@cratis/pi 7.34.0 → 7.35.0

package/package/corpus/agents/security-reviewer.md

@@ -40,6 +40,7 @@ Your responsibility is to perform a structured **security review** of all change
 ### Authentication & Authorization
 
 - [ ] All HTTP endpoints are decorated with `[Authorize]` or explicitly marked `[AllowAnonymous]` with justification
+- [ ] Apply the source-pinned Arc v22.75.0 checks in `cratis-security-review/references/arc-boundaries.md`: host-wide forwarded-header opt-in only behind stripping ingress, principal-derived identity (no cookie reads), deployed discovery exposure, declaration precedence and guest-policy intent, plain-HTTP emission guards, narrow system actors, and embedded viewer opt-in overrides.
 - [ ] Tenant isolation enforced — no cross-tenant data accessible without explicit authorization
 - [ ] Claims are verified before acting on command data that depends on identity
 

package/package/corpus/agents/spec-writer.md

@@ -96,7 +96,7 @@ public class and_all_information_is_valid : Specification
 0. **Every contract specification first** — one spec each, named after it, using the contract's example values. Then add the code-derived cases below that the contract lacks and report them as proposals for the contract (the `.play` model when one covers the slice, otherwise the agreed outline); never present them as contract coverage. A `.play` specification maps to a plain-call spec for a pure decision, with a scenario added where the pipeline, validation, constraints or projections matter; never edit, skip or delete a spec derived from the contract to make code pass — change the code or return an edit request.
 1. **Happy path** — succeeds, correct event(s) appended.
 2. **Each validation failure** — assert **both** `ShouldNotBeSuccessful()` and `ShouldHaveValidationErrors()`. Do not assert on message strings by default; assert exact text only when that wording is the specified behavior, and name that behavior in the fact. Violate **only** the rule the spec is named after (build the command valid in every other respect), or a neighbouring rule makes it pass.
-3. **Business-rule violations** — each `Result<,>` rejection / DCB condition.
+3. **Business-rule violations** — each `Result<,>` rejection / guarded decision condition. Plain injection is advisory; for `[ProtectedDecision]` or stream decisions use `UseDecisionReads()` with seeded events and competing appends, not pinned models.
 4. **Constraint violations** — `ShouldHaveConstraintViolationFor(name)` via `EventScenario`.
 5. **Authorization** — `ShouldNotBeAuthorized()` (an unauthorized result has no validation errors).
 6. **Repeat execution**, when a reactor invokes the command — the same command twice for the same source; specify whether the second is rejected, a no-op, or appends again.

package/package/corpus/harnesses/pi/extensions/shared/rules.ts

@@ -48,10 +48,12 @@ function matchesSelection(name: string, applyTo: string[], selected: AiConfigura
     const scope = applyTo.join(',');
     const needsCSharp = scope.includes('.cs');
     const needsTypeScript = scope.includes('.ts') || name === 'rtk.md' || name.endsWith('/rtk.md');
+    const needsGo = scope.includes('.go') || scope.includes('go.mod') || scope.includes('go.sum');
     const needsDocumentation = scope.includes('md');
-    if (!needsCSharp && !needsTypeScript && !needsDocumentation) return true;
+    if (!needsCSharp && !needsTypeScript && !needsGo && !needsDocumentation) return true;
     return (needsCSharp && languages.includes('csharp')) ||
         (needsTypeScript && languages.includes('typescript')) ||
+        (needsGo && languages.includes('go')) ||
         (needsDocumentation && (selected.profiles ?? []).includes('cratis/documentation'));
 }
 

package/package/corpus/hooks/scripts/cratis-nuget-pins.txt

@@ -3,9 +3,10 @@
 # each into the full Cratis closure found in the local NuGet cache. Sources: the
 # "Verified product sources" sections of the skills under skills/.
 # Update a pin only together with the skill whose verified version moved.
-Cratis.Arc 22.10.4
-Cratis.Arc.Chronicle 22.10.4
-Cratis.Chronicle 16.45.2
-Cratis.Chronicle 17.0.1
-Cratis.Chronicle.CodeAnalysis 16.45.3
-Cratis.Fundamentals 7.18.2
+Cratis.Arc 22.75.0
+Cratis.Arc.Chronicle 22.75.0
+Cratis.Chronicle 19.50.1
+Cratis.Chronicle.CodeAnalysis 19.50.1
+Cratis.Fundamentals 7.23.0
+Cratis.Specifications 4.1.1
+Cratis.Specifications.XUnit 4.1.1

package/package/corpus/hooks/scripts/cratis-release-notes-reviewed.cjs

@@ -41,8 +41,9 @@ const INLINE_CODE = /(`+)[^\n]*?\1/g;
 const HTML_COMMENT = /<!--[\s\S]*?-->/g;
 const KEYWORD = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?|refs?|references)(?:[ \t]*:[ \t]*|[ \t]+)((?:[\w.-]+\/[\w.-]+)?#(\d+))/gi;
 const KEYWORD_URL = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?|refs?|references)(?:[ \t]*:[ \t]*|[ \t]+)(https?:\/\/(?:www\.)?github\.com\/([\w.-]+\/[\w.-]+)\/(?:issues|pull)\/(\d+))/gi;
-// The pattern release-action closes issues with.
-// It sees everything but fenced and inline code: HTML comments are not skipped.
+// The pattern release-action closes issues with. release-action removes HTML comments from the notes
+// before it publishes them and reads issues from the published text, so a `(#n)` only inside a comment
+// closes nothing (release-action v1.4.2).
 const CLOSES_ISSUE = /(?<![\w/-])\(#(\d+)\)/g;
 // What may follow the delivering `(#n)` and still count as the end of the bullet: more issue references
 // (`(part of #n)`, `(see #n)`, `(Cratis/Repo#n)` too), closing emphasis, a trailing `<br>` and sentence
@@ -346,9 +347,9 @@ function check({ body, repository, defaultBranch }) {
     // The same without fenced code, which does not belong to the bullet text around it.
     const uncommented = blank(blank(text, FENCED_CODE, " "), INLINE_CODE, "x");
     const prose = blank(uncommented, HTML_COMMENT, " ").split("\n");
-    // What release-action reads when it closes issues: it removes fenced and inline code, in that order,
-    // and nothing else, so a `(#n)` hidden in an HTML comment still closes its issue. Each match is
-    // mapped back to where it sits in the description.
+    // Where `(#n)` sits in the description. release-action removes HTML comments (and fenced and inline
+    // code) before it reads issues, so a commented `(#n)` closes nothing. It stays a violation here: a
+    // reference in a comment is a delivery the author thinks they made but that is silently dropped.
     const closes = closingReferences(text, prose);
 
     const violations = [];
@@ -534,7 +535,7 @@ function check({ body, repository, defaultBranch }) {
         }
         for (const match of closes.filter(candidate => candidate.line === index)) {
             if (match.commented) {
-                report("Issue reference position", index, `\`(#${match.number})\` sits inside an HTML comment: the release page does not show the comment, but release-action still closes #${match.number}. Delete it from the comment, or write \`(part of #${match.number})\` or \`see #${match.number}\` outside the comment if it must stay open; never put issue references in comments.`);
+                report("Issue reference position", index, `\`(#${match.number})\` sits inside an HTML comment: release-action removes comments before publishing, so #${match.number} would NOT be closed. If it is delivered, write \`(#${match.number})\` outside the comment; if it stays open, write \`(part of #${match.number})\` or \`see #${match.number}\` outside the comment; never put issue references in comments.`);
                 continue;
             }
             const end = bulletEnd[match.endLine];

package/package/corpus/hooks/scripts/cratis-store-mutations.json

@@ -8,7 +8,7 @@
         "local file can tighten the shipped lists but only a replacement file can loosen them.",
         "",
         "Scope: only the \"group\" command group is guarded. Every other cratis group (ai, arc, context, llm,",
-        "screenplay, prologue, completions) and every top-level command (init, new, render, run, update,",
+        "screenplay, prologue, completions, direct) and every top-level command (init, new, render, run, update,",
         "version, get-started, llm-context) is out of scope and always allowed.",
         "",
         "Fields:",
@@ -28,7 +28,9 @@
         "Anything under the group that is on neither list is blocked as unknown: the guard fails closed, so a",
         "command added by a newer CLI is refused until someone classifies it here."
     ],
-    "verifiedAgainst": "cratis 3.13.1",
+    "verifiedAgainst": "cratis 3.53.1",
+    "source": "https://github.com/Cratis/cli/blob/v3.53.1/Documentation/reference/llm-context.md",
+    "policyExceptions": ["report-error is cataloged read-only, but blocked because it opens an external browser issue form"],
     "group": "chronicle",
     "helpOptions": ["-h", "--help"],
     "versionOptions": ["-v", "--version"],
@@ -66,7 +68,9 @@
         { "command": "observers replay", "effect": "replays an observer from the beginning of the event log, resetting all state it has built" },
         { "command": "observers replay-partition", "effect": "replays one partition of an observer from the beginning, resetting that partition's state" },
         { "command": "observers retry-partition", "effect": "retries a failed partition from the sequence number where it failed" },
-        { "command": "observers clear-quarantine", "effect": "clears an observer's quarantine so it resumes processing" },
+        { "command": "observers clear-quarantine", "effect": "clears observer-level quarantine only, not a partition's quarantine" },
+        { "command": "observers clear-partition-quarantine", "effect": "clears a failed partition's quarantine and resets its retry budget; retries the handler unless --no-retry is given" },
+        { "command": "observers remove", "effect": "deletes an observer's definition, state, handled counts, failed partitions and projection definition across every namespace of the event store; leaves read model data" },
         { "command": "jobs stop", "effect": "stops a running background job" },
         { "command": "jobs resume", "effect": "resumes a stopped background job" },
         { "command": "recommendations perform", "effect": "executes a server recommendation, such as a schema or replay maintenance action" },