@cratis/pi 7.22.0 → 7.24.0

package/package/corpus/skills/cratis-application-slice-conformance/SKILL.md

@@ -73,7 +73,7 @@ are, is `cratis-screenplay-modeling-lifecycle` ("Decide the level first").
 4. Existing code has no authority over the contract.
 
 Precedence inside the contract. Executable parts of the contract beat prose: specifications,
-mappings, constraints and authorization first; then the `description` and realization notes;
+mappings, constraints and authorization first; then the `description`, `documentation` and realization notes;
 then issue text. If prose contradicts an executable part, that is a model defect: stop that
 scope, return an **edit request** (address, change, reason) and do not pick a side silently.
 Reading a question is not resolving it. Details: `references/contract-and-precedence.md`.

package/package/corpus/skills/cratis-application-slice-conformance/references/contract-and-precedence.md

@@ -23,11 +23,11 @@ or the unmanaged extension code.
 
 ## Precedence (highest first)
 1. Executable parts: specifications, mappings, constraints, authorization, rules.
-2. The slice `description` and realization notes: they explain intent and never license a
-   contradiction or an undocumented default. Realization notes are the explicit realization
-   requirements stated in a description: they bind adapters and fallback code, cannot contradict
-   executable parts, and are never supplemented with inferred rules; other description prose is
-   only a hint.
+2. The slice `description`, its fenced `documentation`, and realization notes: they explain intent
+   and never license a contradiction or an undocumented default. Realization notes are the explicit
+   realization requirements stated in the `description` or `documentation`: they bind adapters and
+   fallback code, cannot contradict executable parts, and are never supplemented with inferred
+   rules; other prose is only a hint.
 3. Issue or ticket text.
 4. Existing code: no authority.
 

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -59,7 +59,8 @@ sends again.
 A field left out of `map` still passes through the capture's working record: omission is not
 redaction. Check the append mappings and every resulting event property, and record whether
 the target stores raw or last-seen source records and how they are minimized.
-Personal data kept in events needs `@pii` on its concept and a purpose; keep the annotation
+Personal data kept in events needs bare `pii` on its concept and a declared purpose
+(see command-surface `references/compliance.md`); keep the marker
 even when it blocks binding. Never record bearer tokens, magic links or signed URLs as facts
 (a keyed hash or reference at most), and never put PII on the event-source id.
 
@@ -123,7 +124,15 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
    `runs as system role "<Role>"` (ESM v10). An undeclared actor remains caller-less.
    CLI/Stage realization is a separate gap; a returned-command reactor uses
    `[ExecuteCommandsAsSystem("<role>")]` and the matching policy. Never strip a
-   gate or supply `given caller` as a fictional reaction identity.
+   gate or supply `given caller` as a fictional reaction identity. Arc supplies a
+   system principal only to reactors marked `[ExecuteCommandsAsSystem]`; without
+   it there is no principal and `[Authorize]`/`[Roles]` deny. `runs as` covers returned
+   or invoked commands, not imperative pipeline calls, reads, productions or causation.
+   On Screenplay 4.127.0 run `--check privilege --warnaserror` (PLAY0652) for
+   confused-deputy paths: every trigger-event producer must require **all** declared
+   system roles. Ungated commands/captures/reaction productions warn; opaque gates
+   are information, not proven safe. An OR alternative does not require a role.
+   Clock/application triggers have no producer and are silent; still review trust.
 5. **Trace inputs.** Every trigger value, command input, event property and destination needs a
    supported source; every filter a business reason. Gaps are questions, not invented mappings.
 6. **Repetition and termination.** Identify one logical work occurrence and what a retry is. Guard the
@@ -140,7 +149,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 ## Rules
 **Compiler contracts** (diagnostics at 4.66.0)
 - No inline `produces event` in a reaction (PLAY0474); declare reaction-produced events in the slice.
-- Effects sit under a trigger; only `description` and `where` are reaction-level; one `where` per
+- Effects sit under a trigger; `description`, `where` and current `runs as` are reaction-level; one `where` per
   reaction (PLAY0252); a trigger may not repeat (PLAY0253).
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
@@ -161,7 +170,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
   record. A fan-out records one outcome per item; partial success is failure at an effect boundary
   (`cratis-engineering-effect-boundaries`), never a batch "done" while members failed.
 - Infrastructure (logging, caching, retries, outbox plumbing) is never a Translate slice.
-- Personal data kept in events needs `@pii` on its concept; keep it even when it blocks binding or render.
+- Personal data kept in events needs `pii` on its concept; keep it even when it blocks binding or render.
 - Code bodies (`file`, inline fences) document realization; no local engine runs them.
 
 **Review questions**

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -56,7 +56,7 @@ Outcomes:
 
 When a todo list is not needed: the effect is immediate, internal and cannot fail (a direct
 `produces` or co-production), and nobody needs to see pending work. Say why in the slice
-`description`; do not add a list just to follow a pattern.
+`documentation`; do not add a list just to follow a pattern.
 
 ## 3. Effects: `produces` vs `invokes`
 | | `produces <Fact>` | `invokes <Command>` |
@@ -80,8 +80,8 @@ not identity inferred from prose or an imperative pipeline call.
 Decide and record one of:
 1. **Internal ungated command** - only if the security design supports it: not reachable by
    outside callers in the target (verify; the model cannot show exposure), safe to repeat
-   (guarded by `unique event`), and touching one stream. State the reasons in the module
-   `description` (as `todo-list-example.md` does) and list "not externally exposed" as a target
+   (guarded by `unique event`), and touching one stream. State the reasons in module
+   `documentation` (the historical `todo-list-example.md` used a description) and list "not externally exposed" as a target
    requirement in `STATE.md`.
 2. **Direct `produces`** - when no decision is left (the fact is already decided) and nothing
    should refuse it.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -38,7 +38,7 @@ One spec in the slice does not cover the others.
 | invalid | unknown code, wrong type | `translate` has no entry -> decide and specify |
 | changed / corrected | outside value changes after our fact | correction fact or open decision (`translation-patterns.md` §6) |
 | mis-correlated | reference points at the wrong stream | property constraint on the external reference, or an expert review case |
-| personal data | field we must not keep | excluded from the append mappings; note in `description`; the source record may still carry it |
+| personal data | field we must not keep | excluded from the append mappings; record the reason in `documentation`; the source record may still carry it |
 | authenticity / ownership | wrong source, tenant or entity reference | specify the rejection and name where it is enforced; capture metadata does not verify it |
 | each mapping branch | every recognized code has its intended local meaning | concrete payload and exact translated values; unknown code is a separate case |
 | same object, different occurrence | two legitimate events share a provider object id | both stay representable; dedup hits only the repeated occurrence |

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/effects-and-idempotency.md

@@ -70,7 +70,7 @@ See "Effect guarantees and recovery traps" in SKILL.md.
   the target's replay behaviour before relying on it, and record the answer.
 See "Effect guarantees and recovery traps" in SKILL.md.
 
-## What to write down (slice `description` + `STATE.md`)
+## What to write down (slice `documentation` + `STATE.md`)
 - Effect placement (1-4) and why. Placement 4 is syntax-only: say the model then has no
   executable form.
 - The idempotency key, and whether the outside system honours it.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/integration-contracts.md

@@ -1,7 +1,7 @@
 # Integration contracts
 
 Use before completing a new or changed translation. Keep accepted decisions in the relevant
-`.play` descriptions and specs; open questions and target requirements go to `STATE.md`. Do
+`.play` `documentation` and specs; open questions and target requirements go to `STATE.md`. Do
 not create a second canonical model.
 
 ## Resolve only the unknowns

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/realization-and-gap-fill.md

@@ -17,14 +17,16 @@ with `cratis-screenplay-render-and-gap-fill`.
 | Model element | Realization | Skill |
 |---|---|---|
 | reaction `when <Event>` with `invokes` or `produces` | Chronicle reactor returning commands or events | `cratis-chronicle-reactor` |
-| trusted actor for `invokes` | `[ExecuteCommandsAsSystem("<role>")]` on the reactor plus a policy requiring the role (Arc, since v20.56.0; available in a rendered app's Arc 22.25.0) | `cratis-chronicle-reactor` |
+| trusted actor for `invokes` | `[ExecuteCommandsAsSystem("<role>")]` on the reactor plus a policy requiring the role (Arc, since v20.56.0; available in Stage 4.51.3's rendered Arc 22.50.5) | `cratis-chronicle-reactor` |
 | clock trigger, application trigger | scheduler or host signal that raises the occurrence | `cratis-engineering-effect-boundaries` |
 | call to an outside system | adapter behind an effect boundary, keyed by the idempotency key in the model | `cratis-engineering-effect-boundaries` |
 | capture source (webhook, poll, topic) | adapter that authenticates, parses and appends | `cratis-engineering-effect-boundaries` |
 | replay versus recovery redelivery | `[OnceOnly]` for replay; a receipt keyed by `ReactorDelivery.Id` for recovery | `cratis-chronicle-reactor` |
 
-`[ProtectedDecision]` (Arc v22.39.0 and later) is not available in a Stage-rendered app (Arc
-22.25.0), and `Directory.Packages.props` there is Stage-managed: do not edit it to get a newer Arc.
+Stage 4.51.3 rendered apps pin Arc 22.50.5/Chronicle 19.32.0, so
+`[ProtectedDecision]` and `DecisionRead<T>` are available to gap-fill, not
+Stage-emitted enforcement. Admit the projection/key and enroll the read in the
+active unit of work; never edit managed `Directory.Packages.props`.
 
 ## Faithful realization
 A realization may choose the reactor, scheduler or queue mechanism. It may not: drop pending

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/translation-patterns.md

@@ -33,7 +33,7 @@ thing by it. Keep it as a property when it is needed to correlate or deduplicate
   `<X>WebhookReceived` are smells; a business fact such as `PaymentReceived` is fine).
 
 ## 4. Per-field disposition
-For every field of the outside record, decide and write in the slice `description`:
+For every field of the outside record, decide and write in slice `documentation`:
 | Disposition | Meaning | Screenplay |
 |---|---|---|
 | **map** | carried into our fact as is or translated | `map` + mapping `x = $.x`; `translate` for codes |

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -77,7 +77,8 @@ scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
 
 CLI 3.41.0's 4.114.0 compiler rejects this source with PLAY0137; its version gate
 and Stage 4.51.3 planner admit only through v7. Target realization is gap-fill,
-using Arc `[ExecuteCommandsAsSystem]` for returned commands. Each invoked command
+using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
+Arc supplies no principal and `[Authorize]`/`[Roles]` deny. Each invoked command
 is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 
 ⚠️ **Declared, not enforced.** A trigger `reads` gives no runtime protection. From
@@ -177,7 +178,7 @@ optional.
 
 ⚠️ **Indentation decides what is a trigger and what is an effect.** `produces`,
 `invokes`, `file` and inline code belong **inside** the trigger block, indented
-under `when`/`every`/`at`. Only `description` and `where` sit at reaction level.
+under `when`/`every`/`at`. `description`, `where` and `runs as` sit at reaction level.
 Outdenting an effect gives *Expected a trigger in reaction body, got 'invokes …'*
 (`PLAY0137`) — the compiler is looking for another trigger where the effect is.
 
@@ -239,7 +240,7 @@ append-time constraints. `invokes` asks for a command, which additionally runs t
 command's authorization, validation and requirements, and may reject.
 Using `produces` for both would say those are the same kind of consequence.
 
-**Who is the caller of an `invokes`?** Nobody; see *Caller-less invokes and unprotected reads* above before writing one.
+**Who is the caller of an `invokes`?** Nobody unless `runs as` declares the actor; see *Caller-less invokes and unprotected reads* above before writing one.
 
 Both are declarations of *what happens*, not of how — a trigger can state its
 consequences **and** carry a `file` or an inline block in a tagged fence

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -32,7 +32,7 @@ source is the single flow model.
 | `Cratis.Screenplay` | main `fd18129` | Inline events, repairs and canonical `optional`; changed examples compiled |
 | `Cratis.Screenplay` | `4.66.0` (`c89198b`) | Binding behaviour of `handler`, code attachments, `persona` and compliance attributes: `Semantics/SemanticModelBinder*.cs`, `Diagnostics/DiagnosticCodes.cs` |
 | `Cratis.Screenplay` | `4.68.0` (`79801bf`) | Historical generated-value/response rule probes (ESM v7) |
-| `Cratis.Screenplay` | `4.125.0` | Current source guidance: routes, operations, negation, protected identifiers and pre-generation contexts; released `commands.md`, `operations.md`, `policies.md`, `context.md`, `diagnostics.md` |
+| `Cratis.Screenplay` | `4.127.0` | Current identity and compliance guidance: released `identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`, `diagnostics.md`; changed examples compiled |
 
 Historical examples/probes retain the table's original versions; current source
 guidance is not a relabeled old execution result. Compilation checks syntax and
@@ -50,8 +50,8 @@ concept DiscountPercentage : Decimal
   validate
     >= 0    message "A discount cannot be negative"
     <= 100  message "A discount cannot exceed 100 percent"
-concept PersonName : String @pii
-  pii reason "Billing contact name; lawful basis: contract performance."
+concept PersonName : String pii
+  pii reason "Identifies the billing contact."
 concept InvoiceStatus : Enum
   draft
   sent
@@ -61,31 +61,19 @@ concept InvoiceStatus : Enum
 The seven primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 `DateTime`. `Enum` is **not** one of them — it is a separate concept kind, which
 is why the compiler says *expected … or Enum* rather than listing it among them.
-Attributes `@pii` and `@sensitive`, each with at most one `reason`; a
-reason for an attribute the concept does not declare is an error. **Compliance is
-inherited** — a property typed with a `@pii` concept is PII everywhere. The
-executable model does not bind compliance attributes (`PLAY0268`, "compliance attributes
-require portable data-subject semantics"), so a `@pii` model stops at authorable (V1);
-keep the attribute, because the classification is the point, and never drop it to bind
-or render.
-
-`@pii` is personal data (erasable); `@sensitive` is an **operational secret** (API key,
-token, a company's bank account number): encrypted at rest without erasure and withheld
-from the causation chain (Screenplay decision 0034, Screenplay#384). C# providers render
-`@sensitive` as `[Encrypted]` + `[NotAudited]`, `@pii` as `[PII]`, and `@pii @sensitive`
-as `[PII]` only, because Chronicle rejects `[PII]` with `[Encrypted]` (`CHR0053`); Stage
-renders this from v4.29.0. The executable model still stops at `PLAY0268` for either.
-
-⚠️ **Identifiers are neither `@pii` nor `@sensitive`.** Chronicle rejects `[PII]` on an
-event source id (`CHR0034`) and `[Encrypted]` on one (`CHR0052`); Screenplay reports
-`PLAY0515` for `@pii` from Screenplay 4.69.1 and for `@sensitive` from 4.84.1, on a
-command identifier, an explicit `for` destination or an event source identifier; earlier
-versions compile it silently and only Chronicle catches it. Current PLAY0515
-also covers scalar stream-id types, composite parts and nested route mapping
-sources. It is a source error, including typed destinations, not a binding-only
-warning. Keep the stream identity a surrogate `Uuid`
-concept and carry the personal value (name, email) as a separate `@pii` property and a
-secret as a `@sensitive` property.
+Use bare `pii` for personal data (`personal` is the same marker) and `secret`
+for operational secrets. **Compliance is inherited** from concepts, including
+nested uses. Either marker blocks executable binding with PLAY0268; keep the
+protection. `pii personal` is redundant and warns PLAY0653. Legacy `@pii`,
+`sensitive` and `@sensitive` remain accepted with PLAY0565 information and a repair.
+Read [compliance and purposes](references/compliance.md) for reasons, special/criminal
+qualifiers, secret scopes, provider mappings, purpose declarations and coverage checks.
+
+**Identifiers cannot be personal data or secrets.** PLAY0515 is a source error
+for command identifiers, typed `for` destinations, event-source identities,
+scalar/composite stream-id types and nested route mapping sources, including legacy
+markers. Keep a surrogate identity and carry protected data in the payload.
+Chronicle likewise rejects `[PII]`/`[Encrypted]` identifiers (CHR0034/CHR0052).
 
 ⚠️ **Enum trap.** A value literally named `validate` is read as an empty validate
 block. Write `@validate` for the value; the compiler warns when it sees the
@@ -244,8 +232,8 @@ choosing or omitting `for` on a production, or fixing `PLAY0469`-`PLAY0478`.
 
 - **Mapping sources** that bind to the executable model: a command property
   (`= invoiceNumber`), a literal (`= "draft"`, `= 0`), `$context.occurred`, and
-  the caller's audit identity (`$context.identity.id`/`.name`/`.userName`, the
-  same values as `$context.causedBy.*`). The last two select ESM v2.
+  the caller's audit identity (`$identity.id`/`.name`/`.userName`, also supported
+  as `$context.identity.id`/`.name`/`.userName`, the same values as `$context.causedBy.*`). The last two select ESM v2.
   `$context.tenant`, claims, roles, causation, `$env.` values, templates and
   computed expressions parse but block binding (`PLAY0268`).
 - **`for <identifier>`** on an indented line names the event source the event is
@@ -272,8 +260,12 @@ produces when isProForma == true
 
 ## Routes and external operations
 
-Named event sources/streams and command routes bind as ESM v8 at 4.125.0;
-CLI 3.41.0 render rejects models above v7. The complete checked route example
+Named event sources/streams and command routes bind as ESM v8 (verified at 4.125.0);
+CLI 3.41.0 render rejects models above v7. A routed command's identifier and
+known event destinations must match the source's nominal identifier type
+(PLAY0504, error). Allocation uses the generated identifier's type, or without
+one requires a UUID-based source. Composite `streamId` routes map every named
+part exactly once; scalar `streamId T` and `streamId = x` remain valid. The complete checked route example
 and nested `streamId =` form are in `cratis-screenplay-toolchain`
 `references/sources-and-streams.md`.
 
@@ -353,7 +345,15 @@ not both win — a `validate` rule cannot do that.
 A policy has **exactly one** `require` line (`PLAY0441`) **or** one implementation, never both (`PLAY0440`). Read [references/policy-persona-seed.md](references/policy-persona-seed.md) when
 declaring a policy, a persona, or a `seed` block.
 
-## `$context`
+## Event data subject
+
+One event property may carry trailing `subject`; it identifies the person whose
+data the event holds, not the stream identity. Only unprotected required scalar
+String/Uuid or String/Uuid/Int-backed concepts are allowed. The mark is report-only
+(PLAY0270), changes no ESM bytes and emits no C# `[Subject]` yet; read models are
+not supported. See [subject lineage](references/compliance.md#identify-the-person-not-the-stream).
+
+## `$context` and `$identity`
 
 Four contexts, and **what each omits is load-bearing** — when writing a code body or a context/expression mapping, read
 [context.md](references/context.md) for the full member lists, the declarative
@@ -369,7 +369,7 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
 ## Verify
 
 - [ ] Validate the complete model root with warnings as errors; name the tool,
-      version and result. Current pins: standalone 4.125.0 / CLI 3.41.0; bundle
+      version and result. Current pins: standalone 4.127.0 / CLI 3.41.0; bundle
       compatibility and execution are separate checks.
 - [ ] No unintended `PLAY0478` or `PLAY0479` information remains.
 - [ ] At most one command property carries `identifier`, and no event property does.
@@ -379,8 +379,9 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
       is stated.
 - [ ] Constraints are `unique` forms; no `file` constraint stands in for another rule.
 - [ ] Each policy has one `require` or one implementation, not both.
-- [ ] Personal data is `@pii` on the concept, with a reason; no identifier concept is `@pii`;
-      operational secrets are `@sensitive` (never `@pii`), and no identifier concept carries either.
+- [ ] Personal data is `pii` on the concept; operational secrets are `secret`;
+      no identifier or subject concept carries either. Reasons explain the value,
+      while purposes declare basis/retention; run `--check purposes` separately.
 - [ ] No `handler` where the model must bind, and no bodied construct described as
       runnable or renderable without saying which tool admits it.
 - [ ] No event carries an optional property covering two situations.

package/package/corpus/skills/cratis-screenplay-command-surface/references/compliance.md

@@ -0,0 +1,154 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Personal data, secrets and processing purposes
+
+## Contents
+
+- Classify the value on its concept
+- Declare the use separately
+- Identify the person, not the stream
+
+Authority: Screenplay v4.127.0 `concepts.md`, `purposes.md`, `events.md` and
+`diagnostics.md`; decision 0041. These declarations do not establish lawful
+processing or enforce retention. Check provider support separately.
+
+## Classify the value on its concept
+
+```screenplay
+concept Email : String pii
+  pii reason "Contact address"
+concept MedicalNote : String personal
+  personal special health
+concept ConvictionNote : String pii
+  pii criminal
+concept PartnerApiKey : String secret
+  secret scope namespace
+  secret reason "Credential for the partner API"
+```
+
+`personal` is an alias of `pii`, not a second classification; canonical printing
+writes `pii`. Write one marker. `pii personal`, `pii pii`, `secret secret` and
+`@pii @pii` report one PLAY0653 warning per header. Both compilers retain the
+first occurrence of each marker and attach body settings to it. The concept-line
+repair removes later tokens with `PreserveTrivia`, retaining notes and comments.
+
+`@pii`, `sensitive` and `@sensitive` still compile but are deprecated: one PLAY0565
+information diagnostic per line. The line/document repair migrates them to bare
+`pii`/`secret` without moving notes. `--warnaserror` does not fail on information.
+Unknown markers report PLAY0566. Never remove protection to get a model to bind.
+
+A reason is an optional free-text note about the value, not a lawful basis,
+purpose or retention policy. At most one reason per declared marker; a reason for
+an absent marker is an error. Classification is inherited through concept uses,
+including fields nested in composite types; do not put markers on properties or
+composite types.
+
+`pii special` requires one of `racialOrEthnicOrigin`, `politicalOpinions`,
+`religiousOrPhilosophicalBeliefs`, `tradeUnionMembership`, `genetic`, `biometric`,
+`health`, `sexLifeOrSexualOrientation` (GDPR Art. 9(1)). `pii criminal` records
+Art. 10 data and may coexist with `special`. These qualifiers require `pii`;
+unknown categories and repeated `special` lines are errors (PLAY0570/0571).
+A photograph alone is not biometric identification data.
+
+`secret scope` accepts `subject`, `namespace`, `global`; omitted scope retains
+Chronicle's Subject default. Scope on `pii`, duplicate scope and unknown values
+are errors (PLAY0567/0568). Explicit scope on `pii secret` warns (PLAY0569),
+because only `[PII]` renders. Changing scope for persisted event uses requires a
+new event generation.
+
+C# provider mapping: `pii` → `[PII]`; `secret` → `[Encrypted]` + `[NotAudited]`;
+`pii secret` → `[PII]` only (Chronicle refuses `[PII]` with `[Encrypted]`, CHR0053).
+This mapping is not admission: either marker, including qualifiers and scopes,
+still blocks executable binding with PLAY0268. Subject lineage is a different
+role, described below.
+
+## Declare the use separately
+
+```screenplay
+concept ContactName : String pii
+  pii reason "Identifies the customer's contact"
+purpose Billing
+  description "Issue invoices and collect payment"
+  basis contract
+  subjects customer, customerContact
+  retention "Until the customer relationship ends"
+  recipient "Payment provider"
+module Finance
+  purpose Billing
+  feature Invoices
+    slice StateChange RecordContact
+      command RecordContact
+        name ContactName
+```
+
+A top-level `purpose` has optional singleton `description`, `basis` (optional
+quoted legal reference), `interest`, `condition` (optional quoted reference),
+`authorization`, `subjects` (comma-separated categories), `retention`, and
+`erasure exception`; `recipient` and `transfer "<destination>" safeguard
+"<safeguard>" repeat. Text fields are quoted; description also accepts a text
+fence. Unknown closed values or repeated singleton fields are errors.
+
+- `basis`: `consent`, `contract`, `legalObligation`, `vitalInterests`, `publicTask`,
+  `legitimateInterests` (Art. 6(1)). The last needs a nonblank `interest` statement;
+  inconsistent interest/basis warns (PLAY0601).
+- `condition`: `explicitConsent`, `employmentLaw`, `vitalInterests`, `notForProfit`,
+  `madePublic`, `legalClaims`, `substantialPublicInterest`, `healthCare`,
+  `publicHealth`, `research` (Art. 9(2)).
+- `erasure exception`: `expression`, `legalObligation`, `publicTask`,
+  `publicHealth`, `archiving`, `legalClaims` (Art. 17(3)).
+
+Repeat `purpose <Name>` on modules, features or slices. Coverage is the **union**
+of those references and ancestors' references, unlike authorization's AND rule.
+Unresolved references warn (PLAY0600). Purpose metadata adds no ESM bytes and
+reports PLAY0270; it does not implement consent, a legal hold or crypto-shredding.
+
+Run `screenplay <root> --check purposes --warnaserror`: PLAY0602–0606 prompt for
+uncovered personal data (including nested concepts), missing special-category
+conditions, criminal authorization, bases and unused purposes. Ordinary compile
+does not run this check. Findings are investigation prompts, never a legal verdict.
+
+`screenplay report processing <root> --format markdown|json|csv` derives the
+processing record; optional `--controller-name` and `--controller-contact` are
+explicit inputs, never inferred. MCP `processing-record` returns revision-bound,
+count/byte-bounded pages (`offset`, `expectedSourceRevision`); repeat controller
+inputs across pages. Invalid source prevents reporting; binding is not required.
+Opaque code/imports/runtime protections are not inferred. Zero purposes yields
+zero rows, not compliance. Special/criminal data prompts a DPIA assessment, not a
+claim of large-scale processing. An erasure exception with reachable `pii` flags
+that per-subject crypto-shredding also destroys data kept for that purpose.
+Move legal declarations out of old reasons by hand; repairs never guess them.
+
+## Identify the person, not the stream
+
+An event property may end in `subject`, last among modifiers (before `=` on an
+inline mapping). Each generation may choose one mark independently:
+
+```screenplay
+concept CustomerId : Uuid
+module Billing
+  feature Contact
+    slice StateChange ChangeContact
+      event CustomerContactChanged
+        customerId CustomerId subject
+        note String
+```
+
+Required scalar `String`/`Uuid`, concepts over either, and Int-backed concepts
+are allowed. Bare Int, optional/collection/composite values, enums, Decimal,
+Bool and dates are refused. A `pii` or `secret` concept is refused because
+`EventContext.Subject` is plaintext. Use a surrogate identity; an empty String
+cannot be detected statically and Chronicle falls back to the event source.
+Equal identity strings across entity kinds share one subject; favor Uuid.
+
+PLAY0590–0595 cover multiple marks, invalid/protected types, wrong owner,
+unsupported read-model marks and repeated/out-of-order modifiers. The mark is
+report-only (PLAY0270): it changes no ESM bytes or runtime value and emits no
+C# `[Subject]` yet. Without a supplied subject the runtime's
+`$eventContext.subject` defaults to the event source. Do not promise propagation,
+erasure, export or redaction from this declaration. MCP exposes `isSubject` and
+event summaries' `subject.source` (`eventSource` or `property`).
+
+The event data subject, `secret scope subject` (encryption scope), and policy
+`matches subject` (the thing acted on, not the caller) are three different roles.
+For actual Chronicle erasure and attributes, use `cratis-chronicle-compliance`.

package/package/corpus/skills/cratis-screenplay-command-surface/references/context.md

@@ -5,6 +5,7 @@
 - The four contexts
 - The values they carry
 - Reaching the context declaratively
+- Caller paths and identity details
 - Production metadata is not a context expression
 - The other expression roots
 - Templates and literals
@@ -97,6 +98,52 @@ roles, claims and causation report `PLAY0268`.
 
 An unknown `$context.` path is reported, so a typo does not silently become null.
 
+## Caller paths and identity details
+
+At Screenplay 4.127.0, `$identity.<property>` is the same caller value as
+`$context.identity.<property>`. Prefer `$identity` in new mappings; the older root
+is supported, not deprecated. The `cratis` CLI 3.41.0 bundles Screenplay 4.114.0, which predates both:
+its parser rejects a top-level `identity` block (`PLAY0001`), and with `--executable` it reads a
+`$identity.<property>` mapping as a raw expression (`PLAY0268`). Check these with standalone 4.127.0,
+and keep `$context.identity.<property>` where a model must go through `cratis render` today. Built-ins are `id`, `name`, `userName`,
+`isAuthenticated`, `roles`, `claims.<name>` (everything after `claims.` is opaque).
+Bare `$identity` reports PLAY0152; unknown properties report PLAY0155. Only
+`$identity.id`/`.name`/`.userName` bind in portable `produces` mappings, exactly
+like the older forms; roles, authentication status and claims still report PLAY0268.
+
+A top-level `identity` block declares additional typed caller details:
+
+```screenplay
+identity
+  description "What the application knows about whoever is calling"
+  department String optional from claim "department"
+  organization Organization optional from query MyOrganization by $identity.id
+module Organizations
+  feature Membership
+    slice StateView Mine
+      readmodel Organization
+        name String
+      query MyOrganization => Organization optional
+        by userId String
+```
+
+At most one block per document and assembled folder; layout expansion writes it
+to `application.play`. Each unique detail has exactly one source: opaque claim,
+keyed single-result query, tagged inline code fence or repository-relative `file`.
+It cannot redeclare built-ins. Claim/query sources have no body; refresh/cache
+belongs to the runtime. Query sources need `by <expression>` using only token
+built-ins, claims or literals, never another detail, input, environment or view.
+The query's effective authorization must not depend on details. Result type must
+match; an optional query result needs an optional detail, while a required result
+may populate an optional detail. Details may themselves be optional or collections.
+
+The block is **authoring metadata**, not runtime source resolution or ESM data.
+Declarations alone do not block executable readiness. Executable reads of
+`$identity.<detail>` report PLAY0268; `$context.identity` stays built-ins only.
+`scoped to` is an opaque scope name, not a detail reference. PLAY0633–0646 diagnose
+source/header/type/cardinality errors; there are no automatic identity repairs.
+Authority: v4.127.0 `identity.md`, `context.md`, `diagnostics.md`.
+
 ## Production metadata is not a context expression
 
 `namespace`, `sequence`, `correlation`, `causation`, `causedBy` and `occurred`
@@ -111,6 +158,7 @@ occurrence metadata; use `given clock`, never `given time`, to state scenario ti
 
 | Root | Where | Yields |
 | --- | --- | --- |
+| `$identity.<property>` | caller expression | built-in caller value or declared authoring detail; execution admission is narrower |
 | `$env.<VAR_NAME>` | mapping sources | an environment variable |
 | `$eventContext.<property>` | **projections only** | `occurred`, `sequenceNumber`, `correlationId`, `eventSourceId` |
 | `$eventSourceId` | **projections only** | shorthand for `$eventContext.eventSourceId` |

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -1,7 +1,7 @@
 ## Generated values and responses (ESM v7)
 
 A `generated` command property and `returns` response bind and reference-execute
-as ESM v7. Current pins are standalone Screenplay 4.125.0 and CLI 3.41.0
+as ESM v7. Current pins are standalone Screenplay 4.127.0 and CLI 3.41.0
 (bundled Screenplay 4.114.0/Stage 4.51.3); `cratis-screenplay-toolchain`
 `references/versions.md` owns the table. CLI#261 is closed: CLI now admits v7
 to Stage planning, but its v7 canonical corpus receives Stage generated-value

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -3,6 +3,12 @@
   "input": "Declare a Screenplay command with validation, authorization, a uniqueness constraint and a state-dependent rule.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "PLAY0653" },
+    { "kind": "skill-contains", "value": "personal` is an alias of `pii", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "report-only (PLAY0270)", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "--check purposes", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "PLAY0633–0646", "file": "references/context.md" },
+    { "kind": "skill-contains", "value": "The block is **authoring metadata**", "file": "references/context.md" },
     { "kind": "skill-contains", "value": "main `fd18129`" },
     { "kind": "skill-contains", "value": "produces event ProjectRenamed", "file": "references/inline-events.md" },
     { "kind": "skill-contains", "value": "name ProjectName = name", "file": "references/inline-events.md" },