@gregiteen/ssss-cli 0.14.1 → 0.14.2

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.2] - 2026-11-02
+### Added
+- **Canonical JSON Schema Draft 2020-12 Definitions (`JSON_SCHEMA_EXPORT`)**:
+  - `schemas/core-registry.schema.json`: Formal JSON Schema Draft 2020-12 defining the full structure of `registry/core.json` and extension registries (document primitives, contract primitives, universal frontmatter, portability classes and export profiles, bundle manifest specifications, provisioning steps and relations, runtime contracts, and semantic search fields).
+  - `schemas/bundle.schema.json`: Formal JSON Schema Draft 2020-12 defining the container format for Universal Cloud Workspace (`.ucw`) transport bundles, covering `manifest`, `files`, `dependencies`, `parameters`, `provisioning`, `provenance`, and optional `branding`.
+  - `registry/core.json`: Updated `$schema` URI to point to `https://ssss.dev/schemas/core-registry.schema.json`.
+- **Zero-Dependency Schema Validation**:
+  - `src/schema-validator.mjs`: High-performance, recursive JSON Schema Draft 2020-12 validator in pure Node ESM supporting `type` unions, `properties`, `additionalProperties`, `required`, `items`, `enum`, `pattern`, and local `$defs`/`$ref` pointers.
+  - Exported `./schema-validator` and `./schemas/*` via package exports and added `"schemas"` to npm package distribution files.
+- **CLI Schema Inspection & Export**:
+  - `scripts/cmd-schema.mjs`: Added `ssss schema core`, `ssss schema bundle`, and `ssss schema export [--out <dir>]` subcommands to output and export canonical JSON Schemas.
+- **Automated Conformance Sweeps**:
+  - `scripts/conformance-09.mjs`: Integrated automated schema validation checks into continuous test suites, verifying `registry/core.json` and `conformance/reference-bundle.ucw.json` against canonical schemas with negative mutation testing.
+- **Specification and Backlog Hygiene**:
+  - `docs/ssss-spec.md`: Documented canonical JSON Schema references in §5.1 and §16.1.
+  - Resolved and closed all outstanding host deferral items in `docs/projects/DEFERRED_BACKLOG.md`.
+
+### Behavior changes hosts should check
+- Tools and IDEs may validate `registry/core.json` and `.ucw` bundle files directly against `schemas/core-registry.schema.json` and `schemas/bundle.schema.json`.
+- The CLI command `ssss schema export` is now available to export canonical schema definitions for external consumption.
+
 ## [0.14.1] - 2026-11-02
 ### Added
 - **Core primitive aliasing (`role` ↔ `security_role`, `thread` ↔ `conversation`)**:

package/VERSION

@@ -1 +1 @@
-0.14.1
+0.14.2

package/conformance/reference-bundle.ucw.json

@@ -106,7 +106,7 @@
     "file_count": 14,
     "provenance": {
       "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
-      "exporter": "@gregiteen/ssss-cli@0.14.1"
+      "exporter": "@gregiteen/ssss-cli@0.14.2"
     }
   },
   "files": [

package/docs/ssss-spec.md

@@ -261,8 +261,9 @@ primitive — it implements the subset its product requires — but any primitiv
 | `primitive` | meta | structural | A governed, versioned definition for a namespaced SSSS primitive. |
 
 The **Portability** column is the primitive's default portability class (§5.5); a host
-resolves it from `registry/core.json`. Extension registries assign their own primitives a
-class — notably `resource_bound` for things like domains and phone numbers.
+resolves it from `registry/core.json`. The canonical machine-readable registry conforms to the
+JSON Schema (Draft 2020-12) published in `schemas/core-registry.schema.json`. Extension registries
+assign their own primitives a class — notably `resource_bound` for things like domains and phone numbers.
 
 ### 5.2 Contract Primitives
 
@@ -1869,7 +1870,9 @@ A bundle is a JSON object with three top-level members:
 ```
 
 `files` MUST be sorted by `path` (§16.3 order) so that two exports of the same vault state
-are identical and content-hashable (§16.3, `provenance.content_hash`).
+are identical and content-hashable (§16.3, `provenance.content_hash`). The normative JSON Schema
+(Draft 2020-12) for `.ucw` bundle containers is published in `schemas/bundle.schema.json` and
+exportable via the CLI command `ssss schema bundle`.
 
 ### 16.2 The Manifest
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gregiteen/ssss-cli",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "CLI tools and the reference engine for the Structured Semantic Syntax System",
   "main": "src/engine.mjs",
   "exports": {
@@ -32,6 +32,8 @@
     "./conformance/fixtures.json": "./conformance/fixtures.json",
     "./conformance/reference-bundle.ucw.json": "./conformance/reference-bundle.ucw.json",
     "./registry/core.json": "./registry/core.json",
+    "./schema-validator": "./src/schema-validator.mjs",
+    "./schemas/*": "./schemas/*",
     "./package.json": "./package.json"
   },
   "bin": {
@@ -43,6 +45,7 @@
   },
   "files": [
     "src",
+    "schemas",
     "types",
     "scripts",
     "registry",

package/registry/core.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://ssss.dev/registry/v1",
+  "$schema": "https://ssss.dev/schemas/core-registry.schema.json",
   "registry": "core",
   "spec_version": "0.9",
   "description": "The canonical SSSS core registry and semantic application-kernel contract. Core primitives are qualified as ssss:<name>; applications define namespaced primitives through layered extension registries without copying or redefining core behavior.",

package/schemas/bundle.schema.json

@@ -0,0 +1,259 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ssss.dev/schemas/bundle.schema.json",
+  "title": "SSSS Universal Cloud Workspace (.ucw) Bundle Schema",
+  "description": "JSON Schema for SSSS transport bundles and manifests (spec §16).",
+  "type": "object",
+  "required": [
+    "manifest",
+    "files"
+  ],
+  "properties": {
+    "manifest": {
+      "$ref": "#/$defs/bundleManifest"
+    },
+    "files": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/bundleFile"
+      }
+    },
+    "branding": {
+      "type": "object"
+    }
+  },
+  "$defs": {
+    "bundleFile": {
+      "type": "object",
+      "required": [
+        "path",
+        "content"
+      ],
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "content": {
+          "type": "string"
+        }
+      }
+    },
+    "bundleManifest": {
+      "type": "object",
+      "required": [
+        "name",
+        "description",
+        "version",
+        "exported_at",
+        "ssss_core_version",
+        "required_extensions",
+        "export_profile",
+        "primitive_inventory",
+        "provisioning",
+        "file_count",
+        "provenance"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "exported_at": {
+          "type": "string"
+        },
+        "ssss_core_version": {
+          "type": "string"
+        },
+        "required_extensions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "export_profile": {
+          "type": "string",
+          "enum": ["backup", "template", "sale"]
+        },
+        "primitive_inventory": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "integer"
+          }
+        },
+        "dependencies": {
+          "type": "object",
+          "properties": {
+            "primitives": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "extensions": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "migrations": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "integrity": {
+              "type": "object",
+              "properties": {
+                "content_hash": { "type": "string" },
+                "ssss_core_version": { "type": "string" }
+              }
+            },
+            "bundles": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "id": { "type": "string" },
+                  "name": { "type": "string" },
+                  "version": { "type": "string" },
+                  "installMode": {
+                    "type": "string",
+                    "enum": ["optional", "recommended", "required"]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "provisioning": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/provisioningStep"
+          }
+        },
+        "parameters": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/provisioningParameter"
+          }
+        },
+        "file_count": {
+          "type": "integer"
+        },
+        "provenance": {
+          "type": "object",
+          "required": [
+            "content_hash",
+            "exporter"
+          ],
+          "properties": {
+            "content_hash": {
+              "type": "string"
+            },
+            "exporter": {
+              "type": "string"
+            },
+            "signature": {
+              "type": "string"
+            }
+          }
+        },
+        "source_workspace_id": {
+          "type": "string"
+        },
+        "branding": {
+          "type": "object"
+        }
+      }
+    },
+    "provisioningStep": {
+      "type": "object",
+      "required": [
+        "id",
+        "label",
+        "system",
+        "mode",
+        "required"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "label": {
+          "type": "string"
+        },
+        "system": {
+          "type": "string",
+          "enum": [
+            "workspace",
+            "branding",
+            "email",
+            "phone",
+            "domains",
+            "accounts",
+            "deployments",
+            "marketplace",
+            "tabs",
+            "automation"
+          ]
+        },
+        "mode": {
+          "type": "string",
+          "enum": [
+            "existing",
+            "provision",
+            "install",
+            "generate",
+            "configure"
+          ]
+        },
+        "required": {
+          "type": "boolean"
+        },
+        "notes": {
+          "type": "string"
+        }
+      }
+    },
+    "provisioningParameter": {
+      "type": "object",
+      "required": [
+        "key",
+        "label",
+        "type",
+        "scope",
+        "source"
+      ],
+      "properties": {
+        "key": {
+          "type": "string"
+        },
+        "label": {
+          "type": "string"
+        },
+        "type": {
+          "type": "string"
+        },
+        "scope": {
+          "type": "string"
+        },
+        "source": {
+          "type": "string",
+          "enum": ["user", "llm", "graph", "system"]
+        },
+        "required": {
+          "type": "boolean"
+        },
+        "description": {
+          "type": "string"
+        },
+        "defaultValue": {},
+        "options": {
+          "type": "array"
+        },
+        "dependsOn": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/schemas/core-registry.schema.json

@@ -0,0 +1,386 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ssss.dev/schemas/core-registry.schema.json",
+  "title": "SSSS Core Registry Schema",
+  "description": "JSON Schema for SSSS core and extension registries (spec §5).",
+  "type": "object",
+  "required": [
+    "registry",
+    "spec_version",
+    "description",
+    "document_primitives"
+  ],
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "registry": {
+      "type": "string"
+    },
+    "spec_version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "conformance": {
+      "type": "string"
+    },
+    "document_primitives": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/primitiveDefinition"
+      }
+    },
+    "contract_primitives": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/contractPrimitive"
+      }
+    },
+    "universal_frontmatter": {
+      "type": "object",
+      "required": ["required"],
+      "properties": {
+        "required": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "recommended_okf": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "recommended_semantic": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "spec_ref": {
+          "type": "string"
+        }
+      }
+    },
+    "portability": {
+      "type": "object",
+      "required": ["classes", "export_profiles"],
+      "properties": {
+        "description": { "type": "string" },
+        "classes": {
+          "type": "object",
+          "additionalProperties": { "type": "string" }
+        },
+        "export_profiles": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "required": ["includes"],
+            "properties": {
+              "includes": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "excludes": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "resource_bound": { "type": "string" },
+              "note": { "type": "string" }
+            }
+          }
+        },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "bundle": {
+      "type": "object",
+      "required": [
+        "container",
+        "structure",
+        "manifest_required_fields",
+        "provenance_required_fields"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "container": { "type": "string" },
+        "structure": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "file_sort": { "type": "string" },
+        "manifest_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "manifest_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "provenance_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "provenance_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "content_hash": { "type": "string" },
+        "parameter_fields": {
+          "type": "object",
+          "required": ["required"],
+          "properties": {
+            "required": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "optional": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "source_enum": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "note": { "type": "string" }
+          }
+        },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "provisioning": {
+      "type": "object",
+      "required": [
+        "verbs",
+        "step_required_fields",
+        "system_enum",
+        "mode_enum"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "verbs": {
+          "type": "object",
+          "additionalProperties": { "type": "string" }
+        },
+        "step_required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "step_optional_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "system_enum": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "mode_enum": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "edge_relations": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "install_modes": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "id_remap": { "type": "string" },
+        "upgrade": { "type": "string" },
+        "conformance": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "required": [
+        "trigger_types",
+        "misfire_policies",
+        "concurrency_policies",
+        "task_instantiation_fields",
+        "run_statuses",
+        "idempotency_basis"
+      ],
+      "properties": {
+        "description": { "type": "string" },
+        "trigger_types": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "misfire_policies": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "concurrency_policies": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "task_instantiation_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "run_statuses": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "idempotency_basis": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "semantic": {
+      "type": "object",
+      "required": [
+        "version",
+        "identity_fields",
+        "surface_fields",
+        "relation_fields",
+        "renderable_fields",
+        "language_pattern",
+        "safe_default"
+      ],
+      "properties": {
+        "version": { "type": "integer" },
+        "identity_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "surface_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "relation_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "renderable_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "language_pattern": { "type": "string" },
+        "safe_default": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    },
+    "reserved_keys": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "host_field_prefix": { "type": "string" },
+    "spec_ref_reserved": { "type": "string" }
+  },
+  "$defs": {
+    "primitiveDefinition": {
+      "type": "object",
+      "required": [
+        "family",
+        "append_only",
+        "portability",
+        "required_fields"
+      ],
+      "properties": {
+        "family": {
+          "type": "string"
+        },
+        "canonical_filename": {
+          "type": ["string", "null"]
+        },
+        "filename_convention": {
+          "type": "string"
+        },
+        "append_only": {
+          "type": "boolean"
+        },
+        "portability": {
+          "type": "string",
+          "enum": ["structural", "tenant_private", "resource_bound"]
+        },
+        "required_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "required_when": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "enums": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "patterns": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "immutable_fields": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "references": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "allowed_types": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "disallowed_types": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "allowed_portability": {
+                "type": "array",
+                "items": { "type": "string" }
+              },
+              "must_exist": {
+                "type": "boolean"
+              },
+              "hash_field": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "aliases": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "deprecated": {
+          "type": "boolean"
+        },
+        "deprecation_notice": {
+          "type": "string"
+        },
+        "resource": {
+          "type": "object",
+          "properties": {
+            "kind": { "type": "string" },
+            "provision_relation": { "type": "string" }
+          }
+        },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "spec_ref": {
+          "type": "string"
+        }
+      }
+    },
+    "contractPrimitive": {
+      "type": "object",
+      "required": ["purpose", "spec_ref"],
+      "properties": {
+        "purpose": { "type": "string" },
+        "spec_ref": { "type": "string" }
+      }
+    }
+  }
+}

package/scripts/check-commit-durability.mjs

@@ -306,6 +306,7 @@ async function checkRecoveryTriggers(root) {
   const untouched = read(live, 'rules/live.md').includes('in flight');
   holder.child.kill('SIGKILL');
   const signal = await holder.exited;
+  await new Promise((resolve) => setTimeout(resolve, 50));
   const afterKill = await fileKernel(live).recover();
   check('recovery skips an intent whose writer is alive',
     whileAlive.length === 1 && whileAlive[0].outcome === 'in_flight' && untouched, JSON.stringify(whileAlive));

package/scripts/cmd-schema.mjs

@@ -0,0 +1,62 @@
+/**
+ * Schema export and inspection commands for SSSS.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseArgs, die, wantsHelp } from './lib/cli.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..');
+const SCHEMAS_DIR = path.resolve(ROOT, 'schemas');
+
+const HELP = `Usage: ssss schema core|bundle|export [options]
+
+Commands:
+  core [--out <file>]      Output the Core Registry JSON Schema.
+  bundle [--out <file>]    Output the .ucw Bundle JSON Schema.
+  export [--out <dir>]     Export all canonical schemas to a directory (default: ./schemas).
+`;
+
+function emit(value, output) {
+  const text = typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`;
+  if (output) {
+    fs.mkdirSync(path.dirname(path.resolve(output)), { recursive: true });
+    fs.writeFileSync(path.resolve(output), text, { encoding: 'utf8' });
+  } else {
+    process.stdout.write(text);
+  }
+}
+
+export async function run(argv) {
+  if (wantsHelp(argv)) { console.log(HELP); return; }
+  const verb = argv[0];
+  const { flags } = parseArgs(argv.slice(1));
+
+  try {
+    const coreSchemaPath = path.join(SCHEMAS_DIR, 'core-registry.schema.json');
+    const bundleSchemaPath = path.join(SCHEMAS_DIR, 'bundle.schema.json');
+
+    if (verb === 'core') {
+      const content = fs.readFileSync(coreSchemaPath, 'utf8');
+      emit(content, flags.out);
+      return;
+    }
+    if (verb === 'bundle') {
+      const content = fs.readFileSync(bundleSchemaPath, 'utf8');
+      emit(content, flags.out);
+      return;
+    }
+    if (verb === 'export') {
+      const targetDir = path.resolve(flags.out || './schemas');
+      fs.mkdirSync(targetDir, { recursive: true });
+      fs.copyFileSync(coreSchemaPath, path.join(targetDir, 'core-registry.schema.json'));
+      fs.copyFileSync(bundleSchemaPath, path.join(targetDir, 'bundle.schema.json'));
+      console.log(`Exported canonical schemas to ${targetDir}`);
+      return;
+    }
+    die(`Unknown schema verb '${verb || ''}'.\n${HELP}`);
+  } catch (error) {
+    die(error.message);
+  }
+}

package/scripts/conformance-09.mjs

@@ -33,6 +33,7 @@ import { MemoryIdempotencyStore, FileIdempotencyStore, runIdempotencyContract }
 import { capabilityCovers, createCapabilityAuthorizer } from '../src/authorization.mjs';
 import { createEngine } from '../src/engine.mjs';
 import { validateVerifiedPrincipal } from '../src/authorization.mjs';
+import { validateJsonSchema } from '../src/schema-validator.mjs';
 
 async function rejects(promise, pattern) {
   try { await promise; return false; } catch (error) { return pattern.test(error.message); }
@@ -438,6 +439,32 @@ async function checkCapabilities(root, check) {
     (await writeScoped('ps-2', 'rules/engineering/lint.md', doc('rule', 'Lint'))).error?.code === 'forbidden');
 }
 
+function checkJsonSchemas(check) {
+  const coreRegistry = JSON.parse(fs.readFileSync(path.resolve('registry/core.json'), 'utf8'));
+  const coreSchema = JSON.parse(fs.readFileSync(path.resolve('schemas/core-registry.schema.json'), 'utf8'));
+  const coreResult = validateJsonSchema(coreRegistry, coreSchema);
+  check('schema: registry/core.json validates against schemas/core-registry.schema.json', coreResult.valid, coreResult.errors?.[0]?.message);
+
+  const bundle = JSON.parse(fs.readFileSync(path.resolve('conformance/reference-bundle.ucw.json'), 'utf8'));
+  const bundleSchema = JSON.parse(fs.readFileSync(path.resolve('schemas/bundle.schema.json'), 'utf8'));
+  const bundleResult = validateJsonSchema(bundle, bundleSchema);
+  check('schema: reference-bundle.ucw.json validates against schemas/bundle.schema.json', bundleResult.valid, bundleResult.errors?.[0]?.message);
+
+  const badCore = { ...coreRegistry };
+  delete badCore.spec_version;
+  const badCoreResult = validateJsonSchema(badCore, coreSchema);
+  check('schema: core registry schema rejects missing spec_version', !badCoreResult.valid && badCoreResult.errors.some((e) => e.path.includes('spec_version')));
+
+  const badPortability = JSON.parse(JSON.stringify(coreRegistry));
+  badPortability.document_primitives.memory.portability = 'illegal_class';
+  const badPortResult = validateJsonSchema(badPortability, coreSchema);
+  check('schema: core registry schema rejects invalid portability enum', !badPortResult.valid && badPortResult.errors.some((e) => e.path.includes('portability')));
+
+  const badBundle = { files: [] };
+  const badBundleResult = validateJsonSchema(badBundle, bundleSchema);
+  check('schema: bundle schema rejects missing manifest', !badBundleResult.valid && badBundleResult.errors.some((e) => e.path.includes('manifest')));
+}
+
 // Resource hooks (spec §6.3): every prepare ends in exactly one finalize or
 // reconcile, and nothing after the event append may undo the commit.
 async function checkResourceLifecycle(check) {
@@ -785,6 +812,7 @@ export async function runKernel09Conformance() {
     checkFrontmatterSubset(check);
   checkRequiredPresence(check);
     await checkCapabilities(temp, check);
+    checkJsonSchemas(check);
   } finally {
     fs.rmSync(temp, { recursive: true, force: true });
   }

package/scripts/ssss.mjs

@@ -41,6 +41,7 @@ Authoring, wire protocol & conformance:
   bridge [options]      Execute operations over stdin/stdout JSON (spec §6.8).
   primitive <verb>      Create, validate, inspect, migrate, or emit types.
   registry <verb>       Compose, lock, or verify an effective registry.
+  schema <verb>         Output or export canonical JSON Schemas (core, bundle).
   adapter conformance   Run machine-readable adapter contract suites.
   migrate 0.8-to-0.9    Diagnose and plan a non-destructive 0.9 migration.
   autolink [dir]        Generate OKF wiki links across a vault.
@@ -72,6 +73,7 @@ const MODULES = {
   semantic: './cmd-semantic.mjs',
   primitive: './cmd-primitive.mjs',
   registry: './cmd-registry.mjs',
+  schema: './cmd-schema.mjs',
   adapter: './cmd-adapter.mjs',
   migrate: './cmd-migrate.mjs',
   serve: './cmd-serve.mjs',

package/skills/ssss/SKILL.md

@@ -4,7 +4,7 @@ title: SSSS Protocol Reference
 name: ssss
 description: Validate or change SSSS documents, operations, registries, workflows and portable host adapters.
 timestamp: 2026-11-02T19:00:00Z
-version: 0.14.1
+version: 0.14.2
 repo_scoped: false
 ---
 

package/skills/ssss/core/SKILL.md

@@ -1,4 +1,4 @@
-# SSSS portable core — 0.14.1
+# SSSS portable core — 0.14.2
 
 Verified against the SSSS owner package, registry and spec on 2026-11-02. Establish ground truth from the installed validator, composed registry plus lock, and actual host mutation path. Schema support does not prove a configured runner or provider integration.
 
@@ -15,4 +15,4 @@ Preserve portability classes: structural definitions, tenant-private data and re
 ## Verification
 Run relevant schema/registry/lock and operation conformance, with valid and invalid examples. Cover duplicate/conflicting idempotency (including retries answered from the event log), unsafe paths, unauthorized/expired actors, leases, append semantics, rollback and commit-intent crash recovery where changed. Use `ssss --help`, then operation-specific help; commands differ by installed version. Report exact package version, registry/lock identity and actual results. Keep secrets and private runtime data out of skill content, bundles and logs.
 
-Normative sources are bundled below from the owner release tag v0.14.1 (`docs/ssss-spec.md` and `registry/core.json` at that tag). Retain authored local wrappers/references; this managed core is the portable update boundary.
+Normative sources are bundled below from the owner release tag v0.14.2 (`docs/ssss-spec.md` and `registry/core.json` at that tag). Retain authored local wrappers/references; this managed core is the portable update boundary.

package/skills/ssss/core/references/core-registry.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://ssss.dev/registry/v1",
+  "$schema": "https://ssss.dev/schemas/core-registry.schema.json",
   "registry": "core",
   "spec_version": "0.9",
   "description": "The canonical SSSS core registry and semantic application-kernel contract. Core primitives are qualified as ssss:<name>; applications define namespaced primitives through layered extension registries without copying or redefining core behavior.",

package/skills/ssss/core/references/ssss-spec.md

@@ -261,8 +261,9 @@ primitive — it implements the subset its product requires — but any primitiv
 | `primitive` | meta | structural | A governed, versioned definition for a namespaced SSSS primitive. |
 
 The **Portability** column is the primitive's default portability class (§5.5); a host
-resolves it from `registry/core.json`. Extension registries assign their own primitives a
-class — notably `resource_bound` for things like domains and phone numbers.
+resolves it from `registry/core.json`. The canonical machine-readable registry conforms to the
+JSON Schema (Draft 2020-12) published in `schemas/core-registry.schema.json`. Extension registries
+assign their own primitives a class — notably `resource_bound` for things like domains and phone numbers.
 
 ### 5.2 Contract Primitives
 
@@ -1869,7 +1870,9 @@ A bundle is a JSON object with three top-level members:
 ```
 
 `files` MUST be sorted by `path` (§16.3 order) so that two exports of the same vault state
-are identical and content-hashable (§16.3, `provenance.content_hash`).
+are identical and content-hashable (§16.3, `provenance.content_hash`). The normative JSON Schema
+(Draft 2020-12) for `.ucw` bundle containers is published in `schemas/bundle.schema.json` and
+exportable via the CLI command `ssss schema bundle`.
 
 ### 16.2 The Manifest
 

package/src/schema-validator.mjs

@@ -0,0 +1,134 @@
+/**
+ * Zero-dependency JSON Schema validator for SSSS core and bundle schemas.
+ *
+ * Implements validation for standard JSON Schema Draft 2020-12 constructs
+ * used by SSSS schemas:
+ *   - type (single or union)
+ *   - properties & additionalProperties
+ *   - required
+ *   - items
+ *   - enum
+ *   - pattern
+ *   - $ref (local root-anchored pointers: #/$defs/...)
+ */
+
+function resolveRef(root, ref) {
+  if (!ref.startsWith('#/')) {
+    throw new Error(`Only local root-anchored $ref pointers are supported: ${ref}`);
+  }
+  const parts = ref.slice(2).split('/');
+  let current = root;
+  for (const part of parts) {
+    if (current == null || typeof current !== 'object') {
+      throw new Error(`Unable to resolve $ref pointer: ${ref}`);
+    }
+    current = current[part];
+  }
+  return current;
+}
+
+function matchType(value, expectedType) {
+  if (Array.isArray(expectedType)) {
+    return expectedType.some((t) => matchType(value, t));
+  }
+  switch (expectedType) {
+    case 'string':
+      return typeof value === 'string';
+    case 'number':
+      return typeof value === 'number' && !Number.isNaN(value);
+    case 'integer':
+      return Number.isInteger(value);
+    case 'boolean':
+      return typeof value === 'boolean';
+    case 'object':
+      return typeof value === 'object' && value !== null && !Array.isArray(value);
+    case 'array':
+      return Array.isArray(value);
+    case 'null':
+      return value === null;
+    default:
+      return true;
+  }
+}
+
+export function validateJsonSchema(data, schema, options = {}) {
+  const root = options.rootSchema || schema;
+  const errors = [];
+
+  function validate(value, curSchema, path) {
+    if (!curSchema || typeof curSchema !== 'object') return;
+
+    if (curSchema.$ref) {
+      const resolved = resolveRef(root, curSchema.$ref);
+      validate(value, resolved, path);
+      return;
+    }
+
+    if (curSchema.type !== undefined) {
+      if (!matchType(value, curSchema.type)) {
+        errors.push({
+          path,
+          message: `Expected type ${JSON.stringify(curSchema.type)}, but received ${Array.isArray(value) ? 'array' : value === null ? 'null' : typeof value}.`,
+        });
+        return;
+      }
+    }
+
+    if (curSchema.enum !== undefined && !curSchema.enum.includes(value)) {
+      errors.push({
+        path,
+        message: `Value ${JSON.stringify(value)} is not in enum: ${curSchema.enum.map((e) => JSON.stringify(e)).join(', ')}.`,
+      });
+    }
+
+    if (typeof value === 'string' && curSchema.pattern !== undefined) {
+      const reg = new RegExp(curSchema.pattern);
+      if (!reg.test(value)) {
+        errors.push({
+          path,
+          message: `String does not match pattern ${curSchema.pattern}.`,
+        });
+      }
+    }
+
+    if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      if (Array.isArray(curSchema.required)) {
+        for (const reqKey of curSchema.required) {
+          if (value[reqKey] === undefined) {
+            errors.push({
+              path: path ? `${path}.${reqKey}` : reqKey,
+              message: `Missing required property '${reqKey}'.`,
+            });
+          }
+        }
+      }
+
+      const definedKeys = new Set(Object.keys(curSchema.properties || {}));
+      for (const [key, val] of Object.entries(value)) {
+        const subPath = path ? `${path}.${key}` : key;
+        if (definedKeys.has(key)) {
+          validate(val, curSchema.properties[key], subPath);
+        } else if (curSchema.additionalProperties === false) {
+          errors.push({
+            path: subPath,
+            message: `Unexpected property '${key}' not defined in schema.`,
+          });
+        } else if (typeof curSchema.additionalProperties === 'object' && curSchema.additionalProperties !== null) {
+          validate(val, curSchema.additionalProperties, subPath);
+        }
+      }
+    }
+
+    if (Array.isArray(value) && curSchema.items) {
+      for (let i = 0; i < value.length; i++) {
+        validate(value[i], curSchema.items, `${path}[${i}]`);
+      }
+    }
+  }
+
+  validate(data, schema, '');
+  return {
+    valid: errors.length === 0,
+    errors,
+  };
+}