@cratis/pi 7.22.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -59,7 +59,8 @@ sends again.
 A field left out of `map` still passes through the capture's working record: omission is not
 redaction. Check the append mappings and every resulting event property, and record whether
 the target stores raw or last-seen source records and how they are minimized.
-Personal data kept in events needs `@pii` on its concept and a purpose; keep the annotation
+Personal data kept in events needs bare `pii` on its concept and a declared purpose
+(see command-surface `references/compliance.md`); keep the marker
 even when it blocks binding. Never record bearer tokens, magic links or signed URLs as facts
 (a keyed hash or reference at most), and never put PII on the event-source id.
 
@@ -123,7 +124,15 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
    `runs as system role "<Role>"` (ESM v10). An undeclared actor remains caller-less.
    CLI/Stage realization is a separate gap; a returned-command reactor uses
    `[ExecuteCommandsAsSystem("<role>")]` and the matching policy. Never strip a
-   gate or supply `given caller` as a fictional reaction identity.
+   gate or supply `given caller` as a fictional reaction identity. Arc supplies a
+   system principal only to reactors marked `[ExecuteCommandsAsSystem]`; without
+   it there is no principal and `[Authorize]`/`[Roles]` deny. `runs as` covers returned
+   or invoked commands, not imperative pipeline calls, reads, productions or causation.
+   On Screenplay 4.127.0 run `--check privilege --warnaserror` (PLAY0652) for
+   confused-deputy paths: every trigger-event producer must require **all** declared
+   system roles. Ungated commands/captures/reaction productions warn; opaque gates
+   are information, not proven safe. An OR alternative does not require a role.
+   Clock/application triggers have no producer and are silent; still review trust.
 5. **Trace inputs.** Every trigger value, command input, event property and destination needs a
    supported source; every filter a business reason. Gaps are questions, not invented mappings.
 6. **Repetition and termination.** Identify one logical work occurrence and what a retry is. Guard the
@@ -140,7 +149,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 ## Rules
 **Compiler contracts** (diagnostics at 4.66.0)
 - No inline `produces event` in a reaction (PLAY0474); declare reaction-produced events in the slice.
-- Effects sit under a trigger; only `description` and `where` are reaction-level; one `where` per
+- Effects sit under a trigger; `description`, `where` and current `runs as` are reaction-level; one `where` per
   reaction (PLAY0252); a trigger may not repeat (PLAY0253).
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
@@ -161,7 +170,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
   record. A fan-out records one outcome per item; partial success is failure at an effect boundary
   (`cratis-engineering-effect-boundaries`), never a batch "done" while members failed.
 - Infrastructure (logging, caching, retries, outbox plumbing) is never a Translate slice.
-- Personal data kept in events needs `@pii` on its concept; keep it even when it blocks binding or render.
+- Personal data kept in events needs `pii` on its concept; keep it even when it blocks binding or render.
 - Code bodies (`file`, inline fences) document realization; no local engine runs them.
 
 **Review questions**

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -77,7 +77,8 @@ scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
 
 CLI 3.41.0's 4.114.0 compiler rejects this source with PLAY0137; its version gate
 and Stage 4.51.3 planner admit only through v7. Target realization is gap-fill,
-using Arc `[ExecuteCommandsAsSystem]` for returned commands. Each invoked command
+using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
+Arc supplies no principal and `[Authorize]`/`[Roles]` deny. Each invoked command
 is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 
 ⚠️ **Declared, not enforced.** A trigger `reads` gives no runtime protection. From
@@ -177,7 +178,7 @@ optional.
 
 ⚠️ **Indentation decides what is a trigger and what is an effect.** `produces`,
 `invokes`, `file` and inline code belong **inside** the trigger block, indented
-under `when`/`every`/`at`. Only `description` and `where` sit at reaction level.
+under `when`/`every`/`at`. `description`, `where` and `runs as` sit at reaction level.
 Outdenting an effect gives *Expected a trigger in reaction body, got 'invokes …'*
 (`PLAY0137`) — the compiler is looking for another trigger where the effect is.
 
@@ -239,7 +240,7 @@ append-time constraints. `invokes` asks for a command, which additionally runs t
 command's authorization, validation and requirements, and may reject.
 Using `produces` for both would say those are the same kind of consequence.
 
-**Who is the caller of an `invokes`?** Nobody; see *Caller-less invokes and unprotected reads* above before writing one.
+**Who is the caller of an `invokes`?** Nobody unless `runs as` declares the actor; see *Caller-less invokes and unprotected reads* above before writing one.
 
 Both are declarations of *what happens*, not of how — a trigger can state its
 consequences **and** carry a `file` or an inline block in a tagged fence

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -32,7 +32,7 @@ source is the single flow model.
 | `Cratis.Screenplay` | main `fd18129` | Inline events, repairs and canonical `optional`; changed examples compiled |
 | `Cratis.Screenplay` | `4.66.0` (`c89198b`) | Binding behaviour of `handler`, code attachments, `persona` and compliance attributes: `Semantics/SemanticModelBinder*.cs`, `Diagnostics/DiagnosticCodes.cs` |
 | `Cratis.Screenplay` | `4.68.0` (`79801bf`) | Historical generated-value/response rule probes (ESM v7) |
-| `Cratis.Screenplay` | `4.125.0` | Current source guidance: routes, operations, negation, protected identifiers and pre-generation contexts; released `commands.md`, `operations.md`, `policies.md`, `context.md`, `diagnostics.md` |
+| `Cratis.Screenplay` | `4.127.0` | Current identity and compliance guidance: released `identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`, `diagnostics.md`; changed examples compiled |
 
 Historical examples/probes retain the table's original versions; current source
 guidance is not a relabeled old execution result. Compilation checks syntax and
@@ -50,8 +50,8 @@ concept DiscountPercentage : Decimal
   validate
     >= 0    message "A discount cannot be negative"
     <= 100  message "A discount cannot exceed 100 percent"
-concept PersonName : String @pii
-  pii reason "Billing contact name; lawful basis: contract performance."
+concept PersonName : String pii
+  pii reason "Identifies the billing contact."
 concept InvoiceStatus : Enum
   draft
   sent
@@ -61,31 +61,19 @@ concept InvoiceStatus : Enum
 The seven primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 `DateTime`. `Enum` is **not** one of them — it is a separate concept kind, which
 is why the compiler says *expected … or Enum* rather than listing it among them.
-Attributes `@pii` and `@sensitive`, each with at most one `reason`; a
-reason for an attribute the concept does not declare is an error. **Compliance is
-inherited** — a property typed with a `@pii` concept is PII everywhere. The
-executable model does not bind compliance attributes (`PLAY0268`, "compliance attributes
-require portable data-subject semantics"), so a `@pii` model stops at authorable (V1);
-keep the attribute, because the classification is the point, and never drop it to bind
-or render.
-
-`@pii` is personal data (erasable); `@sensitive` is an **operational secret** (API key,
-token, a company's bank account number): encrypted at rest without erasure and withheld
-from the causation chain (Screenplay decision 0034, Screenplay#384). C# providers render
-`@sensitive` as `[Encrypted]` + `[NotAudited]`, `@pii` as `[PII]`, and `@pii @sensitive`
-as `[PII]` only, because Chronicle rejects `[PII]` with `[Encrypted]` (`CHR0053`); Stage
-renders this from v4.29.0. The executable model still stops at `PLAY0268` for either.
-
-⚠️ **Identifiers are neither `@pii` nor `@sensitive`.** Chronicle rejects `[PII]` on an
-event source id (`CHR0034`) and `[Encrypted]` on one (`CHR0052`); Screenplay reports
-`PLAY0515` for `@pii` from Screenplay 4.69.1 and for `@sensitive` from 4.84.1, on a
-command identifier, an explicit `for` destination or an event source identifier; earlier
-versions compile it silently and only Chronicle catches it. Current PLAY0515
-also covers scalar stream-id types, composite parts and nested route mapping
-sources. It is a source error, including typed destinations, not a binding-only
-warning. Keep the stream identity a surrogate `Uuid`
-concept and carry the personal value (name, email) as a separate `@pii` property and a
-secret as a `@sensitive` property.
+Use bare `pii` for personal data (`personal` is the same marker) and `secret`
+for operational secrets. **Compliance is inherited** from concepts, including
+nested uses. Either marker blocks executable binding with PLAY0268; keep the
+protection. `pii personal` is redundant and warns PLAY0653. Legacy `@pii`,
+`sensitive` and `@sensitive` remain accepted with PLAY0565 information and a repair.
+Read [compliance and purposes](references/compliance.md) for reasons, special/criminal
+qualifiers, secret scopes, provider mappings, purpose declarations and coverage checks.
+
+**Identifiers cannot be personal data or secrets.** PLAY0515 is a source error
+for command identifiers, typed `for` destinations, event-source identities,
+scalar/composite stream-id types and nested route mapping sources, including legacy
+markers. Keep a surrogate identity and carry protected data in the payload.
+Chronicle likewise rejects `[PII]`/`[Encrypted]` identifiers (CHR0034/CHR0052).
 
 ⚠️ **Enum trap.** A value literally named `validate` is read as an empty validate
 block. Write `@validate` for the value; the compiler warns when it sees the
@@ -244,8 +232,8 @@ choosing or omitting `for` on a production, or fixing `PLAY0469`-`PLAY0478`.
 
 - **Mapping sources** that bind to the executable model: a command property
   (`= invoiceNumber`), a literal (`= "draft"`, `= 0`), `$context.occurred`, and
-  the caller's audit identity (`$context.identity.id`/`.name`/`.userName`, the
-  same values as `$context.causedBy.*`). The last two select ESM v2.
+  the caller's audit identity (`$identity.id`/`.name`/`.userName`, also supported
+  as `$context.identity.id`/`.name`/`.userName`, the same values as `$context.causedBy.*`). The last two select ESM v2.
   `$context.tenant`, claims, roles, causation, `$env.` values, templates and
   computed expressions parse but block binding (`PLAY0268`).
 - **`for <identifier>`** on an indented line names the event source the event is
@@ -272,8 +260,12 @@ produces when isProForma == true
 
 ## Routes and external operations
 
-Named event sources/streams and command routes bind as ESM v8 at 4.125.0;
-CLI 3.41.0 render rejects models above v7. The complete checked route example
+Named event sources/streams and command routes bind as ESM v8 (verified at 4.125.0);
+CLI 3.41.0 render rejects models above v7. A routed command's identifier and
+known event destinations must match the source's nominal identifier type
+(PLAY0504, error). Allocation uses the generated identifier's type, or without
+one requires a UUID-based source. Composite `streamId` routes map every named
+part exactly once; scalar `streamId T` and `streamId = x` remain valid. The complete checked route example
 and nested `streamId =` form are in `cratis-screenplay-toolchain`
 `references/sources-and-streams.md`.
 
@@ -353,7 +345,15 @@ not both win — a `validate` rule cannot do that.
 A policy has **exactly one** `require` line (`PLAY0441`) **or** one implementation, never both (`PLAY0440`). Read [references/policy-persona-seed.md](references/policy-persona-seed.md) when
 declaring a policy, a persona, or a `seed` block.
 
-## `$context`
+## Event data subject
+
+One event property may carry trailing `subject`; it identifies the person whose
+data the event holds, not the stream identity. Only unprotected required scalar
+String/Uuid or String/Uuid/Int-backed concepts are allowed. The mark is report-only
+(PLAY0270), changes no ESM bytes and emits no C# `[Subject]` yet; read models are
+not supported. See [subject lineage](references/compliance.md#identify-the-person-not-the-stream).
+
+## `$context` and `$identity`
 
 Four contexts, and **what each omits is load-bearing** — when writing a code body or a context/expression mapping, read
 [context.md](references/context.md) for the full member lists, the declarative
@@ -369,7 +369,7 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
 ## Verify
 
 - [ ] Validate the complete model root with warnings as errors; name the tool,
-      version and result. Current pins: standalone 4.125.0 / CLI 3.41.0; bundle
+      version and result. Current pins: standalone 4.127.0 / CLI 3.41.0; bundle
       compatibility and execution are separate checks.
 - [ ] No unintended `PLAY0478` or `PLAY0479` information remains.
 - [ ] At most one command property carries `identifier`, and no event property does.
@@ -379,8 +379,9 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
       is stated.
 - [ ] Constraints are `unique` forms; no `file` constraint stands in for another rule.
 - [ ] Each policy has one `require` or one implementation, not both.
-- [ ] Personal data is `@pii` on the concept, with a reason; no identifier concept is `@pii`;
-      operational secrets are `@sensitive` (never `@pii`), and no identifier concept carries either.
+- [ ] Personal data is `pii` on the concept; operational secrets are `secret`;
+      no identifier or subject concept carries either. Reasons explain the value,
+      while purposes declare basis/retention; run `--check purposes` separately.
 - [ ] No `handler` where the model must bind, and no bodied construct described as
       runnable or renderable without saying which tool admits it.
 - [ ] No event carries an optional property covering two situations.

package/package/corpus/skills/cratis-screenplay-command-surface/references/compliance.md

@@ -0,0 +1,154 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Personal data, secrets and processing purposes
+
+## Contents
+
+- Classify the value on its concept
+- Declare the use separately
+- Identify the person, not the stream
+
+Authority: Screenplay v4.127.0 `concepts.md`, `purposes.md`, `events.md` and
+`diagnostics.md`; decision 0041. These declarations do not establish lawful
+processing or enforce retention. Check provider support separately.
+
+## Classify the value on its concept
+
+```screenplay
+concept Email : String pii
+  pii reason "Contact address"
+concept MedicalNote : String personal
+  personal special health
+concept ConvictionNote : String pii
+  pii criminal
+concept PartnerApiKey : String secret
+  secret scope namespace
+  secret reason "Credential for the partner API"
+```
+
+`personal` is an alias of `pii`, not a second classification; canonical printing
+writes `pii`. Write one marker. `pii personal`, `pii pii`, `secret secret` and
+`@pii @pii` report one PLAY0653 warning per header. Both compilers retain the
+first occurrence of each marker and attach body settings to it. The concept-line
+repair removes later tokens with `PreserveTrivia`, retaining notes and comments.
+
+`@pii`, `sensitive` and `@sensitive` still compile but are deprecated: one PLAY0565
+information diagnostic per line. The line/document repair migrates them to bare
+`pii`/`secret` without moving notes. `--warnaserror` does not fail on information.
+Unknown markers report PLAY0566. Never remove protection to get a model to bind.
+
+A reason is an optional free-text note about the value, not a lawful basis,
+purpose or retention policy. At most one reason per declared marker; a reason for
+an absent marker is an error. Classification is inherited through concept uses,
+including fields nested in composite types; do not put markers on properties or
+composite types.
+
+`pii special` requires one of `racialOrEthnicOrigin`, `politicalOpinions`,
+`religiousOrPhilosophicalBeliefs`, `tradeUnionMembership`, `genetic`, `biometric`,
+`health`, `sexLifeOrSexualOrientation` (GDPR Art. 9(1)). `pii criminal` records
+Art. 10 data and may coexist with `special`. These qualifiers require `pii`;
+unknown categories and repeated `special` lines are errors (PLAY0570/0571).
+A photograph alone is not biometric identification data.
+
+`secret scope` accepts `subject`, `namespace`, `global`; omitted scope retains
+Chronicle's Subject default. Scope on `pii`, duplicate scope and unknown values
+are errors (PLAY0567/0568). Explicit scope on `pii secret` warns (PLAY0569),
+because only `[PII]` renders. Changing scope for persisted event uses requires a
+new event generation.
+
+C# provider mapping: `pii` → `[PII]`; `secret` → `[Encrypted]` + `[NotAudited]`;
+`pii secret` → `[PII]` only (Chronicle refuses `[PII]` with `[Encrypted]`, CHR0053).
+This mapping is not admission: either marker, including qualifiers and scopes,
+still blocks executable binding with PLAY0268. Subject lineage is a different
+role, described below.
+
+## Declare the use separately
+
+```screenplay
+concept ContactName : String pii
+  pii reason "Identifies the customer's contact"
+purpose Billing
+  description "Issue invoices and collect payment"
+  basis contract
+  subjects customer, customerContact
+  retention "Until the customer relationship ends"
+  recipient "Payment provider"
+module Finance
+  purpose Billing
+  feature Invoices
+    slice StateChange RecordContact
+      command RecordContact
+        name ContactName
+```
+
+A top-level `purpose` has optional singleton `description`, `basis` (optional
+quoted legal reference), `interest`, `condition` (optional quoted reference),
+`authorization`, `subjects` (comma-separated categories), `retention`, and
+`erasure exception`; `recipient` and `transfer "<destination>" safeguard
+"<safeguard>" repeat. Text fields are quoted; description also accepts a text
+fence. Unknown closed values or repeated singleton fields are errors.
+
+- `basis`: `consent`, `contract`, `legalObligation`, `vitalInterests`, `publicTask`,
+  `legitimateInterests` (Art. 6(1)). The last needs a nonblank `interest` statement;
+  inconsistent interest/basis warns (PLAY0601).
+- `condition`: `explicitConsent`, `employmentLaw`, `vitalInterests`, `notForProfit`,
+  `madePublic`, `legalClaims`, `substantialPublicInterest`, `healthCare`,
+  `publicHealth`, `research` (Art. 9(2)).
+- `erasure exception`: `expression`, `legalObligation`, `publicTask`,
+  `publicHealth`, `archiving`, `legalClaims` (Art. 17(3)).
+
+Repeat `purpose <Name>` on modules, features or slices. Coverage is the **union**
+of those references and ancestors' references, unlike authorization's AND rule.
+Unresolved references warn (PLAY0600). Purpose metadata adds no ESM bytes and
+reports PLAY0270; it does not implement consent, a legal hold or crypto-shredding.
+
+Run `screenplay <root> --check purposes --warnaserror`: PLAY0602–0606 prompt for
+uncovered personal data (including nested concepts), missing special-category
+conditions, criminal authorization, bases and unused purposes. Ordinary compile
+does not run this check. Findings are investigation prompts, never a legal verdict.
+
+`screenplay report processing <root> --format markdown|json|csv` derives the
+processing record; optional `--controller-name` and `--controller-contact` are
+explicit inputs, never inferred. MCP `processing-record` returns revision-bound,
+count/byte-bounded pages (`offset`, `expectedSourceRevision`); repeat controller
+inputs across pages. Invalid source prevents reporting; binding is not required.
+Opaque code/imports/runtime protections are not inferred. Zero purposes yields
+zero rows, not compliance. Special/criminal data prompts a DPIA assessment, not a
+claim of large-scale processing. An erasure exception with reachable `pii` flags
+that per-subject crypto-shredding also destroys data kept for that purpose.
+Move legal declarations out of old reasons by hand; repairs never guess them.
+
+## Identify the person, not the stream
+
+An event property may end in `subject`, last among modifiers (before `=` on an
+inline mapping). Each generation may choose one mark independently:
+
+```screenplay
+concept CustomerId : Uuid
+module Billing
+  feature Contact
+    slice StateChange ChangeContact
+      event CustomerContactChanged
+        customerId CustomerId subject
+        note String
+```
+
+Required scalar `String`/`Uuid`, concepts over either, and Int-backed concepts
+are allowed. Bare Int, optional/collection/composite values, enums, Decimal,
+Bool and dates are refused. A `pii` or `secret` concept is refused because
+`EventContext.Subject` is plaintext. Use a surrogate identity; an empty String
+cannot be detected statically and Chronicle falls back to the event source.
+Equal identity strings across entity kinds share one subject; favor Uuid.
+
+PLAY0590–0595 cover multiple marks, invalid/protected types, wrong owner,
+unsupported read-model marks and repeated/out-of-order modifiers. The mark is
+report-only (PLAY0270): it changes no ESM bytes or runtime value and emits no
+C# `[Subject]` yet. Without a supplied subject the runtime's
+`$eventContext.subject` defaults to the event source. Do not promise propagation,
+erasure, export or redaction from this declaration. MCP exposes `isSubject` and
+event summaries' `subject.source` (`eventSource` or `property`).
+
+The event data subject, `secret scope subject` (encryption scope), and policy
+`matches subject` (the thing acted on, not the caller) are three different roles.
+For actual Chronicle erasure and attributes, use `cratis-chronicle-compliance`.

package/package/corpus/skills/cratis-screenplay-command-surface/references/context.md

@@ -5,6 +5,7 @@
 - The four contexts
 - The values they carry
 - Reaching the context declaratively
+- Caller paths and identity details
 - Production metadata is not a context expression
 - The other expression roots
 - Templates and literals
@@ -97,6 +98,52 @@ roles, claims and causation report `PLAY0268`.
 
 An unknown `$context.` path is reported, so a typo does not silently become null.
 
+## Caller paths and identity details
+
+At Screenplay 4.127.0, `$identity.<property>` is the same caller value as
+`$context.identity.<property>`. Prefer `$identity` in new mappings; the older root
+is supported, not deprecated. The `cratis` CLI 3.41.0 bundles Screenplay 4.114.0, which predates both:
+its parser rejects a top-level `identity` block (`PLAY0001`), and with `--executable` it reads a
+`$identity.<property>` mapping as a raw expression (`PLAY0268`). Check these with standalone 4.127.0,
+and keep `$context.identity.<property>` where a model must go through `cratis render` today. Built-ins are `id`, `name`, `userName`,
+`isAuthenticated`, `roles`, `claims.<name>` (everything after `claims.` is opaque).
+Bare `$identity` reports PLAY0152; unknown properties report PLAY0155. Only
+`$identity.id`/`.name`/`.userName` bind in portable `produces` mappings, exactly
+like the older forms; roles, authentication status and claims still report PLAY0268.
+
+A top-level `identity` block declares additional typed caller details:
+
+```screenplay
+identity
+  description "What the application knows about whoever is calling"
+  department String optional from claim "department"
+  organization Organization optional from query MyOrganization by $identity.id
+module Organizations
+  feature Membership
+    slice StateView Mine
+      readmodel Organization
+        name String
+      query MyOrganization => Organization optional
+        by userId String
+```
+
+At most one block per document and assembled folder; layout expansion writes it
+to `application.play`. Each unique detail has exactly one source: opaque claim,
+keyed single-result query, tagged inline code fence or repository-relative `file`.
+It cannot redeclare built-ins. Claim/query sources have no body; refresh/cache
+belongs to the runtime. Query sources need `by <expression>` using only token
+built-ins, claims or literals, never another detail, input, environment or view.
+The query's effective authorization must not depend on details. Result type must
+match; an optional query result needs an optional detail, while a required result
+may populate an optional detail. Details may themselves be optional or collections.
+
+The block is **authoring metadata**, not runtime source resolution or ESM data.
+Declarations alone do not block executable readiness. Executable reads of
+`$identity.<detail>` report PLAY0268; `$context.identity` stays built-ins only.
+`scoped to` is an opaque scope name, not a detail reference. PLAY0633–0646 diagnose
+source/header/type/cardinality errors; there are no automatic identity repairs.
+Authority: v4.127.0 `identity.md`, `context.md`, `diagnostics.md`.
+
 ## Production metadata is not a context expression
 
 `namespace`, `sequence`, `correlation`, `causation`, `causedBy` and `occurred`
@@ -111,6 +158,7 @@ occurrence metadata; use `given clock`, never `given time`, to state scenario ti
 
 | Root | Where | Yields |
 | --- | --- | --- |
+| `$identity.<property>` | caller expression | built-in caller value or declared authoring detail; execution admission is narrower |
 | `$env.<VAR_NAME>` | mapping sources | an environment variable |
 | `$eventContext.<property>` | **projections only** | `occurred`, `sequenceNumber`, `correlationId`, `eventSourceId` |
 | `$eventSourceId` | **projections only** | shorthand for `$eventContext.eventSourceId` |

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -1,7 +1,7 @@
 ## Generated values and responses (ESM v7)
 
 A `generated` command property and `returns` response bind and reference-execute
-as ESM v7. Current pins are standalone Screenplay 4.125.0 and CLI 3.41.0
+as ESM v7. Current pins are standalone Screenplay 4.127.0 and CLI 3.41.0
 (bundled Screenplay 4.114.0/Stage 4.51.3); `cratis-screenplay-toolchain`
 `references/versions.md` owns the table. CLI#261 is closed: CLI now admits v7
 to Stage planning, but its v7 canonical corpus receives Stage generated-value

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -3,6 +3,12 @@
   "input": "Declare a Screenplay command with validation, authorization, a uniqueness constraint and a state-dependent rule.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "PLAY0653" },
+    { "kind": "skill-contains", "value": "personal` is an alias of `pii", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "report-only (PLAY0270)", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "--check purposes", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "PLAY0633–0646", "file": "references/context.md" },
+    { "kind": "skill-contains", "value": "The block is **authoring metadata**", "file": "references/context.md" },
     { "kind": "skill-contains", "value": "main `fd18129`" },
     { "kind": "skill-contains", "value": "produces event ProjectRenamed", "file": "references/inline-events.md" },
     { "kind": "skill-contains", "value": "name ProjectName = name", "file": "references/inline-events.md" },

package/package/corpus/skills/cratis-screenplay-discovery/SKILL.md

@@ -54,7 +54,7 @@ Statements here were checked at those tags:
 | `<Type>[]`, shapes must be declared; `@pii` and `reason` on concepts | `v4.66.0:Documentation/screenplay/events.md`, `concepts.md` |
 | `then denied`, `given caller`, `then error` | `v4.66.0:Documentation/screenplay/specifications.md` |
 | PII on an event-source id is rejected by Chronicle (CHR0034); nullable event properties warn (CHR0012) | Chronicle `v19.32.0:Source/Clients/DotNET.CodeAnalysis/DiagnosticIds.cs` |
-| Any `@pii` or `@sensitive` on a concept fails binding (PLAY0268) | `v4.66.0:Source/DotNET/Screenplay/Semantics/SemanticModelBinder.Concepts.cs:21-24` |
+| Any `@pii` or `@sensitive` on a concept fails binding (PLAY0268) at 4.66.0; current markers are in `cratis-screenplay-command-surface` | `v4.66.0:Source/DotNET/Screenplay/Semantics/SemanticModelBinder.Concepts.cs:21-24` |
 
 Every complete `screenplay` fence in this skill compiles with the standalone compiler
 4.68.0 (`--warnaserror`) and with `cratis screenplay validate --warnings-as-errors` 3.28.2.
@@ -123,8 +123,15 @@ decided apart from what you assumed. Never guess silently.
    two business facts that make it meaningful. A simple state transition may carry no payload
    beyond its identity: do not pad events with fields just to reach a count. Domain names; `<Type>[]` for collections (declare the `type`); a
    `concept` for a value with its own meaning; classify personal data on the concept with
-   `@pii` and a reason now. `@pii` compiles but does not bind (PLAY0268 at 4.66.0): record it
-   as a known target gap; never drop it to get a clean result.
+   bare `pii` and a reason now; operational secrets use `secret` (4.127.0).
+   Either blocks binding (PLAY0268); record the gap, never drop protection.
+   Ask what use, lawful basis, retention, recipient/transfer and erasure needs the
+   data serves; declare those in a `purpose`, not a concept reason. Special/criminal
+   qualifiers describe the value, not legal permission. See command-surface
+   `references/compliance.md` for purpose coverage checks and the processing record.
+   For who-is-calling details, distinguish token claims from a keyed single-result
+   identity-source query or opaque implementation. The `identity` block is metadata;
+   executable detail reads remain unsupported. See `references/context.md` in command-surface.
 7. **Validate, gate, hand off.** After a coherent batch of edits (not every sentence) run V1
    with the tool and version named (`cratis-screenplay-toolchain`). Stop storming a workflow
    when the user says it is complete or both closing questions return nothing new; unattended,

package/package/corpus/skills/cratis-screenplay-discovery/references/interview-questions.md

@@ -21,7 +21,7 @@ assumption you take instead of asking.
 | Outside | Which outside parties or systems send or receive information here? | Later translations and contracts | they send facts we rely on: ask how we recognise which of our records it concerns |
 | Corrections | Can a recorded fact turn out wrong? How is it put right today? | Correction and reversal events instead of edits | "we just edit it": ask who needs to know it was changed |
 | History | What would an auditor, a regulator or an angry customer ask to see later? | Finds facts that look like detail but must be kept | a calculation must be shown later: treat it as a fact |
-| People's data | Which values identify or describe a person? How long may we keep them? | `@pii` on concepts before event shapes settle | data about two people in one fact: consider separate facts |
+| People's data | Which values identify or describe a person? For what use, basis, retention, recipients/transfers and erasure exceptions? | bare `pii` on concepts; purpose declarations separate from reasons | special/criminal data needs declared safeguards; two people in one fact may need separate facts |
 | Volume | How often does this happen, and how long does one instance live? | Informs stream design later; never a reason to drop a fact | an instance lives for years: note it for stream review |
 | Input | What do we have to go on: written rules, a rough list, word of mouth, a running system? | Sets how hard to sweep | only word of mouth: run every sweep lens |
 | Who decides | Who has the final word on what this means for the business? | Separates decisions from assumptions | no one present: mark meaning as assumption to confirm |

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -53,7 +53,7 @@ Framework repositories and brownfield work that has not opted in stay code-first
   handlers, adapters, and scope Stage cannot render yet (the model stays the contract).
 - **Never:** use code as a shortcut around the model; change the model to match
   existing code; edit Stage-managed output; leave a modeled rule living only in
-  code; weaken protection (authorization, `@pii`, rules) so a model compiles or renders.
+  code; weaken protection (authorization, `pii`, rules) so a model compiles or renders.
 
 **2. Run the lifecycle.** Load `cratis-screenplay-modeling-lifecycle` for modes, the
 independent verdicts V1-V5, the P0-P9 phases with their gates, stop-or-assume,
@@ -131,7 +131,7 @@ What binds depends on **which tool** you ask, so name the tool and its version:
 - `reads` and `concurrency` on a command do not bind (`PLAY0271`), so no decision is
   protected against stale state. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
-- `persona` declarations are report-only and never block; `@pii` and `@sensitive`
+- `persona` declarations are report-only and never block; bare `pii` and `secret`
   concepts do block binding (`PLAY0268`). Keep them anyway: the classification is
   part of the model. Report the block.
 - Generated values/responses bind and reference-execute as v7; sources, streams
@@ -243,7 +243,7 @@ compile or will not be safe. Both are deliberate.
 ## Naming the primitives is the highest-value work
 
 Name concepts before events, classify personal data at the concept, keep events past tense and single-purpose, and never put the event-source identity in an event payload.
-Read [references/naming-primitives.md](references/naming-primitives.md) when declaring concepts, `@pii` classification, event shapes, `identifier`, inline events or `id "<old name>"` pins.
+Read [references/naming-primitives.md](references/naming-primitives.md) when declaring concepts, `pii` classification, event shapes, `identifier`, inline events or `id "<old name>"` pins.
 
 ## Quick gate - before specifications are called done
 

package/package/corpus/skills/cratis-screenplay-event-modeling/references/naming-primitives.md

@@ -5,10 +5,12 @@
   `Decimal`, `Bool`, `Date` and `DateTime`; `Enum` is a separate concept kind,
   with its values indented beneath.
 - **Classify personal data at the concept**, with a reason:
-  `concept PersonName : String @pii` plus an indented `pii reason "..."`. Every
+  `concept PersonName : String pii` plus an indented `pii reason "..."`. Every
   usage inherits it; a reason for an attribute the concept does not declare is an
-  error. Decide this before fixing event shapes - erasure follows the subject and
-  the subject follows the stream.
+  error. Decide this before fixing event shapes; purpose/basis/retention belong in
+  processing-purpose declarations, not a reason. An event subject defaults to the
+  source unless supplied; the trailing event-property `subject` mark is report-only
+  at 4.127.0, not runtime lineage. See command-surface `references/compliance.md`.
 - **Events are past tense and self-describing** - `InvoiceRegistered`, never
   `Created`. One purpose per event; an event needing an optional property to cover
   two situations is two events.

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -22,7 +22,9 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 | Construct | Current standalone disposition |
 | --- | --- |
 | `persona`, domain/authentication metadata | Report-only; unknown named policies remain source defects |
-| Compliance concepts | Preserve protection; portable binding gaps are not permission to remove it |
+| Compliance concepts | Bare `pii`/`secret` (4.127.0); binding still refuses PLAY0268, never remove protection |
+| Identity details / processing purposes / event subject | Report-only metadata (4.127.0); executable detail reads refuse PLAY0268, not source declaration errors |
+| Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; Stage 4.51.3 member refusals STAGE-ESM-028/029 |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -153,7 +153,15 @@ chain per slice before handoff (evidence template); never manufacture references
      in the model today**, target named; a unique index with business meaning becomes
      `unique ... on <every event that sets it>` with `released by`
      (`references/rule-modeling.md`);
-   - keep `@pii` / `@sensitive` and authorization found in code; every role gate has `authorize`
+   - preserve personal-data/secret protection and authorization found in code,
+     using bare `pii` / `secret` (4.127.0); deprecated marker repairs keep legal
+     notes intact, never guess a purpose or basis. Derive purpose/use/retention
+     declarations only from evidence or expert decisions; run `--check purposes`
+     and inspect the processing record as prompts, not a legal verdict. Keep
+     hand-joined legacy ids scalar; never infer composite parts by splitting text.
+     Event `subject` is report-only; distinguish observed lineage from runtime
+     realization. See command-surface `references/compliance.md`.
+     Every role gate has `authorize`
      plus a `then denied` spec, else a recorded gap; rules you cannot express truthfully are
      recorded one by one, never fabricated.
 3. Cite evidence ids in each slice `description` ("Evidence: E3, E7"). Read `references/intent-example.md` when authoring the intentional candidate to check the complete example of evidence citations, re-slicing, constraints, authorization and recorded state-dependent rules.
@@ -195,7 +203,7 @@ handoff packet appended, first line `Outcome:`; no prose reports in the model ro
   same-application canonical exports with authoritative catalogs; it does not guess
   rename continuity, run specifications or prove recovered behavior. Inspect
   incomplete sections and exclusions before using the result in the loss report.
-- Never weaken protection (authorization, `@pii`, rules) to make the candidate compile.
+- Never weaken protection (authorization, `pii`, rules) to make the candidate compile.
 
 ## Gate
 

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -23,7 +23,7 @@ contract is in `cratis-screenplay-ui-composition`.
 
 ## Verified product sources
 
-Current authoring/MCP guidance follows Screenplay v4.125.0
+Current authoring/MCP guidance follows Screenplay v4.127.0
 `Documentation/screenplay/mcp/`, `ast-authoring.md`, `folders.md`, `vscode.md`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
 tool. Pins are in `cratis-screenplay-toolchain` `references/versions.md`.
@@ -178,6 +178,8 @@ each lost comment (`PLAY0288` also reports their count and lines). Untouched
 documents retain exact bytes. A printer that loses requested structural fields
 rejects the plan.
 
+`identityMigrationIssues`: read the [MCP loop](references/mcp-loop.md).
+
 ## Repair or extract before rewriting
 
 Read `read-workspace` with `view: "diagnostics"`, then `view: "repairs"` at the
@@ -199,6 +201,7 @@ from silently changing the reviewed candidate.
   No automatic generation-evolution repair ships.
 - `PLAY0479`: migrate optionality spelling with `PreserveTrivia`; document scope
   migrates all occurrences together. Keep the `query Q => observable?` exception.
+- Compliance repairs PLAY0565/0653: [MCP tool guide](references/mcp-tools.md).
 
 Use `propose-extract-inline-event` on the inline `EventSyntax` handle before adding
 a generation (canonical formatting consent; refuses comment loss; no reverse
@@ -303,7 +306,7 @@ a generated app that silently drops authored UI. Use the Screenplay-owned canoni
 corpus fixture path when it exists instead of copying `.play` examples into this
 repository.
 
-Repair and refactoring guidance follows Screenplay v4.125.0. The Cratis
+Repair and refactoring guidance follows Screenplay v4.127.0. The Cratis
 CLI bundles its own Screenplay version, so check the installed `tools/list`
 schemas before relying on a view or argument named here (for example
 `dropped-comments` or `implementation-requirements`). Do not invent a command,