@cratis/pi 7.90.0 → 7.91.0

package/package/corpus/harnesses/copilot/instructions/pull-requests.instructions.md

@@ -7,7 +7,7 @@ applyTo: "**/*"
 
 ## The description is the release note
 
-**The PR description is published verbatim as the GitHub release. In repositories released by `cratis/release-action`, it also closes every issue written as `(#n)`; elsewhere, follow the repository's own release and issue-closing process.** Write the note the person upgrading should read, not a development write-up. The same contract applies to release notes typed into a manual workflow run or written straight into a release. Where it is installed, the `verify-release-notes` check enforces it on release-bound PRs into the default branch carrying `major`/`minor`/`patch` (it re-runs when the label is added); it warns on `no-release` and unlabelled PRs, which must still be written this way because any of them may become releasable. `release-action` does not run for a `no-release` PR, so `(#n)` closes nothing there. Editing the description re-runs the check. HTML comments are not shown on the release page and the check ignores them for headings, keywords and placeholders, and `release-action` removes them before publishing, so a `(#n)` only inside a comment closes nothing; the check fails it, so never put an issue reference in a comment. The template's own comment can stay: its `(#123)` examples are inline code, and the comment is not published.
+**The PR description is published verbatim as the GitHub release. In repositories released by `cratis/release-action`, it also closes every issue written as `(#n)`; elsewhere, follow the repository's own release and issue-closing process.** Write the note the person upgrading should read, not a development write-up. The same contract applies to release notes typed into a manual workflow run or written straight into a release. Where it is installed, the `policy / verify` check enforces it on release-bound PRs into the default branch carrying `major`/`minor`/`patch` (it re-runs when the label is added); its release-note step warns on `no-release` and unlabelled PRs, which must still be written this way because any of them may become releasable. `release-action` does not run for a `no-release` PR, so `(#n)` closes nothing there. Editing the description re-runs the check. HTML comments are not shown on the release page and the check ignores them for headings, keywords and placeholders, and `release-action` removes them before publishing, so a `(#n)` only inside a comment closes nothing; the check fails it, so never put an issue reference in a comment. The template's own comment can stay: its `(#123)` examples are inline code, and the comment is not published.
 
 ### Allowed shape
 
@@ -82,12 +82,12 @@ Arc can now construct Chronicle reactors and reducers through its own dependency
 
 ### Before you create or edit a PR
 
-1. Run `node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file <file> --label <intent>`. It runs the exact `verify-release-notes` rules plus the label and diff checks, and the Bash hook runs it on `gh pr create` and `gh pr edit`.
+1. Run `node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file <file> --label <intent>`. It runs the exact `policy / verify` release-note rules plus the label and diff checks, and the Bash hook runs it on `gh pr create` and `gh pr edit`.
 2. Read the body against the forbidden list and the issue table above; delete every hit and verify every issue number.
 3. Sections in order, none empty, at most one summary form; every bullet user-facing.
 4. Test plan, verification and review notes are in a PR comment.
 
-If `verify-release-notes` fails, fix it by editing the description, not by pushing code.
+If the release-note rules fail, fix the description, not the code.
 
 ## Commits
 

package/package/corpus/product-sync.json

@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.216.0",
-        "date": "2026-10-18",
-        "by": "Cratis/AI#784"
+        "version": "4.231.0",
+        "date": "2026-10-19",
+        "by": "Cratis/AI#808"
       },
       "covers": {
         "skills": [

package/package/corpus/prompts/ship-changes.prompt.md

@@ -51,7 +51,7 @@ The description is published verbatim as the release notes, so it follows the co
 - Post reviewer notes (checks run, what was not verified, review provenance, stacking, merge or
   deploy order) right after creating the PR with `gh pr comment <n> --body-file .ai-work/pr-notes.md`.
   Never put them in the description, even for `no-release`.
-- After pushing, if `verify-release-notes` fails, fix it by editing the description; it re-runs on edit.
+- After pushing, if `policy / verify` fails on the release notes, fix it by editing the description; it re-runs on edit.
 
 ## Cleanup — the last step, never skipped
 

package/package/corpus/rules/pull-requests.md

@@ -6,7 +6,7 @@ applyTo: "**/*"
 
 ## The description is the release note
 
-**The PR description is published verbatim as the GitHub release. In repositories released by `cratis/release-action`, it also closes every issue written as `(#n)`; elsewhere, follow the repository's own release and issue-closing process.** Write the note the person upgrading should read, not a development write-up. The same contract applies to release notes typed into a manual workflow run or written straight into a release. Where it is installed, the `verify-release-notes` check enforces it on release-bound PRs into the default branch carrying `major`/`minor`/`patch` (it re-runs when the label is added); it warns on `no-release` and unlabelled PRs, which must still be written this way because any of them may become releasable. `release-action` does not run for a `no-release` PR, so `(#n)` closes nothing there. Editing the description re-runs the check. HTML comments are not shown on the release page and the check ignores them for headings, keywords and placeholders, and `release-action` removes them before publishing, so a `(#n)` only inside a comment closes nothing; the check fails it, so never put an issue reference in a comment. The template's own comment can stay: its `(#123)` examples are inline code, and the comment is not published.
+**The PR description is published verbatim as the GitHub release. In repositories released by `cratis/release-action`, it also closes every issue written as `(#n)`; elsewhere, follow the repository's own release and issue-closing process.** Write the note the person upgrading should read, not a development write-up. The same contract applies to release notes typed into a manual workflow run or written straight into a release. Where it is installed, the `policy / verify` check enforces it on release-bound PRs into the default branch carrying `major`/`minor`/`patch` (it re-runs when the label is added); its release-note step warns on `no-release` and unlabelled PRs, which must still be written this way because any of them may become releasable. `release-action` does not run for a `no-release` PR, so `(#n)` closes nothing there. Editing the description re-runs the check. HTML comments are not shown on the release page and the check ignores them for headings, keywords and placeholders, and `release-action` removes them before publishing, so a `(#n)` only inside a comment closes nothing; the check fails it, so never put an issue reference in a comment. The template's own comment can stay: its `(#123)` examples are inline code, and the comment is not published.
 
 ### Allowed shape
 
@@ -81,12 +81,12 @@ Arc can now construct Chronicle reactors and reducers through its own dependency
 
 ### Before you create or edit a PR
 
-1. Run `node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file <file> --label <intent>`. It runs the exact `verify-release-notes` rules plus the label and diff checks, and the Bash hook runs it on `gh pr create` and `gh pr edit`.
+1. Run `node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file <file> --label <intent>`. It runs the exact `policy / verify` release-note rules plus the label and diff checks, and the Bash hook runs it on `gh pr create` and `gh pr edit`.
 2. Read the body against the forbidden list and the issue table above; delete every hit and verify every issue number.
 3. Sections in order, none empty, at most one summary form; every bullet user-facing.
 4. Test plan, verification and review notes are in a PR comment.
 
-If `verify-release-notes` fails, fix it by editing the description, not by pushing code.
+If the release-note rules fail, fix the description, not the code.
 
 ## Commits
 

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -272,7 +272,7 @@ Chronicle's constraints enforce **uniqueness only**; use one when two concurrent
 ## `policy` and `persona`
 
 A policy has **exactly one** `require` line (`PLAY0441`) **or** one implementation, never both (`PLAY0440`). Read [references/policy-persona-seed.md](references/policy-persona-seed.md) when
-declaring a policy, a persona, or a `seed` block.
+declaring a policy (including `require anonymous` for a deliberately public command or query), a persona, or a `seed` block.
 
 ## Event data subject
 

package/package/corpus/skills/cratis-screenplay-command-surface/references/policy-persona-seed.md

@@ -1,5 +1,12 @@
 # Policies, personas and seed
 
+## Contents
+
+- `policy` and `persona`
+- Anonymous policy
+- Policy negation
+- `seed`
+
 ## `policy` and `persona`
 
 ```screenplay
@@ -20,7 +27,7 @@ persona Accountant
   policy IsAccountant
 ```
 
-Condition atoms: `authenticated`, `role "<name>"`, and
+Condition atoms: `authenticated`, `anonymous`, `role "<name>"`, and
 `claim "<name>" matches subject | "<value>" | <path>`. A policy has **exactly one**
 `require` line — continue the condition on deeper-indented lines instead of adding
 a second (`PLAY0441`) — **or** one implementation (a tagged ` ```csharp ` block or
@@ -29,6 +36,51 @@ runner; a code policy binds as opaque ESM v3 and needs a target to evaluate it.
 A `persona` is authoring metadata: the binder reports it as information `PLAY0270`
 (report-only) and it does not block binding; an unknown policy it lists is an error.
 
+## Anonymous policy
+
+Requires Screenplay 4.231.0 (ESM v31; `screenplay --version`); older compilers reject
+`require anonymous`. A policy with `require anonymous` exposes a public command or
+query, such as sign-up. The condition always holds, for callers with and without an
+identity alike. Only a model that declares one selects v31.
+
+```screenplay
+concept SubscriberId : Uuid
+concept EmailAddress : String
+policy PublicAccess
+  require anonymous
+module Newsletter
+  feature Signup
+    slice StateChange SubscribeToNewsletter
+      command SubscribeToNewsletter
+        subscriberId SubscriberId identifier
+        email EmailAddress
+        authorize PublicAccess
+        produces event SubscriberSignedUp
+          email EmailAddress = email
+      specification SubscribingWithoutAnIdentity
+        when SubscribeToNewsletter
+          subscriberId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          email = "ada@example.com"
+        then SubscriberSignedUp
+          email = "ada@example.com"
+```
+
+`anonymous` must be the command's or query's whole effective authorization:
+
+| Code | Refused |
+| --- | --- |
+| PLAY0804 | combined with another condition in `require` |
+| PLAY0805 | negated; write `authenticated` instead |
+| PLAY0806 | combined with another policy in `authorize` |
+| PLAY0807 | under or above another module, feature, command or query gate |
+
+A specification of such a command or query may omit `given caller`; every other
+authorized specification still needs one (`PLAY0389`).
+
+**Security:** `anonymous` declares a public surface on purpose. Never use it to make a
+model compile or to silence a missing-`authorize` or caller finding; model the real
+policy instead, because a generated application renders it as an open endpoint.
+
 ## Policy negation
 
 `not <condition>` is a portable ESM v7 policy-condition

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -133,7 +133,7 @@ chain per slice before handoff (`references/evidence-table-template.md`, "Tracea
    `cratis-screenplay-slice-design` for slices, `cratis-screenplay-streams-and-consistency` for
    identity and invariants). To move an already authored slice or feature to its right parent, use
    the MCP `propose-move` tool (identity-preserving; it refuses identity loss, collisions and
-   captures) rather than retyping the declarations (`cratis-screenplay-model-authoring`):
+   name capture (a reference that would resolve to a different declaration); it also moves a single declaration between slices from Screenplay 4.230.0) rather than retyping the declarations (`cratis-screenplay-model-authoring`):
    - one StateChange per decision a person or system makes; events are facts experts recognise;
      consequences (counters, denormalised copies) become projections; an automation only when
      evidence shows a separate decision; no generic names (`Update/Edit/Save<Noun>`, `<Noun>Updated`): split by intent;

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -218,7 +218,7 @@ connection. Passing `open-workspace.path` does **not** avoid it, because the err
 | Edit class | Examples | Route |
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
-| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
+| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents, and single declarations between slices: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
 | Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, generated secrets PLAY0268, generated-rule proofs PLAY0688/0689, finite-support failures PLAY0691/0692. Pattern/random/rule and checksum validation bind as ESM v21 (Requires Screenplay 4.172.0, `screenplay --version`; older compilers refuse PLAY0268). Read `mcp-tools.md#concept-generation` for `arguments`, exact support and `rules[]`, not parsed diagnostic prose. |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653`, `0683`, `0684` (and recipe-only `0397`); `PLAY0470` only with author intent ([destination intent repair](destination-intent-repair.md)) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -25,7 +25,7 @@
 - Formatting and recovery limits
 - Code attachments
 
-The standalone MCP server lists 44 tools (including the MCP-Apps visualization tool); `tools/list` is the authority for the installed server.
+The standalone MCP server lists 46 tools from Screenplay 4.228.0 (including the MCP-Apps visualization tool); `tools/list` is the authority for the installed server, and the CLI-bundled MCP (`cratis screenplay mcp`) can be an older Screenplay that lacks newer tools.
 
 The supported CLI launch is `cratis screenplay mcp <model-root>`, or `cratis screenplay mcp`
 alone inside a project, where the CLI locates the model (the project's `.play` files, else
@@ -50,16 +50,26 @@ the [MCP loop](mcp-loop.md).
 | Group | Tools | Intent |
 | --- | --- | --- |
 | Understanding | `describe-application`, `search-declarations`, `find-declaration`, `declaration-details` | Navigate logical hierarchy and inspect bounded details |
-| References and examples | `find-references`, `dependencies`, `dependency-graph`, `find-fixtures`, `find-assertion-gaps`, `find-specification-obligations`, `find-modeling-smells`, `semantic-diff` | Inspect declared relationships and authored examples, not executed coverage |
+| References and examples | `find-references`, `dependencies`, `dependency-graph`, `find-fixtures`, `find-assertion-gaps`, `find-specification-obligations`, `find-modeling-smells`, `trace-lineage`, `semantic-diff` | Inspect declared relationships and authored examples, not executed coverage |
 | Source and validation | `diagnostics`, `ui-profiles`, `read-document`, `merged-document`, `syntax-schema` | Read exact source or typed structure and diagnose problems |
 | Workspace inspection | `open-workspace`, `read-workspace`, `read-ast`, `workspace-state`, `export-workspace`, `repair-capabilities` | Obtain current identities, handles, readiness, code attachment requirements, source-map locations, durable-state status and the repair catalog |
 | Visual (MCP-Apps hosts only) | `visualize-model` | Draw the board for the model or a `proposalId`; its `sketch` argument previews a what-if of whole documents. Reads only |
-| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-move`, `propose-repair`, `propose-property`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
+| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-move`, `propose-repair`, `propose-property`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
 | Review | `read-proposal`, `discard-proposal` | Inspect exact changes, dropped comments and proposed attachments, or abandon a connection-local proposal |
 | Reference execution | `run-specifications` | Run the workspace or a retained proposal candidate read-only; not attached code or target tests |
 | Effects | `apply`, `recover-workspace` | Apply an accepted plan or explicitly recover an interrupted write |
 
-`propose-move` moves a slice to another feature, or a feature to another module or feature, keeping identities: copy the `target` and `newParent` `{kind, parts}` addresses from the identity inventory and pass `expectedRevision` and `expectedCatalogRevision`. It repairs qualified references and `depends on`, and refuses identity loss, capture, collisions, descendant destinations, inherited authorization or screen-interaction changes and glob imports; review `moveReport` (`identityMigrations`, `referenceRepairs`, `fragmentsMoved`). It does not rename events, change pins or move files, and declaration moves between slices are deferred. Use it for legacy re-slicing instead of retyping declarations. Its report document fields are plain strings, not nested identity objects.
+`propose-move` moves a slice to another feature, a feature to another module or feature, or a single command, event, read model, projection, query, reaction or capture to another slice, keeping identities: copy the `target` and `newParent` `{kind, parts}` addresses from the identity inventory (`newParent` is the destination slice for a declaration) and pass `expectedRevision` and `expectedCatalogRevision`. It repairs qualified references and `depends on`, and refuses identity loss, collisions, descendant destinations, name capture (a reference that would resolve to a different declaration), inherited authorization or screen-interaction changes and glob imports; review `moveReport` (`identityMigrations`, `referenceRepairs`, `fragmentsMoved`, and `specificationsCarried` for a declaration). It does not rename events, change pins or move files. Use it for legacy re-slicing instead of retyping declarations. Its report document fields are plain strings, not nested identity objects.
+
+A declaration move follows these rules:
+
+- A specification that covers only the moved declaration moves with it. A specification covers a declaration when it is a matching specification of one of its `find-specification-obligations` obligations, or when its `when` step names it; a `given` or `then` reference alone is not coverage.
+- The move is refused when a specification also covers a declaration that stays, when an obligation the source slice met would no longer be met or the move would introduce an unmet obligation, on a name collision, for an inline declaration (such as an inline `produces event`), a declaration written in more than one fragment, a standalone specification, screen, constraint or module, and when an unqualified reference would resolve differently. Qualify that reference first.
+- Screen `execute`, `refresh` and `navigate to` targets that name the declaration are repaired, not moved.
+- Slice-level events named by `produces` do not travel with a command, and a projection's `from` may name an event declared in another slice; move such an event with its own `propose-move` only when it should change slices. A command's inline events go with it.
+- Event names and pins stay untouched, and assigned identities follow the declaration.
+
+Requires Screenplay 4.230.0 (`screenplay --version`) for declaration moves; older servers move only slices and features.
 
 Requires Screenplay 4.211.0 (`screenplay --version`) for string conflict/move-report document fields and independent reference-edit batches; older servers can emit objects and refuse independent remove/add batches. Upgrade before relying on this contract.
 
@@ -347,6 +357,24 @@ tags and identities survive; canonical ESM must stay byte-identical and every
 comment must survive exactly once. Extract before adding `generation`, not after
 making the document parser-invalid. This is a refactoring, not a diagnostic repair.
 
+Requires Screenplay 4.228.0 (`screenplay --version`) for `propose-inline-event`.
+
+`propose-inline-event` is the inverse: it folds a slice-level event with exactly one
+production into an inline event on that production, takes the same `subject`,
+revisions and `formatting: "CanonicalizeTouchedDocuments"`, and preserves executable
+bytes and identities. It refuses when the fold could change meaning (a conditional
+production, public or external event, cross-slice use, handlers, lost comments or any
+other reference to the event).
+
+Requires Screenplay 4.223.0 (`screenplay --version`) for `trace-lineage`.
+
+`trace-lineage` takes a read-model property `address` and returns a paged tree
+(`limit`, `offset`) from the property through projection or reducer mappings, joins and
+child mappings to the event property, then to the producing command property or capture
+source. A broken hop is reported where the chain breaks, several sources appear as
+branches and code the model cannot see into is marked opaque. It is read-only and
+advisory.
+
 Requires Screenplay 4.153.0 or later (`screenplay --version`) for `propose-rename` to consult release-baseline mutability; before it, `propose-rename` pins the previous effective name without a baseline.
 
 `propose-rename` consults release-baseline mutability: without a

package/package/corpus/skills/cratis-screenplay-toolchain/references/language-admission.md

@@ -18,6 +18,7 @@ exact language/semantic pairs; binding, reference execution and rendering are se
 | v28 | `==`/`!=` between Uuid values in command `require` and `produces when` | Uuid properties, Uuid concepts and identities, canonical literals; protected read paths in `require` only | v28 refused STAGE-ESM-016 |
 | v29 | `decimals <= N`; `add`/`subtract` by `a * b`; a concept mapped to another concept over the same primitive (decision 0098) | Decimal-places rule on a Decimal concept or property; the exact decimal product; the conversion is admitted only when the target declares no rule or compliance the source does not, never for enums, composites or optional into required | v29 refused until Stage admits it |
 | v30 | A command `produces ... for <required scalar property>` (several event sources); a specification `given generated <Command>.<property> = <value>` (decision 0098) | Several sources in one accepted command; pinned generated values for reaction-invoked commands, taken in authored order | v30 refused until Stage admits it |
+| v31 | A policy `require anonymous` for a public command or query | A deliberately public surface; the policy is the whole effective authorization | v31 refused until Stage admits it |
 
 Constructs of decision 0098 with no executable-model content need no version: application-level toolbar buttons in the layout's `navigation topbar` region (`button <id> title "..." slice <Slice>` with an optional indented `authorize <Policy>`), a command specification that states the public event its outbound Translate slice publishes (no more false `PLAY0285`), and a capture over events that copies a list (`lines = $.lines`) or fans out with `children lines identified by sku`. Check `screenplay --version` against the release that admitted v29 and v30 before relying on them.