Bump Jint from 4.11.0 to 4.14.0 by dependabot[bot] · Pull Request #137 · en-gen/Wayfinder

dependabot · 2026-07-24T12:25:39Z

Updated Jint from 4.11.0 to 4.14.0.

Release notes

4.14.0

Jint 4.14.0 is an interop-focused performance release: CLR arrays now cross into script as live views instead of copies, recently wrapped host objects reuse their wrappers, single-candidate interop method calls dispatch through compiled invokers, and JSON.parse interns repeated keys and values. Host collection traversal is 10.9× faster than 4.13.0. Two interop defaults changed in this release — read the first two highlights if you pass CLR arrays to scripts or rely on per-crossing conversion behavior; everything else needs no code changes to benefit.

Highlights

CLR arrays are live views by default (behavior change). Options.Interop.ArrayConversion now defaults to ArrayConversionMode.LiveView (#2721, #2728, #2735): a single-rank T[] crossing into script becomes a live, fixed-size view over the underlying array — the way wrapped List<T> already behaves — instead of being copied into a new JS array on every read. Writes go through in both directions, and arrays exposed through read-only-declared members (e.g. IReadOnlyList<T>) produce read-only views. Iteration, Array.prototype methods, JSON serialization, index-key enumeration (Object.keys / for..in yield "0".."n-1") and undefined for out-of-range reads all behave array-like, but Array.isArray returns false, and because CLR arrays are fixed-size, resizing operations (push/pop/length writes) throw a TypeError like integer-indexed exotic objects do — shift/splice may move elements before their length change throws, as for typed arrays. Set Options.Interop.ArrayConversion = ArrayConversionMode.Copy to restore the 4.13 behavior.

Recently wrapped CLR objects reuse their wrappers (behavior change). The new Options.Interop.CacheRecentObjectWrappers defaults to true (#2734): a small bounded ring (8 entries, keyed by reference identity and exposed type) reuses wrappers for host objects that repeatedly cross into script. Wrapper identity becomes stable (host.Obj === host.Obj), script-attached state (freeze, defineProperty, expandos) survives crossings, and the per-crossing wrapper allocation disappears. Under Copy array conversion this also means repeated reads of the same CLR array reuse the first JsArray snapshot while it stays cached — CLR-side mutations are not re-copied; set the option to false for the pre-4.14 fresh-snapshot-per-crossing behavior. Engine.Dispose() releases the ring.

Interop fast lanes. Single-candidate method calls run through a compiled invoker that binds and invokes without argument arrays or boxing (#2733), with per-parameter binding flags precomputed (#2719). Resolved ObjectWrapper members get a per-call-site inline cache (#2722) and the member-call fast path covers primitive string receivers (#2717). Array-like wrapper creation is a cached factory call with lazily materialized length (#2730), primitive elements convert without boxing on both indexed reads and Array.prototype iteration (#2731, #2735), the wrapper identity caches cover CLR arrays (#2716), and implicitly implemented interface methods are deduplicated in member resolution (#2711).

JSON. JSON.parse interns property keys and string values within a parse, parses numbers off the span with an exactly-rounded fast path and scans string content in bulk (#2718, #2725, #2732) — the json-parse-modern comparison row is 6% faster with 23% less allocation than 4.13.0. Parsing is also aligned with the JSON grammar (#2738): malformed numbers like -09 and 1. are now rejected as in V8, while raw U+2028/U+2029 in strings and escaped control characters in keys — both valid JSON — are now accepted.

Strings. Chained slice/substring and split segments stay zero-copy views (#2720), whole-string substring/substr return the receiver, and mismatched-length comparisons no longer materialize views (#2740).

Execution constraints at host boundaries. Timeouts and cancellation are re-checked when control returns from host CLR code, so detection latency is bounded by one host call instead of a statement-count window, without adding per-statement cost — gated on execution depth so host-side reads of wrapped objects on an idle engine never observe a stale timer (#2713, #2714, #2715). Execution-context depth stays balanced when constraint exceptions unwind generator/async frames, and a host callback that re-enters the engine no longer resets the outer script's budget (#2736).

Correctness (including a pre-release review). A review of everything since 4.13.0 fixed: spurious TDZ when a for-header reads a name the loop body shadows (#2709) and stale closure captures from destructuring defaults in for-loop headers (#2739); the compiled-invoker lane now defers to custom ITypeConverters and preserves reflection exception types (#2737); and the new wrapper defaults were hardened — declared-type contracts for arrays (an IReadOnlyList<T>-typed member no longer yields a writable view), a static type-mapper poisoning crash, Engine.Dispose releasing the wrapper caches, and JS-array in/enumeration/out-of-range semantics on array views (#2735). Closure reads memoize slot-cache chain reachability (#2726).

On the engine comparison benchmarks, Jint 4.14.0 beats ClearScript (native V8) by 7.1×–9.1× on every script ↔ host interop row — host collection traversal went from last to second among all engines at 15,597 → 1,433 µs with 99% less allocation — while remaining the fastest managed engine on 10 of 12 pure-JS scripts and the fastest interpreter on all 12, and now leading array-stress and dromaeo-object-array, rows V8 narrowly led at 4.13.0.

What's Changed

Refresh EngineComparison benchmarks for 4.13.0 by @lahma in Refresh EngineComparison benchmarks for 4.13.0 sebastienros/jint#2704
Fix spurious TDZ when a for-header reads a name the loop body shadows by @svenrog in Fix spurious TDZ when a for-header reads a name the loop body shadows sebastienros/jint#2709
Bump the testing group with 1 update by @dependabot[bot] in Bump the testing group with 1 update sebastienros/jint#2710
Add tests for using modules from script code run via Evaluate by @lahma in Add tests for using modules from script code run via Evaluate sebastienros/jint#2712
Deduplicate implicitly implemented interface methods in member resolution by @lahma in Deduplicate implicitly implemented interface methods in member resolution sebastienros/jint#2711
Re-check amortized constraints at interpreter/host-code boundaries by @lahma in Re-check amortized constraints at interpreter/host-code boundaries sebastienros/jint#2713
Add ClearScript V8 to engine comparison benchmarks, trim suite, add script-to-host interop suite by @viceice in Add ClearScript V8 to engine comparison benchmarks, trim suite, add script-to-host interop suite sebastienros/jint#1775
Gate host-boundary constraint checks on active evaluation and harden coverage by @lahma in Gate host-boundary constraint checks on active evaluation and harden coverage sebastienros/jint#2714
Key the host-boundary constraint gate on execution depth and close remaining lanes by @lahma in Key the host-boundary constraint gate on execution depth and close remaining lanes sebastienros/jint#2715
Cover CLR arrays with the interop identity caches by @lahma in Cover CLR arrays with the interop identity caches sebastienros/jint#2716
Extend the member-call fast path to primitive string receivers by @lahma in Extend the member-call fast path to primitive string receivers sebastienros/jint#2717
Intern object property keys within a single JSON parse by @lahma in Intern object property keys within a single JSON parse sebastienros/jint#2718
Precompute per-parameter interop binding flags by @lahma in Precompute per-parameter interop binding flags sebastienros/jint#2719
Keep slice-of-slice and split segments zero-copy by @lahma in Keep slice-of-slice and split segments zero-copy sebastienros/jint#2720
Add opt-in ClrArrayConversion.LiveView interop mode for CLR arrays by @lahma in Add opt-in ClrArrayConversion.LiveView interop mode for CLR arrays sebastienros/jint#2721
Cache resolved ObjectWrapper members per member-expression node by @lahma in Cache resolved ObjectWrapper members per member-expression node sebastienros/jint#2722
Refresh engine comparison README after the V8-gap campaign by @lahma in Refresh engine comparison README after the V8-gap campaign sebastienros/jint#2723
Bulk string scanning and a simple-number fast path for JSON.parse by @lahma in Bulk string scanning and a simple-number fast path for JSON.parse sebastienros/jint#2725
Memoize slot-cache chain reachability for closure reads by @lahma in Memoize slot-cache chain reachability for closure reads sebastienros/jint#2726
Refresh engine comparison tables after the second campaign round by @lahma in Refresh engine comparison tables after the second campaign round sebastienros/jint#2727
Default Interop.ArrayConversion to LiveView for 4.14 by @lahma in Default Interop.ArrayConversion to LiveView for 4.14 sebastienros/jint#2728
Cache array-like wrapper factories and materialize length lazily by @lahma in Cache array-like wrapper factories and materialize length lazily sebastienros/jint#2730
Convert primitive array-like wrapper elements without boxing by @lahma in Convert primitive array-like wrapper elements without boxing sebastienros/jint#2731
Add a compiled-invoker fast lane for single-candidate interop method calls by @lahma in Add a compiled-invoker fast lane for single-candidate interop method calls sebastienros/jint#2733
Intern JSON.parse string values and parse numbers off the span by @lahma in Intern JSON.parse string values and parse numbers off the span sebastienros/jint#2732
Default Interop.CacheRecentObjectWrappers to true for 4.14 by @lahma in Default Interop.CacheRecentObjectWrappers to true for 4.14 sebastienros/jint#2734
Harden LiveView array wrappers and interop wrapper caches for 4.14 by @lahma in Harden LiveView array wrappers and interop wrapper caches for 4.14 sebastienros/jint#2735
Keep execution-context depth balanced under raw constraint exceptions by @lahma in Keep execution-context depth balanced under raw constraint exceptions sebastienros/jint#2736
... (truncated)

4.13.0

Jint 4.13.0 is a performance- and correctness-focused release. It brings a Proxy overhaul — trap dispatch rebuilt to forward with near-zero allocation, plus a new public API for implementing traps in .NET — extends the unboxed interpreter fast lanes to more operators and loop shapes, and cuts allocations on for..of, nested-function calls and array enumeration. A thorough pre-release review of everything since 4.12.0 also fixed several correctness bugs. No code changes are required to benefit.

Highlights

Proxy overhaul, and a CLR trap API. Proxy trap dispatch was rebuilt around a shared skeleton with lazy argument construction and pooled arrays, so a proxy with no matching trap forwards to its target with effectively zero allocation (#2674, #2675, #2676). Proxies can now be implemented from .NET: Engine.Advanced.CreateProxy / CreateRevocableProxy accept a ProxyHandler whose virtual methods are the traps, with the same invariant enforcement as JavaScript handlers (#2678). Several Proxy spec fixes came along — getPrototypeOf / setPrototypeOf with null prototypes (#2668), the construct trap's argument array (#2670), capturing [[Construct]] at creation (#2669), and the get trap firing for a property named revoke (#2667) — and the ObjectWrapper iterator helpers are hardened against foreign and revoked receivers (#2681).

Interpreter fast lanes. New unboxed operand lanes for the arithmetic binary operators (#2664) and an int32 fast lane for remainder (#2671) remove per-iteration boxing; flag-proven casts use Unsafe.As on the hot paths (#2673) and JsNumber.Create avoids a native fmod (#2662). Strict-equality guards against undefined / null / typeof are fused (#2658), member-expression identifier reads route through the identifier caches (#2660), and the identifier slot cache is restructured hop-0-first (#2689). The tight-loop fast lane now covers while and do-while bodies (#2688).

Lower allocations. for..of over an array no longer allocates an iterator-result object per element (#2700); per-call nested-function instantiation is allocation-free (#2684); for-in over arrays enumerates dense indices lazily without materializing a key list (#2656); and observation-only constraint checks are amortized so tight loops stay fast under a timeout (#2672).

RegExp. Quantified groups without capture or lookaround hazards prefer the .NET Regex engine (#2682), reused .NET adaptations adaptively upgrade to RegexOptions.Compiled (#2690), and the custom engine's match timeout is enforced by an inline deadline rather than a thread-pool timer (#2686).

Correctness (including a pre-release review). A review of everything since 4.12.0 fixed: a regex routing regression that silently truncated matches for nullable non-capturing quantified groups (#2694) and a custom-engine bug dropping iterations for multi-atom quantified groups (#2699); Proxy trap dispatch is now atomic against a mid-dispatch revoke (#2696); top-level await of a .NET Task in a module (#2665), plus prompt cancellation of the await drain (#2697); the arguments object escaping a short-circuiting logical compound assignment un-materialized (#2698); for-in now includes inherited enumerable index properties on Array.prototype (#2655); and the memory limit stays exact in tight loops (#2695).

Across the managed JavaScript engines for .NET, Jint 4.13.0 is the fastest engine on 17 of the 21 comparison scripts — and the fastest interpreter on all 21 — while allocating far less memory than the other engines; dromaeo-3d-cube is ~9% faster and dromaeo-string-base64 ~10% faster than 4.12.0. See the engine comparison benchmarks for the full table.

What's Changed

Drop Jurassic from engine comparison benchmarks, add Okojo by @lahma in Drop Jurassic from engine comparison benchmarks, add Okojo sebastienros/jint#2653
Add benchmark lanes for for-in over arrays, holey-array traversal and large-chunk string concat by @lahma in Add benchmark lanes for for-in over arrays, holey-array traversal and large-chunk string concat sebastienros/jint#2654
Fix for-in missing inherited enumerable index properties placed on Array.prototype by @lahma in Fix for-in missing inherited enumerable index properties placed on Array.prototype sebastienros/jint#2655
for-in over arrays: enumerate dense indices lazily without materializing a key list by @lahma in for-in over arrays: enumerate dense indices lazily without materializing a key list sebastienros/jint#2656
Harden the known wall-clock test flakes by @lahma in Harden the known wall-clock test flakes sebastienros/jint#2657
Fuse strict-equality guards: x === undefined/null and typeof x === "literal" by @lahma in Fuse strict-equality guards: x === undefined/null and typeof x === "literal" sebastienros/jint#2658
Skip the prototype walk for array hole reads when the chain is provably clean by @lahma in Skip the prototype walk for array hole reads when the chain is provably clean sebastienros/jint#2659
Route member-expression identifier-object reads through identifier caches by @lahma in Route member-expression identifier-object reads through identifier caches sebastienros/jint#2660
Avoid native fmod in JsNumber.Create(double) integral detection by @lahma in Avoid native fmod in JsNumber.Create(double) integral detection sebastienros/jint#2662
Add unboxed operand lane for arithmetic binary operators by @lahma in Add unboxed operand lane for arithmetic binary operators sebastienros/jint#2664
Fix top-level await of a .NET Task in a module failing with "Pending" by @lahma in Fix top-level await of a .NET Task in a module failing with "Pending" sebastienros/jint#2665
Add Proxy trap dispatch benchmarks by @lahma in Add Proxy trap dispatch benchmarks sebastienros/jint#2666
Fix Proxy get trap being bypassed for properties named "revoke" by @lahma in Fix Proxy get trap being bypassed for properties named "revoke" sebastienros/jint#2667
Add int32 fast lane to the raw-double remainder sites by @lahma in Add int32 fast lane to the raw-double remainder sites sebastienros/jint#2671
Fix Proxy getPrototypeOf/setPrototypeOf traps with null prototypes by @lahma in Fix Proxy getPrototypeOf/setPrototypeOf traps with null prototypes sebastienros/jint#2668
Capture Proxy [[Construct]] at creation per ProxyCreate by @lahma in Capture Proxy [[Construct]] at creation per ProxyCreate sebastienros/jint#2669
Replace flag-proven casts with Unsafe.As on hot arithmetic paths by @lahma in Replace flag-proven casts with Unsafe.As on hot arithmetic paths sebastienros/jint#2673
Fix Proxy construct trap receiving Array-constructor-mangled arguments by @lahma in Fix Proxy construct trap receiving Array-constructor-mangled arguments sebastienros/jint#2670
Amortize observation-only constraint checks and keep tight loops armed under timeouts by @lahma in Amortize observation-only constraint checks and keep tight loops armed under timeouts sebastienros/jint#2672
Refactor Proxy trap dispatch into a shared skeleton with lazy argument construction by @lahma in Refactor Proxy trap dispatch into a shared skeleton with lazy argument construction sebastienros/jint#2674
Pool Proxy trap argument arrays by @lahma in Pool Proxy trap argument arrays sebastienros/jint#2675
Slim allocations in Proxy ownKeys trap validation by @lahma in Slim allocations in Proxy ownKeys trap validation sebastienros/jint#2676
Give every Proxy invariant violation a descriptive TypeError message by @lahma in Give every Proxy invariant violation a descriptive TypeError message sebastienros/jint#2677
Add ProxyHandler for implementing Proxy traps in .NET code by @lahma in Add ProxyHandler for implementing Proxy traps in .NET code sebastienros/jint#2678
Guard default RevocableProxy instances with a clear exception by @lahma in Guard default RevocableProxy instances with a clear exception sebastienros/jint#2679
Add CLR ProxyHandler lanes to ProxyBenchmark by @lahma in Add CLR ProxyHandler lanes to ProxyBenchmark sebastienros/jint#2680
Harden ObjectWrapper iterator helpers against foreign and revoked receivers by @lahma in Harden ObjectWrapper iterator helpers against foreign and revoked receivers sebastienros/jint#2681
Let branchy constructors with static this-stores shape from instance three by @lahma in Let branchy constructors with static this-stores shape from instance three sebastienros/jint#2685
Prefer .NET Regex for quantified groups without capture or lookaround hazards by @lahma in Prefer .NET Regex for quantified groups without capture or lookaround hazards sebastienros/jint#2682
Skip covariant store checks when populating exact JsValue arrays by @lahma in Skip covariant store checks when populating exact JsValue arrays sebastienros/jint#2683
Enforce custom regex-engine timeout via an inline deadline instead of a thread-pool timer by @lahma in Enforce custom regex-engine timeout via an inline deadline instead of a thread-pool timer sebastienros/jint#2686
Make per-call nested function instantiation allocation-free by @lahma in Make per-call nested function instantiation allocation-free sebastienros/jint#2684
CI: cross-OS Test262 suite cache + action/tool version bumps by @lahma in CI: cross-OS Test262 suite cache + action/tool version bumps sebastienros/jint#2687
... (truncated)

4.12.0

Jint 4.12.0 is a performance- and correctness-focused release. It completes the move to hidden-class shapes across the whole object model, extends the unboxed interpreter fast lanes to more operators and call shapes, and adds a layer of per-engine caching so re-executed scripts and re-created functions reuse their compiled metadata and environments. A pre-release review of everything since 4.11.0 also fixed several correctness regressions. No code changes are required to benefit.

Highlights

Object model — shapes everywhere. The hidden-class shape model now backs the built-in prototypes and constructors, TypedArrays, the global object, and Intl / Temporal (#2580, #2581, #2582, #2590, #2595, #2597). JSON.parse builds its result objects as shapes, so an array of like-shaped records costs one allocation per record instead of a property dictionary each (#2634). Object literals inside generator/async frames and object spread {...src} adopt shapes too (#2596, #2648, #2635), and a provably-simple constructor shapes its instances from the third construction (#2636).

Interpreter fast lanes. New unboxed operand lanes for equality, bitwise, modulo-equality and sum-of-products expressions remove per-iteration boxing (#2602, #2604, #2611, #2628), and comparison operands are served from the validated global-descriptor cache (#2603). Expression-only and if/else for-loop bodies run through a tight per-iteration cycle with a member-bound loop test (i < arr.length) (#2605, #2617, #2623), env-less leaf calls run against the captured environment directly (#2627), and functions that cannot observe their this skip this-binding (#2626).

Caching & reuse. Nested-scope global reads and writes are served from a validated global-binding cache (#2584, #2625); hoisted function and class definitions, and the top-level statement handler tree, are reused across re-evaluations on an engine (#2613, #2615, #2649); and for-of / for-in reuse a fixed-slot per-iteration environment, skipping per-iteration TDZ re-init where it is provably safe (#2586, #2632).

Lower allocations. A coverage campaign added benchmarks for common patterns the suite did not exercise and then closed the hotspots they surfaced (#2630): resolved await chains and engine-internal promise reactions (#2639), for-in enumeration (#2640), throw/catch (#2641), primitive number/boolean/bigint methods (no wrapper object, #2642), and tagged templates (#2638) all allocate far less.

Correctness. Fixes for sticky + global [Symbol.match] returning wrong results (#2600), an unlabeled break escaping a labeled switch (#2607), -0 in integer multiplication (#2620), and raw property writes on shaped hosts (#2591, #2601). A pre-release review (#2651) additionally fixed for-in re-enumerating a shadowed key (a mid-loop delete and a pooled-iterator reuse case), mapped-arguments writes being lost after the call returns (and duplicate-parameter mapping now follows the spec), and hardened the object-literal and built-in-shape paths.

Across the managed JavaScript engines for .NET, Jint 4.12.0 is the fastest engine on 17 of the 21 comparison scripts — and the fastest interpreter on all 21 — leading by up to ~5.4× over the next-fastest engine while allocating 2×–63× less memory than the closest competitor. See the engine comparison benchmarks for the full table.

What's Changed

Built-in shapes for prototypes and constructors: composable storage, accessors, aliases by @lahma in Built-in shapes for prototypes and constructors: composable storage, accessors, aliases sebastienros/jint#2580
Shape Number/%TypedArray% constructors and %TypedArray%.prototype; add [JsInstanceSlot] by @lahma in Shape Number/%TypedArray% constructors and %TypedArray%.prototype; add [JsInstanceSlot] sebastienros/jint#2581
Shape TypedArray constructors; modernize element codecs with BinaryPrimitives by @lahma in Shape TypedArray constructors; modernize element codecs with BinaryPrimitives sebastienros/jint#2582
Trim per-iteration block ceremony; slot lane for lexical declaration initialization by @lahma in Trim per-iteration block ceremony; slot lane for lexical declaration initialization sebastienros/jint#2583
Serve nested-scope global reads and writes from the global-binding cache by @lahma in Serve nested-scope global reads and writes from the global-binding cache sebastienros/jint#2584
Probe own-property existence/enumerability without materializing descriptors by @lahma in Probe own-property existence/enumerability without materializing descriptors sebastienros/jint#2585
Keep builtin-shape deopt lazy: unmaterialized function slots stay deferred by @lahma in Keep builtin-shape deopt lazy: unmaterialized function slots stay deferred sebastienros/jint#2588
Serve arguments reads virtually; defer property materialization by @lahma in Serve arguments reads virtually; defer property materialization sebastienros/jint#2589
Reuse a fixed-slot per-iteration environment in for-of/for-in by @lahma in Reuse a fixed-slot per-iteration environment in for-of/for-in sebastienros/jint#2586
Bump the analyzers group with 3 updates by @dependabot[bot] in Bump the analyzers group with 3 updates sebastienros/jint#2575
BuiltinShape Factory slots: shape-path intrinsic references and throwers; flip Function.prototype by @lahma in BuiltinShape Factory slots: shape-path intrinsic references and throwers; flip Function.prototype sebastienros/jint#2590
Fix raw SetProperty on builtin-shaped hosts landing in an invisible dictionary by @lahma in Fix raw SetProperty on builtin-shaped hosts landing in an invisible dictionary sebastienros/jint#2591
Build the yield argument handler once, not per evaluation by @lahma in Build the yield argument handler once, not per evaluation sebastienros/jint#2593
Allocation-free for-in key enumeration by @lahma in Allocation-free for-in key enumeration sebastienros/jint#2592
Extend prepared-script engine-retention test to newer env cache shapes by @lahma in Extend prepared-script engine-retention test to newer env cache shapes sebastienros/jint#2594
Shape-backed object literals inside generator/async frames when values cannot suspend by @lahma in Shape-backed object literals inside generator/async frames when values cannot suspend sebastienros/jint#2596
Flip Intl, Temporal and %AsyncFromSyncIteratorPrototype% to builtin shapes by @lahma in Flip Intl, Temporal and %AsyncFromSyncIteratorPrototype% to builtin shapes sebastienros/jint#2597
GlobalObject joins the builtin-shape system via hybrid shape+overflow storage by @lahma in GlobalObject joins the builtin-shape system via hybrid shape+overflow storage sebastienros/jint#2595
Refresh engine comparison benchmark results by @lahma in Refresh engine comparison benchmark results sebastienros/jint#2598
Update Test262 suite to latest commit; drop issue-5066 slice exclusion by @lahma in Update Test262 suite to latest commit; drop issue-5066 slice exclusion sebastienros/jint#2599
Fix sticky+global [Symbol.match] .NET fast path returning wrong results by @lahma in Fix sticky+global [Symbol.match] .NET fast path returning wrong results sebastienros/jint#2600
Make raw SetProperty before lazy initialization survive Initialize by @lahma in Make raw SetProperty before lazy initialization survive Initialize sebastienros/jint#2601
Add unboxed slot-number lane to equality operators by @lahma in Add unboxed slot-number lane to equality operators sebastienros/jint#2602
Run expression-only for-loop bodies through a tight per-iteration cycle by @lahma in Run expression-only for-loop bodies through a tight per-iteration cycle sebastienros/jint#2605
Serve comparison-lane operands from the validated global-descriptor cache by @lahma in Serve comparison-lane operands from the validated global-descriptor cache sebastienros/jint#2603
Add dense-array append fast path for computed-index writes by @lahma in Add dense-array append fast path for computed-index writes sebastienros/jint#2608
Mark dead completion values at script/eval top level by @lahma in Mark dead completion values at script/eval top level sebastienros/jint#2606
Fused modulo-equality lane; admit const bindings to comparison-lane reads by @lahma in Fused modulo-equality lane; admit const bindings to comparison-lane reads sebastienros/jint#2604
Construct new Date() from clock ticks without intermediate conversions by @lahma in Construct new Date() from clock ticks without intermediate conversions sebastienros/jint#2609
Fix unlabeled break escaping a labeled switch statement by @svenrog in Fix unlabeled break escaping a labeled switch statement sebastienros/jint#2607
Flatten eligible loop-body lexicals into the pooled loop environment by @lahma in Flatten eligible loop-body lexicals into the pooled loop environment sebastienros/jint#2610
Evaluate sum-of-products assignments on raw doubles, boxing once by @lahma in Evaluate sum-of-products assignments on raw doubles, boxing once sebastienros/jint#2611
Refresh engine comparison benchmark results by @lahma in Refresh engine comparison benchmark results sebastienros/jint#2612
... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…p business case Add documentation, reorganize repo structure, and develop business case - Moved solution and all projects under src/ - Rewrote README with full project structure, tech stack, and doc links - Added docs/01-cmmn-overview.md: CMMN standard overview and engine mapping - Added docs/02-codebase-evaluation.md: architectural assessment and code metrics - Added docs/03-modernization-plan.md: 7-phase roadmap to production SaaS, v1/v2 scope, delivery scenarios - Added docs/04-market-analysis.md: competitive landscape, strategic positioning, audit vertical deep-dive - Added docs/05-business-case.md: internal pitch — build vs. buy, IP provenance, revenue model, competitive reframe, v1 scope, design partner approach - Added .vscode/settings.json: markdown preview default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix product names across all docs Correct product names throughout: Lease Accounting and Data Extraction (not Crunchafi Lease Accounting / Crunchafi Data Extraction). Fix rebrand description from LeaseCrunch to Crunchafi. Remove remaining Strongbox references. Fix redundant phrasing in modernization plan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…p and analysis docs Establishes the delivery foundation for roadmap M0: - Case.Flow.CI (Version job via GitVersion dotnet tool; build, test, merged coverage; run names <version>-<label>.<counter>) - GitVersion baseline 1.0.0: all pre-GA builds are previews of 1.0.0 (develop -> 1.0.0-develop.<n>); tag Case.Flow-1.0.0 at GA - docs/06 commercial readiness deep-dive, docs/07 product roadmap (mirrored to work items 9-48) - scripts/: idempotent ADO roadmap scaffolding - .gitignore: coverlet artifacts Related work items: #10, #48

Migrates the solution from .NET Core 3.1 / Orleans 3.3.0 to net10.0 / Orleans 10.2.1. 209/209 tests pass natively; independent pre-merge review verdict: merge-ready. - All six projects to net10.0; global.json pins SDK 10.0.x - Orleans: modern Sdk/Server packages, Host-builder hosting, memory streams (replaces fire-and-forget SMS), TestCluster fixture with verified prod parity - Serialization: [GenerateSerializer]/[Id] across events/stores/snapshots; Quartz.JobKey surrogate; Newtonsoft fallback scoped to the CMMN model namespace + JToken (TypeNameHandling.Auto required for the polymorphic hierarchy; SerializationBinder hardening filed as follow-up) - Jint 4.11 with sandbox budgets (timeout/statements/memory) - License-aware bumps: AutoMapper pinned 14.0.0 (last MIT; carries GHSA-rvv3-g6hj-g44x - removal item filed), FluentAssertions 7.2.0 (last pre-commercial) - CI: native SDK 10, DOTNET_ROLL_FORWARD stopgap removed - Fixes a latent never-asserting test (IsSameOrEqualTo no-op) in CaseStoreTests - Intentional minor behavior additions: DeactivationReason now logged in TimerEventSchedulerGrain.OnDeactivateAsync; CorrelationId sourced from Activity.Current Known follow-ups filed rather than blocked on: pre-existing timer-stream namespace mismatch (TimerTickJob vs behavior subscription) + end-to-end timer delivery test; stream resume/backpressure integration tests; SerializationBinder allowlist. Related work items: #11, #12

…ucture) Moves CI to devops/build/case.flow.ci.yml (definition 4 repointed in the same change), reserves devops/deploy (Case.Flow.CD home + step templates) and devops/infrastructure (bicepconfig.json, all analyzer rules as errors), scopes the CI trigger to src/devops/GitVersion.yml/global.json, adds the VS Code azure-pipelines file association, and syncs docs/07 + scripts/roadmap.json with tracker items #49-#51. Follow-up applied at merge time: develop/main build-validation policies get filenamePatterns matching the trigger paths, so docs-only PRs skip build validation. Related work items: #9

Removes Newtonsoft.Json solution-wide (work item #52). Rebased over the merged devops/AutoMapper/systemic-fixes train; 244/244 tests green locally post-rebase; orchestrator review verdict: merge-ready. - Orleans fallback serializer -> Microsoft.Orleans.Serialization.SystemTextJson, with polymorphism for the XSD-generated CMMN hierarchy derived from the generator's own [XmlInclude] attributes (CmmnPolymorphicTypeResolver; no hand-maintained type list). Discriminators fail-closed: unknown types are rejected on both serialize and deserialize - this supersedes work item #51 (SerializationBinder allowlist), which the Newtonsoft TypeNameHandling.Auto setup needed and this design makes structural. - Jint case-file bridge fully rewritten on System.Text.Json.Nodes (JsonObjectInstance / JsonNodePropertyDescriptor / JsonNodeExtensions + Executable.cs); 9 new tests over previously-uncovered WithArgument/WithContext caught and fixed a null-vs-Undefined bug. - Fixed en route: STJ ignoring [IgnoreDataMember] (object cycle on Stage recursion) and get-only ICollection<T> properties silently deserializing empty (per-property Populate scoping). - Generated model: 25 Newtonsoft [JsonIgnore] swapped for System.Text.Json equivalents (frozen file, deliberate edit). - Round-trip pinning tests through the real Orleans serializer prove concrete subtypes survive (the historical polymorphism-collapse regression cannot silently return). Related work items: #51, #52

Replaces the initial grep-based CI gate with restore-time NuGet Audit enforcement: Directory.Build.props treats NU1902-NU1904 (moderate/high/critical, direct + transitive) as errors on every restore - local dev and CI alike; nuget.config pins nuget.org as the sole source (hermetic builds + guaranteed audit data). Completes work item #12. Decision context: GitHub Advanced Security for ADO evaluated and skipped at current scale ($19-$49/committer/mo); repo-host + security-suite question added to the #22 licensing decision gate. Related work items: #12

Solution-wide member-style sweep (work item #53): private constructor-assigned get-only auto-properties become private readonly _camelCase fields - 35 conversions across 25 files (production + tests). Protected/public API surface, serialized state types, and properties with setters or bodies are untouched. Ships .editorconfig with the enforcing conventions: private instance fields _camelCase, const and static readonly fields PascalCase (matching existing codebase precedent), dotnet_style_readonly_field warning. Pure mechanics contract verified: 244/244 tests identical before and after on the same base commit; zero new build warnings. One pre-existing naming inconsistency deliberately left alone (TypeNameHelper.cs, vendored from dotnet/runtime). Related work items: #53

…banners, name sweep Closes the last M0 work item (#14), applying the docs/06 section 5 correction list under the documentation doctrine (wiki = what was built, work items = what we plan): - README rewritten to as-built truth: honest capability/gap lists, no conformance overclaim, current stack (net10.0 / Orleans 10.2.1 / System.Text.Json / sandboxed Jint 4.x), devops structure, build instructions, and the wiki/work-items documentation model - docs/02 + docs/03 banner-marked as historical (pre-modernization snapshots) with their factually-wrong-at-writing items fixed: origin date (first commit Jan 2019), 25-file unit test suite, IBehaviorHost 17 members, 38 CaseRequestContext references (+ RequestContext-wrapper nuance), spec-comment format, and the Phase 3 effort table/body contradiction (now 5-7 weeks in both) - Case.Flow name normalized across docs 01-05 (docker image path corrected to case.flow/silo) Docs-only: build validation is skipped by the branch policy path filters, by design. Related work items: #14

Adds hard resource budgets to the shared Jint engine (2s timeout, 100k statements, 16MB memory) via a SandboxedJintEngine factory used by the DI registration. Hostile/runaway expressions now fail their evaluation (Executable converts engine exceptions to Failure results) instead of blocking silo threads. Four pinning tests: infinite loop, statement bomb, memory bomb, and an ordinary expression passing through the sandboxed engine. Provenance note: this was briefed into the .NET 10 migration but never actually implemented - the claim propagated unverified until the wiki as-built sync agent checked the code and flagged it. Partial delivery of work item #24 (the budgets); the pluggable IExpressionEngine remains M-EXPR scope. 248/248 tests green. Related work items: #24

… develop

## Summary - `TimerTickJob.cs` logged `"{ElementType} [{PlanItemDefinition}] {ElementScope}.{ElementInstanceId} | timer tick occurred"` with zero arguments supplied for the 4 named placeholders (CA2017). - This is the same defect class that silently killed CMMN repetition spawning in #19 (Bug #62): eager message-template renderers (MEL `FormattedLogValues` via `String.Format` - console logger, `Orleans.TestingHost` file logger) throw `FormatException` on the mismatch, MEL rethrows as `AggregateException`, and a faulted context (here, the Quartz job execution context) can swallow it or fail the tick silently. - Fixed by supplying `ElementType`, `PlanItemDefinition`, and `ElementScope` from the job's `JobDataMap` (the same map `TimerEventSchedulerGrain`/`TimerEventListenerBehavior.Host.Context` populates with those exact keys), alongside the already-read `elementInstanceId`. ## Test plan - [x] `dotnet build src/CaseFlow.sln -c Release` - CA2017 warning for this file is gone, 0 errors. - [x] `dotnet test` on `TimerEventSchedulerGrainTests` (exercises `TimerTickJob.Execute` through Orleans.TestingHost's eager file logger) - passes. Diff is scoped to the single log statement; the two pre-existing CS0618 `DirtyFlagMap.Get` obsolete warnings in the same file were left untouched per scope.

…#69) ## Summary ADO #69. Once a Case reaches the terminal **Closed** state (§8.4.1 / Table 8.5: "no new activity is allowed in the Case"), its case file must become read-only. `CaseFileItemGrain` had no such guard, so `Create`, `Update`/`Replace`, `AddChild`/`RemoveChild`, `AddReference`/`RemoveReference`, and `Delete` all stayed mutable after Close. ## Fix - Added `EnsureCaseNotClosed`, invoked from `Create` (Table 8.2 lists create as a transition) and from `EnsureAvailable` (the existing chokepoint every other mutator already routes through). Throws `InvalidOperationException` mirroring `CaseGrain.Trigger`'s existing Closed guard — same exception type and "is Closed" wording. - `EnsureAvailable` became `async`; all 6 call sites updated to `await` (blast radius confirmed via GitNexus impact analysis: MEDIUM, all 6 callers in-file). - Owning `ICaseGrain` is resolved via `ICaseDefinitionGrain → CasePlanModel.Id` (the addressing convention existing callers use), cached per-activation. ## Design note The guard is intentionally tolerant: if the owning case is undefined or not yet instantiated, it no-ops rather than throwing. This preserves the documented standalone-CaseFileItem usage (work item #16) — a CaseFileItem used without a fully modeled Case has no Closed state to lock against. The guard fires only for a defined, instantiated, Closed case. Scoped to **Closed only** (not Completed/Terminated, which are re-activatable), matching the mirrored precedent. ## Tests - `Update__Given_OwningCaseClosed__Then_ThrowInvalidOperationException` - `Create__Given_OwningCaseClosed__Then_ThrowInvalidOperationException` Pre-fix: both red (mutation succeeded, no throw). Post-fix full suite green: Flow.Grains.Tests 286/286, Integration 118 passed / 11 pre-existing skips (Azurite + KnownGapScenarios). Release build: 0 errors. Related work items: #69

…lifecycle cascades deliver (#63) ## Summary (P1 — ADO #63) Parent→child lifecycle cascades (suspend/resume/exit/terminate propagation from a Case/Stage to its children) never delivered. Root cause: the **subscribe side was mis-keyed**. Grains always PUBLISH transitions on their **definition id** (`CmmnElementGrain.PublishEvent` → `GetCaseEventStream(Definition.Id)`), but the parent→child subscription in `BaseBehavior.Activate` keyed on the parent's **instance id** (`Host.ParentInstanceId`, freshly minted per child) — so the stream identities never matched. The design is deliberately definition-id-keyed + instance-id **payload** filtering (all four `HandleParentTransitioned` guard `@event.SourceInstanceId != Host.ParentInstanceId`), which is only coherent if the stream carries the parent *definition*'s transitions. ## Fix - **Core:** `BaseBehavior.Activate` now subscribes on `Host.ParentDefinitionId` (publish unchanged — child→parent and sentry criteria require definition-id publish). The instance-id payload guard is untouched, preserving instance isolation. - **Root guard:** the CasePlanModel root has no parent → subscription skipped when `ParentDefinitionId` is null/empty. - **Plumbing:** new `IBehaviorHost.ParentDefinitionId`, implemented by `PlanItemGrain` (from persisted state) and `CaseGrain` (null). Threaded from `StageBehavior.CreateChild` (`Host.DefinitionId`) through `DefineRepetition`, and persisted via a new field on the `Defined` event + `PlanItemStore` so a reactivated grain's Resume re-arms the subscription. (Orleans-serialized schema addition — ephemeral in tests; note for durable deployments.) - **D8 reactivate carve-out (folded in):** the CasePlanModel leaves Suspended via `Reactivate`, not `Resume`, so a cascaded-suspended child never saw a recognized transition. Added a `Reactivate` case to all four `HandleParentTransitioned` switches, folded into the existing `ParentResume` arm — naturally no-ops via `StateMachine.CanFire` for children not cascaded into Suspended. ## Tests — all 5 previously-quarantined conformance scenarios un-quarantined and green `StageSuspend`, `StageExit`, `CaseSuspend`, `CaseTerminate`, `CaseReactivate` (`KnownGapScenarios.cs` — `[Fact(Skip=…)]` → `[Fact]`). Pre-fix `StageSuspend` red (task still Active after 10s — exact FINDING-1 symptom); post-fix all green. - Unit: 286/286. Integration: 123 passed / 6 skipped (3 Azurite-infra + 3 out-of-scope: #68 D4-remainder, #64 auto-start, #65 nested-definition) / 0 failed. Release build: 0 errors. ## Scope Does NOT touch #64 (auto-start off-activation-context) or #65 (definition-index instance-vs-definition) — adjacent but separate subsystems, confirmed independent. #62 was already fixed separately (log-template defect) and is unaffected. Related work items: #63

…on-scoped lookup (#65) ## Summary (ADO #65) Plan-item definitions declared **inside a nested `<stage>`** were unresolvable at runtime — only casePlanModel-root declarations resolved. Root cause (same instance-vs-definition family as #63, but a separate subsystem — the definition index): `CaseDefinitionGrain.DefinitionIndex` is keyed on **definition-id** paths (`CPM.StageA.TaskA`, built by `CreateStageDefinitions`), but `PlanItemGrain.DefineRepetition` looked it up with the runtime **instance-id** `_scope` (freshly-minted child GUIDs). Root-level worked only by coincidence (the CaseGrain's address happens to carry the casePlanModel's definition id). Nested lookups threw `InvalidOperationException: definition <X> not registered`. ## Fix Threaded a definition-scoped path end-to-end, mirroring #63's `ParentDefinitionId` pattern: - New `IBehaviorHost.DefinitionScope` — the full **definition-id** chain from root through this host. - `CaseGrain.DefinitionScope => Definition?.CasePlanModel?.Id` (the index is rooted at the casePlanModel's own id — **not** the Case's id). - `PlanItemGrain.DefinitionScope => ParentDefinitionScope + "." + PlanItemDefinition?.Id` — uses the **resolved CMMN definition's** id (e.g. `StageA`), **not** `Definition?.Id` (the `<planItem>` element id `PlanItemStageA`, a different id namespace used for stream keying). Matches `DefinitionGraphNode.Address` composition exactly. - `DefineRepetition` now searches with `parentDefinitionScope ?? _scope`, threaded from `StageBehavior.CreateChild` (`Host.DefinitionScope`), persisted via `PlanItemStore`/`Defined`. The bare 2-arg `Define()` overload passes null → falls back to legacy instance-scope (root-only) resolution, preserving existing test-scaffolding behavior. ## Tests - Un-quarantined `NestedDeclaration__Given_DefinitionDeclaredInsideNestedStage__Then_NestedChildInstantiates` (`[Fact(Skip=…)]` → `[Fact]`). Verified RED first (`definition TaskA not registered`), GREEN after. - Corrected that scenario's assertion `Active` → **`Enabled`**: nested TaskA declares no ManualActivationRule, so Table 5.51's default (TRUE) leaves it waiting `Enabled` for a Case worker's ManualStart — same reasoning a sibling pinned Lifecycle scenario already applies. Reaching that state at all proves the nested definition resolved (pre-fix it threw before the state existed). - Full suite: build 0 errors; 415 total, 410 passed, 5 skipped (3 Azurite-infra + #68 D4-remainder + #64 auto-start), 0 failed. All #63 cascade scenarios stayed green. COVERAGE.md FINDING-3 → fixed. ## Scope Independent of #63 (separate subsystem) and does not touch #64/#66/#68. Related work items: #65

… Stage/Task Start (#64) ## Summary (ADO #64) An auto-start Stage (FALSE `ManualActivationRule`) crashed the engine with `InvalidOperationException: Activation access violation` — no children instantiated. Root cause is a Stateless-vs-Orleans context mismatch: - `PlanItemStateMachine` runs Stateless in `FiringMode.Queued` (its default), so `EnableOrStart` firing `Start` **reentrantly** from inside the in-flight `Create` transition enqueues `Start` and drains it later within the same `FireAsync(Create)` call — by design. - But Stateless's `RetainSynchronizationContext` flag defaults to **false**, so every internal `await` in its queued-firing path uses `ConfigureAwait(false)`. Orleans grain code has no ambient `SynchronizationContext`; it relies on `TaskScheduler.Current` (the activation's scheduler) being captured across awaits. `ConfigureAwait(false)` opts out — so once any real async step suspends (ConfirmEvents, stream subscriptions, the `ManualActivationRule` expression call), the queued `Start` trigger's entry action (`HandleEnterActiveFromStart` → `CreateChild` → `Host.GrainFactory`) resumes on a ThreadPool thread, off the activation context → the violation. - The manual-start route never hit this: its entry action runs synchronously in the original outer `FireAsync`, nothing having suspended yet. ## Fix (one line) `PlanItemStateMachine` sets `RetainSynchronizationContext = true` — Stateless's own documented escape hatch. Every internal Stateless `await` becomes `ConfigureAwait(true)`, so its continuations recapture `TaskScheduler.Current` and stay on the activation context, exactly like the rest of the codebase (which never uses `ConfigureAwait(false)`). **Why safe:** changes *where* continuations resume, not *when* `Start` fires or *what* fires it. The reentrant `Start` is still enqueued and drained in the same `FireAsync(Create)` call on the same grain turn — no new grain-to-grain call, timer, reminder, or fire-and-forget; nothing blocks on `.Result`/`.Wait()` (no deadlock); Stateless's queue is bounded by the finite triggers fired (no new reentrancy). Verified against the Stateless 5.20.1 source. Applies to every plan-item state machine, so it also forecloses this whole class of reentrant-queued-trigger off-context bugs. ## Tests - Un-quarantined `StageAutoStart__Given_ManualActivationRuleFalse__Then_StageActivatesAndInstantiatesChild` (`[Fact(Skip=…)]` → `[Fact]`) — **assertions unchanged**; the sample `.cmmn` change is comment-only (model untouched). Pre-fix RED: the exact `Activation access violation` stack via `CreateChild`. Post-fix GREEN (928ms). - Full suite: build 0 errors; unit 286/286; integration 129 total, 125 passed, 4 skipped (3 Azurite-infra + #68 D4-remainder), 0 failed. #63 cascade + #65 nested-declaration scenarios stay green. COVERAGE.md FINDING-2 → fixed. ## Scope Isolated to `PlanItemStateMachine` — does not touch StageBehavior/#68 or the other tail bugs. Related work items: #64

…te branches (#68) ## Summary (ADO #68 — D4 residual) The `UserCompletable` determination in `StageBehavior.HandleChildTransitioned` conflated CMMN Table 8.12's two distinct completion branches. Two defects in the raise condition: 1. It **ignored `PlanItemDefinition.AutoComplete`** — so an autoComplete=TRUE Stage (which has *no* Manual Completion branch in Table 8.12; it simply auto-completes) still latched `UserCompletable=true`. 2. It required **all** children non-Active, not just required children — so an autoComplete=FALSE Stage with a lingering **non-required** Active child never latched, even though the actual `Trigger(Complete)` enforcement gate (`ManualCompletionCriteriaSatisfied`, fixed in !26/#19) already permits manual completion in exactly that case. ## Fix Gate the raise on `!PlanItemDefinition.AutoComplete` and drop the `all-children-non-Active` conjunct. `UserCompletable` now mirrors `ManualCompletionCriteriaSatisfied`'s autoComplete=FALSE arm — TRUE only where a human may legitimately invoke Manual Completion (all **required** children terminal/semi-terminal; non-required Active children don't block it). ## Tests - Un-quarantined `StageCompletion__Given_AutoCompleteFalseAndNonRequiredChildActive__Then_ManualCompletionBecomesAvailable` (`[Fact(Skip=…)]` → `[Fact]`). RED pre-fix (`UserCompletable` stayed false), GREEN post-fix. - Corrected one existing unit test that was itself pinning the bug: for an autoComplete=TRUE stage it asserted `UserCompletableCriteriaMet` fires `Times.Once` → now `Times.Never`. **Its primary assertions are unchanged** (`AutoCompleteCriteriaMet` Once, `FireAsync(Complete)` Once) — only the incorrect secondary assertion flipped. - Added a focused unit test covering the exact fixed branch (autoComplete=FALSE, required child terminal, non-required child still Active → UserCompletable latches; no auto-complete). - Full suite: build 0 errors; unit 287/287; integration 129 total, 126 passed, 3 skipped (Azurite-infra only), 0 failed. **Conformance suite now 33/33 green, 0 quarantined** — this was the last quarantined scenario. #63/#64/#65 scenarios stay green. COVERAGE.md D4/#68 → Pinned. ## Scope Isolated to the ordinary-Stage completion gate. The Case root (`CasePlanModelBehavior`) follows Table 8.6 via its own `ManualCompletionCriteriaSatisfied` override and is deliberately left untouched (noted as a possible follow-up if Case-root `UserCompletable` semantics ever come up). Related work items: #68

…sion event (#61) ## Summary (ADO #61 — audit) Audited event-confirmation ordering across every state-machine ENTRY action in the behaviors. Mechanism (per the existing "#61 discipline" in `TryRepeatOnCompleteOrTerminate`): Stateless raises-and-confirms the `Transitioned` event in `HandleTransitioned` *before* the destination state's entry actions run, so an event a state entry action raises has no later confirm to ride on — it sits in `TentativeState` indefinitely unless the entry action confirms it itself. ## Audit result — one genuine gap Every entry action was enumerated and classified (raises events? / confirmed?). All were already safe **except one**: - **`TimerEventListenerBehavior.HandleEnterAvailableFromCreate`** raises `TimerExpressionEvaluated` (via `EvaluateTimerExpression`) with no confirm of its own. Unlike Stage/Task/Milestone's `HandleEnterAvailableFromCreate` (whose `EvaluateRequiredRule` confirms, then a following `FireAsync` flushes anything after), the EventListener shape (`ConfigureForMilestoneOrEventListener`) defines **no `Fault` permit at all**, so the Fault path it implicitly relied on can never fire — the raise was stranded in `TentativeState` on every TimerEventListener creation. Already-safe (not changed): `BaseBehavior.HandleEnterTerminal` (no raise), `TryRepeatOnCompleteOrTerminate` (own confirm), Stage/Task/Milestone `HandleEnterAvailableFromCreate` (`EvaluateRequiredRule` confirm + following FireAsync), `HandleEnterActiveFromStart` (own trailing confirm), `TaskBehavior.HandleEnterActive`/`TimerEventListenerBehavior.HandleTerminated` (no raise). The post-#66 addition `CasePlanModelBehavior.HandleEnterActiveFromCreate` (not visible on this branch's base) only arms a subscription and raises nothing — verified during review, no confirm needed. ## Fix `TimerEventListenerBehavior.HandleEnterAvailableFromCreate` now `await Host.ConfirmEvents()` immediately after `EvaluateTimerExpression()`, mirroring the `#61 discipline` idiom, with a comment on why (no Fault permit for this shape). ## Test New `TimerEventListenerBehaviorTests.Trigger__Given_TimerExpression__When_Create__Then_TimerExpressionEvaluatedConfirmedAfterRaise` — asserts (via a call-order log) that a `ConfirmEvents()` happens **after** the `TimerExpressionEvaluated` raise specifically. (A naive `Times.AtLeastOnce` assertion was insufficient — it passes even unfixed, because `HandleTransitioned` always confirms the `Transitioned` event before the entry action runs — so the test checks ordering.) RED on unfixed code, GREEN after. Full suite: build 0 errors; unit 288/288; integration 126 passed / 3 skipped (Azurite-infra) / 0 failed; conformance 33/33. ## Follow-up (out of scope, flagged) `TimerEventListenerBehavior.HandleStartTriggerOccurred` raises `TimerStartTriggerOccurred` with no confirm — same bug class, but reached via a stream-subscription handler, not a state-machine entry action (#61's scope is entry-action raises). Worth a follow-up look. Related work items: #61

…suite on Docker (#60) Implements #60. Replaces the manual/compose-managed Azurite dependency in the integration tests with Testcontainers.Azurite so the restart-survival suite self-provisions a throwaway Azurite container per run (random host port — no clash with a local Azurite on 10000-10002, no manual `docker compose`). ## What changed - **AzuriteClusterFixture** owns the Azurite container lifecycle (Testcontainers.Azurite 4.13.0) and threads its **dynamic** connection string into the TestCluster and the blob assertions; per-run GUID blob container retained. - **Removed the AzuriteProbe / AzuriteFact** TCP + api-version probe layer (superseded). Replaced with a lean, process-cached **Docker-availability gate** (`DockerAvailability` + `RequiresDockerFact`) that **skips (never fails)** when Docker is absent — preserving the "never fail a machine without Docker" constraint. The shared-decision invariant (gate and fixture consult one cached result, the PR !16 fail-open lesson) is kept. - The **3 previously-skipped Storage tests** now execute wherever Docker is present (the only skips in the suite). - **CI**: dropped the *Start Azurite* / *Wait for Azurite* steps — Testcontainers owns lifecycle + readiness on `ubuntu-latest`. - Compose stack (`devops/infrastructure`) **unchanged** — it serves the F5 silo, not the tests. ## Validation status — please read before completing - Local `dotnet build`: **green** (0 warnings, 0 errors). - Local **test run could not validate the un-skip**: the dev machine's Docker daemon was unresponsive at build time, so the suite would *skip* rather than execute locally. **CI on `ubuntu-latest` (real Docker) is the runtime gate** for the 3 un-skipped tests — the one thing still unproven is the `--skipApiVersionCheck` command composition against the Testcontainers Azurite module. Confirm the PR build runs the 3 tests **green** before completing. Auto-complete intentionally left off. Related work items: #60

…ership + durable reminders (#30, core) Implements the **clustering core** of #30 — the host-agnostic foundation that lets Case.Flow run as a real multi-silo cluster (docker-compose next, cloud host is a deferred #34 decision). Scope is deliberately clustering-only; Docker/compose, the REST slice, and the Quartz→Reminders timer redesign are separate follow-on units. ## What it does - **`ConfigureDeployedOrleans`** (was a `NotImplementedException`): real cluster membership via **`UseAzureStorageClustering`** (Azure Table) + durable **`UseAzureTableReminderService`** — both resolving a DI `TableServiceClient` from a new `Azure:Clustering` config section that uses the same connectionString / serviceUri+credential shape convention as `Azure:Storage`. One storage account backs clustering + reminders + grain/journal storage (the "all Azure Storage internal plane" decision). - **Behavior-preserving hoist**: shared provider wiring (blob journal storage, PubSubStore, memory streams, fallback serializer) extracted into `ConfigureSharedOrleansProviders`, called by both environments. Development is byte-for-byte unchanged (`UseLocalhostClustering` + in-memory reminders). - **Container-aware endpoints**: deployed silos advertise a reachable address (explicit `Orleans:AdvertisedIPAddress` / `ORLEANS__ADVERTISEDIPADDRESS` env → non-loopback hostname IP → fail-fast) and listen on `0.0.0.0`, replacing Development's hardcoded Loopback. Ports config-overridable, default 11111/30000. ## Validation - `dotnet build` green (0/0). Unit **288 passed / 0 skipped**. Integration **128 passed / 0 skipped** (126 pre-existing + 2 new). - **New real-membership test** (`Clustering/AzureTableClusteringTests`): a 2-silo `TestCluster` with `UseTestClusterMembership = false` (so the real `UseAzureStorageClustering` provider actually forms membership rather than TestCluster's in-memory oracle silently shadowing it), against a Testcontainers-provisioned Azurite **table** endpoint. Asserts `IManagementGrain.GetHosts` reports both silos Active in the real table + a live grain call succeeds. **Executed and passed** on Docker locally; CI (real Docker on ubuntu-latest) is the gate here too. - Orleans-Azure APIs were verified against the decompiled shipped 10.2.1 packages, not guessed. ## Reviewer note — honest scope of validation The clustering **membership** is runtime-validated by the new test. The container **endpoint resolution** is written per Orleans' container guidance and verified against the shipped `EndpointOptions` API, but its real multi-container runtime proof arrives with **#49** (docker-compose N-silo bring-up) — the in-process test necessarily uses Loopback. Nothing here is exercised in a real deployed environment yet; that's the next unit. Auto-complete left off for review. Related work items: #30

…lo Orleans cluster (#49) Turns #30's deployed clustering config into a **real multi-container Orleans cluster** you can bring up locally and curl. This is the "runs for real" milestone — separate silo *processes* in separate containers forming a cluster over Azure Table membership (Azurite), no cloud host required. ## What it adds - **`src/Flow.Silo/Dockerfile`** — multi-stage (`sdk:10.0`→`aspnet:10.0`), repo-root build context (ProjectReferences), layer-cached restore, non-root `$APP_UID`, `curl` healthcheck on `/health`, `-p:EnableSourceControlManagerQueries=false` (no `.git` in the build context). - **`devops/eval/docker-compose.yml`** (new; the F5 `devops/infrastructure` stack is untouched) — Azurite + **3 silo containers** running the deployed config (`DOTNET/ASPNETCORE_ENVIRONMENT=Docker`), with **explicit Azurite-hostname connection strings** for clustering + storage (the container-networking crux: `UseDevelopmentStorage=true` resolves to 127.0.0.1, wrong across containers). Web ports 8081-8083; Azurite host ports offset to 10100-10102 to coexist with the F5 stack. - **`Startup.cs`** — replaces "Hello World" with minimal diagnostics: `GET /health` (liveness, backs the healthcheck) and `GET /` + `GET /cluster` (active-silo count via the co-hosted `IManagementGrain.GetHosts`). Tolerant of a not-yet-converged cluster (200 + `error`, never 500). **Not** the case API — that's #32. - `devops/eval/README.md` — bring-up / curl / teardown walkthrough. ## Verification - Solution build green (0/0). Unit **288/288**, integration **128/128** (Docker-backed suites, incl. the #30 clustering test, actually ran). - **Live 3-container proof** (agent ran, code-reviewed by me): `docker compose up` → each of `localhost:8081/8082/8083` `/cluster` independently reports `{"activeSilos":3,...}` with the same 3 silo addresses (172.22.0.3/4/5) — the separate containers found each other via real Azure Table membership in Azurite. ## Notes for review - The compose bring-up is **not CI-gated** (it's a local eval/demo artifact — and doubles as the licensee trial experience). CI validates the build + tests; the live-cluster proof is the `docker compose up` curl above. I'm independently reproducing it before asking you to merge. - One transparent deviation: the original brief's Azurite well-known account key was truncated (my error); the agent root-caused the resulting `FormatException`, substituted the correct 88-char well-known constant, and committed the fix separately (`2d5a6f7`). - Scope: observability endpoint only. Curling an actual **case** into the cluster is #32 (the transport-agnostic operation core → REST + MCP). Auto-complete left off for review. Related work items: #49

…grain engine (#32, Unit 1) **Unit 1** of the #32 API rework (the CQRS + plug-in + OData architecture). Establishes the transport-agnostic CQRS layer that the REST API (Unit 2) and the future MCP server both sit on. No HTTP yet — that's Unit 2. ## What it adds - **`Flow.Application`** — the CQRS/use-case layer over the existing grain domain: - **Native mediator** — `ICommand<T>`/`IQuery<T>` + `ICommandHandler`/`IQueryHandler` + `ISender` (reflection dispatch, DI assembly-scan registration via `AddFlowApplication`). **No MediatR** (it moved to a commercial license — the same reason we dropped AutoMapper in #50). - **Result kernel** — `Result`/`CommandResult<T>`/`QueryResult<T>` + `ResultStatus`. - **Case commands/queries + handlers** — `DeployDefinition`/`CreateCase`/`TriggerCase` + `GetCase`, lifting #39's proven logic (import→define→create→snapshot + the `CaseView` projection), calling grains via injected `IClusterClient` (topology-agnostic). - **`Flow.Contracts`** — versioned **V1** wire DTOs (`CaseView`, `PlanItemView`, request models), zero references. ## Verification - Build 0/0. **Unit 288 / Integration 132** (incl. 4 new CQRS handler tests over the in-memory cluster), **0 skipped** — 420 total. ## Notes worth a look - **Domain = grains.** This is the *application* (orchestration) layer, not a domain layer — the domain is the existing grain engine — hence `Flow.Application`, not `Flow.Domain`. - **Anti-corruption boundary**: domain `PlanItemState` → V1 `PlanItemState` via an explicit `switch` that throws on an unmapped member (not an ordinal cast) — a new domain state fails loudly. - **Bad input → `Result`** (not exceptions): unknown-definition/invalid-transition → `BadRequest`; not-found case → `NotFound`. (#39 threw; the CQRS layer returns typed results the transport maps to HTTP.) - Pinned `Microsoft.Extensions.DependencyInjection.Abstractions` 10.0.5 (Orleans 10.2.1 transitive floor; NU1605). - `Flow.Silo` untouched (host-agnostic). **#39 is superseded by this** — I'll abandon its PR now that its logic is lifted. Unit 2 (`Flow.Api`: ASP.NET Core OData + versioning + the `Add/Use` plug-in wiring; replaces #39's endpoints) comes next. Auto-complete off. Related work items: #32

…thN/Z + per-tenant isolation (#32, #33) **Unit 2 (#32) + #33 land together** — the first HTTP surface ships *with* authentication, tenant isolation, and the enforcement that closes a real cross-tenant hole. Built as 4 sub-units on one branch. ## What's in - **Flow.Api** — ASP.NET Core OData + `/api/v1` versioning + net10 OpenAPI over the Unit-1 CQRS core (`ISender`). Surface: `POST /api/v1/definitions` (raw CMMN XML), `POST /api/v1/cases`, `GET /api/v1/cases({id})` (`$select`/`$expand`), `POST /api/v1/cases({id})/trigger` (bound action). Plug-in `AddFlowApi`/`MapFlowApi` into the co-hosted Silo host. `$filter` collection deferred (needs read model; TODO-marked). - **AuthN/Z (#33)** — JwtBearer single-issuer (Zitadel, config-driven). `IdentityContextMiddleware` resolves the token `sub` → `(tenantId, userId, roles)` via a new **tenant registry** (`IUserIdentityGrain`/`ITenantGrain` persistent-state grains) + `ITenantResolver`, and sets `CaseRequestContext` once at the boundary. Deletes the hardcoded `CaseRequestContextDefaults`. Unauthenticated→401, unprovisioned→403. - **Tenant enforcement** — `CaseGrain` stamps owning `TenantId` at Create; `Trigger`/`GetSnapshot` reject a mismatched tenant with `CrossTenantAccessException` → **404** (foreign case indistinguishable from not-found). Grain-level defense in depth. ## Security proof (headline) `MultiTenantIsolationApiTests` drives the **real** pipeline (auth → middleware → resolver → grain enforcement) over HTTP: tenant B gets **404** on tenant A's case for both `GET` and `trigger`, asserted with non-empty `ProblemDetails` bodies (distinguishes real enforcement from a routing miss). Plus 401 (unauth), 403 (unprovisioned), 400 (cross-tenant definitionId — definitions are key-isolated). ## Tests & deps - **480 tests green, 0 skipped** (288 unit + 152 integration + 40 Flow.Api unit). - **Stable packages only** (no previews): OData 9.4.1, Asp.Versioning.Mvc[.ApiExplorer] 10.0.0, Microsoft.AspNetCore.OpenApi 10.0.9, JwtBearer 10.0.9, Microsoft.OpenApi 2.7.6 (pinned up off advisory GHSA-v5pm-xwqc-g5wc). Asp.Versioning.OData skipped (net10 = rc-only) → EDM hand-composed. All MIT/Apache. ## First Light (docker-compose) Zitadel v2.71.8 + Postgres 16 added to `devops/eval/`; FIRSTINSTANCE bootstrap **live-validated** (migrations/bootstrap/machine-key/healthz). Remaining Zitadel project/API-app/2nd-org/human-user creation **documented as manual steps** in `devops/eval/README.md` (Management-API scripting judged too fiddly to verify blind) + an `eval-authenticated.sh` demo script. ## Bugs caught by the new full-pipeline tests - OData bound action needed `.ReturnsFromEntitySet<CaseView>` (not `.Returns<>`). - Attribute-route combinator inserted a stray `/` (`cases/({key})`) → fixed with `~/` absolute templates. - Orleans `ExceptionCodec` needs `[Serializable]`+ISerializable ctor + a `"Flow"` namespace allow-list to round-trip a custom exception cross-grain. ## Deferred → work items #74 per-tenant SSO federation · #75 hosted/managed Zitadel · #76 t...

…mixed-content, not `body` attribute) (#72) **Bug (#72):** `CmmnXmlSerializer` wrote expression text as a non-schema `body` attribute; OMG CMMN 1.1 `tExpression` is mixed-content (text as element content). 16/26 corpus fixtures failed XSD validation — and the engine couldn't ingest schema-standard CMMN emitted by conforming tools (cmmn-js, Camunda, …). ## Fix (serialization boundary only — `Expression.Body`, the engine's canonical in-memory property, is untouched) - **Tolerant reader:** both the legacy `body="…"` attribute and schema-standard mixed-content element text deserialize (both XmlSerializer mappings retained). `CmmnXmlSerializer.ReconcileExpressionText` syncs `Body`↔`Text` after Import, so `.Body`-reading callers work regardless of source form. - **Schema-valid writer:** `Expression.ShouldSerializeBody() => false` (XmlSerializer's sidecar convention) suppresses the attribute on export only — `Deserialize()` untouched. The inherited `[XmlText] Text` carries the value as mixed content; reconciliation runs before export so `Text` reflects `Body` even for hand-built graphs. - Updated the 15 affected fixtures + the `Discretionary_ItemExcluded.cmmn` planningTable child-ordering, plus 2 bonus `itemControl`/`defaultControl` child-ordering fixes found while validating. ## Verification - **425 tests green, 0 skipped** (293 unit incl. 5 new round-trip/shape tests + 132 integration). - Local XSD validation against the OMG reference schema: **10/27 → 26/27** valid. `RichSample.cmmn` deliberately left on the legacy `body=` form to prove the tolerant reader still accepts it. **No committed test depends on the external schema path** (CI-safe). ## Impact note `gitnexus_impact` flagged `Expression` **CRITICAL** (20 direct callers across 6 modules), but the change only *adds* `ShouldSerializeBody()` — it never touches `Body`/`Text` or any signature those callers use; the full green suite confirms no behavioral change. Interop win: the engine now emits schema-valid CMMN and tolerantly ingests both forms. Bears on #20 (import/export) and the conformance claim (#21/#45). Auto-complete off. Related work items: #72

…ops with a configurable ceiling (#67) CMMN 1.1 §8.6.4 places **no upper bound** on repetition: a non-blocking task with `ManualActivationRule=false`, a constant-TRUE `RepetitionRule`, and no entry criteria spawns instances **forever** — spec-faithful, and a documented modeler foot-gun (#19). This adds the engine ceiling commercial engines layer on top (never a spec deviation — the spec is silent on limits). ## What it does - **`RepetitionGuardOptions.MaxRepetitionsPerPlanItem`** — configurable per-plan-item ceiling, default **10,000** (generous; legitimate models never approach it), bound from an optional `Engine:RepetitionGuard` config section. - **Enforcement at the single choke point** — `StageBehavior.HandleChildRepeated`, where both repetition paths (no-entry-criteria Complete/Terminate re-evaluation, and entry-criterion OnPart re-satisfaction) funnel before spawning a repeated child. At the ceiling: `LogError` (plan-item id + ceiling + attempted index) → raise the journaled **`RepetitionCeilingExceeded`** domain event → drive Fault. - Documented in code as a Case.Flow **ENGINE EXTENSION, not CMMN spec surface** — hitting it is a safety net catching a modeler mistake, never to be cited as a conformance failure. ## ⚠️ One decision for your review On breach it Faults the **containing Stage/CasePlanModel** (→ case `Failed`), *not* the repeating child — because the child is either already terminal (no-entry path) or still legitimately running (OnPart path), neither a legal Fault target in the state machine. So a runaway repetition **fails the whole case, loudly**. If you'd prefer a gentler response (stop spawning + raise the event, leave the case running), it's a one-line change — say the word. ## Verification - **423 tests green, 0 skipped** (290 unit + 133 integration; +2 unit, +1 end-to-end foot-gun test). All existing repetition tests stay green against the generous default. - Foot-gun test: the exact #19 scenario with ceiling=5 → exactly 5 instances (indices 0–4), case reaches `Failed`, no 6th after settle. (Needed a permanently-`Enabled` sentinel sibling so Table 8.12 `autoComplete=FALSE` Branch 1 didn't complete the case before the ceiling engaged — documented in the test.) Auto-complete off. Related work items: #67

… findings B2/B3) Chasing the `Guid.Empty` scheduler-key thread (findings B2/B3) surfaced **three** related defects in the timer subsystem: 1. **`Guid.Empty` scheduler key** — `GrainFactoryExtensions.GetScheduler()` hardcoded `Guid.Empty` as the `ITimerEventSchedulerGrain` key. Dead code (0 call sites, confirmed via grep + `git log --follow`) but a landmine — parameterized by `caseInstanceId`, routed the 3 real call sites through it. 2. **Live bug — leaked Quartz jobs on Terminated:** `TimerEventListenerBehavior.HandleTerminated()` passed `Host.InstanceId` as the 2nd arg of `GetGrain<ITimerEventSchedulerGrain>(guid, string)` — but that overload's 2nd param is `grainClassNamePrefix`, not a key extension (the grain is `IGrainWithGuidKey`). It failed class resolution → NRE → every `TimerEventListener` leaked its Quartz job on Terminated. Fixed to key by case instance id alone. 3. **The real shared-singleton defect (the nasty one):** `ISchedulerFactory` is a process-wide DI singleton with a fixed instance name, so `GetScheduler()` returns the *same* Quartz `IScheduler` for every case's grain. `OnDeactivateAsync` called `_scheduler.Shutdown()` on that shared instance — so **any one case's grain deactivating (idle collection after ~2h, forced collection, redeploy) permanently killed every other case's timers** until the silo restarted (Quartz schedulers can't restart). Fixed: a per-case grain no longer tears down shared infra it doesn't own (deactivation just logs). Each fix is empirically verified — the new tests fail against the pre-fix code (exact predicted NRE / assertion) and pass after. ## Durable timers — assessed & deferred (per the task) Quartz uses `RAMJobStore` (in-memory) in **both** dev and deployed — a silo crash loses every pending timer's schedule (the durable grain state records only `JobKey` identities, not enough to rebuild a trigger). True crash-safety needs a real ADO JobStore (new SQL dep) or persisting+replaying full schedule state into Quartz on activation — a feature, not a wiring fix. Documented, deferred. (Corroborates the #73 memo's Quartz/Reminders durability finding.) ## Verification Fix builds clean; new unit + integration regression tests added. **Full-suite green confirmed via CI** (the agent's local run reported the integration project's 133; the unit test was verified pre/post independently). `gitnexus_impact` flagged `TimerEventListenerBehavior` HIGH (central class), but the changes only correct grain-lookup arguments — public shape/constructor/flow unchanged. Auto-complete off. Related work items: #31

…ty decision memo (docs) **Spike #73 — research memo, docs only, no code.** `docs/08-orleans-provider-evaluation.md`: should Case.Flow diverge from the Azure-Storage-everywhere internal-plane default for any subsystem? ## Verdict: harden the "one Azure Storage account" default — nothing clears the bar to switch - **Clustering** — keep Azure Table. Membership writes serialize through a single version-row regardless of backend (proven to ~200 silos per MS docs) → it's *silo-count*-bound, not grain-count-bound; Case.Flow's scale never approaches it. - **Grain storage** — keep Azure Blob (blob-per-grain rides the ~20–40k req/s *account* ceiling, not a per-partition one). ADO.NET/SQL is the one genuinely open question — gated on whether M2's API needs **cross-grain queries/transactions**, not on throughput. - **Reminders** — keep Azure Table; but the bigger open question is Orleans Reminders vs. durable Quartz (the hard 1-min reminder floor needs validating against real CMMN timer models). *(Ties directly to #31.)* - **Streams** — Azure Queue Storage. ## Notable finding (grounded in code, corrects the brief's premise) **Streams + PubSubStore are in-memory *today*** (`AddMemoryStreams` / `AddMemoryGrainStorage("PubSubStore")`), not the durable Table/Blob/Queue the brief assumed — a known correctness gap already flagged in docs/06 (fire-and-forget delivery → a deactivated sentry silently misses events). So §5.4 is "what replaces memory streams," not a swap between durable options. ## Quality Every claim tagged **[E]** (evidence-backed, linked to MS Learn / Orleans / Redis) or **[R]** (reasoned, no benchmark). §7 designs a Testcontainers benchmark harness (extends #60's pattern — `MsSql`/`Redis` sibling fixtures + a #35-shaped 10k-case workload driver) to validate empirically later — explicitly **not run** (no infra). §8 evidence ledger + §9 open questions. Docs-only decision memo feeding #30/#35 — merging just adds the ADR-style record to the repo. Auto-complete off. Related work items: #73

Stamp the acting identity on every journaled lifecycle event, **before real history accumulates** (the schema retrofit is wire-safe; the data gap wouldn't be). Prerequisite for #58 (case-file history). Actor now flows from the authenticated token (via #41's `IdentityContextMiddleware` → `CaseRequestContext`). ## What it adds - **Composite actor** (`ActorPrincipalId` Guid, `ActorPrincipalType` User|Client, `ActorOnBehalfOf` string?) on every journaled event, via a new `IActorStampedEvent` interface. - **`CaseRequestContext`** gains `ActorPrincipalType` (default User) + `ActorOnBehalfOf` (default null); `IdentityContextMiddleware` sets them (User/null — no S2S path yet). ## Two design calls worth noting 1. **Interface, not a new shared base class.** The event model has no common ancestor — `BaseCreated`/`BaseUpdate` (+subtypes), plus ~10 CaseFileItem/Sentry events that predate `BaseUpdate` and inline their own `Updated`. Inserting a base class *under an already-persistable Orleans type changes its wire shape* (a replay hazard), so each type implements `IActorStampedEvent` directly and adds the 3 fields at its own next-free `[Id(n)]` — purely additive → replay-safe. 2. **Central stamping via a shadowed `RaiseEvent`.** `CmmnElementGrain<,>.RaiseEvent` shadows (Orleans's is non-virtual — can't override) the base and calls `ActorStamping.Apply` first — one append point for all 6 grains in that hierarchy + every behavior's `IBehaviorHost.RaiseEvent`. `CaseDefinitionGrain` (the other JournaledGrain root) calls the same helper explicitly. **Reviewer note:** because it's `new` (shadow) not `override`, a future call through a `JournaledGrain`-typed base reference would bypass stamping — all current call sites resolve to the shadow, and tests prove it. ## Two bugs found + fixed - A custom enum boxed into Orleans `RequestContext`'s object slot **didn't survive client→silo propagation** (Guid/string do) — `ActorPrincipalType` is stored via its underlying `int`. (Failing test → fix.) - `CaseRequestContext.UserId` throws when unset (by #33 design), but `RaiseEvent` is also reached by **no-identity flows** (timer ticks, reactivation cascades) — `ActorStamping` defaults to `Guid.Empty` there rather than faulting normal operation. ## Verification - **500 tests green, 0 skipped** (+10: 4 unit, 4 e2e, 2 replay-safety). The replay-safety test reconstructs the exact pre-#59 wire shape via stand-in types and proves both patterns deserialize cleanly with defaults (`Guid.Empty`/`User`/`null`). - Added a minimal `GetJournaledEvents()` read-back to `ICmmnElementGrain` so tests can observe the real persisted journal (TestCluster exposes only the public interface) — flagged as a raw seam, not #58's eventual design. `gitnexus_impact`: `BaseCreated`/`BaseUpdate` CRITICAL (34 / 128 impacted) — the expected structural blast radius; ran post-hoc (process note: per CLAUDE.md it should precede edits). `TODO #56/#57` left for envelope attribution. Auto-complete off. Related wo...

… + as-of reads (#58) Engine extension (not a CMMN spec feature): exposes the already-durable event journal every CaseFileItem Update/Replace writes as a curated version-history surface, rather than storing anything new. Unblocked by #59 (actor stamping, merged yesterday). Prerequisite delivered for the financial-audit "immutable versioned evidence with who/when" differentiator. ## Grain surface - `ICaseFileItemGrain.GetHistory()` -> ordered `CaseFileItemVersionDescriptor` { version, updatedUtc, composite actor, transition }, one per value-carrying event. - `ICaseFileItemGrain.GetValueAt(version)` -> as-of value read; accepts any journal index 1..current and replays forward. - Both via `JournaledGrain.RetrieveConfirmedEvents`. Version = 1-based journal sequence number. ## Design calls - `ValueChanged` gains a nullable `Transition` field (additive `[Id(5)]`): Create/Update/Replace all raise the identical `ValueChanged` type, so without it a replayed journal can't tell Update from Replace. Nullable -> pre-#58 events default to null ("not recorded"), never a misleading zero-value member. Proven replay-safe against the exact pre-#58 wire shape (same pattern as #59's actor-field tests). - The raw `GetJournaledEvents` seam #59 added is left untouched — it serves every CmmnElementGrain subtype's tests; the new curated surface is added alongside it (the "richer equivalent" that seam's remarks anticipated). - `CaseFileItemSnapshot` gains `UpdatedUtc` (`[Id(3)]`, mapped) + `CurrentVersion` (`[Id(4)]`, stamped by the grain after mapping — a JournaledGrain-level concept the pure mapper can't see). - Application/API follow the existing CQRS/native-mediator + controller conventions exactly (query+handler pair per read, V1 DTOs mirroring domain enums, two new GET actions on CasesController). ## Tenancy History/as-of reads honor the same tenant isolation as current-value reads: a CaseFileItem grain carries no TenantId of its own (case-scoped), so `CaseFileItemAccess` resolves the owning `ICaseGrain` and delegates to its `GetSnapshot()` guard — a foreign-tenant history read fails identically (404) to a foreign-tenant case read. Proven by new MultiTenantIsolationApiTests cases. ## Impact + verification - gitnexus impact (upstream): CaseFileItemGrain LOW, ICaseFileItemGrain LOW, CaseFileItemSnapshot LOW, ValueChanged MEDIUM (13 — every construct/read site, expected for an additive field). No HIGH/CRITICAL. - Tests: 500 -> 518 (44 Flow.Api.Tests + 300 Flow.Grains.Tests + 174 Flow.Grains.Tests.Integration), 0 failed, 0 skipped. ## Out of scope - CaseFileItem instances still created directly against their grain rather than from a caseFileModel definition graph (pre-existing). - No MCP-facing exposure yet (Flow.Api only, per work item scope). Auto-complete intentionally left off. Related work items: #58

…bound Jint recursion (#79, #86) Two small, well-scoped engine-hardening fixes from the 2026-07-14 backlog grooming. ## #79 — timer start-trigger event never confirmed `TimerEventListenerBehavior.HandleStartTriggerOccurred` raised `TimerStartTriggerOccurred` without confirming it. As a stream-subscription handler it runs outside any state-machine transition, so nothing downstream flushed the raise — it sat queued in TentativeState and was lost if the grain deactivated first (a journal-consistency defect; the durable timer itself was still scheduled). Fix: the same explicit `await Host.ConfirmEvents()` the sibling entry-action path already uses (#61). ## #86 — Jint recursion could crash the silo `SandboxedJintEngine` had timeout/statement/memory budgets but no recursion limit, so deep model-authored recursion could overflow the CLR stack with an **uncatchable `StackOverflowException`** — defeating every other sandbox budget (all of which rely on throwing a *catchable* exception). Fix: `LimitRecursion(64)` so Jint throws a catchable `RecursionDepthOverflowException` before the real stack is at risk, and pin `Interop.Enabled = false` explicitly so a future Jint upgrade can't silently open a CLR-interop path. ## Verification Full build green. Full suite (per-project): Flow.Api.Tests 44/44, Flow.Grains.Tests 303/303, Flow.Grains.Tests.Integration 169 passed / 5 skipped (pre-existing Azurite/emulator) / 0 failed. **Total 516 passed, 0 failed, 5 skipped (521 = ~518 baseline + 3 new tests).** Tests added: a confirm-ordering test capturing the subscription callback and asserting `Confirm` follows the raise; two Jint tests (self-recursive script throws `RecursionDepthOverflowException`, and yields a `Failure` result through `Executable.ExecuteAsBool`). Note: `RepetitionGuardFootgunIntegrationTests` (a 15s live-cluster polling test) can intermittently flake under concurrent full-solution runs — verified pre-existing against clean develop, untouched by this diff; consistently green run standalone. Auto-complete intentionally left off. Related work items: #79, #86

…verage (#85, #87) Conformance-suite housekeeping from the 2026-07-14 backlog grooming. Doc + test only — no production code touched. ## #85 — COVERAGE.md was contradicting itself The doc predated the fix-tail and still narrated FINDING-1 (parent→child propagation) as an open, unfiled gap with six scenario rows marked `KnownGap:FINDING-1` — while `KnownGapScenarios.cs` had zero `Skip`ped facts (all fixed by #63's definition-id-keyed subscription) and the journal claimed "green". Verified against real git history (PRs #63/#64/#65/#66/#68/#69) and a live conformance run: - Retired FINDING-1 → `Pinned (#63)` on the findings table and all six dependent rows. - Added the missing CasePlanModel exit-criteria row (#66); flipped Closed-lockdown to `Pinned (#69)`. - Corrected stale counts (was "18 sample files" → real **26**; **35 scenarios, 35/35 green, 0 skipped**). - Added a "Current state" paragraph as the single source of truth so it can't silently drift again. ## #87 — multi-criteria (OR-of-sentries) coverage `Samples/Sentry_MultipleEntryCriteria.cmmn`: a Milestone with two independent single-OnPart entry criteria. New scenario `Sentry__Given_TwoEntryCriteria__Then_EitherAloneSatisfiesEntry` drives only the second criterion and asserts the milestone occurs — proving Table 8.11's "one of the achieving Sentries" OR semantics (previously untested; orphaned when #19 closed). ## Cleanup Deleted a stale, false comment in `CaseFileItemSentryIntegrationTests.cs` claiming `CasePlanModelBehavior` is an empty `// TODO!` stub and that `ICaseGrain.Create` never instantiates children — both false (135-line behavior; the whole suite drives Create end-to-end). Comment-only; no behavior change. ## Verification Full solution: **519 tests, 514 passed, 5 skipped** (pre-existing Azurite/emulator skips, unrelated), **0 failed**. Conformance 35/35, 0 skipped (was 33 pre-#87). Auto-complete intentionally left off. Related work items: #85, #87

…d not set' on stream/reminder activation (#130) **Fixes the intermittently-red trunk.** Root-caused from CI build 114: `StreamSemanticsTests.DeactivateThenReactivate` failed with `InvalidOperationException: RequestContext TenantId not set` thrown from `CaseRequestContext.get_TenantId` → `CmmnElementGrain.OnActivateAsync` → `SentryGrain.OnActivateAsync`. ## Root cause `CmmnElementGrain.OnActivateAsync` enriched its **log context** by reading the enforcement-grade `CaseRequestContext.TenantId`/`UserId` getters, which **throw** when there's no ambient RequestContext. A grain reactivated by a **background stream delivery or reminder** (not a caller-initiated request) has no RequestContext to propagate — so activation threw and aborted, dropping the pending stream message. Intermittent because deactivation/reactivation timing is racy (which is why build 113 passed and 112/114 failed on identical code). Pre-existing from the #33 tenancy work (PR 41) — **not** PR 48 or PR 49. Directly undermines the durable-streams / deactivated-sentry reliability tracked in #108. ## Fix (minimal, enforcement-preserving) - Added non-throwing `CaseRequestContext.TenantIdOrNull` / `UserIdOrNull`, with a comment stating they are **not** for enforcement boundaries. - `OnActivateAsync`'s log-context assignments use the `…OrNull` variants. - The throwing `TenantId`/`UserId` properties — which back `CrossTenantAccessException` enforcement at request-handling methods — are **untouched**. Tenant isolation is unchanged. ## Verification - `DeactivateThenReactivate…` run **10/10 green** (was intermittently failing) — no longer flakes. - Tenant isolation intact: `MultiTenantIsolationApiTests` + `CaseTenantIsolationIntegrationTests` **14/14**. - Full suite: **517 passed, 5 skipped** (pre-existing Azurite), **0 failed**. **Merge this first** — it greens develop for the other in-flight PRs. Auto-complete off. Related work items: #130

…erTickJob (#80) Clears the five CS0618 obsolete-API warnings in `TimerTickJob.cs` (left untouched by PR 28 per its scope). Replaces each `DirtyFlagMap<string,object>.Get(key)` call with the indexer `[key]` — identical behavior. **Verification:** CS0618 warnings 5 → 0 (forced full rebuild, before/after). Full suite: 517 passed, 5 skipped (pre-existing Azurite), 0 failed. Auto-complete off. Related work items: #80

…83) `ChildCreated.PlanItemDefinitionId` actually carries the child PlanItem's **own** id (the `<planItem>` element id, from `StageBehavior.CreateChild`'s `child.Id`), **not** a plan-item *definition* id (that's `PlanItem.DefinitionRef`). The misleading name invites the exact definition-vs-instance id confusion behind #63/#65. Renamed to **`PlanItemId`** (matching the sibling `PlanItemInstanceId` convention on the same event) across all 12 read/write/doc sites, with a corrective doc comment on the field. **Wire-compat preserved:** `[Id(0)]` is unchanged — only the C# property name changed, so journaled/serialized events replay identically. **Verification:** build 0 errors; full suite 0 failed (Flow.Api 44/44, Grains 303/303, Integration 170 passed / 5 pre-existing Azurite skips). **Follow-up flagged (not in scope):** `RepetitionCeilingExceeded.RepeatingPlanItemDefinitionId` has the identical misnaming (also from `child.Id`) — noted for a separate task. Auto-complete off. Related work items: #83

…parameterized Exit trigger (#82) `SentryGrain.HandlePlanItemTransitioned` matched `x.ExitCriterionRef == @event.ExitCriterionRef`, but the sole production construction site (`BaseBehavior.HandleTransitioned`) never supplied a non-null value — so any PlanItemOnPart naming a specific `exitCriterionRef` could never match (dead branch), and import-lint Rule 4 blocked such models as Unsupported. ## Design Uses Stateless's own parameterized-trigger mechanism (not new plumbing): - `PlanItemStateMachine` registers `PlanItemTransition.Exit` via `SetTriggerParameters<string>` and adds `FireAsync(transition, string)` (throws for any non-Exit trigger — nothing else needs a payload). - `StageBehavior`/`TaskBehavior`'s ExitCriterion branch fires `Exit` carrying the satisfying `ExitCriterion.Id`. **`StageBehavior` only does this when `ExitCriterionTransition == Exit`; `CasePlanModelBehavior` still fires plain `Terminate`** — the #66 terminate-not-exit carve-out is untouched. - `BaseBehavior.HandleTransitioned` reads the payload **null-safely** off `Transition.Parameters` — null for any parameterless fire (e.g. a parent-cascaded Exit from `HandleParentTransitioned`), so the #63 cascade path is unchanged — and threads it into the `PlanItemTransitionedEvent`. - Removed the now-obsolete lint Rule 4; added conformance sample `Sentry_ExitCriterionRefOnPart.cmmn` + scenario proving a PlanItemOnPart fires only when its **named** criterion (not just any exit) satisfies. ## Verification Full build clean. Suite run **twice, identical**: 523 tests, 518 passed, 5 skipped (pre-existing Azurite), **0 failed**. New scenario also passes in isolation. ## Review notes (please read closely) This is the load-bearing one in tonight's batch — it changes the plan-item **state machine** and **base transition** path (every plan item) and **removes a lint safety rule**. I verified the parameterless-cascade path is preserved, but it warrants a careful human review over the rubber-stamp the smaller PRs get. **Merge-conflict heads-up:** it edits `StageBehavior.cs`, which **PR #52 (#83)** also touches — whichever merges second needs a rebase + build re-validation. Auto-complete off. Related work items: #82

Documents the move from Azure DevOps (brute-force/Case/Case.Flow) to GitHub (en-gen/wayfinder) and the Case.Flow -> Wayfinder rename: the ADO-to-GitHub parity table, the work-item mapping, follow-ups, and the two items that need a human (the workflow OAuth scope for CI/CD, and the branch-protection plan decision).

130 issues, 8 milestones, 18 labels, 5 sub-issue links and 60 comments created in en-gen/wayfinder, verified against GitHub rather than the migration script's own summary.

Add ADO to GitHub migration status and checklist

…S) (#1) * Add GitHub repo scaffolding for Wayfinder Wayfinder-branded README, dependabot config, issue templates, PR template, and CODEOWNERS, adapted from the OhData reference project. No workflows, license, or source changes. * Correct stale README claims against verified code The Known Gaps section carried over several claims from the old Case.Flow README that no longer hold: stage repeated-child bookkeeping was fixed (StageBehavior.HandleChildRepeated), deployed Orleans clustering plus a Dockerfile and eval Compose stack now exist, and .cmmn XML import/export already ships (CmmnXmlSerializer). Replaced with gaps verified against current code: in-memory Orleans streams/PubSubStore, volatile Quartz timers, no planning-apply surface, no MCP ingress. Also dropped dead Azure DevOps wiki references (GitHub wiki is disabled) in favor of docs/ and Issues, and called out the internal conformance suite's 35/35 green result.

--- updated-dependencies: - dependency-name: Jint dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-24T19:29:34Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

engenb and others added 30 commits April 6, 2026 01:25

Merged PR 9: Remove AutoMapper: hand-written snapshot mapping

d56ad2f

Merged PR 10: Systemic bug fixes with pinning tests

9fff0dc

Merge pull request 16 from feature/54_casefile-blob-storage into develop

4991589

Merge pull request 17 from feature/16_casefileitem-grains into develop

ba836a7

Merge pull request 18 from feature/17_expression-context into develop

e84dd13

Merge pull request 19 from docs/registry-refresh-d1-d2 into develop

9c1ac17

Merge pull request 20 from fix/54_azurite-probe-api-version-gate into…

d249b7a

… develop

Merge pull request 21 from bugfix/55-caseplanmodel-instantiation into…

23fad91

… develop

Merge pull request 22 from feature/18_sentry-completion into develop

89a5654

Merge pull request 23 from feature/20_cmmn-import-export into develop

737810e

Merge pull request 24 from docs/gaps-refresh-18-55 into develop

f23a74b

Merge pull request 25 from feature/21_conformance-suite into develop

768e89f

Merge pull request 26 from feature/19_rules-completion into develop

cbd66d7

Merge pull request 27 from test/21_unquarantine-post-19 into develop

81d7332

engenb and others added 23 commits July 12, 2026 07:14

Record completed work-item migration and verification results

4367e94

130 issues, 8 milestones, 18 labels, 5 sub-issue links and 60 comments created in en-gen/wayfinder, verified against GitHub rather than the migration script's own summary.

Merge pull request #2 from en-gen/docs/migration-status

217974c

Add ADO to GitHub migration status and checklist

Bump Jint from 4.11.0 to 4.14.0

7f986b0

--- updated-dependencies: - dependency-name: Jint dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 24, 2026

engenb force-pushed the develop branch from 3292183 to fa656fc Compare July 24, 2026 12:33

engenb closed this Jul 24, 2026

engenb deleted the dependabot/nuget/src/Flow.Grains/develop/Jint-4.14.0 branch July 24, 2026 19:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump Jint from 4.11.0 to 4.14.0#137

Bump Jint from 4.11.0 to 4.14.0#137
dependabot[bot] wants to merge 54 commits into
developfrom
dependabot/nuget/src/Flow.Grains/develop/Jint-4.14.0

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026

4.14.0

Highlights

What's Changed

4.13.0

Highlights

What's Changed

4.12.0

Highlights

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant