@cratis/pi 2.22.0 → 2.23.1

package/package/corpus/skills/cratis-lens-browser-extension/SKILL.md

@@ -19,8 +19,10 @@ the developer points it at. Nothing in it is production tooling.
 
 | Source | Version | Purpose |
 | --- | --- | --- |
-| `Cratis/Lens` `Source/` | manifest `1.0.0`, repository revision `3d0df87` | The extension itself |
-| `Cratis.Arc.Core` | `22.10.4` | The `/.cratis/*` endpoints, the forwarded-identity contract, and the tenancy header Lens depends on |
+| `Cratis/Lens` `Source/` | manifest `1.0.0`, repository `HEAD` `3ee4882` (the repo has no release tag beyond `v0.0.1`) | The extension itself |
+| `Cratis.Arc.Core` | `22.16.0` | The `/.cratis/*` endpoints, the forwarded-identity contract, and the tenancy header Lens depends on |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 ⚠️ **There is no published store listing.** Nothing in the Lens repository links
 a Chrome Web Store, Edge Add-ons, AMO, or App Store entry — the only store URLs

package/package/corpus/skills/cratis-performance-review/SKILL.md

@@ -20,10 +20,12 @@ storage and replay cost that never goes away.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | Observers, projections, reducers, reactors, replay |
-| `Cratis.Arc.Core` | `22.10.4` | Query return shapes and server-side paging |
+| `Cratis.Chronicle` | `18.3.0` | Observers, projections, reducers, reactors, replay |
+| `Cratis.Arc.Core` | `22.16.0` | Query return shapes and server-side paging |
 | `@cratis/components` | current | `DataTable` paging surface |
 
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+
 Reverify against the owning product repository before asserting a framework
 behavior this file does not already state.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -26,7 +26,7 @@ reality, not against the ecosystem diagram.
 | `Cratis.Screenplay.Tool` | `4.12.1` | The `screenplay` dotnet tool |
 | `Cratis.Screenplay.CanonicalCorpus` | `4.12.1` | The frozen `RegisterProject` conformance vector downstream tools verify against |
 
-Behavior below is read from the repository at revision `7e2d91d`. Reverify before
+Behavior below is read from the repository at tag `v4.12.1`. Reverify before
 claiming another version behaves the same.
 
 ## Verify a model
@@ -108,8 +108,8 @@ by dedicated parsers rather than passed through as text.
 ## A complete model
 
 This is the canonical conformance vector — the smallest complete program the
-whole toolchain is verified against, quoted from
-`Screenplay.CanonicalCorpus`'s `RegisterProject` source:
+whole toolchain is verified against, quoted in full from
+`Screenplay.CanonicalCorpus`'s `Corpus/RegisterProject/v1-legacy/source/single/RegisterProject.play`:
 
 ```screenplay
 concept ProjectId : Uuid
@@ -136,6 +136,15 @@ module Projects
         then ProjectRegistered
           projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
           name = "Screenplay"
+        then readmodel ProjectSummary
+          projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          name = "Screenplay"
+        then query ProjectById
+          arguments
+            projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          result
+            projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+            name = "Screenplay"
       specification RejectingAnEmptyProjectName
         when RegisterProject
           projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
@@ -168,7 +177,7 @@ The parser accepts far more than anything can execute or render. Between the
 syntax tree and any runtime sits the **executable semantic model (ESM v1)**, and
 it fails closed.
 
-⚠️ `SemanticSliceKind` has exactly two members, `StateChange` and `StateView`.
+⚠️ `SemanticSliceKind` has three members — `Unknown = -1`, `StateChange` and `StateView` — and `Unknown` is load-bearing: the binder maps every other slice type to it and refuses to admit it.
 An `Automation` or `Translate` slice is rejected outright with
 `Slice '<name>' of type '<type>' is not admitted by ESM v1.` It parses, it
 validates, and it binds to nothing.
@@ -199,7 +208,8 @@ The language service ships two ways: the Monaco package
 file icon.
 
 ⚠️ Its keyword list has drifted from the parser. `theme`, `ui`, `form`,
-`contribute`, `dialog` and `reducer` appear nowhere in the Monaco package,
+`contribute`, `dialog` and `reducer` have no keyword, tokenizer or completion
+entry in the Monaco package (the words occur only in prose and theme names),
 although all six are real constructs the compiler accepts. They get no
 highlighting and no completion. Absent highlighting is not evidence that a
 construct is wrong — check `screenplay` instead.

package/package/corpus/skills/cratis-security-review/SKILL.md

@@ -16,13 +16,30 @@ first.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Arc.Chronicle` | `22.10.4` | `[NotAudited]` in `Cratis.Arc.Chronicle.Commands`; the `ARCCHR0009` analyzer |
-| `Cratis.Chronicle` | `16.45.2` | `[PII]`, `[Subject]`, redaction, namespace isolation |
-| `Cratis.Arc.Core` | `22.10.4` | Authorization filters, `CommandResult.Unauthorized` |
+| `Cratis.Arc.Chronicle` | `22.16.0` | `[NotAudited]` in `Cratis.Arc.Chronicle.Commands`; the `ARCCHR0009` analyzer |
+| `Cratis.Chronicle` | `18.3.0` | `[PII]`, `[Subject]`, redaction, namespace isolation |
+| `Cratis.Arc.Core` | `22.16.0` | Authorization filters, `CommandResult.Unauthorized` |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 Reverify against the owning product repository before asserting a framework
 guarantee this file does not already state.
 
+## When to run this review without being asked
+
+The orchestrating agents and the PR-review prompt run it unconditionally as the
+last gate. When you are shipping directly — one agent, one branch — run it
+yourself before committing whenever the diff **adds or removes** a line carrying
+any of: `[Roles]`, `[Authorize]`, `[AllowAnonymous]`, `[ExecuteCommandsAsSystem]`;
+`[PII]`, `[Subject]`, `[NotAudited]`; `useIdentity`; or a secret-shaped identifier
+(`ConnectionString`, `PrivateKey`, `Bearer`, `Password`, `ApiKey`, `AccessToken`).
+Added *or removed* matters: a deleted `[PII]` or `[Roles]` is the change most
+worth a second pair of eyes. Match changed lines, not whole files — every slice
+contains a `[Command]` and an `[EventType]`, and a trigger that fires on every
+commit is a trigger that gets skipped. A name-based list has the same blind spot
+as `ARCCHR0009`: a secret with an innocuous property name passes it, so read the
+command's properties as well as grepping them.
+
 ## Route near misses
 
 - General correctness and maintainability: use `cratis-code-review`.

package/package/corpus/skills/cratis-specifications-csharp/SKILL.md

@@ -16,9 +16,9 @@ This skill is verified against these exact public releases:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Specifications` | `4.1.0` | `Specification` base, `Catch.Exception`, `ShouldXxx` assertions |
-| `Cratis.Arc.Testing` | `22.10.4` | `CommandScenario<TCommand>` and `CommandResult` assertions |
-| `Cratis.Chronicle.Testing` | `17.0.0` | `EventScenario`, `ReadModelScenario<T>`, `ReactorScenario<T>` |
+| `Cratis.Specifications` | `4.1.1` | `Specification` base, `Catch.Exception`, `ShouldXxx` assertions |
+| `Cratis.Arc.Testing` | `22.16.0` | `CommandScenario<TCommand>` and `CommandResult` assertions |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario`, `ReadModelScenario<T>`, `ReactorScenario<T>` |
 
 Reverify against the owning product repository before claiming support for
 another version. Never translate an assertion or helper name from memory.

package/package/corpus/skills/cratis-specifications-csharp/references/application-scenarios.md

@@ -5,8 +5,8 @@ in-process. They are the default for event-sourced *application* behavior. A
 library or framework repository reaches for one only to test the very engine it
 provides.
 
-Verified against `Cratis.Arc.Testing` `22.10.4` and `Cratis.Chronicle.Testing`
-`17.0.0`.
+Verified against `Cratis.Arc.Testing` `22.16.0` and `Cratis.Chronicle.Testing`
+`18.3.0`.
 
 | Helper | Exercises | Use for |
 | --- | --- | --- |
@@ -42,9 +42,12 @@ public class and_<condition> : Specification
 #endif
 ```
 
-`CommandScenario<TCommand>` itself exposes exactly `Services`, `Context`,
-`Execute`, and `Validate`. Everything else — seeding, the event log, and the
-assertions — arrives as extension members from `Cratis.Arc.Chronicle.Testing`.
+`CommandScenario<TCommand>` itself exposes `Services`, `Context`, `Execute`
+(two overloads), `Validate`, `LastResult`, `Operations`, the operation assertions
+`ShouldHaveExecutedOperation<T>()` / `ShouldHaveCompensatedOperation<T>()` /
+`ShouldHaveNoOperationInvocations()`, and `Dispose`/`DisposeAsync`. Seeding
+(`Given`), the event log and the *event* assertions arrive as extension members
+from `Cratis.Arc.Chronicle.Testing`.
 
 - **Event assertions** are extension methods keyed by command *and* event type:
   `ShouldHaveAppendedEvent<TCommand, TEvent>(eventSourceId)`, its
@@ -120,9 +123,10 @@ and `ShouldNotHaveConstraintViolations()`,
 `ShouldHaveConcurrencyViolations()` and its negation, `ShouldHaveErrors()` and
 its negation. Assert the constraint **name**, never the message.
 
-⚠️ `EventScenario` wires a no-op concurrency-scope strategy, so a concurrency
-violation can never occur inside it. `ShouldHaveConcurrencyViolations()` cannot
-pass there and its negation passes vacuously — specify concurrency against the
+⚠️ `EventScenario` wires a strategy that always answers `ConcurrencyScope.None`,
+which the validator skips, so an append that lets the strategy choose the scope
+never produces a concurrency violation. `ShouldHaveConcurrencyViolations()`
+cannot pass for such an append and its negation passes vacuously — specify concurrency against the
 real kernel with an out-of-process integration specification instead.
 
 ## `ReadModelScenario<TReadModel>`

package/package/corpus/skills/cratis-specifications-csharp/references/csharp-patterns.md

@@ -2,7 +2,7 @@
 
 Detail for the plain `Cratis.Specifications` surface: phases, substitution,
 assertions, and exception capture. Verified against `Cratis.Specifications`
-`4.1.0` and NSubstitute as consumed by that package.
+`4.1.1` and NSubstitute as consumed by that package.
 
 ## Phases
 

package/package/corpus/skills/cratis-specifications-csharp/references/integration-specs.md

@@ -9,7 +9,7 @@ They live under `when_<behavior>/` **inside the behavior's own folder**, not in
 `for_<Type>/` unit folder: there is no isolated unit, the whole slice is under
 test. Never mix unit and integration specifications in one folder.
 
-Verified against `Cratis.Chronicle.Testing` `17.0.0`.
+Verified against `Cratis.Chronicle.Testing` `18.3.0` (`Cratis.Chronicle.XUnit.Integration` at the same tag).
 
 ## Structure
 
@@ -106,7 +106,9 @@ _collector = StartCollectingAppends();
 await _collector.WaitForCount(2, TimeSpan.FromSeconds(10));
 
 [Fact] void should_append_<event>() =>
-    _collector.ShouldHaveEvent<<EventType>>(appended => appended.<Property> == <expected>);
+    _collector.Last.ShouldHaveEvent<<EventType>>(appended => appended.<Property>.ShouldEqual(<expected>));
+// IEventAppendCollection has no assertions of its own — only All, Last and WaitForCount.
+// ShouldHaveEvent<TEvent>(Action<TEvent>? validate) is an extension on each AppendedEventWithResult.
 
 void Destroy() => _collector.Dispose();
 ```
@@ -120,7 +122,9 @@ deadline, not a sleep — it turns a hang into a named failure.
 - Add the `using context = <full.namespace>.context;` alias at the top of the
   file.
 - `[Collection(ChronicleCollection.Name)]` goes on the outer class and is
-  required for isolation.
+  required for isolation. `ChronicleCollection` is **yours to define** — one
+  `[CollectionDefinition(Name)] public class ChronicleCollection : ICollectionFixture<ChronicleOutOfProcessFixture>`
+  in the specs project (Chronicle ships the fixture, not the collection).
 - `Establish` seeds preconditions; `Because` performs the action under test.
 - Declare `Result` nullable.
 - The outer class receives `context` through xUnit constructor injection.

package/package/corpus/skills/cratis-specifications-typescript/SKILL.md

@@ -109,9 +109,12 @@ describe('when <behavior> with <condition>', given(a_<system_under_test>, contex
 }));
 ```
 
-`given()` instantiates the context class per specification so setup stays
-isolated. `beforeEach` performs the single action under specification; each
-`it()` asserts one outcome.
+`given()` constructs the context class **once per `describe`** and hands that
+instance to the suite — it does not re-create it per `it()`. Isolation therefore
+comes from the spec's shape: `beforeEach` performs the single action under
+specification, and each `it()` only asserts one outcome of it. Never put a second
+action in an `it()`; the stubs it would disturb are shared with the sibling
+`it()` blocks.
 
 ## Step 4 — Skip the context when nothing is shared
 

package/package/corpus/skills/cratis-specifications-typescript/references/typescript-patterns.md

@@ -78,13 +78,30 @@ afterEach(() => sinon.restore());
 ```
 
 `sinon.restore()` matters only for stubs installed on shared objects such as
-`globalThis`. A `createStubInstance` built inside a context class is recreated
-per specification by `given()` and needs no restore.
+`globalThis`. A `createStubInstance` built inside a context class lives for the
+whole `describe` (see below), so a stub whose call count you assert must be
+exercised by exactly one action — the one in `beforeEach` — or reset there.
 
 ## The `given()` helper
 
-`given()` instantiates the context class, hands it to the suite, and keeps
-setup isolated per specification.
+`given()` constructs the context class **once, when the `describe` body is
+registered**, and hands that single instance to the suite callback:
+
+```ts
+export function given<TContext extends object>(contextType: Constructor<TContext>, callback: ContextForSuite<TContext>) {
+    return function (this: Suite) {
+        const context = new contextType(this);   // once per describe, not per it()
+        callback.call(this, context);
+    };
+}
+```
+
+There is no `beforeEach` inside `given()`. Every `it()` under one `describe`
+sees the same context and the same stubs, so isolation comes from the shape of
+the spec, not from the helper: one `describe` = one behavior, one action in
+`beforeEach`, and `it()` blocks that only *assert*. A spec that needs a fresh
+collaborator per `it()` creates it in its own `beforeEach`. (The constructor is
+handed the Mocha `Suite`; a context class may ignore it.)
 
 ```ts
 import { given } from '../../given';

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -22,15 +22,18 @@ rendered.
 
 | Artifact | Version | What it is |
 | --- | --- | --- |
-| `Cratis.Stage.Contracts` | `3.11.0` | `ArtifactRenderPlan`, `EventModelLoader`, specification-result contracts |
-| `Cratis.Stage.Rendering.Cratis` | `3.11.0` | The one rendering target and the `CratisRendering` facade |
-| `Cratis.Stage` | `3.11.0` | The partial direct runtime engine |
-| `cratis/stage` | `3.11.0`, `latest` | Disposable HTTP host plus an in-memory Chronicle kernel |
-| `cratis/stage-specrunner` | `3.11.0`, `latest` | Run-to-completion specification job |
-
-Behavior below is read from the repository at revision `4f3fc6a`. `Cratis.Stage.Host`
-and `Cratis.Stage.SpecRunner` are **not** packable — they exist only as the two
-container images.
+| `Cratis.Stage.Contracts` | `3.15.1` | `ArtifactRenderPlan`, `EventModelLoader`, specification-result contracts |
+| `Cratis.Stage.Rendering.Cratis` | `3.15.1` | The one rendering target and the `CratisRendering` facade |
+| `Cratis.Stage.Rendering.Cratis.Scaffolding` | `3.15.1` | Scaffolds the Cratis project a rendered application is placed into |
+| `Cratis.Stage` | `3.15.1` | The partial direct runtime engine |
+| `cratis/stage` | `3.15.1`, `latest` | Disposable HTTP host plus an in-memory Chronicle kernel |
+| `cratis/stage-specrunner` | `3.15.1`, `latest` | Run-to-completion specification job |
+
+Behavior below is read from the repository at tag `v3.15.1`. Packing is opt-in
+per project (`<IsPackable>true</IsPackable>` on `Contracts`, `Rendering.Cratis`,
+`Rendering.Cratis.Scaffolding` and `Stage`); `Cratis.Stage.Host` and
+`Cratis.Stage.SpecRunner` never opt in and exist only as the two container
+images.
 
 ## Input
 
@@ -74,8 +77,13 @@ artifacts.**
 
 ### What it admits
 
-Every rule below is enforced, and each failure is a blocking `STAGE-ESM-00x`
-diagnostic that stops the whole plan.
+Every rule below is enforced, and each failure is a blocking `STAGE-ESM-0xx`
+diagnostic that stops the whole plan. Before these per-slice rules run, three
+admission diagnostics reject the model outright — `STAGE-ESM-001` (a slice kind
+other than `StateChange`/`StateView`), `STAGE-ESM-002` (concept values or
+validation the renderer cannot express) and `STAGE-ESM-003` (an unresolved
+property type) — and `STAGE-ESM-011` rejects a specification the runtime cannot
+execute.
 
 For a `StateChange` slice:
 
@@ -174,8 +182,9 @@ docker run --rm \
     cratis/stage:latest
 ```
 
-The image pairs the Stage host with an in-memory Chronicle kernel and takes the
-model folder as its first argument. The Stage API is on `9090`, the Chronicle
+The image pairs the Stage host with an in-memory Chronicle kernel and reads the
+model from the fixed `/eventmodel` directory (mount your folder there; the
+entrypoint takes no arguments — passing a folder is a documented override form). The Stage API is on `9090`, the Chronicle
 Workbench on `35000`. Deployment configuration is read from `cratis-stage.json`,
 overridable through the `STAGE_CONFIG` environment variable — not from
 `appsettings.json`.
@@ -183,10 +192,13 @@ overridable through the `STAGE_CONFIG` environment variable — not from
 ⚠️ It is a **partial** runtime, not a generated application. Commands evaluate
 their modeled `produces` mappings, append the facts to Chronicle and echo the
 payload; **modeled validation and authorization are not enforced on this path.**
-Modeled queries **deny by default and return no data** — the query performer's
-`IsAuthorized` returns false and `Perform` returns null or an empty array — until
-an executable query authorization contract exists in Screenplay. A sandbox query
-returning nothing is the designed behavior, not a bug in the model.
+Modeled queries are **served without authorization**: the query performer's
+`IsAuthorized` returns `true` unconditionally, and `Perform` reads the projected
+documents (by id when the query declares one, otherwise all instances). There is
+no executable query authorization contract in Screenplay yet, so a sandbox
+query answering is not evidence that the model's authorization is right —
+it is evidence that Stage does not enforce it. (Earlier Stage releases returned
+nothing from every query; that is no longer the case at 3.15.1.)
 
 ## Modeled specifications
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "2.22.0",
+  "version": "2.23.1",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [

package/package/corpus/rules/terminal-commands.md

@@ -1,19 +0,0 @@
----
-applyTo: "**/*"
-description: "Use when running any terminal command. Prefix every command with rtk -- including each command in an && chain -- so token-heavy output is filtered."
----
-
-# RTK (Rust Token Killer) - Token-Optimized Commands
-
-## Golden Rule
-
-**Always prefix commands with `rtk`**. If RTK has a dedicated filter, it uses it. If not, it passes through unchanged. This means RTK is always safe to use.
-
-**Important**: Even in command chains with `&&`, use `rtk`:
-```bash
-# ❌ Wrong
-git add . && git commit -m "msg" && git push
-
-# ✅ Correct
-rtk git add . && rtk git commit -m "msg" && rtk git push
-```