# Managedcode Orleans Graph

> Integrate ManagedCode.Orleans.Graph into an Orleans-based .NET application for grain-call policy enforcement, deadlock detection, live-call telemetry, and Mermaid graph diagnostics. USE FOR: ManagedCode.Orleans.Graph integration; allowed grain transitions; Orleans call filters; live policy graphs; reviewing Orleans call-cycle risk. DO NOT USE FOR: generic graph data modeling or traversal unrelate…

- **Type:** Skill
- **Install:** `agentstack add skill-managedcode-dotnet-skills-managedcode-orleans-graph`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [managedcode](https://agentstack.voostack.com/s/managedcode)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [managedcode](https://github.com/managedcode)
- **Source:** https://github.com/managedcode/dotnet-skills/tree/main/catalog/Libraries/ManagedCode-Orleans-Graph/skills/managedcode-orleans-graph
- **Website:** https://skills.managed-code.com

## Install

```sh
agentstack add skill-managedcode-dotnet-skills-managedcode-orleans-graph
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ManagedCode.Orleans.Graph

## Trigger On

- integrating `ManagedCode.Orleans.Graph` into an Orleans-based system
- enforcing which grain interfaces may call other grain interfaces and methods
- detecting unsafe runtime grain call cycles or intentional self-reentrancy
- generating configured-policy or live-call Mermaid diagrams
- running observe mode to discover real traffic before locking down a policy

## Install

Current upstream release reviewed: `v10.0.3`.

```bash
dotnet add package ManagedCode.Orleans.Graph
```

The upstream package targets the current .NET 10 / Orleans 10 stack. Do not add it to older Orleans applications without first checking target frameworks and Orleans package compatibility.

## Workflow

1. Confirm the application needs grain-call policy enforcement or live-call diagnostics. If the task is generic graph data traversal, use normal Orleans grain modeling instead.
2. Register Orleans.Graph filters in the silo with `AddOrleansGraph(...)`.
3. Model the policy from source grain to target grain and method. Start with explicit allow rules for client entry points and grain-to-grain transitions.
4. Use `AllowAll()` observe mode only to discover traffic before enforcement. Keep a follow-up step to convert observed edges into reviewed policy.
5. Register the client-side outgoing filter with `clientBuilder.AddOrleansGraph()` only when Orleans clients should participate in call-history tracking.
6. Use attributes when colocating policy with grain contracts is clearer than central fluent setup.
7. Generate Mermaid diagrams and inspect policy edges for review artifacts.
8. Validate with real Orleans runtime tests, including timer, reminder, hosted-service, and stateless-worker call origins when those are part of the topology.

```mermaid
flowchart LR
  A["Orleans call"] --> B["Outgoing filter records source"]
  B --> C["Incoming filter checks transition policy"]
  C --> D{"Allowed?"}
  D -->|Yes| E["Target grain method runs"]
  D -->|No| F["Blocked before target code"]
  E --> G["Telemetry worker aggregates live edge"]
  G --> H["Telemetry grain / Mermaid graph"]
```

## Practical Usage

### Enforce a grain transition

```csharp
using ManagedCode.Orleans.Graph.Extensions;

siloBuilder.AddOrleansGraph(graph =>
{
    graph.AllowClientCallGrain();

    graph.AddGrainTransition()
        .Method(
            source => source.SubmitAsync(GraphParam.Any()),
            target => target.ChargeAsync(GraphParam.Any()))
        .And();

    graph.AddGrain()
        .WithReentrancy();
});
```

### Discover traffic before enforcement

```csharp
siloBuilder.AddOrleansGraph(
    configureFilters: filters =>
    {
        filters.LiveGraphFlushPeriod = TimeSpan.FromSeconds(1);
    },
    configureGraph: graph =>
    {
        graph.AllowAll();
    });

clientBuilder.AddOrleansGraph();
```

After the app receives traffic, inspect the observed graph:

```csharp
var telemetry = grainFactory.GetGrain(
    Constants.LiveGraphTelemetryGrainKey);

var observedGraph = await telemetry.GetObservedGraphAsync();
var mermaid = await telemetry.GenerateLiveMermaidDiagramAsync();
```

### Use attributes on grain contracts

```csharp
using ManagedCode.Orleans.Graph.Attributes;

[AllowClientCall]
[AllowGrainCall(
    typeof(IPaymentGrain),
    AllowAllMethods = false,
    SourceMethods = [nameof(IOrderGrain.SubmitAsync)],
    TargetMethods = [nameof(IPaymentGrain.ChargeAsync)])]
public interface IOrderGrain : IGrainWithStringKey
{
    Task SubmitAsync(Order order);
}

[AllowSelfReentrancy]
public interface IPaymentGrain : IGrainWithStringKey
{
    Task ChargeAsync(Payment payment);
}
```

## Options And Constraints

- `AllowAll()` is an observe/discovery mode, not a finished production policy.
- `AllowClientCallGrain()` is required for client-originated entry points that should be allowed.
- `TrackOrleansGraphInternalCalls` should stay off unless debugging Orleans.Graph itself.
- `RegisterGrainTimer` callbacks use `*` as the source method because Orleans does not expose a grain interface method for that callback.
- Reminder callbacks use the source grain identity and `ReceiveReminder` as the source method.
- Runtime vertices use exact graph identities. The library records `ORLEANS_GRAIN_CLIENT` for client calls and `UNKNOWN_CALLER` when Orleans exposes no resolvable caller identity.
- `v10.0.3` includes fixes for reminders and timers; re-test those origins when upgrading.

## Deliver

- explicit Orleans.Graph registration for the silo and, when needed, clients
- reviewed allow rules for client-to-grain and grain-to-grain transitions
- observe-mode output or Mermaid diagrams when discovering real call paths
- validation coverage for blocked transitions, allowed transitions, self-reentrancy, and runtime graph diagnostics

## Validate

- the app needs call policy enforcement, not generic graph traversal
- every client entry point and grain transition required by the workflow is allowed intentionally
- missing or unexpected transitions fail before target grain code runs
- observe-mode findings are converted into reviewed policy before production enforcement
- timer, reminder, hosted-service, stateless-worker, and client-originated calls are covered when they exist
- Mermaid or edge snapshots are generated from runtime traffic or configured policy and reviewed for cycles

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [managedcode](https://github.com/managedcode)
- **Source:** [managedcode/dotnet-skills](https://github.com/managedcode/dotnet-skills)
- **License:** MIT
- **Homepage:** https://skills.managed-code.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-managedcode-dotnet-skills-managedcode-orleans-graph
- Seller: https://agentstack.voostack.com/s/managedcode
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.