@cratis/pi 7.34.1 → 7.35.0

package/package/corpus/skills/cratis-chronicle-web-workbench/SKILL.md

@@ -46,7 +46,7 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `18.3.0` | the Workbench application, its hosting, screens, and commands |
+| `Cratis.Chronicle` | `19.50.1` | the Workbench application, its hosting, screens, and commands |
 
 Reverify before claiming a screen, route, command, or configuration key for
 another version.
@@ -57,7 +57,14 @@ The Workbench is served by the Chronicle server on the kernel port, which
 defaults to **35000**. That port is **TLS**, because HTTP/1.1 and HTTP/2 are
 multiplexed on it through ALPN — so the browser URL is `https://<host>:35000/`,
 not `http://`. In a non-development build the server refuses to start without a
-certificate.
+certificate. Explicit `Tls.Enabled=false` instead serves **private HTTP/2-only
+h2c** behind an HTTPS-terminating proxy; it warns at startup. The proxy must
+forward **all** traffic over h2c, including Workbench/REST, not HTTP/1.1.
+Restrict direct backend access. With authentication enabled, this requires an
+external HTTPS authority; the internal OAuth authority and `/connect/token`
+are unavailable. The .NET SDK's built-in ClientCredentials mode cannot use that
+external authority. Source: `Documentation/hosting/configuration/tls.md` at
+**v19.50.0**. Use **cratis-chronicle-hosting** for the deployment checklist.
 
 Configuration lives under `Cratis:Chronicle`, bound from a `chronicle.json` at
 the host root and from environment variables prefixed `Cratis__Chronicle__`.
@@ -93,9 +100,14 @@ Read these before putting a Workbench on any reachable network.
   layer; the Sequences screen renders whatever event content the API returns.
   Whether an operator sees plaintext personal data depends on the server path,
   not on the UI. Assume they do.
-- The server is designed to sit behind a proxy and trusts the immediate proxy's
-  forwarded headers unconditionally. That is only safe when the proxy is the
-  only route in.
+- **Forwarded headers are not trusted unconditionally.** At **v19.50.0**,
+  `X-Forwarded-For/Proto` is accepted only from loopback by default, or immediate
+  proxy addresses configured in `forwardedHeaders.knownProxies/knownNetworks`
+  (`Cratis__Chronicle__ForwardedHeaders__KnownProxies__0` and
+  `__KnownNetworks__0`). `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true` does not widen
+  trust. Restrict the proxy subnet, never use a wildcard CIDR, and have the proxy
+  **replace** client-supplied headers. Source: `Documentation/hosting/configuration/tls.md`,
+  "Trusted reverse proxies" at **v19.50.0**.
 - The health endpoint, the antiforgery probe, the gRPC descriptor-set and
   compatibility calls, the initial-admin-password endpoints, and the gRPC
   `ResetKernelState` call answer anonymously (`[AllowAnonymous]`).
@@ -105,24 +117,32 @@ Read these before putting a Workbench on any reachable network.
 Routes are grouped by scope. Event-store-scoped screens apply to the whole
 store; namespace-scoped screens apply to one tenant namespace.
 
-**Namespace-scoped:** Recommendations (the landing screen) · Jobs · Sequences ·
-Pivot · Patterns · Pattern heatmap · Observers · Failed partitions · Read Models ·
-Identities · Seed Data.
+**Namespace-scoped:** Dashboard (the landing screen, `Default/dashboard`) ·
+Recommendations · Jobs · Sequences · Closed streams · Pivot · Patterns ·
+Pattern heatmap · Observers · Failed partitions · Read Models · Identities · Seed Data.
 
-**Event-store-scoped:** Event Types · Read Model Types · Webhooks · External
-Services · Captures · Projections (namespace-routed) · Namespaces · Seed Data.
+**Event-store-scoped:** Dashboard · Event Types · Event sources · Read Model Types ·
+Webhooks · External Services · Captures · Projections (namespace-routed) · Namespaces · Seed Data.
 
 **System:** Users · Applications · Connected Clients · Servers · Development
 Tools (offered only when the server reports them available).
 
 Reducers, Reactors, Sinks and a store-wide Sequences view have routes but no menu
-entry (their menu lines are commented out in `EventStore.tsx`). There is no
-Dashboard screen; only a `Card`/`Chart` component pair written for one remains.
+entry (their menu lines are commented out in `EventStore.tsx`). Event types uses
+one list with a side panel (Schema and Observers tabs). Observer details includes
+connected clients in Summary; Failed partitions has Retry and a detail panel.
+The Help menu is available since 19.39.2. Source at **v19.50.0**:
+`Source/Workbench/Features/EventStore/EventStore.tsx`,
+`Namespaces/Observers/ObserverDetails.tsx`, `Namespaces/FailedPartitions/FailedPartitions.tsx`,
+and `General/EventTypes/TypeDetails.tsx` (paths relative to that feature).
+Do not infer that dashboard or stale-detail reports are fixed from the new menu:
+Cratis/Chronicle#4414 and #4418 remain unresolved in the release research; no
+runtime reproduction was performed here.
 
 ## What each screen can change
 
 Read-only: Read Models, Identities, Pivot, Behavior patterns, Pattern heatmap,
-Connected Clients.
+Connected Clients, Dashboards, Event sources, Closed streams.
 
 Everything below mutates the running server.
 
@@ -130,6 +150,7 @@ Everything below mutates the running server.
 | --- | --- | --- |
 | Observers | Replay observer | yes |
 | Observers | Clear quarantine | **no** |
+| Observers | Remove observer | yes |
 | Failed partitions | Retry partition | **no** |
 | Jobs | Stop / Resume / Delete job | **no** |
 | Recommendations | Perform | **no** |
@@ -165,8 +186,12 @@ not being there.
 
 These two are Workbench-only; the CLI has no equivalent command.
 
-- **Redact** removes an event's content. It requires a reason, records who
-  caused it and its causation, and is therefore itself auditable. Use it for
+- **Redact** removes an event's content, retained causation property values,
+  revision history and content hashes. It requires a reason and records the
+  redaction itself. It does not reach backups, oplogs or already-forwarded events.
+- `IEventSequence.VerifyContent` is a command for comparing prepared content
+  after an ambiguous append, not an authorization to revise or retry blindly.
+  Use **cratis-chronicle-client-dotnet** for its result contract. Use it for
   content that should never have been appended.
 - **Revise** rewrites an event's content. Its confirmation dialog enumerates the
   replayable observers that will be affected — read that list before confirming,

package/package/corpus/skills/cratis-cli-terminal-workbench/SKILL.md

@@ -24,9 +24,9 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Cli` | `3.2.0` | `cratis chronicle workbench`, its views, keys, and actions |
+| `Cratis.Cli` | `3.53.1` | `cratis chronicle workbench`, its views, keys, and actions |
 
-> Re-verified at `Cratis/cli` **v3.2.0**: the fifteen navigation views and every key binding below exist in `Source/Cli/Commands/Chronicle/Workbench` at that tag.
+> Re-verified at `Cratis/cli` **v3.53.1**: fifteen views remain; keys are in [WorkbenchKeyDispatcher.cs](https://github.com/Cratis/cli/blob/v3.53.1/Source/Cli/Commands/Chronicle/Workbench/windows/WorkbenchKeyDispatcher.cs) and output validation is in [WorkbenchCommand.cs](https://github.com/Cratis/cli/blob/v3.53.1/Source/Cli/Commands/Chronicle/Workbench/WorkbenchCommand.cs).
 
 Reverify before claiming a view, key binding, or action for another version.
 `cratis chronicle workbench --help` and `cratis llm-context` are the authority
@@ -35,11 +35,16 @@ for the installed version.
 ## Launch it
 
 ```bash
-cratis chronicle workbench                     # active context, default event store and namespace
-cratis chronicle workbench -e <store> -n <ns>  # explicit event store and namespace
-cratis chronicle workbench --interval <secs>   # refresh cadence, default 5
+cratis chronicle workbench -o table                         # active context
+cratis chronicle workbench -o table -e <store> -n <ns>       # explicit scope
+cratis chronicle workbench -o table --interval <secs>        # default 5
 ```
 
+A **human at a terminal** launches it; an agent should not launch or try to drive
+this TUI. The catalog classifies it `destructive`, and the Cratis store guard
+blocks it. `auto` becomes `json-compact` in an agent environment, so `-o table`
+is needed explicitly there even for a human-operated session.
+
 It requires an interactive terminal and the `table` output format. Asking for
 `json`, `plain`, or `json-compact` is rejected with a validation error — that is
 the correct behavior, not a bug. **When you need machine-readable output, use
@@ -83,7 +88,12 @@ read-only.
 - `Ctrl+E` switches event store; `Ctrl+N` switches namespace.
 - `F` filters the current view; `[` and `]` page; `Home` jumps to the first row
   and `Shift+G` to the last.
-- `?` shows the keyboard shortcuts.
+- `1`–`9` jump to view N; `F9` opens the theme chooser.
+- `+` / `-` change the refresh interval; `Esc` dismisses overlays.
+- `?` shows the keyboard shortcuts. The File menu offers Switch Event Store
+  (`Ctrl+E`), Switch Namespace (`Ctrl+N`) and Quit; Help offers shortcuts/themes.
+- Filters support `state:`, `type:`, `event:` in Observers, `type:` in Event
+  Sequences, `owner:` / `gen:` in Event Types and `owner:` in Read Models.
 - `Ctrl+C` **copies the detail pane to the clipboard** — it does not interrupt.
   Quit with `Q`, which also persists the refresh interval and the last view.
 
@@ -146,6 +156,10 @@ Fix the cause before replaying. Replaying into an unfixed handler fails the same
 way and buries the original error. A failed partition you have not yet explained
 is not a thing to clear.
 
+There is no key for `observers remove`, `clear-quarantine` or
+`clear-partition-quarantine`. A quarantined partition refuses retry; use the CLI
+recovery guidance after fixing the cause, not repeated `T` presses.
+
 `D` and `V` on the event views — view an event type's definition, view the
 observers for an event type — are navigation, not mutation.
 

package/package/corpus/skills/cratis-code-review/SKILL.md

@@ -18,11 +18,21 @@ change did not touch is a note, never a blocker.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Arc.Core` | `22.16.0` | Command, query, validation and analyzer surface (`ARC0001`–`ARC0015` in `DiagnosticDescriptors`, plus `ARC0016`–`ARC0018` from the command-operation analyzer) |
+| `Cratis.Arc.Core` | `22.75.0` | Command, query, validation and analyzer surface (`ARC0001`–`ARC0026`, including operations, authorization, generated values and explicit query selection) |
 | `Cratis.Chronicle` | `18.3.0` | Event, projection, read-model and constraint surface |
-| `Cratis.Fundamentals` | `7.19.2` | `ConceptAs<T>`, `IInstancesOf<T>`, the DI conventions |
+| `Cratis.Fundamentals` | `7.23.0` | `ConceptAs<T>`, `IInstancesOf<T>`, the DI conventions |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+> Arc analyzer/decision/query surface rechecked at v22.75.0. Arc depends on
+> Chronicle 19.39.1 / Fundamentals 7.23.0; separate product verification stays
+> version-qualified.
+
+Fundamentals rechecked at v7.23.0:
+[`ConceptAs<T>`](https://github.com/Cratis/Fundamentals/blob/v7.23.0/Source/DotNET/Fundamentals/Concepts/ConceptAs.cs)
+is the typed-value record;
+[`InstancesOf<T>`](https://github.com/Cratis/Fundamentals/blob/v7.23.0/Source/DotNET/Fundamentals/Types/InstancesOf.cs)
+discovers implementations and resolves them when enumerated;
+[DI conventions](https://github.com/Cratis/Fundamentals/blob/v7.23.0/Source/DotNET/Fundamentals/DependencyInjection/ServiceCollectionExtensions.cs)
+honor `[Singleton]` and `[Scoped]`, defaulting to transient.
 
 Reverify against the owning product repository before asserting a framework
 contract this file does not already state.
@@ -75,6 +85,18 @@ there is nothing to review under a red build.
 - Logging lives in a `*Logging.cs` partial with `[LoggerMessage]`, not inline in
   domain code.
 - No shared mutable state between commands.
+- Plain injected models are advisory, not a concurrency guard. Review guarded
+  stream/projection reads and actual conflict specs (`UseDecisionReads()`).
+- Use `Cratis.Arc.Core.CodeAnalysis` and `Cratis.Arc.Chronicle.CodeAnalysis`.
+  At Arc v22.75.0, ARCCHR0011/0012 (Info) flag unprotected reads/immediate
+  bypasses; 0013 (Info) recommends definitions; 0014 checks declared observer
+  streams; 0015 warns on nullable events; 0016 flags ignored concurrency flags;
+  0017/0018 check stream-id templates; 0019 warns on folds exposed as queries.
+  ARC0015 checks concept query inputs, ARC0016–18 operations, ARC0019–21
+  authorization, ARC0022–25 generated values and ARC0026 explicit/ambiguous queries.
+  A clean build cannot prove the Info-level decision advisories were addressed.
+  Sources: Arc v22.75.0 `Source/DotNET/Arc.Core.CodeAnalysis/DiagnosticDescriptors.cs`
+  and `Source/DotNET/Chronicle.CodeAnalysis/DiagnosticDescriptors.cs`.
 
 ## Step 3 — C# style
 

package/package/corpus/skills/cratis-components-accessibility/SKILL.md

@@ -17,7 +17,7 @@ what is written here.
 
 | Package | Version | Verified from |
 | --- | --- | --- |
-| `@cratis/components` | `4.6.0` | `Source/Dialogs/*` (`DialogInitialFocus`, `DialogImplementation`), `Source/CommandForm/fields/fieldAccessibility.tsx`, `Source/for_accessibility/*`, `Source/SchemaEditor/*`, `Source/ObjectNavigationalBar/*`, `Source/MIGRATION.md`, `Documentation/Styling/pass-through.md`, `Documentation/Common/cratis-components-provider.md`, `Documentation/renderers/index.md` |
+| `@cratis/components` | `4.26.4` | `Source/Dialogs/*` (`DialogInitialFocus`, `DialogImplementation`), `Source/CommandForm/fields/fieldAccessibility.tsx`, `Source/for_accessibility/*`, `Source/SchemaEditor/*`, `Source/ObjectNavigationalBar/*`, `Source/MIGRATION.md`, `Documentation/Styling/pass-through.md`, `Documentation/Common/cratis-components-provider.md`, `Documentation/renderers/index.md` |
 
 Focus, overlay and collection behavior come from React Aria **internally** — the
 dialog is a React Aria `Modal` inside a `ModalOverlay`; you never import React
@@ -89,7 +89,9 @@ different name.
 | `SchemaEditor` | `labels` | — |
 | `ObjectNavigationalBar` | `backLabel` — tooltip **and** accessible name | — |
 | `ToolbarButton` | `title` — required; the accessible name and the tooltip | — |
-| `Toolbar` | `aria-label` | `messages.toolbar` (`label`, default `'Tools'`) |
+| `Toolbar` | `aria-label`, `aria-labelledby` | `messages.toolbar` (`label`, default `'Tools'`) |
+| `ToolbarFolder` drawer | `closeLabel` | `messages.toolbar.closeDrawer` |
+| `FilterPanel` | `aria-label`, `searchAriaLabel` | `messages.filter` (`label`, `searchAriaLabel`) |
 | `ToolbarFanOutItem` / `ToolbarFolder` | `tooltip` / `title` — required | — |
 | `RatingField` | `starAriaLabel` | — |
 | `ChipsField` | `removeAriaLabel` | — |
@@ -186,8 +188,22 @@ nothing.
   motion, forced colors and responsive behavior.** Components supplies semantic
   behavior and the `--cratis-focus-ring` token; it cannot infer the product's
   color relationships.
-- **No skip links, roving-tabindex utilities or live regions** for application
-  layouts beyond the toast region (`messages.notifications.region` names it).
+- **Query state is announced.** Loading rows contain `role='status'`; failure
+  and unauthorized rows contain `role='alert'`. `empty-row` is only for a real
+  empty result. `Message live={false}` avoids double announcement inside an
+  existing live region.
+- **FilterPanel is a named non-modal dialog.** It uses the overlay environment,
+  and Escape returns focus to its anchor. Localize `messages.filter`.
+- **Toolbars navigate by keyboard.** `ToolbarFocusMode.Arrows` is the default
+  (arrows/Home/End, each tool retains its Tab stop); `SingleTabStop` implements
+  the WAI-ARIA toolbar pattern, while `None` keeps native focus. `ToolbarButton`
+  exposes `aria-pressed` when `active` is supplied. Tabs, toggle groups, tag
+  groups and breadcrumbs also provide keyboard semantics; name each control.
+- **ErrorBoundary uses neutral recovery copy**, never exception text. Supply
+  `fallback` (node or `(reset) => node`) to localize it; `onError` reports
+  diagnostics, `onReset` runs before retry remounts only the protected section.
+- **Application layouts still own skip links and announcements.** Library
+  status regions and focus behavior do not certify the surrounding application.
 
 ## Verify
 

package/package/corpus/skills/cratis-components-schema-editor/SKILL.md

@@ -21,8 +21,8 @@ case where the shape itself is data.
 
 | Package | Version | Verified from |
 | --- | --- | --- |
-| `@cratis/components` | `4.6.0` | its package manifest and the `SchemaEditor` / `ObjectContentEditor` sources |
-| `react` | `^19.0.0` | peer of `@cratis/components@4.6.0` |
+| `@cratis/components` | `4.26.4` | its package manifest and the `SchemaEditor` / `ObjectContentEditor` sources |
+| `react` | `^19.0.0` | peer of `@cratis/components@4.26.4` |
 
 ## The schema type these editors consume
 
@@ -42,7 +42,7 @@ interface JsonSchema {
 interface JsonSchemaProperty {
     id?: string; name?: string; type?: string; format?: string; description?: string;
     items?: JsonSchema; properties?: Record<string, JsonSchemaProperty>;
-    required?: boolean; $ref?: string;
+    required?: string[]; $ref?: string;
 }
 
 type Json = string | number | boolean | null | Json[] | { [key: string]: Json };
@@ -54,8 +54,9 @@ Three limits to design around:
   navigation walks `properties` and `items` literally. A schema that relies on
   references will not render its referenced shapes.
 - **`type` is a plain string**, not a union — there is no exhaustiveness check.
-- **`required` is read but never rendered or edited** by `SchemaEditor`. Its
-  table has two columns, Property and Type. Do not promise a required toggle.
+- **Required and key toggles are opt-in.** `allowRequired` edits the object's
+  `required: string[]`; `allowKeyProperty` edits `x-key` (at most one key per
+  object). Both table columns and tree toggles are supported.
 
 ## `SchemaEditor`
 
@@ -64,8 +65,10 @@ import { SchemaEditor } from '@cratis/components/SchemaEditor';
 import type { JsonSchema, TypeFormat } from '@cratis/components/SchemaEditor';
 ```
 
-The editor is internally stateful and pushes the **whole new schema** out on
-every structural change.
+The default `layout='table'` has Edit/Save/Cancel and pushes the **whole new
+schema** out on every structural change. `layout='tree'` applies edits live,
+with `readOnly` for display. Read [tree layout](references/tree-layout.md) when
+using concepts, render slots, selection, parts or controlled property trees.
 
 ```tsx
 const [schema, setSchema] = useState<JsonSchema>(initialSchema);
@@ -83,11 +86,12 @@ const [schema, setSchema] = useState<JsonSchema>(initialSchema);
 
 | Prop | Type | Default |
 | --- | --- | --- |
-| `schema` | `JsonSchema` | **required** |
+| `schema` | `JsonSchema` | required unless a tree is controlled through `properties` |
+| `layout` | `'table' \| 'tree'` | `'table'` |
 | `eventTypeName` | `string` | `''` — the breadcrumb root label |
 | `canEdit` | `boolean` | `true` |
 | `canNotEditReason` | `string` | shown when `canEdit` is false |
-| `onChange` | `(schema: JsonSchema) => void` | receives the complete new schema |
+| `onChange` | `ChangeHandler<JsonSchema>` | complete new schema; optional second metadata argument |
 | `onSave` | `() => void` | takes **no arguments** |
 | `onCancel` | `() => void` | |
 | `editMode` | `boolean` | initial edit state only — see below |
@@ -96,8 +100,14 @@ const [schema, setSchema] = useState<JsonSchema>(initialSchema);
 | `typeFormats` | `TypeFormat[]` | the default vocabulary |
 | `className` | `string` | |
 | `labels` | `Partial<SchemaEditorLabels>` | override every visible and accessible string |
+| `allowRequired` | `boolean` | opt-in Required column/toggle |
+| `allowKeyProperty` | `boolean \| (property, context) => boolean` | opt-in Key column/toggle; table function enables the column |
+| `header` / `footer` | `ReactNode` | content around the properties, both layouts |
+| `isPropertyProtected` | `(property: Property) => boolean` | prevents rename/removal, both layouts |
+| `validatePropertyName` | `(name, property, siblings) => string \| undefined` | extra name check, both layouts |
+| `onPropertyRenamed` / `onPropertyRemoved` | callbacks on the property | both layouts; rename includes previous name |
 
-### Two behaviors that decide how you wire it
+### Table-layout behaviors that decide how you wire it
 
 - **`editMode` is initial state, not a controlled prop.** It seeds the internal
   flag once; changing it later has no effect. Drive edit mode from inside the
@@ -120,10 +130,10 @@ The default vocabulary covers `string` (plain, `guid`, `date-time`, `date`,
 `time`), `integer` (plain, `int16`, `int32`, `int64`), `number` (plain, `float`,
 `double`), and `boolean`. Supply your own `typeFormats` to narrow or extend it.
 
-**`typeFormats` is the only extension point.** There is no registry mapping a
-schema type to a custom editor component — the cell renderers are a fixed
-branch on `array` / `object` / everything else. You can change the vocabulary,
-not the widget.
+`typeFormats` changes the table vocabulary, not its fixed cell renderer.
+Both layouts have header/footer and protection/name callbacks. The tree adds
+concept types, row render slots, `getPropertyRowState`, selection and `pt`;
+see [tree layout](references/tree-layout.md).
 
 Changing a property's type has side effects worth knowing: switching to `array`
 seeds `items` as a string and clears `format`; switching to `object` seeds an
@@ -133,10 +143,10 @@ clears both `items` and `properties`.
 ### Nested navigation
 
 Drilling into an object property or an array's item definition pushes a
-breadcrumb segment. Array item definitions use the reserved path segment
-`$items`, rendered in the breadcrumb as `[items]`. Nested navigation is
-**click-driven only** — the breadcrumbs and rows are not keyboard-operable, so
-do not document a keyboard path that does not exist.
+breadcrumb segment in table layout. Array item definitions use the reserved
+path segment `$items`, rendered as `[items]`. Breadcrumb and drill-in buttons
+are keyboard-activatable; do not promise arrow-key grid navigation. Tree layout
+shows nested properties inline.
 
 ### Property-name validation
 
@@ -146,7 +156,9 @@ among its siblings. Save is disabled while any name is invalid.
 
 ### Localization
 
-`SchemaEditorLabels` has fourteen fields, nine of them accessible names:
+`SchemaEditorLabels` retains fourteen required fields and adds optional labels
+for the tree, concepts, key/required toggles and name diagnostics. The original
+fields include:
 menu actions `edit`, `save`, `cancel`, `addProperty`; accessible names `actions`,
 `navigateBack`, `navigateToItemDefinition`, `navigateToProperties`,
 `propertyName`, `propertyType`, `arrayItemType`, `deleteProperty`; and the
@@ -214,14 +226,14 @@ Anything richer belongs in the caller.
 `ObjectNavigationalBar` (`@cratis/components/ObjectNavigationalBar`) is the
 shared breadcrumb both editors use. Standalone, it takes `navigationPath`,
 `onNavigate`, and `backLabel` (which is both the tooltip and the accessible
-name — localize it). It is click-only, like the editors' own breadcrumbs.
+name — localize it). Its breadcrumb buttons are keyboard-activatable.
 
 ## Styling
 
-Both editors expose `className` only — no `pt`. Restyle their internals with CSS
-scoped under that class, reaching the controls they render (buttons, inputs,
-the embedded `Dropdown`) through their `data-cratis-part` values and the
-`--cratis-*` tokens; there is no global provider pass-through in Components 4 —
+The tree layout of `SchemaEditor` accepts `pt: SchemaEditorParts`; its table
+layout and `ObjectContentEditor` use `className`. Reach internal controls
+through documented `data-cratis-part` values and the `--cratis-*` tokens;
+there is no global provider pass-through in Components 4 —
 see the **cratis-components-styling** skill.
 
 ## Verify
@@ -231,10 +243,10 @@ see the **cratis-components-styling** skill.
   relied on for rendering.
 - The parent holds the schema or object state and updates it from `onChange`;
   `onSave` is treated as a signal, not a carrier of data.
-- `editMode` on `SchemaEditor` is treated as initial state, not a controlled
-  prop.
-- Nothing in the UI or the documentation promises a required-flag toggle,
-  nested object editing, or keyboard navigation in these editors.
+- Table `editMode` is initial state, not controlled; tree edits are live unless
+  `readOnly` or host-controlled through `properties`.
+- Required/key toggles are opted into. No nested **object-instance** editing or
+  arrow-key grid navigation is promised.
 - Every visible and accessible string is supplied through `labels` /
   `backLabel` in a localized application.
 - Lint and the TypeScript build pass.

package/package/corpus/skills/cratis-components-schema-editor/references/tree-layout.md

@@ -0,0 +1,62 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# SchemaEditor tree layout
+
+## Contents
+
+- Live edits and controlled mode
+- Extension props
+- Conversion helpers
+
+Verified at Components v4.26.4: `Source/SchemaEditor/SchemaEditor.tsx`,
+`Tree/TreeSchemaEditor.tsx`, `Tree/schemaConversion.ts`, and `index.ts`.
+All exports below come from `@cratis/components/SchemaEditor`.
+
+## Live edits and controlled mode
+
+`layout='tree'` shows nested properties inline. With `schema` and `onChange`,
+it owns the property tree and reports every edit as a complete schema through
+`ChangeHandler<JsonSchema>` (the optional metadata argument identifies a user edit).
+Handing the reported schema back preserves property ids; a different external
+schema replaces the tree. `readOnly` disables edits, not selection or host slots.
+Table-only Edit/Save/Cancel and `typeFormats` do not govern this layout.
+
+Alternatively pass `properties: Property[]`: the host owns all changes. An edit
+with no matching callback is not offered. Handle `onAddProperty`,
+`onAddChildProperty`, `onDeleteProperty`, `onRenameProperty`,
+`onChangePropertyType`, `onSetKeyProperty`, and `onSetRequiredProperty` as needed.
+`schema` is ignored in this mode. `onChange`, `onPropertiesChange`,
+`onPropertyRemoved`, and `onPropertyRenamed` report editor-owned changes only;
+the controlled host applies and reports its own changes.
+
+## Extension props
+
+| Prop | Contract |
+| --- | --- |
+| `concepts: PropertyConcept[]` | Named types with a `PropertyType`; saved as `x-concept`. Overrides a surrounding `PropertyConceptsProvider` |
+| `allowRequired` | Toggle membership in the object's `required` names |
+| `allowKeyProperty` | Boolean or `(property, context) => boolean`; `x-key`, one per object |
+| `isPropertyProtected` | Prevent rename/removal, not every possible edit |
+| `validatePropertyName` | `(name, property, siblings) => string \| undefined`, after built-in checks |
+| `selectedPropertyId`, `onPropertyClick` | Controlled selection; callback receives the property id |
+| `header`, `footer` | Content above properties / beside the add button |
+| `renderPropertyLeading`, `renderPropertyAccessory`, `renderPropertyDetails` | `(property, context) => ReactNode`, before name / after row content / below row |
+| `renderPropertyTypeBadge` | `(property, context, defaultBadge) => ReactNode` |
+| `getPropertyRowState` | Extra row classes, data attributes, tooltip and type-lock state |
+| `pt: SchemaEditorParts` | Stable part attributes |
+| `aria-label`, `aria-labelledby`, `labels` | Localizable editor name and copy |
+
+In controlled mode, supplying `onSetKeyProperty` or `onSetRequiredProperty`
+enables the corresponding toggle unless explicitly disabled. Both layouts also
+support `header`, `footer`, protection, extra name checks and rename/removal callbacks.
+
+## Conversion helpers
+
+The subpath exports `PropertyType`, `PropertyConceptsProvider`,
+`jsonSchemaToProperties`, `propertiesToJsonSchema`, `addProperty`,
+`addChildProperty`, `renameProperty`, `removeProperty`, `changePropertyType`,
+`setKeyProperty`, `setRequiredProperty`, and `toggleRequiredProperty`.
+Use the typed property-tree helpers for a controlled host, rather than treating
+`required` as a property boolean. Schema keywords are `x-concept`, `x-key`, and
+the parent object's `required: string[]`.

package/package/corpus/skills/cratis-components-schema-editor/verification.json

@@ -0,0 +1,14 @@
+{
+  "skill": "cratis-components-schema-editor",
+  "input": "Edit a JSON schema with live tree edits, required and key toggles, and custom row content.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "required?: string[]" },
+    { "kind": "skill-contains", "value": "allowRequired" },
+    { "kind": "skill-contains", "value": "layout='tree'" },
+    { "kind": "skill-contains", "value": "ChangeHandler<JsonSchema>" },
+    { "kind": "skill-contains", "value": "references/tree-layout.md" },
+    { "kind": "skill-contains", "value": "onSetRequiredProperty", "file": "references/tree-layout.md" },
+    { "kind": "skill-contains", "value": "renderPropertyTypeBadge", "file": "references/tree-layout.md" }
+  ]
+}

package/package/corpus/skills/cratis-components-stepper-command-dialog/SKILL.md

@@ -14,8 +14,8 @@ field across every step is valid.
 
 | Package | Version | Verified from |
 | --- | --- | --- |
-| `@cratis/components` | `4.6.0` | its package manifest, `Source/CommandDialog/*` (`StepperCommandDialog`, `CommandStepper`, `StepperPanel`), `Documentation/StepperCommandDialog/*`, `Documentation/CommandStepper/*` |
-| `@cratis/arc.react` | `>=20.3.1 <23` | peer range declared by `@cratis/components@4.6.0` |
+| `@cratis/components` | `4.26.4` | its package manifest, `Source/CommandDialog/*` (`StepperCommandDialog`, `CommandStepper`, `StepperPanel`), `Documentation/StepperCommandDialog/*`, `Documentation/CommandStepper/*` |
+| `@cratis/arc.react` | `>=20.3.1 <23` | peer range declared by `@cratis/components@4.26.4` |
 
 ## Choose it over `CommandDialog` when
 
@@ -66,7 +66,8 @@ export const CreateProjectDialog = () => {
 
 Rules:
 
-- Every `StepperPanel` needs a `header` — it is the step label.
+- Give every `StepperPanel` a `header` — the house convention for a named step.
+  Its type is optional `ReactNode`, not a required string.
 - All `CommandForm` fields inside any panel bind to the **same** command
   instance through their `value` accessor.
 - Each command property belongs on exactly one step.
@@ -144,6 +145,7 @@ Dialog-level props:
 | `isValid` | `boolean` | extra validity gate on top of form validity |
 | `onConfirm` / `onCancel` / `onClose` | close gates | — |
 | `onBeforeExecute` | `(values) => values` | transformer; must return the values |
+| `confirmBeforeExecute` | `(values) => boolean \| Promise<boolean>` | after validation and transformation; only `true` executes |
 | `style` / `contentStyle` | `CSSProperties` | — |
 | `resizable` | `boolean` | `false` — accepted but has no effect |
 
@@ -155,11 +157,16 @@ Stepper-level props (inherited from the stepper customization surface):
 | `headerPosition` | `'top' \| 'bottom'` | `'top'` |
 | `linear` | `boolean` | `true` |
 | `start` / `end` | `React.ReactNode` | extra content beside the step headers |
-| `onChangeStep` | `(event: { index: number }) => void` | — |
+| `onChangeStep` | `(event: { index: number }) => void` | once per accepted move: header, Previous, Next |
 
 Command-form props (`initialValues`, `currentValues`, `validateOn`,
 `validateOnInit`, `onSuccess`, `onValidationFailure`, `onFailed`,
-`autoServerValidate`, …) all apply as well.
+`autoServerValidate`, …) all apply as well. Horizontal steppers show names below
+numbers and wrap (4.26.3+). Panels are named by their headers through
+`aria-labelledby`; custom header ids are preserved.
+
+While `confirmBeforeExecute` is pending, fields are disabled; changed command
+values discard approval and skip execution. Confirm the new values again.
 
 ### Two part targets
 
@@ -167,8 +174,8 @@ The inherited `pt` (`StepperParts`: `root`, `list`, `step`, `header`, `number`,
 `title`, `separator`, `panels`, `panel`) targets the **inner stepper**. Use
 `dialogPt` (`DialogParts`) and `dialogClassName` to reach the **outer dialog**.
 Getting these the wrong way round is the usual cause of a `pt` that appears to do
-nothing. (`ptOptions`/`unstyled` and their `dialog*` twins are accepted for
-Components 3 source compatibility and do nothing.)
+nothing. (`ptOptions`/`unstyled` are compatibility no-ops;
+`dialogPtOptions`/`dialogUnstyled` are also deprecated no-ops.)
 
 ## Dismissal while the command runs
 
@@ -181,7 +188,8 @@ needs one.
 
 `CommandStepper` (same subpath) is the stepper without the dialog chrome, for
 embedding a wizard directly in a page. It takes the same `StepperPanel`
-children.
+children. It reports `onException`, `onUnauthorized`, and `onFailed` (including
+validation failures), and guards against double submission.
 
 ## Common mistakes