[einari]

cratis run now runs a Screenplay model the way it runs in production: behind AuthProxy when the model declares authentication, with its own Ante when it declares onboarding, configured from the selected environment.

Added

• cratis run starts AuthProxy in front of the Stage when the model has authentication, configured from the model's providers and the selected environment, and opens the application through it; the Stage trusts the identity AuthProxy forwards instead of playing a persona (cratis run: start AuthProxy and Ante when the model declares them #516)
• cratis run starts the application's own Ante in development mode, with a MongoDB and the model's legal terms, when the model has onboarding; onboarding emails are written to .cratis/local/mail unless the environment names a mail server
• cratis run stops before starting any container when the environment lacks keys the model needs, and lists them
• cratis run options --environment, --auth-port, --lobby-port, --authproxy-tag and --ante-tag
• cratis config --missing <model> reads the keys a .play file or folder needs and lists those the environment lacks
• cratis render renders a model's authentication and onboarding: the AuthProxy, Ante and environment configuration under .runtime/, sign-in and persona mapping, onboarding provisioning and the email templates

Changed

• The CLI bundles Stage 4.211.0 and Screenplay 4.259.0, and cratis run uses the cratis/stage:4.211.0 image by default

[einari]

Notes for reviewers (part of Cratis/Screenplay#1114):

• Local checks: Debug and Release builds with zero warnings against Screenplay 4.259.0; Environments.Specs passes; the Run, Config and Environments spec groups pass apart from the known DiagnoseCommand renderings and with_an_invalid_engine › should_list_both_engines, which fail the same way on the base locally.
• Exercised for real here: a model with authentication started cratis/stage and cratis/authproxy from Docker Hub; AuthProxy redirected to the provider using the client id from the mounted secrets file; no secret value appeared in container environment or binds; SIGTERM removed every container, the network and the run directory.
• Not exercised end to end: onboarding. ghcr.io/cratis/ante is not pullable from this sandbox, and the released Stage image does not yet accept the onboarding block (Render authentication: run the application behind AuthProxy Stage#915 and Render onboarding: provision from Ante's outcomes, license and email through Showrunner Stage#916 are in progress). AuthProxy accepted the full onboarding contract and both ports routed correctly with a stand-in for Ante. Signing in through a real provider was not tested.
• Choices to review: Ante image ghcr.io/cratis/ante (what Ante publishes); Ante runs in AuthProxy's network namespace because the contract only allows loopback HTTP in development; AuthProxy uses staged (attested) exchange, so Ante runs Attested with a per-run key pair whose public half is pinned in Ante; GitHub's issuer defaults to https://github.com unless the environment sets issuer.

---

Generated by Claude Code