ARO 0.11.5

[KrisSimon]

ARO 0.11.5 — safer defaults for templates and Exec, a lot more diagnostics before you hit run time, and a Compute string toolkit.

⚠️ Behavior changes

• Templates HTML-escape by default. {{ Print <x> to the <template>. }} now escapes & < > " ' when rendering .html/.htm. Deliberate markup opts out with the raw target: {{ Print <trusted-html> to the <template: raw>. }} — the same raw convention Write already uses. Escaping is keyed on the template's extension, so non-HTML templates are unaffected. (Update books and runtime for atomic Store dedup and crawler improvements #476)
• Doubles render at full precision. Numeric output went through "%.2f", so 3.5 printed as 3.50 and anything past two decimals was silently rounded away in console output, responses and compiled binaries. Output for decimal values changes accordingly (nine Examples/ expectation files were updated with it). (Remove noisy debug print statements from runtime #474)

✨ Features

Language & runtime

• Encoding and escaping primitives for Compute — html-escape, url-encode / url-decode, base64-encode / base64-decode, base64url-encode / base64url-decode (JWT-shaped), json-escape, trim and replace. Specified in ARO-0019 §3.1. (Redesign website with console-like typography and parallax #482)
• Action middleware/hooks — ActionRegistry.addMiddleware(…) wraps every action invocation with a before/after hook, returning a token for removal. Foundation for tracing, metrics and policy without patching individual actions. (Add Business Activity to error messages #107)

Tooling

• aro check validates prepositions. Every action already declared its accepted set; nothing checked it, so Exec the <r> from the <command: …>. compiled clean and failed at run time with a message that never mentioned the preposition. Now reported at check time with the valid set and a corrected statement. Backed by PrepositionCatalog (70 actions, 128 verbs), generated from the runtime and kept honest by parity tests. Reported as a warning rather than an error, because one runtime fast path currently tolerates unaccepted prepositions. (ARO-0046: Typed Event Extraction using OpenAPI Schemas #479)
• aro actions shows verb aliases, looks up single actions, and speaks JSON. The listing printed only canonical names, so keepalive and createdirectory — both used in this project's own examples — were unfindable with the command whose job is to list actions. Adds a Verbs column, aro actions <name-or-verb> (resolving aliases, with an example statement and near-match suggestions), and --format json so SOLARO, the LSP and the MCP server can consume one source instead of each maintaining a partial mirror. (Add WebSocket support (ARO-0048) #483)

🐛 Fixes

Safety

• Exec … with passes literal argv, not shell text. Arguments were pasted into a shell command line; they are now passed as an argument vector, so values containing spaces, quotes or ; are arguments rather than syntax. (Add runtime metrics tracking (ARO-0044) #471)
• Integer overflow reports an error instead of trapping the process. Arithmetic that overflowed crashed the interpreter (and constant-folded the same way in the compiler); both paths now surface a diagnostic. (Fix runtime issues: event deduplication, variable shadowing, and idle shutdown #472)

Parser & semantics

• as <Type> is honoured by Compute, and no longer eats the qualifier. ARO-0003 presents as Float as the way to ask for decimals, but Compute ignored it while Reduce honoured it. Tracing that turned up a worse bug: as Type overwrote the result's qualifier, so Compute the <m: length> as Integer from <s>. silently became the identity instead of a length. Qualifier and type annotation are now separate fields. (Run docker builds in parallel with the build stage #475)
• Path-shaped qualifiers are no longer split on . — <file: "./out/report.json"> and similar kept their qualifier truncated at the first dot. (Add integration tests for Application-End handlers #470)
• aro check recognises command, url and destination as system objects, ending spurious undefined-symbol reports. Adds SystemObjectCatalog. (Fix ZipService test on Linux CI by using GitLab mirror #478)

Diagnostics

• Template errors carry a position and a hint. A malformed template used to surface as a raw Swift enum dump with no line number. Now: Template render error in page.html:3: with the offending line, plus a Mustache hint — {{name}} is inevitable given the syntax, and now suggests {{ Print <name> to the <template>. }}. The underlying fix (CLIErrorFormatter.describe, preferring errorDescription) stops enum case names leaking for every LocalizedError in the runtime, not just templates. (Strip debug symbols from binaries to reduce artifact size #484)

📚 Docs

• ARO-0004's action reference is generated from the runtime by Scripts/generate-action-reference.py, wired into CI, with role-consistency tests — so the reference can no longer drift from the implementation. (ARO-0047: Command-Line Parameters #480)
• Proposal identifiers are unique and enforced by Scripts/check-proposals.py in CI. Every ARO-NNNN reference must resolve; eight GitLab issue numbers had been written with the ARO- prefix across Sources/ and were corrected. (Implement ARO-0048: WebSocket Support #481)
• Examples/UserService used Close … for the <application> inside Application-End — a latent shutdown bug the new preposition check found and fixed.

🤖 Model & training

• Curated ARO corpus expanded and REPL-validated, 318 → 1000 examples.
• NB18 hardened against the gradient-checkpoint/resume NaN failure mode; per-notebook timeouts removed after NB06 was killed at the 2h default.

---

Full history: git log 0.11.4..0.11.5.