Skip to content
Cratis Cratis Cratis

CHR0035: Read model declares a reserved '_subject' property

Rule Description

Section titled “Rule Description”

A read model — a record or class marked with [ReadModel] — declares a property or record parameter named exactly _subject. Chronicle reserves the _subject field in the MongoDB document backing a read model for internal compliance-subject tracking, so a same-named property silently collides with it.

Rename the property.

Severity

Section titled “Severity”

Error

Example

Section titled “Example”
using Cratis.Arc.Queries.ModelBound;


// Error CHR0035: Read model 'Customer' declares a property named '_subject', which
// Chronicle reserves as an internal MongoDB field. Rename it.
[ReadModel]
public record Customer(Guid Id, string Name, string _subject);

Why This Rule Exists

Section titled “Why This Rule Exists”

Every managed read-model document carries an internal _subject field that Chronicle uses to track the compliance subject the document belongs to — the identity its [PII] values are encrypted under and erased by. That field is infrastructure, not part of your model.

A read-model property named _subject maps to the same document field, so your value and Chronicle’s internal tracking value fight over one slot. The projected value can overwrite the tracking value or read back as Chronicle’s, and after a right-to-erasure key deletion the behavior is undefined. Because the collision is by name in the persisted document, nothing surfaces at compile time without this rule — it just misbehaves at runtime.

Rename the property to anything else (for example Subject, without the leading underscore, if you genuinely need to expose the subject).

Section titled “Related Rules”