Skip to content
Cratis

CHR0035: Read model declares a reserved compliance subject property

Rule Description

Section titled “Rule Description”

A read model — a record or class marked with [ReadModel] — declares a property or record parameter named _subject, __subject, or __subjects. Chronicle reserves these fields in stored read model documents for internal compliance-subject tracking, so a same-named property silently collides with them.

Rename the property.

Severity

Section titled “Severity”

Error

Example

Section titled “Example”
using Cratis.Arc.Queries.ModelBound;


// Error CHR0035: Read model 'Customer' declares a property named '_subject', which
// Chronicle reserves as an internal MongoDB field. Rename it.
[ReadModel]
public record Customer(Guid Id, string Name, string _subject);

Why This Rule Exists

Section titled “Why This Rule Exists”

Every managed read-model document carries an internal __subject field that Chronicle uses as the default identity its [PII] values are encrypted under and erased by. A document composed from several subjects can also carry __subjects, which maps individual properties to their owners. These fields are infrastructure, not part of your model. _subject remains reserved for compatibility with earlier stored shapes.

A read-model property with any reserved name maps to the same document field, so your value and Chronicle’s internal tracking value fight over one slot. The projected value can overwrite the tracking value or read back as Chronicle’s, and after a right-to-erasure key deletion the behavior is undefined. Because the collision is by name in the persisted document, nothing surfaces at compile time without this rule — it just misbehaves at runtime.

Rename the property to anything else (for example Subject, without the leading underscore, if you genuinely need to expose the subject).

Section titled “Related Rules”