@cratis/pi 7.34.1 → 7.36.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,7 +2,7 @@
 
 ## Contents
 
-- Caller and compliance boundary (4.127.0)
+- Caller and compliance boundary (4.142.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later; the cratis 3.53.1 bundle binds them too
@@ -16,12 +16,12 @@ Current pins: `versions.md`. Detailed
 4.66.0/4.68.0 binder probes below retain their historical labels. Current source
 admits routes as ESM v8, public/direction constructs as v9, identity/overrides/filters
 as v10, qualifying non-route Double literals as v11 (exact lowering of Double-mode literals)
-and non-positional enum numbers as v12. Operations, the `numbers exact` **source mode** (PLAY0268) and
+and non-positional enum numbers as v12; concept compliance as v13. Operations, the `numbers exact` **source mode** (PLAY0268) and
 reaction refusals/redelivery remain unadmitted. Use the actual
 binder before promoting an older probe to a current capability claim.
 
 What the binder admits, and what it refuses with which code. The answer depends on the
-compiler version: the standalone tool (4.139.0) binds through v12; the compiler bundled in cratis
+compiler version: the standalone tool (4.142.0) binds through v13; the compiler bundled in cratis
 3.53.1 (4.137.0) binds ESM through v10 for rendering and refuses non-positional enum numbers at
 binding; older bundles (4.66.0 in cratis 3.28.x, admitting v1 to v6; 4.60.1 before 3.28.2, v1 to v5)
 are history.
@@ -40,7 +40,7 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later, and the cratis 3.53.1 bundle).
 
-## Caller and compliance boundary (4.127.0)
+## Caller and compliance boundary (4.142.0)
 
 `$identity.id`/`.name`/`.userName` are aliases of the admitted
 `$context.identity` produces-mapping values. Authentication status, roles and
@@ -49,10 +49,14 @@ A top-level `identity` block alone is authoring metadata and does not block
 readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
 `$context.identity` remains built-ins only. Purposes and event `subject` marks
 are metadata (PLAY0270), not source resolution, retention or subject propagation.
-Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers still block
-binding. Legacy spellings compile with PLAY0565 information; duplicates warn
-PLAY0653. Never remove protection; see command-surface `references/compliance.md`.
-Authority: v4.127.0 `context.md`, `identity.md`, `concepts.md`, `events.md`, `purposes.md`.
+Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers bind as v13
+on standalone 4.142.0; CLI 3.53.1 bundles Screenplay 4.137.0, which refuses markers. Enum/identity
+compliance and events mixing protected values with explicit subject marks remain
+refused; see command-surface `references/compliance.md` for the precise boundary.
+Legacy spellings compile with PLAY0565 information; duplicates warn PLAY0653.
+Never remove protection. Reference execution proves neither encryption nor erasure.
+Authority: v4.142.0 `SemanticModelBinder.Compliance.cs`, `concepts.md`, `events.md`;
+caller and purpose guidance retains v4.127.0 `context.md`, `identity.md`, `purposes.md`.
 
 ## Admitted on both compilers
 
@@ -166,6 +170,14 @@ pins preserve the earlier executable version/bytes. The optional canonical last
 Consumers must admit v12 explicitly; CLI 3.53.1/Stage 4.73.1 do not. Syntax:
 command-surface `references/enum-numbers.md`; version contract: `versions.md`.
 
+Concept `pii`/`personal` and `secret`, qualifiers and scopes bind as optional
+`compliance` in ESM v13 from 4.141.0 (rechecked at 4.142.0). Reasons remain
+report-only PLAY0270; reference execution proves neither encryption nor erasure.
+Enum/identity concepts and an event combining personal or explicitly subject-scoped
+secret values with an explicit `subject` mark refuse PLAY0268 at binding only.
+CLI 3.53.1 bundles Screenplay 4.137.0, which refuses markers; standalone Stage
+4.76.0 admits only through v12 (Stage#345). Preserve protection, not a falsely green bind.
+
 ## Code attachments (what binds, what never does)
 
 Inline fences (`csharp`, `typescript`, `react`, `html`, `sql`) and `file <path>` attach
@@ -209,7 +221,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `pii` or `secret` on any concept (also alias/legacy markers) | PLAY0268 | Compliance requires portable data-subject semantics; scopes/qualifiers do not admit it. Secret provider mapping is `[Encrypted]` + `[NotAudited]`, not a bind/render claim |
+| `pii` or `secret` on a concept | PLAY0268 | Blanket refusal on CLI 3.53.1's 4.137.0 bundle only. Standalone 4.142.0 admits v13 except enum/identity compliance and events mixing personal or explicitly subject-scoped secret values with explicit subject marks; see `compliance.md` in command-surface references |
 | `query` with a composite `by` block, or `by ... from` context-derived arguments | PLAY0268 | composite `by` blocks remain unadmitted (#599). An optional scalar snapshot lookup, an unfiltered list (`RM[]`) and a list narrowed by one caller-supplied `by` key bind, in their `observable` form too (since 4.105.0) |
 | `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` is not the blocker: it goes in the return position (`=> observable RM[]`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -251,8 +263,9 @@ bodies still leave their owner non-executable.
 
 Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
-slice in the gap list. A `pii` or `secret` marker blocks V3 and rendering, and
-either attribute on an identifier or typed destination is a source error
+slice in the gap list. A `pii` or `secret` marker selects v13 on standalone
+4.142.0 (since 4.141.0). CLI 3.53.1 bundles Screenplay 4.137.0, which refuses
+markers; standalone Stage 4.76.0 admits only through v12 (Stage#345). Either attribute on an identifier or typed destination is a source error
 PLAY0515 on the current compiler (including stream-id parts and route mapping
 sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers
 (CHR0034/CHR0052). Keep surrogate identity and protected payload separate.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -50,14 +50,16 @@ version; each construct it does not render refuses with its own code before any
 | Authorization | role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false; Stage 4.73.1 `IsSupportedClaimPath`), `not`/and/or; roles read through the identity's `RoleClaimType` | role-claim URIs, nested opaque policies, unresolved or non-portable policies, no single identifier, opaque-policy subjects that are not text, Uuid, Date or DateTime (`STAGE-ESM-015`; Stage 4.73.1 `IsTextualSubject`, a restriction separate from declarative claim targets) |
 | Event sources, streams, routes (ESM v8) | rendered, with routed specifications | reserved stored names, unformattable routed fixtures, unsupported routed replay (`STAGE-ESM-030`) |
 | Numbers, case tables | whole numbers as `long` from ESM v8; case tables | out-of-`int` literals below v8 (`STAGE-ESM-031`) |
-| Generated values and responses (v7) | not rendered | `STAGE-ESM-028`/`-029` (Stage#175) |
+| Generated values and responses (v7) | not rendered by Stage 4.73.1 (cli 3.53.1); rendered from standalone Stage 4.74.0 (UUID concepts, scalar and named responses) | `STAGE-ESM-028`/`-029` at 4.73.1 (Stage#175); `STAGE-ESM-038` for combinations the target cannot preserve |
 | Specifications | as in Stage's `admission.md` | `then no readmodel` (`-027`); an unauthenticated caller carrying roles or claims, `$context.occurred`-derived fixed values asserted (`-011`) |
 | v9 and v10 | reducer observer `from` filters | public events and event-target projections (`-032`); foreign origins and event-source captures (`-033`); directed Translate (`-024`); reaction `runsAs` (`-034`); reaction `from` filters (`-035`); per-production route overrides (`-036`) |
 | Evolved events | initial revisions only | `STAGE-ESM-026` (Stage#204) |
 | Descriptions, documentation | XML `<summary>`/`<remarks>` doc comments only (Stage#178 closed) | characters invalid in XML: `CLI-RENDER-005`; never behavior |
 
-Still bind-refused (not Stage): `reads` and `concurrency` (`PLAY0271`), command `handler`s, `pii`/`secret`
-(`PLAY0268`). Other rows of the table below that name 4.24 behavior are history.
+CLI 3.53.1 bundles Screenplay 4.137.0. That compiler refuses `reads` and
+`concurrency` (PLAY0271), command `handler`s and concept `pii`/`secret` markers
+(PLAY0268) at binding, before Stage admission. Rows below naming Stage 4.24
+behavior are historical.
 
 ## Historical: what Stage 4.24 admitted
 
@@ -88,7 +90,11 @@ whole automation is hand-written (gap-fill).
 | Compliance | none | any `@pii` or `@sensitive` already fails binding (PLAY0268). The C# provider mapping (Stage v4.29.0, Stage#197) is `@pii` to `[PII]`, `@sensitive` to `[Encrypted]` + `[NotAudited]`, both to `[PII]` only |
 
 At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
-accepted with PLAY0565 information); either still refuses binding. Identity blocks,
+accepted with PLAY0565 information); either still refuses binding on that compiler.
+Standalone 4.142.0 admits concept compliance as v13 (from 4.141.0) with narrower refusals
+(command-surface `references/compliance.md`). CLI 3.53.1 bundles Screenplay
+4.137.0, which refuses markers; standalone Stage 4.76.0 admits only through v12
+(Stage#345). Identity blocks,
 purposes and event `subject` are authoring metadata, not provider realization;
 executing identity detail reads still refuses PLAY0268. Current source/stream
 routes are admitted as v8, including composite ids, not the historical binding