@cratis/pi 7.21.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -28,10 +28,15 @@ identity, effect and pending-work contract at that point; do not postpone it to
   4.66.0). Probed on 3.28.2: the complete examples are `executableReady`. A cratis bundle before 3.28.2
   (4.60.1) reports PLAY0268 at binding: report "V3 blocked: PLAY0268 (ESM v6)" and
   name the tool, never remove them.
-- No MCP tool, `validate` or render runs Automation or Translate specs. V4 is "not run: no route".
-- Stage 4.24.2 (bundled in cratis 3.28.3) renders no Automation or Translate slice (Stage#79); `cratis render` refuses the whole v6 model with STAGE-ESM-016: the whole automation is
-  gap-fill or hand-written delivery with the model as contract (`references/realization-and-gap-fill.md`).
-- Invoked commands run with no caller; `.play` cannot name an actor (Screenplay#383).
+- Standalone 4.125.0 runs admitted scenarios through `screenplay test` or MCP
+  `run-specifications`; source validation and render publication do not run V4.
+- Stage 4.51.3 refuses Automation/Translate members with STAGE-ESM-024; its direct
+  planner audits through v7. Deliver that scope as authorized gap-fill
+  (`references/realization-and-gap-fill.md`).
+- Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
+  Without it the invoke has no caller. CLI 3.41.0's 4.114.0 compiler rejects the
+  new syntax (PLAY0137). Checked model/diagnostics: captures-and-reactions
+  `references/invocation-identity.md`.
 
 ## Effect guarantees and recovery traps
 | Guarantee | What it promises | What can show it |
@@ -54,7 +59,8 @@ sends again.
 A field left out of `map` still passes through the capture's working record: omission is not
 redaction. Check the append mappings and every resulting event property, and record whether
 the target stores raw or last-seen source records and how they are minimized.
-Personal data kept in events needs `@pii` on its concept and a purpose; keep the annotation
+Personal data kept in events needs bare `pii` on its concept and a declared purpose
+(see command-surface `references/compliance.md`); keep the marker
 even when it blocks binding. Never record bearer tokens, magic links or signed URLs as facts
 (a keyed hash or reference at most), and never put PII on the event-source id.
 
@@ -113,12 +119,20 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
    supersession), the work-item key and the recovery path. Direct reaction only for an immediate,
    internal, always-possible effect; say why no pending state is needed. A translation is not
    automatically infallible.
-4. **Effect and actor.** `produces <Fact>` when nothing should refuse the fact. `invokes <Command>`
-   when the step is a decision that may reject; it carries **no caller**, so gated commands reject it.
-   Record one actor decision: internal ungated command (only when safe and unreachable), direct
-   `produces`, or gated command with a trusted actor and the capability gap (Screenplay#383). The code
-   realization of the actor is a reactor with `[ExecuteCommandsAsSystem("<role>")]` and a policy
-   requiring that role; never invent `runs as`. Never strip authorization to pass a tool.
+4. **Effect and actor.** `produces <Fact>` records a decided fact; `invokes <Command>`
+   requests a decision. Keep its gate and declare the trusted role with reaction
+   `runs as system role "<Role>"` (ESM v10). An undeclared actor remains caller-less.
+   CLI/Stage realization is a separate gap; a returned-command reactor uses
+   `[ExecuteCommandsAsSystem("<role>")]` and the matching policy. Never strip a
+   gate or supply `given caller` as a fictional reaction identity. Arc supplies a
+   system principal only to reactors marked `[ExecuteCommandsAsSystem]`; without
+   it there is no principal and `[Authorize]`/`[Roles]` deny. `runs as` covers returned
+   or invoked commands, not imperative pipeline calls, reads, productions or causation.
+   On Screenplay 4.127.0 run `--check privilege --warnaserror` (PLAY0652) for
+   confused-deputy paths: every trigger-event producer must require **all** declared
+   system roles. Ungated commands/captures/reaction productions warn; opaque gates
+   are information, not proven safe. An OR alternative does not require a role.
+   Clock/application triggers have no producer and are silent; still review trust.
 5. **Trace inputs.** Every trigger value, command input, event property and destination needs a
    supported source; every filter a business reason. Gaps are questions, not invented mappings.
 6. **Repetition and termination.** Identify one logical work occurrence and what a retry is. Guard the
@@ -135,12 +149,13 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 ## Rules
 **Compiler contracts** (diagnostics at 4.66.0)
 - No inline `produces event` in a reaction (PLAY0474); declare reaction-produced events in the slice.
-- Effects sit under a trigger; only `description` and `where` are reaction-level; one `where` per
+- Effects sit under a trigger; `description`, `where` and current `runs as` are reaction-level; one `where` per
   reaction (PLAY0252); a trigger may not repeat (PLAY0253).
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
 - Capture `when` cannot mix `and` and `or` (PLAY0089). A capture without `key` does not bind.
-- Undeclared events in capture `append` and `remove with` pass V1 and fail only at binding (V3, PLAY0273): run V3.
+- Current V1 warns on undeclared capture/removal events (PLAY0166); V3 remains a
+  separate binder check.
 - A trigger with `reads` that `produces` directly fails binding: decide in a command. `reads` never protects.
 - An authorized command exercised in a spec without `given caller` is PLAY0389 at binding.
 - A list query (`=> Item[]`) and a clock sweep that iterates items do not bind; show them only as marked
@@ -155,7 +170,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
   record. A fan-out records one outcome per item; partial success is failure at an effect boundary
   (`cratis-engineering-effect-boundaries`), never a batch "done" while members failed.
 - Infrastructure (logging, caching, retries, outbox plumbing) is never a Translate slice.
-- Personal data kept in events needs `@pii` on its concept; keep it even when it blocks binding or render.
+- Personal data kept in events needs `pii` on its concept; keep it even when it blocks binding or render.
 - Code bodies (`file`, inline fences) document realization; no local engine runs them.
 
 **Review questions**
@@ -175,7 +190,8 @@ Never report a verdict without the tool and version that produced it.
 
 ## Verify
 - V1 and V3 per `cratis-screenplay-toolchain`, each with tool and version. On a cratis before 3.28.2
-  bundle report "V3 blocked: PLAY0268 (ESM v6)"; on 4.66.0 (standalone or cratis 3.28.2) these slices bind. V4 is "not run: no route" for these slices.
+  bundle report "V3 blocked: PLAY0268 (ESM v6)". Current admitted scenarios use
+  standalone `screenplay test`/MCP for V4; unsupported or unbound is not passed.
 - For each external source and type: its translation, or an explicit out-of-scope reason; check
   target-field completeness as well as source-field dispositions.
 - One happy path is not coverage: cite the spec or the missing case for each branch, denial, competing

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -11,8 +11,8 @@ technique: partial work stays visible and nothing is skipped because it looked r
 
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
-answers. `blocked` names the capability gap (for example Screenplay#383 for the actor, or a
-list query that does not bind) with the intended behaviour.
+answers. `blocked` names the actual capability gap (for example CLI 3.41.0's
+older compiler cannot parse a declared ESM v10 reaction actor) with intended behavior.
 
 ## Per translation (capture or translator reaction)
 | Source and type | Location | Correlation | Field dispositions | Target fields traced | Dedup and ordering | Trust boundary | Recovery owner | Named cases | Result |
@@ -45,4 +45,5 @@ never skip it silently or call the chain complete.
 | Unreviewed | `RecordCompletion` denial for a non-coordinator is specified; query authorization not in scope | stated |
 
 Then the verdict line per `cratis-screenplay-toolchain`: tool and version on each of V1 to V4
-(V4 for these slices: "not run: no route").
+(V4 uses standalone `screenplay test` or MCP `run-specifications`; report the
+actual result, or a specific host/input limitation if not run).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -65,16 +65,17 @@ When a todo list is not needed: the effect is immediate, internal and cannot fai
 | can it be refused? | only by append-time constraints | authorization, validation, `require`, constraints |
 | destination | `for` value; without `for`, the trigger fact's source | the command's identifier |
 | with trigger `reads` | fails binding (unprotected decision) | allowed; protection is the command's job |
-| caller | n/a | **none**: gated commands reject |
+| caller | n/a | declared reaction `runs as` actor (ESM v10), otherwise none |
 
 ## 4. The actor behind an invoke
-On Screenplay 4.66.0 there is no caller: the invoked command runs its full pipeline (authorization, validation,
-requirements, constraints) with no caller, a command that needs one rejects, and the rejection
-ends the scenario. Screenplay has no syntax for an identity (Screenplay#383, open); never invent
-`runs as` or a caller line. At code level the realization is a Chronicle reactor whose returned
-commands run as a trusted system actor: `[ExecuteCommandsAsSystem("<role>")]` (Arc, since
-v20.56.0; also in a Stage-rendered app, whose Arc is 22.25.0) with a policy that requires that
-role. Record the intended actor in the model; the attribute lives in gap-fill code.
+Screenplay 4.125.0 declares the actor with reaction-level `runs as system role
+"<Role>"` (ESM v10); without it a gated invocation has no caller and denies.
+`given caller` is not an invocation actor. Role requirements remain enforced;
+claim conditions for this system principal remain unknown. CLI 3.41.0's older
+compiler rejects the syntax (PLAY0137), and Stage 4.51.3 admits through v7 only.
+Use the checked model in captures-and-reactions `references/invocation-identity.md`.
+Arc gap-fill uses `[ExecuteCommandsAsSystem("<role>")]` for returned commands,
+not identity inferred from prose or an imperative pipeline call.
 
 Decide and record one of:
 1. **Internal ungated command** - only if the security design supports it: not reachable by
@@ -84,13 +85,10 @@ Decide and record one of:
    requirement in `STATE.md`.
 2. **Direct `produces`** - when no decision is left (the fact is already decided) and nothing
    should refuse it.
-3. **Gated command + trusted actor + recorded gap** - when the command must stay protected.
-   Keep the gate (a policy requiring the service role), name the role as the intended actor,
-   and record that Screenplay 4.66.0 cannot declare it. The reference rejects the caller-less invoke,
-   so the automation spec cannot pass: do not write a fake passing spec. Report V4 as "not run:
-   no route" (no available route executes these specs) and record the expected rejection and
-   the trusted-actor gap separately, citing the reaction semantics (a command that requires a
-   caller rejects the reaction).
+3. **Gated command + declared trusted actor** - keep the service-role policy and
+   declare matching `runs as system role` on the reaction. Reference-test the
+   scenario with standalone 4.125.0; separately record CLI/Stage target refusal.
+   A missing actor must not be excused by removing the gate or inventing a caller.
 Never remove an existing gate only to make a reaction spec pass.
 Omitting an HTTP route is not an authorization proof: the exposure requirement stays a target
 requirement with its negative case (an outside caller is refused).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -16,7 +16,7 @@ One spec in the slice does not cover the others.
 | queue opens / closes | item appears, item disappears | `then query …ById`; `when append <Closing>` + `then no readmodel … for` |
 | already done | trigger re-delivered after the result exists | `given <Result>` + `when <Command>` -> `then error "<fixed constraint message>"` |
 | invoked command rejects | validation or constraint refuses | command spec in its StateChange slice; record what the queue shows afterwards |
-| no caller | invoked command is gated | record the expected rejection and the actor decision (`automation-patterns.md` §4); V4 is "not run: no route" |
+| no declared actor | invoked command is gated | specify its denial; for the trusted path declare reaction `runs as system role` and reference-test with standalone 4.125.0 |
 | clock boundary | due exactly at the instant, just before, just after | `given clock` + `when clock`; boundary semantics are contested in the docs, mark the expectation as an assumption |
 | each branch | does every filter and conditional production have both outcomes? | concrete triggering and non-triggering values; assert the resulting facts or view |
 | denied actor | every command and query under an inherited module/feature `authorize` needs its own denial; also, can an unauthorized caller reach a gated invoked command by another origin? | command spec with otherwise-valid inputs, `given caller` carrying the wrong role/claim (or no caller) and `then denied`; separate from the caller-less reaction gap |
@@ -58,9 +58,9 @@ One spec in the slice does not cover the others.
   The decision must not depend on it (it is not protected).
 
 ## Spec limits (tool differences: `cratis-screenplay-toolchain` `references/versions.md`)
-- These Automation/Translate specs parse and bind (V3) on Screenplay 4.66.0, but no MCP tool,
-  `validate` or Stage render runs them (Stage renders no Automation or Translate slice). Report
-  V4 as "not run: no route"; never as passed.
+- Current admitted Automation/Translate specifications run through standalone
+  `screenplay test` or MCP `run-specifications`. Validate/render alone is not V4;
+  report unsupported/unbound separately from passing scenarios.
 - With Screenplay 4.66.0 (standalone or cratis 3.28.2), a command spec lists the cascade (v6 semantics: after
   `when <Command>`, `then` lists every new fact, including reaction appends). Only when a
   cratis before 3.28.2 bundle (4.60.1) is the V1 tool does it report a false PLAY0285 on a cascade (cli#242):

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/effects-and-idempotency.md

@@ -25,6 +25,27 @@ or reaction. Choose and record one of:
 Payments, legal notices and anything costly or irreversible: prefer 2 or 3 and an idempotency
 key; write a reconciliation case.
 
+## Refusal disposition and redelivery
+
+At Screenplay 4.125.0 an invocation can state ordered `on refused` selectors for
+validation, constraint (optionally named) or explicit authorization denial.
+Bare refusal does not include authorization. A matching branch declares a fact
+or leaf `acknowledge`; `$refusal.reason`/`.message` are String details and
+`.constraint` belongs only to constraint selectors. This is **authoring-only**
+(PLAY0268), not evidence that a duplicate was safely acknowledged at runtime.
+
+Recovery syntax `when redelivered <Event> to <Reaction>` selects exactly one
+existing given occurrence; it is not append or replay. `then no events` makes a
+no-new-facts contract explicit but remains unadmitted too. Full selectors,
+occurrence matching and checked source examples: captures-and-reactions
+`references/refusals-and-redelivery.md`.
+
+Infrastructure/contract errors, Unsupported and concurrency are never domain
+refusals. No `by concurrency` exists: fail/retry transient contention. Record the
+actual target's disposition, trusted actor, durable delivery identity and external
+idempotency/reconciliation owner. A branch or observer receipt alone proves no
+cascade transaction or exactly-once external effect.
+
 ## Retry identity
 - The retry must carry the same identity as the first attempt: the stream id chosen before
   the first try (never a fresh id per attempt), and the same idempotency key outward.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/provenance.md

@@ -40,5 +40,7 @@ Changes in this version: the examples are complete fenced documents that compile
 example's anonymous-booking spec gained the `given caller` PLAY0389 requires; the todo-list
 example's list query, `reads` and retry sweep moved to marked design-only excerpts so the core
 binds); tool-qualified verdict text; the trusted-actor text now names `[ExecuteCommandsAsSystem]`
-(Arc v20.56.0, available in a rendered app's Arc 22.25.0) and Screenplay#383; Stage renders no
-Automation or Translate slice (Stage#79).
+(Arc v20.56.0). Current actor syntax was reverified at Screenplay v4.125.0
+`reactions.md`, `ReactionIdentityParser.cs`, `ReactionRefusalValidator.cs` and the
+binder's v10 selection; the checked scenario passes reference execution. CLI
+3.41.0's older parser and Stage 4.51.3's v7 planner remain target limits.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/todo-list-example.md

@@ -13,7 +13,8 @@ The first spec lists the whole cascade (`then` names every new fact: `CoursePass
 `CertificateSent` through the reaction), and `given clock` supplies the instant that
 `$context.occurred` needs. Both 4.66.0 tools accept that cascade; the cratis 3.27.1 bundle reported a false PLAY0285 on it
 (cli#242). These specs were not
-run (V4: not run, no route); the expectations follow the v4.66.0 reference semantics.
+run in that historical probe; current admitted scenarios can be run with
+standalone `screenplay test` or MCP `run-specifications`.
 
 What the model proves and what it does not:
 
@@ -22,8 +23,10 @@ What the model proves and what it does not:
 - Not proven: that the certificate email reaches the person once. See
   `references/effects-and-idempotency.md`.
 - The actor behind `SendCertificate` is a recorded security decision in the `Certification`
-  module `description`, because reaction invocations carry no caller on Screenplay 4.66.0 (Screenplay#383).
-- No local engine runs Automation specifications: report them as authored, not as run.
+  module `description`: this example declares no reaction identity, so its
+  invocations remain caller-less. A gated trusted path can instead declare
+  `runs as system role` on 4.125.0 (ESM v10), with separate CLI/Stage refusal.
+- Report reference outcomes only after executing the selected scenarios.
 
 ```screenplay
 // Todo-list automation. Shape: CoursePassed opens an item -> CertificateSender invokes
@@ -101,7 +104,7 @@ module Courses
           for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
 
 module Certification
-  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and record the capability gap instead (reaction invocations carry no caller: Screenplay#383)."
+  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and declare runs as system role on the reaction (ESM v10), retaining the CLI/Stage realization gap."
   feature Certificates
     slice StateView CertificatesToSend
       description "Work queue: membership means 'still to send'; there is no status flag"

package/package/corpus/skills/cratis-screenplay-automations-and-translations/verification.json

@@ -4,13 +4,13 @@
   "fixtures": [],
   "assertions": [
     { "kind": "skill-contains", "value": "`[ExecuteCommandsAsSystem(\"<role>\")]`" },
-    { "kind": "skill-contains", "value": "Screenplay#383" },
-    { "kind": "skill-contains", "value": "renders no Automation or Translate slice" },
-    { "kind": "skill-contains", "value": "never invent `runs as`" },
+    { "kind": "skill-contains", "value": "ESM v10" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-024" },
+    { "kind": "skill-contains", "value": "runs as system role" },
     { "kind": "skill-contains", "value": "**One meaning of Translation:**" },
     { "kind": "skill-contains", "value": "complete, open or blocked" },
     { "kind": "skill-contains", "value": "never write a mapping" },
-    { "kind": "skill-contains", "value": "V4 is \"not run: no route\"" },
+    { "kind": "skill-contains", "value": "run-specifications" },
     { "kind": "skill-contains", "value": "never skipped silently" },
     { "kind": "skill-contains", "value": "not applicable: no queue" }
   ]

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -32,16 +32,10 @@ source is the single flow model.
 | `Cratis.Screenplay` | main `fd18129` | Command-only inline event boundary |
 | `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6: reactions, clock, trigger and capture specifications bind; `invokes` caller rule; probed with the standalone tool and its MCP server |
 
-The update follows `commands.md`, `events.md` and `diagnostics.md` at that main
-commit (after v4.52.0).
-
-Historical baseline evidence: the original examples were checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
-`Documentation/screenplay/{captures,captures/grammar,reactions,triggers,interactions,file-references,grammar,diagnostics}.md`
-and decisions 0003, 0006 and 0009; those original examples compiled with that
-version's compiler. The specification actions and ESM v6 text were checked at
-`v4.66.0` (see its row above), and the complete examples here and in
-`references/complete-examples.md` compile with the standalone 4.68.0 compiler.
-Reverify before claiming another version behaves the same.
+The table records historical examples/probes; they are not reclassified as
+current execution evidence. Refusal/redelivery guidance follows released
+v4.125.0 `reactions.md`/`specifications.md`. Current pins are in toolchain
+`references/versions.md`; reverify before promoting an old probe to that version.
 
 ⚠️ **Which tool admits them depends on its Screenplay version.** The ESM level
 decides, not the slice type:
@@ -50,14 +44,10 @@ decides, not the slice type:
   `Translate` slices, reactions, declared triggers and captures bind, and the
   reference runner executes them. Probed: the complete example below is
   `executableReady` over `screenplay mcp`.
-- **`cratis` 3.28.2 (bundles Screenplay 4.66.0, ESM v1-v6):** the same as the standalone
-  tool. Probed: the complete examples validate with warnings as errors and are
-  `executableReady` over `cratis screenplay mcp`. `cratis` before 3.28.2 (Screenplay
-  4.60.1, ESM v1-v5) failed an `Automation` or `Translate` slice at binding with `PLAY0268`
-  (*Slice '<name>' of type '<type>' is not admitted by ESM v1*), reported reactions as
-  *requires portable occurrence and effect semantics* and captures as *require a portable
-  compiled CDL plan*, and gave a false `PLAY0285` on a specification that follows a reaction
-  cascade (Cratis/cli#242).
+- **Historical CLI 3.28.2 / Screenplay 4.66.0 probe:** complete examples validated
+  and were executableReady through MCP. Earlier 4.60.1 bundles refused v6 at
+  binding and falsely reported PLAY0285 on cascades. Toolchain `references/versions.md`
+  separates that history from current pins.
 - **Stage 4.24.2** admits ESM v1-v4 and renders no `Automation` or `Translate`
   slice. The automation is gap-fill, with the `.play` slice and its specifications
   as the contract: `cratis-screenplay-render-and-gap-fill`.
@@ -69,25 +59,27 @@ Method (the four-part automation test, loops, translations versus automations):
 
 ## Specify what sets them off
 
-A specification names what sets the automation off: `when clock`, `when trigger` or `when capture`. No command runs these specifications; report one as authored, not executed.
+A specification names what sets the automation off: `when clock`, `when trigger`
+or `when capture`. Execute admitted scenarios through `screenplay test` or MCP
+`run-specifications`; source compilation alone is only authored evidence.
 
 Read [references/specifying-triggers-and-clock.md](references/specifying-triggers-and-clock.md) when writing a specification for a reaction, trigger or capture, or when the clock, occurrence or limit rules matter.
 
 ## Caller-less invokes and unprotected reads
 
-**Who is the caller of an `invokes`?** Nobody. In the reference execution the invoked
-command runs its full pipeline - authorization, validation, requirements,
-constraints - **with no caller**; a command that needs one rejects, and the
-rejection ends the scenario. Each invoked command is atomic, but the cascade is not,
-so facts accepted earlier remain. There is no syntax for a trusted identity in the verified Screenplay versions
-(Screenplay#383, open): never invent `runs as` or a `given caller` for a reaction.
-Say so in the model: a `description` on the reaction that names the trusted actor
-the target must use. At code level a rendered or hand-written target runs such a
-command as the system with `[ExecuteCommandsAsSystem]` (Arc 20.56.0 and later, so
-also in a rendered application's Arc 22.25.0). An authorized command a reaction
-invokes needs that decision made explicit, in the model's description and in the
-gap-fill code, not left to a rejection nobody expected. Cascades and their
-specification limits: `cratis-screenplay-specifications`.
+**Who is the caller of an `invokes`?** Without a declared actor, nobody.
+Screenplay 4.125.0 supports reaction-level `runs as system role "<Role>"`
+(optional roles, joined with `and role`). It selects ESM v10 and supplies the
+reference invocation's authenticated system principal with exactly those roles;
+`given caller` does not supply it. Keep gates and declare the least-privilege actor.
+Read [invocation identity](references/invocation-identity.md) for the checked
+scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
+
+CLI 3.41.0's 4.114.0 compiler rejects this source with PLAY0137; its version gate
+and Stage 4.51.3 planner admit only through v7. Target realization is gap-fill,
+using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
+Arc supplies no principal and `[Authorize]`/`[Roles]` deny. Each invoked command
+is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 
 ⚠️ **Declared, not enforced.** A trigger `reads` gives no runtime protection. From
 ESM v6 the binder refuses to treat it as one: a trigger with `reads` that **produces
@@ -101,9 +93,19 @@ the input selection or not; nested paths and read aliases fail binding): keep th
 the invoked command or the implementation. Under `cratis` before 3.28.2 none of this
 bound at all (`PLAY0268`); `cratis` 3.28.2 binds it like the standalone tool.
 
+## Refusals and recovery redelivery
+
+At 4.125.0, invocation refusal selectors, `$refusal` branch values,
+`acknowledge`, `when redelivered ... to ...` and `then no events` are valid
+authoring intent but refuse binding with PLAY0268. Read
+[refusals and redelivery](references/refusals-and-redelivery.md) for first-match
+selectors, typed values, occurrence matching, diagnostics and the checked
+unbound example. Never acknowledge infrastructure or concurrency failures.
+
 ## Complete example (ESM v6)
 
-One document with every construct (application trigger, reactions on an event, a trigger, a view read and the clock, and a capture with specifications) is kept in the reference file.
+The reference document covers v6 triggers, event/clock reactions, view reads and
+capture specifications. Refusal/redelivery forms use their separate checked reference.
 
 Read [references/complete-examples.md](references/complete-examples.md) when you need a complete, compiling parent document for an excerpt or want to check the authoring and binding prerequisites.
 
@@ -176,7 +178,7 @@ optional.
 
 ⚠️ **Indentation decides what is a trigger and what is an effect.** `produces`,
 `invokes`, `file` and inline code belong **inside** the trigger block, indented
-under `when`/`every`/`at`. Only `description` and `where` sit at reaction level.
+under `when`/`every`/`at`. `description`, `where` and `runs as` sit at reaction level.
 Outdenting an effect gives *Expected a trigger in reaction body, got 'invokes …'*
 (`PLAY0137`) — the compiler is looking for another trigger where the effect is.
 
@@ -238,7 +240,7 @@ append-time constraints. `invokes` asks for a command, which additionally runs t
 command's authorization, validation and requirements, and may reject.
 Using `produces` for both would say those are the same kind of consequence.
 
-**Who is the caller of an `invokes`?** Nobody; see *Caller-less invokes and unprotected reads* above before writing one.
+**Who is the caller of an `invokes`?** Nobody unless `runs as` declares the actor; see *Caller-less invokes and unprotected reads* above before writing one.
 
 Both are declarations of *what happens*, not of how — a trigger can state its
 consequences **and** carry a `file` or an inline block in a tagged fence
@@ -338,7 +340,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       `PLAY0268` at binding and a false `PLAY0285` on cascade specifications, and report them
       as tool skew.
 - [ ] The tool that bound the model is named (Screenplay 4.61 or later, so standalone or
-      `cratis` 3.28.2 or later, for ESM v6 constructs); no tool runs the specifications.
+      `cratis` 3.28.2 or later, for ESM v6 constructs); reference scenarios use
+      `screenplay test`/MCP. Unadmitted refusal/redelivery is not executed evidence.
 - [ ] Each automation has all four components — occurrence, state consulted,
       conditional logic, resulting command or event. If it always fires
       unconditionally it is co-production, not an automation.
@@ -351,8 +354,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       value the trigger takes, and clock triggers read without `by`.
 - [ ] Nobody reports trigger or command `reads` as protected; UI clicks are
       interactions, not triggers.
-- [ ] Every `invokes` of an authorized command names the trusted actor in a
-      description; no caller is invented for a reaction.
+- [ ] Every gated invocation declares its trusted actor with reaction `runs as`
+      (ESM v10) or records the target gap explicitly; `given caller` is not that actor.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/complete-examples.md

@@ -97,7 +97,7 @@ module Delivery
 
 ## Reaction with `produces` and `invokes`
 
-Parent of the `Provisioner` excerpt. The invoked command runs with no caller in the
+Parent of the `Provisioner` excerpt. The reaction declares no `runs as system`, so the invoked command runs with no caller in the
 reference execution.
 
 ```screenplay

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/invocation-identity.md

@@ -0,0 +1,84 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Declare the actor behind a reaction invocation
+
+## Contents
+
+- Trusted system identity
+- Checked example
+- Diagnostics and target boundaries
+
+## Trusted system identity
+
+Screenplay 4.125.0 supports one reaction-level line
+`runs as system [role "<Role>" and role "<Role>"]`. Roles are optional, nonempty,
+distinct quoted literals; personas and expressions are not accepted. Put it
+under the reaction, not its trigger or invocation. The declaration selects
+**ESM v10**. Without it, invocations remain caller-less; `given caller` never
+supplies an actor to a reaction.
+
+The reference evaluator authenticates a system principal with exactly the stated
+roles. Claim conditions remain unknown, including under not; a satisfied role
+alternative may allow, but final unknown denies. This is not the caller's audit
+identity and does not invent Arc's system subject claims. The identity covers
+invoked/returned commands across that reaction's triggers, not imperative
+pipeline calls in bodies, direct productions, reads, refusal productions or
+causation. Record the actual least-privilege role, not a prose-only actor or an
+ungated command substituted to make the scenario pass.
+
+## Checked example
+
+This complete model compiled with warnings as errors and its reference scenario
+passed on standalone Screenplay 4.125.0:
+
+```screenplay
+policy Worker
+  require role "Worker"
+module Work
+  feature Processing
+    slice StateChange RecordWork
+      command RecordWork
+        workId String identifier
+        authorize Worker
+        produces event WorkRecorded
+    slice Automation ProcessWork
+      event WorkRequested
+        workId String
+      reaction Processor
+        runs as system role "Worker"
+        when WorkRequested
+          workId
+          invokes RecordWork
+            workId = workId
+      specification ProcessingRequestedWork
+        when append WorkRequested
+          workId = "work-1"
+        then WorkRecorded
+          for "work-1"
+```
+
+## Diagnostics and target boundaries
+
+- PLAY0647: malformed, repeated or misplaced identity, including duplicate/empty roles.
+- PLAY0648: gated invocation without declared identity and without an authorization
+  refusal branch. PLAY0557 instead warns on that refusal branch; it cannot turn
+  an always-denied caller-less invocation into a trusted path.
+- PLAY0649: identity with neither invocations nor an implementation body.
+- C# binding PLAY0650/0651 warns about unused roles or definite authorization
+  denial; opaque/unknown cases are not guessed. `--check privilege` (PLAY0652)
+  reviews whether event producers require every elevated role, not runtime safety.
+
+CLI 3.41.0 bundles Screenplay 4.114.0, which does not parse `runs as`: the example's
+`cratis screenplay validate --executable --warnings-as-errors` returns PLAY0137,
+exit 5. It cannot render this source. Its render version gate separately admits
+only through v7 (CLI-RENDER-004 for newer admitted compiler output), while Stage
+4.51.3's direct planner audits through v7 and refuses v10 with STAGE-ESM-016.
+Clock/application-trigger identities have no Stage Arc realization either.
+Use authorized gap-fill with the model as contract; returned-command Arc identity
+uses `[ExecuteCommandsAsSystem]`, never permission inferred from a model header.
+Refusal/redelivery syntax remains unadmitted even when identity itself runs.
+
+Authority: Screenplay v4.125.0 `reactions.md`, `ReactionIdentityParser.cs`,
+`ReactionRefusalValidator.cs`, `SemanticModelBinder.cs`; CLI v3.41.0
+`RenderedSemanticVersions.cs`; Stage v4.51.3 `SemanticCratisAdmission.cs`.