@cratis/pi 7.103.3 → 7.103.5

package/package/corpus/harnesses/copilot/instructions/go.instructions.md

@@ -24,7 +24,9 @@ exact commands.
 
 - Read the `go` directive, build constraints and CI before choosing a feature.
   The minimum is not the newest locally installed compiler; a `toolchain`
-  preference does not replace minimum-version testing. Do not raise it incidentally.
+  preference does not replace minimum-version testing. Do not raise it incidentally
+  or rewrite unrelated code to modernize syntax. Verify unfamiliar APIs against the
+  documentation for that minimum, and keep experimental features opt-in.
 - Iterators require Go 1.23; `T.Context` and `B.Loop` require 1.24;
   stable `testing/synctest` and `WaitGroup.Go` require 1.25.
 - Prefer the standard library when it meets the contract. Review dependency
@@ -33,6 +35,10 @@ exact commands.
   including indirect minimum-version changes; keep sums consistent. A consumer
   must not need a developer's workspace or local replacement.
 - Never edit generated code; change its authoritative inputs and pinned generator.
+- Start with a small public package surface aligned with caller workflows; put
+  implementation-only packages in `internal/` and keep optional adapters apart from
+  core behavior. Do not mandate `pkg/`. Avoid package initialization that performs
+  I/O, starts goroutines or mutates globals.
 
 ## Names, public APIs and values
 
@@ -44,11 +50,23 @@ exact commands.
 - Document exported declarations with comments beginning with their names.
   Explain nil/zero semantics, concurrency, ownership, cancellation, error identities
   and cleanup. Add executable examples for important public workflows.
-- Make zero values useful where possible; reject invalid construction early.
-  Document option defaults, validation, ordering and duplicates.
+- Design exported APIs from realistic caller examples first and export only what
+  the library will support. Make zero values useful where possible; reject invalid
+  construction early. Use plain parameters or config structs for simple
+  configuration and functional options when extensibility outweighs the added
+  namespace; document option defaults, validation, ordering and duplicates.
+- Reuse standard interfaces such as `io.Reader` and `http.Handler`; prefer concrete
+  returns unless an abstraction is part of the API. Use pointer receivers for
+  mutation or values that must not be copied, and avoid public embedding that
+  promotes dependency methods. Mark retired API with a `Deprecated:` paragraph
+  naming the replacement.
 - Use named domain values instead of interchangeable primitives. Defined types
   do not inherit codec methods; explicitly forward text/JSON codecs and test wire
   formats. See `cratis-fundamentals-concept-go` when using Fundamentals.Go.
+- Specify `Close` ownership, repeated-close behavior and use after close, and
+  document concurrent-use guarantees for clients, handles and callbacks.
+- Use generics for meaningful type-safe reuse, not speculative abstraction; do not
+  replace domain types with `any` for plumbing convenience.
 - Document whether slices, maps, config and results are owned, copied or borrowed.
   Copying a slice/map header is not a detached copy. Do not copy a used mutex,
   wait group or atomic value, or expose pooled bytes after returning their buffer.
@@ -62,7 +80,9 @@ exact commands.
   return an `error` interface containing a typed nil.
 - Add useful operation context. Handle/log an error at one boundary rather than
   repeatedly logging and returning it. A partial or ambiguous write is not success
-  and must not trigger a blind retry.
+  and must not trigger a blind retry. Use sentinels for stable categories and typed
+  errors for structured details; translate dependency errors whose identity must
+  stay internal, and explain intentional suppression.
 - Put `context.Context` first for blocking/cancelable work and propagate it through
   RPCs, HTTP, storage and callbacks. Never escape caller cancellation by replacing
   it with `Background`. Do not retain request contexts in long-lived clients.
@@ -73,6 +93,9 @@ exact commands.
 
 ## Goroutines, streams and iterators
 
+- Prefer synchronous APIs and let callers place concurrency. A saturated
+  `errgroup.SetLimit` can block `Go`; use `errgroup` only when its cancellation
+  and error behavior fits.
 - Each goroutine needs an owner, termination condition and observable join path.
   Cancellation requests termination; it does not join workers.
 - Bound workers, queues, subscriptions, buffers and retries; define backpressure.
@@ -85,6 +108,8 @@ exact commands.
 - Preserve protocol metadata, tenancy, checkpoints and duplicate-delivery semantics.
   No generic retry or stream helper may promise exactly-once effects.
 - Validate remote TLS identities. Development exceptions must be explicit.
+  Bound untrusted payload sizes, fan-out and retained subscription state, and keep
+  long-lived subscription lifetimes apart from unary-call deadlines.
   Use cryptographic randomness for secrets, never `math/rand`.
 
 ## Specifications and checks
@@ -98,10 +123,23 @@ exact commands.
 - Cover error identity, nil/zero input, cancellation/deadlines, partial outcomes,
   early stream exit and resource ownership. Bound fuzz duration and preserve
   failing seeds. Use race checks where supported; race-free does not mean leak-free.
+- Add a regression test for each corrected behavior, including error and boundary
+  cases. Use `httptest` or `bufconn` plus real-transport tests where needed, and
+  protobuf-aware comparison for generated types.
+- Profile or benchmark a demonstrated problem before optimizing; add no pools,
+  caches or `unsafe` without measured justification.
 - Run the repository's build, tests, formatting, vet and pinned golangci-lint gates,
   with race and vulnerability scanning as separate checks. Respect the declared
   minimum without silent toolchain upgrades. Report absent tools honestly.
 
+## Compatibility and releases
+
+- Prefer additive change: exported signature changes break callers, and adding a
+  method to an exported interface breaks its external implementations. Check struct comparability, embedding, defaults, errors and wire shape;
+  API-diff tools aid but cannot prove behavioral compatibility.
+- Introduce `/v2` only with a migration and parallel-support plan. Never move a
+  published tag; issue a corrective release and retract when needed.
+
 ## Adaptation and attribution
 
 This condensed rule adapts the repository-owned Go baseline at

package/package/corpus/hooks/README.md

@@ -128,6 +128,22 @@ ignored records. Other ignored files (`node_modules`, build output) go with a de
   `--include-work-records` only after preserving any records you still need: it permits deleting
   `.ai-work/` content, but never overrides locks or other safety checks. Hook mode ignores this flag;
   automatic hooks never opt in.
+- **GitHub lookups.** The complete worktree and branch sweep is planned before any removal. Git
+  ancestry is checked first; only a plan needing more evidence triggers the single REST batch. It
+  reads the latest 100 closed pull requests, so older merged branches absent from that page are simply
+  kept. Only merged entries with the exact branch and head commit qualify. Hook runs share an atomic
+  stamp and cache under the Git common directory, with at most one request per repository every
+  15 minutes, including failed attempts. A fresh successful cache is reused. A failed request, invalid
+  response, or unavailable lock without a fresh successful cache aborts **all** removals in that sweep,
+  including ancestry-proven worktrees and branches, with a one-line notice. Failed attempts are marked
+  for the full window: later plans needing GitHub also abort all removals without retrying, while plans
+  needing only ancestry evidence proceed without GitHub. Locks older than 15 minutes can be reclaimed.
+  Manual runs are not throttled, but also use at most one request per run and abort all removals if
+  that request fails.
+- **Disable GitHub only.** Set `CRATIS_CLEANUP_NO_GH=1` to avoid all GitHub lookups while keeping
+  cleanup based on Git ancestry enabled. Missing `gh` or `jq`, a non-GitHub origin, or an invalid
+  repository slug also select ancestry-only cleanup before planning: unproven items are kept, with
+  no GitHub call, abort, or failed-attempt marker.
 - **Pin a long-lived worktree.** Use `git worktree lock <path>` to keep it out of cleanup; release the
   pin with `git worktree unlock <path>` when ready.
 - **Self-test.** `--self-test` plants delivered, dirty, unmerged, brand-new, work-record and locked cases

package/package/corpus/hooks/scripts/cratis-cleanup-worktrees.sh

@@ -139,34 +139,121 @@ REMOVED=(); KEPT=(); FREED_KB=0
 note_removed() { REMOVED+=("$1"); }
 note_kept() { KEPT+=("$1"); }
 
-# delivered <sha> <branch|""> <upstream-track>  → prints the evidence, returns 0 when delivered
-delivered() {
-    local sha="$1" br="$2" track="$3"
+# The cache is available only after a successful, valid batch. Failed attempts also stamp the window.
+GH_PULLS=''
+valid_pulls() {
+    jq -e -s 'length == 1 and (.[0] | type == "array" and all(.[];
+        type == "object" and has("merged_at") and (.merged_at == null or (.merged_at | type == "string")) and
+        (.head | type == "object" and (.ref | type == "string") and (.sha | type == "string"))))' "$1" >/dev/null 2>&1
+}
+lock_stat() { stat -c '%i %Y' "$1" 2>/dev/null || stat -f '%i %m' "$1" 2>/dev/null; }
+fresh_stamp() {
+    local stamp
+    stamp=$(cat "$state/stamp" 2>/dev/null || true)
+    [[ "$stamp" =~ ^[0-9]+$ ]] && [ "$now" -lt "$((stamp + 900))" ]
+}
+cached_pulls() {
+    fresh_stamp && [ ! -e "$state/failed" ] && valid_pulls "$state/pulls.json" || return 1
+    cat "$state/pulls.json"
+}
+take_lock() {
+    mkdir "$state/lock" 2>/dev/null && return 0
+    local modified retired acquired
+    read -r _ modified < <(lock_stat "$state/lock")
+    [[ "$modified" =~ ^[0-9]+$ ]] && [ "$now" -ge "$((modified + 900))" ] || return 1
+    # Rename atomically: a killed reclaimer can leave only a retired directory, never a blocking marker.
+    retired="$state/lock.stale.$$.$RANDOM"
+    mv "$state/lock" "$retired" 2>/dev/null || return 1
+    acquired=1
+    mkdir "$state/lock" 2>/dev/null && acquired=0
+    rm -rf "$retired"
+    return "$acquired"
+}
+hook_pulls() (
+    local repo="$1" common state now temporary lock_inode current
+    common=$(git rev-parse --git-common-dir) || exit 1
+    state="$common/cratis-cleanup-gh/$repo"
+    now=$(date +%s)
+    mkdir -p "$state" 2>/dev/null || exit 1
+    if ! take_lock; then cached_pulls; exit $?; fi
+    read -r lock_inode _ < <(lock_stat "$state/lock")
+    temporary=''
+    # A retired owner must never remove its replacement's lock.
+    trap '[[ -z "$temporary" ]] || rm -f "$temporary"; read -r current _ < <(lock_stat "$state/lock"); [ "$current" != "$lock_inode" ] || rmdir "$state/lock" 2>/dev/null' EXIT
+    if fresh_stamp; then cached_pulls; exit $?; fi
+    temporary=$(mktemp "$state/pulls.XXXXXX") || exit 1
+    printf '%s\n' "$now" > "$temporary" && mv "$temporary" "$state/failed" || exit 1
+    printf '%s\n' "$now" > "$temporary" && mv "$temporary" "$state/stamp" || exit 1
+    read -r current _ < <(lock_stat "$state/lock")
+    [ "$current" = "$lock_inode" ] || exit 1
+    # Only the latest 100 closed PRs are searched; older merged branches are simply kept.
+    if gh api "repos/$repo/pulls?state=closed&per_page=100" > "$temporary" 2>/dev/null && valid_pulls "$temporary"; then
+        read -r current _ < <(lock_stat "$state/lock")
+        [ "$current" = "$lock_inode" ] || exit 1
+        mv "$temporary" "$state/pulls.json" && rm -f "$state/failed" || exit 1
+        cat "$state/pulls.json"
+    else exit 1; fi
+)
+GH_POSSIBLE=0; GH_REPO=''
+configure_github() {
+    [ "${CRATIS_CLEANUP_NO_GH:-}" != 1 ] || return 0
+    command -v gh >/dev/null 2>&1 && command -v jq >/dev/null 2>&1 || return 0
+    local remote repo
+    remote=$(git remote get-url origin 2>/dev/null) || return 0
+    case "$remote" in
+        https://github.com/*) repo=${remote#https://github.com/} ;;
+        git@github.com:*) repo=${remote#git@github.com:} ;;
+        ssh://git@github.com/*) repo=${remote#ssh://git@github.com/} ;;
+        *) return 0 ;;
+    esac
+    repo=${repo%.git}
+    [[ "$repo" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || return 0
+    GH_REPO=$repo; GH_POSSIBLE=1
+}
+configure_github
+load_pulls() {
+    if [ "$HOOK" = 1 ]; then GH_PULLS=$(hook_pulls "$GH_REPO") || return 1
+    else GH_PULLS=$(gh api "repos/$GH_REPO/pulls?state=closed&per_page=100" 2>/dev/null) || return 1; fi
+    printf '%s' "$GH_PULLS" | valid_pulls /dev/stdin
+}
+
+# Ancestry evidence is resolved during planning; GitHub evidence only after the complete plan exists.
+ancestry_delivered() {
+    local sha="$1" track="$3"
     if git merge-base --is-ancestor "$sha" "$default" 2>/dev/null; then
-        if ! grep -qx "$sha" "$firstparent"; then echo "merged into $default"; return 0; fi
-        if [ "$track" = "[gone]" ]; then echo "merged into $default, upstream gone"; return 0; fi
-    fi
-    if [ -n "$br" ] && [ "${CRATIS_CLEANUP_NO_GH:-}" != 1 ] && command -v gh >/dev/null 2>&1; then
-        if gh pr list --head "$br" --state merged --json headRefOid -q '.[].headRefOid' 2>/dev/null | grep -qx "$sha"; then
-            echo "pull request merged at this commit"; return 0
-        fi
+        if ! grep -qx "$sha" "$firstparent"; then EVIDENCE="merged into $default"; return 0; fi
+        if [ "$track" = "[gone]" ]; then EVIDENCE="merged into $default, upstream gone"; return 0; fi
     fi
     return 1
 }
+github_delivered() {
+    printf '%s' "$GH_PULLS" | jq -e --arg br "$1" --arg sha "$2" \
+        'any(.[]; .merged_at != null and .head.ref == $br and .head.sha == $sha)' >/dev/null 2>&1
+}
+PLAN_KIND=(); PLAN_PATH=(); PLAN_SHA=(); PLAN_BRANCH=(); PLAN_EVIDENCE=(); NEEDS_GH=0
+plan_item() {
+    local kind="$1" path="$2" tip="$3" branch="$4" evidence=''
+    if ancestry_delivered "$tip" "$branch" "$([ -n "$branch" ] && track_of "$branch")"; then evidence=$EVIDENCE
+    elif [ -n "$branch" ] && [ "$GH_POSSIBLE" = 1 ]; then NEEDS_GH=1; fi
+    PLAN_KIND+=("$kind"); PLAN_PATH+=("$path"); PLAN_SHA+=("$tip")
+    PLAN_BRANCH+=("$branch"); PLAN_EVIDENCE+=("$evidence")
+}
 track_of() { git for-each-ref --format='%(upstream:track)' "refs/heads/$1" 2>/dev/null; }
 
-# ── Worktrees ─────────────────────────────────────────────────────────────────
-git worktree prune >/dev/null 2>&1
+# ── Plan the entire sweep without removing worktrees or branches ──────────────
 wt=""; sha=""; br=""; locked=0; first=1
 process_worktree() {
     [ -n "$wt" ] || return 0
     if [ "$first" = 1 ]; then first=0; return 0; fi        # the main worktree is never removed
-    local name="${br:-detached}" ev
+    local name="${br:-detached}"
     if [ "$locked" = 1 ]; then note_kept "worktree $wt ($name): locked"; return 0; fi
     case "$here/" in "$wt"/*) note_kept "worktree $wt ($name): it is the current directory - run the sweep from the main checkout"; return 0 ;; esac
-    if ! ev=$(delivered "$sha" "$br" "$([ -n "$br" ] && track_of "$br")"); then
-        note_kept "worktree $wt ($name): work not delivered to $default"; return 0
-    fi
+    plan_item worktree "$wt" "$sha" "$br"
+}
+execute_worktree() {
+    local name="${br:-detached}" ev="$1" current
+    current=$(git -C "$wt" rev-parse HEAD 2>/dev/null) || return 0
+    [ "$current" = "$sha" ] || { note_kept "worktree $wt ($name): tip changed since planning"; return 0; }
     if [ "$INCLUDE_WORK_RECORDS" = 0 ] && [ -d "$wt/.ai-work" ]; then
         local records
         if ! records=$(find "$wt/.ai-work/." -mindepth 1 -maxdepth 1 -print -quit); then
@@ -191,20 +278,49 @@ while IFS= read -r line; do
 done < <(git worktree list --porcelain; echo)
 process_worktree
 
-# ── Local branches ────────────────────────────────────────────────────────────
 in_use=$(git worktree list --porcelain | sed -n 's#^branch refs/heads/##p')
+planned_branches=$(printf '%s\n' "${PLAN_BRANCH[@]+"${PLAN_BRANCH[@]}"}")
 while IFS='|' read -r b bsha; do
     if [ -z "$b" ] || [ "$b" = "$default_local" ]; then continue; fi
-    printf '%s\n' "$in_use" | grep -qx "$b" && continue
-    if ev=$(delivered "$bsha" "$b" "$(track_of "$b")"); then
-        if [ "$DRY" = 1 ]; then note_removed "branch $b: would delete, $ev"
-        elif git branch -D "$b" >/dev/null 2>&1; then note_removed "branch $b: $ev"
-        else note_kept "branch $b: git refused to delete it"; fi
-    else
-        note_kept "branch $b: work not delivered to $default"
+    if printf '%s\n' "$in_use" | grep -qx "$b"; then
+        [ "$DRY" = 0 ] || continue
+        printf '%s\n' "$planned_branches" | grep -qx "$b" || continue
     fi
+    plan_item branch "$b" "$bsha" "$b"
 done < <(git for-each-ref --format='%(refname:short)|%(objectname)' refs/heads)
 
+abort_sweep() {
+    echo "cratis-cleanup-worktrees: GitHub evidence unavailable; 0 removed, keeping the entire sweep" >&2
+    exit 0
+}
+# Resolve every item's evidence before any deletion, including ancestry-proven items.
+if [ "$NEEDS_GH" = 1 ] && ! load_pulls; then abort_sweep; fi
+for ((i=0; i<${#PLAN_KIND[@]}; i++)); do
+    if [ -z "${PLAN_EVIDENCE[i]}" ] && [ -n "${PLAN_BRANCH[i]}" ] && [ -n "$GH_PULLS" ]; then
+        if github_delivered "${PLAN_BRANCH[i]}" "${PLAN_SHA[i]}"; then PLAN_EVIDENCE[i]="pull request merged at this commit"
+        else result=$?; [ "$result" = 1 ] || abort_sweep; fi
+    fi
+done
+
+# ── Execute the resolved plan, rechecking tips and worktree safety ─────────────
+git worktree prune >/dev/null 2>&1
+for ((i=0; i<${#PLAN_KIND[@]}; i++)); do
+    kind=${PLAN_KIND[i]}; path=${PLAN_PATH[i]}; sha=${PLAN_SHA[i]}; br=${PLAN_BRANCH[i]}; ev=${PLAN_EVIDENCE[i]}
+    if [ "$kind" = branch ]; then
+        git worktree list --porcelain | sed -n 's#^branch refs/heads/##p' | grep -qx "$br" && continue
+    fi
+    if [ -z "$ev" ]; then
+        if [ "$kind" = worktree ]; then note_kept "worktree $path (${br:-detached}): work not delivered to $default"
+        else note_kept "branch $br: work not delivered to $default"; fi
+        continue
+    fi
+    if [ "$kind" = worktree ]; then wt=$path; execute_worktree "$ev"; continue; fi
+    [ "$(git rev-parse -q --verify "refs/heads/$br")" = "$sha" ] || { note_kept "branch $br: tip changed since planning"; continue; }
+    if [ "$DRY" = 1 ]; then note_removed "branch $br: would delete, $ev"
+    elif git branch -D "$br" >/dev/null 2>&1; then note_removed "branch $br: $ev"
+    else note_kept "branch $br: git refused to delete it"; fi
+done
+
 # ── Report ────────────────────────────────────────────────────────────────────
 summary="cratis-cleanup-worktrees: ${#REMOVED[@]} removed, ${#KEPT[@]} kept"
 [ "$FREED_KB" -gt 0 ] && summary="$summary, $((FREED_KB / 1024)) MB freed"

package/package/corpus/rules/go.md

@@ -23,7 +23,9 @@ exact commands.
 
 - Read the `go` directive, build constraints and CI before choosing a feature.
   The minimum is not the newest locally installed compiler; a `toolchain`
-  preference does not replace minimum-version testing. Do not raise it incidentally.
+  preference does not replace minimum-version testing. Do not raise it incidentally
+  or rewrite unrelated code to modernize syntax. Verify unfamiliar APIs against the
+  documentation for that minimum, and keep experimental features opt-in.
 - Iterators require Go 1.23; `T.Context` and `B.Loop` require 1.24;
   stable `testing/synctest` and `WaitGroup.Go` require 1.25.
 - Prefer the standard library when it meets the contract. Review dependency
@@ -32,6 +34,10 @@ exact commands.
   including indirect minimum-version changes; keep sums consistent. A consumer
   must not need a developer's workspace or local replacement.
 - Never edit generated code; change its authoritative inputs and pinned generator.
+- Start with a small public package surface aligned with caller workflows; put
+  implementation-only packages in `internal/` and keep optional adapters apart from
+  core behavior. Do not mandate `pkg/`. Avoid package initialization that performs
+  I/O, starts goroutines or mutates globals.
 
 ## Names, public APIs and values
 
@@ -43,11 +49,23 @@ exact commands.
 - Document exported declarations with comments beginning with their names.
   Explain nil/zero semantics, concurrency, ownership, cancellation, error identities
   and cleanup. Add executable examples for important public workflows.
-- Make zero values useful where possible; reject invalid construction early.
-  Document option defaults, validation, ordering and duplicates.
+- Design exported APIs from realistic caller examples first and export only what
+  the library will support. Make zero values useful where possible; reject invalid
+  construction early. Use plain parameters or config structs for simple
+  configuration and functional options when extensibility outweighs the added
+  namespace; document option defaults, validation, ordering and duplicates.
+- Reuse standard interfaces such as `io.Reader` and `http.Handler`; prefer concrete
+  returns unless an abstraction is part of the API. Use pointer receivers for
+  mutation or values that must not be copied, and avoid public embedding that
+  promotes dependency methods. Mark retired API with a `Deprecated:` paragraph
+  naming the replacement.
 - Use named domain values instead of interchangeable primitives. Defined types
   do not inherit codec methods; explicitly forward text/JSON codecs and test wire
   formats. See `cratis-fundamentals-concept-go` when using Fundamentals.Go.
+- Specify `Close` ownership, repeated-close behavior and use after close, and
+  document concurrent-use guarantees for clients, handles and callbacks.
+- Use generics for meaningful type-safe reuse, not speculative abstraction; do not
+  replace domain types with `any` for plumbing convenience.
 - Document whether slices, maps, config and results are owned, copied or borrowed.
   Copying a slice/map header is not a detached copy. Do not copy a used mutex,
   wait group or atomic value, or expose pooled bytes after returning their buffer.
@@ -61,7 +79,9 @@ exact commands.
   return an `error` interface containing a typed nil.
 - Add useful operation context. Handle/log an error at one boundary rather than
   repeatedly logging and returning it. A partial or ambiguous write is not success
-  and must not trigger a blind retry.
+  and must not trigger a blind retry. Use sentinels for stable categories and typed
+  errors for structured details; translate dependency errors whose identity must
+  stay internal, and explain intentional suppression.
 - Put `context.Context` first for blocking/cancelable work and propagate it through
   RPCs, HTTP, storage and callbacks. Never escape caller cancellation by replacing
   it with `Background`. Do not retain request contexts in long-lived clients.
@@ -72,6 +92,9 @@ exact commands.
 
 ## Goroutines, streams and iterators
 
+- Prefer synchronous APIs and let callers place concurrency. A saturated
+  `errgroup.SetLimit` can block `Go`; use `errgroup` only when its cancellation
+  and error behavior fits.
 - Each goroutine needs an owner, termination condition and observable join path.
   Cancellation requests termination; it does not join workers.
 - Bound workers, queues, subscriptions, buffers and retries; define backpressure.
@@ -84,6 +107,8 @@ exact commands.
 - Preserve protocol metadata, tenancy, checkpoints and duplicate-delivery semantics.
   No generic retry or stream helper may promise exactly-once effects.
 - Validate remote TLS identities. Development exceptions must be explicit.
+  Bound untrusted payload sizes, fan-out and retained subscription state, and keep
+  long-lived subscription lifetimes apart from unary-call deadlines.
   Use cryptographic randomness for secrets, never `math/rand`.
 
 ## Specifications and checks
@@ -97,10 +122,23 @@ exact commands.
 - Cover error identity, nil/zero input, cancellation/deadlines, partial outcomes,
   early stream exit and resource ownership. Bound fuzz duration and preserve
   failing seeds. Use race checks where supported; race-free does not mean leak-free.
+- Add a regression test for each corrected behavior, including error and boundary
+  cases. Use `httptest` or `bufconn` plus real-transport tests where needed, and
+  protobuf-aware comparison for generated types.
+- Profile or benchmark a demonstrated problem before optimizing; add no pools,
+  caches or `unsafe` without measured justification.
 - Run the repository's build, tests, formatting, vet and pinned golangci-lint gates,
   with race and vulnerability scanning as separate checks. Respect the declared
   minimum without silent toolchain upgrades. Report absent tools honestly.
 
+## Compatibility and releases
+
+- Prefer additive change: exported signature changes break callers, and adding a
+  method to an exported interface breaks its external implementations. Check struct comparability, embedding, defaults, errors and wire shape;
+  API-diff tools aid but cannot prove behavioral compatibility.
+- Introduce `/v2` only with a migration and parallel-support plan. Never move a
+  published tag; issue a corrective release and retract when needed.
+
 ## Adaptation and attribution
 
 This condensed rule adapts the repository-owned Go baseline at

package/package/corpus/skills/cratis-engineering-local-cross-repo-verification/SKILL.md

@@ -55,12 +55,13 @@ commands before choosing the build, regression spec and full gate commands.
 ## Copy this checklist
 
 - [ ] Reproduce the consumer bug and select its regression spec/app action.
-- [ ] Generate one stamp; build and pack the producer's full dependency closure.
+- [ ] Read [references/dependency-map.md](references/dependency-map.md) for the chain between the named repositories, generate one stamp, then pack each producer in upstream order.
 - [ ] If needed, publish the kernel and assets, then build a matching local image.
 - [ ] Activate the consumer overlay and select the local image.
 - [ ] Build the consumer, run its regression specs/app action and required gates.
 - [ ] On failure, diagnose, fix the producer, create a distinct stamp and repeat.
-- [ ] Run `check` before every consumer commit and push, and on the producer.
+- [ ] Run `check` before every consumer commit and push, and on the producer; it must report 0 leaks.
+- [ ] Upstream first: a downstream ships only after the upstream has released and its pin is bumped to the released version.
 - [ ] Restore overlays, unset environment overrides, and run `check` again.
 - [ ] Review stamp-scoped `clean` dry-run targets, then apply cleanup.
 
@@ -92,7 +93,10 @@ For npm, complete the repository build before
 exit `0`. Inspect package dependencies: every locally changed dependency ID must
 resolve to the stamp, not a published fallback. Chronicle's client solution filter
 can omit `Cratis.Chronicle.CodeAnalysis`; pack its code-analysis package project
-separately. A successful pack alone does not prove dependency closure.
+separately. The package IDs a producer should ship are listed in
+[dependency-map.tsv](scripts/dependency-map.tsv) (a reference, see
+[references/dependency-map.md](references/dependency-map.md)); compare them with the feed by hand.
+A successful pack alone does not prove dependency closure.
 
 ### 3. Build an image when needed
 
@@ -237,7 +241,7 @@ minutes, instead of after a release and a pin bump.
 - Read [references/npm-yarn.md](references/npm-yarn.md) when packing frontend libraries or restoring Yarn overlays.
 - Read [references/docker-images.md](references/docker-images.md) when publishing a kernel or selecting images in a consumer.
 - Read [references/go-jvm-python-elixir.md](references/go-jvm-python-elixir.md) when the boundary uses another language toolchain.
-- Read [references/worked-examples.md](references/worked-examples.md) when following Chronicle → Studio, Fundamentals → Arc or Components → Studio.
+- Read [references/worked-examples.md](references/worked-examples.md) when following Chronicle → Studio, Fundamentals → Arc, Components → Studio, Chronicle → Direct, Screenplay → Stage and Studio, Arc → Chronicle, or Fundamentals → Arc → Chronicle.
 - Read [references/other-environments.md](references/other-environments.md) when running on another developer machine or an agent host.
 
 Read `scripts/npm-restore-check.cjs` when inspecting the read-only npm restoration

package/package/corpus/skills/cratis-engineering-local-cross-repo-verification/references/dependency-map.md

@@ -0,0 +1,59 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Dependency map
+
+`scripts/dependency-map.tsv` is a reference table of the producer-to-consumer edges between
+Cratis repositories, the pack targets of each producer and the package IDs each ships.
+`cratis-local-packages.sh` does not read it: use it to decide which repositories to pack,
+in which order, and which IDs to expect in the feed. It holds no versions; read pins live
+from the consumer manifests (`Directory.Packages.props`, `package.json`, `Dockerfile`).
+
+## Rows
+
+Tab-separated, `#` starts a comment.
+
+| Row | Fields | Meaning |
+| --- | --- | --- |
+| `pack` | repo, eco, target, `PROP=VAL,...` | A pack target; the optional MSBuild properties are the `-p:` arguments the producer's own publish workflow passes |
+| `ids` | repo, eco, comma-separated IDs | The packages the producer ships in that ecosystem |
+| `uses` | consumer, producer, eco, manifest | An edge; the manifest is the pin file, or the Yarn project directory for npm |
+| `image` | repo, dockerfile, tag suffix | A producer image a consumer builds on |
+
+`eco` is `nuget`, `npm` or `image`. For npm, `.` means the repository root.
+
+## Using it
+
+- Find every `uses` row whose producer is the repository you changed; those consumers
+  pin its packages. A consumer may also reach the producer through another repository
+  (Fundamentals reaches Chronicle through Arc as well as directly).
+- Pack upstream first. Overlay the earlier producer into the next repository with
+  `use-nuget`, pack that, then `restore` it. Use one stamp for the whole chain: `stamp`
+  takes one producer, so generate it once and reuse the string.
+- Pack properties from a `pack` row are not accepted by `pack-nuget`. When a row has them,
+  run `dotnet pack TARGET -c Release -p:PackageVersion=$stamp -p:Version=$stamp -p:PROP=VAL
+  -o "$CRATIS_LOCAL_FEED/nuget"` yourself, with the properties as `-p:` arguments and never
+  as exported environment variables (an exported `IsPackaging=true` reaches Chronicle's
+  nested `dotnet run` code generator and fails with a multi-target error).
+- After packing, list the feed for the stamp and compare it with the `ids` row; a missing ID
+  is a silent partial overlay. Open the nuspec of each packed ID and check that every locally
+  changed dependency is at the stamp.
+
+## Facts about the chains
+
+- Arc and Chronicle depend on each other. Arc's Chronicle-facing packages are built against
+  a released Chronicle, and Chronicle's clients against a released Arc. The same holds for
+  Chronicle and Orleans. Record the nuspec dependencies and do not break the cycle.
+- Image and package pins are coupled. A consumer that builds `FROM` a producer image may
+  derive the tag from the producer's NuGet pin; check its publish workflow before tagging a
+  local image.
+- A repository you did not name keeps its released version: Stage reaches Arc, Chronicle
+  reaches Orleans. A binary break through that hop is a finding about the consumer's pins.
+- The current Screenplay rows list only npm IDs although Stage and Studio consume its NuGet
+  packages; read the IDs from the producer's publish workflow.
+
+## Extend it
+
+Add `pack` rows only from the producer's publish workflow on the default branch, not a
+stale clone. Add `ids` for every package a consumer must resolve. Add one `uses` row per
+consumer manifest that pins the producer.

package/package/corpus/skills/cratis-engineering-local-cross-repo-verification/references/worked-examples.md

@@ -3,16 +3,28 @@
 
 # Worked examples
 
+## Contents
+
+- Chronicle kernel → Studio integration specs
+- Fundamentals → Arc (NuGet)
+- Components → Studio frontend (npm)
+- Chronicle clients → Direct (NuGet)
+- Screenplay → Stage and Studio (NuGet and npm)
+- Arc → Chronicle (NuGet)
+- Fundamentals → Arc → Chronicle under one stamp
+
+Run times below are rounded from one measured run on a shared machine; queue wait is not included.
 Use absolute producer/consumer paths for your checkouts and the entry point's
 `local` helper variable. These recipes define work to execute, not pre-verified
 results. Substitute actual regression filters and CI commands; stop on a failed
 step. Apply the entry point's check/restore/cleanup sequence to both repositories.
 
+
 ## Chronicle kernel → Studio integration specs
 
 1. Reproduce Studio's integration bug against its released client/kernel. Record
    the regression filter and inspect Studio's CI build/test commands.
-2. Generate the stamp and pack client packages plus their full dependency closure.
+2. Generate the stamp and pack client packages plus their dependencies.
    A client solution filter can omit CodeAnalysis. Include its package explicitly:
 
    ```bash
@@ -60,38 +72,160 @@ requirement the consumer's container setup does not satisfy yet), that is a
 real finding about the consumer, not about the overlay: read the container log
 before changing the producer.
 
-## Fundamentals → Arc
+## Fundamentals → Arc (NuGet)
+
+```bash
+stamp=$(bash "$local" stamp "$fundamentals")
+(cd "$fundamentals" && bash "$local" pack-nuget . "$stamp" Fundamentals.slnx)
+bash "$local" use-nuget "$arc" "$stamp"
+```
+
+Gates (Arc `dotnet-build.yml`), run in this order after sourcing the printed env:
+`yarn install --immutable`; in `Source/DotNET/Screenplay.Embedded`: `npm ci --workspaces=false`,
+`npm run typecheck`, `npm test`, `npm run build`; `dotnet build --configuration Release
+-p:CratisSpecsTargetFramework=net10.0`; then `dotnet test <project> --no-build --configuration
+Release --framework net10.0` for each project that `python3 scripts/ci-test-shards.py projects
+--shard specs-N` prints. Finish by listing Arc's `obj/project.assets.json` files for the stamp.
+
+- Pass: the Fundamentals IDs in `project.assets.json` are at the stamp, build has 0 warnings and 0 errors, 18 spec projects run and none fail.
+- Time: pack about 4 min, build about 6 min, the spec projects about 18 min.
+- Pitfall: skipping the embedded viewer build makes four `Screenplay.Embedded.Specs` fail
+  with a 404 for the viewer. It is the missing step, not the overlay.
+- Pitfall: Arc's own `@cratis/fundamentals` npm line is out of scope for the NuGet stamp.
+- Skip producer specs when the producer is unchanged `origin/main`; its CI covered that SHA.
+
+For a JavaScript Fundamentals fix, run the producer's build and `pack-npm`, then `use-npm` in
+Arc and install. Include every affected workspace tarball so no transitive copy stays released.
+
+## Components → Studio frontend (npm)
+
+```bash
+(cd "$components" && yarn install --immutable && yarn workspace @cratis/components run ci && yarn build)
+stamp=$(bash "$local" stamp "$components")
+(cd "$components" && bash "$local" pack-npm . "$stamp")
+bash "$local" use-npm "$studio" "$stamp"
+(cd "$studio" && yarn install)        # not --immutable: the overlay edits the lock
+yarn why @cratis/components
+```
+
+Gates: from `Source/<App>` run `yarn ci` for each Studio application that uses
+`@cratis/components` (Core, Admin, Editor, EventModels, Viewer, ScreenMigration), `node
+scripts/generate-scene-package-catalog.mjs --check`, then in Core `yarn build` and the
+`initial-bundle-guard.mjs` budget check, and `yarn build-storybook` where the script exists.
 
-For a .NET Fundamentals fix, build/spec the producer, generate its stamp and
-`pack-nuget` the affected projects and dependency closure. In Arc, run `use-nuget`
-with the required Fundamentals package IDs, source the printed env/config, restore,
-then build/spec Arc with its CI configuration. Inspect `project.assets.json` to
-confirm the actual stamp. No image is required unless the reproducer needs one.
+- Pass: every installed `@cratis/components*` copy is at the stamp (`yarn why` and the installed `package.json` files),
+  `yarn why` shows one resolution, and every gate above exits 0.
+- Time: Components `ci` about 7 min, all-workspace build about 1 min, pack about 2 min,
+  Studio install under 30 s, Studio gates about 8 min.
+- Pitfall: `yarn workspace @cratis/components run ci` builds only the core package. Run
+  `yarn build` at the Components root before `pack-npm`, or the adapter tarballs have no
+  `dist` and Studio fails with `Failed to resolve entry for package
+  "@cratis/components.primereact"`.
+- Pitfall: the root `package.json` version is a placeholder, so the stamp base comes from tags.
+  Resolutions bypass the prerelease ranges that npm would otherwise ignore.
 
-For a JavaScript Fundamentals fix, run the producer's normal build and
-`pack-npm`, then `use-npm` in Arc and install. Run Arc frontend build/specs and the
-reproducer. Include all affected workspace tarballs so a transitive dependency
-cannot silently remain released. A green producer-only spec is not consumer proof.
-Finish with the entry point's commit checks, restoration and cleanup.
+## Chronicle clients → Direct (NuGet)
 
-## Components → Studio frontend
+```bash
+stamp=$(bash "$local" stamp "$chronicle")
+(cd "$chronicle" && dotnet pack Source/Clients/Packages.slnf -c Release -p:PackageVersion=$stamp -p:Version=$stamp \
+  -p:IsPackaging=true -p:DisableProxyGenerator=true -p:DisableDockerBuild=true -o "$CRATIS_LOCAL_FEED/nuget")
+bash "$local" use-nuget "$direct" "$stamp"
+```
+
+Gates (Direct `build.yml`): `dotnet build Source/Direct/Direct.csproj -c Release
+-p:DisableProxyGenerator=true`, the same in Debug with `-warnaserror`, `dotnet test` of that
+project with `--no-build`, and `dotnet test Source/Assurance/Assurance.csproj`. Then
+check `project.assets.json`. Image-based specs also need the producer image tag.
+
+- Pass for a consumer whose pins lag the producer: every Chronicle ID is in the feed at the
+  stamp, the Release build with the owner's floors passes, and `project.assets.json` shows every
+  stamped ID at the stamp. The Debug `-warnaserror` build and the specs are gated on the consumer owner's pin
+  bump (Arc, Orleans, Screenplay, MongoDB.Driver) and on the analyzer fixes the newer pins
+  bring. Record that dependency; do not edit the consumer's source or tracked pins.
+- Time: pack about 5 min; the Release build about 2 min.
+- Pitfall: pass pack properties as `-p:` arguments to `dotnet pack`, never
+  as environment variables; `pack-nuget` takes none. An exported `IsPackaging=true` reaches Chronicle's nested
+  `dotnet run` code generator and fails with a multi-target error.
+- Pitfall: a consumer whose pins lag the producer's own pins fails with NU1109 or NU1605.
+  That is the upgrade the consumer would need anyway; record the bump list.
+- Pitfall: a released umbrella package can pull in a released package that is also stamped
+  (here an AspNetCore package). Pin it with a direct reference or treat it as a finding.
+
+## Screenplay → Stage and Studio (NuGet and npm)
+
+```bash
+stamp=$(bash "$local" stamp "$screenplay")
+(cd "$screenplay" && yarn install && yarn workspaces foreach -Rt --from @cratis/screenplay-mcp-app run build \
+  && bash "$local" pack-nuget . "$stamp" Screenplay.slnx && yarn build && bash "$local" pack-npm . "$stamp")
+bash "$local" use-nuget "$stage" "$stamp"; bash "$local" use-nuget "$studio" "$stamp"
+bash "$local" use-npm "$studio" "$stamp"       # at the workspace root, not the nested app
+```
+
+Gates: Stage's frontend `npm ci`, test and build, then `dotnet build` in Debug and the repository's
+own spec-shard helper; skip probes that need a live kernel or database and say so. Studio:
+`dotnet build` of its solution in Debug with warnings as errors, then the frontend `yarn ci` and
+`yarn build` of every workspace that consumes the language package.
 
-Build/spec Components using its own package scripts, including any required
-Storybook gate. Then:
+- Pass: `project.assets.json` shows the stamp in both NuGet consumers and `yarn why` at the Studio workspace root shows one resolution; specs executed > 0.
+- Pitfall: a repository without a committed lockfile fails `yarn install --immutable`; use plain
+  `yarn install` there.
+- Pitfall: yarn hoists to the root `node_modules`; check and install at the root.
+- Pitfall: the packed language tarball must contain its built bundles. `pack-npm` uses `yarn pack`;
+  a package whose `files` lists a gitignored folder can ship only part of it. Compare the
+  tarball file list with the package's `dist` folder.
+- Pitfall: multi-hop. Studio keeps its released Stage; a binary break is a finding.
+
+## Arc → Chronicle (NuGet)
 
 ```bash
-stamp=$(bash "$local" stamp "$producer")
-bash "$local" pack-npm "$producer" "$stamp"
-bash "$local" use-npm "$consumer" "$stamp"
-cd "$consumer"
-yarn install
+stamp=$(bash "$local" stamp "$arc")
+(cd "$arc" && bash "$local" pack-nuget . "$stamp" Arc.slnx)
+bash "$local" use-nuget "$chronicle" "$stamp"
 ```
 
-Confirm the Components `file:` tarball resolutions. Run Studio's frontend build,
-lint/specs and exercise the broken dialog/page. If Vite serves stale assets, stop
-the dev server, clear only its `.vite` prebundle and restart. Avoid `link:` and
-`portal:` because duplicate React/context instances distort the reproduction.
-Overlay-only lockfile changes from Yarn install are restored automatically.
-Review npm backups if unrelated changes cause `restore` to refuse; preserve
-that work, restore only local changes and retry. Reinstall released packages,
-run `check`, and review/apply cleanup for this stamp.
+Gates: Chronicle `dotnet build` in Release with `DisableProxyGenerator=true` and
+`DisableDockerBuild=true`, the non-integration specs; Workbench `yarn install` then `yarn ci`
+with `NODE_OPTIONS=--max-old-space-size=4096`.
+
+- Pass: Release build clean; every spec assembly passes; `project.assets.json` shows the stamp for
+  every Arc ID.
+- Finding when the consumer's other pins lag: the build passes, but the specs fail with
+  `MissingMethodException` on a Fundamentals method the newer Arc calls, because Chronicle pins an
+  older Fundamentals than Arc was built against. Record it; do not edit the consumer's pins.
+- Pitfall: build the Arc embedded viewer before the .NET build, or the Arc build fails.
+- Pitfall: Chronicle resolves Arc packages to the stamp only where its manifests pin them; a
+  released package that depends on a released Arc package keeps that version. Record it.
+- Pitfall: `use-npm` overlays only the consumer repository root `package.json` and has no option to
+  target `Source/Workbench`, so this recipe does not put the Arc npm packages under the Workbench.
+  To verify them there, run `pack-npm` in Arc, then add `file:` resolutions to the Workbench
+  manifest by hand and run `yarn install`; do not claim the Workbench result without that step.
+- Pitfall: the Workbench is its own Yarn project with its own lockfile. `restore` refuses to
+  put back a changed lockfile; in a throwaway worktree check out the two manifests and remove the
+  helper's backup folder.
+
+## Fundamentals → Arc → Chronicle under one stamp
+
+```bash
+stamp=$(bash "$local" stamp "$arc")                 # one stamp, reused for every layer
+(cd "$fundamentals" && bash "$local" pack-nuget . "$stamp" Fundamentals.slnx)
+bash "$local" use-nuget "$arc" "$stamp"             # Arc builds against the new Fundamentals
+(cd "$arc" && bash "$local" pack-nuget . "$stamp" Arc.slnx)
+bash "$local" restore "$arc"
+bash "$local" use-nuget "$chronicle" "$stamp"       # no IDs: every stamped Fundamentals and Arc ID
+```
+
+Gates: Chronicle Release build and the non-integration specs, as above.
+
+Without package IDs `use-nuget` overrides every package in the feed carrying the stamp, so Chronicle
+resolves Fundamentals at the stamp both directly and through Arc; naming only the Arc IDs would leave
+its direct Fundamentals pin at the release and bring back the `MissingMethodException`.
+
+- Pass: every spec assembly passes (no `MissingMethodException`), which the two-repository run does
+  not achieve. A binary mismatch between layers disappears only when every layer carries the same stamp.
+- Order: pack the upstream first, overlay it into the next repository, pack that, and so on;
+  inspect the nuspec of each pack before overlaying it.
+- A stamp is tied to the commit of the repository it was generated from. After changing any
+  layer, generate a new stamp and repeat the chain.
+- Time: each pack 15–30 minutes with queue waits; the Chronicle build and specs about 5 minutes
+  of run time each.

package/package/corpus/skills/cratis-engineering-local-cross-repo-verification/scripts/dependency-map.tsv

@@ -0,0 +1,68 @@
+# Reference table of producer/consumer dependencies between Cratis repositories. cratis-local-packages.sh does not read it.
+# Tab-separated; # starts a comment; no versions (pins are read live from consumer manifests).
+#   pack  <repo> <eco> <target> [PROP=VAL,...]  pack targets; PROP is a -p:PROP=VAL argument (never an environment variable)
+#   ids   <repo> <eco> <comma-separated expected package IDs>
+#   uses  <consumer> <producer> <eco> <manifest path relative to consumer>
+#   image <repo> <dockerfile> <tag-suffix>
+# A target of "." means the repository root (npm workspaces).
+
+# Fundamentals
+pack	Fundamentals	nuget	Fundamentals.slnx
+ids	Fundamentals	nuget	Cratis.Fundamentals,Cratis.Metrics.Roslyn,Cratis.OpenTelemetry
+pack	Fundamentals	npm	.
+
+# Orleans (edges only)
+pack	Orleans	nuget	Orleans.slnx
+
+# Arc
+pack	Arc	nuget	Arc.slnx	CratisSpecsTargetFramework=net10.0
+ids	Arc	nuget	Cratis.Arc,Cratis.Arc.Core,Cratis.Arc.MongoDB,Cratis.Arc.EntityFrameworkCore,Cratis.Arc.Swagger,Cratis.Arc.Connections.Azure,Cratis.Arc.ProxyGenerator.Build,Cratis.Arc.Testing
+pack	Arc	npm	.
+ids	Arc	npm	@cratis/arc,@cratis/arc.react,@cratis/arc.react.mvvm,@cratis/arc.vite
+
+# Chronicle (clients only; the kernel ships as an image)
+pack	Chronicle	nuget	Source/Clients/Packages.slnf	IsPackaging=true,DisableProxyGenerator=true,DisableDockerBuild=true
+ids	Chronicle	nuget	Cratis.Chronicle,Cratis.Chronicle.AspNetCore,Cratis.Chronicle.Aspire,Cratis.Chronicle.CodeAnalysis,Cratis.Chronicle.Connections,Cratis.Chronicle.Contracts,Cratis.Chronicle.Testing,Cratis.Chronicle.XUnit.Integration
+image	Chronicle	Docker/Production/Dockerfile	(none)
+
+# Components
+pack	Components	npm	.
+ids	Components	npm	@cratis/components,@cratis/components.primereact,@cratis/components.mui
+
+# Screenplay
+pack	Screenplay	nuget	Screenplay.slnx
+pack	Screenplay	npm	.
+ids	Screenplay	npm	@cratis/screenplay-language
+
+# Stage
+pack	Stage	nuget	Stage.slnx
+
+# Edges (consumer, producer, ecosystem, manifest)
+uses	Arc	Fundamentals	nuget	Directory.Packages.props
+uses	Arc	Chronicle	nuget	Directory.Packages.props
+uses	Arc	Screenplay	nuget	Directory.Packages.props
+uses	Chronicle	Fundamentals	nuget	Directory.Packages.props
+uses	Chronicle	Arc	nuget	Directory.Packages.props
+uses	Chronicle	Orleans	nuget	Directory.Packages.props
+uses	Chronicle	Arc	npm	Source/Workbench
+uses	Orleans	Arc	nuget	Directory.Packages.props
+uses	Orleans	Chronicle	nuget	Directory.Packages.props
+uses	Orleans	Fundamentals	nuget	Directory.Packages.props
+uses	Stage	Fundamentals	nuget	Directory.Packages.props
+uses	Stage	Arc	nuget	Directory.Packages.props
+uses	Stage	Chronicle	nuget	Directory.Packages.props
+uses	Stage	Screenplay	nuget	Directory.Packages.props
+uses	Studio	Fundamentals	nuget	Directory.Packages.props
+uses	Studio	Arc	nuget	Directory.Packages.props
+uses	Studio	Chronicle	nuget	Directory.Packages.props
+uses	Studio	Orleans	nuget	Directory.Packages.props
+uses	Studio	Stage	nuget	Directory.Packages.props
+uses	Studio	Screenplay	nuget	Directory.Packages.props
+uses	Studio	Components	npm	.
+uses	Studio	Screenplay	npm	.
+uses	Direct	Fundamentals	nuget	Directory.Packages.props
+uses	Direct	Arc	nuget	Directory.Packages.props
+uses	Direct	Chronicle	nuget	Directory.Packages.props
+uses	Direct	Orleans	nuget	Directory.Packages.props
+uses	Direct	Screenplay	nuget	Directory.Packages.props
+uses	Direct	Chronicle	image	Source/Watchdog/Dockerfile.full

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.103.3",
+  "version": "7.103.5",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [