@cratis/pi 7.125.2 → 7.127.0

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/rendered-application.md

@@ -6,6 +6,7 @@
 - Runtime package migration
 - Lists on screen
 - Reducer layout for new applications
+- Authentication and onboarding
 - What is managed
 - `Customizations/` (unmanaged)
 - Re-render checklist
@@ -104,6 +105,44 @@ an existing classic application to `self`: observer identity and old reducer rem
 need migration-aware publication. This opt-in does not automatically change CLI,
 Studio or semantic-engine execution.
 
+## Authentication and onboarding
+
+A model with an `authentication` block renders an application that runs behind AuthProxy
+and trusts the identity it forwards. The model's `onboarding` block renders the code that
+acts on the outcomes of the application's own Ante. Both are realized by the renderer;
+none of it is hand-written gap-fill.
+
+Requires cratis CLI 3.116.0 with Stage 4.211.0 (`cratis --version`); older releases report `authentication` and `onboarding` as unrendered warnings.
+
+| Rendered | Purpose |
+| --- | --- |
+| `appsettings.json` with `Cratis:Arc:TrustForwardedIdentityHeaders` true | Arc builds the caller from the headers AuthProxy forwards. |
+| `GeneratedAuthentication/` (`Personas`, `MemberIdentity`, `RuntimeConventions`) | Roles and claims per persona, the identity of a person, and the Chronicle connection string read from `CRATIS_CHRONICLE_CONNECTION_STRING_FILE`. |
+| `GeneratedOnboarding/` | Reactor on Ante's outcomes, idempotent provisioning, the invite-member command, member persona claims, Herald email sending. |
+| `Emails/` | Email templates and images laid out for Herald. |
+| `.runtime/authproxy.application.json`, `.runtime/ante.onboarding.json`, `.runtime/environment.json` | What a runtime (`cratis run`, Stage Manager) starts AuthProxy and Ante with, and the environment keys the model needs. |
+
+- The identity headers are unsigned. Never expose a rendered application with authentication
+  except through AuthProxy.
+- Only provider kinds AuthProxy supports render (`EntraId`, `GitHub`, `Google`, `Apple`,
+  `OpenId`). Another kind is left out with `STAGE-AUTH-001`; a persona that is not a
+  requirement on authentication, roles or claims is never matched (`STAGE-AUTH-002`).
+- `offering` renders nothing (`STAGE-ONBOARDING-001`): tenants are provisioned without
+  licensing. `STAGE-ONBOARDING-002` to `-006` cover a tenant invitation with no command,
+  a sign-up without a first-member persona, a legal document count other than two, a
+  missing email template and an invitation without inviters.
+- An invitation Ante rejects (a persona or invitation type the model does not allow) is a
+  mistake in the invitation, not a decision about the person: the application records
+  `OnboardingInvitationRejected` and logs a warning for an administrator, and emails no
+  one. The `signupDeclined` template renders but is not sent until Ante publishes a
+  declined sign-up (`STAGE-ONBOARDING-007`).
+- An application with onboarding pins a newer Chronicle client and kernel image than
+  other applications; read them from the rendered files.
+- Realization needs the model folder: email images are read from the model root.
+
+Read the Stage references `authentication-rendering.md` and `onboarding-rendering.md` for
+exact files and keys.
+
 ## What is managed
 
 Every path in `.cratis-render.json` is managed: the scaffold files (project, solution,

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -49,6 +49,13 @@ ports or an authenticated proxy). Rendered applications use the renderer's admit
 authorization instead, which is the thing to test for production behavior (Debug tests
 of a render, [render-example.md](render-example.md)).
 
+`Stage__Sandbox__ForwardedIdentity=true` (`Stage:Sandbox:ForwardedIdentity`) is the exception:
+the sandbox runs behind AuthProxy, trusts the identity it forwards and plays no persona, so the
+signed-in caller is the caller authorization runs for. It overrides `Stage:Sandbox:Identity`.
+`cratis run` sets it when the model declares `authentication`; set it yourself only behind an
+AuthProxy, because the headers are unsigned and anything that can reach the sandbox directly
+can forge them. Requires Stage 4.211.0; an older sandbox ignores the setting.
+
 The semantic Host encrypts personal-data and secret concepts at rest through Chronicle and
 releases values on read; erasure deletes event-source keys. Encryption applies to new
 writes only: events already stored in plaintext in an existing Play store are not

package/package/profile-catalog.json

@@ -522,7 +522,8 @@
         "cratis-chronicle-reducer",
         "cratis-event-model-diagram",
         "cratis-multi-service-architecture",
-        "cratis-multi-service-local-orchestration"
+        "cratis-multi-service-local-orchestration",
+        "cratis-showrunner-herald"
       ],
       "languages": [
         "csharp",
@@ -623,7 +624,8 @@
       "availableTargets": [
         "cratis-commits-and-pull-requests",
         "cratis-rtk",
-        "cratis-chronicle-cli-operations"
+        "cratis-chronicle-cli-operations",
+        "cratis-environments-and-secrets"
       ],
       "languages": [
         "shell"
@@ -953,6 +955,7 @@
       "availableTargets": [
         "cratis-commits-and-pull-requests",
         "cratis-rtk",
+        "cratis-screenplay-authentication-and-onboarding",
         "cratis-screenplay-automations-and-translations",
         "cratis-screenplay-captures-and-reactions",
         "cratis-screenplay-command-surface",
@@ -1026,6 +1029,7 @@
       "availableTargets": [
         "cratis-commits-and-pull-requests",
         "cratis-rtk",
+        "cratis-onboarding-runtime",
         "cratis-stage-rendering-and-sandbox"
       ],
       "languages": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.125.2",
+  "version": "7.127.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [