@cratis/pi 7.33.0 → 7.34.0

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/prologue-safety.md

@@ -8,9 +8,9 @@
 - 4. Cleanup DDL to propose (run by the DBA after the Extractor is stopped)
 - 5. Capture verification before interpreting
 
-Sources: Prologue `ad4bbe7` (Extractor, Configuration, Interpretation) and cratis CLI
-`v3.28.2` (`Source/Cli/Commands/Prologue/*`, unchanged since `v3.27.1`; `LlmOptionsResolver.cs`,
-`Documentation/reference/prologue.md`). Tool versions: `cratis-screenplay-toolchain`
+Sources: Prologue `v2.0.0` (the version CLI 3.53.1 bundles; Extractor, Configuration,
+Interpretation) and cratis CLI `v3.53.1` (`Source/Cli/Commands/Prologue/*`,
+`LlmOptionsResolver.cs`, `Documentation/reference/prologue.md`). Tool versions: `cratis-screenplay-toolchain`
 `references/versions.md`.
 Everything here that touches a target system is
 **proposed** by the screenplay-modeler (legacy extraction) and run only by the user or DBA (or the main session
@@ -54,21 +54,28 @@ Nothing in Prologue removes what the Extractor created. Cleanup is manual; Crati
 
 ## 3. LLM use in `interpret` (preflight by the main session; a subagent runs interpret only
 when its brief records this preflight and the user's approval, otherwise it proposes)
-Resolution in the current cratis CLI (`LlmOptionsResolver.Resolve`):
-1. `cratis-prologue.json` with `llm.enabled: true` -> that provider;
-2. otherwise the **global** CLI configuration written by `cratis llm use` (a hosted provider,
-   or a local compatible endpoint) -> enabled, with the provider's public endpoint unless an
-   endpoint is set;
+`cratis prologue interpret --no-llm` forces heuristics-only interpretation: it never creates a
+chat client and sends no capture evidence to a model, whatever the local or global configuration
+says (CLI 3.37.1 or later; confirm with `cratis prologue interpret --help`). Cratis/cli#241 is
+closed. Without `--no-llm` the effective provider resolves in this order
+(`LlmOptionsResolver.ResolveWithSource`):
+1. an explicit local `llm.enabled` in `cratis-prologue.json`: `true` -> that provider, `false`
+   -> disabled, with no fallback to the global configuration;
+2. only when the local setting is absent, the **global** CLI configuration written by
+   `cratis llm use` (a hosted provider, or a local compatible endpoint);
 3. otherwise disabled.
-A local `llm.enabled: false` does **not** stop step 2. There is no `--no-llm` flag. This is
-an open defect: Cratis/cli#241 (`LlmOptionsResolver.Resolve` returns the Prologue `llm`
-section only when it is enabled, then falls back to the global CLI configuration).
+The command prints the provider, model, endpoint host and where the setting came from (`local
+file`, `global config`, `--no-llm`, `none`) to stderr before it sends any evidence, also in JSON
+and unattended runs; the JSON result carries an `llm` object. That notice informs the user; it
+does not replace the approval.
+
+Unattended default: pass `--no-llm` unless the brief records the approved disclosure.
 
 Preflight (read-only):
 - `cratis llm show -o json` (the key is masked) and the `llm` section of the
   `cratis-prologue.json` that interpret will find (PATH, then the current directory).
 - Report the effective provider, model and endpoint. If it is hosted, the whole payload sent
-  is (`RefinementPrompt.Evidence`, `EvidenceFormatter.cs` at `ad4bbe7`):
+  is (`RefinementPrompt.Evidence`, `EvidenceFormatter.cs` at `v2.0.0`):
   - the provisional model outline and the list of every provisional name in it, **uncapped**
     (inferred command, event and property names from all captures);
   - observed behaviour, each list capped at 50 distinct entries: `METHOD path` lines (concrete
@@ -78,11 +85,9 @@ Preflight (read-only):
     database (several observations can send more);
   - in an interactive run, the text of your answers to the model's questions.
 - Ask the user. The approval must cover that full payload; otherwise restrict or redact the capture
-  input first, or do not run interpret. Options for the
-  user: approve; switch to a local provider; remove the global setting themselves
-  (`cratis llm clear` changes their configuration, so it is their call); or run the batch
-  Interpreter container with a config whose `llm.enabled` is false and no CLI config mounted
-  (it writes `extraction-result.json` as well; not verified locally).
+  input first, or run `interpret --no-llm`. Options for the
+  user: approve; switch to a local provider; set `llm.enabled: false` in the local Prologue file;
+  or use `--no-llm`. Changing the global configuration (`cratis llm clear`) is the user's call.
 - Batch mode asks no questions; LLM failures fall back silently to the heuristic model.
 
 ## 4. Cleanup DDL to propose (run by the DBA after the Extractor is stopped)

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/provenance.md

@@ -8,11 +8,10 @@
 
 Verified product facts are listed under *Verified product sources* in `SKILL.md`.
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/rule-modeling.md

@@ -14,12 +14,12 @@
 A rule that depends on stored state (current status, existing records, balances) is written
 as `reads <View>` + `require <expr> message "…"` and the slice description says it is **NOT
 enforced in the model today** (PLAY0268/0271 at binding are expected in design mode;
-Screenplay#129/#209). Name the invariant, the race it leaves open, and the target:
+Screenplay#129). Name the invariant, the race it leaves open, and the target:
 `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; available to gap-fill
 in Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0 package set, not automatically emitted), or a Chronicle
 `concurrency` scope on the event source or stream, or a constraint where one fits. Forbidden: caller-supplied copies of state
 in `require`, boolean inputs standing in for a rule (`confirmsX == true`), and rules hidden in
-`handler`/`implementation hint` prose. Descriptions are not rendered (Stage#178), so a rule
+`handler`/`implementation hint` prose. Descriptions render only as XML doc comments (Stage#178), so a rule
 that exists only in prose is unenforced; list it in LOSS.md too.
 
 ## Unique indexes

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/side-car-migration.md

@@ -131,6 +131,7 @@ verification come first).
 - [ ] Extraction strategy defined for all in-scope legacy data; every table mapped or listed as unmapped
 - [ ] Event capture or load pipeline designed and owned
 - [ ] New behaviour scoped as modeled slices with their own acceptance
+- [ ] Accepted model and the new side-car code compared structurally with `cratis screenplay conform <model-root> --project <path>` (CLI 3.42.0 or later; exit 0 no blocking findings, 1 defects, 2 could not run or incomplete; same MSBuild trust caveat as `generate`, so use a trusted clone; structural address matching only, never a behavior or equivalence verdict)
 - [ ] Traffic routing designed; users can tell which system they are in
 - [ ] Parallel-operation test plan and reconciliation check
 - [ ] Deprecation timeline agreed

package/package/corpus/skills/cratis-screenplay-legacy-extraction/verification.json

@@ -30,7 +30,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "cli#241"
+      "value": "--no-llm"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -263,8 +263,8 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Reaction with trigger `reads` | Direct-producing (or code-bodied) reaction with `reads`: `PLAY0268` ("ESM v6 cannot protect that decision dependency", decision 0006), non-executable. Invokes-only reaction with `reads`: information only; the invoked command must declare and protect its own decision reads. Keep the `reads`; never remove them to obtain binding |
 | Binds as opaque code (v3); reference runner reports unsupported | Bodied reducers, bodied named rules, fenced `validate` blocks, code or file policies. A pure reducer body is the only attachment Stage 4.24.0 admits |
 | Information only, never blocks (probed) | `persona` (report-only: `PLAY0270`, the policies it lists must exist), `authentication`, `domain`, `seed`, descriptions and `file` provenance. A persona does not block binding and does not change behavior, so state persona scope in a description or a policy the model uses |
-| Binds as ESM v7 on standalone Screenplay 4.68.0 (source and release notes; `PLAY0268` on the 4.66.0 in Cratis CLI 3.28.x, probed) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and a generated property on a concept with validation rules is `PLAY0268`. Stage 4.24.2 does not render them (`STAGE-ESM-016`, tracked in Stage#201): gap-fill |
-| Authorable, not executable (PLAY0268) | Systems/operations, exact numbers and refusal/redelivery remain unadmitted |
+| Binds as ESM v7 on standalone Screenplay 4.68.0 (source and release notes; `PLAY0268` on the 4.66.0 in Cratis CLI 3.28.x, probed) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and a generated property on a concept with validation rules is `PLAY0268`. Stage 4.73.1 refuses them (`STAGE-ESM-028`/`-029`, Stage#175): gap-fill |
+| Authorable, not executable (PLAY0268) | Systems/operations, the `numbers exact` source mode (PLAY0268; exact lowering of qualifying Double literals is the admitted v11) and refusal/redelivery remain unadmitted |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10 on 4.125.0. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
 | Blocks binding (`PLAY0268`) | `pii`/`secret` concepts (also legacy spellings; historical probe: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with filters, scope, performer, context-derived `by` or composite `by` blocks (optional keyed and collection queries, including observable delivery, bind at 4.135.0), `$causedBy` and templates in projections |
 | Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -129,7 +129,7 @@ the server sends `roots/list` and serves `tools/list` after the reply).
    without writing. An
    unintended executable regression is discarded (`discard-proposal`) and
    re-proposed. Intent the user has accepted that does not run yet (operations,
-   exact numbers or refusal/redelivery; PLAY0268 by design)
+   the `numbers exact` source mode or refusal/redelivery; PLAY0268 by design)
    may be applied from a reviewed `Authoring` proposal: disclose the new
    diagnostics, report V3 as not binding-ready, and never drop or stub the
    construct. The server's own guidance is to apply such a proposal only when
@@ -174,11 +174,11 @@ the server sends `roots/list` and serves `tools/list` after the reply).
 | Edit class | Examples | Route |
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
-| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files; contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
+| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653` (and recipe-only `0397`) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |
 | Parser-invalid document | no editable handles | `propose-source` `replace-document` with corrected source, or typed `propose-ast` document replacement |
-| Unadmitted constructs | systems/operations, exact numbers, refusal/redelivery | reviewed Authoring `propose-source` (whole documents) or `propose-ast` (typed edits); preserve intent and report PLAY0268 |
+| Unadmitted constructs | systems/operations, the `numbers exact` source mode, refusal/redelivery | reviewed Authoring `propose-source` (whole documents) or `propose-ast` (typed edits); preserve intent and report PLAY0268 |
 | Admitted source/stream routing | ESM v8 at 4.125.0 | typed `propose-ast`; `propose-rename` repairs proven route references; target admission separate |
 
 ## Self-describing identity migration refusals

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -51,10 +51,12 @@ the [MCP loop](mcp-loop.md).
 | Source and validation | `diagnostics`, `read-document`, `merged-document`, `syntax-schema` | Read exact source or typed structure and diagnose problems |
 | Workspace inspection | `open-workspace`, `read-workspace`, `read-ast`, `workspace-state`, `export-workspace`, `repair-capabilities` | Obtain current identities, handles, readiness, code attachment requirements, source-map locations, durable-state status and the repair catalog |
 | Visual (MCP-Apps hosts only) | `visualize-model` | Draw the board for the model or a `proposalId`; its `sketch` argument previews a what-if of whole documents. Reads only |
-| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-repair`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
+| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-move`, `propose-repair`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
 | Review | `read-proposal`, `discard-proposal` | Inspect exact changes, dropped comments and proposed attachments, or abandon a connection-local proposal |
 | Effects | `apply`, `recover-workspace` | Apply an accepted plan or explicitly recover an interrupted write |
 
+`propose-move` moves a slice to another feature, or a feature to another module or feature, keeping identities: copy the `target` and `newParent` `{kind, parts}` addresses from the identity inventory and pass `expectedRevision` and `expectedCatalogRevision`. It repairs qualified references and `depends on`, and refuses identity loss, capture, collisions, descendant destinations, inherited authorization or screen-interaction changes and glob imports; review `moveReport` (`identityMigrations`, `referenceRepairs`, `fragmentsMoved`). It does not rename events, change pins or move files, and declaration moves between slices are deferred. Use it for legacy re-slicing instead of retyping declarations.
+
 `propose` is the executable-only whole-document interface. Prefer `propose-source`
 for whole `.play` text, `propose-ast` for focused typed edits, and `propose-rename`
 for proved logical renames. A

package/package/corpus/skills/cratis-screenplay-model-review/LICENSE

@@ -35,5 +35,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -17,7 +17,7 @@ adapted to `.play` declarations (`references/provenance.md`).
 ## When / when not
 - Use: P4 self-check; P5 independent review; auditing an existing or extracted model; reviewing a
   proposal or edit request before it is applied; checking a model before rendering; checking a
-  code diff in a repository with a model for model-first drift (checklist R1).
+  code diff in a repository with a model for model-first drift (checklist R1; `conform` is structural only).
 - Not for: changing the model (return findings; the modeler or the main session edits); writing
   missing specs (`cratis-screenplay-scenario-coverage`); designing slices
   (`cratis-screenplay-slice-design`); stream and invariant redesign
@@ -31,11 +31,10 @@ adapted to `.play` declarations (`references/provenance.md`).
 |---|---|---|
 | Screenplay | `v4.66.0` (`c89198b`) | MCP catalog (29 tools: `describe-application`, `search-declarations`, `dependencies`, `find-assertion-gaps`, `read-workspace`, `declaration-details`) in `Source/DotNET/Screenplay.Mcp/McpToolCatalog.cs`; diagnostics PLAY0029, PLAY0191, PLAY0268, PLAY0271, PLAY0350, PLAY0381, PLAY0469 in `Source/DotNET/Screenplay/Diagnostics/DiagnosticCodes.cs`; decision 0008 (one data subject per event) |
 | Screenplay | `v4.127.0` | `find-specification-obligations` (SPEC001–SPEC008 authored presence), `find-modeling-smells` (SMELL001–SMELL005 advisory questions); neither proves executed behavior or complete lineage |
-| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; previous CLI 3.46.1 predates these; see pin table below |
+| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; previous CLI 3.46.1 predates these |
 | cratis CLI | `v3.28.3` | bundles Screenplay 4.66.0 and Stage 4.24.2; see the toolchain skill |
 
-The full pin table lives in `cratis-screenplay-toolchain` `references/versions.md`; do not copy
-it here. Compilation (V1) does not establish reference execution.
+Historical sources; pins (v4.139.0: 39 tools): toolchain `references/versions.md`. Compilation (V1) does not establish reference execution.
 
 ## Interview phase
 Skip if the brief names the scope, the mode and the review kind.
@@ -65,7 +64,7 @@ model's behalf.
    `dependencies direction=incoming` for orphans. The verdict lines are independent: a V1 pass is
    necessary, never sufficient. Opt into completeness with `--check` or MCP
    `checks` for bindings, input surfaces, field origins, query keys, event consumers
-   and navigation; whole-source errors skip these checks. Record selected families,
+   navigation and personas (PLAY0574-0576); whole-source errors skip these. Record selected families,
    skipped status and coverage limits, never a vacuous pass. Any line without
    evidence is "not run: reason".
 3. **Element sweep** (phase 1, mechanical, before any judgement). One line per gated element, event,
@@ -255,10 +254,11 @@ verdict follows the rules in `references/report-template.md`.
 ## References (load on demand)
 - Review public leaks, direction, complete keys and effective routes with [public/key/route checks](references/public-keys-and-routes.md).
 - Read `references/checklist.md` when performing the element sweep and phased audit; it contains eleven phases, 89 checks, tiers and evidence sources.
-- Read `references/anti-patterns.md` when investigating an anti-pattern signal; it gives the signal, why it matters, tier and Screenplay fix.
-- Read `references/report-template.md` when classifying findings, deciding the verdict, writing the report or conducting a re-review; it defines report, severity and verdict rules.
-- Read `references/worked-example.md` when an example of the sweep, lineage or report is needed, or when checking the complete examples; it contains a seeded model, sweep notes, a filled report and the fixed model.
+- Read `references/anti-patterns.md` when investigating an anti-pattern signal.
+- Read `references/report-template.md` when classifying findings, deciding the verdict, writing the report or conducting a re-review.
+- Read `references/worked-example.md` when an example of the sweep, lineage or report is needed, or when checking the complete examples: seeded model, filled report, fixed model.
 - Read `references/review-questions.md` when gathering evidence for subject-specific checks or distinguishing facts from views; it contains questions per subject and domain examples.
+- Read `references/model-inventory-report.md` when asked for a read-only inventory of an existing model.
 - Read `references/business-questions.md` when conducting the business-question pass; it contains the explainer journey method, prompts and word translation.
 
 ## Lineage

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -61,8 +61,8 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Dropped construct | PLAY0029 warning; misspelled keyword or `type` inside a slice | the construct is silently ignored | C | fix the keyword; validate with warnings as errors |
 | Missing `for` | an event production (`produces <Event>` or `produces event`) without `for`. Not operation productions: they are authorable design intent, belong to commands, and take no event `for`, tags or routing | runtimes disagree on the destination | C (executable) / D | `for <identifier>` |
 | Unbuilt read-model field | field no projection maps and AutoMap cannot fill | always empty; not reported by the compiler | D | map it or remove it |
-| Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | passes V1, fails binding (V2/V3, PLAY0273) | C (executable) / D | declare or fix the name; run V3 |
-| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; previous CLI 3.46.1 refused v10 with CLI-RENDER-004, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
+| Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
+| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.73.1 refuses `runsAs` with STAGE-ESM-034 and every reaction model, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
 | `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
 | Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -168,19 +168,19 @@ Nebulit (`provenance.md`).
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
 | G1 | Every command has at least one reachable and authorized origin, and no command is attributed to a generic "User" | screen `action`, forms, reactions, persona policies | D |
-| G2 | Personas have a purpose and say what they cannot do; read-only roles are legitimate; every persona has at least one command or one view | `persona` descriptions | D |
+| G2 | Personas have a purpose and say what they cannot do; read-only roles are legitimate; every persona has at least one command or one view (mechanical evidence: `--check personas`, PLAY0574 to PLAY0576) | `persona` descriptions | D |
 | G3 | Persona policy lists cover every gate on the path (module, feature, construct) | policies | C semantics (board placement) |
 | G4 | A command invoked by a reaction is not gated by a caller policy, unless a trusted-path decision is recorded | reactions, `authorize` | D (silent = major) |
 | G5 | Row scoping (whose data) is part of the view, not a filter the caller supplies | queries | D |
 | G6 | Every persona Cannot line resolves to an executable gate (`authorize` policy, or ownership `claim "x" matches subject\|<command property>`) and a `then denied` spec whose caller is synthesized with `given caller as <Persona>` or explicitly carries the effective-gate roles/claims; otherwise recorded as a gap. Persona text is intent only | personas, policies, specs | D |
 | G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it | policies, specs | D |
-| G8 | Ownership checks against a Uuid-backed identifier are not renderable today (STAGE-ESM-015): noted | policies | C (renderable mode) |
+| G8 | Ownership/claim targets are a supported scalar (text, Uuid, Date or DateTime render; a numeric or Boolean target is always denied; other shapes and a command without exactly one identifier are STAGE-ESM-015 at Stage 4.73.1): noted | policies | C (renderable mode) |
 
 ## Phase 10. Views, queries and screens (4 checks, H1-H4)
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
 | H1 | Query shape follows the business view (list where people scan; lookup where they open one) | queries, screens | D |
-| H2 | Executable scope: one keyed `=> RM optional` query with `by` named like a read-model property, and the projection routes by the same identity (a `from` key or an event property, or `$eventSourceId`; `$eventSourceId` is not mandated). Renderable scope only: Stage-specific identity limits (Stage 4.24 admits a one-instance projection with an optional keyed snapshot query) | queries, projections | C (executable); C (render admission, renderable only) |
+| H2 | Executable scope: a keyed `=> RM optional` query with `by` named like a read-model property, or an unfiltered / one-`by` list (`=> RM[]`, observable too; `filter`, `scoped to`, `performer` do not bind), and the projection routes by the same identity (a `from` key or an event property, or `$eventSourceId`; `$eventSourceId` is not mandated). Renderable scope only: Stage-specific identity limits (Stage 4.73.1 renders a keyed optional snapshot lookup and observable collection queries; any other query is `STAGE-ESM-010`) | queries, projections | C (executable); C (render admission, renderable only) |
 | H3 | One builder per read model; projection `key` only on `from` | projections | C |
 | H4 | Screens show one actor's point of view; a form submits one command | screens, forms | D |
 
@@ -192,7 +192,7 @@ artifact is `N/A: <reason>`.
 
 | Id | Check (the rejected pattern) | Signal to look for | Severity |
 |---|---|---|---|
-| R1 | Code-first change that silently outranks accepted model intent | behaviour added in code with no `.play` counterpart; the model edited to match existing code; the model left stale after a code change | major (critical when the code contradicts a protection) |
+| R1 | Code-first change that silently outranks accepted model intent | behaviour added in code with no `.play` counterpart; the model edited to match existing code; the model left stale after a code change; optional structural evidence: `cratis screenplay conform <model-root> --project <path>` (CLI 3.42.0+, exit 0/1/2, exact structural addresses only, never a behavioral or V4 verdict; MSBuild runs, so a trusted clone) | major (critical when the code contradicts a protection) |
 | R2 | A diagram, board or document in place of executable semantics | a rule only in a board note, a description or a wiki page; no property, validation, constraint or spec behind it (E8) | major |
 | R3 | Claims of universal low-code, lossless recovery or target parity | words like "fully generated", "lossless", "any target" in a report or description | minor; major when it hides a gap |
 | R4 | Framework machinery in the domain vocabulary (saga, aggregate, passive objects, HTTP or broker detail) or syntax wanted because a framework API is common | declarations named after saga, handler classes, topics, endpoints; a request to add language syntax to mirror a framework API | minor; major when it shapes the model |

package/package/corpus/skills/cratis-screenplay-model-review/references/model-inventory-report.md

@@ -0,0 +1,75 @@
+# Model inventory report
+
+Use this for a read-only "what is in this model and where are the gaps" report on an
+existing, extracted or inherited `.play` model, before or without a full checklist run. It is
+the inventory the audit pass in `SKILL.md` produces, in a fixed shape a maintainer can read
+in a minute. It never changes the model. Adapted from Martin Dilger and Nebulit GmbH's
+analyze-existing-model (see `provenance.md`), with board, status and placement steps replaced by
+the Screenplay MCP views.
+
+## Gather (read-only)
+1. Scope. A named module narrows the report to that module; otherwise report the whole
+   model, one block per module. If the named module does not exist, say so and list the modules
+   that do.
+2. Structure: `describe-application` (view `summary`) gives modules, features and slices by kind.
+3. Elements: counts of `event`, `command`, `readmodel`, `screen`, `reaction` and `trigger`
+   per module from `search-declarations`; fall back to the source files when a view is
+   unavailable and say which.
+4. Specifications: `find-assertion-gaps` for slices without an assertion; `find-specification-obligations`
+   for obligations with no matching specification. These read authored examples, not executed
+   coverage (`../../cratis-screenplay-model-authoring/references/mcp-tools.md`).
+5. Gaps and orphans: `find-references` and `dependencies` for declarations referenced by nothing;
+   `find-modeling-smells` for the candidate shapes.
+
+## Report
+```
+## Model inventory: <model root or module>
+Inspected: <date>, Screenplay <tool version>, source identity <revision>
+
+### Modules (n)
+- <module>: <n> features, <n> slices
+
+### Elements (per module)
+| Kind | Count |
+|---|---|
+| event | |
+| command | |
+| readmodel | |
+| screen | |
+| reaction / trigger | |
+| capture | |
+
+### Specification coverage
+- n of total slices have at least one assertion (pct)
+- Without: <names, at most 10, then "and N more">
+
+### Structural gaps (per slice)
+<slice: what is missing>, or "none"
+
+### Orphans
+<declarations nothing references>, or "none"
+
+### Shapes
+<left chair, right chair, bed, shelf only as candidates that held up against the domain; see
+anti-patterns.md>, or "none"
+
+### Summary
+<2 to 4 sentences: maturity, the most important gap or risk, one concrete suggestion>
+```
+
+## Structural gaps to look for
+| Slice kind | Expect | Flag when missing |
+|---|---|---|
+| StateChange | an origin (screen action, form, or reaction), a `command`, at least one `event` | any of the three |
+| StateView | a `readmodel` with a projection (or reducer) and a `query` or screen that reads it | projection or reader |
+| Automation | a `reaction` or `trigger` and what it produces or invokes | either |
+| Translate | inbound: a `capture` or a translating reaction, and the private events it produces; outbound: a reaction or an event-target projection/reducer publishing the public event contract (no capture) | the direction's source or the produced or published events |
+
+Do not flag a gap the documentation or the slice name marks intentional (an internal slice
+with no screen). Judge unintentional gaps against the slice title, and surface only those.
+Orphans that a documented terminal reason explains are not findings.
+
+## Not carried over
+Slice status counts (`Planned`, `InProgress`, `Done`) are not in the report: `.play` has no
+status field. Delivery status lives in the GitHub issue or `STATE.md`. An orphan that a board
+tool could not see is skipped with a note, never guessed.

package/package/corpus/skills/cratis-screenplay-model-review/references/provenance.md

@@ -12,11 +12,10 @@ MIT, Copyright (c) 2025 Straw Hat, LLC. The complete notice is in this skill's `
 | `eventmodeling-validating-event-models` | `checklist.md` T (allowed and refused transitions per entity), C7 and C8 (unique semantics, corrections name what they correct), F3, G (role attribution and coverage), D and E (read models serve real queries, regenerable), `report-template.md` (critical and warning findings, completeness table) | Adapted; the command-state rule is not adopted as such (Screenplay decisions read stored state through `reads`; see `anti-patterns.md`) |
 | `eventmodeling-checking-completeness` | `checklist.md` A (origin and destination for every field, every command input, every read-model field), A8 (step contracts), G (role coverage), `references/worked-example.md` (field-trace format) | Adapted; matrices replaced by lineage over `.play` declarations |
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
@@ -24,7 +23,7 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 | `.claude/skills/eventmodeling-designing-automation-chains/SKILL.md`: every automation needs a todo list, translation versus worker, redundant second stage, no status field, closing path, quality checklist | `checklist.md` F8 to F12 and the automation-chain audit, `report-template.md` "Automation chains", `review-questions.md` | Restored from #493 (the automation-chain audit) as review checks translated to `Automation` and `Translate` slices. Not adopted: a translation's todo list is never closed; here a translation holding real pending work needs a terminal disposition (the audit format of `cratis-screenplay-automations-and-translations`), and an artificial never-closing queue is flagged instead |
 | `.claude/skills/eventmodeling-core-rules/SKILL.md`: Critic Mode, Flow and Causality, Open Questions vs. Decided Failures, Offline-First Thinking | `SKILL.md` "Procedure" (stance), `checklist.md` E9 and F13, `report-template.md` "Defect or business question?", `review-questions.md` | Adapted closely; the single-issuer command rule, lanes, linked copies and board mechanics are not adopted |
 | `.claude/skills/handle-comment/SKILL.md`: one remark per node with a kind, resolving means answering | `SKILL.md` "Findings" | Adapted; the board place, resolve and delete actions are dropped, the remark is a finding pinned to one declaration |
-| `.claude/skills/analyze-existing-model/SKILL.md`: spec coverage with names, structural gaps per slice type, summary in 2 to 4 sentences | `SKILL.md` "Audit pass", `report-template.md` Inventory | Now adapted closely; slice status breakdown dropped (Screenplay has none) |
+| `.claude/skills/analyze-existing-model/SKILL.md`: spec coverage with names, structural gaps per slice type, summary in 2 to 4 sentences | `SKILL.md` "Audit pass", `report-template.md` Inventory, `model-inventory-report.md` (gather steps, report shape, structural-gap table) | Adapted closely; board and slice-status steps replaced by the Screenplay MCP views, slice status breakdown dropped (Screenplay has none), `validate_model` replaced by `find-modeling-smells` and `find-assertion-gaps` |
 | `.claude/skills/eventmodeling-validating-event-models/SKILL.md`, `-checklist/SKILL.md`: event-entity mapping (Check 6.2), report with blockers and next steps, common issues, closing questions that gate the verdict | `checklist.md` B2, `report-template.md` Verdict, `review-questions.md` | Martin Dilger and Nebulit GmbH's changes to the TrogonStack base, adapted; the "exactly one issuer" and "screen wired to more than one command always fails" rules are not adopted (Screenplay commands may have several origins and a screen several actions) |
 | `.claude/skills/eventmodeling-checking-completeness/SKILL.md`: field matrix, slice coverage, "search before calling data missing" | `checklist.md` A1 to A8 | Already adapted from the TrogonStack base (role coverage is TrogonStack's, credited above); Martin Dilger and Nebulit GmbH's slice-border and linked-copy checks are not adopted (no columns or linked copies in `.play`) |
 

package/package/corpus/skills/cratis-screenplay-model-review/references/public-keys-and-routes.md

@@ -16,7 +16,7 @@ Add these to the element sweep, with evidence pinned to the declaration:
 - Is the view identity explicitly marked `key` or unambiguously inferred? Does each
   single-instance query/read supply every part exactly once, with compatible types,
   and do state fixtures contain all parts? Do PDL keys align with the view's key?
-  Composite view keys still refuse binding at 4.135.0 (PLAY0268, #599); compilation
+  Composite view keys still refuse binding at 4.139.0 (PLAY0268, #599); compilation
   is not executable evidence. Read read-surface `references/named-keys.md`.
 - Does a production override replace the whole source/stream/id route, rather than
   assume partial inheritance? Is its `for` destination still explicit and compatible?

package/package/corpus/skills/cratis-screenplay-model-review/references/worked-example.md

@@ -12,8 +12,9 @@
 A small model with one seeded design defect, reviewed in critic mode. The model file is
 `berths.play`; line numbers below refer to it. The report follows `report-template.md` and is
 shortened: it shows the flagged checks of each phase and elides the passing ones, which a real
-report lists in full. The model compiles in design mode: the `ListBerths` list query blocks V3
-(`PLAY0268`), which is why the report below does not run V3.
+report lists in full. The model compiles and, on the standalone 4.139.0 tool, binds and runs one specification (the
+`ListBerths` list query binds since Screenplay 4.105.0). The report works in design mode, so it
+does not run V3 or V4.
 
 ## The model under review
 
@@ -171,7 +172,7 @@ Confidence: medium (design mode; V2 to V5 not run)
 
 ## After the fix
 The same scope after the modeler applied the edit request and added denial specifications.
-The review is re-run only on the changed scope. The query contract is unchanged: no edit request asked for a different query, so `ListBerths => BerthSummary[]` stays. This document compiles (design mode), but the list query blocks V3 (binding reports PLAY0268, a query must declare one caller-supplied `by` argument), so its specifications do not run here. Adding a keyed `BerthById` next to the list would not unblock binding; replacing the list would change the contract and needs its own domain-justified edit request.
+The review is re-run only on the changed scope. The query contract is unchanged: no edit request asked for a different query, so `ListBerths => BerthSummary[]` stays. This document compiles and binds, and its four specifications pass in `screenplay test` (4.139.0). Replacing the list with a keyed lookup would change the contract and needs its own domain-justified edit request. Stage 4.73.1 would refuse the snapshot list (`STAGE-ESM-010`); only an `observable` list or a keyed lookup renders.
 
 ```screenplay
 concept BerthId : Uuid

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/LICENSE

@@ -33,5 +33,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/SKILL.md

@@ -43,7 +43,7 @@ an unproven pass.
 | An accepted model covers the scope | **Model** | Change the `.play`, verify V1-V3, review, then render or gap-fill |
 | Opted in, but this scope has no model yet | **Model** | New behavior starts in discovery, then slice design |
 | A computed rule inside a modeled slice | **Model + code attachment** | `csharp`/`file` block; it binds only as the construct allows (`cratis-screenplay-model-authoring`) |
-| Scope Stage cannot render yet, including every modeled automation and translation (Stage `v4.24.2` renders neither; the whole behavior is gap-fill, not just its outside call) | **Gap-fill code** | Hand-written; the `.play` slice and specs are the contract. `cratis-screenplay-render-and-gap-fill` separates an authorized existing generated base from fully hand-written delivery |
+| Scope Stage cannot render yet, including every modeled automation and translation (Stage 4.73.1 renders neither; the whole behavior is gap-fill, not just its outside call; a reaction that produces and invokes stays one reaction, `STAGE-ESM-037`, hand-written as one reactor on Arc 22.72.0 or later) | **Gap-fill code** | Hand-written; the `.play` slice and specs are the contract. `cratis-screenplay-render-and-gap-fill` separates an authorized existing generated base from fully hand-written delivery |
 | Outside call, transport or credentials | **Adapter code** | `Customizations/` or the host, applying `cratis-engineering-effect-boundaries` |
 | Infrastructure, clients, framework-profile repositories, brownfield not opted in | **Code** | Arc, Chronicle, spec and React skills; trivial changes keep the proportional-delegation policy |
 
@@ -210,10 +210,12 @@ labelled as such. The user decides whether it is enough
 | Critic review, business-question pass | `cratis-screenplay-model-review` |
 | Existing system into a model | `cratis-screenplay-legacy-extraction` |
 | Render, gap-fill, fallback, drift | `cratis-screenplay-render-and-gap-fill` |
+| Estimate, order or split delivery of an accepted model | `cratis-screenplay-delivery-planning` |
 
 Construct mechanics stay in the `cratis-screenplay-*` construct skills; term clashes:
 `references/vocabulary-map.md`; worked example: `references/worked-example.md`; done checklist: `references/phases.md`.
 Read `references/worked-example.md` when needing an example of reasoning documentation, constraints, and decided rejections.
+Read `references/core-rules-digest.md` when you need the one-page card of element names, causality, open-question-versus-decided-failure and the anti-patterns to reject early.
 
 ## Gate
 Done when: the mode's "done when" holds with fresh verdict lines; every open question has an
@@ -221,13 +223,13 @@ address and assumption; every decided rejection is a specification; no protectio
 the packet opens with `Outcome:`; STATE.md is current.
 
 ## Verified product sources
-Full pin table: `cratis-screenplay-toolchain/references/versions.md`. Read `cratis-screenplay-toolchain/references/versions.md` when selecting or reverifying tool versions. Used here: Screenplay
+Full pin table: `cratis-screenplay-toolchain/references/versions.md`. Read `cratis-screenplay-toolchain/references/versions.md` when selecting or reverifying tool versions. Current pins (Stage 4.73.1, cratis CLI 3.53.1 and the rest) are in that file. Older source reads used here: Screenplay
 `v4.66.0` (`c89198b`): `Source/DotNET/Tool/Program.cs` (`--warnaserror`, folder mode),
 `Source/DotNET/Screenplay/Semantics/SemanticModelBinder.cs:209-216` (personas are report-only),
 `Documentation/screenplay/{constraints,specifications}.md`, `mcp/reference.md` (`modelRevision`);
-cratis CLI `v3.28.3` (`cratis screenplay validate --warnings-as-errors`, bundled Screenplay 4.66.0);
-Stage `v4.24.2` (admits ESM v1-v4 and refuses evolved events with `STAGE-ESM-026`); opt-in key `mcpServers.screenplay.root` in cratis CLI `v3.28.3`
-`Documentation/reference/screenplay-mcp.md`. The worked example compiles with both tools.
+cratis CLI `v3.28.3` (`cratis screenplay validate --warnings-as-errors`; bundled Screenplay 4.66.0 then, 4.137.0 in 3.53.1);
+opt-in key `mcpServers.screenplay.root` in cratis CLI `v3.28.3`
+`Documentation/reference/screenplay-mcp.md`. The 4.66.0 and 3.28.3 reads are historical, not current pins. The worked example compiles with the standalone tool.
 ## Verify
 ```shell
 screenplay <model-folder> --warnaserror --no-color