@cratis/pi 7.22.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -22,7 +22,7 @@ files is one application: always check the folder, never one file of it.
 
 When choosing or upgrading a tool, or checking version-specific capabilities, read `references/versions.md`; it is the only version table, and other skills point to it.
 
-The standalone pin is Screenplay 4.125.0. CLI 3.41.0 bundles Screenplay 4.114.0,
+The standalone pin is Screenplay 4.127.0. CLI 3.41.0 bundles Screenplay 4.114.0,
 Stage 4.51.3 and Cratis.Arc.Screenplay 22.54.0. The single version table records
 released source evidence and historical probes separately; do not relabel an old
 render/browser result as a probe of the current packages.
@@ -31,7 +31,7 @@ Historical screens-release evidence: CLI 3.40.7 / Stage 4.51.1 / bundled
 Screenplay 4.114.0 opened the canonical corpus with `executableReady true`
 and the stdio transcript exposed 37 tools; standalone language 4.122.0 was
 recorded in that vector. These retained results are not a rerun on CLI 3.41.0
-or Screenplay 4.125.0.
+or Screenplay 4.127.0.
 
 ## Ground rules
 
@@ -49,7 +49,7 @@ or Screenplay 4.125.0.
 5. **Capability is not correctness.** The tool you ran decides what is accepted today; the
    domain and the documented semantics decide what is correct. On conflict keep the correct
    model and record a tool gap; never reshape a model to silence a tool.
-6. **Never remove `@pii`, `@sensitive`, authorization, list queries, automations or rules
+6. **Never remove `pii`, `secret`, authorization, list queries, automations or rules
    to reach V3 or a render.** Report the verdict as blocked with the codes.
 7. **A clean verdict proves only its own layer.** "Not run" with the reason is a valid
    result. Specifications written or bound are never specifications passing.
@@ -90,7 +90,7 @@ server with a fixed root when the tool is older than 4.63.2 (the roots bug hit 4
 4.60.1 bundled by cratis before 3.28.2; 4.66.0 and later and cratis 3.28.2 are fine). A subagent without MCP reports "V2 not run: no MCP in this agent".
 
 One line per verdict, tool first, for example `V1 pass (screenplay 4.68.0, 3 files)` and
-`V3 blocked: PLAY0268 x3 (list query, @pii)`. Name the source identity (commit plus the digest from
+`V3 blocked: PLAY0268 x3 (list query, pii)`. Name the source identity (commit plus the digest from
 the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity")) the verdict ran on; keep it apart from the MCP
 `modelRevision`, which is semantic and, without `.screenplay/identities.json`,
 changes with the root folder name.
@@ -101,7 +101,7 @@ changes with the root folder name.
   `references/cheat-sheet.md`. Read [references/cheat-sheet-example.md](references/cheat-sheet-example.md) when you need one complete design-mode document with every construct family.
 - **Executable** (binds, V3): `references/executable-subset.md`. Keyed optional queries
   only; no handler (PLAY0268, with or without `implementation`/`hint`); `reads` and
-  `concurrency` do not bind (PLAY0271); no `@pii`; v6 constructs bind on Screenplay 4.61 or
+  `concurrency` do not bind (PLAY0271); no compliance markers (`pii`/`secret`); v6 constructs bind on Screenplay 4.61 or
   later (standalone, and cratis 3.28.2 or later); generated values and `returns` responses bind (ESM v7)
   from Screenplay 4.68.0 (also in the current CLI bundle) (`references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).
 - **Renderable** (V5): `references/renderable-subset.md` retains explicitly labeled
@@ -112,6 +112,13 @@ changes with the root folder name.
   render refuses versions above v7 (`CLI-RENDER-004`). Operations and exact numeric
   mode remain authorable/unadmitted. Details: `references/sources-and-streams.md`.
 
+- **Caller/compliance metadata** at 4.127.0: `$identity` aliases caller built-ins;
+  additional identity details are metadata and executable reads still refuse.
+  Bare `pii`/`secret` replace legacy spellings; `pii personal` repeats one marker
+  (PLAY0653). Purposes/checks/processing records and event `subject` are report-only,
+  not legal compliance, retention or runtime subject realization. See
+  command-surface `references/context.md` and `references/compliance.md`.
+
 ## Edit strategy
 
 - **Discover the capabilities available** (tool, version, `tools/list`, model root) once,

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -2,7 +2,7 @@
 
 One complete document with every construct family. Design mode, not executable. Prose rules: [cheat-sheet.md](cheat-sheet.md); tool versions: [versions.md](versions.md); what binds: [executable-subset.md](executable-subset.md).
 
-Blocking on every compiler: unquoted import, `@pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The fence compiles warning-free on the standalone 4.66.0 tool and on `cratis screenplay validate` 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
+Binding blockers: unquoted import, `pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
 ```screenplay
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
@@ -12,7 +12,7 @@ import Customers.CustomerRegistered        // unquoted = another bounded context
 
 concept InvoiceId : Uuid                   // primitives: Uuid String Int Decimal Bool Date DateTime Enum
 concept PaymentId : Uuid
-concept Email : String @pii                // @pii / @sensitive (blocks executability today)
+concept Email : String pii                 // pii / secret (blocks executability)
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet.md

@@ -12,7 +12,7 @@
 - PDL quick reference (most forms are compiled in `pdl-example.md` or `cheat-sheet-example.md`; `remove via join` and `$eventContext.occurred` are not)
 - Specification forms
 
-Current pins: standalone Screenplay 4.125.0 / CLI 3.41.0; `versions.md` is the
+Current pins: standalone Screenplay 4.127.0 / CLI 3.41.0; `versions.md` is the
 single table. Compile evidence below keeps its historical tool labels.
 
 The syntax lives in compiled example files next to this one (each is a Markdown file holding
@@ -105,6 +105,17 @@ a reference scenario that supplies only a clock carries no caller audit identity
 reference runner before relying on identity paths in a specification. Renderable:
 `$context.occurred` only.
 
+At 4.127.0, `$identity.id`/`.name`/`.userName` map to the same ESM kinds as
+`$context.identity`; prefer the shorter root, but the older one stays supported.
+Other built-ins parse but roles/claims/authentication status do not bind in
+produces mappings. Identity details are metadata: executable detail reads report
+PLAY0268. See command-surface `references/context.md`.
+
+Use bare `pii`/`secret` on concepts (`personal` aliases `pii`); legacy markers
+are PLAY0565 information and repeated markers are PLAY0653 warning. Event `subject`
+is report-only lineage; processing purposes/checks/reports declare use, not lawful
+processing or runtime retention. See command-surface `references/compliance.md`.
+
 ## `$eventContext.` (projections)
 `eventType{.id,.generation,.tombstone}`, `eventSourceType`, `eventSourceId`, `eventStreamType`,
 `eventStreamId`, `sequenceNumber`, `occurred`, `occurred.Week`, `eventStore`, `namespace`,

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -4,6 +4,7 @@
 
 - Warnings that hide defects (always validate with `--warnings-as-errors`)
 - Source reference and identifier checks
+- Caller identity, compliance and routes
 - Structural completeness and timeline checks
 - Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
@@ -36,7 +37,7 @@ then STAGE (V5 admission). Tool differences: `versions.md`.
 
 ## Source reference and identifier checks
 
-At Screenplay 4.125.0 these are V1 source checks, not binding-only gaps:
+At Screenplay 4.127.0 these are V1 source checks, not binding-only gaps:
 
 | Code | Severity | Meaning |
 | --- | --- | --- |
@@ -46,6 +47,70 @@ At Screenplay 4.125.0 these are V1 source checks, not binding-only gaps:
 
 Legacy compliance spellings (`@pii`/`@sensitive`) do not evade PLAY0515.
 
+## Caller identity, compliance and routes
+
+Source authority: v4.127.0 `diagnostics.md`, `identity.md`, `concepts.md`,
+`purposes.md`, `events.md`, `event-sources.md`, `reactions.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0152 | E | Bare `$identity` needs a property path |
+| PLAY0155 | W | A `$identity` or `$context.identity` path names a property the caller does not carry; correct the built-in/detail name (claims suffixes are opaque) |
+| PLAY0633 | E | Invalid identity header; write bare `identity` |
+| PLAY0634 | E | Second identity block in one document; a second file uses the folder singular-declaration diagnostic |
+| PLAY0635 | E | Invalid typed detail or escape source; exactly one source per detail |
+| PLAY0636 | E | Unknown source kind; use claim, query, inline code or file |
+| PLAY0637 | E | Detail has no source/implementation |
+| PLAY0638 | E | Claim/query source has a body; refresh/cache belongs to runtime |
+| PLAY0639 | E | Duplicate detail name |
+| PLAY0640 | E | Detail redeclares a token built-in |
+| PLAY0641 | E | Unknown/ambiguous source query |
+| PLAY0642 | E | Source query is unkeyed or returns a list |
+| PLAY0643 | E | Query source lacks `by <expression>` |
+| PLAY0644 | E | Query key reads more than built-ins, claims or literals |
+| PLAY0645 | E | Source query's effective gate depends on details |
+| PLAY0646 | E | Result type/optionality differs from detail; optional result needs optional detail |
+| PLAY0565 | I | Deprecated `@pii`, `sensitive`, `@sensitive`; repair to bare `pii`/`secret`, preserving notes/trivia |
+| PLAY0566 | E | Unknown concept marker |
+| PLAY0567/0568 | E | Invalid secret scope / repeated scope |
+| PLAY0569 | W | Explicit secret scope ignored on `pii secret` because only `[PII]` renders |
+| PLAY0570/0571 | E | Invalid personal-data qualifier/category / repeated special category |
+| PLAY0653 | W | Repeated concept-header compliance marker; `pii personal` is one marker repeated. Keep the first; body settings stay attached; canonical printing writes one marker |
+| PLAY0590 | E | More than one event subject; choose one, no safe automatic repair |
+| PLAY0591 | E | Subject not required scalar String/Uuid or a String/Uuid/Int-backed concept |
+| PLAY0592 | E | Protected subject concept; EventContext.Subject is plaintext, use a surrogate |
+| PLAY0593 | E | Subject modifier outside event properties |
+| PLAY0594 | E | Read-model subject mark is unsupported |
+| PLAY0595 | E | Repeated/out-of-order subject modifier; write it last |
+| PLAY0596/0597/0598/0599 | E | Malformed purpose declaration/reference/field; unknown closed value; repeated singleton; duplicate purpose name, respectively |
+| PLAY0600/0601 | W | Unknown purpose reference / inconsistent legitimate-interest declaration |
+| PLAY0602–0606 | W | Opt-in purposes coverage: uncovered pii, missing Art. 9 condition, Art. 10 authorization, basis, or unused purpose |
+| PLAY0647 | E | Malformed/repeated/misplaced `runs as`, empty/duplicate role; one reaction-level line with quoted roles (zero allowed) |
+| PLAY0648 | W | Gated invocation without declared identity; an authorization refusal branch gets PLAY0557 instead, once per invocation |
+| PLAY0649 | W | Identity declared without invokes or inline/file implementation |
+| PLAY0650 | W | C# bound-gate check: role needed by no invocation; opaque gates/implementation bodies suppress it |
+| PLAY0651 | W | C# bound-gate check: declared actor definitely cannot satisfy gate; unknown is not denial |
+| PLAY0652 | W/I | Opt-in `privilege`: trigger producer lacks every declared actor role (W), or has opaque gates that cannot be compared (I); clock/application triggers are silent |
+| PLAY0504 | E | Missing/ambiguous stream, invalid/mismatched route parts, nominal source identifier/destination type mismatch or invalid stream-id literal; never a warning |
+| PLAY0549 | E | Invalid specification route/mapping, including invalid stream-id literals |
+
+Stream-id text must be nonempty, well-formed Unicode NFC: refuse, never normalize.
+Integer ids in Double mode are within ±9007199254740991; Exact mode has no such
+bound but remains unadmitted. Specification contradictions compare canonical ids,
+so UUID casing does not distinguish routes. Composite encoding is ordered and
+escapes `%`/`|`, not an inferred split of legacy text.
+
+Identity declarations and event `subject` are metadata; reading a declared
+`$identity` detail in executable clauses is PLAY0268. `runs as` is admitted as
+ESM v10 in the current standalone, not a current PLAY0268 gap. Compliance markers
+still block binding; purpose metadata is PLAY0270. See command-surface
+`references/compliance.md` and `references/context.md` for syntax and limits.
+
+`screenplay_repair_capabilities` and `propose-repair` advertise PLAY0653: a
+concept-subject, line-only `PreserveTrivia` repair, no document-root or pinned
+repair evidence. PLAY0565 supports one discovered `line` or a document-root
+migration. Preview every repair; legal notes never move automatically.
+
 ## Structural completeness and timeline checks
 
 Opt in with `--check <names>` or MCP diagnostics `checks`, then treat warnings
@@ -59,6 +124,8 @@ as errors if gating. Ordinary compile success does not imply these ran:
 | query-keys | PLAY0535 | Query argument not representable by known identity/fields |
 | event-consumers | PLAY0536 | Latest local event generation lacks an operational consumer; a terminal fact can legitimately be reported |
 | navigation | PLAY0537 | Unreachable screens; unreachable cycles do not establish an entry point |
+| privilege | PLAY0652 | Elevated event-trigger producers must require every actor role; opaque gates are information, clock/application triggers exempt |
+| purposes | PLAY0602–0606 | Personal-data coverage, special/criminal safeguards, basis and unused-purpose prompts; union of ancestor/direct references |
 
 Whole-source errors skip completeness checks. Unknown/opaque coverage is not
 invented: report skipped status/coverage and walk field lineage manually.
@@ -75,15 +142,18 @@ before a retained glob; cycles and own-sub-feature findings have no repair.
 
 Monaco/VS Code use the TypeScript syntax/authoring compiler. They share projection
 and protected-identifier checks (PLAY0514/0515), typed-example syntax (0518/0519),
-guarded actions (0341–0348), and reaction-refusal syntax/checks (0538–0545).
+guarded actions (0341–0348, including item paths/input bindings 0345–0348),
+identity details (0633–0646), compliance/subject checks, reaction identity
+(0647–0649), and reaction-refusal syntax/checks (0538–0545).
 A shared catalog code is not proof that a check is implemented in both compilers.
 
 C# CLI/MCP owns whole-application scoped diagnostics, opt-in completeness
-(PLAY0530–0537), semantic binding and PLAY0546 (a negated claim targets optional,
+(including PLAY0530–0537, PLAY0602–0606 and PLAY0652), bound reaction gate
+checks PLAY0650/0651, semantic binding and PLAY0546 (a negated claim targets optional,
 unavailable-subject or non-text data). The VS Code repair bridge is not a general
 C# validator. A clean editor is not V1 for the complete application, V3 binding
 or V4 execution. Run the CLI or MCP for those verdicts. Authority:
-`v4.125.0:Documentation/screenplay/editor-diagnostics.md`, `diagnostics.md`.
+`v4.127.0:Documentation/screenplay/editor-diagnostics.md`, `diagnostics.md`.
 
 ## Consistency errors (V1: the model contradicts itself)
 | Code | Meaning |
@@ -99,7 +169,7 @@ or V4 execution. Run the CLI or MCP for those verdicts. Authority:
 ## Binding (V2 and V3) - see `executable-subset.md` for the full table
 | Code | Meaning | Fix |
 |---|---|---|
-| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `@pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `@pii`/authorization |
+| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `pii`/authorization |
 | PLAY0269 / 0270 | UI deferred / authoring metadata (I) | none |
 | PLAY0271 | legacy `reads` or a `concurrency` block keeps its legacy meaning and cannot bind (error) | design gap; a constraint for uniqueness; protected decisions are a target requirement |
 | PLAY0273 | incoherent: ambiguous `for`, property not on event revision, operand type mismatch, derived `$eventContext` path | fix the reference |

package/package/corpus/skills/cratis-screenplay-toolchain/references/doc-contradictions.md

@@ -1,10 +1,17 @@
 # Documentation contradictions and which side to trust
 
-Current pins are Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). This is a
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). This is a
 **historical** contradiction inventory, not a claim that all listed defects still
 exist. Current grammar documents exact numbers and free description placement;
 sources/routes bind as ESM v8; PLAY0515 is a source error; CLI v7 reaches Stage.
 
+At v4.127.0 `concepts.md` links the shipped purpose declarations/checks/record
+but its final identifier section still calls them later phases. `purposes.md`,
+the released grammar/tool and successful purpose probes take precedence. The same
+page's legacy `@pii` mentions do not change bare `pii`/`secret` canonical syntax;
+legacy forms compile with PLAY0565 information, duplicates with PLAY0653 warning.
+Event `subject` remains report-only, despite accepted future lineage work.
+
 `D/` is Screenplay `Documentation/screenplay/` at **v4.66.0**; line numbers were re-read at
 that tag. Rule: the compiler you ran decides what the tool accepts today; the documentation
 and the domain decide what the model should mean. When they disagree, follow the compiler

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,6 +2,7 @@
 
 ## Contents
 
+- Caller and compliance boundary (4.127.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later only
@@ -10,7 +11,7 @@
 - Not refused, but do not rely on it
 - Never do this to reach V3
 
-Current pins are Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). Detailed
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Detailed
 4.66.0/4.68.0 binder probes below retain their historical labels. Current source
 admits sources/streams/routes as ESM v8 and policy negation as ESM v7; operations,
 exact numbers and reaction refusals/redelivery remain unadmitted. Use the actual
@@ -32,6 +33,20 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later only).
 
+## Caller and compliance boundary (4.127.0)
+
+`$identity.id`/`.name`/`.userName` are aliases of the admitted
+`$context.identity` produces-mapping values. Authentication status, roles and
+claims still refuse there (PLAY0268); the older root is not deprecated.
+A top-level `identity` block alone is authoring metadata and does not block
+readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
+`$context.identity` remains built-ins only. Purposes and event `subject` marks
+are metadata (PLAY0270), not source resolution, retention or subject propagation.
+Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers still block
+binding. Legacy spellings compile with PLAY0565 information; duplicates warn
+PLAY0653. Never remove protection; see command-surface `references/compliance.md`.
+Authority: v4.127.0 `context.md`, `identity.md`, `concepts.md`, `events.md`, `purposes.md`.
+
 ## Admitted on both compilers
 
 - `StateChange` and `StateView` slices.
@@ -159,7 +174,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `@pii` or `@sensitive` on any concept | PLAY0268 | "Concept '<n>' compliance attributes require portable data-subject semantics." Same message at 4.60.1 and 4.66.0. `@sensitive` means an operational secret, rendered `[Encrypted]` + `[NotAudited]` (Screenplay decision 0034) |
+| `pii` or `secret` on any concept (also alias/legacy markers) | PLAY0268 | Compliance requires portable data-subject semantics; scopes/qualifiers do not admit it. Secret provider mapping is `[Encrypted]` + `[NotAudited]`, not a bind/render claim |
 | `query` returning a collection (`RM[]`), or without exactly one caller-supplied `by` | PLAY0268 | "must declare one caller-supplied 'by' argument" or "must return one optional read model" |
 | `observable`, `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` goes in the return position (`=> observable RM optional`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -199,9 +214,9 @@ bodies still leave their owner non-executable.
 
 ## Never do this to reach V3
 
-Do not remove `@pii`, `@sensitive`, `authorize` or policies, list queries, automations or
+Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
-slice in the gap list. A `@pii` or `@sensitive` attribute blocks V3 and rendering, and
+slice in the gap list. A `pii` or `secret` marker blocks V3 and rendering, and
 either attribute on an identifier or typed destination is a source error
 PLAY0515 on the current compiler (including stream-id parts and route mapping
 sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers

package/package/corpus/skills/cratis-screenplay-toolchain/references/provenance.md

@@ -28,7 +28,13 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 
 ## Sources read for facts
 
-- Current baseline: Screenplay `v4.125.0` `Documentation/screenplay/{tool,diagnostics,editor-diagnostics,grammar,event-sources,specifications,policies}.md`, MCP reference/authoring guides and `Semantics/Versions.cs`; CLI `v3.41.0` dependency pins, `RenderedSemanticVersions.cs` and its v7 planning specification. Installed versions/CLI help and changed examples were checked separately. Pins are in `versions.md`; the older probes below retain their original labels.
+- Identity/compliance/route-literal guidance: Screenplay `v4.127.0` (`e70435a4`)
+  `identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`,
+  `event-sources.md`, `reactions.md`, `completeness.md`, `diagnostics.md`,
+  `editor-diagnostics.md`, MCP reference/authoring tools and `Semantics/Versions.cs`.
+  Installed 4.127.0 version and changed examples were checked separately. Historical
+  execution and renderer probes retain their labels; CLI stays 3.41.0.
+- Earlier baseline: Screenplay `v4.125.0` `Documentation/screenplay/{tool,diagnostics,editor-diagnostics,grammar,event-sources,specifications,policies}.md`, MCP reference/authoring guides and `Semantics/Versions.cs`; CLI `v3.41.0` dependency pins, `RenderedSemanticVersions.cs` and its v7 planning specification. Installed versions/CLI help and changed examples were checked separately. Pins are in `versions.md`; the older probes below retain their original labels.
 - Screenplay `v4.66.0` (`c89198b`): `Documentation/screenplay/` (grammar, commands, queries,
   specifications, reactions, diagnostics, mcp), `decisions/0017`, `0020`, `0022` to `0024`,
   `Source/DotNET/Screenplay/Semantics/` (binder, versions, execution),

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -1,6 +1,13 @@
 # Renderable subset (V5): what `cratis render` admits
 
-Current pins: standalone Screenplay 4.125.0; CLI 3.41.0 bundles Screenplay
+## Contents
+
+- What Stage 4.24 admits
+- Authoring consequences in renderable mode
+- Ownership, publication and recovery
+- Reading V5
+
+Current pins: standalone Screenplay 4.127.0; CLI 3.41.0 bundles Screenplay
 4.114.0 and Stage 4.51.3 (`versions.md`). CLI admits ESM v7 to Stage planning;
 above v7 is CLI-RENDER-004. Its v7 canonical corpus gets STAGE-ESM-028/029 for
 generated values/responses (`v3.41.0:Source/Cli.Specs/for_ScreenplayPlanning/when_planning_an_esm_v7_model.cs`).
@@ -48,6 +55,14 @@ whole automation is hand-written (gap-fill).
 | Specifications | command-action scenarios: given events, `when <Command>`, `then` events (ordered or any order), `then readmodel`, `then query`, `then error` (naming a rendered constraint or message), `then denied`, `given caller`. Two narrow when-less routes: an unprotected single `then query` seeded by exactly one `given readmodel` whose key and values match (no given events, no caller), and a query-only denial (`given caller`, one `then query` with no results, `then denied`, a protected query, no role claims) | `then no readmodel`, `when append`, composite values, error codes not naming a rendered constraint: 011. Any other when-less specification (for example given events with `then query`) fails 011 |
 | Compliance | none | any `@pii` or `@sensitive` already fails binding (PLAY0268). The C# provider mapping (Stage v4.29.0, Stage#197) is `@pii` to `[PII]`, `@sensitive` to `[Encrypted]` + `[NotAudited]`, both to `[PII]` only |
 
+At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
+accepted with PLAY0565 information); either still refuses binding. Identity blocks,
+purposes and event `subject` are authoring metadata, not provider realization;
+executing identity detail reads still refuses PLAY0268. Current source/stream
+routes are admitted as v8, including composite ids, not the historical binding
+refusal above; CLI 3.41.0 still refuses versions above v7. Never split hand-joined
+legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
+
 ## Authoring consequences in renderable mode
 
 - `produces when` is STAGE-ESM-006: split conditional outcomes into separate commands, or

package/package/corpus/skills/cratis-screenplay-toolchain/references/sources-and-streams.md

@@ -5,6 +5,7 @@
 - Admission
 - Declare and route
 - Specification routes
+- Canonical keys and evolution
 - Boundaries
 
 ## Admission
@@ -82,6 +83,26 @@ Typed event examples may supply a route, replaced as a whole by step overrides;
 `for` is independent. No spelling restores a wildcard after an example supplies
 a route. See `cratis-screenplay-specifications` for fixture provenance.
 
+## Canonical keys and evolution
+
+At Screenplay 4.127.0, stream-id literals on command routes (PLAY0504) and
+specification routes (PLAY0549) must be nonempty, well-formed Unicode NFC text;
+invalid text is refused, never normalized. In Double numeric mode integer ids
+are within ±(2^53−1); Exact mode has no such bound but still refuses binding.
+Known routed command identifiers and production destination types must equal
+the source's nominal identifier type (PLAY0504 is an error, not a warning).
+Allocation is typed by the generated identifier, or without one requires a
+UUID-based source. Unrouted commands are unaffected.
+
+Composite schemas declare `streamId` with at least two named scalar parts.
+Command routes map every part once; specification parts are literals only.
+Format each part by the portable scalar rules, escape `%` to `%25` and `|` to
+`%7C`, then join with `|` in declaration order; decoding is strict. Specification
+route contradictions compare canonical values part by part (UUID case variants
+are equal). Changing a stored stream's key schema needs a new stream identity
+or migration. Keep hand-joined legacy ids as scalar text: never split by guesswork.
+Authority: v4.127.0 `event-sources.md`, `diagnostics.md`, decision 0033.
+
 ## Boundaries
 
 Reference routing does not prove target deployment, concurrency or protected

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -1,6 +1,6 @@
 # Traps (one line each, with the fix)
 
-Current pins: Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). Unless explicitly
+Current pins: Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Unless explicitly
 updated below, [probed]/[source] rows retain their historical v4.66.0/CLI 3.28.2
 scope; negative capability claims there are not current verdicts. Current routes
 bind as v8, v7 reaches Stage planning, reference tests have CLI/MCP routes, and
@@ -46,6 +46,23 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 37. Personas are not in the ESM (Screenplay#254); specs cannot reference them. Write `given caller` as the roles/claims that stand for the persona.
 38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; not available in a Stage-rendered app on Arc 22.25.0), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
 
+Current identity/compliance traps (v4.127.0 `identity.md`, `concepts.md`, `events.md`,
+`purposes.md`, `diagnostics.md`):
+- `$identity` built-ins alias `$context.identity`; declared detail reads are PLAY0268,
+  while an identity block alone does not block readiness. `scoped to` is opaque,
+  not a detail reference. Query sources need keyed single compatible results and
+  token-only keys/gates that do not depend on details.
+- `pii personal` repeats one marker (PLAY0653). Legacy markers are accepted but
+  deprecated (PLAY0565); repairs preserve notes, never invent legal content.
+- Event `subject` is report-only (PLAY0270), not emitted C# `[Subject]` or runtime
+  lineage. Keep stream identity, data subject, encryption scope and policy subject apart.
+- Purpose metadata/checks/records declare processing, not lawfulness or retention.
+- PLAY0504 is an error; stream-id text is nonempty well-formed NFC (refuse, never
+  normalize), Double integer ids are within ±(2^53−1); canonical UUID comparison
+  ignores case. Protected concepts cannot be stream ids/parts/mapping sources (PLAY0515).
+- Run `--check privilege` on elevated event-trigger paths; opaque producers are
+  unknown, not safe. Arc needs `[ExecuteCommandsAsSystem]` to supply a principal.
+
 The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version notes there). Traps 39 to 44 are tool traps added at the 4.66.0 pin.
 39. A handler never binds: PLAY0268 "Command '<n>' handler requires a constrained implementation attachment", with a file, a fence, `implementation` or `hint` alike. `implementation` and `hint` are accepted on a command handler, an operation execute/compensate phase and (from 4.65.0) a command property named rule, and are rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies; on a handler they are authoring intent only (no execution, lock or confirmation). A handler slice is gap-fill, not a customization of a rendered slice. [source, probed]
 40. `numbers exact` parses on 4.66.0 to 4.68.0 but never binds (PLAY0268; "not admitted by any supported executable model (ESM) version yet") and is PLAY0001 on older compilers; it is absent from `grammar.md`. Never use it in a model or example meant to execute. [probed]

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -28,7 +28,7 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
 
 | Tool | Command | Pass | Fail |
 | --- | --- | --- | --- |
-| Standalone 4.125.0 (preferred) | `screenplay <model-root> --warnaserror --no-color` | exit 0 and a nonzero compiled file count | exit 1 defects; exit 2 could not run/invalid arguments or input |
+| Standalone 4.127.0 (preferred) | `screenplay <model-root> --warnaserror --no-color` | exit 0 and a nonzero compiled file count | exit 1 defects; exit 2 could not run/invalid arguments or input |
 | cratis (fallback) | `cratis screenplay validate <model-folder> --warnings-as-errors -o json-compact` | exit 0 | exit 5; exit 1 means missing path or no files |
 
 - Validate the complete application root, not an independently selected fragment.
@@ -40,7 +40,8 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
   Exit/`--warnaserror` apply to that reported set; inspect the separate whole
   application counts before a whole-model claim. Unknown/ambiguous scopes exit 2.
 - `--check <names>` (repeatable) or `--check all` opts into completeness warnings
-  PLAY0530–PLAY0537. Whole-source errors skip them; a skipped check is not passed.
+  including PLAY0530–PLAY0537, purposes (PLAY0602–0606) and privilege (PLAY0652).
+  Whole-source errors skip them; a skipped check is not passed.
   Names/codes, coverage limits and editor support: `diagnostics.md`.
 - Warnings are failures here. PLAY0029 (a construct dropped silently) and the unresolved-name
   warnings are the defects this verdict exists to catch.
@@ -62,7 +63,7 @@ MCP reports `V2 not run: no MCP in this agent` unless the brief supplies fresh o
    source revision).
 4. Report the codes with counts, blocking (error severity) apart from informational. A list
    with blocking entries is a valid V2 result (`V2 read: 6 blocking, PLAY0268 x3 list query,
-   @pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
+   pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
    information-severity diagnostics (PLAY0269 deferred UI, PLAY0270 authoring metadata such as
    descriptions, personas and screens) on models that bind; they do not block.
 
@@ -79,9 +80,9 @@ comparison needs it). Binding is what makes a model renderable at all. V3 means
 never "specifications pass".
 
 - Report the ESM version the model needs: `V3 ready (screenplay 4.68.0, ESM v6)`,
-  `V3 blocked: PLAY0268 x3 (list query, @pii) - design scope kept`.
-- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `@pii`,
-  `@sensitive`, authorization, list queries, automations or rules to reach V3; record the
+  `V3 blocked: PLAY0268 x3 (list query, pii) - design scope kept`.
+- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `pii`,
+  `secret`, authorization, list queries, automations or rules to reach V3; record the
   slice and the code in the gap list.
 - A model is executable only on the compiler that bound it. V3 does not carry
   to render admission: CLI 3.41.0 passes up to ESM v7 to Stage, refuses newer

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -17,7 +17,7 @@ probe; older probes retain their original labels in the other references.
 
 | Source | Pin | Evidence |
 | --- | --- | --- |
-| Screenplay language, standalone tool and MCP | **4.125.0** (`4d818eb`) | Released tag `v4.125.0`; installed `screenplay --version` and `--help` |
+| Screenplay language, standalone tool and MCP | **4.127.0** (`e70435a4`) | Released tag `v4.127.0`; installed `screenplay --version`; changed identity/compliance examples compiled |
 | cratis CLI | **3.41.0** | Released tag `v3.41.0`; installed `cratis --version` |
 | Screenplay bundled by CLI | **4.114.0** | CLI `v3.41.0:Directory.Packages.props` |
 | Stage bundled by CLI | **4.51.3** | Same file; the CLI's runtime image follows its Stage package version |
@@ -30,7 +30,7 @@ on PATH can shadow a newer install; inspect `which -a cratis`.
 
 ## Two compilers, one rule
 
-Standalone Screenplay 4.125.0 and the CLI's 4.114.0 bundle are different releases.
+Standalone Screenplay 4.127.0 and the CLI's 4.114.0 bundle are different releases.
 Prefer standalone for the current language checks; CLI owns generation, Prologue
 and rendering. Name the tool/version with every verdict. No verdict transfers
 between differing compilers without checking the same inputs there.
@@ -62,7 +62,7 @@ for identity-stable selection.
 
 ## Admission boundaries
 
-Screenplay `v4.125.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports schema
+Screenplay `v4.127.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports schema
 pairs through v10. Generated values/responses and policy negation select v7;
 sources/streams and command/specification routes select v8; reaction
 `runs as system [role "<Role>"]` selects v10 and reference-executes on 4.125.0.
@@ -86,6 +86,13 @@ The renderable-subset and Stage references retain older probes explicitly;
 read them as tested snapshots, not as a claim that Stage 4.51.3 shares every
 4.24.2 limitation. Query the actual bundled renderer before a V5 claim.
 
+At 4.127.0, `$identity` aliases built-in caller paths; declared identity details
+remain metadata and their executable reads report PLAY0268. Bare `pii`/`secret`
+still block binding; `personal` aliases `pii`. Legacy markers are accepted with
+PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
+purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove
+lawfulness or enforce retention. See command-surface context/compliance references.
+
 ## Historical probes
 
 - Screenplay 4.68.0 admitted v7; CLI 3.28.2/3.28.3 bundled 4.66.0 (v6 at most),

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -3,6 +3,12 @@
   "input": "Check a Screenplay model folder: which compiler should I run, what do V1 to V3 mean, and what does the cratis CLI do with my Automation slice?",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "4.127.0" },
+    { "kind": "skill-contains", "value": "PLAY0653", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0646", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0595", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0652", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0504 | E", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "references/versions.md" },
     { "kind": "skill-contains", "value": "PLAY0029" },
     { "kind": "skill-contains", "value": "--warnaserror" },

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -68,7 +68,7 @@ The `.play` model is the source of truth; Stage-managed output is derived from i
 - Hand-written code goes in `Customizations/` (unmanaged), in a separate project, or in
   an explicitly authorized gap-fill for scope Stage cannot render (`cratis-screenplay-render-and-gap-fill`).
 - A customization never makes a rejected model renderable, and never weakens modeled
-  authorization, validation or `@pii` to get past a refusal.
+  authorization, validation or personal-data and secret markers to get past a refusal.
 - Never claim a whole-application result from a subset of the model.
 
 ## Publication and recovery
@@ -135,7 +135,7 @@ Facts that surprise:
 
 ## Historical Stage 4.24 admission
 
-Current pins are standalone Screenplay 4.125.0 / CLI 3.41.0 / Stage 4.51.3.
+Current pins are standalone Screenplay 4.127.0 / CLI 3.41.0 / Stage 4.51.3.
 Routes bind/reference-execute as v8; reaction `runs as` identity as v10.
 CLI renders through v7 only (CLI-RENDER-004 for newer model versions) and its
 older 4.114.0 parser rejects `runs as` (PLAY0137). Stage 4.51.3's direct planner

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.22.0",
+  "version": "7.23.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [