@cratis/pi 6.1.0 → 6.3.0

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -24,15 +24,17 @@ source is the single flow model.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Screenplay` | `4.12.1` | Parser, validator, diagnostics |
+| `Cratis.Screenplay` | `4.31.0` | Parser, validator, diagnostics, semantic binder |
 
-Read from the Screenplay repository at tag `v4.12.1` (commit `122eee8`), against
-`Documentation/screenplay/{queries,readmodels,screens}.md` and
-`Source/DotNET/Screenplay/Parsing/`. Reverify before claiming another version
-behaves the same.
+Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
+`Documentation/screenplay/{queries,readmodels,screens,policies,specifications,interactions}.md`
+and decision 0010. Every example below compiles with that version's compiler.
+Reverify before claiming another version behaves the same.
 
 ## `readmodel` — shape only
 
+Excerpt, inside a `StateView` slice:
+
 ```screenplay
 readmodel AccountBalance
   description "What the account is worth right now"
@@ -45,8 +47,20 @@ A read model declares what it **is** — nothing about what builds it. Whatever
 builds it points at it with `=>`, and **exactly one thing may**: two builders is
 error `PLAY0191`. See `cratis-screenplay-projections` for the builder side.
 
+Do not mark a read-model property `identifier`. The executable model infers the
+instance identifier from the `by` property of the keyed queries that return the
+read model in its own slice
+(`query InvoiceById => InvoiceSummary? by invoiceId InvoiceId`). Several queries
+over the same `by` property are fine; each must still have the shape the
+executable model admits, `=> <ReadModel>?` with one caller-supplied `by`. A read
+model with no keyed query, or with keyed queries over different `by` properties,
+has no unambiguous identifier and does not bind (`PLAY0268`), and specifications
+cannot select an instance of it.
+
 ## `query`
 
+Excerpt: the concepts, the read model and the policy are declared elsewhere.
+
 ```screenplay
 query ListInvoices => InvoiceListReadModel[]
   description "Every invoice the caller may see, narrowed by status and customer"
@@ -70,10 +84,13 @@ optionally prefixed `observable`.
 ⚠️ **Anything the caller must not be able to choose — the tenant, the caller's own
 subject — belongs on a `from` parameter, never on a `filter` the UI supplies.**
 Any mapping source works as a `from` source, so `$context.`, `$env.` and constants
-are all available.
+are all available. The `from` states the contract; the runtime that realizes the
+query enforces it. A compiling query is not evidence that access control works.
 
 ### `scoped to`
 
+Excerpt, inside a `StateView` slice:
+
 ```screenplay
 query Mine => Timesheet[]
   scoped to identity
@@ -95,23 +112,41 @@ Treat every `scoped to global` in a review as a question to answer, not a detail
 
 ### `observable`
 
-`=> observable OverdueInvoicesReadModel[]` is a live read that keeps pushing;
-without the marker a query is one-shot, which is the default and what most reads
-are. The marker qualifies only *how* the result arrives, so it composes with `[]`,
-`?`, `by`, `filter`, `authorize` and a `performer`. A screen binds to a live query
-exactly as it binds to a one-shot one and gets updates for free.
+`=> observable OverdueInvoicesReadModel[]` declares a live read that keeps
+pushing; without the marker a query is one-shot, which is the default and what
+most reads are. The marker qualifies only *how* the result arrives, so it composes
+with `[]`, `?`, `by`, `filter`, `authorize` and a `performer`, and a screen binds
+to a live query exactly as it binds to a one-shot one. The delivery itself is the
+target runtime's: the executable model does not bind observable queries.
+
+Paging, sorting and change-set delivery for queries are accepted as Screenplay
+decision 0010 but **not in the language yet**. Do not invent syntax for them.
 
 ### `performer`
 
 A query is **complete without a performer** — it is realization metadata, not a
-precondition. It takes a `file` reference or an inline code block, and is the
-query's counterpart to a command's `handler`. `csharp` and `sql` are the two that
-make sense here; the parser accepts any registered inline language
-(`csharp`, `typescript`, `react`, `html`, `sql` are built in) and does not
-reject a nonsensical one, so the choice is yours to get right.
+precondition. It takes a `file` reference or an inline block in a tagged fence
+(` ```csharp `, ` ```sql `), and is the query's counterpart to a command's
+`handler`. The parser accepts any registered inline language and does not reject
+a nonsensical one, so the choice is yours to get right. Performer code is opaque:
+Screenplay never runs it.
+
+### What runs
+
+In the executable model today, only the keyed snapshot shape binds:
+`=> <ReadModel>?` with one caller-supplied `by` argument and no `observable`,
+`filter`, `scoped to` or `performer`. Anything else, including `=> <ReadModel>`
+and `=> <ReadModel>[]`, reports `PLAY0268`. Its `authorize` gate runs before
+the lookup, ANDed with module and feature gates; a denied caller gets
+`Unauthorized`. Pin that with a `given caller` fixture and `then denied` (see
+`cratis-screenplay-specifications`). Model the richer query shapes when the
+application needs them; just do not claim the reference runner exercised them.
 
 ## `screen` — three levels
 
+The examples below are excerpts: each screen sits in a slice, and the queries,
+commands and screens it names are declared elsewhere.
+
 **Level 1 — intent.** Data and actions; the tool generates the component.
 
 ```screenplay
@@ -152,6 +187,13 @@ Constructs: `title`, `data … via query … [by <param>]`, `action <Command>` w
 `on row-click navigate to <Screen> [by <param>]`, `summary <ReadModel>` with
 `field <property> label`, and `template <Name>` with slot bodies.
 
+`on row-click navigate to …` is the one-line table navigation form. What a click,
+selection, submit or screen entry *does* beyond that — confirm, execute, refresh,
+open a dialog, branch on success or failure — is an interaction: an inline `on`
+block or a named `behavior` attached with `uses`. See
+`cratis-screenplay-ui-composition`. Screens and interactions are deferred from the
+executable model (information `PLAY0269`); they never block binding.
+
 ## How a bare name resolves
 
 **Inside out:** the slice, then the enclosing feature, then the module, then the
@@ -161,7 +203,8 @@ That rule exists because a generated document cannot make every name unique —
 real application declares 76 queries under 37 distinct names, with `All` appearing
 21 times. Two sibling slices can each declare `All`, and each screen gets its own.
 
-Reach across slices by qualifying with **any trailing part** of the scope:
+Reach across slices by qualifying with **any trailing part** of the scope.
+Excerpt: `Queue` and `Deviations` are sibling slices that each declare `All`.
 
 ```screenplay
 screen OverviewScreen
@@ -180,6 +223,8 @@ Ambiguous query 'All' - it matches 2 declarations equally well
 ⚠️ Unresolved and ambiguous references are **warnings, not errors**, because a
 name may resolve to something outside the document. Run with `--warnaserror` or a
 screen can navigate to a screen that does not exist and the build stays green.
+This is about references only: malformed clauses, duplicate declarations and
+binding failures are errors.
 
 ## Verify
 
@@ -188,6 +233,8 @@ screen can navigate to a screen that does not exist and the build stays green.
 - [ ] Every `scoped to global` is deliberate and defensible.
 - [ ] `observable` is present exactly where the caller should see changes without
       asking again.
+- [ ] Every authorized query has a specification with `given caller`, including a
+      `then denied` case.
 - [ ] Each read model has exactly one builder and every field traces to an event.
 - [ ] No screen reference is left ambiguous or unresolved.
 

package/package/corpus/skills/cratis-screenplay-read-surface/verification.json

@@ -7,6 +7,9 @@
     { "kind": "skill-contains", "value": "`cratis ai install` manages `.cratis/ai/`, not `.cratis/screenplay/`" },
     { "kind": "skill-contains", "value": "The tenant is the default and stays unstated" },
     { "kind": "skill-contains", "value": "belongs on a `from` parameter, never on a `filter`" },
-    { "kind": "skill-contains", "value": "warnings, not errors" }
+    { "kind": "skill-contains", "value": "warnings, not errors" },
+    { "kind": "skill-contains", "value": "the executable model does not bind observable queries" },
+    { "kind": "skill-contains", "value": "A compiling query is not evidence that access control works" },
+    { "kind": "skill-contains", "value": "decision 0010 but **not in the language yet**" }
   ]
 }

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-screenplay-specifications
-description: Pin behavior in a Cratis Screenplay `.play` model with given/when/then `specification` blocks — prior events and read-model state, the command under test, expected events, read-model state, query results and rejections, plus what the reference execution actually runs. Use when writing acceptance criteria for a slice, specifying a rejection, or deciding whether a rule belongs in a specification or in the type system. Do not use for C# or TypeScript test code.
+description: Pin behavior in a Cratis Screenplay `.play` model with given/when/then `specification` blocks — prior events and read-model state, the caller, the command or appended event under test, expected events, read-model state, query results, rejections and denials, plus what the reference execution actually runs. Use when writing acceptance criteria for a slice, specifying a rejection or an authorization denial, or deciding whether a rule belongs in a specification or in the type system. Do not use for C# or TypeScript test code.
 license: MIT
 ---
 
@@ -25,106 +25,177 @@ source is the single flow model.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Screenplay` | `4.12.1` | Parser, semantic binder, reference execution |
+| `Cratis.Screenplay` | `4.31.0` | Parser, semantic binder, reference execution |
 
-Read from the Screenplay repository at tag `v4.12.1` (commit `122eee8`), against
-`Documentation/screenplay/specifications.md` and
-`Source/DotNET/Screenplay/Parsing/SpecificationParser.cs`. Reverify before
+Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
+`Documentation/screenplay/{specifications,policies,constraints,readmodels,diagnostics}.md`.
+The worked example below compiles with zero diagnostics, binds to ESM v2, and
+all six specifications pass the reference runner at that tag. Reverify before
 claiming another version behaves the same.
 
 ## The vocabulary
 
 | Construct | Meaning |
 | --- | --- |
-| `given <EventType>` | prior state, established by replaying events before the command runs |
-| `given readmodel <ReadModelType>` | prior read-model state, established directly |
-| `when <CommandType>` | the command under test — **at most one**; a second is a compile error |
-| `then <EventType>` | an event expected to be produced |
-| `then readmodel <ReadModelType>` | the read-model state expected afterwards |
-| `then query <Query>` | ordered query results for explicit arguments |
-| `arguments` | the values supplied to the query |
-| `result` | one expected query result; repeat for many |
-| `then error "<message>"` | a rejection, for the named reason |
-| `then error` | a rejection, for a reason this specification does not name |
-| `<property> = <value>` | a property value, using the `produces` expression grammar |
-
-`given`, `then`, `then readmodel`, `then query` and `then error` are each zero or
-more.
-
-## Command specifications
+| `given <EventType>` | prior state, established by replaying events before the action |
+| `given readmodel <ReadModelType>` | prior read-model state, established directly — a **complete** instance including its identifier |
+| `given caller` | the caller: `authenticated`, `role "<r>"`, repeatable `claim "<type>" = "<value>"`; empty means unauthenticated |
+| `when <CommandType>` | run a command |
+| `when append <EventType>` | append one event: constraints and projections run, the command and reactions do not |
+| `then <EventType>` | an expected new event |
+| `then events in any order` | compare the new events without regard to order |
+| `then readmodel <ReadModelType> [exactly]` | read-model state afterwards — must state the identifier |
+| `then query <Query> [exactly]` | query results for explicit `arguments`; one `result` per row; none means empty |
+| `then error "<message>"` | a validation or constraint rejection, for that reason |
+| `then error` | a validation or constraint rejection, reason unnamed |
+| `then denied` | an authorization denial (`Unauthorized`) |
+| `for <value>` | the event source of a `given`/`then` event, or of the `when` command or appended event |
+| `<property> = <value>` | a literal, `null`, or a one-line JSON-shaped object or list: `lines = [{"sku":"A-1","quantity":2}]` |
+
+Rules the binder enforces:
+
+- **At most one action** — `when` or `when append` (`PLAY0358`). Without an
+  action, assert only `then readmodel` or `then query` (`PLAY0352`).
+- **`then` contains either events or an error — never both.** A rejection
+  specification has exactly one rejection and no success outcome.
+- **`then denied` stands alone**: not with events, errors or state assertions
+  (`PLAY0388`). For a query, pair it with one `then query` that has `arguments`
+  and no `result`.
+- **Authorized commands and queries need `given caller`** (`PLAY0389`). The runner
+  never invents a caller.
+- **`null` only in optional read-model values.** A `null` in a command or event
+  value is `PLAY0350`: an optional fact is a separate event.
+
+`PLAY0358` is a syntax error. `PLAY0350`, `PLAY0352`, `PLAY0388`, `PLAY0389` and
+the one-rejection rule (`PLAY0273`) are reported only when the model binds, so
+`screenplay --warnaserror` does not show them. Check executable diagnostics
+(the MCP authoring tools) as well.
+
+## How outcomes are compared
+
+- **Events:** the complete set of new events, in authored order, unless
+  `then events in any order` is stated. The count is always exact.
+- **Read models and query rows:** only the asserted properties must match
+  (subset); add `exactly` to require every property. Row count and order are
+  always exact. A missing property does not match an asserted `null`.
+- **Rejections:** `then error "<message>"` matches the message whatever the rule's
+  validation severity; no form asserts severity. Bare `then error` never matches
+  a denial. Quote a localized key: `then error "$strings.invoices.reasonRequired"`.
+
+## Worked example
+
+A command with an authorization gate, a validation rule and a uniqueness
+constraint, and a read model fed by its event. The `for` values select ESM v2.
 
 ```screenplay
-specification RegisteringADraftInvoice
-  given CustomerRegistered
-    customerId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
-    name       = "Acme Corp"
-  when RegisterInvoice
-    invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
-    customerId    = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
-    invoiceNumber = "INV-000123"
-  then InvoiceRegistered
-    invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
-    invoiceNumber = "INV-000123"
+concept InvoiceId : Uuid
+concept InvoiceNumber : String
+policy IsAccountant
+  require role "Accountant"
+module Invoicing
+  feature Registration
+    slice StateChange RegisterInvoice
+      command RegisterInvoice
+        invoiceId     InvoiceId identifier
+        invoiceNumber InvoiceNumber
+        authorize IsAccountant
+        validate
+          invoiceNumber not empty message "Invoice number is required"
+        produces InvoiceRegistered
+          for invoiceId
+          invoiceNumber = invoiceNumber
+      event InvoiceRegistered
+        invoiceNumber InvoiceNumber
+      constraint UniqueInvoiceNumber
+        unique invoiceNumber on InvoiceRegistered
+      specification RegisteringAnInvoice
+        given caller
+          authenticated
+          role "Accountant"
+        when RegisterInvoice
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+        then InvoiceRegistered
+          for "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+        then readmodel InvoiceSummary
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+      specification RejectingAnEmptyInvoiceNumber
+        given caller
+          authenticated
+          role "Accountant"
+        when RegisterInvoice
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = ""
+        then error "Invoice number is required"
+      specification RejectingANumberAnotherInvoiceHolds
+        given caller
+          authenticated
+          role "Accountant"
+        given InvoiceRegistered
+          for "0f5f5f7f-0f6f-4f47-9f39-5c1f2f0a1a9f"
+          invoiceNumber = "INV-000123"
+        when RegisterInvoice
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+        then error
+      specification DenyingACallerWithoutTheRole
+        given caller
+          authenticated
+        when RegisterInvoice
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+        then denied
+      specification ProjectingAnAppendedInvoice
+        when append InvoiceRegistered
+          for "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000123"
+        then query InvoiceById
+          arguments
+            invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          result
+            invoiceNumber = "INV-000123"
+    slice StateView InvoiceLookup
+      readmodel InvoiceSummary
+        invoiceId     InvoiceId
+        invoiceNumber InvoiceNumber
+      query InvoiceById => InvoiceSummary?
+        by invoiceId InvoiceId
+      projection InvoiceSummaries => InvoiceSummary
+        from InvoiceRegistered
+          invoiceId     = $eventSourceId
+          invoiceNumber = invoiceNumber
+      specification LookingUpAnExistingInvoice
+        given readmodel InvoiceSummary
+          invoiceId     = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          invoiceNumber = "INV-000001"
+        then query InvoiceById
+          arguments
+            invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
+          result
+            invoiceNumber = "INV-000001"
 ```
 
-**`then` contains either events or an error — never both.**
+- `RejectingANumberAnotherInvoiceHolds` needs `for`: without it the `given`
+  event lands on the command's own event source, and re-claiming your own value
+  is not a violation.
+- `ProjectingAnAppendedInvoice` exercises the projection without running the
+  command. Put `for`-bearing specifications in the slice whose command produces
+  the event; placed in the view slice, binding fails with `PLAY0273`.
+- `LookingUpAnExistingInvoice` has no action: it checks established state only.
 
-## Rejections — two forms, and they say different things
+## Rejections and denials say different things
 
-```screenplay
-specification RejectingAnInvoiceWithNoLines
-  when RegisterInvoice
-    invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
-  then error "An invoice must have at least one line"
-```
-
-`then error "<message>"` says **rejected, for this reason** — pinning a constraint
-violation or a validation message down deliberately.
-
-```screenplay
-specification RejectingAnInvoiceWhoseNumberIsAlreadyTaken
-  given InvoiceRegistered
-    invoiceNumber = "INV-000123"
-  when RegisterInvoice
-    invoiceNumber = "INV-000123"
-  then error
-```
-
-Bare `then error` says **rejected, for a reason this specification does not name**.
-Most specifications are this kind — the reason lives in the specification's name.
-
-## View specifications
+`then error "<message>"` says **rejected, for this reason** — pin it when the
+message is the point. Bare `then error` says **rejected, for a reason this
+specification does not name**; the reason lives in the specification's name.
+`then denied` says **this caller may not do this**, which is decided before any
+validation runs. Write the bare form rather than `then error ""`.
 
-```screenplay
-specification SendingADraftInvoice
-  given readmodel InvoiceListReadModel
-    invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
-    status    = "draft"
-  when ChangeInvoiceStatus
-    status = "sent"
-  then readmodel InvoiceListReadModel
-    status = "sent"
-```
-
-**Views cannot reject events.** There are no error cases for a projection.
-
-## Query specifications
-
-```screenplay
-specification LookingUpARegisteredProject
-  when RegisterProject
-    projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
-    name      = "Screenplay"
-  then query ProjectById
-    arguments
-      projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
-    result
-      projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
-      name      = "Screenplay"
-```
-
-Results are compared **in order**. `then query` with no `result` block asserts the
-query returns nothing.
+**Views cannot reject events.** A projection never refuses an event; there are no
+error cases for one. (A `when append` can still be refused by an append-time
+constraint — that is the constraint speaking, not the view.)
 
 ## Business rule or type system?
 
@@ -147,31 +218,41 @@ the concept.
 
 ## Application-boundary coverage
 
-Every slice should carry at least one specification whose `when` is the command a
-real caller issues and whose `then` is observable at that same boundary — produced
-events, read-model state, or query results. A specification satisfiable only by an
-internal function describes a unit, not a slice acceptance criterion.
+Every slice should carry at least one specification whose action is what a real
+caller does and whose `then` is observable at that same boundary — produced
+events, read-model state, query results, a rejection or a denial. A specification
+satisfiable only by an internal function describes a unit, not a slice acceptance
+criterion.
 
 ## Reference execution — what actually runs
 
-Screenplay supplies a framework-neutral reference path: no Arc, no Chronicle, no
-database, no filesystem, no network. It executes against an immutable in-memory
-world so every downstream target has one normalized behavior to match.
-
-> The minimum evaluator currently admits the RegisterProject-style vertical:
-> `not empty` validation, unconditional event production, one affected read-model
-> instance, optional snapshot lookup, and exact ordered specification results.
-> Unsupported reachable capabilities **block plan creation** rather than producing
-> a partial or stubbed execution.
-
-A rejected execution returns the unchanged world. An accepted one commits its
-facts and projected state once, then evaluates the requested queries against that
-state.
-
-⚠️ **`for <event-source-value>` is reserved for ESM v2.** The parser, printer and
-syntax tree preserve it, but ESM v1 binding reports blocking diagnostic
-`PLAY0268`. It cannot execute or render silently. Avoid it in a model that must
-run today.
+Screenplay's reference runner executes specifications against an immutable
+in-memory world: no Arc, no Chronicle, no database, no network. Every downstream
+target has one normalized behavior to match.
+
+- It runs the capabilities the execution plan admits: declarative validation
+  and `require` over command properties, conditional production, literal tags,
+  declarative policies, `unique` constraints, and projections as Chronicle
+  lowers them. The `cratis-screenplay-model-authoring` language reference lists
+  what binds and what the plan admits.
+- Binding is not admission. These projection constructs bind, but the plan
+  refuses them: a projection-level `remove via join`; `all` beside removals,
+  `children` or `nested`; a `join`, `children` or `remove via join` inside
+  `nested`; and any `$eventContext.<path>` other than `eventSourceId`, such as
+  `$eventContext.occurred`. The limits apply at every ESM version.
+- A specification that needs **opaque code** — a bodied reducer, a rule with a
+  body, a fenced `validate` block, a code policy — returns **unsupported** and
+  never passes. Authorization is evaluated first, so a `then denied` case still
+  runs when a portable policy decides it. Other specifications in the model run
+  normally.
+- Unsupported reachable declarative constructs block the whole execution plan
+  rather than running partially: no specification in the model runs, including
+  the ones that never touch the refused construct.
+- Reactions never run, not even after `when append`.
+- A rejection leaves the world unchanged; an accepted action commits once, then
+  the read models and queries are compared.
+
+Unsupported is not passed. Report it as "needs a target", not as green.
 
 ## Quality checklist
 
@@ -183,24 +264,29 @@ For every specification:
 
 For command specifications:
 
-- [ ] `given` contains only events, each with all its fields.
-- [ ] `when` contains exactly one command with all its inputs.
+- [ ] Every `given` event and the `when` command state all required fields.
+- [ ] `given caller` is present whenever the command is authorized, with a
+      `then denied` case for a caller who must be refused.
 - [ ] `then` contains **either** events **or** an error, never both.
+- [ ] A collision between two event sources uses `for` on the `given` event.
 - [ ] Error cases test business rules, not format validation.
 
 For view specifications:
 
-- [ ] `given readmodel` is the complete state before.
-- [ ] `then readmodel` is the complete state after.
+- [ ] `given readmodel` is a complete instance with its identifier.
+- [ ] `then readmodel` states the identifier and the properties that matter; add
+      `exactly` only when extra properties must fail the assertion.
 - [ ] No error cases — views cannot reject.
 
 ## Verify
 
 - [ ] `screenplay <model> --warnaserror` reports zero errors and zero warnings.
+- [ ] Executable diagnostics are clean too: `PLAY0350`, `PLAY0352`, `PLAY0388`,
+      `PLAY0389` and `PLAY0273` are only reported at binding.
 - [ ] Every slice has at least one boundary specification.
-- [ ] The rejections are specified, not only the happy path.
+- [ ] The rejections and denials are specified, not only the happy path.
 - [ ] No `given`/`when`/`then` clause names an element the model does not declare.
-- [ ] No `for <event-source-value>` in a model that must reach a runtime.
+- [ ] An unsupported run is reported as unsupported, never as passing.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-specifications/verification.json

@@ -21,7 +21,19 @@
     },
     {
       "kind": "skill-contains",
-      "value": "PLAY0268"
+      "value": "**Authorized commands and queries need `given caller`**"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "only the asserted properties must match"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "Unsupported is not passed."
+    },
+    {
+      "kind": "skill-contains",
+      "value": "Bare `then error` never matches\n  a denial"
     }
   ]
 }