no longer work. Enabling or changing these settings signs everyone out once, so restart all replicas together with identical values (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): `EnvironmentClaimType` on bearer routes requires exactly one token environment claim matching `CredentialBinding:Environment` (#253) - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): A reusable memory budget (`IMemoryBudget`) that work with a large footprint reserves memory from before it runs. Requests are served in order, a request larger than the whole budget runs alone, a wait that exceeds a maximum is let through, and the capacity follows the memory pressure of the process. It is configured under `Cratis:Chronicle:Memory` (`Enabled`, `BudgetPercentOfAvailableMemory`, `BudgetPercentUnderPressure`, `MaximumWaitSeconds`, `MinimumReservationBytes`, `ReducerCostMultiplier`). - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): Reduces of large states wait for room in the memory budget, so many large partitions no longer reduce at the same time and exhaust the heap. A reduce reserves for the size its partition's state had last time, and accounts for its state once read when it had no size to go by. - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): Metrics for how the process uses memory (`cratis.chronicle.memory.*`: heap size, committed, available, load, fragmentation, pause time ratio, working set, allocated bytes, full collections), for the budget (capacity, reserved, waiting, wait time, queued, overcommitted), and for the estimated size of reducer states (`cratis.chronicle.reducer.state_size`). - **Stage** ([Release v4.225.0](https://github.com/Cratis/Stage/releases/tag/v4.225.0)): Lowering of a graph handler's `foreach` to the kernel's `ForEach`, with the item addressed as `collection.property` in keys, sources, targets, identities and property mappings. - **Stage** ([Release v4.225.0](https://github.com/Cratis/Stage/releases/tag/v4.225.0)): Audit of ESM v41 for the sandbox. - **Chronicle** ([Release v19.134.0](https://github.com/Cratis/Chronicle/releases/tag/v19.134.0)): `ForEach` on the node and edge `From` and `RemovedWith` graph definitions, in the kernel concepts, the gRPC contracts and their converters. The items' properties are addressed as `collection.property`; an absent or empty collection yields nothing; stored definitions without it behave as before. - **Chronicle** ([Release v19.134.0](https://github.com/Cratis/Chronicle/releases/tag/v19.134.0)): Documentation of the collection form in the graph projection guide. - **Screenplay** ([Release v5.10.0](https://github.com/Cratis/Screenplay/releases/tag/v5.10.0)): `foreach <collection>` after the event name in a graph `from` and `remove with`, in both compilers, the printer and the syntax JSON. Inside the handler the item's properties are written `<collection>.<property>`. - **Screenplay** ([Release v5.10.0](https://github.com/Cratis/Screenplay/releases/tag/v5.10.0)): ESM v41: a graph handler carries `forEach`, and a model that uses it selects 41.0. Models that do not keep their version and bytes. `EsmSchemaV41Support`, the golden `full-esm-v41.json` (the v40 golden is now frozen), the corpus vector and the interoperability table. - **Screenplay** ([Release v5.10.0](https://github.com/Cratis/Screenplay/releases/tag/v5.10.0)): `PLAY0886` for a dotted collection or a collection that is not a list of a composite type. - **Screenplay** ([Release v5.10.0](https://github.com/Cratis/Screenplay/releases/tag/v5.10.0)): The reference graph runner runs each item as the event with the collection replaced by that item, as Chronicle's graph changeset builder does. - **Screenplay** ([Release v5.10.0](https://github.com/Cratis/Screenplay/releases/tag/v5.10.0)): The `graph-foreach` conformance document and documentation. - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): Execution of queries that end in `graph <Graph>` (ESM v40), served as ordinary endpoints with the model's own `authorize` check, paging-free list results and live delivery when the query is `observable` (#1000). - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): `SemanticGraphCypher`, a pure lowering from the declared pattern to Cypher; node labels, edge types and property names come only from the declared graph and every value is a parameter. - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): The host registers Arc's Neo4j connection only when `Cratis:Neo4j:Server` is configured (`Cratis__Neo4j__Server`, `UserName`, `PasswordSecret`, `DatabaseMode`), so a sandbox without Neo4j starts as before. - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): ESM v40 is audited for the sandbox. - **Chronicle** ([Release v19.133.0](https://github.com/Cratis/Chronicle/releases/tag/v19.133.0)): `IChronicleSetupFixture.AdditionalHostConfiguration` and `ConfigureHostServices` in `Cratis.Chronicle.XUnit.Integration` let an integration fixture add silo configuration (for instance a graph sink connection) and register host services such as the naming policy. Both default to nothing. - **Screenplay** ([Release v5.9.0](https://github.com/Cratis/Screenplay/releases/tag/v5.9.0)): `SemanticGraphQueryAuthorization.Refusal`, which decides a graph query's `authorize` with the same evaluation the other queries use and returns why not, or null when the caller may run it (Stage#1000). - **Stage** ([Release v4.223.0](https://github.com/Cratis/Stage/releases/tag/v4.223.0)): Registration of each graph and its projection with the kernel the sandbox runs against, lowered to the read model and projection definition Chronicle's own client builds for a `[Graph]` model (#997). - **Stage** ([Release v4.223.0](https://github.com/Cratis/Stage/releases/tag/v4.223.0)): `Stage__Graph__SinkType` selects the graph sink, Neo4j by default and `InMemoryGraph` for a kernel without Neo4j. - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): Queries that read a graph, `query <Name> => <ReadModel>[] graph <Graph>`, with `match` and `optional match` path patterns, `where` equality joined with `and`, and a `return` block; both compilers check labels, edge types and direction, aliases, argument and return types, and optional-match returns with `PLAY0878` to `PLAY0885` (#1169). - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): `then query` in graph specifications, evaluated by the reference graph runner over its in-memory graph, including `optional match`. - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): `given clock "<instant>"` in graph specifications, which sets `$eventContext.occurred` for the events the specification appends, with a fixed instant when it is absent (#1171). - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): ESM v40 carries `graphQueries` and the graph specification `clock`; a model that uses neither keeps its version and bytes. - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): A conformance document for graph queries, a section on reading a graph in the graphs documentation, and decision 0139. - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): Forwarded identity can require the forwarding hop to present a trusted client certificate on the TLS connection; identity headers from any other caller are ignored (#3704) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): `[RequiresScope]` lets a command, query or controller action require scopes that a verified caller's scope ceiling must hold; other principals are not narrowed (#3731) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): `WithVerifiedCallers(...)` installs signed forwarded-identity v2 verification for browser sessions, with your person directory and an explicitly chosen nonce store. New public types: `VerifiedCallersBuilder`, `SignedForwardedIdentityV2Builder`, `ICallerPersonDirectory`, `CallerAccountKey`, `CallerPersonId`, `CallerPersonFound`, `IForwardedIdentityNonceStore` and `ForwardedIdentityNonceReservation`. The process-local nonce store suits a single instance only (#3730) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): An invalid installation fails at startup with `InvalidVerifiedCallerInstallation`, `InvalidForwardedIdentityPublicKey` or `ForwardedIdentityNonceStoreNotConfigured` (#3730) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): A sample host and specs prove one signed browser flow through authorization, tenant membership and scopes using only public APIs (#3732) - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): Product reports reach the operator by audience: set `BoxOfficeOptions.OperatorAudience` (or `OfferingOptions.OperatorAudience` for standalone Offering and Metering) and offering, default offering, seat, compute and metering reports are addressed to the operator. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): The operator's subscription to each product can be filtered to one audience with `BoxOfficeOptions.ProductAudience`. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): Usher addresses its desk traffic by audience with `UsherOptions.Audience` and `UsherOptions.DeskAudience`. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): Notes addresses what an application sends to its collector with `NotesOptions.CollectorAudience`, and filters what comes back with `NotesOptions.Audience`. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): A note names the sending application, and the collector addresses its acknowledgements, addressed and declined answers back to it, so `NotesOptions.Audience` can be set safely. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): Marquee announcements can be addressed to the product they are for with `MarqueeAuthoringOptions.AddressToProducts`, and a product receives only its own with `MarqueeOptions.SubscribeForProduct`. - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): An "Audience routing" page in the Box Office documentation covers every option. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): `Ante:Audience` (`Ante__Audience`) names the lobby. When set, every host-store subscription is filtered to that audience; when unset or empty, subscriptions stay unfiltered as before. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): `Ante:OperatorAudience` is the fallback reply audience when a request does not say who sent it. When unset, replies stay unaddressed as before. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): `Ante.Contracts.AudienceTags.From` (`"from"`) is the tag a host sets to name the requesting operator; replies to that request are addressed to it. No event schema changes. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): Startup validation rejects blank or padded audience values with `AnteAudienceInvalid`. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): Documentation for audience routing in the configuration and host-integration guides: https://github.com/Cratis/Ante/blob/main/Documentation/host-integration.md - **Stage** ([Release v4.222.0](https://github.com/Cratis/Stage/releases/tag/v4.222.0)): Graph declarations render as Chronicle node and edge records, and graph projections as model-bound graph projections (node keys, edge endpoints and identity, property mappings, counters, removal with or without detaching edges). (#976) - **Stage** ([Release v4.222.0](https://github.com/Cratis/Stage/releases/tag/v4.222.0)): Applications that declare a graph are wired for Neo4j: `WithNeo4j()` in the host, the `Cratis.Arc.Neo4j` package, configuration and a Neo4j service in the generated Docker Compose file. The Neo4j password is read only from the `NEO4J_PASSWORD` environment variable. - **Stage** ([Release v4.222.0](https://github.com/Cratis/Stage/releases/tag/v4.222.0)): `then graph` specifications render as specs over Chronicle's `GraphScenario`, and Stage's specification verification runs `given graph` and `then graph` specifications. - **Stage** ([Release v4.222.0](https://github.com/Cratis/Stage/releases/tag/v4.222.0)): Graph constructs Chronicle cannot express are refused with named diagnostics (STAGE-ESM-062, STAGE-ESM-064, STAGE-ESM-067) instead of being dropped. - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): Tag filter on event store subscriptions: `WithNamedTag(name, value)` and `ForAudience(audience)` on the subscription builder. Non-matching events are never forwarded to the target inbox; an empty filter forwards everything as before. - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): `IEventTagEnricher` and `EventTags.Scope` / `EventTags.Audience` to add named tags to events at append time, applied on every `EventSequence` and `UnitOfWork` append path. - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): `[Audience]` attribute: on an event type it requires an audience (appending without one throws `MissingAudience`); on a property it stamps `audience=<value>` on the event. - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): Documentation for subscription tag filters, tag enrichers and audiences. - **Arc** ([Release v22.169.0](https://github.com/Cratis/Arc/releases/tag/v22.169.0)): `[RequiresApproval]` marks a command that must be approved before it runs; until an approval package is registered such commands are refused with a clear problem response (#3711) - **Arc** ([Release v22.169.0](https://github.com/Cratis/Arc/releases/tag/v22.169.0)): Capabilities hosting on a dedicated endpoint-group port that admits only verified callers, exposes the caller to capabilities and records person, actor, declared client, credential or grant id and tenant as causation on the events a capability causes (#3544) - **Arc** ([Release v22.169.0](https://github.com/Cratis/Arc/releases/tag/v22.169.0)): Specified the forwarded-identity envelope v2 contract (Locked v1): canonical signing input, caller fields, bearer binding, replay protection and conformance vectors (#3698) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): Reactors whose client declares page delivery receive one call per page, with each partition settled on its own. A failing partition is parked at its first unhandled event and the rest of the page still counts (#5679) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): Catch-up and replay of a page-declaring reactor run as one ordered sweep over the whole observer, using the same pages. Clients that do not declare page delivery are unaffected. - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): Reducer state caching. A client that opts in at registration (the .NET client does) keeps the state it last returned per partition, and the kernel tells it the state is unchanged instead of serializing the whole read model for every reduce. Memory and CPU per reduce no longer grow with the size of the read model while it is unchanged between reduces. Clients that do not opt in, and older kernels, behave as before (#5669) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): The kernel refuses to start, naming both database names, when the System event store is empty under the configured name but holds events under the other one, instead of creating a fresh administrator roster in an empty store. The downgrade path is documented in the storage configuration page (#5690) - **Arc** ([Release v22.168.1](https://github.com/Cratis/Arc/releases/tag/v22.168.1)): Internal groundwork for building a verified caller from authenticated credentials only, refusing ambiguous or query-string credentials (part of #3709) - **Arc** ([Release v22.168.1](https://github.com/Cratis/Arc/releases/tag/v22.168.1)): Internal verification of signed forwarded identity v2 envelopes with per-key public keys, freshness, audience and replay checks (part of #3706) - **AuthProxy** ([Release v2.45.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.45.0)): Backend TLS configuration: AuthProxy can present a client certificate to backends and trust a private CA bundle, from mounted PEM files that reload without a restart. It covers proxied requests, bearer routes, identity-details calls and tenant-list calls. See https://github.com/Cratis/AuthProxy/blob/main/Documentation/configuration/backend-tls.md (part of #251) - **AuthProxy** ([Release v2.45.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.45.0)): A `Profile` setting with a `LocalDevelopment` value for developer machines. Aspire's `WithSignedForwardingTo` selects it in run mode only (part of #251) - **AuthProxy** ([Release v2.45.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.45.0)): Startup diagnostics show the transport (`PlainHttp`, `Tls` or `MutualTls`) for each identity flow and the client certificate's subject, SAN, fingerprint and expiry, without key material (part of #251) - **Chronicle.Elixir** ([Release v3.20.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.20.0)): `node` and `edge` blocks in the projection DSL declare graph projections: node keys, edge source and target, optional edge identity, property mappings, counters and removal with or without detaching edges. (#206) - **Chronicle.Elixir** ([Release v3.20.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.20.0)): Graph projections register with the kernel through the existing projection coordinator and run against Chronicle's in-memory or Neo4j graph sinks. - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Optional per-service forwarded-identity signing (audience, key id and key) that signs proxied requests, bearer-route requests, identity-details calls and tenant-list calls with the Arc v1 envelope, after all request transforms (part of #139) - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Startup validation that refuses unusable signing settings and the same signing key shared between different backends, plus a startup report listing each identity-bearing flow and whether it is signed (part of #139) - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Aspire `WithSignedForwardingTo(backend)` that pairs AuthProxy with an Arc backend: a fresh key per backend for every local run, the matching verifier settings on the backend, and a required secret parameter for published deployments (#198) - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Documentation for configuring forwarded-identity signing and the Aspire pairing (part of #139) - **Ante** ([Release v1.8.0](https://github.com/Cratis/Ante/releases/tag/v1.8.0)): Hosts confirm provisioning with `OnboardingProvisioningCompleted`, and Ante publishes `OnboardingProvisioningConfirmed` once per accepted invitation or registration, so acceptance alone no longer signals readiness (#217) - **Ante** ([Release v1.8.0](https://github.com/Cratis/Ante/releases/tag/v1.8.0)): An onboarding provisioning status read model that moves from awaiting provisioning to ready on the host's confirmation (#217) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): Graph projections: a projection can map events onto graph nodes and edges with keys, property mappings, counters and `$eventContext` values, and remove them again, with `detach` for nodes that still have edges. Writes are idempotent per element and replay rebuilds the graph without touching elements other projections own. See [Graph projections](https://github.com/Cratis/Chronicle/blob/main/Documentation/projections/graph-projections.mdx) (#5668) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): `InMemoryGraph` sink type for tests and local development (#5668) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): Neo4j graph sink (`Neo4j` sink type), configured in the `neo4j` section of `chronicle.json`, with database-per-namespace or single-database mode, key uniqueness constraints and database creation on first use. See [Neo4j](https://github.com/Cratis/Chronicle/blob/main/Documentation/sinks/neo4j.mdx) (#5670) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): Storage connection resolution supports `Neo4j` for read model databases, so a platform can answer the Bolt URI, database and identity per namespace (part of #5670) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): .NET client: model-bound graphs with `[Node]`, `[Edge]`, `[Graph]`, `[Source<>]`, `[Target<>]`, `[EdgeFrom<>]`, `[EdgeRemovedWith<>]` and `[RemovedWith<>(detach: true)]`, alongside the existing property attributes (#5671) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): .NET client: fluent `IGraphProjection` with `Node<T>()` and `Edge<TEdge, TSource, TTarget>()` builders, and `ChronicleOptions.DefaultGraphSinkTypeId` (default `Neo4j`) (part of #5671) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): `GraphScenario` in `Cratis.Chronicle.Testing` for asserting nodes and edges produced by graph projections (part of #5671) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): Analyzers CHR0066 (graph property must be a primitive or a list of primitives), CHR0067 (a node needs exactly one key) and CHR0068 (a node or edge cannot also be a read model) (part of #5671) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): The projection declaration language accepts a `graph` declaration with a `projection … => graph …`; saving one registers the graph and its projection, and registered graph projections render back to the same declaration. See [Graph targets](https://github.com/Cratis/Chronicle/blob/main/Documentation/projections/projection-declaration-language/index.md) (#5672) - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): `cratis-arc-tenancy-typescript`: tenant sources, `membershipClaim`, `tenancy.resolve`, per-tenant MongoDB, Drizzle and Chronicle isolation, and how to verify the boundary. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): `cratis-arc-storage-typescript`: `@cratis/arc.mongodb` and `@cratis/arc.drizzle` registration, naming policies, storage formats, geospatial fields, paging, column codecs, schema ownership, and change-stream and PostgreSQL observation. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): `cratis-arc-testing-typescript`: choosing between `handle()` and the `CommandScenario`, `QueryScenario`, `ObservableQueryScenario` and `ArcScenario` boundaries, authorization specs, `given` contexts and `node:test`. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): `cratis-arc-code-analysis-typescript`: the `@cratis/eslint-plugin-arc-core` presets and every `arc-core` rule with its fix. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): References for the existing Arc for TypeScript skills: `ArcOptions` and `appsettings.json` configuration, every `arc-proxygenerator` option, global command filters, response value handlers, execution scopes, direct command execution, and the query pipeline with filters, renderers, read-model interceptors, read consistency, hubs and query health. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): The four new skills load for Node.js Arc server projects alongside the command, query and validation skills. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): All 11 packages are published to npm at 1.0.0: `@cratis/arc.core`, `@cratis/arc.express`, `@cratis/arc.fastify`, `@cratis/arc.hono`, `@cratis/arc.testing`, `@cratis/arc.proxygenerator`, `@cratis/eslint-plugin-arc-core`, `@cratis/arc.mongodb`, `@cratis/arc.drizzle`, `@cratis/arc.chronicle` and `@cratis/platform`. Install with `npm install @cratis/arc.core`. `@cratis/arc.chronicle` stays documented as bounded and experimental. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): `@cratis/platform` is a meta package: one install brings Arc, the Express adapter, the Chronicle integration and the Chronicle client, like the Cratis package for .NET. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): A `Showcase` sample that ports the .NET and Elixir showcases as vertical slices: ticker, live feed, query showcase, authentication, cross-cutting authorization, observable collections, change stream and MongoDB with tenancy, over WebSocket and SSE. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): A README and `run.sh` (`./run.sh`, `./run.sh dev`, `./run.sh test`) for the Tasks, Library and Showcase samples, with a `Samples/run-tests.sh` that tests all of them. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): A `publish.yml` workflow that releases a merged `major`, `minor` or `patch` pull request and publishes the packages through npm trusted publishing with provenance. - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): `graph` declarations: `node` blocks with typed properties and exactly one `key`, and `edge <TYPE> source <Label> target <Label>` blocks with typed properties and optional `identified by` for several edges between the same nodes. See [Graphs](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/graphs.md) (#1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): Graph projections: `node` and `edge` blocks with `from … key …`, `from … source … target …`, property mappings, counters, `every`, `$eventContext` values and `remove with … [detach]`. See [Graph projections](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/projections/graphs.md) (part of #1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): `given graph` and `then graph` specification steps (`has node`, `has edge`, `no node`, `no edge`), run by the reference executor and the `run-specifications` MCP tool (part of #1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): Graphs and graph projections bind into the executable semantic model as ESM v38; models without a graph keep their version and bytes (part of #1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): Diagnostics `PLAY0862` to `PLAY0877` for malformed graphs, unsupported property types, missing or duplicate keys, undeclared labels, edge types and properties, `detach` on an edge, read-model-only constructs in a graph projection, and graph projections outside a slice (part of #1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): Graph support in the TypeScript compiler, the Monaco editor and the VS Code extension (part of #1160) - **Screenplay** ([Release v5.7.0](https://github.com/Cratis/Screenplay/releases/tag/v5.7.0)): `Samples/Organization`: persons, groups, nested groups and role assignments projected onto a graph, with specifications (part of #1160) - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): Live collaboration in `Cratis.Choreography`: a WebSocket hub that tracks the collaborators in a room and broadcasts their presence and cursor positions. Identity and tenancy come from your own `ICollaborationParticipantResolver`; register it with `AddCratisCollaboration<TResolver>()` and map the endpoint with `MapCratisCollaboration()`. - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): `AddCratisCollaborationOrleans()` shares the roster across replicas through an Orleans grain, so presence is correct at any replica count, and sessions of a replica that goes away expire instead of lingering. - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): New grain interfaces `ICollaborationRoomGrain` ([Version(0)]) and `ICollaborationRoomObserver` ([Version(0)]), and the `CollaborationRoomGrain` grain. No existing grain interface changes. - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): Collaboration client in `@cratis/choreography/collaboration`: a resilient WebSocket client, roster, session identity and cursor geometry, with no dependency on React. - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): React bindings in `@cratis/choreography/collaboration/react`: `useCollaborators`, interpolated and edge-parking `CollaboratorCursors`, and a `CollaborationIndicator`, with a CSS export. Avatars, glass layer attributes, canvas transform activity and the trigger button are supplied by the host. - **Choreography** ([Release v2.3.0](https://github.com/Cratis/Choreography/releases/tag/v2.3.0)): Documentation for the wire protocol, backend setup, running at more than one replica and the frontend client. - **Choreography** ([Release v2.2.1](https://github.com/Cratis/Choreography/releases/tag/v2.2.1)): `@cratis/choreography` is published to npm with each release, using npm trusted publishing (OIDC), so no token is stored in the repository. - **AI** ([Release v7.136.0](https://github.com/Cratis/AI/releases/tag/v7.136.0)): The `cratis-arc-elixir` skill: commands and queries, observable queries over the SSE and WebSocket hubs, tenancy and identity, MongoDB, generated proxies and vertical slices, hosting and testing, and pitfalls - **AI** ([Release v7.136.0](https://github.com/Cratis/AI/releases/tag/v7.136.0)): The `cratis/arc/elixir` profile, included in `cratis/application/elixir` - **AI** ([Release v7.136.0](https://github.com/Cratis/AI/releases/tag/v7.136.0)): Trigger and evaluation inputs for the skill, and a product-sync entry for Arc.Elixir - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): A multiplexed Server-Sent Events hub beside the WebSocket hub, and delta transfer mode on both - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): Tenancy resolvers that select the tenant and scope the Chronicle namespace - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): `cratis_arc_mongodb`: conventions, tenant-aware databases, connection resolution and change stream observation - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): `Arc.Filter` for cross-cutting authorization and `Arc.Watch` as a source of observable changes - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): A co-located proxy layout (`layout: :colocated`) for vertical slices - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): The showcase sample, a `run.sh` in every sample and a Samples README - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): Documentation for tenancy, MongoDB and vertical slices - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `@observes(MyEvent)` marks a reactor or reducer method as a batch method; stack it once per event type. Works with both legacy and standard decorators. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): A reactor batch method receives an `EventBatch` and a `BatchContext`; a reducer batch method receives the `EventBatch`, the current state and a `BatchContext`, and is called once per event source. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `EventBatch.fail` and `EventBatch.defer` settle one event source of a batch without failing the rest; `defer` asks Chronicle to deliver it again after a delay. `EventAndContext.is(MyEvent)` narrows an entry to that event type. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `BatchContext` tells a batch method where the page came from (`Live`, `CatchUp`, `Replay`, `Retry`), which event sources it holds, its deadline and an `AbortSignal`. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `@batchSize({ maxEvents, maxBytes, maxDelayMilliseconds, maxConcurrency })` sets page bounds for an observer and how many event sources a reducer folds at once (defaults to `os.availableParallelism()`). - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): Reactors can mix batch methods and per-event methods; each event goes to exactly one of them. A reducer has either one batch method or per-event methods. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): Registration fails with a clear error when an event type reaches more than one method, when `@observes` is combined with `@handles`, `@replay` or `@onceOnly`, when a batch method observes an unregistered event type, or when a reducer mixes the two modes. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `ReadModelScenario` runs batch reducers. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): `@Observes(MyEvent::class)` (Java: `@Observes(MyEvent.class)`) marks a reactor or reducer method as a batch method; repeat it once per event type. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): A reactor batch method takes an `EventBatch` and optionally a `BatchContext`; a reducer batch method takes the `EventBatch`, the current state and optionally a `BatchContext`, and is called once per event source. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): `EventBatch.fail` and `EventBatch.defer` settle one event source of a batch without failing the rest; `defer` asks Chronicle to deliver it again after a delay. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): `BatchContext` tells a batch method where the page came from (`Live`, `CatchUp`, `Replay`, `Retry`), which event sources it holds and its sequence-number range. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): `@Reducer(maxConcurrency = n)` limits how many event sources of a page a reducer folds at once; 0, the default, means the processor count. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): Reactors can mix batch methods and per-event methods; each event goes to exactly one of them. A reducer has either one batch method or per-event methods. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): Registration fails with a clear exception when an event type reaches more than one method, when a batch method observes nothing or an unregistered event type, when a per-event method takes a `BatchContext`, or when a reducer mixes the two modes. - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): Published hosting mode (`Stage:Mode=Published`): Stage serves only the application, without Scalar, OpenAPI, the Workbench, the read-model browser or the specification and model-loading routes, and refuses to start unless forwarded identity from AuthProxy is on and limited to trusted proxy addresses. (part of #917) - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): A published application keeps its data in MongoDB through Chronicle, in an event store named `app-<published name>` that survives restarts, redeploys and new versions. (part of #917) - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): Versioned application packages: Stage exports a publishable package from a model, and a published container loads its application from such a package. (#918) - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): In-app feedback through Cratis Showrunner Notes: a Notes button in the top bar and in the header of slice-owned dialogs, with the screen, slices and picked component as context, sent to the collecting host when Notes is configured for the published application. (#919) - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): The frontend runtime exposes the application context (module, feature, slice, screen and dialogs) and a map from the running application back to the model, so feedback names the elements it is about. (#919) - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): `@observes EventType` marks a reactor or reducer function as a batch function; repeat it once per event type. A reactor batch function receives an `Chronicle.Observers.EventBatch` and a `BatchContext`; a reducer batch function is called once per event source with the events, the current state and a `BatchContext`. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): `EventBatch.fail/3` and `EventBatch.defer/3` settle one event source of a batch without failing the rest; `defer` asks Chronicle to deliver it again after a delay. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): `BatchContext` tells a batch function where the page came from (`:live`, `:catch_up`, `:replay`, `:retry`), which event sources it holds and whether it can defer. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): The `batch_size:` option on `use` sets page bounds (`max_events`, `max_bytes`, `max_delay_milliseconds`) and, for reducers, `max_concurrency` (defaults to the number of schedulers online). - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): Reactors can mix batch functions and `handle/2`; each event goes to exactly one of them. A reducer has either one batch function or `reduce/3`. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): Registration fails with a clear error when an event type reaches more than one function, when `@observes` is on a per-event callback, when a batch function observes an unregistered event type, or when a reducer mixes the two modes. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): `Chronicle.Testing` runs batch functions. - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): `Cratis.Arc.Neo4j`: `WithNeo4j(...)` / `AddCratisNeo4j(...)` with `Neo4jOptions` (server, credentials or a password secret key, database prefix, `PerNamespace` or `Single` database mode), one pooled driver per server and identity, and a scoped `IGraphSession` (read access by default, `IGraphSessionFactory.Open(AccessMode)` for writes) injectable into queries and services (#3692) - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): Graph databases are named per event store and namespace with the same algorithm Chronicle's Neo4j graph sink uses, so Arc reads exactly what Chronicle projects; replace `IGraphDatabaseNameResolver` or `IGraphNamespaceResolver` to customize it - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): Concept values bind as their primitive in Cypher parameters, and query results map back to records with concept-typed properties - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): Connection resolution supports Neo4j: resolvers can answer the Bolt URI, the database and the identity, and expired or rejected credentials are resolved again; `Neo4j` is a storage value in the [connection resolution contract](https://github.com/Cratis/Arc/blob/main/Documentation/connection-resolution-contract.md) - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): `Cratis.Arc.Neo4j.Testing` with a substitutable graph session for specifications - **Arc** ([Release v22.168.0](https://github.com/Cratis/Arc/releases/tag/v22.168.0)): Documentation: [Neo4j](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/neo4j/index.md) and a sample under `Samples/Neo4j` - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Each event store now keeps its own Ed25519 webhook signing keys, encrypted at rest, with overlap during rotation (part of #5117) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): The kernel can now sign and verify Standard Webhooks payloads with Ed25519 (`v1a`) keys, groundwork for signed webhook deliveries (part of #5117) - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): `Cratis.Showrunner.BoxOffice.Product`: `AddBoxOfficeProduct` adds Box Office and the product side in one call. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): Provisioning: the product implements `IProvisionTenants`; Box Office hears the operator's `TenantRegistered`, calls it and reports `TenantProvisioned` once per tenant. A refusal that retrying will not change is reported as `TenantNotProvisioned` with a reason; a transient failure is retried. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): `ISeatLicenses.For(tenant, holder)` answers `Licensed`, `NoLicense` (with who to ask) or `UnknownOrganization` from what the operator published, with no call to the operator. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): `ITenantAccess.IsReadOnly(tenant)` for jobs, reactors and endpoints; Box Office's command filter already refuses the commands of a read-only tenant. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): AuthProxy's sign-in callback is received automatically at `/.cratis/showrunner/sign-in`, with no endpoint to map. It reports `SeatHolderActive` at most once per person and day, so the operator can show when a person was last seen. `IReportActivity` reports activity AuthProxy cannot see. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): Two public contract events, `SeatHolderActive` and `TenantNotProvisioned`; existing events are unchanged. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): `IClosingTenants`, an optional hook that is told when the operator closes a tenant. - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): Documentation: [The product side](https://github.com/Cratis/Showrunner/blob/main/Documentation/BoxOffice/product.md), including the AuthProxy configuration. - **AuthProxy** ([Release v2.43.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.43.0)): Optional per-service `SignInCallback` (`Path`, `Interval`, `Timeout`, `Secret`): AuthProxy posts a `SignedIn` callback right after an identity-provider sign-in succeeds, and a `Returned` callback on the first request of an existing browser session, then at most once per interval (default 12 hours) per user and service. - **AuthProxy** ([Release v2.43.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.43.0)): The callback carries the usual `x-ms-client-principal-*` identity headers and the resolved tenant, a marker header and an optional shared secret, and a JSON body with the kind, subject, name, email, identity provider, tenant and time. AuthProxy strips the marker and secret headers from inbound requests, so they cannot be forged through the proxy. - **AuthProxy** ([Release v2.43.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.43.0)): Callbacks are delivered from a background queue with the configured timeout and never block or fail the user's request; failures are logged without the secret or the user's identity. - **AuthProxy** ([Release v2.43.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.43.0)): A "Sign-in Callback" configuration page describing the settings, the exact call and its delivery guarantees (the receiver must be idempotent). - **Screenplay** ([Release v5.6.0](https://github.com/Cratis/Screenplay/releases/tag/v5.6.0)): Binding can now keep read-model property declaration order as optional ESM 37.1 metadata, for models whose base is a valid ESM 37.0 model. Consumers such as Stage can then render read-model constructor parameters in authored order. (#1110) - **AI** ([Release v7.135.0](https://github.com/Cratis/AI/releases/tag/v7.135.0)): `WorkerJob.Labels`: optional labels the Docker worker runtime puts on the worker container, so tools on the host can find or skip the containers it starts. The Kubernetes runtime ignores them, and jobs without labels run exactly as before. - **AI** ([Release v7.134.0](https://github.com/Cratis/AI/releases/tag/v7.134.0)): New `cratis-engineering-issue-design-note` skill in the `cratis/engineering/core` profile: it guides writing, revising and linking one pinned implementation design comment per issue before non-trivial issue-backed work starts. The issue-hygiene skill now points to it. (#1027) - **cli** ([Release v3.121.0](https://github.com/Cratis/cli/releases/tag/v3.121.0)): `cratis direct setup` connects your AI tools to Direct in one step. It detects the installed MCP clients, signs you in if needed, and registers the Direct MCP server with each of them. `--client` limits the clients and `--dry-run` shows the plan without writing anything. (part of #206) - **cli** ([Release v3.121.0](https://github.com/Cratis/cli/releases/tag/v3.121.0)): `cratis direct mcp install` and `cratis direct setup` can register Direct with pi, in user or project scope. They honor `PI_CODING_AGENT_DIR` and preserve any servers and settings they did not write. (part of #206) - **cli** ([Release v3.121.0](https://github.com/Cratis/cli/releases/tag/v3.121.0)): `cratis direct login --token` and `cratis direct setup --token` sign in with a Direct personal access token instead of the browser flow. The token is read from standard input or `DIRECT_TOKEN` and kept in the operating system's secret store. The token decides the organization, so `--tenant` cannot be combined with it. When Direct rejects the token, the CLI tells you to create a new one instead of trying to refresh it. (part of #206) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Operators using an external identity provider can map a role or claim to Chronicle administrator through configuration; nothing is mapped by default (#5480) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Guidance for running the kernel in small containers: CPU and memory sizing, garbage collector settings, and how to measure a deployment. See [Size the kernel for a container](https://github.com/Cratis/Chronicle/blob/main/Documentation/hosting/container-resources.md). (part of #5110) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Kernel keys now expose their kind (string, Guid, integer, long or composite), groundwork for typed keys in the Workbench (part of #1387) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Child joins inside Children(...) now have their own join builder (#1350) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): An opt-in, off-by-default setting enables the Orleans distributed grain directory; changing it requires the same setting on all silos and a whole-cluster restart, not a rolling upgrade (part of #3746) - **Chronicle.Kotlin** ([Release v7.5.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.5.0)): `@CompensationFor(KClass)` declares that an event type compensates another, written into the schema as `compensationFor` the same way the .NET client does. (part of Cratis/Chronicle#3343) - **Chronicle.Kotlin** ([Release v7.5.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.5.0)): `IEventSequence.compensate(compensationFor, event, options)` appends a compensating event to the stream of the event it compensates and returns an `AppendResult`, with a blocking variant for Java. Rejections arrive in `result.errors` as the new `COMPENSATED_EVENT_NOT_FOUND` and `EVENT_TYPE_DOES_NOT_COMPENSATE_EVENT_TYPE` errors. The default implementation throws `CompensationsNotSupported`, so existing implementers keep compiling. - **Chronicle.Kotlin** ([Release v7.5.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.5.0)): `EventContext.compensationFor` and `isCompensation` link a compensating event to the original. - **Chronicle.Kotlin** ([Release v7.5.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.5.0)): The in-memory event sequence in the testing module supports compensation and enforces the same two rejections. - **Screenplay** ([Release v5.5.0](https://github.com/Cratis/Screenplay/releases/tag/v5.5.0)): Admit ESM v37 clock operands (`today`, `now`, offsets and `date of`), application and command calendars, and declared context time-zone members in command conditions and validation rules. (#824) (#1044) (part of #1120) - **Chronicle.Elixir** ([Release v3.18.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.18.0)): `EventLog.compensate/3` and `EventSequence.compensate/4` append a compensating event to the stream of the event it compensates and return `{:ok, AppendResult}`. A compensation is always sent immediately and is never buffered in a unit of work. (part of Cratis/Chronicle#3343) - **Chronicle.Elixir** ([Release v3.18.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.18.0)): `EventContext.compensation_for` links a compensating event to the original; it is `nil` for every other event. - **Chronicle.TypeScript** ([Release v6.57.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.57.0)): `@compensationFor(OriginalEvent)` declares that an event type compensates another, written into the schema as `compensationFor` the same way the .NET client does. (part of Cratis/Chronicle#3343) - **Chronicle.TypeScript** ([Release v6.57.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.57.0)): `eventSequence.compensate(sequenceNumber, event, options)` appends a compensating event to the stream of the event it compensates and returns an `AppendResult`; `CompensatedEventNotFound` and `EventTypeDoesNotCompensateEventType` arrive in `result.errors`. - **Chronicle.TypeScript** ([Release v6.57.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.57.0)): `EventContext.compensationFor` links a compensating event to the original, and a `compensate` telemetry span is emitted. - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): Command handlers can declare the events they may produce with a `may produce` block and return an ordered selection of them (handler result contract v2, ESM v35). (part of #1102) - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): Author composite collection sample values as nested rows, including explicit empty collections, in Screenplay and its authoring tools. (part of #1000) - **AI** ([Release v7.132.0](https://github.com/Cratis/AI/releases/tag/v7.132.0)): A shell-write guard for Claude, Codex and Pi: a Bash command that names a protected file (agent configuration, dependency manifests, `.env` files and the other files the write guard protects) runs only when every command in it is a read-only command with known-safe options. Ordinary build and test commands that do not name protected files are unaffected. (#1009) - **Stage** ([Release v4.219.0](https://github.com/Cratis/Stage/releases/tag/v4.219.0)): Reducers that publish a public event can now carry a `from` filter on an event source or one of its streams. Stage renders the same source and stream filter attributes as for ordinary reducers, and rendering such a reducer on its own slice no longer fails. (#928) - **Stage** ([Release v4.219.0](https://github.com/Cratis/Stage/releases/tag/v4.219.0)): Joins inside root-level `nested` objects now render as nested Chronicle joins. Joins under `children`, joins on the nested object's own key (`id`), and removals inside nested objects are still refused. (part of #117) - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): `IEventSequence.Compensate(sequenceNumber, event)` in the .NET client, backed by a new `Compensate` operation on the event sequences service. The compensating event is appended to the event source, event stream and subject of the event it compensates for. (part of #3343) - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): `CompensationFor` on the event context: the sequence number of the compensated event, or `null` for events that are not compensations. It is stored by the MongoDB, SQL and in-memory providers; existing events and existing SQL tables read as not being compensations, and SQL event sequence tables gain a nullable `CompensationFor` column when upgraded. - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): A rejected compensation is reported as `CompensatedEventNotFound` when no event exists at the sequence number, or `EventTypeDoesNotCompensateEventType` when the event type is not declared with `CompensationFor<TEventType>` for the type of the target. - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): A **Compensate** action in the Workbench event sequence view. It is enabled when the selected event's type has registered compensation event types, and opens a form for choosing the type and filling in its content. - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): Documentation for [event compensation](https://github.com/Cratis/Chronicle/blob/main/Documentation/events/compensation.md) and [compensating events in .NET](https://github.com/Cratis/Chronicle/blob/main/Documentation/clients/dotnet/compensation.md). - **Arc** ([Release v22.166.0](https://github.com/Cratis/Arc/releases/tag/v22.166.0)): Generate framework-neutral TypeScript proxies with `framework=none` or `CratisProxiesFramework=none`, while retaining React as the default. (#3627) - **Arc** ([Release v22.166.0](https://github.com/Cratis/Arc/releases/tag/v22.166.0)): Emit aligned tenant, HTTP route and MongoDB telemetry alongside existing tags and metrics without changing span names or outcomes. (#2915) - **Stage** ([Release v4.218.0](https://github.com/Cratis/Stage/releases/tag/v4.218.0)): Read models marked `passive` in Screenplay now render as Chronicle passive projections: the generated read model carries `[Passive]` (model-bound, fluent and reducer backings), and Stage registers them without a sink, so they are built when read instead of being kept up to date by a running observer. Passive read models on joins, child or nested scopes, or keyed by something other than the event source are refused with `STAGE-ESM-061`. See [Stage rendering](https://github.com/Cratis/Stage/blob/main/Documentation/reference/stage-rendering.md). (#208) - **Prompter** ([Release v0.14.13](https://github.com/Cratis/Prompter/releases/tag/v0.14.13)): The eval command takes `--skip <count>`, and the production eval workflow has a matching `skip` input, so golden cases past the first 60 can run against production (#134) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): External token authority options for the .NET client. (part of #4350) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Benchmarks for decision reads, guarded appends and concurrent decision reads (#4856) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Failed partition groups page in the Workbench groups current failed partitions by observer and failure kind (part of #5539) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Added `observers.maxConcurrentRegistrations` to limit how many reactor and reducer registrations a kernel silo processes at once, so rolling client updates no longer exhaust the storage connection pool (part of #5514) - **Ante** ([Release v1.7.0](https://github.com/Cratis/Ante/releases/tag/v1.7.0)): A host can supply its own copy for the user and organization invitation wizards through `Ante:Invitations:UserSetup:Content:{locale}` and `Ante:Invitations:OrganizationSetup:Content:{locale}`: a title, intro, completion message and support link per locale, independent of the registration page's content. Copy is plain text, the support link must be an absolute HTTPS URL, unknown keys fail startup, and locales fall back from the exact culture to its language, then `en` and `en-US`. Without configuration the wizards show the shipped text as before (#198) - **Choreography** ([Release v2.2.0](https://github.com/Cratis/Choreography/releases/tag/v2.2.0)): Operation history in `Cratis.Choreography.Operations`: stable operation identity, scope, actor, kind, lifecycle and the event sequence numbers an operation produced. Operations can emit zero, one or many events, history is append-only, and it can be queried by scope and actor in order. It does not depend on Studio or on Chronicle, and ships with an in-memory storage and the `IOperationHistoryStorage` abstraction for durable ones. (#180) - **Choreography** ([Release v2.2.0](https://github.com/Cratis/Choreography/releases/tag/v2.2.0)): A fluent definition API for undo and redo, for example `Define<RenameModule>().UndoWith(...).CanUndoWhen(...).RedoWith(...)`, and `IOperationEngine` with `Undo`, `Redo` and `GetHistory`. Reversal is always explicit: the definition supplies the inverse and nothing is inferred from events. Undo targets the actor's latest operation in the scope and reports why it is blocked instead of skipping to an older one, runs as a new operation that is linked to the original, and reverses multi-event operations as one unit. A new operation by the same actor clears their redo stack. (#181) - **Choreography** ([Release v2.2.0](https://github.com/Cratis/Choreography/releases/tag/v2.2.0)): `@cratis/choreography`: a typed `OperationHistoryClient` over a pluggable transport, an HTTP transport for hosts that expose the engine, and `@cratis/choreography/react` with `useOperationHistory`, `useUndo` and `useRedo`. Hooks report pending, error and blocked outcomes and keep previous history when a refresh fails. (#182) - **Choreography** ([Release v2.2.0](https://github.com/Cratis/Choreography/releases/tag/v2.2.0)): Guides for [operation history and undo/redo](https://github.com/Cratis/Choreography/blob/main/Documentation/operations/index.md) and [using it from React](https://github.com/Cratis/Choreography/blob/main/Documentation/operations/react.md). - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): CI publishes the ArcCore sample with NativeAOT on linux-x64 next to the untrimmed build and runs the published acceptance specs against it. Known NativeAOT failures are held to a tracked list that can only shrink (part of #2859) - **Chronicle.Kotlin** ([Release v7.4.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.4.0)): `copyForEventSource(sourceId, targetId, eventTypes)` on `IEventSequence` (Kotlin `suspend`) and `BlockingEventSequence` (Java) copies events between event sources as a durable kernel job and returns the job id. Requires Chronicle 19.123 or later. - **Chronicle.Kotlin** ([Release v7.4.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.4.0)): `InMemoryEventSequence` supports `copyForEventSource` and copies synchronously. - **Chronicle.Kotlin** ([Release v7.4.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.4.0)): Kotlin and Java documentation snippets for copying events. - **Scene** ([Release v4.88.0](https://github.com/Cratis/Scene/releases/tag/v4.88.0)): The `Cratis.Components` package declares React Aria counterparts for `tag`, `avatar`, `message` and `progressBar`, so screens using them render in the default profile without PrimeReact. PrimeReact severity spellings (`warning`, `error`, `danger`) map to the library's, `avatar` keeps PrimeReact's `square`/`circle` shape with `square` as the default, and the `progressBar` label becomes its accessible name (#251) - **Chronicle.Go** ([Release v0.12.0](https://github.com/Cratis/Chronicle.Go/releases/tag/v0.12.0)): `(*eventsequences.Sequence).Copy(ctx, source, target, eventTypes...)` copies events between event sources as a durable kernel job and returns the job id. Requires Chronicle 19.123 or later. - **Chronicle.Go** ([Release v0.12.0](https://github.com/Cratis/Chronicle.Go/releases/tag/v0.12.0)): Documentation and shared snippets for copying events. - **Chronicle.Mcp** ([Release v2.1.0](https://github.com/Cratis/Chronicle.Mcp/releases/tag/v2.1.0)): `get_patterns` tool: reads the learned behavior patterns that match a grouping key and a set of current facet values, in the server's ranking order, using the configured event store and namespace unless others are given (#27) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Render reducers that target a public event in an outbound translation as Chronicle event-target reducers that publish to the outbox. (part of #212) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): The Cratis renderer now generates projection specifications that seed a scalar-keyed read model with `given readmodel` and assert its projected state, instead of refusing them with STAGE-ESM-011. (part of #14) (part of #15) - **Chronicle.TypeScript** ([Release v6.56.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.56.0)): `copy(sourceId, targetId, ...eventTypes)` on the event sequence copies events between event sources as a durable kernel job and returns the job id. Requires Chronicle 19.123 or later. - **Chronicle.Elixir** ([Release v3.17.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.17.0)): `EventLog.copy/4` copies the events of one event source to another as a durable kernel job and returns the job id. With no event types every event is copied. Requires Chronicle 19.123 or later. - **Chronicle.TypeScript** ([Release v6.55.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.55.0)): `skipKeepAlive` client option (also `skipKeepAlive=true` in the connection string) for short-lived runtimes such as serverless functions and one-shot scripts: the client appends and reads without starting the kernel keep-alive, lets the process exit naturally, and refuses client-hosted reactors and reducers with `ClientObserversRequireKeepAlive` (#260) - **Chronicle** ([Release v19.123.0](https://github.com/Cratis/Chronicle/releases/tag/v19.123.0)): `IEventSequence.Copy(sourceId, targetId, params Type[] eventTypes)` in the .NET client. It starts a durable kernel job and returns its job id. With no event types every event of the source is copied; with event types only those are. - **Chronicle** ([Release v19.123.0](https://github.com/Cratis/Chronicle/releases/tag/v19.123.0)): `CopyEventsForEventSource` administrator command on the `EventSequences` gRPC service, available to every client generated from the Chronicle protobuf contracts. - **Chronicle** ([Release v19.123.0](https://github.com/Cratis/Chronicle/releases/tag/v19.123.0)): Copies keep the event type, tags, stream and occurred time, are keyed by job and source event so a resumed job never appends one twice, and re-protect personal data for the target. See [Copying events](https://github.com/Cratis/Chronicle/blob/main/Documentation/events/copying.mdx). - **Fundamentals.Kotlin** ([Release v0.9.0](https://github.com/Cratis/Fundamentals.Kotlin/releases/tag/v0.9.0)): `Result`, `ResultWithError` and `ResultWithValue` in `io.cratis.fundamentals.monads`, matching the C# Fundamentals `Result` types. They are sealed classes with static factories, `Optional`-returning `tryGet*` accessors and `match`/`switchOn`, usable from Kotlin `when` and Java `instanceof`. (#23) - **Fundamentals.Kotlin** ([Release v0.9.0](https://github.com/Cratis/Fundamentals.Kotlin/releases/tag/v0.9.0)): `Catch`, `CatchWithValue` and `CatchWithError`, matching the C# Fundamentals `Catch` types, including the three-way result, typed error or exception. `rethrowError()` rethrows the original exception unchanged, and Java callers can catch checked exception types by name. (#23) - **Fundamentals.Kotlin** ([Release v0.9.0](https://github.com/Cratis/Fundamentals.Kotlin/releases/tag/v0.9.0)): The parity ledger maps the C# `Option` type to `java.util.Optional` and Kotlin nullable types. (#23) - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): Reactors can declare batch methods: a method taking an `EventBatch` and marked `[Observes<TEvent>]` once per event type is called once per page with every event of those types, in sequence order, alongside the reactor's per-event methods. See [Handling events in batches](https://github.com/Cratis/Chronicle/blob/main/Documentation/reactors/batches.mdx). - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): Reducers can declare one batch method that receives all of a partition's events and the current read model, and returns the new read model. See [Reducing events in batches](https://github.com/Cratis/Chronicle/blob/main/Documentation/reducers/batches.mdx). - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): `BatchContext` tells a batch method where a page came from (`Live`, `CatchUp`, `Replay` or `Retry`), which partitions it holds, its sequence range, deadline and cancellation token. - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): Batch methods report a single partition with `Fail` or `Defer` on the `EventBatch`; a deferred partition is delivered again after the given delay without being failed or counting towards quarantine. - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): The reactor and reducer gRPC contracts gain page delivery, observation origin and deferral, so other clients can receive pages and answer per partition. Existing clients keep receiving single-partition deliveries. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): Startup patching: implement `ICanApplyPatch` and the patch is discovered, ordered by version and applied once per store before the silo takes work. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): A cluster-wide patch manager grain that is safe in mixed-release clusters. When a newer host asks an older manager, the manager moves to the newer host before patching, and an older host never patches a store a newer host already patched. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): Resilient startup during rollouts: a lost silo, a rejected message or a patch that outlasts the grain response timeout is retried with back-off instead of failing the start, bounded by `PatchingOptions.MaxWait` (15 minutes by default) and reported as `PatchingDidNotComplete`. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): Patch storage for in-memory, MongoDB and SQL (SQL Server and PostgreSQL) stores, with the SQL tables created by Choreography's own migrations. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): `AddCratisChoreographyPatching` and `CratisChoreographyOptions.ConfigurePatching` to turn patching on and tune it. - **Choreography** ([Release v2.1.0](https://github.com/Cratis/Choreography/releases/tag/v2.1.0)): Complete documentation, reorganized by feature area, with a patching section and troubleshooting entries. - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Read-model parameters on commands can be keyed by the current caller with `[LookUpBy<TKeyProvider>]`, using the built-in `CallerSubject` or your own `CallerClaim` subclass, which refuse System and unauthenticated callers. A missing or ambiguous key or a changed caller is refused as Unauthorized. (part of #3587) - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): `cratis chronicle diagnose --require-observer <ID>` makes a diagnosis fail when a named observer is missing or not running. Repeat it for several observers. It requires explicit `--event-store` and `--namespace`, and any unsatisfied requirement exits `3`. (#536) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Specifications can evaluate command clock operands in an IANA calendar, including commands invoked by reactions, using a pinned receipt instant and time zone. (part of #824) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): New diagnostics PLAY0834 (unknown IANA time-zone id, with no fallback to UTC) and PLAY0835 (a `calendar from $context.<member>` other than `timeZone`). (part of #1044) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): A `context` block in the application preamble declares typed-context time-zone members (`<name> time zone`). It is parsed, printed, merged, indexed and highlighted in both compilers and editors, and refused at binding with PLAY0268 until clock admission lands; new diagnostics PLAY0854–PLAY0857. Earlier Screenplay versions cannot read a model or syntax JSON that contains a `context` block. (part of #1120) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Read models can opt in to passive realization with a `passive` directive; queries and screens that consume a passive read model are reported. Earlier compilers do not accept the `passive` directive. (#1129) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Decision 0133 defines `derive … = hash of …` as SHA-256 over UTF-8 text with lowercase hex output, for verifiers of generated secrets and fingerprints, never passwords. (part of #308) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Screen forms can continue with the submitted command's typed response — scalar, concept or record values — in both generated applications and the live Stage host. (part of #175) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Render given-only Translate specifications from private events into keyed read-model assertions, including read models in separate view slices. (part of #14) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): New applications can now select rendering configuration version 4, which renders running totals (`add`, `subtract`, `increment`, `decrement`) and `clear` in flat projections as model-bound read model attributes instead of a separate projection class. Version 3 applications keep their output unchanged. Moving an existing application from version 3 to 4 changes the observer identity of the newly eligible projections, so plan a rebuild or replay and remove the obsolete generated fluent projection files before using the new output; Stage does not migrate observer state or remove those files automatically. Older Stage versions refuse version 4. (part of #496) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): `$eventContext` projection mappings (`occurred`, `sequenceNumber`, `correlationId`, `eventSourceId`) now render as Chronicle `ToEventContextProperty` in `from`, `every` and `all` blocks and in nested properties, when the target type is compatible. Before, they were refused or dropped with STAGE-DEGRADE-002. Other event-context paths still degrade. (#876) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Reaction specifications that expect command invocations (`then invokes`) now render as generated specifications that assert the recorded commands. (#907) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Rendered applications can require Microsoft Entra ID sign-in for every endpoint, configured with `Cratis:Authentication` settings and off by default. See the [Entra ID sign-in guide](https://github.com/Cratis/Stage/blob/main/Documentation/guides/sign-in-with-entra-id.md). (part of #120) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Command fields that reference another entity can offer a searchable picker using an unambiguous modeled list query instead of requiring a raw identifier. (#744) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): New application scaffolds preapprove recently published @cratis packages in `.yarnrc.yml`. (#734) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Application chrome shows readable screen titles. (#736) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Actions and toolbar commands show humanized labels when the model gives none. (#737) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Command forms use the themed submit button labelled with the action, and toolbar commands keep their authored emphasis. (#738) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Tables show readable dates and booleans. (#739) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): The ui profile root option `showThemeSwitcher` controls the theme switcher. (#740) - **Chronicle** ([Release v19.120.0](https://github.com/Cratis/Chronicle/releases/tag/v19.120.0)): `storage.systemDatabaseName` (`Cratis__Chronicle__Storage__SystemDatabaseName`) sets the name the System event store's MongoDB databases are named by. It defaults to `_system`, giving `_system+es`, `_system+es+<namespace>` and `_system` for its read models, after `storage.databaseNamePrefix`. See [System event store database name](https://github.com/Cratis/Chronicle/blob/main/Documentation/hosting/configuration/storage.mdx). - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Reducer bodies can read the key as the read model's key type with `context.KeyAs<T>()`, for example `context.KeyAs<TalkId>()`, instead of parsing the text `Key` themselves. (#1076) - **AuthProxy** ([Release v2.42.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.42.0)): `GrpcListener` opens an HTTP/2-only listener an ingress that terminates TLS can hand gRPC calls to. It runs the same pipeline as the public listener, and gRPC streams on it have no request body limit. See https://github.com/Cratis/AuthProxy/blob/main/Documentation/configuration/grpc-services.md. - **AuthProxy** ([Release v2.42.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.42.0)): `Protocol: Http2` on a service endpoint forwards to a plain-HTTP backend over HTTP/2, which a gRPC backend needs. - **AuthProxy** ([Release v2.42.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.42.0)): `Default: true` on a service keeps the plain catch-all routes on it when other services are configured, so adding a service under its own path prefix no longer takes them away. - **Chronicle** ([Release v19.119.0](https://github.com/Cratis/Chronicle/releases/tag/v19.119.0)): Event type migrations can now address a property on every element of a collection, for example `DefaultValue(m => m.Days.Select(day => day.Activity), "work")`, written as the path `days[].activity`. `DefaultValue`, `RenamedFrom`, `MapValues`, `Split` and `Combine` apply per element in both directions and keep the collection. (#5614) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Validators can read `GetTenant()`, `GetCausedBy()` and `IsSystem()` for the current operation; reads that cannot be authorized fail closed as unauthorized. (#3582) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Validators can tell anonymous and system callers apart through `CausingIdentity.Anonymous` and `CausingIdentity.System`. (#3582) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Opt-in `Tenancy:StrictValidatorMembership` setting (default off, recommended on). (#3582) - **Choreography** ([Release v1.34.0](https://github.com/Cratis/Choreography/releases/tag/v1.34.0)): Job storage gains `IJobStepPlanStorage`, so storage providers can keep a job's planned steps outside the job state document. The MongoDB provider stores them in their own collection, in bounded batches (#172) - **Arc** ([Release v22.161.0](https://github.com/Cratis/Arc/releases/tag/v22.161.0)): WebSocket query handlers report each push as sent, skipped, unconfirmed or failed through the new `IWebSocketMessageSender` and `WebSocketSendResult`, so a skipped or unconfirmed write is no longer counted as a successful delivery. Existing custom `IWebSocketConnectionHandler` implementations still compile without changes. (#3648) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Webhook signing now rejects a message identifier that contains the `.` signing delimiter with a new public `InvalidWebhookMessageId` exception. (part of #5117) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Projection definitions now keep an immutable, content-addressed history each time they are registered, without changing which definition is active (part of #1058) - **Arc** ([Release v22.160.0](https://github.com/Cratis/Arc/releases/tag/v22.160.0)): Libraries can mark an assembly with `[assembly: ArtifactsRequireOptIn]` so a host serves its model-bound commands and queries only after `options.Artifacts.Include(assembly)` (#3621) - **Arc** ([Release v22.160.0](https://github.com/Cratis/Arc/releases/tag/v22.160.0)): The read-model parameter shapes a command `Handle` method can declare are documented, and the new Info diagnostic `ARCCHR0040` suggests a read-model parameter where `Handle` uses `IDecisionReads` or `DecisionRead<T>` directly (#3620) - **Arc** ([Release v22.160.0](https://github.com/Cratis/Arc/releases/tag/v22.160.0)): Allow restricting WebSocket query connections to trusted origins with `Cratis:Arc:Query:AllowedWebSocketOrigins`. - **AuthProxy** ([Release v2.41.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.41.0)): `RefreshTokenFamilyLifetime` per service under `ClientCredentials` (default 30 days, must be greater than zero) sets one absolute deadline for a chain of refreshed tokens. Refreshing never extends it and access tokens never outlive it. - **AuthProxy** ([Release v2.41.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.41.0)): A confirmation page (`link-confirm.html`) that a navigation to `/.cratis/link/{scheme}` now shows. Its form posts back with an antiforgery token. - **Fundamentals** ([Release v7.33.0](https://github.com/Cratis/Fundamentals/releases/tag/v7.33.0)): `GenerateValue.Sha256` returns the SHA-256 digest of a string's UTF-8 bytes as 64 lowercase hex characters, with shared conformance vectors, for fingerprints and verifiers of generated secrets (not passwords). (#1229) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Observers can be given their own retry policy for failed partitions through host configuration (#494) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Observers report when their running state last changed, exposed through the gRPC contract, the client and the Workbench (#3732) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Reactors registered explicitly can take their source event store from configuration (#3951) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Event sequence reads can be cancelled, including tail reads - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): `EventScenario` can redact events (#4749) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Event writes use the injected clock for occurrence and receipt times (#4930) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): The Workbench can ignore and restore recommendations, replay a single event source, show quarantine and failed-partition columns, and inspect the exact events of failed partition attempts (#5310) (part of #776) (part of #735) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Model-bound projections support stable identities (part of #4757) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Read models can be folded through an existing test store in tests (part of #5464) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Explicit event reads can opt in to erased-property metadata, so erased numeric and boolean values can be told apart from real zero and false values (part of #4620) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Constraint index repair retries, time budgets, cadence, poison threshold and memory caps can be configured in `chronicle.json` or environment variables (#4906) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): MVC actions and Razor Page handlers can report failed unit-of-work commits before writing results by enabling `ReportFailuresBeforeResponseStarts`; minimal APIs opt in with `WithUnitOfWork()` (#5339) ## Changed - **Stage** ([Release v5.4.0](https://github.com/Cratis/Stage/releases/tag/v5.4.0)): Queries over read models in named sinks now render instead of being refused with `STAGE-ESM-069`, and the rendered `appsettings.json` maps each declared read-model sink to the development MongoDB under `Cratis:MongoDB:Sinks:<name>:Server` - **Stage** ([Release v5.4.0](https://github.com/Cratis/Stage/releases/tag/v5.4.0)): Stage and rendered applications pin Cratis Arc 22.182.0, which reads read models from named sinks - **AI** ([Release v7.148.0](https://github.com/Cratis/AI/releases/tag/v7.148.0)): The rule index in `general.md`, the review-report rules and the code and security reviewer agents now treat an uncited behavior change on such a surface, or one that conflicts with a vector, as a blocking finding (#1087) - **AuthProxy** ([Release v2.57.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.57.0)): A bearer request that also carries a browser session is now refused as ambiguous with a `400` JSON error, and no verifier runs. Send either the bearer token or the browser session on a request, not both. (part of #256) - **AuthProxy** ([Release v2.57.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.57.0)): A bearer token supplied only as an `access_token` query parameter is now refused with `400` whether or not an `Authorization` header is present. (part of #256) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A projection whose children ordering is invalid now fails when it is registered: an unknown placement or direction, a sorted ordering without a sort property, or a sort property that is missing on the child or is an object or a collection - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A dictionary key read from event content cannot contain `.`, `[`, `]` or a null character, and cannot be empty or start with `$`. An event that produces such a key fails its partition, which shows in the Workbench, instead of writing to the wrong place - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): Dictionary keys and child sort values are formatted and compared the same way on every server, independent of its culture - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A plain set into a dictionary entry with a dynamic key now stores the dictionary's declared value type, for example a 32-bit integer for `Dictionary<string, int>`, instead of always a 64-bit integer. Counting and arithmetic on dictionary entries still use 64-bit integers - **AI** ([Release v7.147.0](https://github.com/Cratis/AI/releases/tag/v7.147.0)): The `cratis-session-handoff` skill now runs the handoff checker as its verification step and falls back to the manual checklist where the script is not installed (#1082) - **AuthProxy** ([Release v2.56.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.56.1)): Updated the page descriptions of the backend TLS, forwarded identity signing, telemetry and upgrade documentation for search results. - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): A Production whose spec is invalid, whose Secrets or required operators are missing, that asks to change its database or graph mode, or that asks for a Vault mode other than `None` is `Blocked` with a condition, and nothing is applied - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): The operator's chart grants it what reconciling a Production needs; cert-manager, and the Percona operator for managed databases, are prerequisites to install in the cluster - **Showrunner** ([Release v1.20.0](https://github.com/Cratis/Showrunner/releases/tag/v1.20.0)): Neo4j servers are read through the `ServerFile` settings, which need a Chronicle release that contains Cratis/Chronicle#5771 - **AuthProxy** ([Release v2.56.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.56.0)): A request that presents a bearer token together with a browser session cookie on a non-bearer route is refused as ambiguous. Bearer routes consult the bearer credential alone: a session cookie beside it is ignored, never validated and never forwarded, and a rejected bearer is never rescued by the cookie. If a client sends both on a non-bearer route, send only one credential. - **AuthProxy** ([Release v2.56.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.56.0)): Browser session recovery and sign-in access are limited to the matched local authentication endpoints. - **AuthProxy** ([Release v2.56.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.56.0)): Client-credentials access tokens are refused at or after their protected expiry. - **Screenplay** ([Release v6.9.0](https://github.com/Cratis/Screenplay/releases/tag/v6.9.0)): `clear` on a dictionary entry is now an error that points to `remove` - **Arc** ([Release v22.182.0](https://github.com/Cratis/Arc/releases/tag/v22.182.0)): Cratis Chronicle packages updated to 19.144.0. - **AI** ([Release v7.146.0](https://github.com/Cratis/AI/releases/tag/v7.146.0)): Lane handoffs in `cratis-orchestration-lanes` now follow the shared `cratis-session-handoff` template instead of a lanes-only reference, and the planner agent keeps a state note and hands off between phases instead of compacting after each phase. (#1081) - **Ante** ([Release v1.12.0](https://github.com/Cratis/Ante/releases/tag/v1.12.0)): Deployments behind an authenticating proxy must set `Cratis__Arc__TrustForwardedIdentityHeaders=true` before upgrading, or proxy sign-in stops working. Enable it only behind an ingress that strips and replaces client-supplied identity headers. Direct's DirectLobby must also enable this setting before upgrading its Ante image. See the [upgrade guide](https://github.com/Cratis/Ante/blob/main/Documentation/deployment.md#upgrade-forwarded-identity-authentication). - **Ante** ([Release v1.12.0](https://github.com/Cratis/Ante/releases/tag/v1.12.0)): With Arc 22.179.0, the Arc discovery endpoints for commands, queries, users, tenants and the identity-details schema require authentication outside Development. Set `Cratis__Arc__Introspection__RequireAuthentication=false` to keep anonymous access for external tooling. - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): Sign-in callbacks carry a short-lived signed snapshot and re-check the session before each send attempt. - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): The `ForwardedIdentitySigner` constructor keeps its previous overload, and a warning is logged when the HTTP context accessor is not registered. - **Chronicle.Kotlin** ([Release v7.7.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.7.0)): Requires `io.cratis:chronicle-contracts` 19.129.0 or later and a Chronicle Kernel 19.129.0 or later for graph projections. - **Chronicle.TypeScript** ([Release v6.60.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.60.0)): Requires `@cratis/chronicle.contracts` 19.129.0 or later and a Chronicle Kernel 19.129.0 or later for graph projections. - **AI** ([Release v7.145.0](https://github.com/Cratis/AI/releases/tag/v7.145.0)): The Definition of Done in `general.md`, the code reviewer agents and the review-report rules now refer to the Code Health floor; reviewers flag a touched file below 9.5 without a reported reason only together with the round's other findings, never in a round of its own (#1077) - **AI** ([Release v7.145.0](https://github.com/Cratis/AI/releases/tag/v7.145.0)): `codescene.md` links to the new rule and explains how to exclude generated files from Code Health scoring with a `.codescene` configuration (#1077) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): A bearer route can share its path prefix with the client-credentials route; AuthProxy dispatches by credential kind without fallback. (part of #257) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Every bearer-route refusal is answered with machine-readable JSON and a profile-aware challenge. (part of #256) - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Passthrough routes select their disposition before any token inspection and skip bearer authentication. - **AI** ([Release v7.144.0](https://github.com/Cratis/AI/releases/tag/v7.144.0)): The reverse-engineering skill scores fidelity on observable behavior (rules, flows, rejections and time rules from a given/when/then catalog), reports naming fidelity separately, and discounts names the running app exposes verbatim. A new `score-fidelity.mjs` script computes the scores from a filled catalog (part of #1056) - **AI** ([Release v7.144.0](https://github.com/Cratis/AI/releases/tag/v7.144.0)): The reverse-engineering skill makes reading the managed assemblies a standard intake step for owned .NET targets, and requires boundary and server-side rejection probes for every command, with a coverage gate before synthesis (part of #1056) - **AI** ([Release v7.144.0](https://github.com/Cratis/AI/releases/tag/v7.144.0)): The reverse-engineering skill seeds backdated data to find time-rule boundaries, and puts today-relative rules into query performer bodies that Stage renders instead of comments (part of #1056) - **AI** ([Release v7.144.0](https://github.com/Cratis/AI/releases/tag/v7.144.0)): The reverse-engineering skill requires every discovered specification to run before a model counts as validated, and covers API discovery, run-smoke routes, computed display values and pipeline boards (part of #1056) - **cli** ([Release v3.124.0](https://github.com/Cratis/cli/releases/tag/v3.124.0)): The CLI bundles Screenplay 6.0.0, including its MCP server, which now offers the `migrate` tool. Component `outlet` is now `slot`, `navigation topbar|sidebar` is now `outlet <name> of navigation`, and a module's `navigation sidebar extends` is now `outlet sidebar extends`. The old forms are refused with a message naming the migration, so run `screenplay migrate <model root> --from 5 --to 6` once before editing a model written for Screenplay 5. See [Migrating a model](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/migration.md). - **cli** ([Release v3.124.0](https://github.com/Cratis/cli/releases/tag/v3.124.0)): `cratis screenplay validate` reports a State Change command nothing issues (`PLAY0533`) as a warning by default, so a model generated from backend code with `cratis screenplay generate` now validates with one warning per command. - **cli** ([Release v3.124.0](https://github.com/Cratis/cli/releases/tag/v3.124.0)): The CLI bundles Stage 5.0.0, built on Screenplay 6.0.0 and Scene 5.1.0, and `cratis run` uses the `cratis/stage:5.0.0` image by default. A screen toolbar renders as Scene outlet buttons, and routed slots keep the selected item, tab and filters in the address. - **cli** ([Release v3.124.0](https://github.com/Cratis/cli/releases/tag/v3.124.0)): `cratis render --target cratis` generates applications on Arc 22.176.0 and Chronicle 19.142.0, and `cratis screenplay generate` uses the Arc source adapter 22.176.0 and Screenplay generation 0.20.0. - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): The reverse engineering and legacy extraction skills lead with systems you own and migrations; rebuilds from public material alone are labeled plausible. (#1066) - **AI** ([Release v7.143.0](https://github.com/Cratis/AI/releases/tag/v7.143.0)): The reverse engineering skill now probes the full query surface beyond the UI, confirms surprising results with a second probe, tests field combinations and one past each limit, and adds a first-validation checklist, a recipe for reaching a running Stage application and a fallback when the Screenplay MCP server is unavailable. (#1056) - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): ESM 41.0 (graph handlers that iterate an event collection) is listed as released; 42.0 is the claimed, unreleased version. - **Screenplay** ([Release v6.8.0](https://github.com/Cratis/Screenplay/releases/tag/v6.8.0)): A toolbar button that opens another slice now names that slice's screen as its navigation target in the UI contract, so it can be resolved. - **Chronicle** ([Release v19.148.0](https://github.com/Cratis/Chronicle/releases/tag/v19.148.0)): Closed streams use exact ids on SQL storage (#5744) - **Chronicle** ([Release v19.148.0](https://github.com/Cratis/Chronicle/releases/tag/v19.148.0)): Key-store erasure fails closed when the fence is degraded, and standalone MongoDB pending erasure honours topology (part of #4979) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Rendered environment keys name the configuration each one sets, including the AuthProxy configuration of provider keys (#1026) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Application triggers and the reactions they start are refused individually with `STAGE-ESM-024`; the rest of the model runs (#1030) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Models on the ESM 37 pair run in the sandbox; commands that use the command clock are refused individually and specifications in their scope are refused (#1033) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): A form field that uses `choose from query` becomes a plain input and reports the warning `STAGE-SCENE-FORM-004` instead of refusing the model (#1029) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): The trusted-proxy documentation states that only the sign-in proxy's addresses may be trusted and that the proxy must remove client-supplied principal headers - **AI** ([Release v7.142.1](https://github.com/Cratis/AI/releases/tag/v7.142.1)): The engineering profile now carries a rule that agents verify locally instead of relying on CI/CD, and push and open a PR only once it is confirmed ready. - **AI** ([Release v7.142.1](https://github.com/Cratis/AI/releases/tag/v7.142.1)): Orchestrators now brief sub-agents to commit verified work to a shared branch and never open PRs, so each repository gets one consolidated PR and CI/CD is not overloaded. - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): Capability gates can admit an endpoint that accepts both personal access tokens and verified OAuth credentials through server-owned endpoint metadata; other gated endpoints stay PAT-only. - **Arc** ([Release v22.177.0](https://github.com/Cratis/Arc/releases/tag/v22.177.0)): Arc and Arc.Core no longer expose internals to the MCP package; the seams it needs are small public extension points. - **Stage** ([Release v5.1.2](https://github.com/Cratis/Stage/releases/tag/v5.1.2)): In the Stage sandbox, modeled users accept the selected user only from the local machine: requests from other addresses, or with a host name other than `localhost`, `127.0.0.1` or `[::1]`, have their identity headers removed. Set `Stage:Sandbox:UsersAllowRemote` to `true` (for Docker, `-e Stage__Sandbox__UsersAllowRemote=true`) to accept a selected user from other machines. - **Stage** ([Release v5.1.2](https://github.com/Cratis/Stage/releases/tag/v5.1.2)): The Stage sandbox no longer counts as development when its host environment is Production, unless `Stage:Development` is set to `true`, so modeled users do not start in a Production host. - **Ante** ([Release v1.11.0](https://github.com/Cratis/Ante/releases/tag/v1.11.0)): In `DurableRequired` mode, only a verified success triggers the onboarding handoff. A failed or unavailable outcome lookup, a timeout, or an unknown mode no longer allows an automatic redirect or manual continue. (#194) - **Ante** ([Release v1.11.0](https://github.com/Cratis/Ante/releases/tag/v1.11.0)): Startup refuses invalid `DurableRequired` settings: missing keys, blank audience, proof lifetime outside 10-300 seconds, unknown hosts, duplicate key ids, or weak or private keys. (#194) - **Ante** ([Release v1.11.0](https://github.com/Cratis/Ante/releases/tag/v1.11.0)): Host proofs are rejected when their not-before time is in the future at the time the event is recorded. (#194) - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Key stores without fencing support, such as Vault, log a startup warning only; their erasure stays pending until every member advertises the full guarantee (part of #4979) - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Encryption key erasure now requires a MongoDB replica set with majority read and write concerns; a standalone MongoDB cannot provide the linearizable fence and erasure stays pending (part of #4979) - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Encryption key compare-and-swap retries use bounded random jitter (part of #4979) - **Ante** ([Release v1.10.0](https://github.com/Cratis/Ante/releases/tag/v1.10.0)): Accepted-identity facts carry the identity issuer, so a host can resolve a federated identity without a provider-name lookup; duplicate issuer or provider-key claims are treated as no evidence (#196) - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): A sink directive changes the render input hash through a new `cratis-realization:sinks` profile input; a model without sinks renders with the same input hash as before - **Stage** ([Release v5.1.0](https://github.com/Cratis/Stage/releases/tag/v5.1.0)): Stage is pinned to Chronicle 19.144.0 (client packages, the bundled kernel image and the rendered scaffold) and Screenplay 6.4.0 - **Chronicle** ([Release v19.146.0](https://github.com/Cratis/Chronicle/releases/tag/v19.146.0)): The federation listener now authenticates by pin only, with the federation service reachable on it and nowhere else - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The render and gap-fill skill tells renderers to hash the sink metadata (`Sinks`, `ReadModelSinks`, `GraphSinks`) into their render input, because a sink change leaves the semantic revision unchanged. - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): The model review checklist gains a sinks check: every declared sink is used and names differ ignoring case. - **AI** ([Release v7.141.0](https://github.com/Cratis/AI/releases/tag/v7.141.0)): Every Screenplay example is checked against Screenplay 6.4.0, and the UI composition evaluation expects an accent in the selected theme rather than in `appearance` (`PLAY0929`). - **AuthProxy** ([Release v2.53.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.53.0)): Incoming `baggage` and `Correlation-Context` headers are no longer forwarded to backends. (#152) - **AuthProxy** ([Release v2.53.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.53.0)): When telemetry export is on, request URLs are redacted before export: query strings are never recorded, invitation paths are recorded as `/invite/{token}`, and tenant-bearing host and URL attributes are dropped from spans and HTTP client metrics. Log scopes and framework request logs are not exported. (#152) - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): `cratis-screenplay-ui-composition` splits `design system`, `theme` and `ui profile`: the design system is the contract, a theme implements it, and `appearance` keeps only `color scheme`; `accent`, `corners` and `font` are deprecated (`PLAY0929`). - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): `cratis-screenplay-model-authoring` documents the extended `ui-profiles` read tool and the new `propose-ast` node kinds. The tool count is unchanged. - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): `cratis-screenplay-toolchain` and `cratis-screenplay-render-and-gap-fill` list the new diagnostics and say Stage keeps reading the deprecated appearance members until it adopts the resolved theme. - **AI** ([Release v7.140.0](https://github.com/Cratis/AI/releases/tag/v7.140.0)): The pinned Screenplay tool and `screenplay-contract.json` move to 6.3.0. - **Showrunner** ([Release v1.19.0](https://github.com/Cratis/Showrunner/releases/tag/v1.19.0)): The kernel configuration of a Production sets `Cratis__Chronicle__Storage__ConnectionDetailsFile` and `Cratis__Chronicle__Sinks__Configurations__<name>__ConnectionDetailsFile` to the files mounted under `/run/secrets/chronicle`, and never the connection value itself (part of #99) - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): The Kernel refuses a read model that names an unknown sink at registration, naming the read model and the sink. Without a `sinks` section nothing changes - **Chronicle** ([Release v19.144.0](https://github.com/Cratis/Chronicle/releases/tag/v19.144.0)): A read model moved to another sink is replayed into it, following the definition evolution policy; read models whose sink is unchanged are not replayed - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): A `ui profile` without a `theme` line uses the design system's `default theme`. Its `appearance` keeps only `color scheme`; `accent`, `corners` and `font` now warn with `PLAY0929` and still read. Move each value into the profile's theme: the accent as a palette entry, the corner style as the `radius.control` value and the font as the `font.sans` value. - **Screenplay** ([Release v6.3.0](https://github.com/Cratis/Screenplay/releases/tag/v6.3.0)): The executable semantic model still defers UI configuration, now including the design system (`PLAY0269`); read it through the syntax tree or the resolver. - **Chronicle.TypeScript** ([Release v6.59.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.59.0)): Connection strings now track whether `skipTlsValidation` was set explicitly: an explicit `false` always requires certificate validation, an explicit `true` skips it and is preserved when the connection string is rebuilt, and an omitted value keeps today's default (skip) in this release. The startup warning for skipped validation against a non-loopback server now says any certificate is accepted and to set `skipTlsValidation=false` once the server certificate is trusted. - **Screenplay** ([Release v6.1.0](https://github.com/Cratis/Screenplay/releases/tag/v6.1.0)): `screenplay test`, `export`, `diff` and `rename` open a folder with its `.screenplay/identities.json` when present, so the CLI and MCP report the same semantic identities for the same model. `export` and `diff` refuse a folder whose sources no longer match its identity file; `test` falls back to address-derived ids in that case. - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): Breaking: Stage compiles Screenplay 6 and renders with Scene 5. Migrate models with `screenplay migrate <model root> --from 5 --to 6`; the old outlet and navigation region forms are refused with a message naming the migration. - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): Breaking: a screen toolbar becomes a Scene `core:outletItems` element of outlet buttons instead of `core:toolbar`. A placement of primary, secondary or quiet becomes the button's emphasis, and other presentation values are reported as `STAGE-SCENE-TOOLBAR-002`. Consumers that read the scene JSON or depend on frozen scene bytes must update. - **Stage** ([Release v5.0.0](https://github.com/Cratis/Stage/releases/tag/v5.0.0)): Stage builds on Scene 5.1.0, Chronicle 19.142.0, Arc 22.176.0 and Screenplay generation 0.20.0. An icon-only toolbar item becomes an icon-only outlet button that keeps its title as its accessible name. - **AI** ([Release v7.139.0](https://github.com/Cratis/AI/releases/tag/v7.139.0)): The Screenplay skills teach Screenplay 6: regions are slots with a role (`page`, `pane` or `panel`) and routing, and outlets are item lists of actions, filters, tabs, stats or navigation that lower levels inherit, extend or override, with `hide`, `before`/`after` and `contribute to`. (#1043) - **AI** ([Release v7.139.0](https://github.com/Cratis/AI/releases/tag/v7.139.0)): The skills teach placement: a slice's screen says what it `fits`, and a hook opens it automatically unless it names `opens dialog`, `opens drawer` or `opens in slot`. They also cover `runs`, `for item`, `enabled when`, `choose from query … show …` and `show … from <element>.selection`. - **AI** ([Release v7.139.0](https://github.com/Cratis/AI/releases/tag/v7.139.0)): The modeling lifecycle skill tells agents to run `screenplay migrate <model root> --from 5 --to 6` as its own change before editing a model written for an older Screenplay. - **AI** ([Release v7.139.0](https://github.com/Cratis/AI/releases/tag/v7.139.0)): No skill example uses `navigation topbar|sidebar`, `contributes`, a feature or module `toolbar`, a component `outlet` for a region, or `destination outlet` any more. Every Screenplay example is checked against Screenplay 6.0.0. - **Chronicle** ([Release v19.142.1](https://github.com/Cratis/Chronicle/releases/tag/v19.142.1)): Saved sequence queries and query folders can now only be changed or deleted by their owner or an administrator, in every storage provider. The Workbench keeps a refused change open instead of discarding it. - **Chronicle** ([Release v19.142.1](https://github.com/Cratis/Chronicle/releases/tag/v19.142.1)): On SQL Server, stored identifiers such as tokens, authorizations, clients, scopes and saved query owners are compared by their exact spelling. - **Arc** ([Release v22.176.0](https://github.com/Cratis/Arc/releases/tag/v22.176.0)): Arc depends on Cratis.Screenplay 6.0.0, Screenplay generation 0.20.0 and Chronicle 19.142.0. With earlier releases, an application that resolved Screenplay 6 failed on startup with a `TypeLoadException` for `NavigationRegionKind`. Upgrade Arc and Chronicle together. (part of Cratis/StudioIssues#1327) - **AuthProxy** ([Release v2.51.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.51.0)): Forwarded headers are ignored by default when no trusted proxies are configured; the previous allow-all behavior for an empty list is removed. `TrustAny` remains an explicit opt-in and the platform forwarded-headers switch cannot bypass the setting. (#278) - **AuthProxy** ([Release v2.51.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.51.0)): AuthProxy logs a startup warning when running with no trusted proxies, and a rate-limited warning when requests carry forwarded headers that are being ignored. (#278) - **AuthProxy** ([Release v2.51.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.51.0)): The Aspire integration defaults to `TrustAny` for local runs only, unless trusted-proxy settings are configured explicitly; published deployments use the secure default. (#278) - **AuthProxy** ([Release v2.51.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.51.0)): The trusted-proxies documentation now describes the upgrade steps and settings. (#278) - **Chronicle** ([Release v19.142.0](https://github.com/Cratis/Chronicle/releases/tag/v19.142.0)): `Cratis.Chronicle.Testing` and the other Chronicle packages that reference Screenplay now depend on Cratis.Screenplay 6.0.0. With the earlier releases, an application that resolved Screenplay 6 failed with a `TypeLoadException` for `NavigationRegionKind` in every in-process command pipeline. Upgrade Cratis.Arc to the release built on Screenplay 6 at the same time. (part of Cratis/StudioIssues#1327) - **Screenplay.Generation** ([Release v0.20.0](https://github.com/Cratis/Screenplay.Generation/releases/tag/v0.20.0)): The generation packages depend on Cratis.Screenplay 6.0.0. Applications that generate Screenplay models move to Screenplay 6 together with this release. (part of Cratis/StudioIssues#1327) - **Showrunner** ([Release v1.17.0](https://github.com/Cratis/Showrunner/releases/tag/v1.17.0)): The Stage Manager operator can read and write Secrets, ConfigMaps, Services, Deployments, Ingresses, NetworkPolicies and pod metrics only in the namespaces in `managedNamespaces`, through a Role and RoleBinding in each, instead of in every namespace of the cluster. Its ClusterRole now only covers Performances, Productions and events. When you upgrade, list every namespace you create Performances in under `managedNamespaces` and make sure those namespaces exist, or Performances outside the release namespace can no longer be prepared. (#94) - **Chronicle** ([Release v19.141.0](https://github.com/Cratis/Chronicle/releases/tag/v19.141.0)): The client now distinguishes an explicitly configured TLS validation setting from an omitted one, and keeps that choice through connection string parsing, building and credential helpers. - **Chronicle** ([Release v19.141.0](https://github.com/Cratis/Chronicle/releases/tag/v19.141.0)): An explicit setting to validate certificates always takes precedence over a setting to skip validation. - **Chronicle** ([Release v19.141.0](https://github.com/Cratis/Chronicle/releases/tag/v19.141.0)): A warning is logged at startup when certificate validation is skipped, and it is not logged when TLS is disabled. - **Chronicle** ([Release v19.141.0](https://github.com/Cratis/Chronicle/releases/tag/v19.141.0)): Documentation covers configuring validation explicitly, development certificate behaviour, and the planned change of the default in the next major release. - **Arc** ([Release v22.175.0](https://github.com/Cratis/Arc/releases/tag/v22.175.0)): Mixed or ambiguous installations refuse startup without modifying the service collection, and token-authenticated callers still cannot issue tokens. - **AI** ([Release v7.138.1](https://github.com/Cratis/AI/releases/tag/v7.138.1)): The shell write guard allows a few more read-only inspection forms that reference protected files: `git -C <dir>` with exactly `status --short`, `rev-parse HEAD`, `branch --show-current` or `tag --list <pattern>`, `git diff --numstat`, and `rg -n`. Run `cratis ai update` to pick up the hook change (part of #1024) - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Breaking: component `outlet <name>` is now `slot <name>`, and `destination outlet <name>` is now `destination slot <name>`. - **Screenplay** ([Release v6.0.0](https://github.com/Cratis/Screenplay/releases/tag/v6.0.0)): Breaking: `navigation topbar|sidebar` is now `outlet <name> of navigation`, `<slot> contributes <Point>` is now `outlet <Point> of navigation`, and a feature or module `toolbar <name>` is now `outlet <name> extends`. Buttons in a - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Breaking: `Outlet` is now `Slot`, `primaryOutlet` is `primarySlot`, `DestinationKind.Outlet` is `DestinationKind.Slot`, and the outlet diagnostics and shell remaps (`OutletRemap`, `ShellOutletMove`, `ShellOutletAction`) are renamed to slot names. CSS classes and data attributes follow (`scene-slot-*`, `data-scene-slot`). - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Breaking: navigation is stored as outlets of kind navigation, and its edits and diagnostics work on outlets. The toolbar's items are an outlet of actions. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Breaking: `Opens` replaces `ActionPresentation`, with the values automatic, none (run directly), modal, drawer and slot. - **Scene** ([Release v5.0.0](https://github.com/Cratis/Scene/releases/tag/v5.0.0)): Stored documents with the old outlet, navigation, toolbar or presentation shape are upgraded on read without overwriting user values, and the C# engine refuses to save a document that is not in the new shape. - **Arc** ([Release v22.174.0](https://github.com/Cratis/Arc/releases/tag/v22.174.0)): With a selector set, requests that cannot be classified (no routed endpoint, unknown or late endpoints, endpoints reassigned after the gate) are refused, and a selector with any rule matching no endpoint stops startup. - **Arc** ([Release v22.174.0](https://github.com/Cratis/Arc/releases/tag/v22.174.0)): Removed the dynamic-proxy generation assembly from the internals visible to test code in Arc.Core; specs use explicit adapters instead. - **Chronicle** ([Release v19.139.0](https://github.com/Cratis/Chronicle/releases/tag/v19.139.0)): The documentation tutorials, concepts and compliance pages use language-neutral wording - **Arc** ([Release v22.173.1](https://github.com/Cratis/Arc/releases/tag/v22.173.1)): Personal access token packages no longer expose internals to a proxy-generation assembly - **Chronicle** ([Release v19.138.0](https://github.com/Cratis/Chronicle/releases/tag/v19.138.0)): Version 2 unique constraints distinguish a null component from an absent one, so different key tuples no longer collide (#4384) - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Principal identities are qualified by issuer in audit actors and saved sequence query owners; existing stored owners keep their format. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): `DeleteEncryptionKey` and the other legacy key operations now fail with `PermissionDenied`, naming the stores that are not covered, instead of succeeding for only some stores. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Administrator checks registered by the host with a scoped or transient lifetime are resolved from the calling request's services. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): `Grpc.AspNetCore.Server` is now a direct dependency of the kernel gRPC assembly, and `Chronicle.Testing` and `Chronicle.XUnit.Integration` declare it for their embedded kernel. - **Chronicle** ([Release v19.136.2](https://github.com/Cratis/Chronicle/releases/tag/v19.136.2)): An observer's subscription, its reader scope, and event types are handed between grains of the same silo as they are instead of being copied through JSON, and a job step shares one copy of the event types its observer reads instead of keeping its own. A wave of thousands of job steps, such as the catch-up of an observer with thousands of partitions, held a copy of the same few dozen event types and subscription per step. - **Chronicle** ([Release v19.136.2](https://github.com/Cratis/Chronicle/releases/tag/v19.136.2)): The converter between dynamic objects and JSON and the type formats it uses are shared instead of created again for every grain that needs one. Each job step grain held four of them, each with its own tables. - **Arc** ([Release v22.172.1](https://github.com/Cratis/Arc/releases/tag/v22.172.1)): The personal access token authority and recovery-epoch ports document the linearizable, revoke-ordered read requirement and fail-closed behavior for adapters that cannot provide it. (part of #3713) - **Chronicle** ([Release v19.136.1](https://github.com/Cratis/Chronicle/releases/tag/v19.136.1)): The MongoDB failed partition storage writes what it is given in one bulk request instead of a round trip per partition. - **cli** ([Release v3.123.0](https://github.com/Cratis/cli/releases/tag/v3.123.0)): The CLI bundles Screenplay 5.11.0, which adds `user <name> ["<display name>"] [as <Persona>, ...]` for the people a development or test session acts as, and Stage 4.226.0. `cratis run` uses the `cratis/stage:4.226.0` image by default. - **cli** ([Release v3.123.0](https://github.com/Cratis/cli/releases/tag/v3.123.0)): With Stage 4.226.0, a sandbox started with `Stage__Sandbox__Users=true` lists the model's users at `/.cratis/users` for Lens. It is off unless set, and Stage refuses to start with it outside development. - **Arc** ([Release v22.171.1](https://github.com/Cratis/Arc/releases/tag/v22.171.1)): Verified caller resolution accepts tool sources only through the host's verified credential path, and refuses caller metadata a tool supplies itself (part of #3709) - **cli** ([Release v3.122.0](https://github.com/Cratis/cli/releases/tag/v3.122.0)): The CLI bundles Screenplay 5.10.0 (ESM v41) and Stage 4.225.1, and `cratis run` uses the `cratis/stage:4.225.1` image by default. Models can now declare graphs, read them with typed `match` queries and draw one edge per item with `foreach`. - **cli** ([Release v3.122.0](https://github.com/Cratis/cli/releases/tag/v3.122.0)): Applications rendered by `cratis render` pin Arc 22.168.0 and Chronicle 19.134.0. Own public events are written to a separate `<Project>.Events.Contracts` project, and guarded actions render as `core:guarded-action`. - **cli** ([Release v3.122.0](https://github.com/Cratis/cli/releases/tag/v3.122.0)): `cratis render` still admits models up to ESM v32, so a model that uses graphs is validated and run, not rendered. - **cli** ([Release v3.122.0](https://github.com/Cratis/cli/releases/tag/v3.122.0)): The CLI's own Chronicle client stays on 19.113.2: newer Chronicle releases need an administrator login to manage applications and users, which is tracked in #557. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): Arc's discovery endpoints (`/.cratis/users`, `/.cratis/tenants`) now answer in the Docker sandbox instead of failing with a 500. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): While users are on, the single server-selected persona is off and Stage trusts the identity headers the tool sends. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): Stage refuses to start when `Stage:Sandbox:Users` is on and Stage is not in development, or together with `Stage:Sandbox:ForwardedIdentity`. - **Stage** ([Release v4.226.0](https://github.com/Cratis/Stage/releases/tag/v4.226.0)): Stage takes Screenplay 5.11.0. - **AI** ([Release v7.138.0](https://github.com/Cratis/AI/releases/tag/v7.138.0)): The Screenplay contract pin moves to 5.7.0, so example checks recognize the graph diagnostics `PLAY0862`–`PLAY0877`. - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): A request whose session or token is bound to another tenant than the one it addresses is refused with 403 before tenant selection, and nothing is forwarded (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): When tenant selection is configured, a tenant addressed by host, sub-host or route is confirmed against the person's memberships before forwarding; route addressing does not lock the browser to one tenant (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): A selection cookie issued for another resource or environment is discarded and the membership is confirmed again (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): On bearer routes, a token naming another tenant than the host, sub-host or route addresses is refused with 403; `Specified` and `Default` tenants do not override the token tenant (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): Starting an ordinary sign-in after an abandoned registration or invitation clears the pending flow instead of failing (#253) - **AuthProxy** ([Release v2.48.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.48.0)): AuthProxy logs a startup warning when a shared data protection key ring is configured without `CredentialBinding:Resource` (#253) - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): The state sent to a reducer client is written straight to JSON, and the state it returns is read straight from JSON, without first building a tree of nodes of the whole document. Strings, guids and dates are read and written without a node each, and dictionaries without reflection, which roughly halves what converting a large state allocates and keeps the whole document from being held a second time. - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): A schema's type is read once instead of on every value converted. - **Chronicle** ([Release v19.135.0](https://github.com/Cratis/Chronicle/releases/tag/v19.135.0)): `IExpandoObjectConverter` gains `WriteJson` and a `ToExpandoObject` that reads UTF-8 JSON, both with default implementations, so existing implementations keep working. - **Stage** ([Release v4.225.0](https://github.com/Cratis/Stage/releases/tag/v4.225.0)): Chronicle 19.134.0, which carries the per-item graph mapping, and Screenplay 5.10.0. - **Stage** ([Release v4.225.0](https://github.com/Cratis/Stage/releases/tag/v4.225.0)): The checked-in framework name catalog, the planner byte pins and the corpus conformance matrix for those packages. - **Stage** ([Release v4.224.1](https://github.com/Cratis/Stage/releases/tag/v4.224.1)): The specification runner guide says the keyed query may be snapshot or `observable`. - **Chronicle** ([Release v19.134.0](https://github.com/Cratis/Chronicle/releases/tag/v19.134.0)): The graph changeset builder maps each item through the existing resolvers by giving it the event content with the collection replaced by that item, so counters, identity and every sink behave unchanged and operations stay idempotent on replay. - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): Screenplay 5.9.0. - **Stage** ([Release v4.224.0](https://github.com/Cratis/Stage/releases/tag/v4.224.0)): The renderer refuses a model that declares a graph query with `STAGE-ESM-068`, because it does not render one yet and a rendered application would have no endpoint for it. - **Stage** ([Release v4.223.0](https://github.com/Cratis/Stage/releases/tag/v4.223.0)): `STAGE-ESM-065` now says the kernel projects the graph while Stage does not read it back. - **Stage** ([Release v4.223.0](https://github.com/Cratis/Stage/releases/tag/v4.223.0)): A node key and an edge identity are no longer mapped as properties, which the kernel refuses; counters (`add`, `increment`) are refused with a precise message. - **Screenplay** ([Release v5.8.0](https://github.com/Cratis/Screenplay/releases/tag/v5.8.0)): Variable-length paths, `or`, ranges, functions and aggregates are refused in a graph query with `PLAY0885`, and `foreach` over an event collection follows separately (#1170). - **Chronicle** ([Release v19.132.1](https://github.com/Cratis/Chronicle/releases/tag/v19.132.1)): `IProjectionChangesetNotifier` gains `HasSubscribers()` (additive grain contract change) and `IReducerPipeline.Reduce` gains an optional `createNotification` parameter. - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): When the kernel restores a subscription for another instance of a client that an observer is already serving, it now adds that instance without repeating the full subscription recovery, which reduces storage load during rollouts (#5648) - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): Serverless observer registration checks deployment fingerprints only when they are needed, and its validation errors name only the URL scheme of receiver endpoints (#5118) - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): Concepts, events, projections, read models, hosting configuration and code-analysis guides have clearer introductions, examples and cross-links. - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): The model-bound projections guide now lists what the attributes cannot express (every-mappings on join-only events, join-context values, one type reused with different mappings) and shows the equivalent declarative projection for each. (#4757) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): On capability ports, the verified caller is the authorization principal: `[Authorize]`, role and tenant-membership checks, `ICurrentPrincipalAccessor` and Chronicle causation see its subject. Roles and membership still come from your application (#3731) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): Chronicle records a verified caller under its own identity; a caller acting on behalf of a user records that user in `OnBehalfOf` (#3731) - **Chronicle** ([Release v19.131.3](https://github.com/Cratis/Chronicle/releases/tag/v19.131.3)): Namespace names are case-insensitive within an event store for every storage provider: where a SQL or in-memory store kept namespaces that differ only in case, the casing that holds its own data is used, the other's data stays in place, and a warning is logged (#5699) - **Showrunner** ([Release v1.16.0](https://github.com/Cratis/Showrunner/releases/tag/v1.16.0)): Built on Chronicle 19.131.0, which supports audience tags and filtered subscriptions. - **Ante** ([Release v1.9.0](https://github.com/Cratis/Ante/releases/tag/v1.9.0)): Receipts, revocations, reservations and the other replies a lobby publishes to the host outbox are addressed to the operator that sent the originating request. Requests carrying no `from` fall back to `Ante:OperatorAudience`, then to unaddressed. - **AuthProxy** ([Release v2.47.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.47.0)): The tenancy guide links to the organization, workspace and namespace vocabulary - **Arc** ([Release v22.169.2](https://github.com/Cratis/Arc/releases/tag/v22.169.2)): Capability hosting now refuses to start with `CapabilityHostingHasNoCredentialInstallation` when the verified-caller resource, environment, resource audience or verifier is missing or ambiguous, instead of starting a host that refuses every caller (#3726) - **Stage** ([Release v4.222.0](https://github.com/Cratis/Stage/releases/tag/v4.222.0)): Stage compiles with Screenplay 5.7.0 and renders against Arc 22.168.0 and Chronicle 19.129.0. - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): Sign-in callbacks to a service with forwarded-identity signing configured carry the forwarded-identity envelope, and are not sent if signing fails (#262) - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): When forwarded-identity signing is configured, on-behalf, invitation, link and sign-in notification calls use the backend TLS client settings, and outside the `LocalDevelopment` profile they must use HTTPS - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): When forwarded-identity signing is configured, the client-credentials, capability, tenant and user-token verification endpoints must use HTTPS outside the `LocalDevelopment` profile, checked at startup and again before each call - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): The forwarded-identity startup report lists these back-channel flows - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): Upgrade: in a signed deployment, serve every endpoint named in a startup validation error over HTTPS - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): An observer registers its alert reminder only while there is something to report, and the first tick is spread over the following minute so reminders no longer tick in the same second (#5685) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): The repeat move of the System event store databases is versioned 19.128.2, so it runs on the next 19.x release instead of never (#5689) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): A projection registration that repeats one that just completed is answered at once instead of queueing behind subscription work and timing out against its own grain (#5688) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): The observer interface gains a page method under a new version, so rolling upgrades inside the major keep working. - **Arc** ([Release v22.168.1](https://github.com/Cratis/Arc/releases/tag/v22.168.1)): Shared pages explain ideas without assuming .NET and link each supported language. - **AuthProxy** ([Release v2.45.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.45.0)): Outside the `LocalDevelopment` profile, every hop that receives signed forwarded identity (service backends, signed service frontends and tenant-list endpoints) must use HTTPS with a configured client certificate, or AuthProxy refuses to start. Deployments without forwarded-identity signing are unaffected (part of #251) - **Chronicle.Elixir** ([Release v3.20.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.20.0)): Requires `cratis_chronicle_contracts` 19.129 or later, and a Chronicle 19.129 or later kernel for graph projections. - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Inbound forwarded-identity envelope headers are removed before AuthProxy forwards a request, and a request is not sent when signing is configured but fails (part of #139) - **AuthProxy** ([Release v2.44.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.44.0)): Bearer routes set the service header from the route's own service instead of passing a caller-supplied value through (part of #139) - **Ante** ([Release v1.8.0](https://github.com/Cratis/Ante/releases/tag/v1.8.0)): A provisioning confirmation is accepted only from the host store that delivered the invitation; self-service registrations may be confirmed by any configured host store. Confirmations before acceptance, for held, declined or revoked attempts, or repeated confirmations are ignored (#217) - **Chronicle** ([Release v19.129.0](https://github.com/Cratis/Chronicle/releases/tag/v19.129.0)): Chronicle now uses Screenplay 5.7.0 to parse projection declarations (part of #5672) - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): The Arc for TypeScript skills, profile text and product ledger no longer call the packages an unpublished source preview; they install from npm. - **AI** ([Release v7.137.0](https://github.com/Cratis/AI/releases/tag/v7.137.0)): Project setup now starts from `npm install` instead of cloning the repository or packing tarballs. - **Arc.TypeScript** ([Release v1.0.0](https://github.com/Cratis/Arc.TypeScript/releases/tag/v1.0.0)): The documentation, README, SECURITY and package READMEs now describe published packages instead of a source preview. - **AI** ([Release v7.136.1](https://github.com/Cratis/AI/releases/tag/v7.136.1)): Issues the corpus instructs agents to create or edit must stay generic: they never name a customer or a customer's customer. - **Choreography** ([Release v2.2.1](https://github.com/Cratis/Choreography/releases/tag/v2.2.1)): The NuGet dependencies are updated: Cratis.Chronicle 19.128.0, Cratis.Arc 22.167.0, Cratis.Fundamentals 7.33.1 and Cratis.Specifications 5.2.3, plus SharpCompress 0.50.8. The net8 and net9 System.Text.Json pin moves to 9.0.22 to match Cratis.Fundamentals, which unblocks the package update workflow. - **Choreography** ([Release v2.2.1](https://github.com/Cratis/Choreography/releases/tag/v2.2.1)): The JavaScript development dependencies are updated, including TypeScript 7, Vitest 5 and jsdom 30. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): Page delivery needs a Chronicle 19.122 kernel or later. Older kernels keep delivering one event source at a time to the same handlers, and deferring a batch is refused against them. - **Chronicle.TypeScript** ([Release v6.58.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.58.0)): `ReactorScenario` refuses reactors with batch methods with `UnsupportedReactorOperation` instead of skipping their events. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): Page delivery needs a Chronicle 19.122 kernel or later. Older kernels keep delivering one event source at a time to the same handlers, and deferring a batch is refused against them. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): A failing per-event reactor handler now stops its event source at that event, so Chronicle retries from the failing event instead of a later position. - **Chronicle.Kotlin** ([Release v7.6.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.6.0)): An observer that handled nothing now reports no position instead of sequence number 0, so the first event of a stream is no longer counted as handled after a failure. - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): Generated applications now pin Cratis Arc 22.166.1, Chronicle 19.125.1, Fundamentals 7.33.1, Cratis.Specifications 5.2.3, `@cratis/components` 4.40.0 and `@cratis/showrunner.notes` / `@cratis/showrunner.notes.react` 1.0.0, alongside the latest releases of their other packages. - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): Generated specifications keep their fully qualified test names under Cratis.Specifications 5.2. - **Stage** ([Release v4.221.0](https://github.com/Cratis/Stage/releases/tag/v4.221.0)): Stage itself runs on the same framework releases, with the bundled Chronicle kernel at 19.125.1 and `Cratis.Showrunner.Notes` 1.14.0. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): Page delivery needs a Chronicle 19.122 kernel or later. Older kernels keep delivering one event source at a time to the same handlers, and deferring a batch is refused against them. - **Chronicle.Elixir** ([Release v3.19.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.0)): A failed reactor or reducer partition now reports the event before the failure as its last handled event, so Chronicle retries from the failing event instead of skipping past it. A failed reduction no longer writes a partial read model. - **Arc.Kotlin** ([Release v7.11.1](https://github.com/Cratis/Arc.Kotlin/releases/tag/v7.11.1)): Queries and observable queries now apply the same caller severity limit as commands: the `X-Allowed-Severity` header can relax validation up to the configured maximum (Warning by default), and allowing errors needs the same explicit server-side opt-in that commands use. - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Client connection and token diagnostics no longer include endpoint addresses or underlying error text in logs and exceptions. - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Chronicle metrics can now use the shared `cratis.chronicle.*` naming convention. Existing metric names stay the default; set `Telemetry:MetricNames=Convention` to switch, or `Both` while migrating dashboards (part of #4459) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): In `Both` mode each measurement is recorded under both names, so do not sum legacy and convention series (part of #4459) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Recording kernel metrics no longer allocates on the append and observer delivery paths (part of #4459) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Re-registering an unchanged reactor or reducer no longer rewrites its stored definition, which reduces MongoDB load when many client replicas connect at once (part of #5514) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): When another instance of the same client connects, an observer that is already running now adds it as a subscriber without repeating the full subscription setup, which greatly reduces storage load during rolling deployments (part of #5514) - **Showrunner** ([Release v1.15.0](https://github.com/Cratis/Showrunner/releases/tag/v1.15.0)): Box Office also subscribes the product to the operator's `TenantRegistered` and `TenantClosing`. - **AI** ([Release v7.134.0](https://github.com/Cratis/AI/releases/tag/v7.134.0)): The `csharp-refactoring` skill now also triggers when renaming public C# types. (part of #452) - **AI** ([Release v7.133.0](https://github.com/Cratis/AI/releases/tag/v7.133.0)): Agent-harness images (`cratis/ai-agents`, `cratis/ai-agents-claude`, `cratis/ai-agents-pi` and `cratis/ai-agents-copilot`) now support native Linux arm64 alongside amd64. (#1023) - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The installer adds `.eventmodelers/` to the project `.gitignore`. When a project already has a `.gitignore`, the installer keeps it and adds only the entries that are missing. If a later rule would make `.eventmodelers/` tracked again, the installer adds the entry again and confirms with git that the configuration is ignored. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The local eventmodelers configuration files are readable only by their owner. Every install run tightens the permissions on existing files. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The bundled agent prompts stage files by name and never stage `.eventmodelers/`, `.env` files, keys or other credentials. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The `/connect` skill creates the configuration with owner-only permissions. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The agent runner passes its prompt on standard input instead of on the command line, and it fails when the prompt cannot be delivered or the agent exits with an error. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): The template `docker-compose.yml` binds every published port to `127.0.0.1`. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The installer adds `.eventmodelers/` to the project `.gitignore`. When a project already has a `.gitignore`, the installer keeps it and adds only the entries that are missing. If a later rule would make `.eventmodelers/` tracked again, the installer adds the entry again and confirms with git that the configuration is ignored. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The local eventmodelers configuration files are readable only by their owner. Every install run tightens the permissions on existing files. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The bundled agent prompts stage files by name and never stage `.eventmodelers/`, `.env` files, keys or other credentials. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The `/connect` skill creates the configuration with owner-only permissions. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The agent runner passes its prompt on standard input instead of on the command line, and it fails when the prompt cannot be delivered or the agent exits with an error. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): The template `docker-compose.yml` binds every published port to `127.0.0.1`. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The installer adds `.eventmodelers/` to the project `.gitignore`. When a project already has a `.gitignore`, the installer keeps it and adds only the entries that are missing. If a later rule would make `.eventmodelers/` tracked again, the installer adds the entry again and confirms with git that the configuration is ignored. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The local eventmodelers configuration files are readable only by their owner. Every install run tightens the permissions on existing files. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The bundled agent prompts stage files by name and never stage `.eventmodelers/`, `.env` files, keys or other credentials. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The `/connect` skill creates the configuration with owner-only permissions. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The agent runner passes its prompt on standard input instead of on the command line, and it fails when the prompt cannot be delivered or the agent exits with an error. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): The template `docker-compose.yml` binds every published port to `127.0.0.1`. - **Prompter** ([Release v0.14.16](https://github.com/Cratis/Prompter/releases/tag/v0.14.16)): Answers that list many items now name the main ones, always including the core products, and point to the cited page for the rest instead of trying to fit every item. "List all Cratis products" still gets the complete list (#107) - **Prompter** ([Release v0.14.16](https://github.com/Cratis/Prompter/releases/tag/v0.14.16)): The production eval report now includes each answer's text, category and refusal status, and shows the answers of failing cases. Eval artifacts are kept for one day, the repository maximum (#140) - **Chronicle.Kotlin** ([Release v7.5.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.5.0)): `chronicle-contracts` is raised to 19.125.2, the first release with the `Compensate` RPC. A compensation of the event at sequence number 0 reads as not a compensation, because the wire cannot tell the two apart. - **Screenplay** ([Release v5.5.0](https://github.com/Cratis/Screenplay/releases/tag/v5.5.0)): Align Library samples, Monaco completions and hovers, VS Code highlighting and MCP guidance with ESM v37 clocks, calendars and time zones. (part of #1125) - **Chronicle.Elixir** ([Release v3.18.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.18.0)): `cratis_chronicle_contracts` is raised to `~> 19.125`, the first release with the `Compensate` RPC. A compensation of the event at sequence number 0 reads as `nil`, because the wire cannot tell the two apart. - **Chronicle.TypeScript** ([Release v6.57.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.57.0)): `@cratis/chronicle.contracts` is raised to 19.125.2, the first release with the `Compensate` RPC. A compensation of the event at sequence number 0 reads as not a compensation, because the wire cannot tell the two apart. - **Arc** ([Release v22.167.0](https://github.com/Cratis/Arc/releases/tag/v22.167.0)): `FromRequestModelBinder` and `FromRequestModelBinderProvider` are marked `[RequiresUnreferencedCode]` and `[RequiresDynamicCode]`, so a trimmed or NativeAOT application that constructs them gets the warning at its own call site. `[FromRequest]` binding is part of MVC, which a trimmed publish turns off with `CratisArcControllersSupport`. (#3680) - **Arc** ([Release v22.167.0](https://github.com/Cratis/Arc/releases/tag/v22.167.0)): `AddIdentityProvider<TProvider>()` and `AddIdentityProvider(Type)` now declare that they need the provider's public constructors, so registering a provider with `AddIdentityProvider<MyProvider>()` is safe to trim. `AddIdentityProvider(ITypes)` is marked `[RequiresUnreferencedCode]` because it finds the provider at runtime. (part of #3675) - **Stage** ([Release v4.220.0](https://github.com/Cratis/Stage/releases/tag/v4.220.0)): The Stage host and rendered applications host their Orleans silo through `Cratis.Choreography` 2.2.0 instead of `Cratis.Orleans`. Rendered `Program.cs` calls `AddCratisChoreography`, and generated state machines and workflows use the `Cratis.Choreography` namespaces. Stage now targets Chronicle 19.125.0, Arc 22.166.0 and Fundamentals 7.33.1. (#967) - **Stage** ([Release v4.220.0](https://github.com/Cratis/Stage/releases/tag/v4.220.0)): Choreography 2.x silos cannot join a cluster with 1.x silos. Settle running jobs and upgrade every Stage host or rendered application in a cluster together; do not run a mixed cluster. See [Stage rendering](https://github.com/Cratis/Stage/blob/main/Documentation/reference/stage-rendering.md). - **Stage** ([Release v4.220.0](https://github.com/Cratis/Stage/releases/tag/v4.220.0)): Generated command specifications no longer call the obsolete `UseDecisionReads()` on typed command scenarios, which now select decision reads automatically. - **AI** ([Release v7.132.1](https://github.com/Cratis/AI/releases/tag/v7.132.1)): The quality gate now blocks the end of a turn that has changes when `jq` is missing, and says how to install `jq` or how to opt out with `CRATIS_HOOKS_SKIP_GATE=1`. Pattern scanning prints a one-time notice per session instead of turning itself off without a word. Run `cratis ai update` to get the updated hooks. (#1008) - **Arc** ([Release v22.166.1](https://github.com/Cratis/Arc/releases/tag/v22.166.1)): `AddArcAuthorizationPolicy<TPolicy>()` now tells the trimmer to keep the policy type's public constructors, so a policy registered in a trimmed or Native AOT application can still be created, and the registration no longer raises trim analysis warnings. (part of #3677) - **Chronicle** ([Release v19.125.1](https://github.com/Cratis/Chronicle/releases/tag/v19.125.1)): Startup patching runs on Cratis Choreography 2.1.0. When a newer kernel starts while an older one holds the patch manager, the manager moves to the newer kernel before patching, and an older kernel never patches a store a newer kernel has already patched. - **Chronicle** ([Release v19.125.1](https://github.com/Cratis/Chronicle/releases/tag/v19.125.1)): A kernel that starts while a pod is lost, or while a patch outlasts the grain call timeout, keeps asking until patching completes instead of failing its start, for up to 15 minutes. - **Chronicle** ([Release v19.125.1](https://github.com/Cratis/Chronicle/releases/tag/v19.125.1)): Patches no longer declare `Down()`; nothing ever called it, and rolling back still means restoring a backup taken before the upgrade. - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): The Screenplay event model board now uses `@cratis/event-models` 0.322.3, the release that ships the spacing and text-size options, so boards in the VS Code extension and the MCP App can offer them (#418) - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): A `rule <predicate>` line placed directly in a command or concept body now gets a hint to declare `validate` and put the rule on an indented line beneath it, in both the C# and TypeScript compilers; other unknown directives keep the generic message (#1137) - **AI** ([Release v7.132.0](https://github.com/Cratis/AI/releases/tag/v7.132.0)): Protected file names are matched case-insensitively, so differently cased names on case-insensitive file systems are protected too. (#1009) - **AI** ([Release v7.132.0](https://github.com/Cratis/AI/releases/tag/v7.132.0)): The secrets guard no longer suggests copying `.env.example` to `.env`; create `.env` with the edit tools or ask the user instead. (#1009) - **Montage** ([Release v0.0.1](https://github.com/Cratis/Montage/releases/tag/v0.0.1)): Montage depends on `Cratis.Choreography`, `Cratis.Choreography.Chronicle` and `Cratis.Choreography.Storage.MongoDB` 2.1.1 instead of the `Cratis.Orleans` packages, and on Chronicle 19.123.1. - **Montage** ([Release v0.0.1](https://github.com/Cratis/Montage/releases/tag/v0.0.1)): Job code uses the `Cratis.Choreography` namespaces in place of `Cratis.Orleans`. - **Montage** ([Release v0.0.1](https://github.com/Cratis/Montage/releases/tag/v0.0.1)): The Arc NuGet packages and the `@cratis/arc` frontend packages move to 22.165.2, so the generated TypeScript proxies and the frontend agree. - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): `IEventSequence` in the Chronicle kernel gains a versioned `Compensate` method; the existing methods are unchanged, so mixed-version clusters keep working during a rolling upgrade. - **Chronicle** ([Release v19.125.0](https://github.com/Cratis/Chronicle/releases/tag/v19.125.0)): Clients other than .NET read `CompensationFor` as `0` for events that are not compensations, because the wire field has no presence. Regenerate the client contracts to see it. - **Prompter** ([Release v0.14.15](https://github.com/Cratis/Prompter/releases/tag/v0.14.15)): Answers about Chronicle now draw on the .NET client documentation by default. Elixir, Kotlin/Java, Go and Chronicle TypeScript client pages are only used when the question or an earlier message in the thread names that language - **Prompter** ([Release v0.14.15](https://github.com/Cratis/Prompter/releases/tag/v0.14.15)): Requests to write generic code or to set up tools that are not part of Cratis, such as nginx, Marten or EventStoreDB, are now declined as out of scope (part of #136) - **Arc** ([Release v22.166.0](https://github.com/Cratis/Arc/releases/tag/v22.166.0)): Run CI actions on current runtimes while preserving version-specific NuGet pull request comments and duplicate suppression. (#3642) - **Stage** ([Release v4.218.0](https://github.com/Cratis/Stage/releases/tag/v4.218.0)): Stage now uses Chronicle 19.117.0 and Screenplay 5.3.1. - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): A configured Authentication:Authority is now used to obtain client tokens (through OIDC discovery). To keep the previous behaviour, remove Authority from the client configuration. (part of #4350) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): New PostgreSQL read-model tables for schemas whose key is spelled `ID` get a single `ID` key column; existing tables are unchanged (#4590) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Publish workflows for the Kotlin and TypeScript clients validate the version input before publishing. - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Workflow inputs are passed to scripts through environment variables. - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Chronicle's telemetry setup (`AddChronicleTelemetry`) no longer exports Orleans runtime and grain-call spans by default; set `Cratis:Chronicle:Telemetry:OrleansTracing=true` to restore them. Trace context propagation remains enabled, and the public `AddChronicleInstrumentation()` still adds the Orleans sources. With Orleans tracing off, untraced grain calls, the default and including appends, are 4-10x cheaper, and sampled calls are about 20% cheaper. (#4607) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Verify-mode SQL replicas now refuse to start until the `chronicle_sink_cycle_receipts` table exists and is current for every event store and namespace. Run `--migrate-only` with the new version before upgrading Verify replicas. Run it again for a namespace created later. (#5526) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Document JSON naming policies for object-valued migration defaults and value maps, including migration hashes and mixed-client rollout considerations. (#5581) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Changed the MongoDB health check to read the driver's cluster state without taking a pooled connection, and storage operations now retry when the MongoDB connection wait queue is full (part of #5514) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): CI test retries now stop when a retry fails exactly the same tests as the attempt before it, instead of re-running against the same stuck fixture (part of #4057) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Chronicle now depends on Cratis.Orleans 1.34.0, Cratis.Fundamentals 7.32.0, Cratis.Arc 22.156.4 and Microsoft.Orleans 10.4.2 or later (#5532) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): MongoDB index provisioning also creates the index of the new `job-step-plans` collection on the jobs database (#5532) - **Arc** ([Release v22.165.2](https://github.com/Cratis/Arc/releases/tag/v22.165.2)): `Cratis.Chronicle`, `Cratis.Chronicle.AspNetCore` and `Cratis.Chronicle.Testing` move from 19.117.1 to 19.123.1. - **Arc** ([Release v22.165.2](https://github.com/Cratis/Arc/releases/tag/v22.165.2)): `Microsoft.Orleans.Reminders` moves from 10.4.0 to 10.4.2, which the new Chronicle packages require. - **AI** ([Release v7.131.5](https://github.com/Cratis/AI/releases/tag/v7.131.5)): The documentation skills now judge a page by what a reader who did not write it can understand and do. Each skill has a distinct role: writing and structure, engineering docs, examples, retrieval-friendly pages, and voice. Guidance asks for source-backed claims, runnable tasks with visible checkpoints and recovery paths, examples that state their source and what has been verified, and claim-preserving rewrites. (part of #973) - **AI** ([Release v7.131.5](https://github.com/Cratis/AI/releases/tag/v7.131.5)): A new reader-review reference describes an uncoached review by a fresh reader, the smallest repair for each confusion, and keeping comprehension, source, compile, runtime and deployed evidence separate. (part of #973) - **AI** ([Release v7.131.5](https://github.com/Cratis/AI/releases/tag/v7.131.5)): The documentation rule covers Platform and component naming, independently adoptable components, stable identifiers and a pragmatic use of Diátaxis. The write-documentation prompt reads the applicable skills before drafting. (part of #973) - **Chronicle** ([Release v19.123.1](https://github.com/Cratis/Chronicle/releases/tag/v19.123.1)): The kernel's dependencies on the Cratis Orleans packages are now the renamed Cratis Choreography packages, together with the Cratis Fundamentals, Cratis Arc and Microsoft Orleans versions they require. - **Chronicle** ([Release v19.123.1](https://github.com/Cratis/Chronicle/releases/tag/v19.123.1)): Job and job step identifiers now live in a different namespace, so `IObserver.ReportHandledEvents`, `ReportHandledEventsBatch` and `CaughtUp` have a different wire identity than in 19.123.0. A job that is running while silos of the two releases share a cluster can fail on those calls, so let running jobs settle before you upgrade. - **Chronicle** ([Release v19.123.1](https://github.com/Cratis/Chronicle/releases/tag/v19.123.1)): The grain compatibility check can be waived for a named baseline release through `.github/grain-compatibility-waivers.txt`, and 19.123.0 is waived. - **Chronicle** ([Release v19.123.1](https://github.com/Cratis/Chronicle/releases/tag/v19.123.1)): `verify-consumer-smoke.sh` reads `.github/consumer-smoke-waivers.txt` and, for a version listed there, reports a failure to start beside the published Arc packages as a warning instead of failing the publish. The standalone Testing scenario is never waived, and 19.123.1 is the only version listed. - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): A `Provide()` return value no longer replaces a read-model `Handle` parameter keyed by `[LookUpBy<TKeyProvider>]`; the command fails with `InvalidLookUpBy` naming the provider instead. The string form `[LookUpBy("Property")]` is unchanged (#3587) - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): Arc now depends on Cratis.Fundamentals and Cratis.Metrics.Roslyn 7.33.1 - **Components** ([Release v4.39.5](https://github.com/Cratis/Components/releases/tag/v4.39.5)): Filter components (`CheckboxListFilter`, `ColumnFilterMenu`, `FilterPanel`, `RangeHistogramFilter`) now mark their root with `data-cratis-component`, so the component picker can identify them (part of #478) - **Components** ([Release v4.39.5](https://github.com/Cratis/Components/releases/tag/v4.39.5)): Component guides connect setup and surface choices to a command/query screen, with clearer field validity, selection, query states and recovery guidance (part of #480) - **Chronicle.Kotlin** ([Release v7.4.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v7.4.0)): The client now depends on `io.cratis:chronicle-contracts` 19.123.0 (was 19.70.0). - **Chronicle.Go** ([Release v0.12.0](https://github.com/Cratis/Chronicle.Go/releases/tag/v0.12.0)): Contracts are now generated from Chronicle 19.123.0, and decision guards recognize the pinned release. - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Update NuGet, frontend and browser-verifier dependencies to their latest patch releases, and pin generated applications' frontend packages to the matching versions. (#950) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Generated applications and the Stage host now use Chronicle 19.116.0. - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Commands with a validation rule Stage cannot render (an unknown rule kind or an undefined severity) are now denied: the generated command always fails validation with an explanatory error, the render reports STAGE-DEGRADE-002 (refused under the strict profile), and specifications that invoke the command are skipped with STAGE-ESM-011 instead of failing at run time. (part of #810) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Validation rules are generated beside their owning validators instead of in a shared validation-bodies file. (part of #850) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Scene guarded actions and interactions resolve guard field types from their attachment data and preserve native conditions, fallbacks and subjects; malformed or unresolved guards refuse rendering. (part of #209) - **AI** ([Release v7.131.1](https://github.com/Cratis/AI/releases/tag/v7.131.1)): Screenplay guidance teaches that a specification covers only its own slice, using `then invokes` for commands its reactions invoke, and explains the `PLAY0815`/`PLAY0816` diagnostics (#926) - **AI** ([Release v7.131.1](https://github.com/Cratis/AI/releases/tag/v7.131.1)): Screenplay guidance covers Screenplay 5.1.0 action subjects (`for item`, `for screen`), composite-key syntax and outbound Translate publications (#947) - **AI** ([Release v7.131.1](https://github.com/Cratis/AI/releases/tag/v7.131.1)): Contract-sync dispatches and scheduled contract checks no longer run the full product verification job; pull requests, pushes and manual runs still do (#987) - **Chronicle.TypeScript** ([Release v6.56.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.56.0)): Updated `@cratis/chronicle.contracts` to 19.123.0. - **Screenplay** ([Release v5.3.2](https://github.com/Cratis/Screenplay/releases/tag/v5.3.2)): Reduce repeated attachment-reference discovery while preparing MCP authoring proposals, without reusing file-access decisions. (#1104) - **Chronicle** ([Release v19.122.0](https://github.com/Cratis/Chronicle/releases/tag/v19.122.0)): Registration fails with a named error when an event type would reach more than one method of a reactor, when a batch method lacks `[Observes<TEvent>]` or returns events, or when a reducer mixes a batch method with per-event methods. - **Chronicle** ([Release v19.121.1](https://github.com/Cratis/Chronicle/releases/tag/v19.121.1)): Schema generation now refuses conflicting protection on concept-typed properties, as it already does on other properties. An `[Encrypted]` scope on the property that differs from the scope on its concept type fails with a clear error naming the property and both scopes, and so does combining `[PII]` and `[Encrypted]` across the property and its concept type. (part of #5623) - **Screenplay** ([Release v5.3.1](https://github.com/Cratis/Screenplay/releases/tag/v5.3.1)): Updated frontend dependency patch versions across the Screenplay JavaScript packages. (#1145) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Improved the standalone C# command/query-to-React guide and clarified command validation, observable query results, authorization and recovery. (#3615) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Chronicle now notifies a dropped client's observers immediately so another client can take over without waiting for the watchdog, and a client departure no longer tears down a webhook-served observer. A silently lost client can still receive events until it learns of the takeover; delivery is not exactly-once. (part of #5508) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Updated Workbench dependencies to their latest patch releases. - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): `cratis init` now writes the Copilot diagnose prompt to `.github/prompts`, the folder VS Code discovers by default. Existing prompts under `.github/copilot/prompts` are kept unchanged, and a prompt folder linked into the managed AI corpus is never written to. (#539) - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): Update workflow actions to their Node24 releases. (part of #540) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Admissible compilation now excludes a persona that references an excluded policy, together with its invitations and the specifications that use it as a caller, instead of refusing the whole model. (part of #1106) - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Faster local builds of the Screenplay repository: the compiler's inline specs now compile in their own spec assembly, so editing the compiler or a spec no longer rebuilds the other. The published `Cratis.Screenplay` package is unchanged. (#1128) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Rendering now admits Screenplay models at ESM semantic version 34; specifications that expect `then invokes` are still refused with STAGE-ESM-016 for the selected slices. (#905) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): STAGE-ESM-017 names the from block, event and mapping it rejects. (#735) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Destination-less produced events report STAGE-ESM-053 rather than STAGE-ESM-006. (#629) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Rendered C# now carries XML documentation and no longer leaves unused usings in rendered specifications. (#497) - **Stage** ([Release v4.216.0](https://github.com/Cratis/Stage/releases/tag/v4.216.0)): Generated specification projects n - **Chronicle** ([Release v19.120.0](https://github.com/Cratis/Chronicle/releases/tag/v19.120.0)): On its first start the kernel moves the System event store's existing `System+es`, `System+es+<namespace>` and `System` databases to the configured name, copying every collection with its indexes and then dropping the old database. Take a backup before upgrading, and upgrade every node at once rather than as a rolling upgrade: a node on an older version keeps writing to the old databases. - **Chronicle** ([Release v19.120.0](https://github.com/Cratis/Chronicle/releases/tag/v19.120.0)): A kernel older than this release no longer finds the System event store's data once it has been moved. To keep the old names, set `storage.systemDatabaseName` to `System` before upgrading; nothing is moved then. - **Chronicle** ([Release v19.120.0](https://github.com/Cratis/Chronicle/releases/tag/v19.120.0)): An event store can no longer be named the same as the System event store's databases (`_system` by default). - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Event-model boards now preserve authored intent and prose, command-rule prose, and specification Given/When/Then prose. (part of #419) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Board spacing and text-size preferences are now global VS Code user settings, shared live across open boards and editor recreation. (part of #418) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): The Release build regenerates `screenplay-contract.json` only when the tool or its assemblies change or the file is missing, and no longer rewrites an unchanged contract. (#1112) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Releases now run the native editor repair checks on Linux, Windows and macOS before publishing packages. (#1031) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Admissible compilation now excludes a top-level trigger that fails to bind, together with what depends on it, instead of refusing the whole model. (part of #1106) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Record decisions for per-language implementation bodies and explicit identity fixtures in specifications. (part of #1086) (part of #1097) - **Chronicle** ([Release v19.119.0](https://github.com/Cratis/Chronicle/releases/tag/v19.119.0)): `IEventMigrationPropertyBuilder<TTarget, TSource>` has a new `DefaultValue` overload for the elements of a collection. Custom implementations of the interface must add it. - **Choreography** ([Release v2.0.0](https://github.com/Cratis/Choreography/releases/tag/v2.0.0)): Packages are renamed: `Cratis.Orleans` is now `Cratis.Choreography`, and `Cratis.Orleans.Storage`, `Cratis.Orleans.Storage.MongoDB`, `Cratis.Orleans.Storage.Sql` and `Cratis.Orleans.Chronicle` follow as `Cratis.Choreography.Storage`, `.Storage.MongoDB`, `.Storage.Sql` and `.Chronicle`. Replace the package references and change `Cratis.Orleans` to `Cratis.Choreography` in your namespaces and `using` directives. - **Choreography** ([Release v2.0.0](https://github.com/Cratis/Choreography/releases/tag/v2.0.0)): `AddCratisOrleans*` entry points are now `AddCratisChoreography*` (for example `AddCratisChoreographyMongoDBJobsStorage`), and `CratisOrleansOptions` is now `CratisChoreographyOptions`. - **Choreography** ([Release v2.0.0](https://github.com/Cratis/Choreography/releases/tag/v2.0.0)): Every grain interface and Orleans codec carries its new full name on the wire, so silos running 1.x and 2.x cannot share a cluster. Upgrade all silos of a cluster together; a rolling upgrade across this release is not supported. - **Choreography** ([Release v2.0.0](https://github.com/Cratis/Choreography/releases/tag/v2.0.0)): Stored state keeps its existing identifiers: the `[GrainType]` names, the workflow journal grain id, the workflow wake reminder name and the SQL migration id are unchanged, so existing grain state, reminders and migration history still resolve. - **Choreography** ([Release v2.0.0](https://github.com/Cratis/Choreography/releases/tag/v2.0.0)): The repository moves to https://github.com/Cratis/Choreography and the documentation to https://www.cratis.io/choreography/. - **Arc** ([Release v22.161.0](https://github.com/Cratis/Arc/releases/tag/v22.161.0)): MongoDB `Observe`, `ObserveSingle` and `ObserveById` declare the document members they read, so trimmed and Native AOT applications keep them; calling them from your own unannotated generic methods now reports IL2091 until you annotate the type parameter. (part of #2856) - **Arc** ([Release v22.161.0](https://github.com/Cratis/Arc/releases/tag/v22.161.0)): Updated supported .NET servicing dependencies, SourceLink metadata tooling, and the xUnit adapter to current patches. (#3649) - **AI** ([Release v7.131.0](https://github.com/Cratis/AI/releases/tag/v7.131.0)): Release trains are the default way to ship: one train and one pull request per repository. Split only for a named major awaiting confirmation, an urgent security fix authorized in writing, or an accepted outsider issue, which ships promptly on its own release (#995) - **AI** ([Release v7.131.0](https://github.com/Cratis/AI/releases/tag/v7.131.0)): Review rounds review each branch whole once, then review glue only, using a review log of reviewed heads so certified items are not reviewed again (#995) - **AI** ([Release v7.131.0](https://github.com/Cratis/AI/releases/tag/v7.131.0)): Flaky tests never hang a release: CI gate guidance classifies a failure quickly, reruns a confirmed flake once and otherwise quarantines it with a tracked issue, never silently and never for security or critical-path coverage (#995) - **AI** ([Release v7.131.0](https://github.com/Cratis/AI/releases/tag/v7.131.0)): Agents decide what the repository or research can answer and ask the user only about human-only matters or undecided product choices (#995) - **AI** ([Release v7.131.0](https://github.com/Cratis/AI/releases/tag/v7.131.0)): Browser use closes only the pages and browsers an agent opened itself, one browser per lane (#995) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Decision 0020 now treats the `Cratis-Key-Id` header as advisory: receivers verify a webhook against their trusted key set and never reject a delivery on the header alone. (part of #5117) - **Components** ([Release v4.39.3](https://github.com/Cratis/Components/releases/tag/v4.39.3)): `ToolbarButton`, `ToolbarFanOutItem`, `ToolbarFolder`, `ToolbarGroup`, `ToolbarLayout`, `ToolbarSection` and `ToolbarSeparator` mark their root element with `data-cratis-component` (part of #478) - **AI** ([Release v7.130.0](https://github.com/Cratis/AI/releases/tag/v7.130.0)): C# verification guidance and the backend quality gates run evaluated specification executables, including Stage-rendered specifications through VSTest, instead of prescribing `dotnet test` and `dotnet format`. Run `cratis ai update` to pick up the updated hooks. (#961) - **Arc** ([Release v22.160.0](https://github.com/Cratis/Arc/releases/tag/v22.160.0)): Arc binds `ArcOptions` from configuration without reflection, so every Arc setting in `appsettings.json` and environment variables is honored in trimmed and Native AOT applications with the same values as before. Option objects replaced by a subclass with its own properties still use the stock reflection binder, which is not supported under Native AOT. See [Configuration](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/configuration/index.md). (#3597) - **Components** ([Release v4.39.2](https://github.com/Cratis/Components/releases/tag/v4.39.2)): `InputTextField` and `TextAreaField` mark their root element with `data-cratis-component`, and `CalendarField`, `DropdownField`, `MultiSelectField` and `NumberInputField` are identified through the marked component they render (part of #478) - **Components** ([Release v4.39.1](https://github.com/Cratis/Components/releases/tag/v4.39.1)): Components now builds and tests against `@cratis/arc` and `@cratis/arc.react` 22.156.2, and the strict public-type check no longer lists any upstream exception. Every public subpath passes as a strict (`skipLibCheck: false`) Bundler and NodeNext consumer under TypeScript 6 and 7. Strict consumers on an earlier `@cratis/arc.react` release can still see `TS2503` for `JSX` in the command and dialog subpaths and should use 22.156.2 or later. (#176) - **Components** ([Release v4.39.1](https://github.com/Cratis/Components/releases/tag/v4.39.1)): JavaScript Build checks the published package from one build per compiler and restores one shared Yarn package cache instead of every job saving its own, so pull-request validation needs fewer runner minutes; every check still runs and still fails Build. (part of #453) - **AuthProxy** ([Release v2.41.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.41.0)): Starting a credential link now requires a confirmed `POST` with a valid antiforgery token; methods other than `GET` and `POST` get `405`. The link callback is refused when the account or provider differs from the one that confirmed the link, or when the session is missing, unless the provider is configured with `ResponseMode: FormPost` and answers with a form post, which is matched through the protected flow state. - **AuthProxy** ([Release v2.41.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.41.0)): Refresh tokens issued by earlier versions keep working until their own expiry. During a rolling upgrade, replicas still on the earlier version reject new refresh tokens, so clients may need to request a new token with their credentials. - **Fundamentals** ([Release v7.33.0](https://github.com/Cratis/Fundamentals/releases/tag/v7.33.0)): Dependencies are updated to their latest patch releases: System.Text.Json 9.0.22 for .NET 8 and 9, the Microsoft.Extensions dependency injection packages 9.0.22 for .NET 9, the Microsoft.Extensions dependency injection and hosting abstractions to 10.0.14, typescript-eslint 8.72.1 in the ESLint configuration, and the JavaScript development tooling. (#1248) - **Prompter** ([Release v0.14.4](https://github.com/Cratis/Prompter/releases/tag/v0.14.4)): Eval results list the case's own configured terms that failed (a missing required term, or a forbidden term marked with `!`), and the production eval summary shows them in a new "Term misses" column (part of #103) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Reading from the System event store now requires administrator access; API registration against it is refused for every caller - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): MongoDB indexes can be pre-provisioned and verified before deployment with schema commands; runtime index creation is unchanged (part of #5284) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Documentation describes the existing retention of replay revert containers and that orphaned replay collections are not cleaned up automatically (part of #5268) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): MongoDB bulk redaction no longer overwrites already-redacted events, and revisions are no longer appended to events that are being redacted concurrently (part of #3920) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Observer hot paths allocate less per batch (#5471) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Observer list streams cache running-state timestamps per subscription instead of re-reading them on every emission (#5479) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Kernel tracing no longer records health checks and keep-alives (#4614) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Test scenarios discover reducers once per store and code analyzers bind once per invocation (#5464) (#5467) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Code generation runs only when its inputs change (#5466) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Wire-compatibility checks no longer compare against releases newer than the release being cut, or the newest release on a maintenance branch (#4312) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Local Chronicle images are tagged with local-only names so they no longer shadow the published image (#3795) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Workbench adopts the shared checkbox list filter (#5441) - **Chronicle** ([Release v19.116.0](https://github.com/Cratis/Chronicle/releases/tag/v19.116.0)): Documentation consolidates event migration ## Fixed - **AuthProxy** ([Release v2.57.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.57.0)): An expired AuthProxy-issued client-credentials token is now refused with `401 invalid_token` and is no longer retried through the external bearer validator. (part of #257) - **AI** ([Release v7.147.1](https://github.com/Cratis/AI/releases/tag/v7.147.1)): The handoff checker accepts "Files to read" entries that add a note after the path, and no longer warns about commands such as `gh run view 123` listed under unread results (#1086) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): A replay that cannot begin now says why. The job's failure reads `Could not begin observer replay: ProjectionNotFound` when the projection does not exist and `Could not begin observer replay: Failed` when establishing the replay threw, instead of the uninformative `Unknown` (#5761) - **Chronicle** ([Release v19.150.0](https://github.com/Cratis/Chronicle/releases/tag/v19.150.0)): Updating Cratis.Choreography to 2.3.1 finalizes a replay job that was stuck starting - **Chronicle** ([Release v19.148.1](https://github.com/Cratis/Chronicle/releases/tag/v19.148.1)): Fix observer registrations and keep-alives being refused behind a load balancer with several silos (#5766) - **AuthProxy** ([Release v2.56.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.56.1)): Telemetry is now sanitized before it is queued for export. Sensitive values in spans, logs and failed native HTTP client requests are redacted, and a failure while redacting a span no longer exports the unredacted data. (#289) - **Arc** ([Release v22.182.1](https://github.com/Cratis/Arc/releases/tag/v22.182.1)): The proxy generator no longer fails with a NotSupportedException when generating proxies for assemblies targeting .NET 11; optionality of properties and parameters is now read directly from nullable-reference metadata. - **Arc** ([Release v22.180.0](https://github.com/Cratis/Arc/releases/tag/v22.180.0)): Embedded Screenplay documents now build in projects using the .NET 11 SDK, whose newer compiler previously failed with ReferencesNewerCompiler. (part of #3762) - **AI** ([Release v7.144.1](https://github.com/Cratis/AI/releases/tag/v7.144.1)): The shell-write guard now lets you stage and commit the files `cratis ai update` creates, including `git add -v`, `git add --all`, `git -C <dir> add` and `git commit --message`, while content writes into managed files stay refused. Run `cratis ai update` to get the fix (part of #1076) - **AI** ([Release v7.144.1](https://github.com/Cratis/AI/releases/tag/v7.144.1)): Compound read-only commands that list managed folders, search with `rg --files` and check disk space with `df -h` are no longer blocked (part of #1076) - **AI** ([Release v7.144.1](https://github.com/Cratis/AI/releases/tag/v7.144.1)): The credential guard no longer treats listing source folders with secret-like names (such as `Credentials` or `UserTokens`) through `git ls-files`, `git status` or `git diff --stat` as a secret read, and now also refuses reading the contents of `credentials.json` (part of #1076) - **AI** ([Release v7.143.1](https://github.com/Cratis/AI/releases/tag/v7.143.1)): The credential and shell-write guards no longer block read-only commands such as `rg` over project globs (including `--glob` filters and `rg -l`), `git grep`, `git ls-files`, and `git add` or `git diff` of spec files whose names mention credentials. They still refuse anything ambiguous, including heredoc bodies, unresolvable directories and globs that could match a key or credential file. Run `cratis ai update` to get the fixed hooks. (part of #1005) - **Choreography** ([Release v2.3.1](https://github.com/Cratis/Choreography/releases/tag/v2.3.1)): A job left in `StartingSteps` with every step already finished is now finalized, both when it is resumed and by the periodic cleanup, instead of staying open forever. - **Choreography** ([Release v2.3.1](https://github.com/Cratis/Choreography/releases/tag/v2.3.1)): Expired terminal jobs are now removed page after page while a full page is removed, so a large backlog drains in one cleanup run instead of 100 jobs per hour. Rehydration still cleans a single page so resuming running jobs is never delayed. - **Arc** ([Release v22.177.1](https://github.com/Cratis/Arc/releases/tag/v22.177.1)): Generated TypeScript proxies for model-bound commands now include public inputs inherited from base command types, in the interface, accessors, imports, descriptors, validation rules and request body. A hidden or overridden input resolves to its most-derived declaration without duplicates (#3643) - **Stage** ([Release v5.2.1](https://github.com/Cratis/Stage/releases/tag/v5.2.1)): A rejected command in a Stage form now shows its message once instead of beside a second, generic error alert; the generic notice is still announced to screen readers (#1036) - **Stage** ([Release v5.2.1](https://github.com/Cratis/Stage/releases/tag/v5.2.1)): Tables no longer show "Loading…" above rows that have already arrived or next to a reported error (#1035) - **Chronicle** ([Release v19.148.0](https://github.com/Cratis/Chronicle/releases/tag/v19.148.0)): Reject reserved and malformed event store names - **Chronicle** ([Release v19.148.0](https://github.com/Cratis/Chronicle/releases/tag/v19.148.0)): Keep event sequence names away from internal storage names - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): A command for an instance that does not exist is refused with a clear message instead of failing with HTTP 501 (#1020) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Model assets such as the layout logo are served under `cratis run` (#1022) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Table columns bound to a child collection render readably instead of `[object Object]` (#1019) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): DateTime command properties accept ISO 8601 values and name the expected format when a value is refused (#1032) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Command dialogs are styled and no longer leave the application inert (#1034) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): A selected-row action binds only the identifier the command acts on, so commands can change a field that shares a name with a row column (#1024) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): A form for a command no longer renders as a stray inline form on the feature's list screen (#1025) - **Stage** ([Release v5.2.0](https://github.com/Cratis/Stage/releases/tag/v5.2.0)): Command dialogs use a form's manual column order and labels (#1027) - **Chronicle** ([Release v19.147.2](https://github.com/Cratis/Chronicle/releases/tag/v19.147.2)): The kernel no longer fails to start on MongoDB offerings such as Atlas Flex, where the `System` database belongs to the provider and the database user may not read it. - **Chronicle** ([Release v19.147.2](https://github.com/Cratis/Chronicle/releases/tag/v19.147.2)): The System event store move patches now do nothing when no databases exist under the old name, and report a failed move as a warning instead of stopping the kernel. - **Chronicle** ([Release v19.147.1](https://github.com/Cratis/Chronicle/releases/tag/v19.147.1)): The kernel no longer crash-loops on upgrade when its MongoDB user may neither drop the old `System` databases nor their collections. The content is moved, the kernel starts from the configured databases, and the old databases are left behind as stale copies for an operator to drop. - **Stage** ([Release v5.1.1](https://github.com/Cratis/Stage/releases/tag/v5.1.1)): Command responses in the Stage sandbox and semantic host no longer return the values of secret concept properties, including secrets nested inside composite values and lists, and validation messages about such properties no longer include their values. Values Stage cannot classify are omitted from the response rather than echoed back. - **Chronicle** ([Release v19.147.0](https://github.com/Cratis/Chronicle/releases/tag/v19.147.0)): Protected-value releases are fenced against fresh erasure, and read-model releases hold their lease across paginated reads (part of #4979) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): A fresh install writes the board's `baseUrl` (the hosted platform URL unless you override it), so the loop connects to the board without setting `BASE_URL`; the `connect` skill writes `organizationId`, the loop also reads `orgId`, and a loop missing credentials prints which fields are missing (#34) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): A slice that keeps failing is set to `Blocked` with a board comment giving the last failure after a configurable number of attempts (3 by default), a hung turn is stopped after a turn timeout (60 minutes by default), two loops on one board no longer build the same slice, and the loop sets each slice's final status itself (#36) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The agent builds from the slice's full definition: before each build the loop fetches its elements, fields and specifications into `slice.json`, and each build turn names the slice to build (#37) - **Scene** ([Release v5.1.0](https://github.com/Cratis/Scene/releases/tag/v5.1.0)): Upgrading an old toolbar keeps an item's icon-only mode as the button's `display` instead of dropping it, so upgraded toolbars show only the icon again. (part of Cratis/StudioIssues#1327) - **Chronicle** ([Release v19.142.1](https://github.com/Cratis/Chronicle/releases/tag/v19.142.1)): Generation blocker retries are bounded. - **Showrunner** ([Release v1.17.1](https://github.com/Cratis/Showrunner/releases/tag/v1.17.1)): The operator image is now published to `cratis/showrunner-operator-image` and the Helm chart stays in `cratis/showrunner-operator`. Both used one repository and one tag per version, so pushing the chart replaced the image and a chart installed with its default image could not start. The chart now defaults to the new image repository. Upgrade: a chart from this release pulls its image from `cratis/showrunner-operator-image`; earlier version tags of `cratis/showrunner-operator` are still chart artifacts, so pin `latest` there or move to this release (#93) - **Chronicle** ([Release v19.140.0](https://github.com/Cratis/Chronicle/releases/tag/v19.140.0)): A job step that starts after the client it was prepared for has been replaced by a newer connection delivers through the connection that is subscribed now, instead of the one it was prepared with. Without it, a step that waited for its turn found nobody to deliver to after its client restarted, and failed its partition as disconnected. - **Chronicle** ([Release v19.138.1](https://github.com/Cratis/Chronicle/releases/tag/v19.138.1)): A failed partition whose recovery job could not be started is tried again in a later turn, after the short delay, instead of straight away in the same turn, where it would only have failed the same way again while the partitions behind it waited. - **Chronicle** ([Release v19.138.0](https://github.com/Cratis/Chronicle/releases/tag/v19.138.0)): Concurrently constructed `ChronicleClientFixture` instances no longer resolve a null content root (#5681) - **Chronicle** ([Release v19.138.0](https://github.com/Cratis/Chronicle/releases/tag/v19.138.0)): A scheduler-dependent appended event coalescing spec is now deterministic (#5645) - **Arc** ([Release v22.172.3](https://github.com/Cratis/Arc/releases/tag/v22.172.3)): Session cookies issued under a custom cookie authentication scheme name are now counted when checking that a request presents only one credential, so a custom-named session cookie combined with a bearer token is refused (part of #3709) - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Administrators can call System event store operations over gRPC; the caller's request context is resolved from the call itself. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): Event store access grants that cover every event store or namespace are accepted, so a server configured with such grants starts normally. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): `EnsureEventStore`, event sequence queries and event streams are authorized against the store and namespace they actually address. - **Chronicle** ([Release v19.137.0](https://github.com/Cratis/Chronicle/releases/tag/v19.137.0)): A refused connection reservation no longer leaves a local claim that blocks the legitimate owner from reconnecting. - **Arc** ([Release v22.172.2](https://github.com/Cratis/Arc/releases/tag/v22.172.2)): A request that presents a recognized session cookie together with an Authorization value or a v1 envelope is now refused as multiple credentials before any verified caller is built; a session cookie with a v2 envelope still counts as one credential (part of #3709) - **Chronicle** ([Release v19.136.2](https://github.com/Cratis/Chronicle/releases/tag/v19.136.2)): Starting the kernel on a database with a large catch-up job no longer runs out of memory. Looking up the retry or replay jobs of an observer listed every job, each with its whole plan of thousands of steps, and copied each of them through JSON on the way. Only the jobs of the type asked for are listed now, and a job state is not copied within a silo. - **Chronicle** ([Release v19.136.2](https://github.com/Cratis/Chronicle/releases/tag/v19.136.2)): Reading a stored job state no longer writes the whole document, plan included, out a second time before it is deserialized. - **Chronicle** ([Release v19.136.2](https://github.com/Cratis/Chronicle/releases/tag/v19.136.2)): A failed partition whose recovery job could not be started, because its grain could not activate while the silo was busy, no longer ends the observer's recovery turn. It is tried again a few seconds later, instead of the partitions queued behind it waiting for the next subscription. - **Arc** ([Release v22.172.1](https://github.com/Cratis/Arc/releases/tag/v22.172.1)): Retired product credential prefixes are now refused by default on every arrival path (authorization header, query value, forwarded-identity header), with any ASCII whitespace after the scheme; hosts can add prefixes but cannot remove the defaults. (part of #3713) - **Arc** ([Release v22.172.1](https://github.com/Cratis/Arc/releases/tag/v22.172.1)): Revoking a personal access token accepts only personal access token credentials. (part of #3713) - **Chronicle** ([Release v19.136.1](https://github.com/Cratis/Chronicle/releases/tag/v19.136.1)): Saving the failed partitions of an observer writes only what changed since it was last written, for every storage target. Previously every save handed storage all of an observer's failed partitions, and the resolved ones again, so with thousands of failed partitions each save, and each recovery, cost more than the last. The observer's failed partitions now know what they have persisted and the grain storage provider writes only the difference. - **Stage** ([Release v4.227.0](https://github.com/Cratis/Stage/releases/tag/v4.227.0)): The published container no longer refuses to start because of a missing sandbox forwarded-identity setting (part of #917) - **Arc** ([Release v22.171.1](https://github.com/Cratis/Arc/releases/tag/v22.171.1)): The query health endpoint no longer publishes an empty tag, so ASP.NET Core OpenAPI document generation succeeds (#3695) - **Arc** ([Release v22.171.0](https://github.com/Cratis/Arc/releases/tag/v22.171.0)): React view models are now disposed when a component really unmounts in development, instead of leaking their subscriptions and handlers (#3689) - **Arc** ([Release v22.171.0](https://github.com/Cratis/Arc/releases/tag/v22.171.0)): Streaming query subscriptions stop the producer before their resources are disposed, and report cancellation and detach failures together instead of hiding one (#3664) - **Chronicle** ([Release v19.135.1](https://github.com/Cratis/Chronicle/releases/tag/v19.135.1)): Recovering many failed partitions of one observer is no longer quadratic. Every save of an observer's failed partitions rewrote all of them, and the resolved ones again, one round trip at a time, so with hundreds of failed partitions each recovery took over a second of the observer's time. The MongoDB storage now sends only what changed since it last wrote, in a single bulk request. 659 failed partitions that took about an hour to recover now recover in under a minute. - **Stage** ([Release v4.225.1](https://github.com/Cratis/Stage/releases/tag/v4.225.1)): `POST /stage/semantic/specifications/run` held the runner's report to the slice specifications and rejected the graph specifications it also carries, answering `502 The specification runner produced an invalid or mismatched report` for every model with a graph specification. A report is now held to the model's graph specifications too: each record must be one the model declares and appear once, and an unscoped run must report them all. - **Stage** ([Release v4.224.1](https://github.com/Cratis/Stage/releases/tag/v4.224.1)): The sandbox's specification run admitted only snapshot queries by key, so a model whose keyed queries are `observable` (the common case) had every such specification reported as unsupported. It now admits an optional keyed query whatever its delivery. An unfiltered collection, observable or not, is still refused. - **Chronicle** ([Release v19.133.2](https://github.com/Cratis/Chronicle/releases/tag/v19.133.2)): A reducer with a large state no longer holds hundreds of megabytes of pooled buffers while it reduces: the state sent to the client is written, and the state returned by the client is parsed, into buffers sized for the document instead of growing rented ones by doubling, so a heap limit is no longer exhausted by memory the document itself does not need. - **Chronicle** ([Release v19.133.2](https://github.com/Cratis/Chronicle/releases/tag/v19.133.2)): Converting documents between JSON, `ExpandoObject` and BSON no longer allocates per value: scalar BSON conversion skips type reflection, a schema's format and its properties by name are computed once, and the case-insensitive fallback and array conversions no longer allocate closures and LINQ iterators. - **Chronicle** ([Release v19.133.2](https://github.com/Cratis/Chronicle/releases/tag/v19.133.2)): Event cursors fetch 1000 events per round trip instead of whatever fits in 16 MB, so an observer reading a long backlog no longer materializes tens of thousands of events at once. - **Chronicle** ([Release v19.133.1](https://github.com/Cratis/Chronicle/releases/tag/v19.133.1)): Keeping a client's reactor and reducer subscriptions alive no longer copies the whole observer definition through the JSON serializer every two seconds for every observer of every connection. Each tick now asks the observer's client grain a question that carries no definition, and sends the definition only when something must be restored. On a kernel serving hundreds of observers per client this was a large share of its CPU; the starved kernel stopped accepting connections in time and observers were left disconnected. - **Chronicle** ([Release v19.133.1](https://github.com/Cratis/Chronicle/releases/tag/v19.133.1)): A silo that does not know the new check, as during a rolling upgrade, is handled by falling back to the previous full keep-alive. - **Chronicle** ([Release v19.133.0](https://github.com/Cratis/Chronicle/releases/tag/v19.133.0)): Model-bound and fluent graph projections are now registered with the kernel; graph elements and graph projections were not forwarded from the client's artifacts, so no graph declared in C# was ever registered through an event store. - **Chronicle** ([Release v19.133.0](https://github.com/Cratis/Chronicle/releases/tag/v19.133.0)): Changing a graph projection's definition no longer fails its partitions with "graph does not define the node"; the graph sink is rebuilt when the graph definition changes. - **Chronicle** ([Release v19.132.1](https://github.com/Cratis/Chronicle/releases/tag/v19.132.1)): A reducer folding a large, growing state no longer allocates several times that state on every reduce, which exhausted memory under a flood of events: the type of a schema is read without allocating, the notification of a change is only built when something is watching the read model, and BSON conversion of string keyed documents and the protected value check no longer do reflection and metadata reads per value. - **Chronicle** ([Release v19.132.1](https://github.com/Cratis/Chronicle/releases/tag/v19.132.1)): An observer that falls behind is spilled to catch-up when its queue holds more than `Events:QueueBoundedEvents` events (default 5000), not only when it holds more than `QueueBoundedCapacity` batches, so a burst of large batches can no longer be held in memory. - **Chronicle** ([Release v19.132.1](https://github.com/Cratis/Chronicle/releases/tag/v19.132.1)): A reducer result that cannot be read (for example a state too large to materialize) fails its delivery immediately and is retried, instead of leaving the observer waiting for the subscriber timeout. - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): Occurrence workers start again after the .NET client reconnects with automatic registration turned off. (#5656) - **Chronicle** ([Release v19.132.0](https://github.com/Cratis/Chronicle/releases/tag/v19.132.0)): Token request failures in the .NET client are now reported with a fixed failure category instead of underlying error text. - **Chronicle** ([Release v19.131.3](https://github.com/Cratis/Chronicle/releases/tag/v19.131.3)): Chronicle now starts when a namespace's stored name differs only in case from its existing MongoDB database: databases are opened by the casing they already have on the server (#5697) - **Chronicle** ([Release v19.131.3](https://github.com/Cratis/Chronicle/releases/tag/v19.131.3)): Removing a namespace never drops a database that another casing of the same name still uses, and case variants of the default namespace or of reserved names are rejected (#5697) - **Chronicle** ([Release v19.131.3](https://github.com/Cratis/Chronicle/releases/tag/v19.131.3)): Namespaces that differ only in case now resolve to the casing already stored for the event store, so each namespace has one set of observers and event sequences, and stored lists holding both casings are merged without losing data (#5699) - **Chronicle** ([Release v19.131.2](https://github.com/Cratis/Chronicle/releases/tag/v19.131.2)): A single event store subscription that cannot be refreshed when the subscriptions manager activates no longer stops the kernel from starting. The failure is logged and the subscription's reminder retries it (#5695). - **Chronicle** ([Release v19.131.1](https://github.com/Cratis/Chronicle/releases/tag/v19.131.1)): A kernel upgrade that relocates the System event store no longer crash-loops against a MongoDB user without the `dropDatabase` action, such as the `readWriteAnyDatabase` user Atlas hands an application. The relocated databases are emptied collection by collection instead. - **AuthProxy** ([Release v2.46.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.46.0)): A path-only client-credentials verification path, such as the default, is resolved against the service's backend address on every platform - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): Named tags are now kept when an event is forwarded to another event store's inbox. They were previously dropped. - **Chronicle** ([Release v19.131.0](https://github.com/Cratis/Chronicle/releases/tag/v19.131.0)): `AppendMany` for a single event source resolves tags per event instead of sharing one tag set across the batch. - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): A transient storage error in a fire-and-forget background task is logged and no longer terminates the kernel. Unobserved task exceptions are logged once per owner and failure with the owning task named, and an unhandled crash exits with a distinct code (#5687) - **Chronicle** ([Release v19.130.0](https://github.com/Cratis/Chronicle/releases/tag/v19.130.0)): A cold start no longer wakes every healthy observer through its alert reminder at the same moment (#5685) - **Arc** ([Release v22.168.1](https://github.com/Cratis/Arc/releases/tag/v22.168.1)): The signed forwarded identity guide now says AuthProxy 2.44.0 and later can sign forwarded identity as an opt-in, instead of saying signing is not available yet. - **Chronicle** ([Release v19.128.1](https://github.com/Cratis/Chronicle/releases/tag/v19.128.1)): A client's reactors and reducers no longer lose their subscription when the kernel runs several replicas and a client's keep-alives or observer streams reach a different silo than its connection. Every silo now finds the connection wherever it is registered, and a keep-alive that lands on the wrong silo is forwarded to the silo that holds the connection, so the client is not expired while alive. (#5665) - **Chronicle** ([Release v19.128.1](https://github.com/Cratis/Chronicle/releases/tag/v19.128.1)): A silo of 19.123.1 or later that finds an earlier release in the cluster now stops with a clear message to stop every silo and start the new release, instead of crash-looping with `TypeLoadException` on the `Cratis.Orleans` to `Cratis.Choreography` rename. The rolling-deploy guide lists the boundary. (#5666) - **Chronicle** ([Release v19.128.1](https://github.com/Cratis/Chronicle/releases/tag/v19.128.1)): A replay job that the observer watchdog finds missing is no longer restarted every minute without limit. Restarts back off from one minute up to one hour and reset once a replay job is running. A job that stays in preparation without a single step for 15 minutes is now deleted so the work can start again. (#5667) - **Chronicle** ([Release v19.128.1](https://github.com/Cratis/Chronicle/releases/tag/v19.128.1)): Reducer state sent to the client with every reduce is now compact JSON instead of indented JSON, and a warning names reducers whose state exceeds 8 MiB. The state is still sent in full with every reduce, so a very large read model remains expensive. (part of #5669) - **Chronicle.Elixir** ([Release v3.19.1](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v3.19.1)): Publishes the batch functions and page delivery for reactors and reducers, whose release did not reach Hex because an intermittent test failure stopped the publish workflow. - **Arc.Elixir** ([Release v0.1.0](https://github.com/Cratis/Arc.Elixir/releases/tag/v0.1.0)): The Phoenix sample builds and serves its React app from `./run.sh` - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Event sequence names can no longer match a collection or table that the event store itself uses, for every storage provider. (part of #932) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Projections now encrypt [PII] and [Encrypted] values that reach a read model through a deferred update, such as a child event that arrives before its parent, so these values are no longer stored in plaintext and erasing the subject makes them unreadable. Values written before this release stay in plaintext until the projection is replayed. (#4599) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): SQL read models (SQLite, PostgreSQL, SQL Server) keep their row identity when a join or property mapping sets `id` to a different value, and still apply the other mapped values, as MongoDB does. (#5577) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Mapping `null` onto an object property of a SQL read model now stores and returns `null`, as MongoDB does, instead of an empty object; this also applies to isolated replacement. Existing rows are not converted; see [Null nested objects](https://github.com/Cratis/Chronicle/blob/main/Documentation/sinks/index.mdx). (#5578) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): Full replays of a projection are now refused, with a named reason, in an event store where projection-generation initialization has begun. A replay that was already running when initialization began may finish, but no new replay starts, and a refused replay leaves the observer active rather than stuck replaying. This holds even after the `ProjectionGenerations` flag is turned off. (part of #5223) - **Chronicle** ([Release v19.128.0](https://github.com/Cratis/Chronicle/releases/tag/v19.128.0)): The g - **Chronicle** ([Release v19.127.0](https://github.com/Cratis/Chronicle/releases/tag/v19.127.0)): Moving the System event store's databases to `_system` now removes the old `System` databases. The patch asked a storage implementation that did nothing, so it was recorded as applied while the data stayed under the old names and the kernel ran against empty new databases. The move now runs, and each old database is dropped only after every collection in it is confirmed to be in the new one. A database whose copy cannot be confirmed is kept, with a warning in the log. - **Chronicle** ([Release v19.127.0](https://github.com/Cratis/Chronicle/releases/tag/v19.127.0)): Installations that already ran the earlier patch get the move repeated on their next upgrade. Anything the kernel wrote under the new names is kept, what is missing is copied, and the old databases are then dropped. Upgrading with `storage.systemDatabaseName` set to `System` still moves nothing. - **Chronicle** ([Release v19.127.0](https://github.com/Cratis/Chronicle/releases/tag/v19.127.0)): `ChronicleTelemetryConfiguration` has a parameterless constructor that applies no changes, so a host that registers it by convention no longer fails with `Unable to resolve service for type 'System.Action<ChronicleTelemetryOptions>'` when the container activates it. - **Chronicle** ([Release v19.126.1](https://github.com/Cratis/Chronicle/releases/tag/v19.126.1)): An observer is no longer left behind the event sequence for good when a restart stops its catch-up job while the job is still preparing its steps. Such a job could not be resumed and was never removed, so every later catch-up found it and started nothing. It is now removed and a new catch-up starts. - **Prompter** ([Release v0.14.17](https://github.com/Cratis/Prompter/releases/tag/v0.14.17)): Answers mentioning names with dots, such as Next.js or app/.cratis, no longer come out garbled when a sentence about "the excerpts" is removed (part of #139) - **Prompter** ([Release v0.14.17](https://github.com/Cratis/Prompter/releases/tag/v0.14.17)): Matching user and model text no longer fails under load because of a 100 ms limit. All such checks share a 1 s limit - **Screenplay** ([Release v5.5.1](https://github.com/Cratis/Screenplay/releases/tag/v5.5.1)): Harden attachment loading across supported platforms. - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Appending or revising an event at an older generation now applies the protection that newer generations declare for the same properties. (#5491) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Retry transient occurrence lease-renewal failures within the confirmed lease and cancel handler attempts whose lease can no longer be confirmed (part of #5005) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): When many event stores start on one kernel host at once, their projection subscriptions now queue for a bounded number of slots instead of all subscribing at the same time. (part of #4068) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): The in-memory sink applies all changes of a projection update together, so a failed update leaves no partial rows or watermarks behind and a retry reapplies cleanly. (#5519) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Identical projection registrations that arrive while one is in progress, or right after it completes, now share that registration instead of each queuing on the projections manager until they time out. (#5498) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): After a kernel restart, the kernel's own projection registration joins identical registrations already in progress, so a storm of client registrations no longer blocks the kernel from starting. (#5627) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Reserved event-sequence names are rejected before writes create storage, including internal writes; existing sequences remain usable (part of #932) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Projections and reducers that publish to an event sequence no longer write to a new sequence whose name Chronicle reserves for its own storage (such as `observers`, `jobs` or a name ending in `+constraint`): the partition fails with a message naming the destination, and a destination containing `#` is refused when the read model is registered (#5490) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): The live observer list now shows changes to an observer's definition even when its state does not change (#5487) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): Watching the observers for an event type no longer keeps its storage subscriptions open after the watcher disconnects (#5500) - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): An explicitly registered projection without its own container name now reports the container its read model is actually served from (#5392) - **Prompter** ([Release v0.14.16](https://github.com/Cratis/Prompter/releases/tag/v0.14.16)): A slow pattern match while recovering a cut-off answer no longer fails the answer. Recovery is skipped instead, and the match time limit is raised (#141) - **Prompter** ([Release v0.14.16](https://github.com/Cratis/Prompter/releases/tag/v0.14.16)): A race in the test clock that made the feedback-processing specs fail intermittently (#110) - **Arc** ([Release v22.167.0](https://github.com/Cratis/Arc/releases/tag/v22.167.0)): A concept rule from `BaseValidator<T>.RuleFor` no longer looks up the concept's `Value` property by name, so trimming cannot remove it. (part of #3674) - **Chronicle** ([Release v19.125.2](https://github.com/Cratis/Chronicle/releases/tag/v19.125.2)): The Workbench Sequences page, and the Add user and Add application dialogs, no longer crash with `crypto.randomUUID is not a function` when opened over plain HTTP on a non-localhost host (#5647) - **release-action** ([Release v1.5.2](https://github.com/Cratis/release-action/releases/tag/v1.5.2)): A batched run that skips the release now says why in its log and step summary: it lists the pending pull requests and, while waiting, the oldest merge time and the UTC time the release window elapses, plus how to release now (a manual run with version `0.0.0` or empty). The post step names the reason instead of only saying no release was created. Repositories pick this up through the `v1` tag; no workflow change is needed. (#222) - **Stage** ([Release v4.220.0](https://github.com/Cratis/Stage/releases/tag/v4.220.0)): A join inside a nested object that is itself below a root-level nested object is now refused with a clear diagnostic instead of being admitted, and the spec runner reports its own refusal instead of the renderer's text. (#969) - **Chronicle** ([Release v19.125.1](https://github.com/Cratis/Chronicle/releases/tag/v19.125.1)): A rolling deployment that evicts the pod holding the patch manager while a new kernel starts no longer fails that kernel's startup. - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): Query descriptions now carry through to the event model board, so the board shows them alongside the other model descriptions. (part of #419) - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): Unresolved qualified event-source names in captures are now reported as error PLAY0166 instead of a warning (#1065) - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): The interactions guide no longer lists `change` among triggers that cannot have alternatives; `on change` supports `when`/`otherwise`. (#1140) - **Screenplay** ([Release v5.4.0](https://github.com/Cratis/Screenplay/releases/tag/v5.4.0)): Harden attachment loading on Windows. - **AI** ([Release v7.131.7](https://github.com/Cratis/AI/releases/tag/v7.131.7)): The secret guard now checks long startup options of shell invocations such as `bash --posix`, and allows only options that keep the checked shell syntax (`--norc`, `--noprofile`, `--login` and similar). (#1006) - **AI** ([Release v7.131.7](https://github.com/Cratis/AI/releases/tag/v7.131.7)): The pull-request body guard now also checks `gh pr create` and `gh pr edit` when `-R`/`--repo` comes before `pr`, and refuses other options placed before the subcommand. (#1007) - **AI** ([Release v7.131.6](https://github.com/Cratis/AI/releases/tag/v7.131.6)): The secret guard now also reviews `oc` commands, and allows Kubernetes output projections (JSONPath and custom columns) only when they select known non-sensitive fields such as names, labels, status and container images. Go templates, file-based projections and unrecognised output formats for workload resources are refused. - **Prompter** ([Release v0.14.15](https://github.com/Cratis/Prompter/releases/tag/v0.14.15)): Answers no longer contain sentences about "the excerpts" behind them. When such a sentence carried a citation, the citation moves to the neighboring sentence - **Prompter** ([Release v0.14.14](https://github.com/Cratis/Prompter/releases/tag/v0.14.14)): Questions that are not about Cratis, such as general programming, other vendors' tools or creative writing, now get a short, honest decline instead of an answer built from unrelated documentation pages. These declines carry no citations and no "This should be documented" button. Questions that compare another tool with Cratis are still answered (part of #136) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): Token failure logs no longer include response bodies. (part of #4350) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): A job start that is delayed or retried can no longer run after the observer has handed its work to a newer job, so a stale catch-up or replay no longer releases, overwrites or quarantines the work of the job that replaced it. (#5382) - **Chronicle** ([Release v19.124.0](https://github.com/Cratis/Chronicle/releases/tag/v19.124.0)): SQL read models (PostgreSQL, SQL Server, SQLite) now apply a projection event that writes several - **Components** ([Release v4.40.0](https://github.com/Cratis/Components/releases/tag/v4.40.0)): The chat sidebar's "New topic" button now keeps readable text on hover in the dark theme: its hover text color is paired with the hover background, and uses the system Highlight and HighlightText colors in forced-colors mode. (#486) - **Components** ([Release v4.40.0](https://github.com/Cratis/Components/releases/tag/v4.40.0)): Chat mention suggestions can now be dismissed with Escape, which leaves the draft and caret as they were and does not close a dialog around the composer; editing the text after the `@` opens them again. (#487) - **Components** ([Release v4.40.0](https://github.com/Cratis/Components/releases/tag/v4.40.0)): The chat message box now exposes the keyboard-highlighted mention option to assistive technology through `aria-activedescendant` while focus stays in the box. `MentionSuggestions` accepts an optional `id` for its list. (#487) - **Arc** ([Release v22.165.1](https://github.com/Cratis/Arc/releases/tag/v22.165.1)): Cancelling the token of an observable query enumeration now ends a `MoveNextAsync` that is already waiting, instead of leaving it pending until the next item arrives. Cancellation consistently throws `OperationCanceledException` (#3631) - **Arc** ([Release v22.165.1](https://github.com/Cratis/Arc/releases/tag/v22.165.1)): Scoped services that implement only `IAsyncDisposable` are now disposed correctly when an observable query subscription ends over SSE or WebSockets (snapshot completion, unsubscribe and connection close). A resource that fails to dispose no longer prevents the remaining resources from being disposed; the failure is logged (#3632) - **Arc** ([Release v22.165.1](https://github.com/Cratis/Arc/releases/tag/v22.165.1)): Changing the title or slice of an open background dialog no longer reorders the dialogs reported by the application context or moves focus away from the top-most dialog (#3641) - **Arc** ([Release v22.165.1](https://github.com/Cratis/Arc/releases/tag/v22.165.1)): Wrapped components such as `export const Pay = memo(PayInner)` now get their slice location even when `PayInner` is declared later in the module (#3639) - **AI** ([Release v7.131.4](https://github.com/Cratis/AI/releases/tag/v7.131.4)): The Stage rendering guidance now matches the scaffold's central package management. Add backend packages in `Customizations/Dependencies.props` as an unversioned `PackageReference` with a matching central `PackageVersion`, or use `VersionOverride`. Only older scaffolds that turn central package management off take `Version`. (#992) - **AI** ([Release v7.131.3](https://github.com/Cratis/AI/releases/tag/v7.131.3)): The protected-write guard no longer refuses every tool call when hooks run under Bash 3.2, which is macOS's `/bin/bash`. It now confirms that the `jq` parser succeeded without waiting on a process-substitution PID, which Bash 3.2 cannot do. A failed or partial parse is still refused. (#1010) - **Prompter** ([Release v0.14.12](https://github.com/Cratis/Prompter/releases/tag/v0.14.12)): Broad questions about Cratis ("What is Cratis good at?", "Why use Cratis?") now always read the opening text of each overview page, where the documentation names the products, so answers name Chronicle, Arc and the other core products consistently (part of #131) - **AI** ([Release v7.131.2](https://github.com/Cratis/AI/releases/tag/v7.131.2)): The secret-read, protected-write and store-mutation hooks read commands more conservatively: commands that name protected files run only in simple literal forms, shell-option changes that widen pattern matching are refused, and the refusal names the protected file and how to split the command. The hooks also require `jq`: without it they refuse the tool call and say why. Install `jq` where agents run, then run `cratis ai update` to install the updated hooks. The guards are a best-effort, defense-in-depth filter, not a sandbox; use OS-level sandboxing or file permissions for real protection. - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): Protected decision reads, read-model and per-stream parameters of a command's `Handle()` and `Provide()` are now awaited instead of blocking. Commands no longer deadlock when they run on a single-threaded scheduler such as an Orleans grain. Custom resolvers can await their reads by implementing `IAsyncParameterDependencyResolver` (#3538) - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): The Screenplay generator recovers command identifiers and event destinations, and withholds returned-tuple productions it cannot represent safely (#3548) - **Arc** ([Release v22.165.0](https://github.com/Cratis/Arc/releases/tag/v22.165.0)): The Screenplay generator recovers reaction appends with envelope metadata without inventing requirement ids (part of #3551) - **Arc** ([Release v22.164.0](https://github.com/Cratis/Arc/releases/tag/v22.164.0)): Observed Entity Framework Core queries re-run in the observer's own context when changes are detected, so updates use the same connection as the initial query - **Arc** ([Release v22.164.0](https://github.com/Cratis/Arc/releases/tag/v22.164.0)): The samples' cookie authentication handler, which trusts unsigned cookies, now authenticates only in the Development environment, and the samples documentation warns against copying it into an application (#3657) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Guards on enumerations with explicit member numbers compare by those numbers instead of declaration position. (#925) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Root projection joins with an explicit event-property key now render and run; the Chronicle server must be 19.112.4 or later, and specification checks do not prevent https://github.com/Cratis/Chronicle/issues/5439 at runtime in a rendered application. (#875) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Keep entity-creation toolbar actions usable without selecting a row. (#693) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Bind plain screen actions to the selected row, preserving subjects and scoping. (#745) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Guarded actions outside an interaction scope preserve command failure messages. (#857) - **Chronicle.TypeScript** ([Release v6.55.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.55.0)): Transactional appends accept the `AppendOptions` names `streamType`, `streamId` and `sourceType`, throw `ConflictingAppendOptionNamesInUnitOfWork` when both spellings carry different values, and refuse options a unit of work cannot honour with `AppendOptionNotSupportedInUnitOfWork` instead of silently dropping them (#240) - **Chronicle.TypeScript** ([Release v6.55.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v6.55.0)): Concurrency scopes that differ only in undefined versus empty stream or source fields are treated as equal, so a unit of work no longer raises a spurious `ConflictingConcurrencyScopesInUnitOfWork` (#241) - **Prompter** ([Release v0.14.11](https://github.com/Cratis/Prompter/releases/tag/v0.14.11)): Broad questions such as "What is Cratis good at?" now get the body of the overview pages as well as their summaries, so answers can name the products behind each strength (part of #125) - **Choreography** ([Release v2.1.1](https://github.com/Cratis/Choreography/releases/tag/v2.1.1)): `CratisTypesFilter` now also allows the types Orleans generates for Cratis grain interfaces, which live under `OrleansCodeGen.Cratis`. Since Orleans 10.4.1 a generic type definition is authorized on its own, so a cross-silo call such as `IObserver.Subscribe<TObserverSubscriber>` failed with `Type "OrleansCodeGen.Cratis…" is not allowed` and terminated the silo. - **Prompter** ([Release v0.14.10](https://github.com/Cratis/Prompter/releases/tag/v0.14.10)): "What is Cratis good at?" and similar broad questions now reliably answer from the documentation's overview pages: the curated overview summaries are no longer dropped when their wording differs from the question's (#125) - **Screenplay** ([Release v5.3.2](https://github.com/Cratis/Screenplay/releases/tag/v5.3.2)): Attachment loading on Linux and macOS no longer follows links swapped in during a load. (#1149) - **cli** ([Release v3.120.1](https://github.com/Cratis/cli/releases/tag/v3.120.1)): Update to Stage 4.216.1. Applications rendered by `cratis render` now pin Chronicle 19.114.0, and a command production that names no event source is refused with `STAGE-ESM-053` instead of `STAGE-ESM-006`. - **Prompter** ([Release v0.14.9](https://github.com/Cratis/Prompter/releases/tag/v0.14.9)): Broad questions about Cratis itself, such as "What is Cratis good at?", now always bring the documentation's overview pages (the home page, Why Cratis and the Cratis stack) to the answer instead of unrelated pages (#125) - **Prompter** ([Release v0.14.9](https://github.com/Cratis/Prompter/releases/tag/v0.14.9)): Short "what is Cratis" answers keep the overview's defining terms, such as event sourcing, instead of paraphrasing them away (#122) - **Prompter** ([Release v0.14.9](https://github.com/Cratis/Prompter/releases/tag/v0.14.9)): An answer that writes Anthropic's prompt cache is now charged its real cost against the daily spending budget instead of a much larger reservation, so the budget no longer runs out early; unknown or inconsistent usage still keeps the full reservation, and every rejected settlement is logged with its reason (#126) - **Stage** ([Release v4.216.1](https://github.com/Cratis/Stage/releases/tag/v4.216.1)): Generated onboarding code now gives a signed-in member persona roles and claims only for the tenant of the request. Persona roles and claims arriving with the sign-in are replaced, and roles from the identity provider that no persona uses pass through unchanged. Re-render and redeploy applications that use model-declared onboarding (`invite member … by`). - **Stage** ([Release v4.216.1](https://github.com/Cratis/Stage/releases/tag/v4.216.1)): The generated `InviteMemberToTenant` command now requires the inviting persona in the tenant it is sent to. - **Screenplay** ([Release v5.3.1](https://github.com/Cratis/Screenplay/releases/tag/v5.3.1)): The reference evaluator now supports joins inside root-level nested projections, including backfill from earlier events, matching Chronicle. (#1078) - **Screenplay** ([Release v5.3.1](https://github.com/Cratis/Screenplay/releases/tag/v5.3.1)): Deeply nested conditions, policies and authorization rules now report PLAY0861 instead of exhausting the compiler, import patterns are matched in bounded time, and the MCP apply and recover tools are annotated as destructive. (#1132) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Unused generated command and query proxies are removed from bundles again, so routes and role names of unused commands no longer end up in unrelated bundles. (#3655) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Chronicle command-scenario decision reads now fold read models through the scenario's existing testing store instead of creating another store. (#3585) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Productions that would not bind in the generated Screenplay document (SP0056) now stay in their C# handlers, and authoring-only documents accept legacy read limits only when the limit is proven advisory. (#3558) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Generated Screenplay documents recover generated identities, responses and guarded productions from handlers that return a conditional list of events with concurrency scopes. (#3558) - **Arc** ([Release v22.163.0](https://github.com/Cratis/Arc/releases/tag/v22.163.0)): Productions whose required event properties are computed by code, or whose `Equals` conditions depend on value-changing casts, now stay in their C# handlers instead of being stated in the generated Screenplay document; controller request-body mappings are preserved. (#3558) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Removing a child from a nested collection in a SQL read model (PostgreSQL, SQL Server, SQLite) now removes it from the right nested collection, instead of the outer collection, where it could delete a parent whose id matched the child key. (#5575) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Event type migrations no longer carry a property removed by an intermediate generation into later generations for newly appended or backfilled events. Generation copies stored before this fix are not changed; see https://github.com/Cratis/Chronicle/issues/5599 for repairing them. (#5583) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Registering an event type no longer drops stored schema generations that the registration omits. (#5582) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Registering an event type no longer drops stored migration bridges that the registration omits, so older and newer generations still migrate. (#5584) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): A client whose registration with the server fails or does not complete in time is now told so instead of waiting for a first keep-alive that never arrives, and a connection that is ended while registering or keeping a debugger-attached client registered is closed promptly. (#5486) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): A client whose registration with the kernel fails now gets a generic error instead of internal exception details, and the kernel logs the details and any failure while closing a connection. (#5559) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): A connected client that registered under a debugger but never connected is now removed once it goes stale, while debugger sessions that stay connected keep their registrations. (#5515) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): A kernel retries a startup step when a sibling silo reports MongoDB connection-pool saturation, instead of failing startup after the first wrapped failure. Silos still on an older version do not get this recovery. (#5518) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Reactors no longer re-register after a dropped connection when they were replaced, unregistered or released while the reconnect was waiting. (#5482) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Reducer discovery no longer keeps collectible event types alive, so collectible assemblies and test hosts can unload once their registries are released, while registries with the same event types still share discovery work. (#5517) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): An event store whose initialization fails no longer stays hidden from the Workbench event store list; the kernel retries it in the background until it appears. (#5562) - **Chronicle** ([Release v19.121.0](https://github.com/Cratis/Chronicle/releases/tag/v19.121.0)): Watching a read model now delivers `__lastHandledEventSequenceNumber` for read models with personal data and for reducer-backe - **Screenplay** ([Release v5.3.0](https://github.com/Cratis/Screenplay/releases/tag/v5.3.0)): Documentation corrections: admission and host claims, the captures grammar (a document needs at least one capture; identifiers may start with an underscore), typed event key fallback rules, and the `$context.timeZone` description in the commands guide. (#1131) - **Components** ([Release v4.39.4](https://github.com/Cratis/Components/releases/tag/v4.39.4)): Pinching or ctrl-scrolling over a `Canvas` shown in front of another one, such as a canvas inside a dialog, zooms only that canvas. The canvas behind no longer zooms along with it, and a pinch over a modal dialog that a canvas is not part of leaves that canvas alone. Pinching over a canvas's own floating content still zooms it. - **AuthProxy** ([Release v2.42.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.42.1)): A remembered selected-tenant confirmation is now discarded whenever the tenants endpoint does not confirm that tenant: when it no longer lists it, answers with an error, times out or cannot be reached. The next request asks the endpoint again instead of reusing the earlier confirmation. This also applies when a slower request's unconfirmed answer arrives after a concurrent request has stored a confirmation. - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Attached command handlers and reaction effects now reject provider requirements belonging to a different compiled application, owner, or declaration before calling the provider. Models without verified compilation provenance are rejected rather than trusting the supplied owner. (#1107) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Events published by outbound Translate projections now count as producers for routed facts, `every`/`all` scopes and compile-time inference, consistently in the C# and TypeScript tooling. A projection that combines `from` and `every` over different producible event types is now refused as ambiguous. (#1036) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): The reference evaluator now routes shared child events to the location where the child was created and applies ancestor include-children mappings once per event, matching Chronicle, and evaluates scoped projections with many distinct children without per-fact allocations. (part of #132) - **Screenplay** ([Release v5.2.0](https://github.com/Cratis/Screenplay/releases/tag/v5.2.0)): Reduce reference-evaluator allocations when projecting many distinct child instances. (#1113) - **Specifications** ([Release v5.2.3](https://github.com/Cratis/Specifications/releases/tag/v5.2.3)): The xUnit v2 adapter (`Cratis.Specifications.XUnit`) no longer runs `Establish` and `Because` for a specification class whose facts are all skipped, matching the xUnit v3 adapter. A class with at least one fact to run still sets up once and shares the result (#107) - **Chronicle** ([Release v19.119.0](https://github.com/Cratis/Chronicle/releases/tag/v19.119.0)): A migration path that reaches into a collection without addressing its elements is now refused instead of silently replacing the collection with an object. (#5614) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Commands keep unsaved changes after a failed submission, and edits made during submission stay dirty. (#3626) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Observable queries notify when only paging or feedback metadata changes. (#3628) - **Arc** ([Release v22.162.0](https://github.com/Cratis/Arc/releases/tag/v22.162.0)): Mounted commands pick up Arc provider configuration changes without being recreated. (#3629) - **Choreography** ([Release v1.34.0](https://github.com/Cratis/Choreography/releases/tag/v1.34.0)): Jobs with very many steps no longer exceed MongoDB's 16 MB document limit and fail to start. A stored step plan is removed only after the job reaches a final state or is removed, and a job started again with the same id never loads or deletes the plan of an earlier run - **Fundamentals** ([Release v7.33.1](https://github.com/Cratis/Fundamentals/releases/tag/v7.33.1)): Derived-type JSON serialization now honours `[JsonIgnore]` and the other System.Text.Json ignore settings (`JsonIgnoreCondition`, `DefaultIgnoreCondition`, `IgnoreReadOnlyProperties`), so ignored properties are no longer written. With `DefaultIgnoreCondition = WhenWritingNull`, null properties of derived types are now omitted, the same as for other types (#1255) - **Chronicle** ([Release v19.118.0](https://github.com/Cratis/Chronicle/releases/tag/v19.118.0)): The kernel no longer logs a stack trace every minute for each observer left over from the event store `[NotSet]`. Those observers could never activate because their storage refuses the name, but their persistent reminders kept firing and flooded the log. A patch removes the reminders when the kernel upgrades to this release. - **Scene** ([Release v4.87.0](https://github.com/Cratis/Scene/releases/tag/v4.87.0)): Guards compare enum values by their declared member numbers when the condition carries `enumerationNumbers`, instead of by declaration position (#280) - **Arc** ([Release v22.161.0](https://github.com/Cratis/Arc/releases/tag/v22.161.0)): Releasing a read model no longer deadlocks when the release completes asynchronously under a single-threaded synchronization context. (part of #2855) - **Arc** ([Release v22.161.0](https://github.com/Cratis/Arc/releases/tag/v22.161.0)): Workspace package publishing retries equivalent-entry transparency-log conflicts without dropping provenance or unblocking failed dependencies. (#3650) - **Chronicle** ([Release v19.117.1](https://github.com/Cratis/Chronicle/releases/tag/v19.117.1)): Values declared in event type migrations (`DefaultValue`, and the `from`/`to` of `MapValues`) are now serialized with the store's configured naming policy, so object-shaped defaults match the payload and schema when `WithCamelCaseNamingPolicy()` is used. Declared defaults keep their explicit nulls. (#5611) - **AuthProxy** ([Release v2.41.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.41.1)): Signing in no longer fails with `502 upstream sent too big header` behind ingress-nginx's default 4k buffer after earlier sign-in attempts in the same browser were abandoned or failed. AuthProxy now clears leftover sign-in cookies a bounded amount per response instead of all at once; the rest expire on their own within an hour. (#225) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Webhooks registered as not replayable now get a non-replayable observer, so a replay no longer re-delivers events to them; existing observers are corrected the next time the webhook subscribes (part of #5409) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Projection definition changes no longer stall or time out while a passive read of the same projection is in progress. (#5403) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Projection definition changes no longer stall when a subscriber activates or deactivates. (#5510) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Event stores created implicitly by any client call are now initialized before the Workbench lists them or reads their statistics, so a fresh store shows empty statistics instead of a missing read-model error (#4414) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Workbench dashboards show an unavailable or empty state, instead of throwing, when event type statistics are missing or fail to load (#4414) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Shared-host integration fixtures again reject a test singleton registered by an earlier context instead of silently reusing it. (#5502) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): SQL storage documentation now describes typed scalar columns and JSON columns for nested objects and collections (#5541) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Reducer documentation explains how the event sequence is inferred when none is specified (#5541) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): `NotRewindable` documentation no longer claims replay is prohibited or that it improves performance; it sets the projection definition's rewindable flag (#5541) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Read model querying documentation explains that `Observe` filters on the client and which read models support it (#5541) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): TypeScript gRPC package contributor guide corrects the package's exports, declaration paths and dependencies, and documents build triggers and trusted publishing (#5541) - **Chronicle** ([Release v19.117.0](https://github.com/Cratis/Chronicle/releases/tag/v19.117.0)): Event seeding documentation now explains that a rejected seed batch is logged on the server and left unseeded rather than failing registration (#5541) - **AI** ([Release v7.130.0](https://github.com/Cratis/AI/releases/tag/v7.130.0)): The quality gate picks the default xUnit v3 runner and detects test projects correctly. (part of #961) - **AI** ([Release v7.130.0](https://github.com/Cratis/AI/releases/tag/v7.130.0)): The Orleans rule example no longer contains a connection URI that secret masking flagged, and broadly scoped connection-string rules now detect storage credentials. (#950) - **Prompter** ([Release v0.14.8](https://github.com/Cratis/Prompter/releases/tag/v0.14.8)): Prompter no longer asks "which product do you mean?" when the strongest evidence for a question is already a cross-cutting overview page (for example "what are all Cratis products and what do they do?"); it answers directly from that page. - **Prompter** ([Release v0.14.8](https://github.com/Cratis/Prompter/releases/tag/v0.14.8)): Broad questions such as "What is Cratis good at?", "Why use Cratis?" and "What are Cratis's strengths?" are grounded in the documentation's own overview pages (`cratis.io/why-cratis`, `cratis.io/cratis-stack`) rather than the company site's FAQ, and each point names the Cratis product behind it. - **Prompter** ([Release v0.14.8](https://github.com/Cratis/Prompter/releases/tag/v0.14.8)): Answers no longer cite a site's `/llms.txt` link index; they cite the real pages instead. - **Specifications** ([Release v5.2.2](https://github.com/Cratis/Specifications/releases/tag/v5.2.2)): An xUnit v3 specification class whose facts will all be skipped, or excluded by the explicit-test option, no longer runs its shared `Establish` or creates the specification instance, so it starts no shared resources. Skip conditions set with `SkipWhen` or `SkipUnless` are honoured, including conditions inherited from a base class. (#99) - **Prompter** ([Release v0.14.7](https://github.com/Cratis/Prompter/releases/tag/v0.14.7)): An answer that still describes its own sources ("the excerpts mention...", "this passage covers...") despite the system prompt's rule against it is no longer delivered as-is: the offending sentence is deterministically removed before the answer reaches the user, without dropping any citation it carries (part of #118). - **Prompter** ([Release v0.14.6](https://github.com/Cratis/Prompter/releases/tag/v0.14.6)): Prompter no longer names "the excerpts" or "the capability map" as its source when listing every Cratis product for an exhaustive list-style question. - **Prompter** ([Release v0.14.5](https://github.com/Cratis/Prompter/releases/tag/v0.14.5)): Raised the answer generation output-token ceiling from 1536 to 3072 so a complete, fully-cited "list all Cratis products"-style answer can finish in a single model dispatch instead of hitting the cap mid-reply and falling back to a generic, product-less response (part of #107). - **Prompter** ([Release v0.14.3](https://github.com/Cratis/Prompter/releases/tag/v0.14.3)): Prompter's answer to "list all Cratis products" style questions now always names every product, instead of sometimes dropping one of the core products while still citing the right page. - **Prompter** ([Release v0.14.2](https://github.com/Cratis/Prompter/releases/tag/v0.14.2)): Overview questions such as "What is Cratis, in a nutshell?" and "What is Cratis good at?" cite the Cratis overview pages again: pages without a top-level heading now take their title from frontmatter instead of the URL. A full reindex is required after upgrading. (part of #103) ## Removed - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The Ollama runner (`ralph-ollama.js`), which could not read the loop's tasks or build a planned slice; building requires Claude Code (#35) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The undocumented shell loop (`ralph.sh` and `lib/agent.sh`), which also skipped every permission check - **Chronicle** ([Release v19.138.0](https://github.com/Cratis/Chronicle/releases/tag/v19.138.0)): `On()` on `IChildrenJoinBuilder` and `ChildrenJoinBuilder`; child joins always join on the identity set (#5638) - **Components** ([Release v4.39.1](https://github.com/Cratis/Components/releases/tag/v4.39.1)): Duplicate documentation build trigger in the publish workflow (part of https://github.com/Cratis/Documentation/issues/226) ## Security - **Ante** ([Release v1.12.0](https://github.com/Cratis/Ante/releases/tag/v1.12.0)): Derive `/.cratis/me` and the browser's identity from the authenticated request rather than forged or replayed `.cratis-identity` cookies, using Arc 22.179.0 on the server and frontend. Ante's forwarded subject and name header fallbacks now require an authenticated principal. (#143) - **AuthProxy** ([Release v2.55.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.55.0)): Personal access tokens, bearer tokens, DPoP and on-behalf requests are refused fail-closed by the v2 signer until their authoritative credential adapters exist. - **AuthProxy** ([Release v2.54.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.54.0)): Fresh authentication closes bearer and query-based method-override bypasses, and the verified authentication time is checked before upstream claims are captured. (#259) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The loop no longer runs Claude with `--dangerously-skip-permissions`: file edits are accepted inside the project only, and the agent may run just the commands the kit needs (`dotnet build`/`test`/`restore`, branch-safe `git`, `yarn install`/`build`/`lint`/`test`, `curl`). Extend the list with `allowedTools` in the kit config or `RALPH_ALLOWED_TOOLS`; a refused command is reported as a blocked slice (#31) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The board token is no longer written into the agent's prompt. It reaches the skills and the board MCP server through the `EVENTMODELERS_TOKEN` environment variable; rotate any token used with an earlier version (#32) - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.2](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.2)): The code export server listens on `127.0.0.1` only, answers browser requests from the board's origin only, and requires a per-install secret (`codeExportSecret` in `.build-kit/.eventmodelers/config.json`) as `Authorization: Bearer <secret>` or `X-Export-Secret` (#33) - **AuthProxy** ([Release v2.51.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.51.1)): Outbound back-channel HTTP clients (proxying, admission, bearer routes, invites, client-credentials verification and OAuth/OIDC/JWT back channels) now disable cookie storage and replay. Documented callback identity headers are unchanged. (#277) - **AuthProxy** ([Release v2.50.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.50.1)): On routes configured as anonymous, forwarded identity, tenant, authorization, on-behalf and signature material is now removed before the request reaches the backend, including caller-supplied copies. (#275) - **AuthProxy** ([Release v2.50.1](https://github.com/Cratis/AuthProxy/releases/tag/v2.50.1)): Authentication bootstrap path matching now accepts only the configured callback paths instead of any path starting with `/signin-`. (part of #275) - **AI** ([Release v7.138.1](https://github.com/Cratis/AI/releases/tag/v7.138.1)): The write guard classifies glob patterns in file references more conservatively, so a bracket or brace pattern that could expand to a protected file is refused. A reference it cannot classify safely is refused rather than allowed. Run `cratis ai update` to pick up the hook change (#1038) - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): Scoped `IEventStore` and `GetEventStore(name)` inside a reactor, reducer or occurrence delivery now resolve to the namespace the event was delivered from. - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): Client connections are now tied to the identity that opened them, and connected-client listings show non-administrators only their own connections. - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): Compare encryption key identifiers exactly on SQL Server, so identifiers that differ only in letter case, width or trailing spaces get separate keys. Identifiers stored before the upgrade that differ only in this way are refused until an operator has reviewed them; see https://github.com/Cratis/Chronicle/blob/main/Documentation/hosting/configuration/compliance-storage.md#encryption-key-identifiers-on-sql-server - **Chronicle** ([Release v19.136.0](https://github.com/Cratis/Chronicle/releases/tag/v19.136.0)): Encryption key lookups in Vault and Azure Key Vault now refuse keys they cannot resolve instead of returning empty values. - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): Signed forwarded identity v2 credentials are accepted only through a forwarding hop that presents a trusted client certificate (#3704) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): A request on a capability port that another authentication scheme authenticated as a different subject is refused (#3731) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): Tenant membership is checked for the verified subject before an operation runs on a capability port (#3731) - **Arc** ([Release v22.170.0](https://github.com/Cratis/Arc/releases/tag/v22.170.0)): A caller verified earlier in a request is no longer reused when the forwarding hop's admission changes (#3704) - **AuthProxy** ([Release v2.47.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.47.0)): AuthProxy now removes every client-supplied forwarded-identity context header and compares protected header names without regard to case or to `_` versus `-`, so backends only see identity headers that AuthProxy set itself. Routing headers such as `x-cratis-microservice` are still forwarded (#252) - **Arc** ([Release v22.169.1](https://github.com/Cratis/Arc/releases/tag/v22.169.1)): Callers verified from a signed browser envelope now keep the signed tenant, scope ceiling and declared client; signed tenant values that disagree, or a resolved tenant that differs from the signed one, are refused (part of #3709) - **Arc** ([Release v22.169.1](https://github.com/Cratis/Arc/releases/tag/v22.169.1)): A caller verified earlier in a request is reused only while the request inputs it was verified from are unchanged; otherwise the request is refused (part of #3709) - **AI** ([Release v7.137.1](https://github.com/Cratis/AI/releases/tag/v7.137.1)): Agent worker harnesses give each agent CLI only the provider credential it needs; the worker callback token stays with the harness and its progress helper. - **AI** ([Release v7.137.1](https://github.com/Cratis/AI/releases/tag/v7.137.1)): Credentials are no longer written into generated MCP configurations, process arguments or timing reports. - **AI** ([Release v7.137.1](https://github.com/Cratis/AI/releases/tag/v7.137.1)): The Kubernetes worker runtime mounts the worker secret readable only by the worker group instead of world-readable. - **Eventmodelers-Build-Kit-Java** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Java/releases/tag/v1.0.1)): If you installed an earlier version, check your project history for `.eventmodelers/config.json`. Rotate any board token that was committed. - **Eventmodelers-Build-Kit-Kotlin** ([Release v1.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-Kotlin/releases/tag/v1.0.1)): If you installed an earlier version, check your project history for `.eventmodelers/config.json`. Rotate any board token that was committed. - **Eventmodelers-Build-Kit-CSharp** ([Release v0.0.1](https://github.com/Cratis/Eventmodelers-Build-Kit-CSharp/releases/tag/v0.0.1)): If you installed an earlier version, check your project history for `.eventmodelers/config.json`. Rotate any board token that was committed. - **Choreography** ([Release v1.34.1](https://github.com/Cratis/Choreography/releases/tag/v1.34.1)): The serialization type filters registered by `AddCratisOrleansSerializers()` no longer allow a closed generic type outright. They allow only the plain types and generic type definitions they own, and Orleans then allows a closed generic type such as `Result<string, JobId>` only when each of its generic arguments is allowed as well. This applies to `CratisTypesFilter`, `CratisJsonSerializer`, `OneOfSerializer`, `ConceptSerializer` and `LinqCollectionCopier`. Payloads whose generic arguments are all allowed serialize as before. - **Choreography** ([Release v2.1.2](https://github.com/Cratis/Choreography/releases/tag/v2.1.2)): The serialization type filters registered by `AddCratisChoreographySerializers()` no longer allow a closed generic type outright. They allow only the plain types and generic type definitions they own, and Orleans then allows a closed generic type such as `Result<string, JobId>` only when each of its generic arguments is allowed as well. This applies to `CratisTypesFilter`, `CratisJsonSerializer`, `OneOfSerializer`, `ConceptSerializer` and `LinqCollectionCopier`. Payloads whose generic arguments are all allowed serialize as before. - **Chronicle** ([Release v19.121.1](https://github.com/Cratis/Chronicle/releases/tag/v19.121.1)): `[PII]` and `[Encrypted]` on a property or record parameter whose type is a `ConceptAs<T>`, or a collection of such concepts, are now kept in the event type's schema, so those values are protected when they are appended. Before this fix, the attribute was silently dropped and the value was stored in plain text; it was only applied when the attribute was on the concept type itself. (#5623) - **Chronicle** ([Release v19.121.1](https://github.com/Cratis/Chronicle/releases/tag/v19.121.1)): Events appended before this upgrade are not re-encrypted. Their values stay in plain text and are not removed when a subject's key is erased. Review event types that put `[PII]` or `[Encrypted]` on a concept-typed property or a collection of concepts, since their earlier events hold those values unprotected. (part of #5623) - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): Templates can no longer read, write, change permissions on or run commands outside the folder they render into. A rendered file, solution, project reference, chmod target, JSON property file or script working directory is refused when its path is absolute, uses `..` to leave the output folder, or reaches outside it through a symbolic link. Rendering stops with an invalid-manifest error, and a post-action skips that path or fails rather than touching it. (#530) - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): Harden template package acquisition and installation. Every package entry is checked before anything is written, linked store paths are refused, an interrupted install recovers on the next acquisition, and a committed install stays in place when cleaning up the previous one fails. Local feeds and cached packages prefer stable versions, and ordinary local package file names are accepted. (#543) - **cli** ([Release v3.120.0](https://github.com/Cratis/cli/releases/tag/v3.120.0)): `cratis ai install`, `update` and `uninstall` validate the complete install plan before applying changes. Supported harness layouts, including those written by earlier CLI versions, and dry-run behavior are preserved. (#544) ## Deprecated - **Chronicle** ([Release v19.126.0](https://github.com/Cratis/Chronicle/releases/tag/v19.126.0)): On() on child joins is obsolete: child joins use IdentifiedBy(), and On() will be removed in the next major (#1350) - **Stage** ([Release v4.217.0](https://github.com/Cratis/Stage/releases/tag/v4.217.0)): Dictionary-returning `SceneGuards.Convert`/`Subject` and the `GuardPath`/`SubjectKey` constants, in favour of the typed `ConvertToCondition`/`SubjectReferenceFor`. (part of #209)