Release v4.22.0

Policies become executable. A declarative policy (authenticated, role, claim matches) now binds into the semantic model, and the reference executor evaluates it before validation. A specification can state who the caller is and assert that a caller is denied.

Added

• Declarative policies bind into the executable semantic model and are evaluated for commands and queries. A command's or query's effective authorization is its own policies, every enclosing feature's and its module's, combined by AND (#142)
• Specifications accept a given caller block (authenticated, role "<role>", claim "<type>" = "<value>"; a claim may repeat) and a then denied outcome, distinct from then error. A denied command or query is rejected as Unauthorized before validation runs (#142)

Changed

• Claim types compare case-insensitively; role names and claim values compare exactly; a claim carried more than once matches when any of its values matches. A missing claim, a null target or an unresolvable subject denies. This matches how Arc evaluates authorization through .NET's ClaimsPrincipal, and Identity.ClaimValue/ClaimValues now look claim types up case-insensitively too (#142)
• A specification that exercises an authorized command without a given caller is reported when binding. Caller identity is never inferred (#142)

csharp policies remain a blocking disposition until constrained implementation bodies are defined.