Release v4.0.0

Provider credentials are now encrypted by Chronicle itself. The ISecretProtector / ISecretRevealer seam that used to do it is gone, and with it the plaintext copy of every key that was being written to the causation chain.

Security

• An AI provider's API key is no longer written to the causation chain in plain text. A command's property values are recorded there before Handle runs, so protecting the value inside the handler never covered them — the key was stored in the clear, permanently, beside the event that protected it. AIProviderApiKey is now [NotAudited]. Anyone upgrading should treat keys configured through earlier versions as exposed in their own event log.

Changed

• AIProviderApiKey is [Encrypted(EncryptionScope.Namespace)]. Chronicle encrypts it on append and decrypts it on read, keyed per event store namespace — the same boundary the per-tenant protectors it replaces already used.
• Command handlers that only awaited the protector are now synchronous.
• Cratis.Arc.Chronicle is a direct dependency, which also enables the ARCCHR analyzers. ARCCHR0009 fails the build when a command carries a credential-shaped property that is not excluded from the causation chain.
• Chronicle 18.1.6 → 19.4.7, Arc 22.14.0 → 22.23.0.
• Twenty event types no longer pass their own name as an explicit [EventType] id. The identifier each one resolves to is unchanged — the type name is the default.

Removed

• ISecretProtector, ISecretRevealer and CratisAIBuilder.WithSecretProtection<T>().

Breaking

Consuming products must delete their .WithSecretProtection<T>() call and re-record every provider credential. Values stored through the old protectors are enc:v1: strings; Chronicle passes unrecognized values through untouched, so they are not corrupted, but nothing can read them any more. Key custody moves from each product's vault to Chronicle's key storage — the boundary is unchanged, the custodian is not. See Documentation/decisions/0015-chronicle-owns-credential-encryption.md.