@cratis/pi 7.22.0 → 7.24.0

package/package/corpus/skills/cratis-screenplay-discovery/SKILL.md

@@ -54,7 +54,7 @@ Statements here were checked at those tags:
 | `<Type>[]`, shapes must be declared; `@pii` and `reason` on concepts | `v4.66.0:Documentation/screenplay/events.md`, `concepts.md` |
 | `then denied`, `given caller`, `then error` | `v4.66.0:Documentation/screenplay/specifications.md` |
 | PII on an event-source id is rejected by Chronicle (CHR0034); nullable event properties warn (CHR0012) | Chronicle `v19.32.0:Source/Clients/DotNET.CodeAnalysis/DiagnosticIds.cs` |
-| Any `@pii` or `@sensitive` on a concept fails binding (PLAY0268) | `v4.66.0:Source/DotNET/Screenplay/Semantics/SemanticModelBinder.Concepts.cs:21-24` |
+| Any `@pii` or `@sensitive` on a concept fails binding (PLAY0268) at 4.66.0; current markers are in `cratis-screenplay-command-surface` | `v4.66.0:Source/DotNET/Screenplay/Semantics/SemanticModelBinder.Concepts.cs:21-24` |
 
 Every complete `screenplay` fence in this skill compiles with the standalone compiler
 4.68.0 (`--warnaserror`) and with `cratis screenplay validate --warnings-as-errors` 3.28.2.
@@ -88,7 +88,8 @@ to reach the intended result." With a brief, restate domain and goal in two sent
 
 **Unattended: assume visibly.** Never stop to ask. Take the most reasonable assumption,
 record it with its reason in the session STATE.md (`.ai-work/screenplay/<model-slug>/STATE.md`,
-untracked) and, when it shapes the model, in the feature `description`. Keep what the user
+untracked) and, when it shapes the model, in the feature's fenced `documentation` (a short
+**ASSUMED** marker may stay in its `description`). Keep what the user
 decided apart from what you assumed. Never guess silently.
 
 ## Procedure
@@ -111,7 +112,7 @@ decided apart from what you assumed. Never guess silently.
    a set-aside, an open question, or "does not apply, because ...". Unattended: model a lens
    fact only when the input implies it; otherwise record an open question.
 5. **Plot: order and branch** (`references/plotting-and-handoff.md`). Walk from the first
-   trigger to every end. In each event's slice `description` record what it comes **after**,
+   trigger to every end. In each event's slice `documentation` record what it comes **after**,
    what **causes** it (persona, schedule, outside party, other fact) and what it is **only
    allowed under** (intent). At every event ask what can happen next *instead*, including
    nothing, and which next steps may happen in any order. Classify forks: *outcome branch* (one
@@ -123,8 +124,15 @@ decided apart from what you assumed. Never guess silently.
    two business facts that make it meaningful. A simple state transition may carry no payload
    beyond its identity: do not pad events with fields just to reach a count. Domain names; `<Type>[]` for collections (declare the `type`); a
    `concept` for a value with its own meaning; classify personal data on the concept with
-   `@pii` and a reason now. `@pii` compiles but does not bind (PLAY0268 at 4.66.0): record it
-   as a known target gap; never drop it to get a clean result.
+   bare `pii` and a reason now; operational secrets use `secret` (4.127.0).
+   Either blocks binding (PLAY0268); record the gap, never drop protection.
+   Ask what use, lawful basis, retention, recipient/transfer and erasure needs the
+   data serves; declare those in a `purpose`, not a concept reason. Special/criminal
+   qualifiers describe the value, not legal permission. See command-surface
+   `references/compliance.md` for purpose coverage checks and the processing record.
+   For who-is-calling details, distinguish token claims from a keyed single-result
+   identity-source query or opaque implementation. The `identity` block is metadata;
+   executable detail reads remain unsupported. See `references/context.md` in command-surface.
 7. **Validate, gate, hand off.** After a coherent batch of edits (not every sentence) run V1
    with the tool and version named (`cratis-screenplay-toolchain`). Stop storming a workflow
    when the user says it is complete or both closing questions return nothing new; unattended,
@@ -144,7 +152,7 @@ decided apart from what you assumed. Never guess silently.
   matches alphabetically. Unimported folder files remain visible after ranked siblings.
   MCP `expand-layout` preserves this order with import barrels; an import-less
   `PlayFileWriter.Expand` layout falls back to path order. Order is presentation, not
-  execution or identity. Keep causes and branches in the feature `description` and STATE.md.
+  execution or identity. Keep causes and branches in the feature `documentation` and STATE.md.
 - A misspelt keyword inside a slice is only warning PLAY0029 and the block disappears: always
   validate with warnings as errors.
 
@@ -152,7 +160,7 @@ decided apart from what you assumed. Never guess silently.
 - An event is a fact the business wants to remember: past tense, business verb, two to four
   words, specific (`BerthAssigned`, not `BerthUpdated`). No generic edit events.
 - One business decision usually yields one event; several facts recognised separately may
-  yield several, with the reason in the slice `description`.
+  yield several, with the reason in slice `documentation`.
 - Calculated values are views, not events, unless the calculation is itself a decision the
   business must be able to show later (a quoted price, a fee set for the season).
 - Personas are roles with a purpose. A read-only persona is legitimate; a role that neither
@@ -162,7 +170,7 @@ decided apart from what you assumed. Never guess silently.
 - A hand-over from an outside party is named as the fact we learn from it
   (`MooringPermitGranted`). If most of a story is the outside party's steps, model only what
   crosses to us.
-- A rule that depends on stored state goes into the `description` of the slice it constrains
+- A rule that depends on stored state is recorded in `documentation` on the slice it constrains
   (`only if ...`), marked as stated intent not enforced in the model today, with its target
   enforcement named for `cratis-screenplay-streams-and-consistency` and
   `cratis-screenplay-slice-design`. Never state copies, attestation booleans or rules living

package/package/corpus/skills/cratis-screenplay-discovery/references/event-naming.md

@@ -56,7 +56,7 @@
 - Optional event properties: the default is none. Chronicle warns on nullable event
   properties (CHR0012) and a specification cannot state `null` for an event value (PLAY0350).
   Make the value required, or record the second situation as its own event. Keep `optional`
-  only for a detail the business genuinely may not have, with the reason in the `description`.
+  only for a detail the business genuinely may not have, with the reason in event `documentation`.
 - Does the event restate the creation event's fields (a generic edit in disguise)? Ask which
   business change it records; if none, name the specific correction or drop it.
 - Never put personal data in the event-source id; one data subject per event.

package/package/corpus/skills/cratis-screenplay-discovery/references/facilitation.md

@@ -38,7 +38,7 @@ that decision. If not, note the need as a view and move on.
 ## Unattended runs
 
 - Never block on a question. Take the most reasonable assumption, record it in STATE.md with
-  why, and mark it in the feature `description` when it shapes the model.
+  why, and record it in feature `documentation` when it shapes the model.
 - Prefer assumptions that keep the model honest (fewer, clearly named facts) over ones that
   invent detail.
 
@@ -52,6 +52,7 @@ See "Evidence and privacy" in SKILL.md.
 4. List assumptions taken.
 5. Per workflow give the happy path, the decision points and the terminal facts in a few lines.
 6. Propose the next step: the next workflow, or `cratis-screenplay-slice-design` for this one.
-7. Update STATE.md (phase, status, carry-forward); keep durable rationale in model
-   `description` text, which is rendered and queryable; `//` comments survive printing at
-   Screenplay v4.66.0, but check the dropped-comments report after any edit that cannot retain them.
+7. Update STATE.md (phase, status, carry-forward); keep durable rationale in fenced Markdown
+   `documentation`, summaries in `description`. At 4.127.0 canonical printing retains
+   documentation on its owner; MCP exposes it, but it changes no `modelRevision` and
+   reaches no rendered code. Inspect dropped comments after canonicalizing edits.

package/package/corpus/skills/cratis-screenplay-discovery/references/human-workshop.md

@@ -142,7 +142,7 @@ lists non-human causes (schedules, outside parties) separately.
 - Ask everywhere: "What happens next instead, including nothing?"
 
 Do not get stuck on exact timing; the point is the logical flow. The agent keeps the feature
-`description` story line and after / caused by / only if in the slices current
+`documentation` story line and after / caused by / only if in the slices current
 (`plotting-and-handoff.md`).
 
 ### 6. Sweep and close (15 to 20 minutes)

package/package/corpus/skills/cratis-screenplay-discovery/references/interview-questions.md

@@ -21,14 +21,14 @@ assumption you take instead of asking.
 | Outside | Which outside parties or systems send or receive information here? | Later translations and contracts | they send facts we rely on: ask how we recognise which of our records it concerns |
 | Corrections | Can a recorded fact turn out wrong? How is it put right today? | Correction and reversal events instead of edits | "we just edit it": ask who needs to know it was changed |
 | History | What would an auditor, a regulator or an angry customer ask to see later? | Finds facts that look like detail but must be kept | a calculation must be shown later: treat it as a fact |
-| People's data | Which values identify or describe a person? How long may we keep them? | `@pii` on concepts before event shapes settle | data about two people in one fact: consider separate facts |
+| People's data | Which values identify or describe a person? For what use, basis, retention, recipients/transfers and erasure exceptions? | bare `pii` on concepts; purpose declarations separate from reasons | special/criminal data needs declared safeguards; two people in one fact may need separate facts |
 | Volume | How often does this happen, and how long does one instance live? | Informs stream design later; never a reason to drop a fact | an instance lives for years: note it for stream review |
 | Input | What do we have to go on: written rules, a rough list, word of mouth, a running system? | Sets how hard to sweep | only word of mouth: run every sweep lens |
 | Who decides | Who has the final word on what this means for the business? | Separates decisions from assumptions | no one present: mark meaning as assumption to confirm |
 | Hotspots | Where does this go wrong, get disputed or need workarounds today? | Focuses depth | per hotspot: what happened the last time? |
 | Competition | Can two parties want the same thing at the same moment? | Uniqueness rules, competing claims | yes: who wins, and what does the other see? |
 | On behalf | Does anyone do this for someone else, or override it? | Authority and denial | yes: may they, and must we record who acted? |
-| In any order | After this, which next steps must wait for each other and which need not? | Ordering, later automations | they need not: say so in the feature description |
+| In any order | After this, which next steps must wait for each other and which need not? | Ordering, later automations | they need not: say so in the feature `documentation` |
 | Instead | At this point, what else could happen instead, including nothing? | Branches and endings | "nothing": does it expire or wait forever? |
 
 ## Interview flow

package/package/corpus/skills/cratis-screenplay-discovery/references/personas-and-causes.md

@@ -61,8 +61,8 @@ into exactly one of these:
 
 1. **Executable.** An `authorize` gate with a role, claim or authenticated policy the persona
    does not satisfy, or an ownership policy (`claim "x" matches subject|<command property>`),
-   plus a `then denied` specification whose `given caller` carries the roles and claims that
-   stand for that persona (`cratis-screenplay-scenario-coverage`). Every command and query
+   plus a `then denied` specification using `given caller as <Persona>` for a
+   synthesized witness, or an explicit effective-gate caller (`cratis-screenplay-scenario-coverage`). Every command and query
    under an inherited module or feature `authorize` gets its own denial spec. Ownership
    against a Uuid-backed identifier is not renderable today (STAGE-ESM-015): note it.
 2. **Gap or target requirement.** The check depends on stored state ("only the requester may
@@ -74,8 +74,11 @@ into exactly one of these:
 Anything not yet resolved is an open question. Do not write Cannot lines for rules that bind
 everyone (business rules, not authority).
 
-A spec that passes is not a persona check by itself: it proves the gate refuses a caller with
-those roles and claims. Say which fixture stands for which persona.
+A passing spec proves the gate refuses that caller, not every caller fitting a
+persona. `given caller as <Persona>` chooses one authenticated policy witness;
+inspect its `or` choice. Use explicit fixtures for anonymous callers, ownership
+claims, missing gate conjuncts or refused synthesis. Name which witness stands
+for which persona.
 
 ## Cannot resolved to an executable gate
 

package/package/corpus/skills/cratis-screenplay-discovery/references/plotting-and-handoff.md

@@ -13,8 +13,9 @@
 
 Plotting arranges the discovered events as a narrative: what happens first, what depends on
 what, what can happen instead, where it ends. In Screenplay the plot is written into the
-model (slice and feature `description` text) and into STATE.md; files sort by name, so story
-order is never carried by structure.
+model (fenced `documentation` on slices and features) and into STATE.md. Board order is the
+authored declaration and import order; it is presentation, not causation, so write causes and
+dependencies down.
 
 ## 1. Sequence
 
@@ -23,7 +24,7 @@ what came before it, what made it happen, what is it only allowed under?
 
 ## 2. Record after / caused by / only if
 
-Write these three into the `description` of the `StateChange` slice that produces the event:
+Write these three into the `documentation` of the `StateChange` slice that produces the event:
 
 ```text
 After:     BerthRequested
@@ -48,7 +49,7 @@ At every event, not only at forks someone mentions:
 
 - What can happen next *instead*, including nothing? Does "nothing" expire, or wait forever?
 - Which next steps may happen in any order, and which must wait for each other? Unordered
-  successors become automations or ordering specs later; say so in the feature description.
+  successors become automations or ordering specs later; say so in the feature `documentation`.
 - On failure or refusal, what compensates, and is the refusal itself a fact the business must
   remember (a decision) or just a rejection (a scenario later)?
 
@@ -62,7 +63,7 @@ thing from the views that listed it).
 
 ## 4. Plot output format
 
-Put a compact story line in the feature `description` and report the plot per workflow:
+Put a compact story line in the feature `documentation` and report the plot per workflow:
 
 ```text
 The plot: SeasonalBerths
@@ -92,7 +93,7 @@ Switch only at a genuine handoff (a boat owner requests a berth, then the Harbou
 act on it) or as a deliberate cutaway to show what another persona sees. A change to another
 persona's read model is not automatically a new beat; it earns one only when that persona
 would look at it as the next step. Do not alternate personas for symmetry. Carry each real
-handoff into the feature `description` and the slice-design handoff packet; a cutaway is
+handoff into the feature `documentation` and the slice-design handoff packet; a cutaway is
 marked as such there.
 
 ```text
@@ -105,7 +106,7 @@ Alternating: Harbourmaster, BoatOwner, Harbourmaster, BoatOwner with no handoff
 When the story is about a *view* rather than a stream (a waiting list, a work queue, a berth
 board), a set of isolated before/after pairs hides what the user cares about: the same read
 model changing over time. Note it as one narrated walkthrough in STATE.md and the feature
-`description`: empty, then an item added, then the item done or failed, then removed, naming
+`documentation`: empty, then an item added, then the item done or failed, then removed, naming
 the event that causes each step. It is a seed only; discovery writes no specification.
 `cratis-screenplay-scenario-coverage` turns it into cumulative lifecycle specifications on
 the read model, and `cratis-screenplay-automations-and-translations` owns the work-queue

package/package/corpus/skills/cratis-screenplay-discovery/references/storming-loop.md

@@ -29,7 +29,7 @@ then reports what changed and asks one question. The user should always be able
    | rename | better business name for an existing fact | identity-affecting once persisted: see SKILL.md |
    | split | one name was covering two facts | keep the original if it is persisted; add the second |
    | merge | two names for one fact | only when they truly mean the same thing |
-   | reorder | the story order changed | change declaration/import order for the board; update the feature `description`/STATE.md for causes and branches |
+   | reorder | the story order changed | change declaration/import order for the board; update the feature `documentation`/STATE.md for causes and branches |
    | drop | not a fact after all | record why in STATE.md |
    | none | already modeled | say so briefly |
 
@@ -68,7 +68,7 @@ What a model looks like after the first workflow has been stormed: no commands,
 or screens yet. Slices are named after the command expected to produce each event. At
 Screenplay 4.125.0, boards use authored declaration/import order, and MCP `expand-layout`
 preserves it with imports. An import-less `PlayFileWriter.Expand` layout still falls back to
-path order. Order is presentation only; the feature `description` records causes and branches.
+path order. Order is presentation only; the feature `documentation` records causes and branches.
 Persona `description` text holds Does / Reads / Cannot on one quoted line here; the multi-line fenced
 form is in `personas-and-causes.md`.
 

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -53,7 +53,7 @@ Framework repositories and brownfield work that has not opted in stay code-first
   handlers, adapters, and scope Stage cannot render yet (the model stays the contract).
 - **Never:** use code as a shortcut around the model; change the model to match
   existing code; edit Stage-managed output; leave a modeled rule living only in
-  code; weaken protection (authorization, `@pii`, rules) so a model compiles or renders.
+  code; weaken protection (authorization, `pii`, rules) so a model compiles or renders.
 
 **2. Run the lifecycle.** Load `cratis-screenplay-modeling-lifecycle` for modes, the
 independent verdicts V1-V5, the P0-P9 phases with their gates, stop-or-assume,
@@ -131,7 +131,7 @@ What binds depends on **which tool** you ask, so name the tool and its version:
 - `reads` and `concurrency` on a command do not bind (`PLAY0271`), so no decision is
   protected against stale state. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
-- `persona` declarations are report-only and never block; `@pii` and `@sensitive`
+- `persona` declarations are report-only and never block; bare `pii` and `secret`
   concepts do block binding (`PLAY0268`). Keep them anyway: the classification is
   part of the model. Report the block.
 - Generated values/responses bind and reference-execute as v7; sources, streams
@@ -191,6 +191,16 @@ do not assume; it lands as `module`, `persona` and `import`; protocol in
 `cratis-screenplay-discovery`). Phase 2 designs one workflow at a time through all nine steps
 ([nine-steps.md](references/nine-steps.md): activities, Screenplay output, questions).
 
+## Keep modeling reasoning with its declaration
+
+Use `description` for summaries and fenced Markdown `documentation` on modules,
+features, slices, commands, read models and reactions (also events) for assumptions,
+boundaries and rejected alternatives. Do not leave that reasoning only in comments
+or disconnected notes. Both are report-only (PLAY0270), never executable rules.
+Specifications use `description` to name the witnessed behavior; longer reasoning
+belongs to their slice. Syntax, merge rules and diagnostics:
+[model reasoning](../cratis-screenplay-slice-design/references/model-reasoning.md).
+
 ## The prime directive: do not lose information
 
 Store what happened (events), not just current state. Events are immutable
@@ -243,7 +253,7 @@ compile or will not be safe. Both are deliberate.
 ## Naming the primitives is the highest-value work
 
 Name concepts before events, classify personal data at the concept, keep events past tense and single-purpose, and never put the event-source identity in an event payload.
-Read [references/naming-primitives.md](references/naming-primitives.md) when declaring concepts, `@pii` classification, event shapes, `identifier`, inline events or `id "<old name>"` pins.
+Read [references/naming-primitives.md](references/naming-primitives.md) when declaring concepts, `pii` classification, event shapes, `identifier`, inline events or `id "<old name>"` pins.
 
 ## Quick gate - before specifications are called done
 

package/package/corpus/skills/cratis-screenplay-event-modeling/references/naming-primitives.md

@@ -5,10 +5,12 @@
   `Decimal`, `Bool`, `Date` and `DateTime`; `Enum` is a separate concept kind,
   with its values indented beneath.
 - **Classify personal data at the concept**, with a reason:
-  `concept PersonName : String @pii` plus an indented `pii reason "..."`. Every
+  `concept PersonName : String pii` plus an indented `pii reason "..."`. Every
   usage inherits it; a reason for an attribute the concept does not declare is an
-  error. Decide this before fixing event shapes - erasure follows the subject and
-  the subject follows the stream.
+  error. Decide this before fixing event shapes; purpose/basis/retention belong in
+  processing-purpose declarations, not a reason. An event subject defaults to the
+  source unless supplied; the trailing event-property `subject` mark is report-only
+  at 4.127.0, not runtime lineage. See command-surface `references/compliance.md`.
 - **Events are past tense and self-describing** - `InvoiceRegistered`, never
   `Created`. One purpose per event; an event needing an optional property to cover
   two situations is two events.

package/package/corpus/skills/cratis-screenplay-event-modeling/references/nine-steps.md

@@ -215,8 +215,7 @@ reaction's `reads UnpaidInvoice` is report-only metadata at 4.66.0 (information
 it does not make the model consult the view. Binding therefore admits only a scheduled
 invocation that records a timestamp. Choosing which invoices are overdue (due date before the
 clock instant) is a target-side decision: record it as gap-fill with the model as the
-contract (`cratis-screenplay-render-and-gap-fill`), and say so in the slice description as
-the example does. Do not claim the specification proves the overdue decision.
+contract (`cratis-screenplay-render-and-gap-fill`), and say so in the slice `documentation`. Do not claim the specification proves the overdue decision.
 
 ```screenplay
 domain Acme.Invoicing

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -22,7 +22,9 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 | Construct | Current standalone disposition |
 | --- | --- |
 | `persona`, domain/authentication metadata | Report-only; unknown named policies remain source defects |
-| Compliance concepts | Preserve protection; portable binding gaps are not permission to remove it |
+| Compliance concepts | Bare `pii`/`secret` (4.127.0); binding still refuses PLAY0268, never remove protection |
+| Identity details / processing purposes / event subject | Report-only metadata (4.127.0); executable detail reads refuse PLAY0268, not source declaration errors |
+| Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; Stage 4.51.3 member refusals STAGE-ESM-028/029 |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -148,12 +148,20 @@ chain per slice before handoff (evidence template); never manufacture references
      `<Noun>Updated`): split by intent;
    - refusals: input or constraint rejection is `validate` / `require` / constraint plus
      `then error` with the exact message from code; authorization refusal is `authorize` plus
-     `then denied`. Legacy HTTP codes and check order go in the description;
+     `then denied`. Legacy HTTP codes and check order go in the slice `documentation`;
    - a state-dependent rule is `reads <View>` + `require ... message "..."`, marked **NOT enforced
      in the model today**, target named; a unique index with business meaning becomes
      `unique ... on <every event that sets it>` with `released by`
      (`references/rule-modeling.md`);
-   - keep `@pii` / `@sensitive` and authorization found in code; every role gate has `authorize`
+   - preserve personal-data/secret protection and authorization found in code,
+     using bare `pii` / `secret` (4.127.0); deprecated marker repairs keep legal
+     notes intact, never guess a purpose or basis. Derive purpose/use/retention
+     declarations only from evidence or expert decisions; run `--check purposes`
+     and inspect the processing record as prompts, not a legal verdict. Keep
+     hand-joined legacy ids scalar; never infer composite parts by splitting text.
+     Event `subject` is report-only; distinguish observed lineage from runtime
+     realization. See command-surface `references/compliance.md`.
+     Every role gate has `authorize`
      plus a `then denied` spec, else a recorded gap; rules you cannot express truthfully are
      recorded one by one, never fabricated.
 3. Cite evidence ids in each slice `description` ("Evidence: E3, E7"). Read `references/intent-example.md` when authoring the intentional candidate to check the complete example of evidence citations, re-slicing, constraints, authorization and recorded state-dependent rules.
@@ -195,7 +203,7 @@ handoff packet appended, first line `Outcome:`; no prose reports in the model ro
   same-application canonical exports with authoritative catalogs; it does not guess
   rename continuity, run specifications or prove recovered behavior. Inspect
   incomplete sections and exclusions before using the result in the loss report.
-- Never weaken protection (authorization, `@pii`, rules) to make the candidate compile.
+- Never weaken protection (authorization, `pii`, rules) to make the candidate compile.
 
 ## Gate
 

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/loss-report-template.md

@@ -31,7 +31,7 @@ and the question raised.
 One line per rule, named individually (never one generic platform caveat): the rule, its
 evidence row, the invariant and consistency risk, and the target enforcement. State-dependent
 checks are written as `reads` + `require` and marked NOT enforced in the slice description;
-date rules and opaque policies that no declaration can state stay in `description` and here.
+date rules and opaque policies that no declaration can state stay in the slice `documentation` and here.
 
 ## Unknowns and undecided target decisions
 | Row/question | What is unknown | Who can answer | Candidate assumption |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/rule-modeling.md

@@ -4,19 +4,19 @@
 - Input or constraint rejection: declarative `validate`, `require` or constraint, plus a
   `then error "<exact legacy message>"` specification.
 - Authorization refusal: `authorize` with a policy (role, claim, authenticated, or an
-  ownership policy) plus `then denied`, with caller fixtures carrying the roles or claims.
+  ownership policy) plus `then denied`, with a synthesized persona caller or an explicit effective-gate fixture.
   Every command and query under an inherited module or feature `authorize` gets its own
   `then denied` spec. A role gate with no executable form is a recorded gap.
 - Legacy HTTP status and check order (for example 409 before 403) are facts about the old
-  system: record them in the slice description and the evidence row, not in the model logic.
+  system: record them in slice `documentation` and the evidence row, not in the model logic.
 
 ## State-dependent rules
 A rule that depends on stored state (current status, existing records, balances) is written
 as `reads <View>` + `require <expr> message "…"` and the slice description says it is **NOT
 enforced in the model today** (PLAY0268/0271 at binding are expected in design mode;
 Screenplay#129/#209). Name the invariant, the race it leaves open, and the target:
-`[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; hand-written code only,
-not available in Stage-rendered applications, which pin Arc 22.25.0), or a Chronicle
+`[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; available to gap-fill
+in Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0 package set, not automatically emitted), or a Chronicle
 `concurrency` scope on the event source or stream, or a constraint where one fits. Forbidden: caller-supplied copies of state
 in `require`, boolean inputs standing in for a rule (`confirmsX == true`), and rules hidden in
 `handler`/`implementation hint` prose. Descriptions are not rendered (Stage#178), so a rule

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/signal-to-intent.md

@@ -14,7 +14,7 @@ who decided it?* If nobody can answer, classify the row `unknown` and ask.
 |---|---|---|---|
 | One request writes several tables | one decision; one table carries the fact, the others are consequences | one event per table (`CheckinCreated`, `HookUpdated`) | one event named for the decision (`CoatTakenIn`); consequences become projections |
 | Generic update route (`PUT /members/{id}`) | several intents hidden behind one form | one `MemberUpdated` event | split by which columns change together and why (address change, suspension, renewal); ask experts. No `Update/Edit/Save<Noun>` command and no `<Noun>Updated/Changed` event; a full-payload `*Updated` event is the default generator output and a review signal |
-| Request with no table write and a 4xx status | a rejected attempt; evidence of a rule | Prologue models it like a success (status codes are ignored) and the merge can strip properties | `validate`/`require`/constraint plus a `then error` spec with the exact message from code (authorization refusals are `then denied`); legacy HTTP code and check order go in the slice description |
+| Request with no table write and a 4xx status | a rejected attempt; evidence of a rule | Prologue models it like a success (status codes are ignored) and the merge can strip properties | `validate`/`require`/constraint plus a `then error` spec with the exact message from code (authorization refusals are `then denied`); legacy HTTP code and check order go in slice `documentation` |
 | 2xx with no table write | read, idempotent no-op, or external side effect | treated as a command | check code; classify |
 | Single-column unique index | a business uniqueness rule, or a technical key | every unique index becomes a constraint, or a clear business rule is dropped to a bare `rule` | when the meaning is clear, `unique <prop> on <every event that sets it>` plus `released by <removal event>`; list collation, case and reuse questions. Fall back to a bare `rule` only when no constraint form fits, and record that as a loss. A purely technical key stays out |
 | Foreign key | an identity relation between streams or read models | copying the parent id into every event | keep ids only where a consumer needs the value |

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -23,7 +23,7 @@ contract is in `cratis-screenplay-ui-composition`.
 
 ## Verified product sources
 
-Current authoring/MCP guidance follows Screenplay v4.125.0
+Current authoring/MCP guidance follows Screenplay v4.127.0
 `Documentation/screenplay/mcp/`, `ast-authoring.md`, `folders.md`, `vscode.md`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
 tool. Pins are in `cratis-screenplay-toolchain` `references/versions.md`.
@@ -130,9 +130,9 @@ and applies; others send an edit request ([MCP loop](references/mcp-loop.md)).
 3. Prefer `propose-rename` for supported logical renames: it coordinates fragments,
    repairs proven references and preserves assigned identities. Never substitute
    global string replacement for an explicit refusal.
-4. Use `propose-ast` for typed additions, replacements, removals and moves. Group
-   related cross-file changes in one batch so no broken intermediate state lands.
-   Parser-invalid source can be repaired by typed whole-document replacement.
+4. Use `propose-source` for whole text or `propose-ast` for typed edits
+   (Authoring defaults); `propose` is executable-only. Batch changes;
+   details: `references/mcp-tools.md`.
 5. Keep reference policy `Safe`. Use `Draft` only for deliberately requested
    unresolved model debt and report that debt; it does not waive structural,
    identity or binding-protection checks.
@@ -178,6 +178,8 @@ each lost comment (`PLAY0288` also reports their count and lines). Untouched
 documents retain exact bytes. A printer that loses requested structural fields
 rejects the plan.
 
+`identityMigrationIssues`: read the [MCP loop](references/mcp-loop.md).
+
 ## Repair or extract before rewriting
 
 Read `read-workspace` with `view: "diagnostics"`, then `view: "repairs"` at the
@@ -199,6 +201,7 @@ from silently changing the reviewed candidate.
   No automatic generation-evolution repair ships.
 - `PLAY0479`: migrate optionality spelling with `PreserveTrivia`; document scope
   migrates all occurrences together. Keep the `query Q => observable?` exception.
+- Compliance repairs PLAY0565/0653: [MCP tool guide](references/mcp-tools.md).
 
 Use `propose-extract-inline-event` on the inline `EventSyntax` handle before adding
 a generation (canonical formatting consent; refuses comment loss; no reverse
@@ -258,7 +261,8 @@ target or consequence expands.
 Readiness has two verdicts: `readiness.authoringAccepted` says the source is valid
 Screenplay; `executableReady` describes only the current executable subset. Do not
 call a model broken because it is not executable, and prefer `propose-ast` for
-full-language authoring. A rejected proposal lists its diagnostics: fix those, do not
+focused full-language edits, or `propose-source` for whole documents. A rejected
+proposal lists its diagnostics: fix those, do not
 retry the same input.
 
 ## Code attachments
@@ -303,7 +307,7 @@ a generated app that silently drops authored UI. Use the Screenplay-owned canoni
 corpus fixture path when it exists instead of copying `.play` examples into this
 repository.
 
-Repair and refactoring guidance follows Screenplay v4.125.0. The Cratis
+Repair and refactoring guidance follows Screenplay v4.127.0. The Cratis
 CLI bundles its own Screenplay version, so check the installed `tools/list`
 schemas before relying on a view or argument named here (for example
 `dropped-comments` or `implementation-requirements`). Do not invent a command,

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -6,6 +6,7 @@
 ## Contents
 
 - Accepted constructs
+- Caller, subject and stream nodes
 - Container dependencies and exact numbers
 - Complete model
 - Source validity is not execution
@@ -21,7 +22,7 @@ repository is the full list; this page is the authoring summary.
 ## Accepted constructs
 
 **Top level:** `domain`, `import`, `concept`, `type`, `policy`, `persona`,
-`authentication`, `trigger`, `theme`, `layout`, `ui profile`, `behavior`,
+`authentication`, `identity`, `purpose`, `trigger`, `theme`, `layout`, `ui profile`, `behavior`,
 `module`, `seed`, authoring-only `system`, and admitted `eventsource` with its `stream`s (ESM v8).
 
 **Inside a module:** `description`, `authorize`, `import "<glob>"`,
@@ -59,13 +60,37 @@ compiling the entire document set.
 
 Concept primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 `DateTime`; `Enum` is a separate concept kind whose members are indented below
-it. Concepts can carry `@pii`, `@sensitive`, reasons and validation.
+it. Concepts carry bare `pii` (`personal` alias), `secret`, reasons, personal-data
+qualifiers, secret scopes and validation. Legacy markers report PLAY0565 information;
+repeated header markers report PLAY0653 warning. Purposes declare the use/basis/retention
+separately; see command-surface `references/compliance.md`.
 
 Projections and captures use their dedicated sub-grammars. Inline code uses a
 tagged fence (` ```csharp `); the older language-line form still parses with
 warning `PLAY0397`. Query the MCP's `syntax-schema` instead of inventing JSON
 members or translating names from memory.
 
+## Caller, subject and stream nodes
+
+At v4.127.0 the typed syntax includes `IdentityExpressionSyntax` (`$identity`),
+`IdentitySyntax`, `IdentityDetailSyntax`, `ClaimIdentitySourceSyntax`,
+`QueryIdentitySourceSyntax`, `CodeIdentitySourceSyntax`, `FileIdentitySourceSyntax`.
+`ApplicationSyntax.Identity` carries the block; query schemas before editing JSON.
+Built-in caller paths are aliases of `$context.identity`; declared detail reads
+are authoring-only and refuse executable binding (PLAY0268), while the block alone
+does not block readiness. Claim/query sources have exactly one source and no body.
+See command-surface `references/context.md` for key/type/gate restrictions.
+
+`PropertySyntax.isSubject` marks an event's required unprotected scalar subject,
+omitted from structural JSON when false. It is lineage metadata (PLAY0270), not
+runtime subject propagation or generated C# `[Subject]`. Read-model marks are
+unsupported. `ReactionSyntax.RunsAs` / `ReactionIdentitySyntax` carry the system
+actor (ESM v10); MCP `declaration-details` includes `runsAs`.
+
+`EventStreamIdPartSyntax` and `streamIdParts` describe a composite stream-id schema;
+route mappings cover all named parts. Current routes are admitted as v8, not an
+old PLAY0268 gap. Never infer composite parts by splitting legacy scalar ids.
+
 ## Container dependencies and exact numbers
 
 At Screenplay 4.125.0, modules and features accept `depends on <Name>`, one
@@ -229,7 +254,7 @@ Screenplay 4.66.0 (before 3.28.2, Screenplay 4.60.1, differ where stated).
 | Binds as ESM v7 on standalone Screenplay 4.68.0 (source and release notes; `PLAY0268` on the 4.66.0 in Cratis CLI 3.28.x, probed) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and a generated property on a concept with validation rules is `PLAY0268`. Stage 4.24.2 does not render them (`STAGE-ESM-016`, tracked in Stage#201): gap-fill |
 | Authorable, not executable (PLAY0268) | Systems/operations, exact numbers and refusal/redelivery remain unadmitted |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10 on 4.125.0. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | `@pii`/`@sensitive` concepts (probed: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model whose keyed queries in its own slice do not share one `by` property (none, or two different properties; several queries over the same property bind), any query other than `=> <ReadModel> optional` with one caller-supplied `by` argument (so also observable, filtered, scoped and performer-backed queries), `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0268`) | `pii`/`secret` concepts (also legacy spellings; historical probe: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model whose keyed queries in its own slice do not share one `by` property (none, or two different properties; several queries over the same property bind), any query other than `=> <ReadModel> optional` with one caller-supplied `by` argument (so also observable, filtered, scoped and performer-backed queries), `$causedBy` and templates in projections |
 | Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |
@@ -264,9 +289,11 @@ Use standalone `screenplay test` or MCP `run-specifications` for a reference
 verdict, and independently check CLI/Stage admission. Never drop a contract to bind.
 Generated values and `returns` are no longer in this group: they bind from 4.68.0 (ESM v7).
 Protected reads and `derive`/`provide` (not admitted by any supported ESM version) have no documented
-syntax at v4.68.0: do not teach or invent one. Affected-instance declarations, per-event data
-subjects, external event origin and query paging/sorting/change-set delivery also
-remain unavailable here.
+syntax at v4.68.0: do not teach or invent one. Affected-instance declarations and query paging/sorting/change-set delivery
+remain unavailable here. Event `subject` is report-only authoring metadata at
+4.127.0; public events/origin are admitted as ESM v9 (not provider realization).
+Purpose declarations, references and processing records are authoring metadata,
+not retention or lawful-processing enforcement.
 
 `Type optional` is canonical for admitted type references; `Type?` remains
 compatible with information `PLAY0479`. The modifier follows `[]` for an optional