@ai-ecoverse/slicc-bios 1.36.7 → 1.37.0

package/README.md

@@ -201,17 +201,29 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 **Release notes (slicc-spectrum#458):** each update check also gives the Kernel, UI, Agent and Tailscale rows a `releases` list from their GitHub repositories (`slicc-kernel`, `slicc-spectrum`, `slicc-agent`, `wasm-tailscale`), and each optional package one from the repository its npm version document names, when that is on GitHub ([`os/releases.js`](src/seed/releases.js)). A row gets the release it has installed and every newer one up to the version it offers, newest first, at most 30. Each release has its `version` (the tag without the `v`, or without the package's name in a shared repository such as homescoop), its `url` and its `notes`, the release body unchanged (the `<!-- cert-verify -->` block included, which spectrum turns into a Certified badge) up to 64 KB. Spectrum renders the notes; bios only fetches them. bios asks GitHub's unauthenticated API (`/repos/<repo>/releases?per_page=100`, page by page down to the installed version, at most 5 pages), without credentials, a referrer or any header but `Accept` and `If-None-Match`. It keeps each list in IndexedDB (`slicc-releases`) for a day and revalidates it with its ETag at every check, and GitHub doesn't count a 304 against its 60 requests an hour. A 403 or 429 backs off until `Retry-After`, the rate limit's reset or 15 minutes, and leaves `releases` out, so the row looks as it does without notes, with no error. The page sets no `connect-src`, so these requests need no change to its CSP.
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall. homescoop's packages (`wasm-*`, `wasi-*`, `wasix-*`) come at npm's `latest`, which under cert-review v2 is certified, since homescoop publishes only from a reviewed main through its ladder. The four that other repos publish, slicc-jsh, mcpcat, wasi-slicc (slicc-cli's) and sliccy-browser (slicc-cdp's), stay bios pins in [`src/packages/optional/package.json`](src/packages/optional/package.json) and its `package-lock.json`, so release-state, Renovate, cert review and the cert scenarios certify them as before; the page can't check those repos' cert-review runs itself (GitHub's API allows 60 unauthenticated requests an hour), so a main-built release alone doesn't reach seven. The catalog, [`src/packages/optional/catalog.json`](src/packages/optional/catalog.json), lists each package by its npm name, with only what npm can't tell: its `id` and `label`, and optionally `requires` (other ids), `notes` (bios's own caveats, one line each, shown next to npm's description), `helpers` (commands to leave out of the list until homescoop marks them `helper: true`), `range` and `abi` (Python's, below) and `kind: "project"`. A project keeps its `description`, `commands` and `size`, since npm doesn't know it.
 
-- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
+- **What npm tells (`os/packages.js`):** at boot, and at an update check at most every ten minutes, bios fetches each entry's version doc from the registry from the page (`https://registry.npmjs.org/<name>/latest`, which sends CORS `*`; the kernel's network path isn't needed), all in parallel and each with a 15-second timeout. A pinned entry's doc is its pin's (`/<name>/<pin>`), so only its description, commands and size come from npm. It takes `version` (the row's `offered`), `description` (npm's text, verbatim), the commands (the keys of `slicc.commands`, without one marked `helper: true` or listed in `helpers`, and only names a shell can run), `dist.unpackedSize` (the row's `size`, now what the package unpacks to on disk, its own files only, so git reads 56 MB where the old tarball-based size read 19 MB; the row says `unpacked: true`) and `dist.integrity`. An entry with a `range` (Python's is `3.15.0`) takes the highest version in range from the abbreviated packument instead, where the range is matched against the upstream X.Y.Z with homescoop's `-N` build ignored, so `3.15.0` offers 3.15.0-3 but never a 3.15.1 or 3.16 (pydata's builds are for one Python ABI: homescoop keeps the ABI within one X.Y.Z, and its py-* ranges stop at the next patch). With `abi`, a version whose `slicc.python.abi` differs isn't offered.
+- **Cache:** the last good answer for each entry is kept in `var/lib/slicc/optional/npm.json`, so the panel works offline and shows at once at boot; a later fetch replaces it, an entry that fails keeps its cached answer, and holds only what the rows show. A passing provenance verdict is remembered only in the tab's memory, for the listing (never a refusal, never in OPFS, which kernel processes can write, and never for an install, which always asks npm again).
+- **No answer and no cache:** boot never waits for npm. Such a row has `registry: 'checking'` while the fetch runs, then `registry: 'unreachable'`, with `offered: null`, an empty description, no commands, no size and no Install (spectrum shows *Couldn't reach npm.*); a row that isn't installed gets **Retry**, which, like the panel's `refreshPackages()`, fetches npm again. An installed row keeps **Remove**.
+- **The gate** (one function, `gate()` in `os/packages.js`, for the panel's Install and Update, a user's Update and [Your packages](#your-packages)) checks every package in the lock pnpm made. Each must be one of:
+  - an exact `name@version` with that integrity in the base set's lockfile (`src/packages/package-lock.json`), the catalog's pins (`src/packages/optional/package-lock.json`) or `src/packages/certs.json`, which is the only way a pinned entry passes; or
+  - an `@ai-ecoverse/*` package whose locked integrity equals the registry's `dist.integrity` for that exact version, and that npm's stored SLSA v1 provenance (`dist.attestations`, which bios trusts as npm stores it) binds to that integrity (its subject's sha512) and to its publisher's repository and release workflow at `refs/heads/main`. The publisher is bios's own, never read from npm: homescoop's `ladder-build.yml` or `publish.yml` for the `wasm-*`, `wasi-*`, `wasix-*` and `py-*` packages, and [`sources.json`](src/packages/optional/sources.json) for slicc-cdp, whose rule is `certified: "tag"`, its npm dist-tag `certified` (from the abbreviated packument), since its main released versions its cert-review didn't pass. A package with no publisher there (slicc-jsh, mcpcat, sliccy-browser at another version than its pin, or wasi-slicc, whose provenance is slicc-cli's, not homescoop's) is refused.
+  - Whatever matched, homescoop's certification exceptions then apply, exact matches included: a `fail` verdict refuses that version, and a `requires` verdict refuses it unless every pin of what it requires, in the lock and the base set's lockfile (never `certs.json`'s history), is in range. bios bundles `certification-exceptions.json` at release-state's pinned ref ([`exceptions.json`](src/packages/optional/exceptions.json); `pins.test` keeps it byte for byte that file) and unions it with homescoop main's (`raw.githubusercontent.com`, CORS `*`), which can only deny or constrain, never grant: a tampered or missing live file is at worst a denial, and the bundled copy decides alone when it can't be fetched. Finally a package whose `engines['slicc-kernel']` or kernel peer range the base set's kernel doesn't meet is refused.
+  - Anything that isn't `@ai-ecoverse/*` and isn't in the base set is refused; homescoop packages have no third-party dependencies.
+- **Listing:** each entry's latest goes through the same rules (with its exact `dependencies`) when it's fetched. If latest fails, bios walks back through older versions (in range, not deprecated, at most five; a version whose doc is broken is skipped) and offers the newest that passes, with `newer: { version, reason }` naming latest's blocker. A pinned entry is never walked back. If none passes, the row is `withheld` with that reason, offers no Install or Update, and an installed copy keeps Remove.
+
+Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two entries' npm `latest` provide the same command, so an install never shadows another entry's; `packages.test` checks that against npm's current `latest`.
+
+- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`, and every package in it, the one added and each dependency, must pass [the gate](#optional-packages). A locked integrity that isn't the registry's for that version (drift) removes the package again and fails the row with *This version doesn't match the tested build*; any other refusal fails it with *Not offered: <reason>.* An Update that fails puts the version it had back (*… stays.*), and an install that fails removes the package, so nothing unchecked stays installed. A row with no version from npm installs nothing, and Install and Update ask npm for the offer again first, so they never act on the OPFS cache's version. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.
-- **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
-- **A user's own installs:** bios also reads each user's own pnpm global (`/home/<user>/.local/share/pnpm/global/v11`, a `pnpm add -g` as `cone`), as root and read-only, straight from the files: it runs no pnpm as the user for that, and with kernel users off it reads none. Each row lists its installs (`installs`, slicc-spectrum#475): the panel's copy as `{ version, where: '/usr/local/share/pnpm', manager: 'panel' }` and each user's as `{ version, where: '/home/<user>/.local/share/pnpm', user, manager: 'pnpm' }`. The version and state follow the panel's copy, or else the user's newest. A row with any install never offers **Install**, and only a panel copy offers **Remove**; a row with only user installs offers **Update** when it's older than the catalog's, and nothing otherwise. That **Update** runs `pnpm add -g` as each user whose copy is older, with their uid, gid, `HOME`, `PNPM_HOME` and `PATH` in their home, with `--ignore-scripts`, `--ignore-pnpmfile`, the store's integrity check and no release-age wait (the catalog's version is certified), never as root and never with the system's environment, so the files stay theirs and no system copy appears. Their lockfile then passes the same check as a panel install; if it doesn't, bios puts the user's version back and the row says so. bios never touches a user's own bins. A requirement counts only in its own scope: the panel's copy for a panel install or a project, so one only a user has is installed for the system first, and that user's own global, or the panel's, for that user's copy (*Needs …*). The Remove question counts every copy that needs it, a user's included, and the move from the old root global moves a system copy even when a user has the package. The panel's own Install, Update and Remove work on its copy as before, whatever a user has.
+- **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than npm's offered version offers **Update**, which adds that version; one at or above it offers **Remove**. bios never downgrades.
+- **A user's own installs:** bios also reads each user's own pnpm global (`/home/<user>/.local/share/pnpm/global/v11`, a `pnpm add -g` as `cone`), as root and read-only, straight from the files: it runs no pnpm as the user for that, and with kernel users off it reads none. Each row lists its installs (`installs`, slicc-spectrum#475): the panel's copy as `{ version, where: '/usr/local/share/pnpm', manager: 'panel' }` and each user's as `{ version, where: '/home/<user>/.local/share/pnpm', user, manager: 'pnpm' }`. The version and state follow the panel's copy, or else the user's newest. A row with any install never offers **Install**, and only a panel copy offers **Remove**; a row with only user installs offers **Update** when it's older than npm's offered version, and nothing otherwise. That **Update** runs `pnpm add -g` as each user whose copy is older, with their uid, gid, `HOME`, `PNPM_HOME` and `PATH` in their home, with `--ignore-scripts`, `--ignore-pnpmfile`, the store's integrity check and no release-age wait (the catalog's version is certified), never as root and never with the system's environment, so the files stay theirs and no system copy appears. Their lockfile then passes the same check as a panel install; if it doesn't, bios puts the user's version back and the row says so. bios never touches a user's own bins. A requirement counts only in its own scope: the panel's copy for a panel install or a project, so one only a user has is installed for the system first, and that user's own global, or the panel's, for that user's copy (*Needs …*). The Remove question counts every copy that needs it, a user's included, and the move from the old root global moves a system copy even when a user has the package. The panel's own Install, Update and Remove work on its copy as before, whatever a user has.
 - **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.
 - **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios makes that tree readable by everyone, as root: one `find` selects the files without `a+r`, the executables without `a+x` and the directories without `a+x`, and runs `chmod a+rX` on only those, so a tree of 15,000 entries with one `0600` file pays for one walk and one `chmod`, not 15,000. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same pass once at its next check, marked by `var/lib/slicc/<project>/readable`.
 - **Failures** lead with one sentence and keep pnpm's output, starting with the package and version, under *Install log*, with **Retry**.
 - **Withdrawn and kept as exceptions** (homescoop#858/#859, #864): uv, esbuild, tsc and buf are withdrawn until attested rebuilds. They're retired rows (*No longer offered*, with Remove for an earlier install), and their certs lines are gone. Instead, use `pip` for uv's work for now (uv returns as `@ai-ecoverse/wasi-uv`, Astral's uv, once that's certified), and install esbuild and typescript straight from npm with `pnpm add -g`; buf has no stand-in. **git** and **gh** stay as recorded supply-chain exceptions until their attested rebuilds: their `certs.json` entries carry an `exception` field, which `pins.test.mjs` lists, and any other uncertified pin still fails it.
-- **Python data tools on Python 3.15:** the catalog's Python is wasix-python 3.15.0-3, and the data tools are homescoop's attested cp315 builds for it: py-numpy 2.5.4-2, py-pandas 3.0.6-3, py-matplotlib 3.11.2-13 and py-scipy 1.18.1-3, with contourpy, kiwisolver, pillow 13.0.0-2 and their pure dependencies, one copy each. The pure ones (dateutil, six, tzdata, cycler and the rest) are homescoop's version-neutral builds (homescoop#1283): their site-packages folder is `lib/python3/site-packages` and they ship no bytecode, so one build serves any Python 3. seven never mixes builds for two Pythons: Python and every py-* move in one PR, and Renovate groups them so (`renovate.json`). The project's version is 2026.10.21, so an install of the 3.14 data tools (2026.10.19 and earlier), or of the first 3.15 builds (2026.10.20), shows as outdated, with **Update**, which moves Python first and then the project; nothing built for 3.14 stays in `/opt/slicc/pydata`, and the `.pth` lists only 3.15 site-packages.
+- **Python data tools on Python 3.15:** the catalog's Python is the highest wasix-python 3.15.0-N (its `range` is `3.15.0`, its `abi` cp315; 3.15.0-3 today), and the data tools are homescoop's attested cp315 builds for it: py-numpy 2.5.4-2, py-pandas 3.0.6-3, py-matplotlib 3.11.2-13 and py-scipy 1.18.1-3, with contourpy, kiwisolver, pillow 13.0.0-2 and their pure dependencies, one copy each. The pure ones (dateutil, six, tzdata, cycler and the rest) are homescoop's version-neutral builds (homescoop#1283): their site-packages folder is `lib/python3/site-packages` and they ship no bytecode, so one build serves any Python 3. seven never mixes builds for two Pythons: the py-* move in one PR, Renovate groups them so (`renovate.json`), and the PR that moves them to another ABI moves Python's `range` and `abi` too. The project's version is 2026.10.21, so an install of the 3.14 data tools (2026.10.19 and earlier), or of the first 3.15 builds (2026.10.20), shows as outdated, with **Update**, which moves Python first and then the project; nothing built for 3.14 stays in `/opt/slicc/pydata`, and the `.pth` lists only 3.15 site-packages.
   - **What changed for code:** pandas 3.0 has copy-on-write, a `str` dtype for strings by default, and no longer needs pytz, so the project drops it (`six` stays, for dateutil). pillow 13 removed some deprecated APIs. numpy 2.5 keeps homescoop#1082's fix: `numpy.linalg` raises `LinAlgError` on a singular matrix instead of returning NaN.
   - **scipy** has static OpenBLAS, and every module loads except the deprecated `scipy.odr`, which needs Fortran, so `import scipy.odr` fails.
   - **The withdrawn builds** (homescoop#826, #730) stay uncertified: no py-numpy 2.3.2-4 to -10 or py-pandas 2.3.2-5 to -11.
@@ -222,7 +234,7 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
   - **Without Python:** if Python is removed while the data tools stay installed, the row warns that it needs Python (`warnings`, spectrum ≥ 1.49.1).
 - **ntfy** (`@ai-ecoverse/wasi-ntfy`, homescoop#1003) is seven's webhook receiver. A webhook, a phone or another agent publishes to a topic, and `ntfy sub <topic> '<command>'` runs the command once per message, in order, with `$NTFY_MESSAGE`, `$NTFY_TITLE`, `$NTFY_ID` and `$NTFY_RAW` (the message's JSON line, `attachment.url` included). For example, `ntfy sub https://ntfy.sliccy.ai/github 'agent send cone --lick=webhook --source github "$NTFY_RAW"'` turns each message into one `webhook` lick, and a replay with `--since` delivers it once. The connection is outbound only, through the page's fetch, so a quiet stream relies on the 120 s body window ([Network](#network)) to outlast ntfy's 45 s keepalive. Keep the gateway's `tk_` token in the vault and pass it as `NTFY_TOKEN` or `--token`. The command runs as the user who started `ntfy sub`, with that user's privileges, and everything in a message (`$NTFY_*`) is untrusted input chosen by whoever can publish to the topic or post to its hook URL: quote it (`"$NTFY_MESSAGE"`) and never `eval` it. A command that runs `ntfy pub` again should `unset ${!NTFY_*}` first, or it publishes to the incoming message's topic. `ntfy.test.mjs` tests it against a local fake ntfy server, not ntfy.sh.
 - **Login shells:** bios writes `/etc/profile.d/slicc.sh` at every boot, which puts `~/.local/share/gem/ruby/3.4.0/bin` on `PATH`, so a command from `gem install` runs by name in a login shell. It also makes sure `/etc/profile` runs `/etc/profile.d/*.sh`: it writes one if there's none, and adds that loop once, after the lines already there, to an `/etc/profile` that doesn't mention `/etc/profile.d/`.
-- **The agent** reads the same catalog: bios writes it to `/etc/slicc/optional.json` at every boot (id, package, version, label, description, commands, requires).
+- **The agent** reads the same catalog: bios writes it to `/etc/slicc/optional.json` at every boot and after every npm fetch (id, package, label, commands, requires, and npm's version and description once they're known).
 
 Optional packages never count in the header and never open the panel. The terminal's `pnpm add -g` still installs anything, at any version.
 
@@ -519,7 +531,7 @@ Limits:
 
 ## Certified packages
 
-Seven certifies a gated package (slicc-kernel, slicc-cdp, slicc-clipboard, slicc-jsh, mcpcat, and the `wasi-*`, `wasix-*`, `wasm-*` and `py-*` packages) by its integrity: a version is certified when [`src/packages/certs.json`](src/packages/certs.json) (the historic list, with its recorded `exception`s) or one of the lockfiles seven ships (the base set, `/opt/agent`, the optional catalog) carries it with that integrity. `src/seed/layer.js`'s `certifiedSet()` reads that union in the page, and a user's or a project's install that needs anything else is refused. A pin on main is certified because every pin a PR or merge group changes passes **release-state** in `ci / test` and bios's own cert-review in the queue. `test/integration/pins.test.mjs` checks the union covers every gated pin with its integrity (Tailscale's project included), and fails when a pinned package's `engines.slicc-kernel` or kernel peer range isn't met by the pinned kernel.
+Seven certifies a gated package (slicc-kernel, slicc-cdp, slicc-clipboard, slicc-jsh, mcpcat, and the `wasi-*`, `wasix-*`, `wasm-*` and `py-*` packages) by its integrity: a version is certified when [`src/packages/certs.json`](src/packages/certs.json) (the historic list, with its recorded `exception`s) or one of the lockfiles seven ships (the base set, `/opt/agent`, the optional catalog's pins, Tailscale and the catalog's projects) carries it with that integrity. `src/seed/layer.js`'s `certifiedSet()` reads that union in the page, and a user's or a project's install that needs anything else is refused, except an optional catalog package that passes [the gate](#optional-packages), with the dependencies it pins exactly, so a user's own add of a catalog package passes or fails as the panel's Install does. homescoop's certification exceptions apply to every version there, a `certs.json` or lockfile match included, and when they can't be read the version is refused. A pin on main is certified because every pin a PR or merge group changes passes **release-state** in `ci / test` and bios's own cert-review in the queue. `test/integration/pins.test.mjs` checks the union covers every gated pin with its integrity (Tailscale's project included), and fails when a pinned package's `engines.slicc-kernel` or kernel peer range isn't met by the pinned kernel.
 
 **release-state** ([`scripts/cert/release-state.mjs`](scripts/cert/release-state.mjs), code only) judges each gated pin and each `certs.json` line that a change adds, against the registry and its own repository's certification:
 - **Always:** the registry's integrity equals the lockfile's (or the line's).
@@ -530,7 +542,7 @@ It runs twice: in `ci / test` for quick feedback, and as cert-review's code chec
 
 ### Renovate keeps the pins current
 
-[`renovate.json`](renovate.json) bumps every `@ai-ecoverse/*` pin in the base set (`src/packages/package.json`), the optional catalog (`src/packages/optional/package.json`) and `/opt/agent` (`src/packages/agent/package.json`), with their npm and pnpm lockfiles.
+[`renovate.json`](renovate.json) bumps every `@ai-ecoverse/*` pin in the base set (`src/packages/package.json`), the optional catalog's four non-homescoop pins (`src/packages/optional/package.json`) and `/opt/agent` (`src/packages/agent/package.json`), with their npm and pnpm lockfiles. The catalog's homescoop entries aren't pinned, so they need no bumps; the Python data tools' project (`src/packages/optional/projects/pydata`) is pinned by hand, from the dependency dashboard.
 
 - **PRs:** homescoop's packages (`wasi-*`, `wasix-*`, `wasm-*`, `py-*`, `wasi-pnpm` included) come as one PR a day, between 00:00 and 06:00 UTC. The kernel (its base-set and `/opt/agent` pins together), slicc-cdp, slicc-agent, slicc-spectrum and slicc-jsh each get their own PR, and so does every other package. The grammars and Tailscale projects stay on the dependency dashboard.
 - **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once its required checks are green: `ci / test` (with release-state for every gated pin it changes) and `cert-review` (see [Certification review](#certification-review)). No bot writes to a Renovate branch: the shipped lockfiles are part of what seven certifies, so a certified pin needs no `certs.json` line.
@@ -557,7 +569,7 @@ It runs twice: in `ci / test` for quick feedback, and as cert-review's code chec
 - **Permissions:** `contents: read` and `actions: read`, no secrets and no `id-token`. A caller outside bios runs the plan with its inputs: the PR proofs and the hourly npm check run only for bios's own triggers.
 - **Jobs:** one plan job, one job per shard of each run, and one report job, because the queue for a runner costs more than the work.
 - **Runner:** fork code never runs on the org's Cloud Run pools. A same-repo `pull_request` (the proofs from our own branches), or a `schedule`, `workflow_dispatch`, `workflow_run` or `release` run on `main` (any `bios-ref`), puts the shard jobs on the `runner` input, else the `CERT_RUNNER` repository variable (`cloud-run-bench`), and the light plan and report jobs on `CERT_LIGHT_RUNNER` (`cloud-run`). Everything else runs on `ubuntu-latest`, and the `runner` input is ignored: fork pull requests, and dispatches from any other branch. Under `workflow_call` the same check reads the caller's event. The pools run with "no new privileges", so `sudo` can't become root there: the shard job installs Chromium's system libraries only when `sudo -n true` works, and otherwise relies on the image's.
-- **Pins:** [`scripts/canary/override-pins.mjs`](scripts/canary/override-pins.mjs) `name@version …` fetches each tarball through the harness download cache (so the tests find it there), checks it against npm's sha512 and records its sha256. It sets the version in every `package.json` under `src/packages` that pins the package and lets npm (`--package-lock-only`) and pnpm 12 (`--lockfile-only`) rewrite that directory's lockfiles, so a dependency that moves with the package (an agent release taking a newer slicc-browsers) moves in the lock too. A package that is only a dependency in a pnpm lock is forced with an `overrides` entry in that directory's `pnpm-workspace.yaml`. One that is only a dependency in an npm lock (wasm-git's own wasm-bash in the optional catalog) is left alone and reported as held. It writes `node_modules/.cache/slicc-canary/pins.json`, whose `candidates` are the gated packages the locks now pin that `certs.json` doesn't certify.
+- **Pins:** [`scripts/canary/override-pins.mjs`](scripts/canary/override-pins.mjs) `name@version …` fetches each tarball through the harness download cache (so the tests find it there), checks it against npm's sha512 and records its sha256. It sets the version in every `package.json` under `src/packages` that pins the package and lets npm (`--package-lock-only`) and pnpm 12 (`--lockfile-only`) rewrite that directory's lockfiles, so a dependency that moves with the package (an agent release taking a newer slicc-browsers) moves in the lock too. A package that is only a dependency in a pnpm lock is forced with an `overrides` entry in that directory's `pnpm-workspace.yaml`. One that is only a dependency in an npm lock (sliccy-browser's own slicc-cdp in the optional catalog) is left alone and reported as held. The catalog's homescoop entries aren't pinned, so they aren't candidates here; seven offers their npm `latest` as it is. It writes `node_modules/.cache/slicc-canary/pins.json`, whose `candidates` are the gated packages the locks now pin that `certs.json` doesn't certify.
 - **Certs check:** with `SLICC_CANARY` set to that file, `pins.test.mjs` reports those candidates as "candidate, not certified" instead of failing on them; anything else uncertified still fails. Without it (normal CI) the check is unchanged.
 - **Tests:** the named shards in `shards.json` (`ci.yml` assigns files to shards at random instead, see [CI](#ci)), run by [`scripts/canary/shard.mjs`](scripts/canary/shard.mjs) with the overrides. The test files with a failure run again on main's pins, and the ones that passed there run once more with the overrides, so each failure is a regression (passes on main's pins, fails with the overrides), a failure on both, or flaky. Tests that assert a pinned version by value (`jsh.test.mjs` for slicc-jsh, `update.test.mjs` and `reuse.test.mjs` for wasm-bash) regress whenever that package is overridden.
 - **Output:** a `canary` artifact with `canary.json` (`<proof>/canary.json` for the proofs), `{ biosRef, overrides: [{ name, version, sha256 }], candidates, held, shards: [{ shard, wallMs, phases }], results: [{ test, status, baseline, retry, verdict, log }] }`, and a job summary with the overrides, a note when a slicc-kernel override of 1.78.0 or later meets a ref whose `src/` calls `createKernel` without a `users` mode (that kernel then defaults to `enforce`, and `i`, `npm` and `npx` by path exit 126 until #405 and kernel #495; [`scripts/canary/users.mjs`](scripts/canary/users.mjs) finds the calls, and `canary.json` lists them as `kernels`), the wall time of each shard and the failures split into regressions, failures on both, and flaky ones. The report job fails on a failure without overrides, on a missing shard, on a shard that exited nonzero with no failing test (a crash or a throwing teardown), when an `expect` entry (a `{ test, log }` pair of substrings) matches no regression, or on a regression no `expect` entry matches, unless the run sets `strict: false`. `test/integration/canary.test.mjs` checks these rules.
@@ -566,7 +578,7 @@ It runs twice: in `ci / test` for quick feedback, and as cert-review's code chec
 
 ### The npm package
 
-`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/package.json`, `package-lock.json` and `catalog.json`. It has no runtime code and no dependencies, and those paths stay where they are. [`.github/workflows/release.yml`](.github/workflows/release.yml) releases it from `main` only: semantic-release reads the conventional commits, tags `v<version>` and writes the GitHub release, then `npm publish --provenance` publishes the tag at HEAD through npm's trusted publishing on a GitHub-hosted runner, retrying, and skipping a version npm already has. So re-running the workflow on main publishes a tag whose publish failed. The step then waits until npm serves the version, up to about 8 minutes with a growing backoff, since npm's listing can lag a publish by a minute or more ([`scripts/ci/served.mjs`](scripts/ci/served.mjs)). It passes only once npm's `dist.integrity` equals the tarball's from `npm pack --dry-run`, or, when only the gzip differs because another runner packed it, once the served tarball's tar equals the packed one byte for byte. A version npm serves with other contents fails at once, and one npm never serves fails after the wait. Every `npm view` answer, and `npm publish`'s output, is in the log. The deploy to seven (`deploy.yml`) is separate and doesn't wait for it.
+`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/package.json`, `package-lock.json` (the four non-homescoop pins), `catalog.json`, `sources.json` and `exceptions.json`. It has no runtime code and no dependencies, and those paths stay where they are. [`.github/workflows/release.yml`](.github/workflows/release.yml) releases it from `main` only: semantic-release reads the conventional commits, tags `v<version>` and writes the GitHub release, then `npm publish --provenance` publishes the tag at HEAD through npm's trusted publishing on a GitHub-hosted runner, retrying, and skipping a version npm already has. So re-running the workflow on main publishes a tag whose publish failed. The step then waits until npm serves the version, up to about 8 minutes with a growing backoff, since npm's listing can lag a publish by a minute or more ([`scripts/ci/served.mjs`](scripts/ci/served.mjs)). It passes only once npm's `dist.integrity` equals the tarball's from `npm pack --dry-run`, or, when only the gzip differs because another runner packed it, once the served tarball's tar equals the packed one byte for byte. A version npm serves with other contents fails at once, and one npm never serves fails after the wait. Every `npm view` answer, and `npm publish`'s output, is in the log. The deploy to seven (`deploy.yml`) is separate and doesn't wait for it.
 
 ## Develop
 
@@ -597,8 +609,8 @@ On a pull request, the plan first reads the files the pull request changes (`git
 
 - **docs**: only Markdown or `docs/` changed. Lint runs, and neither the shards nor `ci / vendors` run.
 - **tests**: only `test/integration/*.test.mjs` files changed, and perhaps `durations.json`. Only those files run, in shards; `ci / vendors` runs when a vendors test changed.
-- **catalog**: only `src/packages/optional/**` or `certs.json` changed. The pins, optional, packages, unshadow and renovate rows run, plus the rows of each changed package.
-- **bump**: only pins and lockfiles changed (the base set, `/opt/agent`, grammars, Tailscale, the optional packages, root devDependencies) and `certs.json`. Pins, the boot smoke and renovate run, plus the rows of each changed package, and the catalog rows when an optional package changed.
+- **catalog**: only `src/packages/optional/**` or `certs.json` changed. The pins, optional, npm, packages, unshadow and renovate rows run, plus the rows of each changed package (a changed `catalog.json`, `retired.json` or `sources.json` entry, by its key).
+- **bump**: only pins and lockfiles changed (the base set, `/opt/agent`, grammars, Tailscale, the optional catalog's pins, root devDependencies) and `certs.json`. Pins, the boot smoke and renovate run, plus the rows of each changed package, and the catalog rows when an optional package changed.
 - **full**: everything else, and every merge queue run, push to `main` and dispatch. A `package.json` that changed beyond its dependencies, a lockfile without a pin change, a changed helper or fixture, and a package without rows all run the full suite.
 
 [`scripts/ci/scopes.json`](scripts/ci/scopes.json) maps each package name or pattern to its rows (`full` for the harness, Playwright and the installer's tar, `vendors` for the slicc CLI). The plan prints its mode and why in the job summary, and `ci / test` passes only when the jobs that mode skips were skipped and every other job passed: `ci: PASS docs plan, 0 shards, skipped integration and vendors`. The merge queue always runs everything, so `main` is never less tested.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.36.7",
+  "version": "1.37.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -27,7 +27,9 @@
     "src/packages/agent/pnpm-lock.yaml",
     "src/packages/optional/package.json",
     "src/packages/optional/package-lock.json",
-    "src/packages/optional/catalog.json"
+    "src/packages/optional/catalog.json",
+    "src/packages/optional/sources.json",
+    "src/packages/optional/exceptions.json"
   ],
   "engines": {
     "node": ">=26"
@@ -42,11 +44,11 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.46.4",
+    "@ai-ecoverse/slicc": "1.47.0",
     "@ai-ecoverse/slicc-browsers": "1.10.3",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "1.24.2",
-    "@ai-ecoverse/slicc-spectrum": "1.104.0",
+    "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/slicc-vault": "1.15.1",
     "@biomejs/biome": "2.5.15",
     "es-module-lexer": "3.0.3",

package/src/packages/optional/catalog.json

@@ -2,179 +2,146 @@
   "@ai-ecoverse/wasm-git": {
     "id": "git",
     "label": "git",
-    "description": "Version control for your projects.",
-    "commands": ["git"],
-    "size": 18814699
+    "helpers": [
+      "git-shell",
+      "git-remote-http",
+      "git-remote-https",
+      "git-upload-pack",
+      "git-receive-pack"
+    ]
   },
   "@ai-ecoverse/wasi-gh": {
     "id": "gh",
     "label": "GitHub CLI",
-    "description": "GitHub CLI. In seven, use GH_TOKEN from the vault; gh auth login stores a plain-text token. gh auth login -c (clipboard) needs slicc-clipboard. A git credential helper using gh auth git-credential gets no token.",
-    "commands": ["gh"],
-    "size": 16248809
+    "notes": [
+      "In seven, use GH_TOKEN from the vault: gh auth login stores a plain-text token.",
+      "gh auth login -c (clipboard) needs slicc-clipboard.",
+      "A git credential helper using gh auth git-credential gets no token."
+    ]
   },
   "@ai-ecoverse/wasix-openssh": {
     "id": "ssh",
-    "label": "OpenSSH",
-    "description": "Connects to servers and copies files with ssh, scp and sftp; git over ssh too.",
-    "commands": ["ssh", "scp", "sftp", "ssh-keygen", "ssh-add"],
-    "size": 3360417
+    "label": "OpenSSH"
   },
   "@ai-ecoverse/wasi-slicc": {
     "id": "slicc",
     "label": "slicc",
-    "description": "Prompts, watches and aborts another seven's agent from this terminal: slicc <join-url> prompt, watch or abort. For root and cones; the other seven must allow remote control from this one in its Linked devices.",
-    "commands": ["slicc"],
-    "size": 1349790
+    "notes": [
+      "For root and cones. The other seven must allow remote control from this one in its Linked devices."
+    ]
   },
   "@ai-ecoverse/wasix-python": {
     "id": "python",
     "label": "Python",
-    "description": "Python 3.15 with pip (pip, pip3 or python3 -m pip), for scripts and data work.",
-    "commands": ["python3", "pip", "pip3"],
-    "size": 61095391
+    "range": "3.15.0",
+    "abi": "cp315"
   },
   "slicc-py-datatools": {
     "id": "pydata",
-    "kind": "project",
     "label": "Python data tools",
-    "description": "numpy, pandas, matplotlib and scipy for Python, about 240 MB on disk. scipy lacks only the deprecated scipy.odr.",
+    "kind": "project",
+    "description": "numpy, pandas, matplotlib and scipy for Python, about 240 MB on disk.",
     "commands": [],
+    "size": 67059175,
     "requires": ["python"],
-    "size": 67059175
+    "notes": ["scipy lacks only the deprecated scipy.odr."]
   },
   "@ai-ecoverse/slicc-jsh": {
     "id": "node",
     "label": "Node.js (jsh)",
-    "description": "Node.js 22-compatible node and jsh commands: fs (chmod included), streams, http, fetch, WebSocket, zlib, crypto, v8.serialize and child_process, the sync calls (spawnSync, execSync, execFileSync) and detached spawns included, tls on the kernel's own handshake and Brotli and zstd decompression in zlib, without fork, worker or asymmetric crypto yet. fetch() reaches servers inside seven (localhost, <port>.kernel.localhost) and streams their responses. node with no arguments opens the REPL.",
-    "commands": ["node", "jsh"],
-    "size": 1478434
+    "notes": [
+      "No fork, worker or asymmetric crypto yet.",
+      "fetch() reaches servers inside seven (localhost, <port>.kernel.localhost)."
+    ]
   },
   "@ai-ecoverse/sliccy-browser": {
     "id": "jsh-browser",
     "label": "Browser for jsh scripts",
-    "description": "sliccy:browser for .jsh scripts: find and open tabs, run code in them, read cookies and localStorage, and fetch as the page, through seven's browser automation. Seven's own tab and the vault stay out of reach.",
-    "commands": [],
     "requires": ["node"],
-    "size": 1525841
+    "notes": ["Seven's own tab and the vault stay out of reach."]
   },
   "@ai-ecoverse/wasix-ruby": {
     "id": "ruby",
     "label": "Ruby",
-    "description": "Ruby 3.4 with gem, bundler, rake, irb and erb, for scripts and gems. Commands from gem install run by name in a login shell.",
-    "commands": ["ruby", "gem", "bundle", "rake", "irb", "erb"],
-    "size": 9762412
+    "notes": ["Commands from gem install run by name in a login shell."]
   },
   "@ai-ecoverse/wasix-perl": {
     "id": "perl",
-    "label": "Perl",
-    "description": "Perl 5.42 with cpan, perldoc and prove, for scripts and text processing.",
-    "commands": ["perl", "cpan", "perldoc", "prove", "pod2html", "pod2man", "pod2text"],
-    "size": 19663059
+    "label": "Perl"
   },
   "@ai-ecoverse/wasi-biome": {
     "id": "biome",
-    "label": "Biome",
-    "description": "Formats and lints JavaScript, TypeScript, JSON and CSS.",
-    "commands": ["biome"],
-    "size": 10593722
+    "label": "Biome"
   },
   "@ai-ecoverse/wasm-poppler": {
     "id": "pdf",
-    "label": "PDF tools",
-    "description": "Reads PDFs: text, page images, and splitting or joining files.",
-    "commands": ["pdftotext", "pdfinfo", "pdftoppm", "pdfimages", "pdfunite", "pdfseparate"],
-    "size": 2584619
+    "label": "PDF tools"
   },
   "@ai-ecoverse/wasm-qpdf": {
     "id": "qpdf",
     "label": "qpdf",
-    "description": "Merges, splits, rotates and encrypts PDF files.",
-    "commands": ["qpdf"],
-    "size": 975365
+    "helpers": ["fix-qdf", "zlib-flate"]
   },
   "@ai-ecoverse/wasm-libheif": {
     "id": "heif",
-    "label": "HEIF and AVIF images",
-    "description": "HEIC/HEIF and AVIF image decoder (heif-convert, heif-info). Includes an HEVC decoder (libde265); HEVC is patent-encumbered. LGPL-3.0-or-later.",
-    "commands": ["heif-convert", "heif-dec", "heif-info"],
-    "size": 4190759
+    "label": "HEIF and AVIF images"
   },
   "@ai-ecoverse/wasm-rsync": {
     "id": "rsync",
-    "label": "rsync",
-    "description": "Copies and syncs folders, sending only what changed, also to rsync:// servers.",
-    "commands": ["rsync"],
-    "size": 376423
+    "label": "rsync"
   },
   "@ai-ecoverse/wasm-sqlite3": {
     "id": "sqlite3",
     "label": "SQLite",
-    "description": "The sqlite3 shell 3.54, for SQLite databases. journal_mode=WAL falls back to delete, and a WAL database made elsewhere opens as \"file is not a database\".",
-    "commands": ["sqlite3"],
-    "size": 678323
+    "notes": [
+      "journal_mode=WAL falls back to delete, and a WAL database made elsewhere opens as \"file is not a database\"."
+    ]
   },
   "@ai-ecoverse/wasm-screen": {
     "id": "screen",
-    "label": "screen",
-    "description": "Keeps a terminal session running to detach and reattach, from any terminal.",
-    "commands": ["screen"],
-    "size": 715907
+    "label": "screen"
   },
   "@ai-ecoverse/wasi-dig": {
     "id": "dig",
-    "label": "dig",
-    "description": "Looks up DNS records, tailnet names included.",
-    "commands": ["dig"],
-    "size": 214326
+    "label": "dig"
   },
   "@ai-ecoverse/wasix-websocat": {
     "id": "websocat",
     "label": "websocat",
-    "description": "Connects to WebSocket servers (ws:// and wss://) from the terminal. An upstream alpha (websocat 4). It speaks raw TCP, so hosts outside seven need an exit: a linked slicc CLI or a Tailscale exit node. A listener that can't bind still exits 0.",
-    "commands": ["websocat"],
-    "size": 1267173
+    "notes": [
+      "An upstream alpha. It speaks raw TCP, so hosts outside seven need an exit: a linked slicc CLI or a Tailscale exit node.",
+      "A listener that can't bind still exits 0."
+    ]
   },
   "@ai-ecoverse/wasi-ntfy": {
     "id": "ntfy",
     "label": "ntfy",
-    "description": "Publishes and subscribes to notifications, and runs a command for every message: ntfy sub <topic> '<command>', with the message in $NTFY_MESSAGE and $NTFY_RAW. Works with ntfy.sh, any ntfy server and the tray's webhook gateway, ntfy.sliccy.ai.",
-    "commands": ["ntfy"],
-    "size": 4751117
+    "notes": ["Works with ntfy.sh, any ntfy server and the tray's webhook gateway, ntfy.sliccy.ai."]
   },
   "@ai-ecoverse/wasix-gnupg": {
     "id": "gpg",
-    "label": "GnuPG",
-    "description": "Signs, verifies and encrypts files and commits with OpenPGP keys.",
-    "commands": ["gpg", "gpgv", "gpg-agent", "gpgconf", "gpg-connect-agent", "gpg2"],
-    "size": 3328285
+    "label": "GnuPG"
   },
   "@ai-ecoverse/mcpcat": {
     "id": "mcpcat",
     "label": "mcpcat (MCP client)",
-    "description": "Calls MCP servers from the terminal: lists and calls their tools, resources and prompts, over HTTP or a stdio command. In a header, -H 'Authorization: Bearer ${NAME}' (single quotes) sends the vault's placeholder, which the vault fills in where a secret rule allows that host; mcpcat never prints the value.",
-    "commands": ["mcpcat"],
-    "size": 595379
+    "notes": [
+      "-H 'Authorization: Bearer ${NAME}' (single quotes) sends the vault's placeholder, which the vault fills in where a secret rule allows that host; mcpcat never prints the value."
+    ]
   },
   "@ai-ecoverse/wasm-imagemagick-heif": {
     "id": "imagemagick",
-    "label": "ImageMagick",
-    "description": "Convert, resize and inspect images (magick, convert, mogrify, identify), including HEIC/AVIF.",
-    "commands": ["magick", "convert", "mogrify", "identify", "magick-open"],
-    "size": 11420934
+    "label": "ImageMagick"
   },
   "@ai-ecoverse/wasm-zip": {
     "id": "zip",
     "label": "zip",
-    "description": "Create and extract .zip archives (zip, unzip, zipinfo).",
-    "commands": ["zip", "unzip", "zipinfo"],
-    "size": 869325
+    "notes": [
+      "unzip refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive) and extracts the rest (homescoop#1174)."
+    ]
   },
   "@ai-ecoverse/wasm-xxd": {
     "id": "xxd",
-    "label": "xxd",
-    "description": "Hex dump and reverse (xxd, from vim).",
-    "commands": ["xxd"],
-    "size": 124869
+    "label": "xxd"
   }
 }

package/src/packages/optional/exceptions.json

@@ -0,0 +1,337 @@
+{
+  "schema": 1,
+  "entries": [
+    {
+      "package": "@ai-ecoverse/emscripten-cache",
+      "versions": ["6.0.9-3"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/859",
+      "ruling": "cert lane 2026-10-17 04:40 and 05:05: staged from a local slicc-emscripten embuilder cache with no provenance; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/py-cycler",
+      "versions": ["0.12.1-1", "0.12.1-2", "0.12.1-3", "0.12.1-4", "0.12.1-5", "0.12.1-6", "0.12.1-7"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 0.12.1-1, manual batch at gitHead f22dcbc2)"
+    },
+    {
+      "package": "@ai-ecoverse/py-fonttools",
+      "versions": ["4.66.1-1", "4.66.1-2", "4.66.1-3", "4.66.1-4", "4.66.1-5", "4.66.1-6", "4.66.1-7"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 4.66.1-1, manual batch at gitHead f22dcbc2)"
+    },
+    {
+      "package": "@ai-ecoverse/py-matplotlib",
+      "versions": ["3.11.2-2", "3.11.2-3", "3.11.2-4", "3.11.2-5", "3.11.2-6", "3.11.2-7", "3.11.2-8", "3.11.2-9"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 3.11.2-2, manual batch at gitHead f22dcbc2)"
+    },
+    {
+      "package": "@ai-ecoverse/py-numpy",
+      "range": ">=2.3.2-4 <=2.3.2-10",
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/826",
+      "ruling": "cert lane 2026-10-17 04:10: unverifiable build (the recipe sha256 matches no upstream source; root 2.3.2-4 could stage a prebuilt), not certified; also the #858 chain"
+    },
+    {
+      "package": "@ai-ecoverse/py-packaging",
+      "versions": ["26.3.0-1", "26.3.0-2", "26.3.0-3", "26.3.0-4", "26.3.0-5", "26.3.0-6", "26.3.0-7"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 26.3.0-1, manual batch at gitHead f22dcbc2)"
+    },
+    {
+      "package": "@ai-ecoverse/py-pandas",
+      "range": ">=2.3.2-5 <=2.3.2-11",
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/730",
+      "ruling": "cert lane 2026-10-17 03:45: unverifiable build (the recipe sha256 matches neither the PyPI sdist nor the GitHub archive), not certified; also the #858 chain"
+    },
+    {
+      "package": "@ai-ecoverse/py-pyparsing",
+      "versions": ["3.3.3-1", "3.3.3-2", "3.3.3-3", "3.3.3-4", "3.3.3-5", "3.3.3-6", "3.3.3-7"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 3.3.3-1, manual batch at gitHead f22dcbc2)"
+    },
+    {
+      "package": "@ai-ecoverse/py-scipy",
+      "versions": ["1.18.0-5", "1.18.0-7", "1.18.0-8", "1.18.0-9", "1.18.0-10", "1.18.0-11", "1.18.0-12"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 1.18.0-5, no provenance, could stage a prebuilt)"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-buf",
+      "versions": ["1.73.0-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-cargo",
+      "versions": ["0.99.0-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified (added row: no recipe)"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-esbuild",
+      "versions": ["0.28.2-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-gh",
+      "versions": ["2.102.0-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-hf",
+      "versions": ["0.1.0-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-protoc-gen-connect-go",
+      "versions": ["1.21.0-0"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-protoc-gen-go",
+      "versions": ["1.36.12-0"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-protoc-gen-go-grpc",
+      "versions": ["1.6.2-0"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-rustc",
+      "versions": ["1.98.1-4"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-rustc-names",
+      "versions": ["1.98.1-4"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified (added row: no recipe)"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-typescript",
+      "versions": ["7.0.2-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-zig",
+      "versions": ["0.16.0-15"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasi-zig-libc-src",
+      "versions": ["0.16.0-15"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified (added row: no recipe)"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-automake",
+      "versions": ["1.17.0-5", "1.17.0-6", "1.17.0-7", "1.17.0-8", "1.17.0-9", "1.17.0-10"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 1.17.0-5, whose gitHead c20b25fb has no recipe; withdraws the lane's 1.17.0-8 line)"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-openssl",
+      "versions": ["3.5.9-3"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 and 05:55: no provenance; unverifiable build and build input, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-python",
+      "versions": ["3.14.2-16"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 06:10: no provenance and no gitHead; unattested build input of py-kiwisolver, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-sysroot",
+      "versions": ["2025.9.30-14", "2025.9.30-28", "2025.9.30-29", "2025.9.30-30", "2025.9.30-31", "2025.9.30-32"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55: -14 was built locally with no provenance, and -29..-32 are the -14 tarball with patches on top; not certified; withdraws the lane's -28 line (ce48e444)"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-uv-shim",
+      "versions": ["0.1.0-6"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasix-zlib",
+      "versions": ["1.3.1-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 and 05:55: no provenance; unverifiable build and build input, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-bash",
+      "versions": ["5.3.0-20"],
+      "verdict": "requires",
+      "requires": {
+        "@ai-ecoverse/slicc-kernel": ">=1.130.2"
+      },
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/1230",
+      "ruling": "cert lane 2026-10-19 12:40 and 16:45: FAIL below slicc-kernel 1.130.2 (an interactive bash exits 130 on a ^C during fork); certified with slicc-kernel >=1.130.2"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-binaryen",
+      "versions": ["132.0.0-1", "132.0.0-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/859",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 132.0.0-1, staged from a local slicc-emscripten tree)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-clang",
+      "versions": ["24.0.0-10", "24.0.0-11", "24.0.0-12", "24.0.0-13", "24.0.0-14", "24.0.0-15", "24.0.0-16", "24.0.0-17", "24.0.0-18", "24.0.0-19", "24.0.0-20", "24.0.0-21"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/859",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 24.0.0-10, staged from a local slicc-emscripten tree)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-cmake",
+      "versions": ["4.4.3-9"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-emscripten",
+      "versions": ["6.0.9-11", "6.0.9-12", "6.0.9-13", "6.0.9-14", "6.0.9-15", "6.0.9-16", "6.0.9-17", "6.0.9-18", "6.0.9-19"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/859",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 6.0.9-11, staged from a local slicc-emscripten tree)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-freetype",
+      "versions": ["2.13.3-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-git",
+      "versions": ["2.55.0-14", "2.55.0-15"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/858",
+      "ruling": "cert lane 2026-10-17 04:40 (#858/#859 audit): unverifiable build; the root and every version that repacks down to it are not certified (root 2.55.0-14, no provenance); also #864 group 1"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-go-std-wasip1",
+      "versions": ["1.26.5-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 (#864 group 1): no provenance and no tree; unverifiable build, not certified (gitHead f22dcbc2 has no recipe)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-lcms2",
+      "versions": ["2.19.1-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libheif",
+      "versions": ["1.23.6-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libiconv",
+      "versions": ["1.18.0-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libjpeg-turbo",
+      "versions": ["3.1.2", "3.1.2-2"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (laptop publishes)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libpng",
+      "versions": ["1.6.59-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libtiff",
+      "versions": ["4.7.2-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libwebp",
+      "versions": ["1.5.0-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-libxml2",
+      "versions": ["2.15.4-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-openjpeg",
+      "versions": ["2.5.3"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-xz",
+      "versions": ["5.8.1-1"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:55 (#864 transitive): unattested build input, not certified (a laptop publish)"
+    },
+    {
+      "package": "@ai-ecoverse/wasm-zlib",
+      "versions": ["1.3.1-2", "1.3.1-3"],
+      "verdict": "fail",
+      "issue": "https://github.com/ai-ecoverse/homescoop/issues/864",
+      "ruling": "cert lane 2026-10-17 05:05 and 05:55: no provenance; unverifiable build and build input, not certified"
+    }
+  ]
+}

package/src/packages/optional/package-lock.json

@@ -9,27 +9,7 @@
         "@ai-ecoverse/mcpcat": "0.17.4",
         "@ai-ecoverse/slicc-jsh": "0.45.4",
         "@ai-ecoverse/sliccy-browser": "0.1.29",
-        "@ai-ecoverse/wasi-biome": "2.5.15-4",
-        "@ai-ecoverse/wasi-dig": "0.1.0-4",
-        "@ai-ecoverse/wasi-gh": "2.102.0-2",
-        "@ai-ecoverse/wasi-ntfy": "2.32.0-2",
-        "@ai-ecoverse/wasi-slicc": "1.47.0",
-        "@ai-ecoverse/wasix-gnupg": "2.4.9-11",
-        "@ai-ecoverse/wasix-openssh": "10.6.0-11",
-        "@ai-ecoverse/wasix-perl": "5.42.0-20",
-        "@ai-ecoverse/wasix-python": "3.15.0-3",
-        "@ai-ecoverse/wasix-ruby": "3.4.11-20",
-        "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-5",
-        "@ai-ecoverse/wasm-git": "2.55.0-17",
-        "@ai-ecoverse/wasm-imagemagick-heif": "7.1.2-34-9.1",
-        "@ai-ecoverse/wasm-libheif": "1.23.6-6",
-        "@ai-ecoverse/wasm-poppler": "26.10.0-5",
-        "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
-        "@ai-ecoverse/wasm-rsync": "3.5.1-5",
-        "@ai-ecoverse/wasm-screen": "5.0.1-13",
-        "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
-        "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
-        "@ai-ecoverse/wasm-zip": "3.0.0-7"
+        "@ai-ecoverse/wasi-slicc": "1.47.0"
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
@@ -85,36 +65,6 @@
         "node": ">=24"
       }
     },
-    "node_modules/@ai-ecoverse/wasi-biome": {
-      "version": "2.5.15-4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-biome/-/wasi-biome-2.5.15-4.tgz",
-      "integrity": "sha512-hTKxTKNCvvfzXoVp30xFe8o/iB3cZ+FxjxYPv4kvyTuvG9i6InbGmZH/IgPsfRgMIL3g0TYIZQcFNlaOHjCTCg==",
-      "license": "MIT OR Apache-2.0"
-    },
-    "node_modules/@ai-ecoverse/wasi-dig": {
-      "version": "0.1.0-4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-dig/-/wasi-dig-0.1.0-4.tgz",
-      "integrity": "sha512-zWKTPKPoJ27Jndc1gpHSGmGovisg8mXD6hkPYm14ccVlqtVpNTDdGgdY+5QAqzqYdTzyiVAbkhqFMDo75vxVOg==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/@ai-ecoverse/wasi-gh": {
-      "version": "2.102.0-2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-gh/-/wasi-gh-2.102.0-2.tgz",
-      "integrity": "sha512-2Jsk/p+QT6Dvf4pMYYSAMSD5WQ67037Bqy6HxvHLT+DslyKNrxm2ExnMu1mQ9l5HG3uaWazdC/Vx4x3EuLwNqA==",
-      "license": "MIT",
-      "engines": {
-        "slicc-kernel": ">=1.30.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasi-ntfy": {
-      "version": "2.32.0-2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-ntfy/-/wasi-ntfy-2.32.0-2.tgz",
-      "integrity": "sha512-gPaK5pptREyvSsfnog3PqxDYAiZ9Qeo3S0llnB5UVzOeQTLT222SecJ5Xm7d6ldB2//3iILp3wxqV24TItpwMg==",
-      "license": "Apache-2.0 OR GPL-2.0-only",
-      "engines": {
-        "slicc-kernel": ">=1.125.4"
-      }
-    },
     "node_modules/@ai-ecoverse/wasi-slicc": {
       "version": "1.47.0",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-slicc/-/wasi-slicc-1.47.0.tgz",
@@ -123,141 +73,6 @@
       "engines": {
         "slicc-kernel": ">=1.92.0"
       }
-    },
-    "node_modules/@ai-ecoverse/wasix-gnupg": {
-      "version": "2.4.9-11",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-gnupg/-/wasix-gnupg-2.4.9-11.tgz",
-      "integrity": "sha512-urq5NdBeiHXZ22+cPjcwr49grwYxdW5dIx6BHvyWmkcDbUseCakG5b0tIw3gpb3hmGbf/Xb+IyqE7pZvyZsGzQ==",
-      "license": "GPL-3.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.117.2"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-openssh": {
-      "version": "10.6.0-11",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-openssh/-/wasix-openssh-10.6.0-11.tgz",
-      "integrity": "sha512-MPTOdE/bKShVw+j65vN5yfZuV/xPyUdPJ34R2s2pSHzxNHHtLJOlZaCdfDmcvR5u+N2BGR/c7COBmYFmo/t6tQ==",
-      "license": "SSH-OpenSSH",
-      "engines": {
-        "slicc-kernel": ">=1.44.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-perl": {
-      "version": "5.42.0-20",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-perl/-/wasix-perl-5.42.0-20.tgz",
-      "integrity": "sha512-YjEfv0m/nfzUvMnilYXis8VRrTxAlyeuckwF1vjfR4tZ50/+7nOG10NwEV1Lv2V4HIztSFxnTuot5OhePYw2CA==",
-      "license": "Artistic-1.0-Perl OR GPL-1.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.120.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-python": {
-      "version": "3.15.0-3",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-python/-/wasix-python-3.15.0-3.tgz",
-      "integrity": "sha512-DiWOa70kqBzeQUPqM0124YKRoE0cHvMDH6Pa1msd/kijc981oVd5JEUhScSTN8j2EHHR5aZmueBnffffdLiSIw==",
-      "license": "PSF-2.0 AND GPL-3.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.122.3"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-ruby": {
-      "version": "3.4.11-20",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-ruby/-/wasix-ruby-3.4.11-20.tgz",
-      "integrity": "sha512-666zP5PgZ4PLk01W6E2F7cBQd7kjZXqyzaMgF1r5MK52v/aO53i7aHfuYHL1frLJgIzCPY8gXe7t3pkkacw/dw==",
-      "license": "Ruby",
-      "engines": {
-        "slicc-kernel": ">=1.120.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-websocat": {
-      "version": "4.0.0-alpha3-5",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-websocat/-/wasix-websocat-4.0.0-alpha3-5.tgz",
-      "integrity": "sha512-ajSgu0rHPgwGrsXEJUSBX1J9s/gl//BRVKfGMkxe1WjwzYXoBFLD99BcJD4LvEMXTE+Wmvlfq102GgOevd3GRA==",
-      "license": "MIT OR Apache-2.0",
-      "engines": {
-        "slicc-kernel": ">=1.95.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasm-bash": {
-      "version": "5.3.0-19",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-bash/-/wasm-bash-5.3.0-19.tgz",
-      "integrity": "sha512-svL9HAGz74mj8OaQaiA7uv7Wv0JnGQKryJk0zdkZBglDg2WIxX0ez+IKmR5lfLo9boFHopGQJ9rw6UeWBZypZw==",
-      "license": "GPL-3.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.48.3"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasm-git": {
-      "version": "2.55.0-17",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-git/-/wasm-git-2.55.0-17.tgz",
-      "integrity": "sha512-1anA5CYYvfVEcu9PQC1f5v6a9w2Q8GcSjrIQHW5Qjq5/zoYDxNmbElB6rX0zhvc5n5ZL5X6mY6RaSxi3jU+bkQ==",
-      "license": "GPL-2.0-only",
-      "dependencies": {
-        "@ai-ecoverse/wasm-bash": "5.3.0-19"
-      },
-      "engines": {
-        "slicc-kernel": ">=1.47.1"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasm-imagemagick-heif": {
-      "version": "7.1.2-34-9.1",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-imagemagick-heif/-/wasm-imagemagick-heif-7.1.2-34-9.1.tgz",
-      "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
-      "license": "ImageMagick AND LGPL-3.0-or-later AND BSD-2-Clause",
-      "engines": {
-        "slicc-kernel": ">=1.78.0"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasm-libheif": {
-      "version": "1.23.6-6",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-libheif/-/wasm-libheif-1.23.6-6.tgz",
-      "integrity": "sha512-RhPLxEfVz3CRiOqYt0WCSPLWqNBTNgrvZcRcQYCfk2DtH+MmdlcH6GjhFPB7IKlmkOKOwonpeXzA/cI5e2H7SA==",
-      "license": "LGPL-3.0-or-later AND MIT AND BSD-2-Clause"
-    },
-    "node_modules/@ai-ecoverse/wasm-poppler": {
-      "version": "26.10.0-5",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-poppler/-/wasm-poppler-26.10.0-5.tgz",
-      "integrity": "sha512-cKHeDywd6qiuM2lb80P1p+Ucpy2VH4PkqbC4Rz1cB1fuBDkCxceO2cYxWrf2r2A11lYZ7sJBm9qMWBi2FdTkMA==",
-      "license": "GPL-2.0-only OR GPL-3.0-only"
-    },
-    "node_modules/@ai-ecoverse/wasm-qpdf": {
-      "version": "12.4.2-4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-qpdf/-/wasm-qpdf-12.4.2-4.tgz",
-      "integrity": "sha512-y1FD7A7zJUdnrdnT9sBD3X+50e2i9r3A7KW6zWQnjTJ6SShsVldihj7RbeyeyRqegrOvYfaMZ/5mJwnlY8M0Og==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/@ai-ecoverse/wasm-rsync": {
-      "version": "3.5.1-5",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-rsync/-/wasm-rsync-3.5.1-5.tgz",
-      "integrity": "sha512-PH3b0+QLwWURo5293My7WMeUChS+p2aOO/JkOIgUNtSqbNTbu2bVaC31fxr+xhkAmAnH+WcTnjwvPQn/mQQ+ig==",
-      "license": "GPL-3.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.29.2"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasm-screen": {
-      "version": "5.0.1-13",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-screen/-/wasm-screen-5.0.1-13.tgz",
-      "integrity": "sha512-g2K9J63mKkRORjPTQA7gGgvVBaW/0FZCjCkKxb+gvIstiwxpCos5mCW2z6+jGXXlxJ32cxTdyu3M0X4KWhkW3g==",
-      "license": "GPL-3.0-or-later"
-    },
-    "node_modules/@ai-ecoverse/wasm-sqlite3": {
-      "version": "3.54.0-6",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-sqlite3/-/wasm-sqlite3-3.54.0-6.tgz",
-      "integrity": "sha512-R68+igrJTaNAheMY317wTWVlRTWQQIA6WnkFgwc2XKdwDnh23tALEoRSURKXki2VacPknGt3YplY/rl/cCwsaw==",
-      "license": "blessing"
-    },
-    "node_modules/@ai-ecoverse/wasm-xxd": {
-      "version": "9.2.1192-3",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-xxd/-/wasm-xxd-9.2.1192-3.tgz",
-      "integrity": "sha512-CJKX6isuCrz3ZFoKLGQqeqj20aiWNSR8BsbgWtRTmCP4bvlZefmvz8vGIsD4rOdZybdfgIfhPnEEnBdsqiNn4g==",
-      "license": "Vim"
-    },
-    "node_modules/@ai-ecoverse/wasm-zip": {
-      "version": "3.0.0-7",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-zip/-/wasm-zip-3.0.0-7.tgz",
-      "integrity": "sha512-q92s+O0EaT+uGHZZ2ZCffoYfb7ZzlRHd3K+wvXDh2l0V+uBJUZE7VeC+5AZQ5KZ2v80w5h7jZbOiw34EWKW4Dw==",
-      "license": "Info-ZIP"
     }
   }
 }

package/src/packages/optional/package.json

@@ -1,31 +1,11 @@
 {
   "name": "slicc-bios-optional",
   "private": true,
-  "description": "The certified versions of the optional packages that seven's Install / Update panel offers. Never installed as a project: the panel runs pnpm add -g for each one.",
+  "description": "The optional packages that seven pins because their publisher isn't homescoop's ladder: slicc-jsh, mcpcat, wasi-slicc (slicc-cli) and sliccy-browser (slicc-cdp). Release-state and cert review certify these pins; every other catalog entry is npm's latest behind the runtime gate. Never installed as a project: the panel runs pnpm add -g for each one.",
   "dependencies": {
     "@ai-ecoverse/mcpcat": "0.17.4",
     "@ai-ecoverse/slicc-jsh": "0.45.4",
     "@ai-ecoverse/sliccy-browser": "0.1.29",
-    "@ai-ecoverse/wasi-biome": "2.5.15-4",
-    "@ai-ecoverse/wasi-dig": "0.1.0-4",
-    "@ai-ecoverse/wasi-gh": "2.102.0-2",
-    "@ai-ecoverse/wasi-ntfy": "2.32.0-2",
-    "@ai-ecoverse/wasi-slicc": "1.47.0",
-    "@ai-ecoverse/wasix-gnupg": "2.4.9-11",
-    "@ai-ecoverse/wasix-openssh": "10.6.0-11",
-    "@ai-ecoverse/wasix-perl": "5.42.0-20",
-    "@ai-ecoverse/wasix-python": "3.15.0-3",
-    "@ai-ecoverse/wasix-ruby": "3.4.11-20",
-    "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-5",
-    "@ai-ecoverse/wasm-git": "2.55.0-17",
-    "@ai-ecoverse/wasm-imagemagick-heif": "7.1.2-34-9.1",
-    "@ai-ecoverse/wasm-libheif": "1.23.6-6",
-    "@ai-ecoverse/wasm-poppler": "26.10.0-5",
-    "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
-    "@ai-ecoverse/wasm-rsync": "3.5.1-5",
-    "@ai-ecoverse/wasm-screen": "5.0.1-13",
-    "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
-    "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
-    "@ai-ecoverse/wasm-zip": "3.0.0-7"
+    "@ai-ecoverse/wasi-slicc": "1.47.0"
   }
 }

package/src/packages/optional/sources.json

@@ -0,0 +1,5 @@
+{
+  "@ai-ecoverse/slicc-cdp": {
+    "certified": "tag"
+  }
+}

package/src/packages/package-lock.json

@@ -10,7 +10,7 @@
         "@ai-ecoverse/slicc-cdp": "1.30.18",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
         "@ai-ecoverse/slicc-kernel": "1.138.0",
-        "@ai-ecoverse/slicc-spectrum": "1.104.0",
+        "@ai-ecoverse/slicc-spectrum": "1.104.1",
         "@ai-ecoverse/wasi-fnox": "1.39.0-5",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-19",
         "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
@@ -81,9 +81,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {
-      "version": "1.104.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.104.0.tgz",
-      "integrity": "sha512-ZH6vp9jDlh3mDBb8PdU5l4jkeP0+GQNmP3+Q39uPDOx/Jx2H76hyjqY6zMX0ZJNQsnLr8W0/RFvT0CM4O+viWg==",
+      "version": "1.104.1",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.104.1.tgz",
+      "integrity": "sha512-/NNo3NmWc8l4+fcVKlynOKzRFbi2N/1H1w8Hkn4N8B51UgjvAW+Y3oykgp0kePQPb11zjithkKmZjC22CdXMkw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -7,7 +7,7 @@
     "@ai-ecoverse/slicc-cdp": "1.30.18",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
     "@ai-ecoverse/slicc-kernel": "1.138.0",
-    "@ai-ecoverse/slicc-spectrum": "1.104.0",
+    "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/wasi-fnox": "1.39.0-5",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-19",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",

package/src/packages/pnpm-lock.yaml

@@ -21,8 +21,8 @@ importers:
         specifier: 1.138.0
         version: 1.138.0
       '@ai-ecoverse/slicc-spectrum':
-        specifier: 1.104.0
-        version: 1.104.0
+        specifier: 1.104.1
+        version: 1.104.1
       '@ai-ecoverse/wasi-fnox':
         specifier: 1.39.0-5
         version: 1.39.0-5
@@ -115,8 +115,8 @@ packages:
     resolution: {integrity: sha512-p5cdX1mB6xed1NcRGe0Uifm3NVx8d3YXzA2kLYH2d7HtcSwjvmOU566SUaUKBtbgwXHRAC5gAfW1QoD6/fAiOQ==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-spectrum@1.104.0':
-    resolution: {integrity: sha512-ZH6vp9jDlh3mDBb8PdU5l4jkeP0+GQNmP3+Q39uPDOx/Jx2H76hyjqY6zMX0ZJNQsnLr8W0/RFvT0CM4O+viWg==}
+  '@ai-ecoverse/slicc-spectrum@1.104.1':
+    resolution: {integrity: sha512-/NNo3NmWc8l4+fcVKlynOKzRFbi2N/1H1w8Hkn4N8B51UgjvAW+Y3oykgp0kePQPb11zjithkKmZjC22CdXMkw==}
     engines: {node: '>=24'}
     peerDependencies:
       '@shikijs/langs': 4.5.0
@@ -215,7 +215,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-kernel@1.138.0': {}
 
-  '@ai-ecoverse/slicc-spectrum@1.104.0': {}
+  '@ai-ecoverse/slicc-spectrum@1.104.1': {}
 
   '@ai-ecoverse/wasi-fnox@1.39.0-5': {}