@cratis/pi 7.34.0 → 7.35.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -2,7 +2,7 @@
 
 One complete document with every construct family. Design mode, not executable. Prose rules: [cheat-sheet.md](cheat-sheet.md); tool versions: [versions.md](versions.md); what binds: [executable-subset.md](executable-subset.md).
 
-Binding blockers: unquoted import, `pii`, `reads` (PLAY0271), `starts with`, a `filter` query (lists and observable lists bind). Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
+Binding blockers: unquoted import, `reads` (PLAY0271), `starts with`, a `filter` query (lists and observable lists bind). Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
 ```screenplay test=unbound
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
@@ -12,7 +12,7 @@ import Customers.CustomerRegistered        // unquoted = another bounded context
 
 concept InvoiceId : Uuid                   // primitives: Uuid String Int Decimal Bool Date DateTime Enum
 concept PaymentId : Uuid
-concept Email : String pii                 // pii / secret (blocks executability)
+concept Email : String pii                 // v13 on standalone 4.141.0; refuses on pinned CLI
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -172,8 +172,10 @@ escapes `%`/`|`, not an inferred split of legacy text.
 
 Identity declarations and event `subject` are metadata; reading a declared
 `$identity` detail in executable clauses is PLAY0268. `runs as` is admitted as
-ESM v10 in the current standalone, not a current PLAY0268 gap. Compliance markers
-still block binding; purpose metadata is PLAY0270. See command-surface
+ESM v10 in the current standalone, not a current PLAY0268 gap. At standalone
+4.141.0, concept compliance binds as v13; enum/identity compliance and protected
+events with explicit subject marks still refuse PLAY0268. CLI 3.53.1's 4.137.0
+bundle retains the blanket marker refusal; purpose metadata is PLAY0270. See command-surface
 `references/compliance.md` and `references/context.md` for syntax and limits.
 
 `screenplay_repair_capabilities` and `propose-repair` advertise PLAY0653: a

package/package/corpus/skills/cratis-screenplay-toolchain/references/doc-contradictions.md

@@ -42,7 +42,7 @@ read from source or documentation.
 | 14 | `$causedBy` | not evaluable (#4119), not ESM | showcase only |
 | 15 | literal keys | `key literal "global"` vs `key "global"` | both compile; prefer `literal` |
 | 16 | query admission | `D/queries.md:74` now says live, filtered, scoped and performer queries are not admitted | the binder also rejects collection queries and a missing `by`, which stay undocumented [probed] |
-| 17 | `@pii` | `D/concepts.md:3,33` "Chronicle applies `@pii` and `@sensitive` rules automatically" | the binder rejects any compliance attribute (PLAY0268); keep it, report V3 blocked. `@sensitive` means an operational secret (`[Encrypted]` + `[NotAudited]`; Screenplay decision 0034); the historically probed tools (standalone 4.68.0, bundle 4.66.0) do **not** report `PLAY0515` (`@pii` from 4.69.1, `@sensitive` from 4.84.1): there only Chronicle catches either attribute on an event-source identifier, at build time of the generated code (CHR0034 for `@pii`, CHR0052 for `@sensitive`) |
+| 17 | `@pii` | `D/concepts.md:3,33` "Chronicle applies `@pii` and `@sensitive` rules automatically" | the historical binder rejected any compliance attribute (PLAY0268); standalone 4.141.0 instead admits concept compliance as v13 with narrower enum/identity/subject-lineage refusals (command-surface `references/compliance.md`). Keep protection; the pinned CLI still reports V3 blocked. `@sensitive` means an operational secret (`[Encrypted]` + `[NotAudited]`; Screenplay decision 0034); the historically probed tools (standalone 4.68.0, bundle 4.66.0) do **not** report `PLAY0515` (`@pii` from 4.69.1, `@sensitive` from 4.84.1): there only Chronicle catches either attribute on an event-source identifier, at build time of the generated code (CHR0034 for `@pii`, CHR0052 for `@sensitive`) |
 | 18 | read-model identity | `D/readmodels.md:32` "from the keyed query" | at 4.135.0 explicit `key` wins; else single-instance queries agree on one read-model `by` property; only with none and an admitted list query does conventional `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`). Queryless views need explicit `key` |
 | 19 | `$strings` constraint messages | `D/constraints.md:31` vs `D/internationalization.md:55` | the compiler keeps the key; realization localizes |
 | 20 | composite key braces | optional in the EBNF; both forms in docs | both fine |

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,7 +2,7 @@
 
 ## Contents
 
-- Caller and compliance boundary (4.127.0)
+- Caller and compliance boundary (4.141.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later; the cratis 3.53.1 bundle binds them too
@@ -16,12 +16,12 @@ Current pins: `versions.md`. Detailed
 4.66.0/4.68.0 binder probes below retain their historical labels. Current source
 admits routes as ESM v8, public/direction constructs as v9, identity/overrides/filters
 as v10, qualifying non-route Double literals as v11 (exact lowering of Double-mode literals)
-and non-positional enum numbers as v12. Operations, the `numbers exact` **source mode** (PLAY0268) and
+and non-positional enum numbers as v12; concept compliance as v13. Operations, the `numbers exact` **source mode** (PLAY0268) and
 reaction refusals/redelivery remain unadmitted. Use the actual
 binder before promoting an older probe to a current capability claim.
 
 What the binder admits, and what it refuses with which code. The answer depends on the
-compiler version: the standalone tool (4.139.0) binds through v12; the compiler bundled in cratis
+compiler version: the standalone tool (4.141.0) binds through v13; the compiler bundled in cratis
 3.53.1 (4.137.0) binds ESM through v10 for rendering and refuses non-positional enum numbers at
 binding; older bundles (4.66.0 in cratis 3.28.x, admitting v1 to v6; 4.60.1 before 3.28.2, v1 to v5)
 are history.
@@ -40,7 +40,7 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later, and the cratis 3.53.1 bundle).
 
-## Caller and compliance boundary (4.127.0)
+## Caller and compliance boundary (4.141.0)
 
 `$identity.id`/`.name`/`.userName` are aliases of the admitted
 `$context.identity` produces-mapping values. Authentication status, roles and
@@ -49,10 +49,14 @@ A top-level `identity` block alone is authoring metadata and does not block
 readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
 `$context.identity` remains built-ins only. Purposes and event `subject` marks
 are metadata (PLAY0270), not source resolution, retention or subject propagation.
-Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers still block
-binding. Legacy spellings compile with PLAY0565 information; duplicates warn
-PLAY0653. Never remove protection; see command-surface `references/compliance.md`.
-Authority: v4.127.0 `context.md`, `identity.md`, `concepts.md`, `events.md`, `purposes.md`.
+Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers bind as v13
+on standalone 4.141.0; CLI 3.53.1's 4.137.0 bundle still refuses them. Enum/identity
+compliance and events mixing protected values with explicit subject marks remain
+refused; see command-surface `references/compliance.md` for the precise boundary.
+Legacy spellings compile with PLAY0565 information; duplicates warn PLAY0653.
+Never remove protection. Reference execution proves neither encryption nor erasure.
+Authority: v4.141.0 `SemanticModelBinder.Compliance.cs`, `concepts.md`, `events.md`;
+caller and purpose guidance retains v4.127.0 `context.md`, `identity.md`, `purposes.md`.
 
 ## Admitted on both compilers
 
@@ -209,7 +213,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `pii` or `secret` on any concept (also alias/legacy markers) | PLAY0268 | Compliance requires portable data-subject semantics; scopes/qualifiers do not admit it. Secret provider mapping is `[Encrypted]` + `[NotAudited]`, not a bind/render claim |
+| `pii` or `secret` on a concept | PLAY0268 | Blanket refusal on CLI 3.53.1's 4.137.0 bundle only. Standalone 4.141.0 admits v13 except enum/identity compliance and events mixing personal or explicitly subject-scoped secret values with explicit subject marks; see `compliance.md` in command-surface references |
 | `query` with a composite `by` block, or `by ... from` context-derived arguments | PLAY0268 | composite `by` blocks remain unadmitted (#599). An optional scalar snapshot lookup, an unfiltered list (`RM[]`) and a list narrowed by one caller-supplied `by` key bind, in their `observable` form too (since 4.105.0) |
 | `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` is not the blocker: it goes in the return position (`=> observable RM[]`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -251,8 +255,9 @@ bodies still leave their owner non-executable.
 
 Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
-slice in the gap list. A `pii` or `secret` marker blocks V3 and rendering, and
-either attribute on an identifier or typed destination is a source error
+slice in the gap list. A `pii` or `secret` marker selects v13 on standalone
+4.141.0, but blocks binding on the pinned CLI and exceeds Stage 4.76.0's v12
+ceiling. Either attribute on an identifier or typed destination is a source error
 PLAY0515 on the current compiler (including stream-id parts and route mapping
 sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers
 (CHR0034/CHR0052). Keep surrogate identity and protected payload separate.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -45,12 +45,12 @@ version; each construct it does not render refuses with its own code before any
 
 | Area | Renders at 4.73.1 | Refused (code) |
 | --- | --- | --- |
-| Slice kinds | `StateChange`, `StateView` | `Automation`, `Translate`, every reaction, capture, application trigger and clock specification (`STAGE-ESM-001`/`-024`); a reaction that both produces and invokes (`-037`, Stage#207; Arc 22.72.0+ can run it, and the scaffold's Arc 22.68.0 needs a proven override; hand-write one reactor, never split the reaction) |
+| Slice kinds | `StateChange`, `StateView` | `Automation`, `Translate`, every reaction, capture, application trigger and clock specification (`STAGE-ESM-001`/`-024`); a reaction that both produces and invokes (`-037`, Stage#207; Arc 22.72.0+ can run it, and the Arc the scaffold pins needs a proven override; hand-write one reactor, never split the reaction) |
 | Queries | optional keyed snapshot lookups; observable collections, keyed or unkeyed (since 4.49.0) | a snapshot list: `STAGE-ESM-010`; `filter`, `scoped to`, `performer`, composite `by`: `PLAY0268` at binding |
 | Authorization | role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false; Stage 4.73.1 `IsSupportedClaimPath`), `not`/and/or; roles read through the identity's `RoleClaimType` | role-claim URIs, nested opaque policies, unresolved or non-portable policies, no single identifier, opaque-policy subjects that are not text, Uuid, Date or DateTime (`STAGE-ESM-015`; Stage 4.73.1 `IsTextualSubject`, a restriction separate from declarative claim targets) |
 | Event sources, streams, routes (ESM v8) | rendered, with routed specifications | reserved stored names, unformattable routed fixtures, unsupported routed replay (`STAGE-ESM-030`) |
 | Numbers, case tables | whole numbers as `long` from ESM v8; case tables | out-of-`int` literals below v8 (`STAGE-ESM-031`) |
-| Generated values and responses (v7) | not rendered | `STAGE-ESM-028`/`-029` (Stage#175) |
+| Generated values and responses (v7) | not rendered by Stage 4.73.1 (cli 3.53.1); rendered from standalone Stage 4.74.0 (UUID concepts, scalar and named responses) | `STAGE-ESM-028`/`-029` at 4.73.1 (Stage#175); `STAGE-ESM-038` for combinations the target cannot preserve |
 | Specifications | as in Stage's `admission.md` | `then no readmodel` (`-027`); an unauthenticated caller carrying roles or claims, `$context.occurred`-derived fixed values asserted (`-011`) |
 | v9 and v10 | reducer observer `from` filters | public events and event-target projections (`-032`); foreign origins and event-source captures (`-033`); directed Translate (`-024`); reaction `runsAs` (`-034`); reaction `from` filters (`-035`); per-production route overrides (`-036`) |
 | Evolved events | initial revisions only | `STAGE-ESM-026` (Stage#204) |
@@ -88,7 +88,10 @@ whole automation is hand-written (gap-fill).
 | Compliance | none | any `@pii` or `@sensitive` already fails binding (PLAY0268). The C# provider mapping (Stage v4.29.0, Stage#197) is `@pii` to `[PII]`, `@sensitive` to `[Encrypted]` + `[NotAudited]`, both to `[PII]` only |
 
 At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
-accepted with PLAY0565 information); either still refuses binding. Identity blocks,
+accepted with PLAY0565 information); either still refuses binding on that compiler.
+Standalone 4.141.0 admits concept compliance as v13 with narrower refusals
+(command-surface `references/compliance.md`), but Stage 4.76.0 admits only through
+v12 and the pinned CLI still bundles 4.137.0. Identity blocks,
 purposes and event `subject` are authoring metadata, not provider realization;
 executing identity detail reads still refuses PLAY0268. Current source/stream
 routes are admitted as v8, including composite ids, not the historical binding
@@ -131,8 +134,8 @@ legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
   `Customizations/styles.css`. The planner never reads it, and it never binds a modeled
   reaction or capture. A customization never makes a rejected model renderable.
 - `cratis render` does **not** build, test or run the application.
-- Stage 4.73.1's scaffold pins .NET 10, Arc 22.68.0, Chronicle client/kernel 19.45.0
-  and emits a `.frontend/` React/Vite app (Components 4.26.2, Scene 4.21.0); these are not the latest
+- Stage 4.73.1's scaffold pins .NET 10 and Arc and Chronicle client/kernel releases
+  and emits a `.frontend/` React/Vite app (Components and Scene releases pinned too); these are not the latest
   releases (`cratis-stage-rendering-and-sandbox` `references/rendered-application.md`).
   `CratisEmbeddedScreenplayEnabled=false`; `Directory.Packages.props` is managed,
   never edit it. `[ProtectedDecision]` / `DecisionRead<T>` are available to gap-fill,