@cratis/pi 7.34.1 → 7.35.0

package/package/corpus/skills/cratis-fundamentals-type-discovery/SKILL.md

@@ -18,7 +18,7 @@ removing one becomes a single-file change.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Fundamentals` | `7.19.2` | `IInstancesOf<T>`, `IImplementationsOf<T>`, `[Singleton]`, `[Scoped]`, `[IgnoreConvention]`, the convention bindings |
+| `Cratis.Fundamentals` | `7.23.0` | `IInstancesOf<T>`, `IImplementationsOf<T>`, `ITypes`, convention bindings and the bundled `Cratis.Fundamentals.TypeDiscovery.Generator` |
 
 Reverify against the Cratis Fundamentals repository before claiming support for
 another version.
@@ -47,15 +47,31 @@ registered implementation:
 
 ## Step 1 — Confirm the implementations are discoverable
 
-`IInstancesOf<T>` finds types by convention across the loaded assemblies. The
-requirements are only:
-
-- Each implementation is a non-abstract, non-interface class. Discovery reads each assembly's `DefinedTypes` and filters only on `!IsInterface && !IsAbstract`, so an `internal` class is discovered too; `public` is a convention for a type meant to be reached from another assembly, not a discovery requirement. Instances are resolved from the service provider (`GetService(type)`), so each implementation must be registered as itself — `AddSelfBindings()` does that for every concrete, non-static, non-`Exception` class whose constructor is resolvable (visibility is not a criterion), honoring `[Singleton]`/`[Scoped]`/`[IgnoreConvention]`.
-- It implements the interface directly, not through a layer that hides it.
-- `T` is an interface or abstract class — the interface is declared
-  `where T : class`.
-
-No assembly attribute and no registration call is needed.
+Discovery normally uses compile-time generated providers, not a walk of
+`DefinedTypes`. Reflection is the fallback when no generated providers exist.
+
+- Use concrete, non-generic implementations. Generated contract maps exclude
+  open-generic implementors. An assembly's own provider can include its internal
+  types; references emitted from another assembly require public types.
+- `T` is an interface or abstract class (`where T : class`).
+- Instances resolve by concrete type, so each implementation needs a self-binding.
+  `AddSelfBindings()` honors `[Singleton]`, `[Scoped]`, and `[IgnoreConvention]`;
+  it excludes static/abstract/interface/exception types, System/Microsoft
+  namespaces, and classes with primitive or record-typed constructor parameters.
+  `IFoo → Foo` bindings require matching names in the same namespace and exactly
+  one implementation; they do not replace self-bindings for a discovered set.
+
+The host must call `services.AddTypeDiscovery()` to register `ITypes`,
+`IInstancesOf<>`, and `IImplementationsOf<>`, plus the convention binding setup.
+Arc's `AddCratisArc` does this (verified at Arc v22.75.0); a plain host must do it.
+No per-implementation registration is needed when self-binding applies.
+
+The Fundamentals NuGet package carries the generator as an analyzer. A project
+reference does **not** carry it: reference the generator explicitly, otherwise
+only Fundamentals' own provider may contribute. A captured `ITypes` universe
+never gains late-loaded assemblies. `AddTypeDiscovery()` reuses the default
+universe while the provider set is unchanged; a later call rebuilds it if new
+providers registered, without changing earlier consumers.
 
 ## Step 2 — Choose the lifetime with an attribute
 
@@ -106,10 +122,14 @@ public class ReportFormatters(IInstancesOf<IReportFormatter> formatters) : IRepo
 
 `IInstancesOf<T>` implements `IEnumerable<T>`, so LINQ works on it directly.
 
-**It resolves an instance from the service provider on every enumeration**, not
-once at construction. That is what makes a scoped or transient implementation
-behave correctly, and it is why materializing with `.ToArray()` is worth doing
-only when you genuinely need a stable snapshot within one operation.
+**The type set is fixed at construction; instances resolve on every enumeration**
+through the service provider captured by `InstancesOf<T>`. The consumer's scope
+therefore matters: the singleton above is safe only when no implementation is
+scoped. A singleton captures the root provider and would make a scoped
+implementation captive or fail scope validation. Use a scoped or transient
+consumer resolved inside a scope when any implementation is scoped; follow the
+lifetime rule in `csharp.md`. Materialize with `.ToArray()` only when one operation
+needs a stable instance snapshot.
 
 ## Step 4 — Delete the dead registrations
 
@@ -130,9 +150,21 @@ relying on a registration for a different reason.
 
 - **`[Singleton]` does not resolve.** The using directive is
   `Cratis.DependencyInjection`, not `Cratis`.
-- **An implementation is silently absent from the set.** Its assembly is not
-  loaded at the point of enumeration, it is not `public`, it is abstract, or it
-  carries `[IgnoreConvention]`.
+- **An implementation is silently absent from the set.** Its assembly did not
+  contribute a generated provider before the universe was built, or its type is
+  abstract, generic, or inaccessible to the emitted provider. Inspect
+  `ITypes.DiscoveryMode` (`Unknown`, `Generated`, `Reflected`, or `Explicit`) and
+  `ITypes.Assemblies`; ask `TypeDiscoveryDiagnostics.FindMissingContributors(types)`
+  for referenced assembly names that did not contribute (it loads nothing and
+  may also report libraries with no discoverable types). The reflection fallback
+  includes package assemblies by prefix: `Cratis` by default, configurable through
+  `PackageReferencedAssemblies.Instance.AddAssemblyPrefixesToInclude(...)` before
+  discovery.
+- **Discovery dependencies cannot resolve.** The plain host omitted
+  `services.AddTypeDiscovery()`.
+- **Enumeration yields null.** The concrete type was discovered but not registered
+  as itself, for example because `[IgnoreConvention]` or a self-binding exclusion
+  skipped it. `InstancesOf<T>` uses `GetService(type)`, not `GetRequiredService`.
 - **An implementation is a new instance every time it is touched.** It has no
   lifetime attribute, so the convention made it transient. That is correct
   behavior for the convention and usually the wrong intent — add `[Singleton]`.
@@ -150,3 +182,8 @@ the affected behavior. The non-vacuity check matters here: assert the **count**
 of discovered implementations, not just that iterating them threw nothing. A
 fan-out over an empty set passes every assertion that only says "nothing went
 wrong".
+
+Assert the expected `ITypes.DiscoveryMode` and contributing assembly names too.
+For startup diagnostics, collect EventSource `Cratis.Fundamentals.TypeDiscovery`
+with `dotnet-trace`: it reports universe construction and warns when only
+Fundamentals contributed.

package/package/corpus/skills/cratis-fundamentals-type-discovery/verification.json

@@ -0,0 +1,14 @@
+{
+  "skill": "cratis-fundamentals-type-discovery",
+  "input": "Wire a discovered set of implementations and diagnose missing types or incorrect scopes.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "concrete, non-generic implementations" },
+    { "kind": "skill-contains", "value": "services.AddTypeDiscovery()" },
+    { "kind": "skill-contains", "value": "TypeDiscoveryDiagnostics.FindMissingContributors(types)" },
+    { "kind": "skill-contains", "value": "type set is fixed at construction" },
+    { "kind": "skill-contains", "value": "singleton captures the root provider" },
+    { "kind": "skill-contains", "value": "Enumeration yields null" },
+    { "kind": "skill-contains", "value": "a later call rebuilds it" }
+  ]
+}

package/package/corpus/skills/cratis-lens-browser-extension/SKILL.md

@@ -19,10 +19,15 @@ the developer points it at. Nothing in it is production tooling.
 
 | Source | Version | Purpose |
 | --- | --- | --- |
-| `Cratis/Lens` `Source/` | manifest `1.0.0`, repository `HEAD` `3ee4882` (the repo has no release tag beyond `v0.0.1`) | The extension itself |
-| `Cratis.Arc.Core` | `22.16.0` | The `/.cratis/*` endpoints, the forwarded-identity contract, and the tenancy header Lens depends on |
+| `Cratis/Lens` `Source/` | `v0.0.1`, manifest `1.0.0` | The extension itself; no newer release |
+| `Cratis.Arc.Core` | `22.75.0` | The `/.cratis/*` endpoints, the forwarded-identity contract, and the tenancy header Lens depends on |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+Behavior was read at Lens `v0.0.1` and `main`; the Source diff is metadata/build
+packaging only. The release predates the previously verified `3ee4882` commit.
+Arc evidence: [ArcOptions.cs:61–80](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/ArcOptions.cs#L61-L80),
+[MicrosoftIdentityPlatformAuthenticationHandler.cs:28–40](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Identity/MicrosoftIdentityPlatformAuthenticationHandler.cs#L28-L40),
+[IntrospectionOptions.cs](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Introspection/IntrospectionOptions.cs)
+and [DiscoveryExposure.cs:102–138](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Introspection/DiscoveryExposure.cs#L102-L138).
 
 ⚠️ **There is no published store listing.** Nothing in the Lens repository links
 a Chrome Web Store, Edge Add-ons, AMO, or App Store entry — the only store URLs
@@ -60,6 +65,10 @@ Developer Tools", which is stale.
 Chrome after each rebuild. `yarn ci` runs `typecheck`, `test` and `build` — the
 same three the pull-request workflow runs. There is no lint script.
 
+On `main`, `yarn build-package` runs `scripts/build-package.js` and writes zip
+packages into repo-root `dist/`; the manifest description changed, but the name
+is still **Cratis Lens**. At `v0.0.1` the script instead zips to `lens-extension.zip`.
+
 The code uses the `chrome.*` namespace throughout with no polyfill. The release
 workflow also packages for Edge, Firefox and Safari, but no cross-browser
 behavior is tested; treat Chromium as the supported target.
@@ -67,34 +76,46 @@ behavior is tested; treat Chromium as the supported target.
 ## What the Arc application must already provide
 
 Lens is not self-contained. It reads endpoints Arc maps for itself, and it sends
-headers Arc's shipped identity handler already reads. **No NuGet package,
-middleware, `Program.cs` change, or configuration key exists for "Lens support"
-— nothing in either repository names one.**
+headers Arc's shipped identity handler reads only after host opt-in. There is no
+Lens-specific package or middleware. For local impersonation, the development
+host must set `Cratis:Arc:TrustForwardedIdentityHeaders=true` (default **false**).
+Never enable this on an exposed application without a trusted ingress that
+strips client-supplied identity headers.
 
 | Route | Mapped by | Lens uses it for |
 | --- | --- | --- |
-| `GET /.cratis/commands` | `MapIntrospectionEndpoints`, `AllowAnonymous` | The Commands tree |
-| `GET /.cratis/queries` | `MapIntrospectionEndpoints`, `AllowAnonymous` | The Queries tree |
-| `GET /.cratis/users` | every `ICanProvideUsers`, `AllowAnonymous` | The importable user roster |
-| `GET /.cratis/tenants` | every `ICanProvideTenants`, `AllowAnonymous` | The importable tenant list |
+| `GET /.cratis/commands` | `MapIntrospectionEndpoints`, discovery access policy | The Commands tree |
+| `GET /.cratis/queries` | `MapIntrospectionEndpoints`, discovery access policy | The Queries tree |
+| `GET /.cratis/users` | every `ICanProvideUsers`, identity discovery policy | The importable user roster |
+| `GET /.cratis/tenants` | every `ICanProvideTenants`, identity discovery policy | The importable tenant list |
 | `GET /.cratis/identity-details/schema` | the identity endpoint mapper | The schema-driven editor for a user's `identityDetails` |
 
-`MapIntrospectionEndpoints` is called from Arc's own application startup, so the
-two introspection routes exist without being asked for. The user and tenant
+At Arc v22.75.0 discovery is anonymous by default **only in Development**.
+Against a deployed host Lens needs the user signed in; hosts unable to authenticate
+omit those routes (404). `Introspection.Enabled` controls catalogs and
+`IdentityDiscovery` the roster/tenant/schema routes. Forwarded identity switching
+also needs the explicit host-wide `TrustForwardedIdentityHeaders` opt-in, only
+behind a header-stripping ingress. Source:
+[secure defaults](https://github.com/Cratis/Arc/blob/v22.75.0/Documentation/upgrading/secure-defaults.mdx).
+`MapIntrospectionEndpoints` runs during Arc activation, subject to these settings. The user and tenant
 routes return whatever the application implements — with **no implementation
 registered they return an empty list**, and Lens treats a `404` on either as
 "empty", not "broken". Users and tenants can also be created by hand in Lens's
 Settings, so an application that provides neither still works.
 
-⚠️ `/.cratis/users` and `/.cratis/tenants` are mapped `AllowAnonymous` and
-**unconditionally**. Register `ICanProvideUsers`/`ICanProvideTenants` only for a
-development environment and return fixtures — see
-`cratis-arc-authentication-authorization-and-identity`.
+At Arc `22.75.0`, all five discovery routes are anonymous by default only in
+**Development**. Elsewhere they require authentication, or are not mapped when
+the host cannot enforce it. `Cratis:Arc:Introspection` options `Enabled` and
+`IdentityDiscovery` control mapping; `RequireAuthentication` and `Roles` control
+access. Register development user/tenant providers with fixtures, not production
+rosters — see `cratis-arc-authentication-authorization-and-identity`.
 
 ### Identity
 
-Lens sends exactly the three forwarded client-principal headers Arc's shipped
-handler reads:
+Lens sends exactly three forwarded client-principal headers. Arc ignores them
+and treats the request as anonymous unless
+`Cratis:Arc:TrustForwardedIdentityHeaders=true`; a default Arc app therefore
+does not honor Lens identity switching:
 
 ```text
 X-MS-CLIENT-PRINCIPAL-ID
@@ -157,10 +178,11 @@ Pick both on the **Context** tab. Two things then happen, in this order:
 2. It deletes the Arc identity cookie `.cratis-identity` on the detected base URL
    and page origins, then reloads every open tab on those origins.
 
-Step 2 is the one that matters. Headers alone do not change who you are once Arc
-has issued its identity cookie; the application keeps presenting the identity it
-was first given. Dropping the cookie and reloading is what makes the switch take
-effect.
+At Arc v22.75.0 the backend neither reads nor writes that legacy identity
+cookie. Lens still deletes it for older hosts; reloading clears the frontend's
+in-memory identity and asks `/.cratis/me` again. Header-based switching requires
+the host-wide trust opt-in and a suitable development/ingress boundary; the
+extension cannot turn unsigned headers into authenticated credentials.
 
 The rules are scoped, deliberately. When a page origin is known the condition is
 `{ urlFilter: '*', initiatorDomains: [<page host>] }`; otherwise it is
@@ -184,7 +206,7 @@ query is always `GET`, with `{name}` segments in the route substituted from the
 path-parameter inputs and the same context headers.
 
 ⚠️ **The schema-driven payload form does not receive a schema from
-Arc `22.16.0`.** Lens reads an optional property named `schema` off each introspection
+Arc `22.75.0`.** Lens reads an optional property named `schema` off each introspection
 item, and falls back to trying `/.cratis/types/{type}`, `/.cratis/schema/{type}`,
 `/.cratis/schemas/{type}` and `/.cratis/types?type={type}` in turn. Arc names the
 property **`payloadSchema`** on a command and **`argumentsSchema`** on a query,
@@ -206,9 +228,12 @@ unwrapped from the first of `data`, `result`, `items`, `results`, `value`,
 
 ⚠️ **The two introspection fetches send no headers and no credentials**, while
 the Settings user/tenant refresh does send both. So an application that puts
-authorization in front of `/.cratis/commands` breaks the Commands and Queries
-tabs while Settings keeps working — which reads as a mysterious partial failure.
-Leave those two routes anonymous.
+authentication in front of `/.cratis/commands` and `/.cratis/queries` breaks
+those tabs while Settings may keep working. This is the default outside
+Development at Arc `22.75.0`. Run the app in **Development**, or knowingly set
+`Cratis:Arc:Introspection:RequireAuthentication=false` on an isolated development
+host; do not weaken production discovery for Lens.
+Evidence: [Lens introspection.ts:100–131](https://github.com/Cratis/Lens/blob/v0.0.1/Source/arc/introspection.ts#L100-L131).
 
 Queries are path-parameter GETs only: no query-string arguments, no paging or
 sorting inputs, and no observable subscription from the popup.
@@ -222,8 +247,10 @@ it does not, the panel reports no data. Nothing else in Lens depends on it.
 ## Verify
 
 - `yarn ci` is clean, and Chrome loaded `Source/dist` without errors.
-- The application answers `/.cratis/commands` and `/.cratis/queries`
-  anonymously.
+- The development application answers `/.cratis/commands` and `/.cratis/queries`
+  anonymously under its deliberate discovery exposure policy.
+- The isolated development host enables `Cratis:Arc:TrustForwardedIdentityHeaders`;
+  without it, Lens's forwarded identity remains anonymous.
 - Tenancy resolves from the header and the header is named
   `x-cratis-tenant-id`.
 - Opening the popup on the app's tab enables the Commands tab — that is the

package/package/corpus/skills/cratis-performance-review/SKILL.md

@@ -21,10 +21,13 @@ storage and replay cost that never goes away.
 | Package | Version | Purpose |
 | --- | --- | --- |
 | `Cratis.Chronicle` | `18.3.0` | Observers, projections, reducers, reactors, replay |
-| `Cratis.Arc.Core` | `22.16.0` | Query return shapes and server-side paging |
+| `Cratis.Arc.Core` | `22.75.0` | Query return shapes and server-side paging |
 | `@cratis/components` | `4.26.2` | `DataTable` paging surface |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+> Arc query/paging surface rechecked at v22.75.0; Arc depends on Chronicle
+> 19.39.1. Separate Chronicle verification remains version-qualified. Paged
+> MongoDB observations now re-read page and total on each change; see the
+> read-model query reference for the distinction from unpaged retained sets.
 
 Reverify against the owning product repository before asserting a framework
 behavior this file does not already state.

package/package/corpus/skills/cratis-release-notes/SKILL.md

@@ -53,7 +53,9 @@ one to add weight.
   `(part of #n)` for anything that stays open (in repositories released by
   `cratis/release-action`, `(#n)` is what closes the issue), never `Closes`, `Fixes` or
   `Refs` before a number (also in bold or a link), and no issue reference
-  inside an HTML comment, which still closes the issue; and absolute
+  inside an HTML comment (release-action removes comments before publishing,
+  so the issue is silently not closed; a body that is only a comment counts as
+  empty and GitHub generates the notes); and absolute
   `https://` links only. Sections are in
   a fixed order (Added, Changed, Fixed, Removed, Security, Deprecated); within
   a section, put changes requiring action first, then new capabilities and

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -58,8 +58,9 @@ sends again.
 - A reaction cascade is not one transaction: earlier accepted facts stay when a later invoked
   command rejects (Screenplay `reactions.md`). Design each step to be retried on its own.
 - Replay and recovery redelivery are different. Chronicle `[OnceOnly]` skips replays (rewind,
-  redaction, revision) only; a recovered failed partition redelivers the event as a normal
-  observation. A receipt keyed by `ReactorDelivery.Id` identifies the retry. Name both.
+  redaction, revision) only, not ordinary catch-up, repeated same-source events or crash
+  redelivery. Recovery runs the handler normally. It is not a per-source run limit or
+  deduplication. A receipt keyed by `ReactorDelivery.Id` identifies the retry. Name both.
 
 ## Capture data-protection traps
 A field left out of `map` still passes through the capture's working record: omission is not
@@ -73,7 +74,7 @@ even when it blocks binding. Never record bearer tokens, magic links or signed U
 ## Verified product sources
 Current pins: toolchain `references/versions.md`. Language claims were re-read at Screenplay v4.139.0,
 renderer claims at Stage v4.73.1 (no Automation, Translate, reaction or capture: `STAGE-ESM-024`), the
-runtime facts at Arc v22.72.0 and Chronicle v19.50.0. Older reads kept as history:
+runtime facts at Arc v22.72.0 and Chronicle v19.50.1. Older reads kept as history:
 
 | Package | Version | Used for |
 | --- | --- | --- |
@@ -81,7 +82,7 @@ runtime facts at Arc v22.72.0 and Chronicle v19.50.0. Older reads kept as histor
 | cratis CLI | v3.28.3 | bundled Screenplay 4.66.0 and Stage 4.24.2 (before 3.28.2: 4.60.1, which gave PLAY0268 on v6 constructs and a false PLAY0285 on cascades, cli#242) |
 | Stage | v4.24.2 | admitted ESM v1 to v4; rendered no Automation or Translate slice |
 | Arc | v22.72.0 (read; v22.50.5 earlier) | `ExecuteCommandsAsSystemAttribute` (since v20.56.0); mixed events-and-commands reactor returns (since v22.72.0) |
-| Chronicle | v19.50.0 (read; v19.32.0 earlier) | `OnceOnlyAttribute`, `ReactorDelivery` and `Documentation/reactors/delivery-identity.mdx` |
+| Chronicle | v19.50.1 (read; v19.32.0 earlier) | `OnceOnlyAttribute`, `ReactorDelivery`, `Documentation/code-analysis/CHR0022.mdx` and `Documentation/reactors/delivery-identity.mdx` |
 
 Read `references/versions.md` in `cratis-screenplay-toolchain` when selecting a tool or checking the full version and capability pins. Reverify before claiming
 another version behaves the same.

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -26,14 +26,13 @@ source is the single flow model.
 
 ## Verified product sources
 
-Current pins: toolchain `references/versions.md`; the claims here were read at 4.139.0 and at
-the older tags below (provenance). Compilation checks syntax and
-model consistency, not reference execution.
+Pins: toolchain `references/versions.md`; sources below. Compilation is not execution.
 
 - `4.31.0`: original examples and executable boundaries; main `fd18129`: inline events, repairs, canonical `optional`.
 - `4.66.0` (`c89198b`): `handler`, code attachments, `persona` and compliance binding (`Semantics/SemanticModelBinder*.cs`, `Diagnostics/DiagnosticCodes.cs`).
 - `4.68.0` (`79801bf`): generated-value/response rule probes (ESM v7).
-- `4.127.0`: identity and compliance guidance (`identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`, `diagnostics.md`).
+- `4.127.0`: identity and compliance syntax (`identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`, `diagnostics.md`).
+- `4.141.0`: v13 compliance admission/refusals: `references/compliance.md`.
 
 "Parses" and "runs" are different claims. The executable profile, and what
 each construct binds to, is in the `cratis-screenplay-model-authoring` language
@@ -60,8 +59,8 @@ The seven primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 is why the compiler says *expected … or Enum* rather than listing it among them.
 Use bare `pii` for personal data (`personal` is the same marker) and `secret`
 for operational secrets. **Compliance is inherited** from concepts, including
-nested uses. Either marker blocks executable binding with PLAY0268; keep the
-protection. `pii personal` is redundant and warns PLAY0653. Legacy `@pii`,
+nested uses. Standalone 4.141.0 admits v13 compliance; the CLI does not. Residual
+PLAY0268 refusals are in the reference below; keep protection. `pii personal` is redundant and warns PLAY0653. Legacy `@pii`,
 `sensitive` and `@sensitive` remain accepted with PLAY0565 information and a repair.
 Read [compliance and purposes](references/compliance.md) for reasons, special/criminal
 qualifiers, secret scopes, provider mappings, purpose declarations and coverage checks.

package/package/corpus/skills/cratis-screenplay-command-surface/references/compliance.md

@@ -10,8 +10,9 @@
 - Declare the use separately
 - Identify the person, not the stream
 
-Authority: Screenplay v4.127.0 `concepts.md`, `purposes.md`, `events.md` and
-`diagnostics.md`; decision 0041. These declarations do not establish lawful
+Authority: Screenplay v4.141.0 `concepts.md`, `events.md`,
+`Semantics/SemanticModelBinder.Compliance.cs` and `SemanticModelValidator.Compliance.cs`;
+processing-purpose guidance retains v4.127.0 evidence; decisions 0041 and 0068. These declarations do not establish lawful
 processing or enforce retention. Check provider support separately.
 
 ## Classify the value on its concept
@@ -60,9 +61,24 @@ new event generation.
 
 C# provider mapping: `pii` → `[PII]`; `secret` → `[Encrypted]` + `[NotAudited]`;
 `pii secret` → `[PII]` only (Chronicle refuses `[PII]` with `[Encrypted]`, CHR0053).
-This mapping is not admission: either marker, including qualifiers and scopes,
-still blocks executable binding with PLAY0268. Subject lineage is a different
-role, described below.
+Standalone Screenplay 4.141.0 admits these markers, qualifiers and scopes as
+ESM v13. Optional concept `compliance` applies through command, event, read-model,
+composite and response type references, including collection elements. Bare `pii`
+writes `{"personal":{}}`; `secret scope namespace` writes
+`{"secret":{"scope":"namespace"}}`. With both markers, personal protection
+wins and no secret scope is stored. Reasons stay report-only (PLAY0270).
+Unmarked models keep their exact executable bytes and revision. The reference
+evaluator runs marked models with unchanged outcomes but tests neither encryption
+nor erasure. Consumers must explicitly admit v13 and realize the protection;
+CLI 3.53.1's 4.137.0 compiler still refuses markers, and Stage 4.76.0 admits only
+through v12. Never remove protection to fit either tool.
+
+PLAY0268 still refuses compliance on enum or event-source/stream identity concepts.
+It also refuses an event combining personal values or explicitly
+`secret scope subject` values with an explicit event-property `subject` mark,
+including nested composite and collection uses: subject lineage is not admitted.
+In v13 the personal-data subject is the event source. Remove a mark only when that
+source truly is the intended subject, not merely to pass binding.
 
 ## Recover classification from C# with Arc 22.70.0
 
@@ -83,7 +99,9 @@ none of SP0061 to SP0063, so the CLI shows none of them; check the generator pac
   Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI adapter flag
   `--authoring-only-constructs`) to state `secret scope namespace` or
   `secret scope global` in the concept body. Subject stays implicit. Scope
-  is syntax-only: it raises no ESM version and grants no executable admission.
+  was syntax-only on this generator's compiler. With standalone 4.141.0,
+  protected concepts instead select ESM v13; this does not upgrade the generator
+  or the CLI bundle.
   `pii secret` gets no scope because the providers ignore it.
 - A property or positional constructor parameter marked `[PII]` on a non-concept
   type reports SP0062 (Information); the marking is not stated and no concept

package/package/corpus/skills/cratis-screenplay-command-surface/references/enum-numbers.md

@@ -83,11 +83,13 @@ names; numbers are neither alternative fixture values nor flags.
 Consumers must **explicitly admit v12**. CLI 3.53.1 and Stage 4.73.1 both bundle
 Screenplay 4.137.0: `cratis render`/Stage do not admit v12 yet. A model with
 non-positional numbers compiles and binds with standalone Screenplay >= 4.139.0,
-but does not render through that CLI. Do not remove its pins to pass rendering;
+but does not render through that CLI. Standalone Stage 4.76.0 is the first Stage that admits v12 and
+renders explicit numbers as `Member = N` (sparse and negative, `-0` as 0; unnumbered enums keep declaration
+order), but no cli release bundles it yet. Do not remove its pins to pass rendering;
 report the consumer gap. See toolchain `references/versions.md`.
 
 Sources checked at `v4.139.0`: `Documentation/screenplay/concepts.md`,
 `interoperability.md`, `diagnostics.md`, `mcp/authoring-tools.md`, decision 0065,
 `Semantics/Versions.cs`, `SemanticModelValidator.EnumMemberNumbers.cs` and the
 source-backed `EnumMemberNumbersCorpus.V12` (under `Source/DotNET/`). Consumer
-pins: CLI `v3.53.1:Directory.Packages.props`, Stage `v4.73.1:Directory.Packages.props`.
+pins: CLI `v3.53.1:Directory.Packages.props`, Stage `v4.73.1:Directory.Packages.props`; Stage `v4.76.0` release notes (#296).

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -4,7 +4,10 @@ A `generated` command property and `returns` response bind and reference-execute
 as ESM v7 (checked at 4.68.0). Current pins:
 `cratis-screenplay-toolchain/references/versions.md`. CLI#261 is closed: CLI now admits v7
 to Stage planning, and the 4.137.0 compiler in CLI 3.53.1 binds it. Stage 4.73.1 still refuses
-generated values and responses with STAGE-ESM-028/029 (Stage#175), as the historical CLI 3.41.0 corpus did. Do not turn this into a blanket compiler
+generated values and responses with STAGE-ESM-028/029 (Stage#175), as the historical CLI 3.41.0 corpus did.
+Standalone Stage 4.74.0 and later render server-generated UUID-concept values and scalar or named
+responses (read at `v4.76.0`), but no cli release bundles them yet, so `cratis render` through cli 3.53.1 still
+refuses. Screenplay 4.139.0 has only `generated` / `generated identifier`; no `generate` strategy form exists. Do not turn this into a blanket compiler
 refusal or promise a render from binding alone. Preserve the contract for gap-fill
 where admission refuses. Historical rules below were read at 4.68.0. Complete compiled example:
 `cratis-screenplay-toolchain` `references/generated-responses-example.md`.

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -135,8 +135,9 @@ What binds depends on **which tool** you ask, so name the tool and its version:
   protected against stale state. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
 - `persona` declarations are report-only and never block; bare `pii` and `secret`
-  concepts do block binding (`PLAY0268`). Keep them anyway: the classification is
-  part of the model. Report the block.
+  concepts bind as ESM v13 on standalone 4.141.0, but still block the pinned CLI.
+  Enum/identity compliance and protected events with explicit subject marks remain
+  refused (PLAY0268); see command-surface `references/compliance.md`. Keep protection.
 - Generated values/responses bind and reference-execute as v7; sources, streams
   and command/specification routes as v8; reaction `runs as` identity as v10;
   qualifying Double literals lower exactly as v11 and non-positional enum numbers

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -22,10 +22,10 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 
 ## Dispositions to keep apart
 
-| Construct | Standalone disposition (checked at v4.125.0; v4.139.0 unchanged for these rows) |
+| Construct | Standalone disposition (v4.125.0/v4.139.0 evidence; compliance updated at v4.141.0) |
 | --- | --- |
 | `persona`, domain/authentication metadata | Report-only; unknown named policies remain source defects |
-| Compliance concepts | Bare `pii`/`secret` (4.127.0); binding still refuses PLAY0268, never remove protection |
+| Compliance concepts | Bare `pii`/`secret`, qualifiers and scope bind as v13 at 4.141.0; enum/identity compliance and protected events with explicit subject marks refuse PLAY0268. The pinned CLI still refuses markers; never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata (4.127.0); executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -44,6 +44,7 @@ at the versions named in each row (CLI 3.53.1 bundles Prologue
 | --- | --- |
 | `generate` options, no default-file certainty (stdout when `--file` is absent), spec-project exclusion by name, `CLI0005/0009/0014-0017` | cli `v3.28.2:Source/Cli/Commands/Screenplay/{GenerateScreenplayCommand,GenerateScreenplaySettings,ScreenplayProjectSelection,ScreenplayDiagnosticCodes}.cs` |
 | `SP0016` (rule in code, computed message, `When`/`Unless` written as unconditional), `SP0024` (source did not compile) | Arc `v22.50.5:Source/DotNET/Screenplay/ScreenplayDiagnosticCodes.cs`, `Documentation/backend/csharp/generating-a-screenplay.md` |
+| Enum number preservation (SP0067–SP0069) and response-read/mutation proof | Arc `v22.76.0:Source/DotNET/Screenplay/Emission/Concepts/ConceptSyntaxBuilder.cs`, `Analysis/Types/{ConceptRegistry,FlagsEnumUses}.cs`, `Analysis/Specifications/SpecificationReturnValues.cs`; `references/generate-notes.md` |
 | Non-default secret scope in authoring mode, SP0061–SP0063, self-check contract on compiler upgrades | Arc `v22.70.0:Documentation/backend/csharp/generating-a-screenplay.md`, `Source/DotNET/Screenplay/Verification/ExpectedBindingDiagnostics.cs`; `references/generate-notes.md` |
 | `prologue start` is an interactive wizard that writes `cratis-prologue.json`; `interpret --no-llm` never creates a chat client; a local `llm.enabled` setting wins over the global CLI configuration; the provider is announced before evidence is sent (cli#241, closed) | cli `v3.53.1:Source/Cli/Commands/Prologue/{StartPrologueCommand,InterpretPrologueSettings,InterpretPrologueCommand,LlmOptionsResolver}.cs`, `Documentation/reference/prologue.md` |
 | `generate` and `conform` evaluate the project with MSBuild (design-time build; may run project targets and write `obj/`); `conform` exit 0/1/2, structural only | cli `v3.53.1:Documentation/reference/screenplay.md`, `Source/Cli/Commands/Screenplay/ConformScreenplayCommand.cs` |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generate-notes.md

@@ -7,6 +7,7 @@
 - Coverage (what a provider reads)
 - Diagnostics are the loss list
 - Arc recovery and authoring-only options
+- Arc 22.76.0 enum and response recovery
 - Arc 22.70.0 compliance recovery
 - Generated-document self-check on compiler upgrades
 - Reading the output cheaply
@@ -16,7 +17,7 @@ cratis-screenplay-toolchain `references/versions.md`; behaviour from the cratis
 (`v3.28.2:Source/Cli/Commands/Screenplay/`; the generate files are unchanged since `v3.27.1`), Arc `v22.50.5`
 (`Documentation/backend/csharp/generating-a-screenplay.md`,
 `Source/DotNET/Screenplay/ScreenplayDiagnosticCodes.cs`), Screenplay.Generation `v0.18.0` and
-Screenplay.CritterStack `v0.24.0`. Version-specific capability facts belong in cratis-screenplay-toolchain
+Screenplay.CritterStack `v0.24.0` (the versions cli 3.53.1 bundles). Later releases exist (Generation 0.18.1 preserves compiler warnings, including on successful generation; CritterStack 0.26.0 adds enum concepts, command-to-event production links and the `MixedSliceKindsSplit` and `ProductionLinkOmitted` diagnostics); do not claim them for `cratis screenplay generate` until a cli bundles them. Version-specific capability facts belong in cratis-screenplay-toolchain
 `references/versions.md`.
 
 For the current standalone compiler and CLI bundle, use the toolchain's
@@ -75,7 +76,7 @@ cratis screenplay generate <solution|project|folder> \
 | Provider | Reads | Does not read |
 |---|---|---|
 | Arc | commands, events, concepts, read models, projections, reducers, reactors, constraints, declarative FluentValidation rules, authorization policies, `produces` from constants and input paths, Chronicle integration specs as given/when/then, `.tsx` beside a slice as `screen` + `data via query` | handler bodies, rules written in code, computed messages (`SP0016`), screen bodies, captures, personas, seeds, `@sensitive`. A rule held to `When`/`Unless` is written down as if unconditional and `SP0016` names the condition: read the diagnostic, do not trust the declaration |
-| Marten / Critter Stack (preview) | aggregates, snapshots, HTTP and message handlers, document operations, queries, outgoing and delayed messages, saga facts | saga lifecycle, policies, middleware bodies, runtime tenancy, upcasting; unbounded extension code is reported by presence only |
+| Marten / Critter Stack (preview; an independent optional adapter built on the neutral Screenplay.Generation SDK, not affiliated with JasperFx: review every `GEN`/`MARTEN`/`WOLVERINE` diagnostic by hand) | aggregates, snapshots, HTTP and message handlers, document operations, queries, outgoing and delayed messages, saga facts | saga lifecycle, policies, middleware bodies, runtime tenancy, upcasting; unbounded extension code is reported by presence only |
 | any non-.NET stack | nothing | use Prologue and targeted reads |
 
 ## Diagnostics are the loss list
@@ -123,6 +124,34 @@ Handler/reaction bodies, unresolved conditions and unproven origins still need
 source review. Do not infer generation/evolution/absence-assertion coverage from
 a package upgrade; read diagnostics and reconcile each recovered scenario.
 
+## Arc 22.76.0 enum and response recovery
+
+Source-verified at Arc `v22.76.0:Source/DotNET/Screenplay/Emission/Concepts/ConceptSyntaxBuilder.cs`,
+`Analysis/Types/{ConceptRegistry,FlagsEnumUses}.cs`, `Analysis/EnumConstants.cs`,
+`Analysis/Specifications/SpecificationReturnValues.cs`, and
+`Documentation/backend/csharp/generating-a-screenplay.md`. Arc 22.76.0 takes
+Screenplay 4.139.0, not 4.141.0. The CLI bundles an older generator; see the
+central toolchain `references/versions.md` rather than assuming parity.
+
+Every enum member now emits its stored integer, including positional members.
+Sparse, negative and reordered values preserve identity when representable as int32
+and permitted by `MaximumExecutableModelVersion` (non-positional values need v12).
+SP0068 warns when numbers fall back together to positions because of the range or
+cap, and on dropped emitted-name collisions: do not treat that output as preserving
+stored identity. SP0069 reports aliases sharing a number; the ordinal-first member
+used by scenario constant resolution is kept. SP0067 reports `[Flags]` enums with
+unnamed combinations and names the property uses; named members still emit, but
+unnamed combinations cannot become scenario values. Read every warning as a loss.
+
+Since 22.75.2, `result!` and `in` arguments remain reads for recovered `then returns`.
+Writes through any member/element of the executed result (assignment, increment,
+decrement, `ref`/`out`, including null-conditional chains) or aliases of the result
+or non-string reference values reached through it withhold the response assertion.
+This includes variables/fields/initializers, foreach/pattern variables,
+returned/yielded/lambda values and conditional/coalescing/tuple/collection flows.
+Mutation through ordinary method calls is not analyzed. Inspect reported scenarios;
+never infer a response contract from a post-execution mutation.
+
 ## Arc 22.70.0 compliance recovery
 
 A concept with both `[Encrypted]` and `[NotAudited]` becomes `secret`.
@@ -136,8 +165,9 @@ without adding `secret`; an existing `pii` classification remains.
   `namespace` scope: the document instead implies Subject scope. Global behaves
   the same way. Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI
   adapter option `--authoring-only-constructs`) to emit `secret scope namespace`
-  or `secret scope global` in the concept body. Scope is syntax-only and does
-  not raise the ESM version; it does not make protected concepts executable.
+  or `secret scope global` in the concept body. This was syntax-only on that
+  compiler; standalone 4.141.0 instead admits concept compliance as ESM v13.
+  That upgrade does not change the older generator or CLI bundle.
 - A concept also marked `[PII]` becomes `pii secret`, with no emitted scope:
   the C# providers render only `[PII]`; Chronicle rejects `[PII]` combined with
   `[Encrypted]`. Do not add a scope the provider ignores.

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -21,8 +21,9 @@ same model root or workspace export to all checks. Workflow:
 
 ## Verified product sources
 
-Current authoring/MCP guidance follows Screenplay v4.139.0
-`Documentation/screenplay/mcp/`, `ast-authoring.md`, `folders.md`, `vscode.md`.
+Screenplay v4.141.0: planner in `references/property-links.md`;
+compliance in command-surface `references/compliance.md`. Other MCP evidence:
+v4.139.0 `Documentation/screenplay/mcp/`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
 tool. Pins are in `cratis-screenplay-toolchain` `references/versions.md`.
 Historical probes remain 4.66.0; registration example compilation/execution
@@ -295,7 +296,8 @@ that the code compiles or behaves. Read `references/mcp-tools.md#code-attachment
   clean run is not a bound or executable result.
 - Operations/`numbers exact` remain unadmitted; routes bind as v8, public
   boundaries v9, identity/overrides/filters v10, qualifying non-route Double
-  literals v11, non-positional enum numbers v12 (standalone 4.139.0).
+  literals v11, enum numbers v12, compliance v13 (4.141.0;
+  limits: command-surface `references/compliance.md`).
   CLI 3.53.1/Stage 4.73.1 bundle 4.137.0 and do not admit v12. Never drop or stub source contracts to bind.
 - Distinguish authoring acceptance from `executableReady`; unsupported backend
   capabilities are not a reason to drop source constructs or invent stubs.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -266,7 +266,7 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Binds as ESM v7 on standalone Screenplay 4.68.0 (source and release notes; `PLAY0268` on the 4.66.0 in Cratis CLI 3.28.x, probed) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and a generated property on a concept with validation rules is `PLAY0268`. Stage 4.73.1 refuses them (`STAGE-ESM-028`/`-029`, Stage#175): gap-fill |
 | Authorable, not executable (PLAY0268) | Systems/operations, the `numbers exact` source mode (PLAY0268; exact lowering of qualifying Double literals is the admitted v11) and refusal/redelivery remain unadmitted |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10 on 4.125.0. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | `pii`/`secret` concepts (also legacy spellings; historical probe: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with filters, scope, performer, context-derived `by` or composite `by` blocks (optional keyed and collection queries, including observable delivery, bind at 4.135.0), `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks (4.141.0); the older CLI bundle refuses all `pii`/`secret` concepts (historical probe: "compliance attributes require portable data-subject semantics"); command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with filters, scope, performer, context-derived `by` or composite `by` blocks (optional keyed and collection queries, including observable delivery, bind at 4.135.0), `$causedBy` and templates in projections |
 | Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |