@gregiteen/ssss-cli 0.14.0 → 0.14.2

package/schemas/core-registry.schema.json

@@ -0,0 +1,386 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ssss.dev/schemas/core-registry.schema.json",
+  "title": "SSSS Core Registry Schema",
+  "description": "JSON Schema for SSSS core and extension registries (spec §5).",
+  "type": "object",
+  "required": [
+    "registry",
+    "spec_version",
+    "description",
+    "document_primitives"
+  ],
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "registry": {
+      "type": "string"
+    },
+    "spec_version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "conformance": {
+      "type": "string"
+    },
+    "document_primitives": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/primitiveDefinition"
+      }
+    },
+    "contract_primitives": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/contractPrimitive"
+      }
+    },
+    "universal_frontmatter": {
+      "type": "object",
+      "required": ["required"],
+      "properties": {
+        "required": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "recommended_okf": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "recommended_semantic": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "spec_ref": {
+          "type": "string"
+        }
+      }
+    },
+    "portability": {
+      "type": "object",
+      "required": ["classes", "export_profiles"],
+      "properties": {
+        "description": { "type": "string" },
+        "classes": {
+          "type": "object",
+          "additionalProperties": { "type": "string" }
+        },
+        "export_profiles": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "required": ["includes"],
+            "properties": {
+              "includes": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "excludes": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "resource_bound": { "type": "string" },
+              "note": { "type": "string" }
+            }
+          }
+        },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "bundle": {
+      "type": "object",
+      "required": [
+        "container",
+        "structure",
+        "manifest_required_fields",
+        "provenance_required_fields"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "container": { "type": "string" },
+        "structure": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "file_sort": { "type": "string" },
+        "manifest_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "manifest_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "provenance_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "provenance_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "content_hash": { "type": "string" },
+        "parameter_fields": {
+          "type": "object",
+          "required": ["required"],
+          "properties": {
+            "required": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "optional": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "source_enum": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "note": { "type": "string" }
+          }
+        },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "provisioning": {
+      "type": "object",
+      "required": [
+        "verbs",
+        "step_required_fields",
+        "system_enum",
+        "mode_enum"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "verbs": {
+          "type": "object",
+          "additionalProperties": { "type": "string" }
+        },
+        "step_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "step_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "system_enum": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "mode_enum": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "edge_relations": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "install_modes": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "id_remap": { "type": "string" },
+        "upgrade": { "type": "string" },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "required": [
+        "trigger_types",
+        "misfire_policies",
+        "concurrency_policies",
+        "task_instantiation_fields",
+        "run_statuses",
+        "idempotency_basis"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "trigger_types": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "misfire_policies": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "concurrency_policies": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "task_instantiation_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "run_statuses": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "idempotency_basis": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "semantic": {
+      "type": "object",
+      "required": [
+        "version",
+        "identity_fields",
+        "surface_fields",
+        "relation_fields",
+        "renderable_fields",
+        "language_pattern",
+        "safe_default"
+      ],
+      "properties": {
+        "version": { "type": "integer" },
+        "identity_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "surface_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "relation_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "renderable_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "language_pattern": { "type": "string" },
+        "safe_default": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "reserved_keys": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "host_field_prefix": { "type": "string" },
+    "spec_ref_reserved": { "type": "string" }
+  },
+  "$defs": {
+    "primitiveDefinition": {
+      "type": "object",
+      "required": [
+        "family",
+        "append_only",
+        "portability",
+        "required_fields"
+      ],
+      "properties": {
+        "family": {
+          "type": "string"
+        },
+        "canonical_filename": {
+          "type": ["string", "null"]
+        },
+        "filename_convention": {
+          "type": "string"
+        },
+        "append_only": {
+          "type": "boolean"
+        },
+        "portability": {
+          "type": "string",
+          "enum": ["structural", "tenant_private", "resource_bound"]
+        },
+        "required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "required_when": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "enums": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "patterns": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "immutable_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "references": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "allowed_types": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "disallowed_types": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "allowed_portability": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "must_exist": {
+                "type": "boolean"
+              },
+              "hash_field": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "aliases": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "deprecated": {
+          "type": "boolean"
+        },
+        "deprecation_notice": {
+          "type": "string"
+        },
+        "resource": {
+          "type": "object",
+          "properties": {
+            "kind": { "type": "string" },
+            "provision_relation": { "type": "string" }
+          }
+        },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "spec_ref": {
+          "type": "string"
+        }
+      }
+    },
+    "contractPrimitive": {
+      "type": "object",
+      "required": ["purpose", "spec_ref"],
+      "properties": {
+        "purpose": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    }
+  }
+}

package/scripts/audit-registry-field-usage.mjs

@@ -45,6 +45,7 @@ const ENGINE_ENFORCED_KEYS = [
   'immutable_fields',
   'references',
   'append_only',
+  'aliases',
 ];
 
 // Keys that are real and load-bearing but are intentionally consumed
@@ -58,6 +59,8 @@ const KNOWN_NON_ENGINE_KEYS = new Set([
   'portability', // consumed by src/registry.mjs resolvePortability() + src/bundle.mjs export filtering, not write-time validation
   'resource', // extension-defined resource_bound metadata, consumed by src/bundle.mjs provisioning
   'description', // human documentation on a primitive definition, same role as `notes`; never enforced at write time
+  'deprecated', // documentation / catalog deprecation status; consumed by tool displays and spec generation, not write-time validation
+  'deprecation_notice', // human guidance on migration path for deprecated primitives; consumed by documentation
   // Product-side projection metadata. The SSSS engine never reads these: they are
   // consumed by the host application's own projector to decide which target tables
   // a document feeds and how (see festech.live SsssGenericProjector.ts). Kept in the

package/scripts/check-commit-durability.mjs

@@ -306,6 +306,7 @@ async function checkRecoveryTriggers(root) {
   const untouched = read(live, 'rules/live.md').includes('in flight');
   holder.child.kill('SIGKILL');
   const signal = await holder.exited;
+  await new Promise((resolve) => setTimeout(resolve, 50));
   const afterKill = await fileKernel(live).recover();
   check('recovery skips an intent whose writer is alive',
     whileAlive.length === 1 && whileAlive[0].outcome === 'in_flight' && untouched, JSON.stringify(whileAlive));

package/scripts/cmd-schema.mjs

@@ -0,0 +1,62 @@
+/**
+ * Schema export and inspection commands for SSSS.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs, die, wantsHelp } from './lib/cli.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..');
+const SCHEMAS_DIR = path.resolve(ROOT, 'schemas');
+
+const HELP = `Usage: ssss schema core|bundle|export [options]
+
+Commands:
+  core [--out <file>]      Output the Core Registry JSON Schema.
+  bundle [--out <file>]    Output the .ucw Bundle JSON Schema.
+  export [--out <dir>]     Export all canonical schemas to a directory (default: ./schemas).
+`;
+
+function emit(value, output) {
+  const text = typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`;
+  if (output) {
+    fs.mkdirSync(path.dirname(path.resolve(output)), { recursive: true });
+    fs.writeFileSync(path.resolve(output), text, { encoding: 'utf8' });
+  } else {
+    process.stdout.write(text);
+  }
+}
+
+export async function run(argv) {
+  if (wantsHelp(argv)) { console.log(HELP); return; }
+  const verb = argv[0];
+  const { flags } = parseArgs(argv.slice(1));
+
+  try {
+    const coreSchemaPath = path.join(SCHEMAS_DIR, 'core-registry.schema.json');
+    const bundleSchemaPath = path.join(SCHEMAS_DIR, 'bundle.schema.json');
+
+    if (verb === 'core') {
+      const content = fs.readFileSync(coreSchemaPath, 'utf8');
+      emit(content, flags.out);
+      return;
+    }
+    if (verb === 'bundle') {
+      const content = fs.readFileSync(bundleSchemaPath, 'utf8');
+      emit(content, flags.out);
+      return;
+    }
+    if (verb === 'export') {
+      const targetDir = path.resolve(flags.out || './schemas');
+      fs.mkdirSync(targetDir, { recursive: true });
+      fs.copyFileSync(coreSchemaPath, path.join(targetDir, 'core-registry.schema.json'));
+      fs.copyFileSync(bundleSchemaPath, path.join(targetDir, 'bundle.schema.json'));
+      console.log(`Exported canonical schemas to ${targetDir}`);
+      return;
+    }
+    die(`Unknown schema verb '${verb || ''}'.\n${HELP}`);
+  } catch (error) {
+    die(error.message);
+  }
+}

package/scripts/conformance-09.mjs

@@ -33,6 +33,7 @@ import { MemoryIdempotencyStore, FileIdempotencyStore, runIdempotencyContract }
 import { capabilityCovers, createCapabilityAuthorizer } from '../src/authorization.mjs';
 import { createEngine } from '../src/engine.mjs';
 import { validateVerifiedPrincipal } from '../src/authorization.mjs';
+import { validateJsonSchema } from '../src/schema-validator.mjs';
 
 async function rejects(promise, pattern) {
   try { await promise; return false; } catch (error) { return pattern.test(error.message); }
@@ -319,11 +320,109 @@ async function checkCapabilities(root, check) {
   await write('lr-1', 'roles/editor/ROLE.md', role('editor', ['"write:rule"']), 'system');
   await write('lr-2', 'roles/owner/ROLE.md', role('owner', ['"write:*"']), 'system');
   await write('lr-3', 'roles/typed/ROLE.md', role('typed', ['"*:assistant"']), 'system');
+  await write('lr-rw', 'roles/rolewriter/ROLE.md', role('rolewriter', ['"write:role"']), 'system');
   check('legacy roles: write:<type> grants writes to that type', (await write('lr-4', 'rules/a.md', doc('rule', 'A'), 'editor')).success);
   check('legacy roles: write:<type> denies other types', (await write('lr-5', 'assistants/b/ASSISTANT.md', doc('assistant', 'B'), 'editor')).error?.code === 'forbidden');
   check('legacy roles: *:<type> grants writes to that type', (await write('lr-6', 'assistants/c/ASSISTANT.md', doc('assistant', 'C'), 'typed')).success);
   check('legacy roles: write:* grants writes to every type', (await write('lr-7', 'workflows/d/WORKFLOW.md', doc('workflow', 'D'), 'owner')).success);
   check('legacy roles: an unknown role is forbidden, not promoted', (await write('lr-8', 'rules/e.md', doc('rule', 'E'), 'ghost')).error?.code === 'forbidden');
+  check('legacy roles: write:role grants writes to security_role (alias unification)',
+    (await write('lr-aliased-1', 'roles/sec/ROLE.md', role('sec', ['"write:rule"']), 'rolewriter')).success);
+
+  const roleDoc = (name, permissions) => `---\ntype: role\ntitle: "${name}"\ndescription: "Canonical role."\ntimestamp: "2026-09-24T00:00:00Z"\nname: "${name}"\npermissions: [${permissions.join(', ')}]\n---\n`;
+  const replaceRes = await write('lr-aliased-replace', 'roles/sec/ROLE.md', roleDoc('sec', ['"write:rule"', '"write:task"']), 'rolewriter');
+  check('kernel mutation: replace security_role with role succeeds (alias unification)', replaceRes.success);
+
+  const illegalTypeChange = await write('lr-illegal-type', 'roles/sec/ROLE.md', doc('assistant', 'SecAsst'), 'owner');
+  check('kernel mutation: replace role with assistant fails closed',
+    illegalTypeChange.error?.code === 'validation_failed' &&
+    illegalTypeChange.error?.message?.includes('Operation may not change an existing document type.'));
+
+  const convDoc = `---\ntype: conversation\ntitle: "Thread"\ndescription: "Chat transcript."\ntimestamp: "2026-09-24T00:00:00Z"\nthread_id: "t-1"\n---\n\nInitial message.\n`;
+  await engine.processOperation({ type: 'operation', workspace_id: 'w', idempotency_key: 'conv-init', path: 'threads/t1/CONVERSATION.md', content: convDoc, actor: { role: 'system' } }, vault);
+  const patchRes = await engine.processOperation({
+    type: 'patch', workspace_id: 'w', idempotency_key: 'conv-patch-alias', path: 'threads/t1/CONVERSATION.md',
+    patches: { type: 'thread', __body__: 'New reply.' },
+    actor: { role: 'system' },
+  }, vault);
+  check('kernel mutation: patch conversation with type thread succeeds (alias unification)', patchRes.success);
+
+  const regTypes = engine._registry.types;
+  check('core registry: release, model, page, conflict declare deprecated: true',
+    regTypes.get('release')?.deprecated === true &&
+    regTypes.get('model')?.deprecated === true &&
+    regTypes.get('page')?.deprecated === true &&
+    regTypes.get('conflict')?.deprecated === true);
+
+  let selfAliasRejected = false;
+  try {
+    composeRegistries({
+      core: {
+        registry: 'ssss',
+        version: '0.14.0',
+        universal_fields: ['type'],
+        portability: { classes: { structural: {} } },
+        document_primitives: {
+          rule: { family: 'core', append_only: false, portability: 'structural', required_fields: ['type'], aliases: ['rule'] },
+        },
+      },
+      extensions: [],
+    });
+  } catch (err) {
+    selfAliasRejected = err.message.includes('cannot alias itself');
+  }
+  check('core registry: self-alias on a primitive is rejected', selfAliasRejected);
+
+  let asymmetricAliasRejected = false;
+  try {
+    composeRegistries({
+      core: {
+        registry: 'ssss',
+        version: '0.14.0',
+        universal_fields: ['type'],
+        portability: { classes: { structural: {} } },
+        document_primitives: {
+          rule: { family: 'core', append_only: false, portability: 'structural', required_fields: ['type'], aliases: ['assistant'] },
+          assistant: { family: 'core', append_only: false, portability: 'structural', required_fields: ['type'] },
+        },
+      },
+      extensions: [],
+    });
+  } catch (err) {
+    asymmetricAliasRejected = err.message.includes('collides with existing primitive');
+  }
+  check('core registry: non-mutual core alias collision is rejected', asymmetricAliasRejected);
+
+  const floorAuthorizer = createCapabilityAuthorizer({
+    policyFloors: { 'ssss:role': { create: ['governance:elevated'] } },
+  });
+  const secRoleDef = regTypes.get('security_role');
+  const floorBlocked = await floorAuthorizer({
+    principal: {
+      id: 'u1',
+      kind: 'agent',
+      workspaceIds: ['w'],
+      capabilities: ['ssss:security_role:create'],
+      authentication: { provider: 'token', assurance: 'verified' },
+    },
+    workspaceId: 'w',
+    definition: secRoleDef,
+    action: 'create',
+  });
+  const floorAllowed = await floorAuthorizer({
+    principal: {
+      id: 'u1',
+      kind: 'agent',
+      workspaceIds: ['w'],
+      capabilities: ['ssss:security_role:create', 'governance:elevated'],
+      authentication: { provider: 'token', assurance: 'verified' },
+    },
+    workspaceId: 'w',
+    definition: secRoleDef,
+    action: 'create',
+  });
+  check('authorization: policyFloors on ssss:role apply when mutating security_role alias',
+    floorBlocked.allowed === false && floorBlocked.missing?.includes('governance:elevated') && floorAllowed.allowed === true);
 
   const pathPrincipal = {
     id: 'scoped-user',
@@ -340,6 +439,32 @@ async function checkCapabilities(root, check) {
     (await writeScoped('ps-2', 'rules/engineering/lint.md', doc('rule', 'Lint'))).error?.code === 'forbidden');
 }
 
+function checkJsonSchemas(check) {
+  const coreRegistry = JSON.parse(fs.readFileSync(path.resolve('registry/core.json'), 'utf8'));
+  const coreSchema = JSON.parse(fs.readFileSync(path.resolve('schemas/core-registry.schema.json'), 'utf8'));
+  const coreResult = validateJsonSchema(coreRegistry, coreSchema);
+  check('schema: registry/core.json validates against schemas/core-registry.schema.json', coreResult.valid, coreResult.errors?.[0]?.message);
+
+  const bundle = JSON.parse(fs.readFileSync(path.resolve('conformance/reference-bundle.ucw.json'), 'utf8'));
+  const bundleSchema = JSON.parse(fs.readFileSync(path.resolve('schemas/bundle.schema.json'), 'utf8'));
+  const bundleResult = validateJsonSchema(bundle, bundleSchema);
+  check('schema: reference-bundle.ucw.json validates against schemas/bundle.schema.json', bundleResult.valid, bundleResult.errors?.[0]?.message);
+
+  const badCore = { ...coreRegistry };
+  delete badCore.spec_version;
+  const badCoreResult = validateJsonSchema(badCore, coreSchema);
+  check('schema: core registry schema rejects missing spec_version', !badCoreResult.valid && badCoreResult.errors.some((e) => e.path.includes('spec_version')));
+
+  const badPortability = JSON.parse(JSON.stringify(coreRegistry));
+  badPortability.document_primitives.memory.portability = 'illegal_class';
+  const badPortResult = validateJsonSchema(badPortability, coreSchema);
+  check('schema: core registry schema rejects invalid portability enum', !badPortResult.valid && badPortResult.errors.some((e) => e.path.includes('portability')));
+
+  const badBundle = { files: [] };
+  const badBundleResult = validateJsonSchema(badBundle, bundleSchema);
+  check('schema: bundle schema rejects missing manifest', !badBundleResult.valid && badBundleResult.errors.some((e) => e.path.includes('manifest')));
+}
+
 // Resource hooks (spec §6.3): every prepare ends in exactly one finalize or
 // reconcile, and nothing after the event append may undo the commit.
 async function checkResourceLifecycle(check) {
@@ -432,6 +557,27 @@ async function checkResourceLifecycle(check) {
   check('references: a reference to a disallowed type is rejected', wrongType.error?.code === 'validation_failed');
   check('references: a patch cannot repoint a reference at a missing document', repointed.error?.code === 'validation_failed');
 
+  const withRoleRefs = createValidator({ extensions: [{
+    registry: 'acme', extends: 'core',
+    document_primitives: {
+      grant_doc: {
+        family: 'extension', append_only: false, portability: 'structural', required_fields: ['type', 'name', 'role_ref'],
+        references: { role_ref: { allowed_types: ['role'] } },
+      },
+      deny_role_doc: {
+        family: 'extension', append_only: false, portability: 'structural', required_fields: ['type', 'name', 'target_ref'],
+        references: { target_ref: { disallowed_types: ['role'] } },
+      },
+    },
+  }] });
+  const roleRefKernel = createKernel({ vfs: new MemoryVfs(), eventStore: new MemoryEventStore(), validator: withRoleRefs });
+  const writeRef = (key, pathName, content) => roleRefKernel.execute({ type: 'operation', workspace_id: 'w', idempotency_key: key, path: pathName, content }, { principal });
+  await writeRef('rr-1', 'roles/admin.md', `---\ntype: security_role\ntitle: "Admin"\ndescription: "D"\ntimestamp: "2026-09-24T00:00:00Z"\nrole_id: "admin"\nname: "Admin"\npermissions: ["*:*"]\n---\n`);
+  const allowedViaAlias = await writeRef('rr-2', 'grants/g1.md', `---\ntype: grant_doc\ntitle: "G"\ndescription: "D"\ntimestamp: "2026-09-24T00:00:00Z"\nname: "G"\nrole_ref: "roles/admin.md"\n---\n`);
+  const disallowedViaAlias = await writeRef('rr-3', 'denies/d1.md', `---\ntype: deny_role_doc\ntitle: "D"\ndescription: "D"\ntimestamp: "2026-09-24T00:00:00Z"\nname: "D"\ntarget_ref: "roles/admin.md"\n---\n`);
+  check('references: allowed_types role accepts aliased security_role target', allowedViaAlias.success);
+  check('references: disallowed_types role rejects aliased security_role target', disallowedViaAlias.error?.code === 'validation_failed');
+
   // Every failure carries a symbolic code that maps to the §6.5 status table.
   const plain = createKernel({ vfs: new MemoryVfs(), eventStore: new MemoryEventStore(), leaseStore: new MemoryLeaseStore() });
   const missing = await plain.execute({ type: 'patch', workspace_id: 'w', idempotency_key: 'ec-404', path: 'rules/none.md', patches: { name: 'x' } }, { principal });
@@ -666,6 +812,7 @@ export async function runKernel09Conformance() {
     checkFrontmatterSubset(check);
   checkRequiredPresence(check);
     await checkCapabilities(temp, check);
+    checkJsonSchemas(check);
   } finally {
     fs.rmSync(temp, { recursive: true, force: true });
   }

package/scripts/ssss.mjs

@@ -41,6 +41,7 @@ Authoring, wire protocol & conformance:
   bridge [options]      Execute operations over stdin/stdout JSON (spec §6.8).
   primitive <verb>      Create, validate, inspect, migrate, or emit types.
   registry <verb>       Compose, lock, or verify an effective registry.
+  schema <verb>         Output or export canonical JSON Schemas (core, bundle).
   adapter conformance   Run machine-readable adapter contract suites.
   migrate 0.8-to-0.9    Diagnose and plan a non-destructive 0.9 migration.
   autolink [dir]        Generate OKF wiki links across a vault.
@@ -72,6 +73,7 @@ const MODULES = {
   semantic: './cmd-semantic.mjs',
   primitive: './cmd-primitive.mjs',
   registry: './cmd-registry.mjs',
+  schema: './cmd-schema.mjs',
   adapter: './cmd-adapter.mjs',
   migrate: './cmd-migrate.mjs',
   serve: './cmd-serve.mjs',