@cratis/pi 7.34.1 → 7.35.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.139.0
+4.141.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -53,7 +53,7 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
 Needs an MCP connection (V2 and V3 belong to the session that owns MCP; a subagent without
 MCP reports `V2 not run: no MCP in this agent` unless the brief supplies fresh output). Without
 MCP, a binding check exists: `cratis screenplay validate --executable <root>` binds with the
-**bundled** compiler (CLI 3.53.1 bundles Screenplay 4.137.0, not the standalone 4.139.0), never
+**bundled** compiler (CLI 3.53.1 bundles Screenplay 4.137.0, not the standalone 4.141.0), never
 renders or writes files, and exits 5 with "The model does not bind into an executable semantic
 model" when it does not. Report it as `V3 (bundled 4.137.0 via cratis validate --executable)`; it
 gives binding errors, not the V2 `executable-diagnostics` view, so V2 stays MCP-only.
@@ -68,7 +68,7 @@ gives binding errors, not the V2 `executable-diagnostics` view, so V2 stays MCP-
    source revision).
 4. Report the codes with counts, blocking (error severity) apart from informational. A list
    with blocking entries is a valid V2 result (`V2 read: 6 blocking, PLAY0268 x3 filter query,
-   pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
+   enum compliance ...`); it is the evidence for a "V3 blocked" report. The view also lists
    information-severity diagnostics (PLAY0269 deferred UI, PLAY0270 authoring metadata such as
    descriptions, personas and screens) on models that bind; they do not block.
 

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -17,16 +17,23 @@ probe; older probes retain their original labels in the other references.
 
 | Source | Pin | Evidence |
 | --- | --- | --- |
-| Screenplay language, standalone tool and MCP | **4.139.0** (`dcd84574`) | Released tag `v4.139.0` and its unchanged published contract; enum numbers/ESM v12 and property references |
+| Screenplay language, standalone tool and MCP | **4.141.0** (`8ce785e3`) | Released tag `v4.141.0` and its unchanged published contract; concept compliance/ESM v13 and the property-change planner |
 | cratis CLI | **3.53.1** | Released tag `v3.53.1`; source-checked, not a new render/browser probe |
 | Screenplay bundled by CLI | **4.137.0** | CLI `v3.53.1:Directory.Packages.props`; enum-number authoring, not v12 binding |
 | Stage bundled by CLI | **4.73.1** | Same file; Stage's own `Directory.Packages.props` also pins Screenplay 4.137.0 |
+| Latest standalone Stage released when this was checked | **4.76.0** (Screenplay 4.139.0) | Released tag `v4.76.0`; no cli release bundles Stage 4.74.0 to 4.76.0, so a cli user observes none of it. It admits ESM v1 to v12 (v11 from 4.75.0, v12 from 4.76.0), renders UUID-concept generated values and responses (4.74.0) and explicit enum numbers (4.76.0). Its scaffold pins match 4.73.1 (Arc 22.68.0, Chronicle 19.45.0, frontend pins); `Directory.Packages.props` takes Scene 4.21.0 |
+| Screenplay.Generation / CritterStack / Prologue bundled by CLI | **0.18.0 / 0.24.0 / 2.0.0** | CLI `v3.53.1:Directory.Packages.props`. Latest released: Generation 0.18.1, CritterStack 0.26.0, Prologue 2.0.0 (no release after 2.0.0); the newer Generation and CritterStack releases are not in a cli |
 | Cratis.Arc.Screenplay bundled by CLI | **22.54.0** | Same file; this is the generator package, not a blanket rendered-app dependency pin |
 | Chronicle / Fundamentals bundled by CLI | **19.32.0 / 7.22.8** | Same file |
-| Latest Arc / Chronicle / Fundamentals released when this was checked | **22.72.0 / 19.50.0 / 7.23.0** | Released tags; newer than the CLI bundle and than Stage's scaffold. Arc 22.72.0 and later run a reactor returning events and commands (absent through 22.71.0); the Stage 4.73.1 scaffold pins Arc 22.68.0, whose command handler accepts a collection only when every element is a command, so a rendered app needs a proven dependency override to 22.72.0 or later |
-| Stage 4.73.1 rendered backend and frontend | **Arc 22.68.0 / Chronicle 19.45.0**; Components 4.26.2, Scene 4.21.0, `@cratis/arc` 22.58.2, Fundamentals 7.22.8 | Stage `v4.73.1:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs` and `CratisFrontendPackageSet.cs` (`Current`); not the latest releases and not bumped by hand |
+| Latest Arc / Chronicle / Fundamentals released when this was checked | **22.76.0 / 19.51.0 / 7.23.0** | Released tags; newer than the CLI bundle and than Stage's scaffold. Arc 22.72.0 and later run a reactor returning events and commands (absent through 22.71.0); the Stage 4.73.1 scaffold pins Arc 22.68.0, whose command handler accepts a collection only when every element is a command, so a rendered app needs a proven dependency override to 22.72.0 or later |
+| Stage 4.73.1 rendered backend and frontend | **Arc 22.68.0 / Chronicle 19.45.0**; `@cratis/components` 4.26.2, `@cratis/scene.*` 4.21.0, `@cratis/arc` 22.58.2, Fundamentals 7.22.8 | Stage `v4.73.1:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs` and `CratisFrontendPackageSet.cs` (`Current`); not the latest releases and not bumped by hand |
 | Historical Stage 4.51.3 rendered backend | **Arc 22.50.5 / Chronicle 19.32.0** | Stage `v4.51.3:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`; client/testing/image match; scaffold disables embedded reverse extraction |
 
+Scene's family id denotes the six scaffold packages listed in
+`cratis-stage-rendering-and-sandbox/references/rendered-application.md`, not a
+package named `@cratis/scene`. The Components skills verify the latest 4.26.4
+surface; that does not upgrade Stage's managed scaffold pin.
+
 The published `screenplay-contract.json` beside this reference is the machine-readable authority for PLAY codes, MCP tools and parameters, and standalone CLI commands/options. Its unchanged release bytes are pinned by `screenplay-contract.version` to the standalone version above. Before adding a claim, search this large JSON file by exact `code` in `diagnostics`, or by exact `name` in `mcpTools`/`cliCommands`, and inspect that object's retirement flag, parameters or options; do not load the full file into context. For example, search for `"code": "PLAY0029"` or `"name": "read-workspace"`; `screenplay-contract-exceptions.json` preserves explicitly reasoned historical statements, not current-release exceptions. Coverage gaps are mention inventories, not proof that a skill teaches a feature.
 
 Check the actual executable before relying on this table: `screenplay --version`,
@@ -46,7 +53,7 @@ or renderer probes below as results from the newer bundle.
 
 ## Two compilers, one rule
 
-Standalone Screenplay 4.139.0 and CLI 3.53.1's 4.137.0 bundle are different releases.
+Standalone Screenplay 4.141.0 and CLI 3.53.1's 4.137.0 bundle are different releases.
 Prefer standalone for the current language checks; CLI owns generation, Prologue
 and rendering. Name the tool/version with every verdict. No verdict transfers
 between differing compilers without checking the same inputs there.
@@ -78,8 +85,8 @@ for identity-stable selection.
 
 ## Admission boundaries
 
-Screenplay `v4.139.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports
-schema pairs through v12. Admission selects by use:
+Screenplay `v4.141.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports
+schema pairs through v13. Admission selects by use:
 
 - v7: generated values/responses and policy negation.
 - v8: sources/streams and command/specification routes.
@@ -110,6 +117,14 @@ schema pairs through v12. Admission selects by use:
   with mismatched length, duplicates, non-int32 entries or positional numbers
   (non-canonical). Consumers must admit v12 explicitly. Authoring shipped in
   4.137.0 (decision 0065); syntax/example: command-surface `references/enum-numbers.md`.
+- **Published v13 in 4.141.0:** concept `pii`/`secret`, personal qualifiers and
+  secret scopes bind as optional concept `compliance`. Unmarked models retain
+  their exact bytes/version/revision. Reference execution outcomes stay unchanged;
+  it proves no storage encryption or erasure. Enum/identity compliance and an
+  event combining personal or explicitly subject-scoped secret values with an
+  explicit `subject` mark refuse PLAY0268. See command-surface
+  `references/compliance.md` and Screenplay decision 0068. Stage 4.76.0 admits
+  only through v12; no current cli bundles this compiler or admits v13.
 
 Decision 0066 freezes a version when any exposing NuGet/npm package is published,
 including prereleases. Later byte-changing features take the next version at
@@ -157,7 +172,8 @@ The Stage skill teaches the version-gated examples.
 
 At 4.127.0, `$identity` aliases built-in caller paths; declared identity details
 remain metadata and their executable reads report PLAY0268. Bare `pii`/`secret`
-still block binding; `personal` aliases `pii`. Legacy markers are accepted with
+bind as v13 on standalone 4.141.0, but still block binding on CLI 3.53.1's
+4.137.0 bundle; `personal` aliases `pii`. Legacy markers are accepted with
 PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
 purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove
 lawfulness or enforce retention. See command-surface context/compliance references.

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -10,7 +10,7 @@
     { "kind": "skill-contains", "value": "Composite read-model keys/query blocks are also still PLAY0268", "file": "references/versions.md" },
     { "kind": "skill-contains", "value": "the **whole source, stream and stream id**", "file": "references/production-routes-and-filters.md" },
     { "kind": "play-compiles" },
-    { "kind": "skill-contains", "value": "4.139.0" },
+    { "kind": "skill-contains", "value": "4.141.0" },
     { "kind": "skill-contains", "value": "Published v12" },
     { "kind": "skill-contains", "value": "PLAY0671", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "PLAY0653", "file": "references/diagnostics.md" },

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -35,6 +35,8 @@ Current pins: toolchain `references/versions.md`; UI statements were re-read at
 (`screens.md`, `contributions.md`, `forms.md`, `templates.md`, `ui-profile.md`, `fixtures/screen-release-ui.play`). Older provenance:
 `4.31.0` (original parser evidence), main `fd18129` (cancellation routing, `optional`), `4.66.0` (`c89198b`: `PLAY0269`).
 
+Scene runtime sources: scaffold Scene tag, `Source/JavaScript/**`.
+
 The update follows `commands.md`, `events.md`, `queries.md` and decision 0023
 at that main commit (after v4.52.0). It does not verify UI rendering.
 

package/package/corpus/skills/cratis-screenplay-ui-composition/references/screen-composition-contract.md

@@ -37,9 +37,10 @@ Keep those three lines separate in reports. Correct an old limitation only when
 the package/version you are using proves the new level. Historical verified vector:
 CLI 3.43.0 with its default `cratis/stage:4.52.0` and bundled Screenplay 4.127.0;
 the executed vector renders on Scene 4.15.0. Packages published since are newer than
-that vector and are not claimed verified: Scene 4.17.0, Screenplay 4.133.1, Stage
-4.64.0, previous CLI 3.46.1 (bundled Screenplay 4.130.0; its then-default Stage was
-4.52.0) and Studio 0.152.2. Current pins:
+that vector and are not claimed browser-verified. Scene 4.17.0 was the earlier
+source-checked runtime summary, not a new executed vector. Scene runtime capabilities
+below were source-checked at the current scaffold's Scene tag; this does not
+re-label the historical execution result. Current pins:
 `cratis-screenplay-toolchain/references/versions.md`.
 All three levels hold for the canonical `ScreenComposition` corpus on the historical vector:
 
@@ -238,11 +239,28 @@ when a single screen owns the button. A parameter that reads a selection is a ty
 data-context path). A dialog destination must state every input with a typed `with`/`parameter`
 binding; a runtime default is not an authored contract.
 
-What Scene 4.17 adds to the runtime side of this contract, so an agent knows what a
-destination can do once it is authored (authoring acceptance and executable
-admission are separate, see Support levels - a Scene release is not a Stage
-release):
-
+Scene 4.21 runtime capabilities (source-checked at the Scene tag in the
+scaffold pin table, not a browser run). Authoring acceptance, executable
+admission and runtime support stay separate — a Scene release is not a Stage
+release. Stage 4.73.1 pins that Scene release; never upgrade managed files by hand:
+
+- **Hierarchy and routes.** `Screen.path` and `NavigationItem.hierarchy` carry
+  module/feature paths, outermost first. Browser/hash history
+  (`createBrowserSceneHistory`, `createHashSceneHistory`) supports deep links;
+  dialogs are history entries closed with `closeDialog(result)`.
+- **Bindings.** Inputs publish a `value` output through `useValueOutput`;
+  command arguments resolve `component.<id>.<output>` through
+  `resolveArgumentSource`. `useBoundQuery` reruns on argument changes, aborts
+  prior runs and discards stale answers; clearing/failing removes old data.
+- **Descriptors and packages.** Object descriptors carry nested `properties`
+  and `open`. `ApprovedPackageSet`, `loadApprovedPackages` and
+  `resolveApprovedPackageHost` align planning declarations with runtime bundles;
+  executable imports require host approval.
+- **Master/detail.** The default blueprint supplies `MasterDetail`.
+- **Core toolbar.** `core:toolbar` holds `core:toolbarItem` entries. Action items
+  announce `cratis.scene.command` with resolved parameters; Navigate/Dialog
+  items execute through the navigation host (or announce a navigation event
+  outside one). This is not a promise that the command executes without a host.
 - **Nested outlets.** A `core:outlet` component declares a named nested outlet on a
   screen. A destination into it opens its screen there and keeps the declaring
   screen on the page; the opened screen may declare outlets of its own, so
@@ -269,7 +287,7 @@ claim: confirm it from the render receipt and diagnostics before reporting it.
 ## Design-time generation results
 
 Design-time actions belong to component packages, not to the model and not to an
-agent. Scene 4.15 (unchanged in 4.17) declares them as data (`PackageDesignTimeMetadata`) and ships
+agent. Scene 4.15 (re-verified at the current scaffold Scene tag) declares them as data (`PackageDesignTimeMetadata`) and ships
 their code in an optional design-time bundle; a runtime host that does not set
 `loadDesignTime` loads none of it, so nothing a design-time action does can exist
 only at runtime. The one Cratis action today is **Generate fields**

package/package/corpus/skills/cratis-security-review/SKILL.md

@@ -16,12 +16,14 @@ first.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Arc.Chronicle` | `22.16.0` | `[NotAudited]` in `Cratis.Arc.Chronicle.Commands`; the `ARCCHR0009` analyzer |
+| `Cratis.Arc.Chronicle` | `22.75.0` | `[NotAudited]` in `Cratis.Arc.Chronicle.Commands`; the `ARCCHR0009` analyzer |
 | `Cratis.Chronicle` | `18.3.0` | `[PII]`, `[Subject]`, redaction, namespace isolation |
 | `Cratis.Chronicle` | `19.32.0` | `[Encrypted]` in `Cratis.Chronicle.ProtectedValues`; analyzers `CHR0052`, `CHR0053` |
-| `Cratis.Arc.Core` | `22.16.0` | Authorization filters, `CommandResult.Unauthorized` |
+| `Cratis.Arc.Core` | `22.75.0` | Authorization filters, `CommandResult.Unauthorized` |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+> Arc security boundaries rechecked at v22.75.0; every added check is cited in
+> references/arc-boundaries.md. Arc depends on Chronicle 19.39.1; separately
+> version-qualified Chronicle security claims retain their original verification.
 
 Reverify against the owning product repository before asserting a framework
 guarantee this file does not already state.
@@ -97,6 +99,10 @@ command's properties as well as grepping them.
   must not be able to assert who it is through a command property.
 - Note that an unauthorized command result maps to HTTP **403**, not 401 — a
   reviewer reading logs for 401s will miss authorization failures.
+- Review [Arc-specific security boundaries](references/arc-boundaries.md) when
+  the diff touches hosting, identity, policies, discovery, streams or system actors.
+  It pins the checks to Arc v22.75.0; do not assume a clean analyzer run proves
+  those deployment boundaries.
 
 ## Step 4 — Data exposure
 

package/package/corpus/skills/cratis-security-review/references/arc-boundaries.md

@@ -0,0 +1,59 @@
+# Arc security checks
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+Verified at **Arc v22.75.0**. Each source below is pinned to that tag.
+
+- Enable `TrustForwardedIdentityHeaders` only behind an authenticating ingress
+  that strips caller identity headers, replaces them and prevents direct backend
+  access. Headers are unsigned, not proof of identity. Without the explicit
+  host-wide opt-in Arc ignores them. Custom handlers must honor the same flag.
+  [Secure defaults](https://github.com/Cratis/Arc/blob/v22.75.0/Documentation/upgrading/secure-defaults.mdx).
+- Application code must not read `.cratis-identity`. The backend derives identity
+  from the authenticated principal; the JS client only falls back to the legacy
+  cookie on 404, never on 401/403. Use `clearCache()` on logout. Browser identity
+  remains display state, not server authorization.
+  [Backend provider](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Identity/IdentityProvider.cs),
+  [JS provider](https://github.com/Cratis/Arc/blob/v22.75.0/Source/JavaScript/Arc/identity/IdentityProvider.ts).
+- Test all discovery routes outside Development. Default access is authenticated
+  there, or 404 when the host cannot authenticate. Explicit
+  `RequireAuthentication=false` opens discovery in every environment;
+  `Enabled=false` removes catalogs, not identity discovery. Disable both switches
+  when neither is needed. `[ExcludeFromDiscovery]` hides documentation/catalogs,
+  not invocation or authorization.
+  [Introspection](https://github.com/Cratis/Arc/blob/v22.75.0/Documentation/backend/csharp/introspection/index.md).
+- Check ARC0019/0020/0021: conflicting declarations, Microsoft attributes without
+  the ASP.NET integration, and schemes on the standalone host. Microsoft
+  `[Authorize]` is enforced only by the ASP.NET host; policies/schemes fail closed
+  on supported hosts. A method declaration **replaces** the type declaration.
+  Guest access requires every policy in the declaration to opt in
+  (`evaluatesAnonymous`), without roles/schemes. Since 22.44.2 guest endpoints are
+  reachable through HTTP even with an authenticated fallback policy. Keep an
+  intentional `IFallbackAuthorizationEvaluator` baseline; it is separate from
+  ASP.NET's `FallbackPolicy`.
+  [Authorization descriptors](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core.CodeAnalysis/DiagnosticDescriptors.cs),
+  [guest endpoint specs](https://github.com/Cratis/Arc/tree/v22.75.0/Source/DotNET).
+- The embedded `/.cratis/event-model` viewer defaults to Debug **and** Development.
+  Explicit `Enabled=true` overrides that default: check that deployed hosts have
+  not enabled it, rather than claiming Production can never map it.
+  [Exposure implementation](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Screenplay.Embedded/Hosting/EventModelViewerExposure.cs).
+- Generated identifiers are not secrets, authorization proofs or idempotency
+  keys. [Generated values](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Commands/ModelBound/GeneratedValueAttribute.cs).
+- Arc telemetry records type/name/outcome metadata and correlation/tenant ids,
+  not command/query/event payload values or validation/exception messages. Do not
+  widen it with sensitive payloads or mistake this for a promise of no ids.
+  [Telemetry names](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/WellKnownTelemetryNames.cs).
+- Returned reactor commands marked `[ExecuteCommandsAsSystem]` use a narrow
+  disposed system scope. The caller-principal leak before 22.72.0 is fixed;
+  manually executing commands still needs explicit actor ownership.
+  [Executor](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Chronicle/Reactors/CommandSideEffectExecutor.cs).
+- Revocable observable data needs `IGuardObservableQueryEmission`; it applies to
+  plain HTTP snapshots/waits/long polls too. Suppression withholds data; denial
+  terminates/returns unauthorized. Never read the producer's ambient principal.
+  [HTTP processing](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Queries/ObservableQueryHttp.cs).
+- Query health remains explicitly anonymous and returns connection health. Audit
+  exposure of connection user ids (tracked by Arc#2873), not just catalogs:
+  discovery restrictions are not blanket protection of `/.cratis/*`.
+  [QueryHealth](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Queries/QueryHealth.cs),
+  [subscription client UserId](https://github.com/Cratis/Arc/blob/v22.75.0/Source/DotNET/Arc.Core/Queries/QuerySubscriptionClientInfo.cs).

package/package/corpus/skills/cratis-specification-by-example/SKILL.md

@@ -39,6 +39,13 @@ In a language without those analyzers the same rules hold; the reviewer enforces
 them instead of the compiler. Reverify against the owning product repository
 before claiming behavior for another version.
 
+The `Cratis.Synopsis.Tool` dotnet tool (verified at `v1.1.3`) reads these
+names statically, never running code, and writes one HTML or JSON behavior
+document from C#, TypeScript, Gherkin and Screenplay specifications:
+`dotnet tool install --global Cratis.Synopsis.Tool`, then `synopsis . --open`
+(or `synopsis . --format both --output Artifacts/synopsis.html`). Good names are
+the documentation it produces.
+
 ## Route near misses
 
 - Writing the C# mechanics — the `Specification` base, `Establish`/`Because`,

package/package/corpus/skills/cratis-specifications-csharp/SKILL.md

@@ -12,14 +12,21 @@ Specifications are executable documentation. The folder tree reads like a table
 of contents, and each file states one setup, one action, and one or more
 focused assertions.
 
+Read [query and decision scenarios](../cratis-application-slice-specifications/references/query-and-decision-scenarios.md)
+when specifying query emissions, routed conflicts or protected projection reads.
+Call `UseDecisionReads()` before seeding actual events; pinned models cannot
+supply a guard. `Perform`/`Observe` need configured services/principal, and
+MongoDB observations still need real infrastructure.
+
 ## Verified product sources
 
 This skill is verified against these exact public releases:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Specifications` | `4.1.1` | `Specification` base, `Catch.Exception`, `ShouldXxx` assertions |
-| `Cratis.Arc.Testing` | `22.16.0` | `CommandScenario<TCommand>` and `CommandResult` assertions |
+| `Cratis.Specifications.XUnit` | `4.1.1` | `Specification` base, lifecycle discovery, `ShouldXxx` assertions, optional shared lifecycle |
+| `Cratis.Specifications` | `4.1.1` | `Catch.Exception`, `SpecificationMethods` (dependency of the XUnit package) |
+| `Cratis.Arc.Testing` | `22.76.0` (caller registrations); `22.75.0` (other scenario assertions) | `CommandScenario<TCommand>` preserves explicit principal/override/policy services from 22.75.1; see application-scenarios |
 | `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario`, `ReadModelScenario<T>`, `ReactorScenario<T>` |
 
 Reactor read-model seeding/absence, synchronous handler exceptions and the
@@ -27,8 +34,13 @@ Reactor read-model seeding/absence, synchronous handler exceptions and the
 and require **19.46.0+**; see the ReactorScenario section in
 [application-scenarios.md](references/application-scenarios.md).
 
+Per-context in-process MongoDB host isolation is verified at
+`Cratis.Chronicle.XUnit.Integration` **19.51.0** (`ChronicleFixture.cs`,
+`ChronicleClientFixture.cs`, `MongoDBContextStorage.cs`); it is opt-in and does
+not isolate out-of-process/remote kernels. See [integration-specs.md](references/integration-specs.md).
+
 Generated-value scenario pinning is verified separately against
-`Cratis.Arc.Testing` **22.68.0** (introduced in **22.67.0**).
+`Cratis.Arc.Testing` **22.75.0** (introduced in **22.67.0**).
 
 Reverify against the owning product repository before claiming support for
 another version. Never translate an assertion or helper name from memory.
@@ -61,6 +73,7 @@ another version. Never translate an assertion or helper name from memory.
 | Pure `Handle()` / `Handle(providedValue)`, reducer logic or reactor decision (default) | Plain method call with `Specification` |
 | Isolated class, collaborators can be substituted | `Specification` + NSubstitute |
 | Arc command pipeline (validators, `Provide()`, `Handle()`, appended events) | `CommandScenario<TCommand>` |
+| Arc query conversion, validation, authorization and interceptors | `QueryScenario<TReadModel>` (`Cratis.Arc.Testing.Queries`) |
 | Chronicle append semantics, constraints, concurrency | `EventScenario` |
 | Projection or reducer state from a sequence of events | `ReadModelScenario<TReadModel>` |
 | Reactor invocation and its side effects | `ReactorScenario<TReactor>` |
@@ -76,11 +89,10 @@ one. Out-of-process integration specifications are an advanced case reserved for
 boundaries the scenario helpers cannot reach — see
 [integration-specs.md](references/integration-specs.md).
 
-> **Validator state can be order-sensitive.** The command-scenario pipeline can
-> cache enough state that injected-validator branches depend on execution order
-> when xUnit runs classes in parallel. Use `CommandScenario` for the valid path,
-> test rejected state variants by instantiating the validator directly, and only
-> for that case put the command's specifications in a small xUnit `[Collection]`.
+> **Historical validator-state order-sensitivity:** observed at 22.16-era Arc.
+> Process-wide provider replacement was fixed in 22.23.2; later releases isolated
+> scenario stores/services. Reproduce at 22.75.0 before applying the old
+> direct-validator/small `[Collection]` workaround; it is not verified here.
 
 ⚠️ `EventScenario` wires a strategy that always answers `ConcurrencyScope.None`,
 which the validator skips, so an append that lets the strategy choose the scope
@@ -96,7 +108,13 @@ build it, even if passive. Missing setup throws
 resolved read-model key. See the ReactorScenario reference for diagnostics,
 exception capture and UTC occurrence-time defaults.
 
-Specification projects are named `<Source>.Specs` and run on xUnit.
+Specification projects are named `<Source>.Specs`. Add a `PackageReference` to
+`Cratis.Specifications.XUnit` 4.1.1, not just `Cratis.Specifications`; the C#
+namespace stays `Cratis.Specifications`. The house runner is xUnit **2.x**
+(2.9.3 at this tag), not xUnit v3. Supported targets are net8.0/net9.0/net10.0;
+net48 was dropped in 4.0.0 (retain 3.x for that target).
+`Cratis.Specifications.NUnit` 4.0.0+ is an alternative with the same base pattern,
+`[Test]` instead of `[Fact]`, and **public** test methods.
 
 ### Pin server-generated Handle values
 
@@ -182,11 +200,17 @@ public class when_<behavior> : Specification
   leave no blank line between `should_` methods.
 - Fields are `private` in a concrete specification and `protected` in a `given/`
   context, named `_camelCase`.
-- Any phase may be `async Task`. `void Destroy()` is the optional teardown.
+- Any phase may be `async Task`. `void Destroy()` is optional teardown, after
+  each fact by default; once per eligible class with the shared lifecycle opt-in.
 
-`Cratis.Specifications` discovers `Establish`, `Because`, and `Destroy` by
+`Cratis.Specifications.XUnit` discovers `Establish`, `Because`, and `Destroy` by
 convention — there are no attributes on them.
 
+Keep the stock per-fact lifecycle by default. Read
+[shared-lifecycle.md](references/shared-lifecycle.md) when deliberately opting
+into one instance and one Establish/Because execution per specification class.
+Facts must not mutate that shared context.
+
 ## Step 4 — Extract a reusable context
 
 When several specifications share setup, layer it under `given/`:
@@ -272,6 +296,14 @@ between collaborators. That is where defects hide.
 
 ## Verify
 
+CRSPEC0001–CRSPEC0007 ship as **warnings** in `Cratis.Specifications`, `.XUnit`,
+and `.NUnit` 4.0.0+. A warnings-as-errors build enforces them: `should_` names,
+one specification per file (given contexts exempt), no facts on given contexts,
+test attributes on `should_` methods, no explicit base lifecycle calls, public
+specification classes, and no `Because` on given contexts. See
+`cratis-specification-by-example` for the diagnostic-by-diagnostic checklist.
+Do not suppress these warnings to pass the gate.
+
 - Every specification file states one `Establish`, one `Because`, and one or
   more `should_` facts.
 - `Because()` appears only in concrete specifications, never in a `given/`

package/package/corpus/skills/cratis-specifications-csharp/references/application-scenarios.md

@@ -15,12 +15,17 @@ validation, constraints or projections matter; a pure decision (`Handle()`,
 call. A library or framework repository reaches for a scenario only to test the
 very engine it provides.
 
-Verified against `Cratis.Arc.Testing` `22.16.0` and `Cratis.Chronicle.Testing`
-`18.3.0`.
+Arc scenarios verified at **v22.75.0** (Chronicle dependency 19.39.1).
+Separate Chronicle-only scenario claims retain their version-qualified sources.
+Read [query and decision scenarios](../../cratis-application-slice-specifications/references/query-and-decision-scenarios.md)
+when using `QueryScenario<T>`, buffered emissions or `UseDecisionReads()`.
+Guarded decisions need actual seeded events, not pinned models; their given
+state and appends share one in-process log, unlike legacy dictionary seeding.
 
 | Helper | Exercises | Use for |
 | --- | --- | --- |
 | `CommandScenario<TCommand>` | Authorization, validators, `Provide()`, `Handle()`, appended events | State Change behavior |
+| `QueryScenario<TReadModel>` | Argument conversion, authorization, validation, interceptors and buffered observations | Query pipeline behavior |
 | `EventScenario` | Chronicle append semantics without the command pipeline | Constraints, raw sequencing, concurrency |
 | `ReadModelScenario<TReadModel>` | Projection or reducer state from a sequence of events | State View behavior |
 | `ReactorScenario<TReactor>` | Reactor invocation and its side effects | Automation and Translation behavior |
@@ -85,10 +90,17 @@ from `Cratis.Arc.Chronicle.Testing`.
   pass against a read-model shape the projection never produces.
 - **Validator and `Provide()` dependencies** are registered in
   `_scenario.Services`; the concrete validator is discovered automatically.
+- **Caller setup (Arc 22.75.1+, re-verified at 22.76.0):** register a substituted
+  `ICurrentPrincipalAccessor`, `ICurrentPrincipalOverride` or
+  `IAuthorizationPolicyRuntime` in `Services` before first execution. The scenario
+  preserves these registrations instead of replacing them with Arc defaults,
+  so role/policy success and denial specs run as the caller you supplied.
+  Source: `Testing/ScenarioServices.cs` and `Testing/Commands/CommandScenario.cs`
+  under `Source/DotNET/`.
 
 ### Pin generated values
 
-Verified at **Arc v22.68.0**, available in `Cratis.Arc.Testing` **22.67.0+**.
+Verified at **Arc v22.75.0**, available in `Cratis.Arc.Testing` **22.67.0+**.
 For the `AllocateCartId` command from `cratis-arc-command`, whose
 `Handle([GeneratedValue("cart")] CartId cartId)` returns that id, specify the
 pipeline with a known concept pin. Import `Cratis.Arc.Commands` and
@@ -153,7 +165,7 @@ public class and_value_is_pinned : Specification
   A direct-call decision spec supplies the known argument to `Handle()` itself.
 
 Guide: [Pin generated values in command specs](/arc/backend/csharp/testing/generated-values/).
-Source: **Arc v22.68.0**, `Source/DotNET/Testing/Commands/CommandScenarioGeneratedValueExtensions.cs`,
+Source: **Arc v22.75.0**, `Source/DotNET/Testing/Commands/CommandScenarioGeneratedValueExtensions.cs`,
 `ScenarioGeneratedValueFixture.cs`, `ScenarioGeneratedValues.cs` and
 `GeneratedValuesCommandScenarioExtender.cs`;
 `Source/DotNET/Testing.Specs/Commands/for_CommandScenario/generated_values/when_pinning_a_value.cs`.

package/package/corpus/skills/cratis-specifications-csharp/references/csharp-patterns.md

@@ -11,8 +11,9 @@
 - One outcome per file
 
 Detail for the plain `Cratis.Specifications` surface: phases, substitution,
-assertions, and exception capture. Verified against `Cratis.Specifications`
-`4.1.1` and NSubstitute as consumed by that package.
+assertions, and exception capture. Verified against `Cratis.Specifications.XUnit`
+`4.1.1` (base and assertions) and its `Cratis.Specifications` dependency (`Catch`).
+NSubstitute is a separate collaborator-substitution dependency.
 
 ## Phases
 
@@ -21,7 +22,7 @@ assertions, and exception capture. Verified against `Cratis.Specifications`
 | `void Establish()` | Setup, before `Because()` | One per class in the chain, run base-first. Never call `base.Establish()` |
 | `void Because()` | The single action under test | Only in a concrete specification, never in a `given/` context |
 | `[Fact] void should_*()` | One assertion per fact | Expression-body form, no blank lines between facts |
-| `void Destroy()` | Teardown after each specification | Optional |
+| `void Destroy()` | Teardown after each fact by default | Optional; once per eligible class with [shared lifecycle](shared-lifecycle.md) |
 
 Every phase may be `async Task`.
 
@@ -91,7 +92,7 @@ _<collaborator>.<Method>(Arg.Any<<ArgumentType>>())
 
 ## Assertion extension methods
 
-From `Cratis.Specifications`:
+From the `Cratis.Specifications.XUnit` package, namespace `Cratis.Specifications`:
 
 | Method | Example |
 | --- | --- |
@@ -103,6 +104,16 @@ From `Cratis.Specifications`:
 | `.ShouldContainOnly(items)` | `_items.ShouldContainOnly(<expectedItems>)` |
 | `.ShouldBeOfExactType<T>()` | `_event.ShouldBeOfExactType<<EventType>>()` |
 | `.ShouldBeGreaterThan(n)` / `.ShouldBeLessThan(n)` | `_count.ShouldBeGreaterThan(0)` |
+| `.ShouldNotEqual(expected)` | Value inequality |
+| `.ShouldBeSame(expected)` / `.ShouldNotBeSame(expected)` | Reference identity |
+| `.ShouldMatch(Func<T, bool>)` | Value predicate |
+| `.ShouldBeInRange(low, high)` | Inclusive range |
+| `.ShouldBeGreaterThanOrEqual(n)` / `.ShouldBeLessThanOrEqual(n)` | Inclusive comparison |
+| `.ShouldContainSingleItem()` / `.ShouldEachConformTo(predicate)` | Collection cardinality / each-item predicate |
+| Collection `.ShouldEqual(IEnumerable<T>)` | Ordered sequence equality |
+| Collection `.ShouldContain(Predicate<T>)` | At least one matching item |
+| `.ShouldBeAssignableFrom<T>()` | Actual object is assignable to T |
+| String `.ShouldContain(substring, StringComparison)` | Explicit string comparison |
 
 Assert on values and types. Do not assert on presentation message strings by
 default; assert exact text only when that wording is the specified behavior,
@@ -121,7 +132,9 @@ async Task Because() => _error = await Catch.Exception(_<sut>.<Action>);
 ```
 
 Use `Catch.Exception` rather than a `try`/`catch` in `Because()`; the captured
-exception is the outcome the facts assert on.
+exception is the outcome the facts assert on. Overloads accept `Action` and
+`Func<Task>`; `Catch.Exception<T>(Action)` captures only T and lets other
+exception types propagate.
 
 ## Usings
 

package/package/corpus/skills/cratis-specifications-csharp/references/integration-specs.md

@@ -7,6 +7,7 @@
 - Command execution overloads
 - Assertion helpers
 - Asynchronous follow-ups
+- In-process MongoDB context isolation (19.51.0)
 - Rules
 
 Reserve these for the host, transport, serialization, or real-infrastructure
@@ -125,6 +126,26 @@ void Destroy() => _collector.Dispose();
 `IEventAppendCollection` is part of the Chronicle testing API. The timeout is a
 deadline, not a sleep — it turns a hang into a named failure.
 
+## In-process MongoDB context isolation (19.51.0)
+
+For an **in-process MongoDB** suite using `Cratis.Chronicle.XUnit.Integration`,
+override `ChronicleFixture.UsesPerContextMongoDBHost` to return `true`. It defaults
+to `false`: consumers otherwise retain shared-host behavior. Each context gets a
+fresh host and unique database prefix, so writes flushed by an earlier host after
+shutdown cannot alter the next context's events or projections.
+
+The default storage configuration applies the prefix. If your client fixture
+overrides `GetStorageConfigurator`, pass its `DatabaseNamePrefix` to `WithMongoDB`
+as `databaseNamePrefix`. Context teardown awaits host disposal without wiping its
+databases in place; collection teardown drops only prefixes it issued. Starting
+one host per context costs time. This does not isolate out-of-process or remote
+kernels, which retain kernel reset.
+
+Source-verified at Chronicle `v19.51.0:Source/Clients/XUnit.Integration/ChronicleFixture.cs`,
+`ChronicleClientFixture.cs`, `MongoDBContextStorage.cs`,
+`ChronicleOrleansInProcessWebApplicationFactory.cs`, and
+`Documentation/contributing/integration-tests.md` (per-context storage isolation).
+
 ## Rules
 
 - `context` is an inner `public class` inheriting `given.an_http_client(fixture)`.

package/package/corpus/skills/cratis-specifications-csharp/references/shared-lifecycle.md

@@ -0,0 +1,34 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Optional shared xUnit lifecycle
+
+Verified against `Cratis.Specifications.XUnit` 4.1.1,
+`SpecificationTestFramework.cs`, `SpecificationTestClassRunner.cs`, and
+`Specification.cs`. Introduced in 4.1.0. The house default remains stock xUnit
+per-fact execution.
+
+## Opt in
+
+Add this assembly attribute to the specification project:
+
+```csharp
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+[assembly: Xunit.TestFramework("Cratis.Specifications.SpecificationTestFramework", "Cratis.Specifications.XUnit")]
+```
+
+For eligible classes, construction, `Establish`, and `Because` happen once.
+All facts share the instance; `Destroy` runs once after the last fact, including
+when initialization failed. A throwing `Establish` or `Because` fails every fact
+in that class. Facts must only assert, never mutate shared context.
+
+A class is eligible only when it derives from `Specification`, has a single
+public parameterless constructor, does not implement `IDisposable`, and has only
+plain facts. Theories, custom fact test cases, fixture/output-helper constructors,
+and plain xUnit classes keep the stock per-fact lifecycle. This is not xUnit v3
+support; the package uses xUnit 2.x.
+
+`Specification.InitializeAsync()` is idempotent for a single instance. It does
+not make an ineligible class shared or cache instances across classes.

package/package/corpus/skills/cratis-specifications-csharp/verification.json

@@ -0,0 +1,13 @@
+{
+  "skill": "cratis-specifications-csharp",
+  "input": "Set up a C# specification project and choose its lifecycle.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "Cratis.Specifications.XUnit" },
+    { "kind": "skill-contains", "value": "xUnit **2.x**" },
+    { "kind": "skill-contains", "value": "stock per-fact lifecycle by default" },
+    { "kind": "skill-contains", "value": "shared-lifecycle.md" },
+    { "kind": "skill-contains", "value": "CRSPEC0001–CRSPEC0007" },
+    { "kind": "skill-contains", "value": "Do not suppress these warnings" }
+  ]
+}

package/package/corpus/skills/cratis-specifications-typescript/SKILL.md

@@ -14,7 +14,9 @@ base: setup is separated from the action, and each `it()` verifies one outcome.
 
 ## Verified product sources
 
-This skill is verified against the frameworks these specifications run on:
+Helper and setup patterns are verified against Fundamentals **v7.23.0**
+(`for_JsonSerializer/given/given.ts`, `vitest.setup.ts`) and Arc **v22.75.0**
+(`Source/JavaScript/Arc/given.ts`). The execution stack is:
 
 | Framework | Role |
 | --- | --- |
@@ -23,10 +25,17 @@ This skill is verified against the frameworks these specifications run on:
 | Chai | Assertions, always through the `.should` fluent interface |
 | Sinon | Stubbing and call verification |
 
-The `given()` helper is supplied by the Cratis TypeScript package under
-specification and is imported from that package root. Reverify the helper's
-location and signature against the owning repository before relying on a
-different import path.
+`given()` is a small **local file** inside the package under specification, not
+a published package export. Import it with a relative path to that file; create
+it if absent. Fundamentals constructs a parameterless context; Arc passes the
+Mocha `Suite` to the context constructor and binds the callback's `this` to it.
+Match the owning package's helper signature rather than assuming one import path.
+
+Configure Vitest to load a setup file that calls `chai.should()` and registers
+`sinon-chai` and `chai-as-promised`; otherwise `.should` is undefined or plugin
+assertions are unavailable. Load the reflection polyfill when specifying
+metadata-dependent code (Fundamentals' setup imports its local `reflection`
+entry). The Specifications repository publishes no TypeScript helper.
 
 ## Route near misses