@cratis/pi 7.64.0 → 7.66.0

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -21,7 +21,8 @@ Requires cratis CLI ≥ 3.57 (`cratis --version`) to render ESM v14 and v15 mode
 
 Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
 for v22–v25: text rules render, atomic batches/protected reads/described bodies do
-not. Stub mode emits no described-body stubs. Keep protection and report refusal.
+not. The semantic Host and specification runner execute admitted protected reads;
+that is not rendering. Stub mode emits no described-body stubs. Keep protection and report refusal.
 
 ## When to use
 
@@ -128,7 +129,7 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   (`-032`/`-033`), claim-reading/opaque `runs as` gates (`-034`), legacy filters (`-035`), production
   overrides (`-036`), code validation (`-005`), DateTime filters (`-010`),
   unsupported conditional productions, composite projection keys and unsupported `all` shapes.
-  Protected reads refuse `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
+  The Cratis C# renderer refuses protected reads with `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
   (even Stub mode), and atomic mode in admitted pairs `STAGE-ESM-043`.
 - **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`, attached
   handlers, context/single-result filters, opaque scope/performer, composite `by`,
@@ -159,7 +160,8 @@ files, a policy registration and generated policies, `Common/<Concept>.cs`, one
 the `[EventType]` event, the validator and the `[ReadModel]` with its query, `scene.json`,
 and a React/Vite frontend scaffold (`.frontend/`, `package.json`, `tsconfig.json`,
 `.gitignore`). Per-file detail, the scaffold's dependency set and the `Customizations/`
-contract: [references/rendered-application.md](references/rendered-application.md). Scene
+contract, including the opt-in self-reducing layout for confirmed new Cratis C# applications:
+[references/rendered-application.md](references/rendered-application.md). Scene
 package ids, host capabilities and the boundary from hand-built Components pages:
 [references/scene-runtime.md](references/scene-runtime.md). A complete renderable model:
 [references/render-example.md](references/render-example.md).
@@ -190,7 +192,13 @@ disposable runtime**, not a generated application. The default engine appends mo
 simple literal `validate` rules on top-level properties, but enforces no other rule, no
 constraint and no command or query authorization; `Stage__Runtime__Engine=semantic` opts
 in to an engine that does, and refuses what it cannot execute (HTTP 501). The default engine
-also refuses routed models (`STAGE-ESM-030`). Callers are built from unsigned headers, so
+also refuses routed models (`STAGE-ESM-030`) and protected reads (`STAGE-ESM-044`).
+Requires Stage 4.129.0 for semantic Host/runner protected reads; older engines refuse
+`STAGE-ESM-044`. Required absence rejects before requirements/generation, read properties
+feed requirements and productions, and non-Error protected requirements refuse
+`STAGE-ESM-045`, including reaction invocations. The Host faults on any outside append,
+even unrelated facts; this is stricter than reference dependency-scoped conflicts.
+Callers are built from unsigned headers, so
 authorization there is not a security boundary.
 
 `cratis/stage-specrunner` checks modeled specifications and writes a results file. The

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -29,10 +29,11 @@ Requires Stage 4.119.0 for pattern/random rendering, Host generation and indepen
 opaque/unsupported rules refuse -005 before pin evaluation. Independent execution
 always needs pins.
 Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
-Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. Protected reads still refuse STAGE-ESM-044.
+Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. The Cratis C# renderer still refuses protected reads with STAGE-ESM-044.
+Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse STAGE-ESM-044. Required absence rejects before requirements or generation; read-backed requirements and produced-event mappings execute. Non-Error protected requirements refuse STAGE-ESM-045, including reaction invocations. See [sandbox boundaries](sandbox-and-specrunner.md#protected-command-reads) for ordering and the Host's stricter outside-append fault boundary.
 Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
 admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
-batch or protected decision. Chronological Date/DateTime command comparisons
+batch or rendered protected decision. Chronological Date/DateTime command comparisons
 select v26 in Screenplay but still refuse STAGE-ESM-016 here; standalone reference
 success is not rendering or Host/executor admission. Keep the date rule and use
 authorized gap-fill rather than downgrading to ordinal text or millisecond precision.
@@ -162,7 +163,8 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-041` | Older renderers refuse non-text secrets; supported renderers keep their original types | Keep classification; upgrade the renderer, never declassify |
 | `STAGE-ESM-042` | Unknown validation rule kinds; checksum on the legacy syntax path (semantic checksum renders) | Keep the rule; use an admitting semantic renderer or gap-fill |
 | `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
-| `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in renderer, Host or specification executor | Keep protection; gap-fill with independently verified target enforcement |
+| `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in the Cratis C# renderer; legacy Host/structural runner also refuse the preamble | Keep protection; semantic Host/executor support is separate from generated-app enforcement |
+| `STAGE-ESM-045` | Non-Error requirement on a protected command, including reaction-invoked commands; semantic admission refuses before reads, requirements or facts | Keep the severity contract; record the execution gap, never silently promote or drop the requirement |
 | `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |
 | `STAGE-ESM-037` | Events and commands from one handler, even across separate triggers on the same event in one reaction. The scaffold's Arc supports mixed results, but appends events before commands; a refused command causes redelivery and duplicate events | **Do not split the modeled reaction or drop an effect.** Gap-fill only with a proven retry-safe implementation; `[OnceOnly]` excludes replay, not retry |
 | `STAGE-ESM-023` | Information: transition bodies analysed | none |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/rendered-application.md

@@ -3,6 +3,7 @@
 ## Contents
 
 - Scaffold
+- Reducer layout for new applications
 - What is managed
 - `Customizations/` (unmanaged)
 - Re-render checklist
@@ -35,13 +36,52 @@ Consequences: `[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) and
 in the scaffold's package set, as is `[ExecuteCommandsAsSystem]`. This is API
 availability, not Stage emission or runtime protection: gap-fill must opt into
 the protected command profile and enroll an admitted projection/key read in the
-active unit of work. Stage does not turn `.play` `reads`/`require` into protected decisions.
+active unit of work. The Cratis C# renderer does not turn `.play` `reads`/`require` into protected decisions;
+semantic Host/executor support is separate from generated-application protection.
 Hand-written scope that needs a newer dependency can raise its version through
 `Customizations/Dependencies.props` (explicit `Version`, imported last; central management
 is off), but any override must be proven with a restore and build. The compose file binds local ports `27017` and
 `35000`, keeps data in the named volumes `chronicle-data` and `chronicle-config`, and
 `docker compose down --volumes` is the only thing that deletes them.
 
+## Reducer layout for new applications
+
+Requires Stage 4.128.0 for the Cratis C# self-reducing profile; older renderers emit
+separate `IReducerFor<T>` classes. Existing `CreateProfile` callers remain classic;
+a missing destination/configuration file does not identify a new application.
+For a **confirmed new application**, artifact-planning hosts opt in explicitly:
+
+```csharp excerpt
+var profile = CratisRendering.CreateNewApplicationProfile(
+    "Shop", new("Shop.Backend", "Acme.Shop"));
+```
+
+This API is in `Cratis.Stage.Rendering.Cratis`. Pass the profile to scaffold and
+artifact planning through `CratisPlanOptions.Profile`. The scaffold persists
+`.cratis/stage/rendering.json` with exactly
+`{"version":1,"application":"Shop","reducerConvention":"self"}`. On later renders,
+the host reads that file and restores the input; Stage does not search the destination:
+
+```csharp excerpt
+var input = ReducerConventionInput.Read("Shop", configurationJson);
+var profile = CratisRendering.WithReducerConvention(
+    CratisRendering.CreateProfile("Shop", new("Shop.Backend", "Acme.Shop")), input);
+```
+
+`configurationJson` is the host-supplied file content. Invalid version, application,
+fields or convention are refused, not defaulted. Self mode emits public static
+`Reduce` overloads and non-public typed-context helpers on the read-model record,
+with unchanged queries and no companion `IReducerFor<T>`. StateView and Automation
+slices use the layout; observer filters become model attributes. Existing purity,
+identity, tenant, deletion and occurrence semantics remain. Model/property/query
+name `Reduce`, replay-hook query names, or generated `Transition_<suffix>` collisions
+refuse `STAGE-ESM-019`; Stage never silently changes layout.
+
+No per-model override or existing-application migration is supported. Do not flip
+an existing classic application to `self`: observer identity and old reducer removal
+need migration-aware publication. This opt-in does not automatically change CLI,
+Studio or semantic-engine execution.
+
 ## What is managed
 
 Every path in `.cratis-render.json` is managed: the scaffold files (project, solution,

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -3,6 +3,7 @@
 ## Contents
 
 - The sandbox: a partial, disposable runtime
+- Protected command reads
 - Refusals shared by both engines
 - The specification runner
 - Choosing between them
@@ -101,6 +102,32 @@ A refusal or an acceptance from the default engine therefore proves nothing beyo
 lists above. Use the semantic engine, or Debug tests of a render, for
 evidence about the rest.
 
+## Protected command reads
+
+Requires Stage 4.129.0 for semantic Host and specification-executor protected reads;
+older engines refuse them with `STAGE-ESM-044`. The default EventModel Host and
+structural runner still refuse the preamble with `STAGE-ESM-044`; the structural
+runner exits `1` without a report. The Cratis C# renderer also retains `-044`:
+executing a model here does not make it renderable.
+
+After authorization and property/concept rules, each declared read must exist at
+its key. Missing state rejects with `<View> '<key>' does not exist.` before any
+requirement or generation, even a command-only requirement. `/validate` reports
+absence too. Present read properties feed `require` and produced-event mappings.
+The executor projects prior facts through Chronicle's in-memory read-model scenario,
+preserving event-source-keyed removal and recreation. Join removals, parent keys,
+children and nested scopes remain refused.
+
+A protected command with any non-Error requirement refuses `STAGE-ESM-045` before
+execution. This includes reaction-invoked commands, even a specification expecting
+rejection: the outcome is `Unsupported`, before seeding facts, not a passing refusal.
+Do not change modeled severity to get an executable result.
+
+The semantic Host faults the session on **any outside append** to its event log,
+even an unrelated one, before committing an accepted command. This interim guard
+is stricter than the reference's dependency-scoped decide/commit conflicts; do not
+claim full reference conflict parity or generated-application protection.
+
 ## Refusals shared by both engines
 
 Both engines refuse public events (`STAGE-ESM-032`), foreign or source-event captures
@@ -141,7 +168,7 @@ invalid semantic option.
 - **Semantic**: creates a fresh in-memory Chronicle log per specification and dispatches
   admitted commands through Arc's in-memory pipeline; supports explicit-source and routed
   given events, unconditional production, event assertions, caller and authorization,
-  command rules, unique constraints, flat and event-source-keyed scoped projections, and
+  command rules, protected command reads (including reaction invocations), unique constraints, flat and event-source-keyed scoped projections, and
   optional snapshot queries, including protected ones: portable authorization is evaluated
   with the fixture caller, query arguments and key, and an expected denial matches only
   `then denied`. Report schema `stage-spec-run/1` with outcomes
@@ -150,6 +177,10 @@ invalid semantic option.
   allocation, external effects, composite values, queries other than optional snapshots, and
   a reached opaque authorization policy (reported as `Unsupported`). Unsupported is never a pass. Do not feed the file to a legacy reader.
 
+The runner and generated-fixture checks use Screenplay's public
+`SemanticValidationRules.Check`. This shared rule check does not execute opaque
+generation or validation bodies.
+
 How the runner relates to the verdicts: a structural pass is not a behavioral result. The
 semantic engine is Stage's own executor running through Arc's in-memory pipeline. It is
 not the Screenplay reference route, so a semantic pass is never V4 (V4 is reference

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/scene-runtime.md

@@ -62,6 +62,16 @@ The scaffold's Scene runtime provides:
   imports and network assets; an explicit importer map is not arbitrary module
   loading. Diagnostics block mismatched or unavailable bundles.
 
+Requires Stage 4.130.0 for Stage shell selection from `ui profile` root template,
+options and appearance; older hosts do not apply that complete shell contract.
+The Host and render plan use Scene's shell resolution: root, legacy layout,
+default blueprint layout, then bare shell. Unknown/unavailable/version-mismatched
+roots and roots lacking a `content` outlet produce planning findings or an explicit
+Host startup message, never silent fallback. Shell options such as `navigationMode`,
+`menuTheme` and `showFooter` are applied or reported unsupported. Light/dark/system
+color scheme and accent reach the shell; runtime Scene carries root, appearance
+and defaults but no sample data. Browser evidence is still needed for UI parity.
+
 Keep authoring acceptance, executable admission and runtime behavior separate.
 Require Stage's plan/diagnostics for emission and a browser run for UI parity;
 source verification alone proves neither. For authoring details read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.64.0",
+  "version": "7.66.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [