@gregiteen/ssss-cli 0.14.2 → 0.14.3

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.3] - 2026-11-03
+### Added
+- **Fail-Closed JSON Schema Validation & Validator Hardening (`SCHEMA_VALIDATION_HARDENING`)**:
+  - `src/schema-validator.mjs`: Upgraded to Draft 2020-12 specification with sibling `$ref` evaluation alongside keywords, cycle detection, `propertyNames`, `uniqueItems`, `minItems`, `maxItems`, `minLength`, `maxLength`, `minimum`, `maximum`, `const`, `allOf`, `anyOf`, `oneOf`, and `if`/`then`/`else` conditional branches.
+  - Exported convenience schema validation utilities: `getCoreRegistrySchema()`, `getBundleSchema()`, `validateRegistryAgainstSchema()`, and `validateBundleAgainstSchema()`.
+  - `schemas/core-registry.schema.json` & `schemas/bundle.schema.json`: Enforced `"additionalProperties": false` across all objects with strict `propertyNames` pattern matching, SHA-256 digest patterns, and integer minimum constraints. Conditional requirements enforce `spec_version` and `description` only for core registries.
+- **CLI `ssss schema validate`**:
+  - `scripts/cmd-schema.mjs`: Added `ssss schema validate <file> [--type core|bundle] [--schema <path>] [--json] [--quiet]` with automatic format detection.
+- **App-Local Extension Scaffolding & Isolation**:
+  - `scripts/cmd-new.mjs`: Added `--extension <name>` option to scaffold app-specific primitive extensions directly into `registry/extensions/<name>.json`, with isolated generated tests and strict name validation.
+  - `src/registry.mjs`: `loadRegistries()` supports app repositories carrying only `registry/extensions/`, automatically composing with the package core registry.
+  - Decoupled proprietary app extensions (`festech.json`, `field-crm.json`, `defaults.json`) from `registry/extensions/` to maintain a 100% vendor-neutral standard.
+  - Updated canonical reference bundle ([`conformance/reference-bundle.ucw.json`](file:///Users/gregoryiteen/github/ssss/conformance/reference-bundle.ucw.json)) to use standard core `resource` primitive.
+- **Documentation Parity & OpenWiki Sync in Release Pipeline**:
+  - `scripts/sync-docs.mjs` and `scripts/check-docs-parity.mjs`: Automatically synchronize CLI command lists, help topics, and primitive counts into `docs/help/overview.md` and enforce 100% doc parity.
+  - Initialized and ingested canonical knowledge graph hubs into `openwiki/`.
+  - `skills/push/scripts/preflight-release.mjs`: Two-phase preflight release pipeline running quality gates first, followed by OpenWiki refresh and doc parity checks.
+
+### Behavior changes hosts should check
+- Custom application extensions should reside in the application repository's own `registry/extensions/` directory rather than being contributed to core SSSS.
+- Running `ssss schema validate <file>` allows CI pipelines and hosts to validate registries and `.ucw` bundles against the standard fail-closed JSON Schemas.
+
 ## [0.14.2] - 2026-11-02
 ### Added
 - **Canonical JSON Schema Draft 2020-12 Definitions (`JSON_SCHEMA_EXPORT`)**:

package/README.md

@@ -9,12 +9,12 @@
 
 SSSS is a vendor-neutral standard and reference implementation for portable AI memory and state. It defines:
 
-- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`, `rule`, `page`, `assistant`, …), validated against a registry, not hand-written code.
+- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`, `rule`, `role`, `assistant`, …), validated against a registry, not hand-written code.
 - **The Operation Contract** (§6) — four envelope types (`operation` / `patch` / `event` / `delete`) for mutating a vault, with idempotency replay and audit.
-- **The Workflow Runtime Contract** (§11.8) — workflows own triggers; daemons, crons, and webhooks derive idempotent event/task/run envelopes from the vault.
+- **The Workflow Runtime Contract** (§11.8) — workflows and standalone triggers derive idempotent event/task/run envelopes from the vault.
 - **Multilingual semantic runtime** (§11.9) — deterministic lexical evidence, injected multilingual embeddings, and runtime rendering with symbolic controls fixed.
 - **Portability classification** (§5.5) — the keystone: every primitive is `structural`, `tenant_private`, or `resource_bound`, so a vault can be *sold* or *shared* without leaking private data.
-- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a vault, then `export → provision → import` it into a fresh environment, deterministically.
+- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a vault, then `export → provision → import → upgrade` it into a fresh environment, deterministically.
 
 This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML library to be conformant. The reference engine *is* the validator.
 
@@ -61,16 +61,17 @@ ssss import bundle.ucw.json --vault ./new-tenant \
 
 ## 0.9 application kernel
 
-SSSS 0.9 provides a shared mutation kernel and host adapter contracts for any system using SSSS:
+SSSS 0.9 provides a shared mutation kernel, canonical JSON Schemas, and host adapter contracts for any system using SSSS:
 
 ```bash
 ssss primitive create --namespace acme --name "New Item" --language en
 ssss registry compose --extension ./acme-extension.json
+ssss schema validate registry/core.json
 ssss adapter conformance
 ssss migrate 0.8-to-0.9 ./vault
 ```
 
-Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/leases`, `/events`, `/projections`, `/semantic`, `/ui`.
+Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/authorization`, `/leases`, `/idempotency`, `/intents`, `/events`, `/projections`, `/semantic`, `/ui`, `/http`, `/guard`, `/schema-validator`, `/schemas/*`.
 
 ## Commands
 
@@ -79,6 +80,7 @@ Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/leases`,
 | `ssss new <dir>` | Scaffold a new SSSS project (`--install`). |
 | `ssss primitive <verb>` | Create, validate, inspect, or migrate primitive definitions. |
 | `ssss registry <verb>` | Compose, lock, or verify an effective registry. |
+| `ssss schema <verb>` | Output, export, or validate against Draft 2020-12 JSON Schemas (`core`, `bundle`, `export`, `validate`). |
 | `ssss adapter conformance` | Run machine-readable VFS/lease/idempotency contract suites. |
 | `ssss migrate 0.8-to-0.9` | Dry-run migration diagnostics with backup manifest. |
 | `ssss export <vault>` | Package a vault into a `.ucw` bundle (§16). Pure & deterministic. |
@@ -86,10 +88,13 @@ Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/leases`,
 | `ssss inspect <bundle>` | Human-readable summary (manifest, inventory, params, steps). |
 | `ssss provision <bundle>` | Plan an install: params + link integrity → envelopes (§17). |
 | `ssss import <bundle>` | Replay a bundle/plan into a vault via the engine (idempotent). |
+| `ssss upgrade <bundle>` | Upgrade an installed vault to a new bundle version via structural patches (§17.4). |
+| `ssss serve [options]` | Start the reference HTTP server for operations (§6.8). |
+| `ssss bridge [options]` | Execute operations over stdin/stdout JSON (§6.8). |
 | `ssss semantic <vault>` | Build or query a deterministic, privacy-safe semantic index (§11.9). |
 | `ssss autolink [dir]` | Generate OKF wiki-links across a vault. |
 | `ssss conformance` | Run the canonical conformance suite (§12). |
-| `ssss help [topic]` | Local docs: `runtime`, `portability`, `bundle`, `provisioning`, `leases`, … |
+| `ssss help [topic]` | Local docs: `runtime`, `portability`, `bundle`, `provisioning`, `schema`, `leases`, … |
 
 Run `ssss <command> --help` for flags, or `ssss help <topic>` for concepts.
 
@@ -97,7 +102,7 @@ Run `ssss <command> --help` for flags, or `ssss help <topic>` for concepts.
 
 | Class | Meaning | In a `sale` export? |
 |-------|---------|---------------------|
-| `structural` | The sellable business model (`workflow`, `rule`, `page`, …). | ✅ shipped |
+| `structural` | The sellable business model (`workflow`, `rule`, `role`, …). | ✅ shipped |
 | `resource_bound` | Needs a real resource bound at provision (`domain`, `phone_number`). | ✅ shipped (as a parameter/step) |
 | `tenant_private` | The operator's private data (`task`, customer records). | ❌ **dropped** |
 
@@ -110,7 +115,7 @@ A host MUST NOT claim SSSS conformance without passing the suite in `conformance
 ```bash
 ssss conformance            # structural + registry validation
 ssss conformance --engine   # + replay all fixtures + round-trip the reference bundle
-npm test                    # == ssss conformance --engine
+npm test                    # == ssss conformance --engine + event/frontmatter/durability suites
 ```
 
 ## Repository layout
@@ -118,13 +123,16 @@ npm test                    # == ssss conformance --engine
 ```
 docs/ssss-spec.md          The normative specification (v0.9).
 docs/help/                 Topic docs surfaced by `ssss help`.
-registry/core.json         15 document + 5 contract primitives; semantic, bundle & provisioning schemas.
-registry/extensions/       Application extension registries.
+registry/core.json         20 document + 5 contract primitives; semantic, bundle & provisioning rules.
+registry/extensions/       Empty in this package; apps keep their own `registry/extensions/<app>.json` (`ssss new --extension`).
+schemas/                   Draft 2020-12 JSON Schemas (`core-registry.schema.json`, `bundle.schema.json`).
+src/kernel.mjs             Shared 0.9 mutation kernel (`kernel.execute`).
 src/engine.mjs             Operation Contract engine (§6).
 src/runtime.mjs            Workflow trigger → event/task/run envelope planning (§11.8).
 src/semantic.mjs           Multilingual semantic retrieval + runtime rendering (§11.9).
-src/bundle.mjs             export / validate / provision / import (§16–§17).
+src/bundle.mjs             export / validate / provision / import / upgrade (§16–§17).
 src/registry.mjs           Registry-driven type + portability resolution.
+src/schema-validator.mjs   Zero-dependency Draft 2020-12 JSON Schema validator.
 src/frontmatter.mjs        Zero-dependency YAML frontmatter.
 scripts/ssss.mjs           The `ssss` CLI dispatcher.
 conformance/               Canonical fixtures + reference bundle.

package/VERSION

@@ -1 +1 @@
-0.14.2
+0.14.3

package/conformance/reference-bundle.ucw.json

@@ -5,14 +5,12 @@
     "version": "1.0.0",
     "exported_at": "1970-01-01T00:00:00.000Z",
     "ssss_core_version": "0.9",
-    "required_extensions": [
-      "festech"
-    ],
+    "required_extensions": [],
     "export_profile": "sale",
     "primitive_inventory": {
       "assistant": 1,
-      "domain": 1,
       "page": 1,
+      "resource": 1,
       "security_role": 1,
       "rule": 1,
       "workflow": 1
@@ -20,18 +18,16 @@
     "dependencies": {
       "primitives": [
         "assistant",
-        "domain",
         "page",
+        "resource",
         "rule",
         "security_role",
         "workflow"
       ],
-      "extensions": [
-        "festech"
-      ],
+      "extensions": [],
       "migrations": [],
       "integrity": {
-        "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
+        "content_hash": "sha256:d6a75528fe31895ef026e5e8ec9d0eb0ec31a731315bbdd859f79a7af3b119f8",
         "ssss_core_version": "0.9"
       }
     },
@@ -59,12 +55,12 @@
         "required": false
       },
       {
-        "id": "bind-domain",
-        "label": "Bind domain",
-        "system": "domains",
+        "id": "bind-resource",
+        "label": "Bind resource",
+        "system": "accounts",
         "mode": "provision",
         "required": true,
-        "notes": "owns_domain"
+        "notes": "resource_bound requirement"
       }
     ],
     "parameters": [
@@ -92,21 +88,12 @@
         "scope": "workspace",
         "source": "user",
         "required": false
-      },
-      {
-        "key": "domain_registrar",
-        "label": "domain registrar",
-        "type": "string",
-        "scope": "workspace",
-        "source": "user",
-        "required": false,
-        "description": "Satisfies the domain resource requirement field 'registrar'."
       }
     ],
     "file_count": 14,
     "provenance": {
-      "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
-      "exporter": "@gregiteen/ssss-cli@0.14.2"
+      "content_hash": "sha256:d6a75528fe31895ef026e5e8ec9d0eb0ec31a731315bbdd859f79a7af3b119f8",
+      "exporter": "@gregiteen/ssss-cli@0.14.3"
     }
   },
   "files": [
@@ -118,14 +105,6 @@
       "path": "assistants/index.md",
       "content": "# Index — assistants\n\n- [Festival Concierge](./concierge.md)\n"
     },
-    {
-      "path": "domains/festival.md",
-      "content": "---\ntype: domain\ntitle: Festival Domain Requirement\ndescription: Domain resource requirement that the buyer binds during provisioning.\ntimestamp: \"2026-07-02T00:00:00Z\"\ndomain_name: REQUIREMENT\nregistrar: REQUIREMENT\nstatus: required\npayment_status: unbound\nx_portability: resource_bound\n---\nThis festival needs a domain. The buyer binds their own at provision (owns_domain)."
-    },
-    {
-      "path": "domains/index.md",
-      "content": "# Index — domains\n\n- [Festival Domain Requirement](./festival.md)\n"
-    },
     {
       "path": "pages/index.md",
       "content": "# Index — pages\n\n- [Lineup](./lineup.md)\n"
@@ -134,6 +113,14 @@
       "path": "pages/lineup.md",
       "content": "---\ntype: page\ntitle: Lineup\ndescription: Public-facing festival lineup page.\ntimestamp: 2026-07-02T00:00:00Z\nslug: lineup\nname: Lineup\nsandbox_entry: lineup/index.html\n---\nThe festival lineup page."
     },
+    {
+      "path": "resources/domain.md",
+      "content": "---\ntype: resource\ntitle: Festival Domain Requirement\ndescription: Domain resource requirement that the buyer binds during provisioning.\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: Festival Domain\nkind: domain\nstatus: pending\nbinds: REQUIREMENT\nx_portability: resource_bound\n---\nThis festival needs a domain. The buyer binds their own at provision."
+    },
+    {
+      "path": "resources/index.md",
+      "content": "# Index — resources\n\n- [Festival Domain Requirement](./domain.md)\n"
+    },
     {
       "path": "roles/admin/ROLE.md",
       "content": "---\ntype: security_role\ntitle: Administrator Role\ndescription: Security role with full festival operations write access.\ntimestamp: 2026-07-02T00:00:00Z\nname: Administrator\npermissions:\n  - \"write:assistant\"\n  - \"write:workflow\"\n  - \"write:rule\"\n  - \"write:domain\"\n  - \"write:page\"\n  - \"write:security_role\"\n  - \"write:task\"\n---\nFull access to all festival operations."

package/docs/help/bundle.md

@@ -14,7 +14,7 @@ integrity. The container file is conventionally named `*.ucw.json`.
     "version": "0.1.0",
     "exported_at": "1970-01-01T00:00:00.000Z",   // frozen → deterministic export
     "ssss_core_version": "0.7",
-    "required_extensions": ["festech"],
+    "required_extensions": ["acme"],
     "export_profile": "sale",                      // backup | template | sale
     "primitive_inventory": { "workflow": 1, "page": 1, "rule": 1, "assistant": 1, "domain": 1 },
     "provisioning": [ /* steps, see `ssss help provisioning` */ ],

package/docs/help/overview.md

@@ -13,13 +13,14 @@ kernel, a registry-driven validator, multilingual semantic adapters, and the
 | Piece | Where | What it is |
 |-------|-------|------------|
 | Spec | `docs/ssss-spec.md` | The normative standard. |
-| Core registry | `registry/core.json` | Document primitives + contracts for semantic (§11.9), bundle (§16), and provisioning (§17). |
+| Core registry | `registry/core.json` | 20 document primitives + 5 contract primitives; semantic (§11.9), bundle (§16), and provisioning (§17) rules. |
+| JSON Schemas | `schemas/` | Draft 2020-12 schemas (`core-registry.schema.json`, `bundle.schema.json`) + `src/schema-validator.mjs`. |
 | Kernel | `src/kernel.mjs` | Shared 0.9 mutation authority (`kernel.execute`) used by hosts and the reference engine. |
 | Engine | `src/engine.mjs` | Compatibility façade over the kernel for the §6 Operation Contract. |
 | Runtime | `src/runtime.mjs` | The §11.8 workflow trigger → event/task/run envelope planner. |
 | Semantic | `src/semantic.mjs` | Lexical evidence, multilingual embeddings, privacy filters, and runtime rendering (§11.9). |
 | Adapters | `src/vfs.mjs`, `leases.mjs`, `events.mjs`, … | Host-injectable storage/security/projection contracts. |
-| Bundle | `src/bundle.mjs` | export / validate / provision / import (§16–§17). |
+| Bundle | `src/bundle.mjs` | export / validate / provision / import / upgrade (§16–§17). |
 | Conformance | `conformance/` | Fixtures every host must pass. |
 
 ## The lifecycle
@@ -32,10 +33,6 @@ vault ──export──▶ .ucw bundle ──provision──▶ envelope plan
 ## Commands
 
 Run `ssss help <topic>` for any of:
-`runtime`, `semantic`, `portability`, `bundle`, `provisioning`,
-`export`, `provision`, `import`, `conformance`, `autolink`, `leases`,
-`concurrency`.
+`autolink`, `bundle`, `concurrency`, `conformance`, `export`, `import`, `leases`, `overview`, `portability`, `provision`, `provisioning`, `roles`, `runtime`, `scaffold`, `schema`, `semantic`.
 
-Run `ssss <command> --help` for: `export`, `validate`, `inspect`, `provision`,
-`import`, `semantic`, `primitive`, `registry`, `adapter`, `migrate`,
-`autolink`, `conformance`.
+Run `ssss <command> --help` for: `adapter`, `bridge`, `export`, `help`, `import`, `inspect`, `migrate`, `new`, `primitive`, `provision`, `registry`, `schema`, `semantic`, `serve`, `upgrade`, `validate`.

package/docs/help/schema.md

@@ -0,0 +1,40 @@
+# JSON Schemas (Draft 2020-12, spec §5 / §16)
+
+Canonical Draft 2020-12 JSON Schemas for SSSS core/extension registries and `.ucw` transport bundles.
+
+## Shipped schema files
+
+| Schema | Path / Subpath export | Governs |
+|--------|-----------------------|---------|
+| Core & Extension Registry | `@gregiteen/ssss-cli/schemas/core-registry.schema.json` | `registry/core.json`, `registry/extensions/*.json`, and runtime extension registries (§5). |
+| `.ucw` Bundle | `@gregiteen/ssss-cli/schemas/bundle.schema.json` | `.ucw` transport bundle containers and manifests (§16). |
+
+ Both schemas enforce `"additionalProperties": false` on structured objects so unknown or misspelled properties fail closed.
+
+## CLI commands
+
+```bash
+ssss schema core                                       # Print the core/extension registry schema
+ssss schema bundle --out ./bundle.schema.json          # Write the bundle schema to a file
+ssss schema export --out ./schemas                     # Copy both schemas into a directory
+ssss schema validate registry/core.json                # Validate a registry or bundle JSON file
+ssss schema validate festival.ucw.json --type bundle   # Explicit schema kind
+ssss schema validate custom.json --json                # Machine-readable validation report
+```
+
+## Programmatic API (`@gregiteen/ssss-cli/schema-validator`)
+
+```js
+import {
+  getCoreRegistrySchema,
+  getBundleSchema,
+  validateRegistryAgainstSchema,
+  validateBundleAgainstSchema,
+  validateJsonSchema,
+} from '@gregiteen/ssss-cli/schema-validator';
+
+const { valid, errors } = validateRegistryAgainstSchema(myExtensionRegistry);
+```
+
+Commands: `ssss schema`, `ssss registry`, `ssss validate`.
+See also: `ssss help bundle`, `ssss help overview`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gregiteen/ssss-cli",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "CLI tools and the reference engine for the Structured Semantic Syntax System",
   "main": "src/engine.mjs",
   "exports": {
@@ -32,7 +32,11 @@
     "./conformance/fixtures.json": "./conformance/fixtures.json",
     "./conformance/reference-bundle.ucw.json": "./conformance/reference-bundle.ucw.json",
     "./registry/core.json": "./registry/core.json",
-    "./schema-validator": "./src/schema-validator.mjs",
+    "./schema-validator": {
+      "types": "./types/schema-validator.d.ts",
+      "import": "./src/schema-validator.mjs",
+      "default": "./src/schema-validator.mjs"
+    },
     "./schemas/*": "./schemas/*",
     "./package.json": "./package.json"
   },

package/registry/core.json

@@ -269,7 +269,7 @@
     "classes": {
       "structural": "The reusable business model — sellable and templatable. Carries no operator- or customer-specific data. Examples: workflow, assistant, page, skill, model, rule, memory, migration, release.",
       "tenant_private": "The operator's private operational data — customers, transcripts, runtime work. NEVER leaves the workspace in a template or sale bundle; included only in an encrypted backup. Examples: conversation, run, task, conflict, and (via extension) profile / CRM contact / deal.",
-      "resource_bound": "Requires a real external resource bound at provision time (a domain, phone number, mailbox, API connection). NEVER ships the seller's resource value; ships only a requirement declaration the buyer satisfies. Defined by extension registries (e.g. festech domain / phone_number / integration_connection)."
+      "resource_bound": "Requires a real external resource bound at provision time (a domain, phone number, mailbox, API connection). NEVER ships the seller's resource value; ships only a requirement declaration the buyer satisfies. Defined by extension registries (e.g. a domain, phone_number, or integration_connection primitive)."
     },
     "export_profiles": {
       "backup": { "includes": ["structural", "tenant_private", "resource_bound"], "note": "Complete fidelity copy. tenant_private MUST be encrypted at rest." },

package/schemas/bundle.schema.json

@@ -8,7 +8,12 @@
     "manifest",
     "files"
   ],
+  "additionalProperties": false,
   "properties": {
+    "$schema": {
+      "type": "string",
+      "minLength": 1
+    },
     "manifest": {
       "$ref": "#/$defs/bundleManifest"
     },
@@ -29,9 +34,11 @@
         "path",
         "content"
       ],
+      "additionalProperties": false,
       "properties": {
         "path": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "content": {
           "type": "string"
@@ -53,27 +60,34 @@
         "file_count",
         "provenance"
       ],
+      "additionalProperties": false,
       "properties": {
         "name": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "description": {
           "type": "string"
         },
         "version": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "exported_at": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "ssss_core_version": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "required_extensions": {
           "type": "array",
           "items": {
-            "type": "string"
-          }
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
         },
         "export_profile": {
           "type": "string",
@@ -82,38 +96,51 @@
         "primitive_inventory": {
           "type": "object",
           "additionalProperties": {
-            "type": "integer"
+            "type": "integer",
+            "minimum": 0
           }
         },
         "dependencies": {
           "type": "object",
+          "additionalProperties": false,
           "properties": {
             "primitives": {
               "type": "array",
-              "items": { "type": "string" }
+              "items": { "type": "string", "minLength": 1 },
+              "uniqueItems": true
             },
             "extensions": {
               "type": "array",
-              "items": { "type": "string" }
+              "items": { "type": "string", "minLength": 1 },
+              "uniqueItems": true
             },
             "migrations": {
               "type": "array",
-              "items": { "type": "string" }
+              "items": { "type": "string", "minLength": 1 },
+              "uniqueItems": true
             },
             "integrity": {
               "type": "object",
+              "additionalProperties": false,
               "properties": {
-                "content_hash": { "type": "string" },
-                "ssss_core_version": { "type": "string" }
+                "content_hash": {
+                  "type": "string",
+                  "pattern": "^sha256:[a-f0-9]{64}$"
+                },
+                "ssss_core_version": {
+                  "type": "string",
+                  "minLength": 1
+                }
               }
             },
             "bundles": {
               "type": "array",
               "items": {
                 "type": "object",
+                "additionalProperties": false,
                 "properties": {
-                  "id": { "type": "string" },
-                  "name": { "type": "string" },
+                  "id": { "type": "string", "minLength": 1 },
+                  "name": { "type": "string", "minLength": 1 },
                   "version": { "type": "string" },
                   "installMode": {
                     "type": "string",
@@ -137,7 +164,8 @@
           }
         },
         "file_count": {
-          "type": "integer"
+          "type": "integer",
+          "minimum": 0
         },
         "provenance": {
           "type": "object",
@@ -145,20 +173,25 @@
             "content_hash",
             "exporter"
           ],
+          "additionalProperties": false,
           "properties": {
             "content_hash": {
-              "type": "string"
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
             },
             "exporter": {
-              "type": "string"
+              "type": "string",
+              "minLength": 1
             },
             "signature": {
-              "type": "string"
+              "type": "string",
+              "minLength": 1
             }
           }
         },
         "source_workspace_id": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "branding": {
           "type": "object"
@@ -174,12 +207,15 @@
         "mode",
         "required"
       ],
+      "additionalProperties": false,
       "properties": {
         "id": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "label": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "system": {
           "type": "string",
@@ -223,18 +259,23 @@
         "scope",
         "source"
       ],
+      "additionalProperties": false,
       "properties": {
         "key": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "label": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "type": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "scope": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "source": {
           "type": "string",