@gregiteen/ssss-cli 0.7.0

package/conformance/fixtures.json

@@ -0,0 +1,763 @@
+{
+  "$schema": "https://ssss.dev/conformance/v1",
+  "version": "1.4.0",
+  "description": "Canonical SSSS Operation Contract conformance fixtures. These define the canonical request/response shapes for the Operation Contract (spec §6) and are the shared test contract every SSSS implementation MUST pass. A host is conformant only if, for every fixture, it produces the expected response and status code (spec §12).",
+  "spec_url": "../docs/ssss-spec.md",
+  "operation_types": {
+    "operation": {
+      "description": "Full atomic file write. Creates or fully replaces a VFS file.",
+      "required_fields": [
+        "type",
+        "idempotency_key",
+        "path",
+        "workspace_id",
+        "content"
+      ],
+      "optional_fields": [
+        "lease_id",
+        "intent",
+        "dry_run",
+        "actor"
+      ]
+    },
+    "patch": {
+      "description": "Partial frontmatter or body merge into an existing VFS file.",
+      "required_fields": [
+        "type",
+        "idempotency_key",
+        "path",
+        "workspace_id",
+        "patches"
+      ],
+      "optional_fields": [
+        "lease_id",
+        "intent",
+        "dry_run",
+        "actor"
+      ],
+      "patches_body_key": "__body__"
+    },
+    "event": {
+      "description": "Append-only immutable event. Never overwrites; stored in the SSSS event log.",
+      "required_fields": [
+        "type",
+        "idempotency_key",
+        "path",
+        "workspace_id",
+        "content"
+      ],
+      "optional_fields": [
+        "intent",
+        "actor"
+      ],
+      "note": "Content must be a valid JSON string for the event payload. Gated by the fixed 'write:event' permission (spec §6.3 Stage 5.5), not a resolved document type."
+    },
+    "delete": {
+      "description": "Deletes a VFS file.",
+      "required_fields": [
+        "type",
+        "idempotency_key",
+        "path",
+        "workspace_id"
+      ],
+      "optional_fields": [
+        "intent",
+        "actor"
+      ]
+    }
+  },
+  "idempotency": {
+    "ttl_hours": 24,
+    "key_format": "UUID v4 recommended",
+    "behavior": "If the same idempotency_key + workspace_id + request_hash is seen within TTL and previously committed=true, the server returns a replay response with the original operation_id without re-applying the mutation. Reusing the same idempotency_key + workspace_id with a different request_hash is an idempotency_conflict."
+  },
+  "validation_rules": {
+    "envelope": [
+      "type must be one of: operation, patch, event, delete",
+      "idempotency_key must be a safe replay identifier (letters, numbers, dot, underscore, hyphen; 1-128 chars)",
+      "path must be a relative VFS path string (no leading /)",
+      "workspace_id must be a safe filesystem identifier (letters, numbers, dot, underscore, hyphen; 1-128 chars)",
+      "content is required for type:operation and type:event",
+      "patches (object) is required for type:patch"
+    ],
+    "ssss_content": [
+      "Files in SSSS directories must have YAML frontmatter",
+      "Frontmatter must include a 'type' field matching a known primitive",
+      "Required fields for each primitive type must be present and non-empty",
+      "required_when-conditional fields must be present when their condition matches (spec §9)",
+      "Fields with a registry-declared enum must take one of the declared values",
+      "See /api/v1/ssss/schema for the full type schema definitions"
+    ],
+    "authorization": [
+      "Stage 5.5 (Granular Authorization): actor.role='system' bypasses all checks; actor.role='admin' gets write:*/read:*; any other role is resolved from roles/<role>/ROLE.md's permissions list.",
+      "A MISSING actor.role is DENIED, not promoted to admin (fail-closed — spec §6.3 Stage 3 MUST: a host exposing the Operation Contract to untrusted clients MUST overwrite actor with verified identity before this stage runs).",
+      "event envelopes are gated on the fixed permission 'write:event' (they have no resolved document type)."
+    ]
+  },
+  "runtime_contract": {
+    "description": "Workflow runtime conformance metadata (spec §11.8). A daemon or scheduler bridge reads workflow triggers from the vault and derives Operation Contract envelopes; no scheduler database is source-of-truth.",
+    "trigger_types": [
+      "manual",
+      "cron",
+      "interval",
+      "event",
+      "webhook",
+      "file_change",
+      "condition"
+    ],
+    "misfire_policies": [
+      "skip",
+      "run_once",
+      "catch_up"
+    ],
+    "concurrency_policies": [
+      "allow_parallel",
+      "skip_if_running",
+      "enqueue",
+      "replace"
+    ],
+    "idempotency_basis": "workspace_id + workflow_id + trigger_id + scheduled_for"
+  },
+  "fixtures": [
+    {
+      "id": "fixture-001",
+      "name": "Create assistant — valid operation",
+      "description": "A well-formed operation to create an assistant definition.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "11111111-1111-1111-1111-111111111111",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: assistant\ntitle: \"Test Bot\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"Test Bot\"\ndescription: \"A conformance test assistant.\"\nmodel: \"openai/gpt-4o\"\n---\n\n## Instructions\n\nYou are a conformance test assistant.",
+        "intent": "Conformance fixture: create a valid assistant"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "dry_run": false,
+        "validation": {
+          "valid": true,
+          "type": "assistant",
+          "errors": [],
+          "warnings": []
+        }
+      }
+    },
+    {
+      "id": "fixture-002",
+      "name": "Create assistant — missing required name field",
+      "description": "An operation with a missing 'name' field. Must return 422 with repair feedback.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "22222222-2222-2222-2222-222222222222",
+        "path": "assistants/bad-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "content": "---\ntype: assistant\ntitle: \"Create Assistant — Missing Required Name Field\"\ntimestamp: \"2026-07-02T00:00:00Z\"\ndescription: \"Missing the name field.\"\n---\n\n## Instructions\n\nBroken bot.",
+        "intent": "Conformance fixture: missing required name field"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "type": "assistant",
+          "errors": [
+            "Missing required field 'name' for type 'assistant' in assistants/bad-bot/ASSISTANT.md."
+          ]
+        },
+        "repair": {
+          "field_errors": [
+            {
+              "field": "name",
+              "issue": "Missing required field 'name' for type 'assistant'."
+            }
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-003",
+      "name": "Dry run — valid operation returns success without commit",
+      "description": "A dry_run request must return success: true and committed_at: null.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "33333333-3333-3333-3333-333333333333",
+        "path": "assistants/dry-run-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: assistant\ntitle: \"Dry Run Bot\"\ndescription: \"Dry Run Bot SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"Dry Run Bot\"\n---\n\n## Instructions\n\nNot committed.",
+        "dry_run": true,
+        "intent": "Conformance fixture: dry run pre-flight check"
+      },
+      "expected_response": {
+        "success": true,
+        "dry_run": true,
+        "committed_at": null,
+        "validation": {
+          "valid": true,
+          "type": "assistant"
+        }
+      }
+    },
+    {
+      "id": "fixture-004",
+      "name": "Patch operation — update model field",
+      "description": "A patch that updates only the model field of an existing assistant.",
+      "preconditions": [
+        "fixture-001 must be committed first"
+      ],
+      "request": {
+        "type": "patch",
+        "idempotency_key": "44444444-4444-4444-4444-444444444444",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "patches": {
+          "model": "anthropic/claude-opus-4-5"
+        },
+        "intent": "Conformance fixture: patch model to Claude Opus"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "patch",
+        "validation": {
+          "valid": true,
+          "type": "assistant"
+        }
+      }
+    },
+    {
+      "id": "fixture-005",
+      "name": "Event — append immutable credit deduction event",
+      "description": "An event operation appending to the immutable event log.",
+      "request": {
+        "type": "event",
+        "idempotency_key": "55555555-5555-5555-5555-555555555555",
+        "path": "events/credit-deducted",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "{\"event_type\":\"credit_deducted\",\"amount_credits\":150,\"model_id\":\"openai/gpt-4o\",\"timestamp\":\"2026-05-16T00:00:00Z\"}",
+        "intent": "Conformance fixture: log a credit deduction event"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "event",
+        "validation": {
+          "valid": true
+        }
+      }
+    },
+    {
+      "id": "fixture-006",
+      "name": "Idempotency replay — same key returns cached result",
+      "description": "Submitting fixture-001 a second time returns a replay response without re-committing.",
+      "preconditions": [
+        "fixture-001 must be committed first"
+      ],
+      "request": {
+        "type": "operation",
+        "idempotency_key": "11111111-1111-1111-1111-111111111111",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: assistant\ntitle: \"Test Bot\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"Test Bot\"\ndescription: \"A conformance test assistant.\"\nmodel: \"openai/gpt-4o\"\n---\n\n## Instructions\n\nYou are a conformance test assistant.",
+        "intent": "Conformance fixture: idempotency replay test"
+      },
+      "expected_response": {
+        "success": true,
+        "replay": {}
+      }
+    },
+    {
+      "id": "fixture-007",
+      "name": "Envelope validation — missing type field",
+      "description": "A request with a missing 'type' field must return 422.",
+      "request": {
+        "idempotency_key": "77777777-7777-7777-7777-777777777777",
+        "path": "assistants/missing-type/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "content": "---\ntype: assistant\ntitle: \"Missing Type Bot\"\ndescription: \"Missing Type Bot SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"Missing Type Bot\"\n---"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "errors": [
+            "Invalid or missing 'type'. Must be one of: operation, patch, event, delete."
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-008",
+      "name": "Create workflow — valid operation",
+      "description": "A well-formed workflow definition.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "88888888-8888-8888-8888-888888888888",
+        "path": "workflows/daily-digest/WORKFLOW.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: workflow\ntitle: \"Daily Digest\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nworkflow_id: daily-digest\nname: \"Daily Digest\"\ndescription: \"Sends a daily summary email.\"\npriority: 80\ntriggers:\n  - type: cron\n    id: daily-0800\n    cron: \"0 8 * * *\"\n    timezone: \"America/Denver\"\n    misfire_policy: run_once\n    concurrency: skip_if_running\nneeds: []\nisActive: true\n---\n\n## Steps\n\n1. Gather unread inbox messages.\n2. Summarize via LLM.\n3. Send digest email.",
+        "intent": "Conformance fixture: create a valid cron workflow"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "workflow",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-009",
+      "name": "Delete assistant — valid delete operation",
+      "description": "A well-formed delete operation to remove an assistant.",
+      "preconditions": [
+        "fixture-001 must be committed first"
+      ],
+      "request": {
+        "type": "delete",
+        "idempotency_key": "99999999-9999-9999-9999-999999999999",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "intent": "Conformance fixture: delete test assistant"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "delete",
+        "validation": {
+          "valid": true,
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-010",
+      "name": "Create security role — valid operation",
+      "description": "A well-formed operation to create a security role definition.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
+        "path": "roles/admin/ROLE.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "admin"
+        },
+        "content": "---\ntype: security_role\ntitle: \"Admin\"\ndescription: \"Admin SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"admin\"\npermissions:\n  - \"write:assistant\"\n  - \"write:workflow\"\n  - \"write:rule\"\n  - \"write:domain\"\n  - \"write:page\"\n  - \"write:security_role\"\n  - \"write:task\"\n---\n\nFull administrative access.",
+        "intent": "Conformance fixture: create a valid security role"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "path": "roles/admin/ROLE.md",
+        "dry_run": false,
+        "validation": {
+          "valid": true,
+          "type": "security_role",
+          "errors": [],
+          "warnings": []
+        }
+      }
+    },
+    {
+      "id": "fixture-011",
+      "name": "Stage 5.5 fail-closed — missing actor is denied, not admin-promoted",
+      "description": "An otherwise-valid operation with NO actor field must be denied. Regression fixture for the fail-open default that was caught before this WIP was committed (spec §6.3 Stage 3 MUST).",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
+        "path": "assistants/no-actor-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "content": "---\ntype: assistant\ntitle: \"No Actor Bot\"\ndescription: \"No Actor Bot SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"No Actor Bot\"\n---\n\n## Instructions\n\nShould never commit without a verified actor.",
+        "intent": "Conformance fixture: envelope with no actor must be denied"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "type": "assistant",
+          "errors": [
+            "Access denied: role '(none)' lacks permission 'write:assistant'."
+          ]
+        },
+        "repair": {
+          "field_errors": [
+            {
+              "field": "actor.role",
+              "issue": "Missing actor.role — the envelope was not authorized by a verified identity."
+            }
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-012",
+      "name": "Memory schema_version 2 — all required_when fields present",
+      "description": "A memory node declaring schema_version: 2 with every conditionally-required field (spec §9) present must validate.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "cccccccc-cccc-cccc-cccc-cccccccccccc",
+        "path": "memory/prefer-atomic-writes.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: memory\ndescription: \"Prefer Atomic Writes SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nslug: prefer-atomic-writes\ncategory: patterns\ntitle: \"Prefer atomic writes\"\nstatus: active\nschema_version: 2\nconfidence: 0.9\nimportance: 4\nmodality: should\nsubject: engine\npredicate: performs\nobject: atomic_write\nsentiment_polarity: descriptive\n---\n\nWrite-then-rename, never write-in-place.",
+        "intent": "Conformance fixture: schema_version 2 memory with all conditional fields"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "memory",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-013",
+      "name": "Memory schema_version 2 — missing required_when fields is denied",
+      "description": "A memory node declaring schema_version: 2 but omitting the conditionally-required fields must be denied. Regression fixture for the registry declaring required_when with zero engine enforcement.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "dddddddd-dddd-dddd-dddd-dddddddddddd",
+        "path": "memory/incomplete-schema2.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: memory\ndescription: \"Incomplete Schema 2 Node SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nslug: incomplete-schema2\ncategory: patterns\ntitle: \"Incomplete schema 2 node\"\nstatus: active\nschema_version: 2\n---\n\nMissing confidence/importance/modality/subject/predicate/object/sentiment_polarity.",
+        "intent": "Conformance fixture: schema_version 2 memory missing conditional fields"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "type": "memory",
+          "errors": [
+            "Missing required field 'confidence' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'importance' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'modality' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'subject' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'predicate' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'object' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
+            "Missing required field 'sentiment_polarity' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md."
+          ]
+        },
+        "expected_http_status": 422
+      }
+    },
+    {
+      "id": "fixture-014",
+      "name": "Task with an out-of-enum status is denied",
+      "description": "A task whose status is not one of the registry's declared enum values must be denied. Regression fixture for the registry declaring enums with zero engine enforcement.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee",
+        "path": "tasks/bad-status.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: task\ntitle: \"Task With An Out Of Enum Status Is Denied\"\ndescription: \"Task With An Out Of Enum Status Is Denied SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\npriority: normal\ncategory: support\nstatus: archived\n---\n\n'archived' is not a declared task status.",
+        "intent": "Conformance fixture: task with invalid status enum value"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "type": "task",
+          "errors": [
+            "Invalid value 'archived' for field 'status' on type 'task'; must be one of: pending, in_progress, done, failed."
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-015",
+      "name": "Create reporter security role — write:event only",
+      "description": "A limited role that may only append events, used to prove event envelopes are gated on 'write:event' rather than 'write:null'.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "ffffffff-ffff-ffff-ffff-ffffffffffff",
+        "path": "roles/reporter/ROLE.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: security_role\ntitle: \"Reporter\"\ndescription: \"Reporter SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"reporter\"\npermissions:\n  - \"write:event\"\n---\n\nMay only append events (e.g. usage/telemetry logging).",
+        "intent": "Conformance fixture: create a write:event-only role"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "security_role",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-016",
+      "name": "Event write by reporter role — allowed via write:event",
+      "description": "The reporter role (write:event only) may append an event. Proves event envelopes resolve a real permission, not 'write:null'.",
+      "preconditions": [
+        "fixture-015 must be committed first"
+      ],
+      "request": {
+        "type": "event",
+        "idempotency_key": "10101010-1010-1010-1010-101010101010",
+        "path": "events/report-logged",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "reporter"
+        },
+        "content": "{\"event_type\":\"report_logged\",\"report_id\":\"r-1\"}",
+        "intent": "Conformance fixture: event write by a write:event-scoped role"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "event",
+        "validation": {
+          "valid": true
+        }
+      }
+    },
+    {
+      "id": "fixture-017",
+      "name": "Create viewer security role — read:* only",
+      "description": "A read-only role with no write permissions of any kind, used to prove a role lacking write:event is correctly denied on event writes.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "20202020-2020-2020-2020-202020202020",
+        "path": "roles/viewer/ROLE.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: security_role\ntitle: \"Viewer\"\ndescription: \"Viewer SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"viewer\"\npermissions:\n  - \"read:*\"\n---\n\nRead-only access; may not write anything, including events.",
+        "intent": "Conformance fixture: create a read-only role"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "security_role",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-018",
+      "name": "Event write by viewer role — denied",
+      "description": "The viewer role (read:* only) must be denied on an event write against the fixed 'write:event' permission.",
+      "preconditions": [
+        "fixture-017 must be committed first"
+      ],
+      "request": {
+        "type": "event",
+        "idempotency_key": "30303030-3030-3030-3030-303030303030",
+        "path": "events/should-be-denied",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "viewer"
+        },
+        "content": "{\"event_type\":\"should_not_land\"}",
+        "intent": "Conformance fixture: event write by a role lacking write:event"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "errors": [
+            "Access denied: role 'viewer' lacks permission 'write:event'."
+          ]
+        },
+        "repair": {
+          "field_errors": [
+            {
+              "field": "actor.role",
+              "issue": "Insufficient permissions."
+            }
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-019",
+      "name": "Valid skill primitive write",
+      "description": "A skill manifest with type, name, and description (the spec §5.4 skill example verbatim) must validate. Regression coverage: registry/core.json has defined a `skill` primitive since early in the project, but no fixture ever exercised it.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "31313131-3131-3131-3131-313131313131",
+        "path": "skills/deploy/SKILL.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: skill\ntitle: \"Deploy\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: deploy\ndescription: >-\n  Deploy services with zero downtime. Use when the user mentions deploy,\n  release, ship, or production push.\n---\n\n# Deploy\n\nSteps to deploy safely.",
+        "intent": "Conformance fixture: valid skill primitive (spec §5.4 example)"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "skill",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-020",
+      "name": "Skill missing the type discriminator is denied",
+      "description": "A skill manifest with only name+description (valid under the open Agent Skills standard) but no `type: skill` is not a conformant SSSS-managed manifest — the registry can't route it without the discriminator (spec §5.4 skill).",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "32323232-3232-3232-3232-323232323232",
+        "path": "skills/broken-skill/SKILL.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntitle: \"Broken Skill\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: broken-skill\ndescription: \"Missing the type discriminator.\"\n---\n\n# Broken",
+        "intent": "Conformance fixture: skill manifest missing type: skill"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "errors": [
+            "Missing required frontmatter field 'type' in skills/broken-skill/SKILL.md."
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-021",
+      "name": "Skill missing description is denied",
+      "description": "A skill manifest declaring type: skill and name but no description is denied — description is a required_field on the skill primitive (spec §5.4).",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "33333333-3333-3333-3333-333333333333",
+        "path": "skills/broken-skill-2/SKILL.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: skill\ntitle: \"Broken Skill 2\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: broken-skill-2\n---\n\n# Broken",
+        "intent": "Conformance fixture: skill manifest missing description"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "type": "skill",
+          "errors": [
+            "Missing required field 'description' for type 'skill' in skills/broken-skill-2/SKILL.md."
+          ]
+        }
+      },
+      "expected_http_status": 422
+    },
+    {
+      "id": "fixture-022",
+      "name": "Runtime run primitive — valid queued run",
+      "description": "A worker-created run with the runtime status vocabulary must validate. This proves the daemon contract can persist run state through the same Operation Contract as every other primitive.",
+      "request": {
+        "type": "operation",
+        "idempotency_key": "34343434-3434-3434-3434-343434343434",
+        "path": "runs/daily-digest/run-runtime-001/RUN.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: run\ntitle: \"Run Runtime 001\"\ndescription: \"Run Runtime 001 SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T14:00:00.000Z\"\nrun_id: \"run-runtime-001\"\nworkflow_id: \"daily-digest\"\ntask_path: \"tasks/daily-digest/daily-0800-20260702T140000000Z.md\"\nworkspace_id: \"TEST_WORKSPACE_ID\"\nstatus: queued\nstarted_at: \"2026-07-02T14:00:00.000Z\"\n---\n\n### run created - 2026-07-02T14:00:00.000Z - queued\nTask claimed by the runtime worker.",
+        "intent": "Conformance fixture: valid runtime run primitive"
+      },
+      "expected_response": {
+        "success": true,
+        "type": "operation",
+        "validation": {
+          "valid": true,
+          "type": "run",
+          "errors": []
+        }
+      }
+    },
+    {
+      "id": "fixture-023",
+      "name": "Idempotency conflict — same key with different payload is denied",
+      "description": "Reusing fixture-001's idempotency key with a different request payload must fail instead of returning a false replay success.",
+      "preconditions": [
+        "fixture-001 must be committed first"
+      ],
+      "request": {
+        "type": "operation",
+        "idempotency_key": "11111111-1111-1111-1111-111111111111",
+        "path": "assistants/test-bot/ASSISTANT.md",
+        "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
+        "content": "---\ntype: assistant\ntitle: \"Test Bot V2 — Should Not Apply\"\ndescription: \"Test Bot V2 — Should Not Apply SSSS conformance fixture.\"\ntimestamp: \"2026-07-02T00:00:00Z\"\nname: \"Test Bot V2 — should not apply\"\n---\n\n## Instructions\n\nThis should not overwrite.",
+        "intent": "Conformance fixture: idempotency conflict test"
+      },
+      "expected_response": {
+        "success": false,
+        "validation": {
+          "valid": false,
+          "errors": [
+            "Idempotency conflict: key '11111111-1111-1111-1111-111111111111' was already committed for a different request payload."
+          ]
+        }
+      },
+      "expected_http_status": 409
+    }
+  ],
+  "error_codes": {
+    "400": "invalid_request — Invalid parameters, directory traversal, malformed request envelope, or path template mismatch",
+    "401": "unauthorized — Missing or invalid auth token / session",
+    "403": "forbidden — Access denied (workspace membership check failed or system scope isolation violation)",
+    "404": "not_found — The requested file to patch or delete does not exist",
+    "409": "lease_conflict, version_conflict, or idempotency_conflict — Lease locked, out-of-date expected version, or idempotency key replay payload mismatch",
+    "422": "validation_failed — Primitive registry/conformance validation errors (contains validation.errors and repair in body)",
+    "500": "internal_error — Unexpected server error, VFS write failed, or DB transactional RPC error"
+  },
+  "implementations": [
+    "festech.live",
+    "ultrachat",
+    "total-recall"
+  ],
+  "maintained_by": "SSSS standard (canonical: this repo)",
+  "provenance": "Seeded from the festech.live reference implementation, which authored the original shared contract; canonicalized here as the vendor-neutral source of truth.",
+  "last_updated": "2026-07-02"
+}