@gregiteen/ssss-cli 0.7.0

package/conformance/reference-bundle.ucw.json

@@ -0,0 +1,135 @@
+{
+  "manifest": {
+    "name": "Festival in a Box",
+    "description": "A complete music-festival operation as a tradeable SSSS bundle.",
+    "version": "1.0.0",
+    "exported_at": "1970-01-01T00:00:00.000Z",
+    "ssss_core_version": "0.6",
+    "required_extensions": [
+      "festech"
+    ],
+    "export_profile": "sale",
+    "primitive_inventory": {
+      "assistant": 1,
+      "domain": 1,
+      "page": 1,
+      "security_role": 1,
+      "rule": 1,
+      "workflow": 1
+    },
+    "provisioning": [
+      {
+        "id": "ws",
+        "label": "Create the workspace",
+        "system": "workspace",
+        "mode": "generate",
+        "required": true
+      },
+      {
+        "id": "dom",
+        "label": "Bind the festival domain",
+        "system": "domains",
+        "mode": "provision",
+        "required": true,
+        "notes": "owns_domain — buyer supplies their own domain."
+      },
+      {
+        "id": "mail",
+        "label": "Provision a support mailbox",
+        "system": "email",
+        "mode": "provision",
+        "required": false
+      }
+    ],
+    "parameters": [
+      {
+        "key": "business_name",
+        "label": "Festival name",
+        "type": "string",
+        "scope": "workspace",
+        "source": "user",
+        "required": true
+      },
+      {
+        "key": "domain",
+        "label": "Domain to bind",
+        "type": "string",
+        "scope": "workspace",
+        "source": "user",
+        "required": true,
+        "description": "Satisfies the resource_bound domain requirement (owns_domain)."
+      },
+      {
+        "key": "support_mailbox",
+        "label": "Support mailbox",
+        "type": "string",
+        "scope": "workspace",
+        "source": "user",
+        "required": false
+      }
+    ],
+    "file_count": 14,
+    "provenance": {
+      "content_hash": "sha256:96380f618ee1e178331beca9507e1b3cd28a3d12cfa7f9898317f98da8295218",
+      "exporter": "@ssss/cli@0.7.0"
+    }
+  },
+  "files": [
+    {
+      "path": "assistants/concierge.md",
+      "content": "---\ntype: assistant\ntitle: Festival Concierge\ndescription: Assistant that answers attendee questions about the lineup and venue.\ntimestamp: 2026-07-02T00:00:00Z\nname: Festival Concierge\nslug: concierge\n---\nAnswer attendee questions about the lineup and venue."
+    },
+    {
+      "path": "assistants/index.md",
+      "content": "# Index — assistants\n\n- [Festival Concierge](./concierge.md)\n"
+    },
+    {
+      "path": "domains/festival.md",
+      "content": "---\ntype: domain\ntitle: Festival Domain Requirement\ndescription: Domain resource requirement that the buyer binds during provisioning.\ntimestamp: 2026-07-02T00:00:00Z\ndomain_name: REQUIREMENT\nregistrar: REQUIREMENT\nstatus: required\npayment_status: unbound\nx_portability: resource_bound\n---\nThis festival needs a domain. The buyer binds their own at provision (owns_domain)."
+    },
+    {
+      "path": "domains/index.md",
+      "content": "# Index — domains\n\n- [Festival Domain Requirement](./festival.md)\n"
+    },
+    {
+      "path": "pages/index.md",
+      "content": "# Index — pages\n\n- [Lineup](./lineup.md)\n"
+    },
+    {
+      "path": "pages/lineup.md",
+      "content": "---\ntype: page\ntitle: Lineup\ndescription: Public-facing festival lineup page.\ntimestamp: 2026-07-02T00:00:00Z\nslug: lineup\nname: Lineup\nsandbox_entry: lineup/index.html\n---\nThe festival lineup page."
+    },
+    {
+      "path": "roles/admin/ROLE.md",
+      "content": "---\ntype: security_role\ntitle: Administrator Role\ndescription: Security role with full festival operations write access.\ntimestamp: 2026-07-02T00:00:00Z\nname: Administrator\npermissions:\n  - \"write:assistant\"\n  - \"write:workflow\"\n  - \"write:rule\"\n  - \"write:domain\"\n  - \"write:page\"\n  - \"write:security_role\"\n  - \"write:task\"\n---\nFull access to all festival operations."
+    },
+    {
+      "path": "roles/admin/index.md",
+      "content": "# Index — roles/admin\n\n- [Administrator Role](./ROLE.md)\n"
+    },
+    {
+      "path": "roles/index.md",
+      "content": "# Index — roles\n\n- [admin/](./admin/index.md)\n"
+    },
+    {
+      "path": "rules/index.md",
+      "content": "# Index — rules\n\n- [Refund Policy](./refund-policy.md)\n"
+    },
+    {
+      "path": "rules/refund-policy.md",
+      "content": "---\ntype: rule\ntitle: Refund Policy\ndescription: Refund eligibility rule for festival attendees.\ntimestamp: 2026-07-02T00:00:00Z\nname: Refund Policy\nslug: refund-policy\n---\nRefunds are available up to 14 days before the event."
+    },
+    {
+      "path": "tasks/index.md",
+      "content": "# Index — tasks\n\n- [Ticket 4821 Seat Change](./ticket-4821.md)\n"
+    },
+    {
+      "path": "workflows/box-office.md",
+      "content": "---\ntype: workflow\ntitle: Box Office\ndescription: Ticket-sales workflow for a music festival.\ntimestamp: 2026-07-02T00:00:00Z\nname: Box Office\nslug: box-office\n---\nSell tickets, then hand the buyer to [[concierge]] for questions."
+    },
+    {
+      "path": "workflows/index.md",
+      "content": "# Index — workflows\n\n- [Box Office](./box-office.md)\n"
+    }
+  ]
+}

package/docs/help/autolink.md

@@ -0,0 +1,15 @@
+# `ssss autolink`
+
+Generate OKF wiki-links across an SSSS vault. Rewrites bare references to
+`[[slug]]` links so a vault is navigable as an "LLM-wiki," using bundle-relative
+absolute paths. Deterministic and idempotent — running it twice changes nothing.
+
+```bash
+ssss autolink [dir]      # default dir: the current directory
+```
+
+The same rewrite engine backs provisioning's id-remap (§17.3): when `provision`
+relocates files under a `--prefix`, link targets are recomputed the same way, so
+internal links never dangle after a move.
+
+See also: `ssss help provisioning`.

package/docs/help/bundle.md

@@ -0,0 +1,47 @@
+# The `.ucw` bundle format (spec §16)
+
+A `.ucw` bundle is the transportable package of a vault — "a festival in a box."
+It is plain JSON: a manifest plus the path-sorted vault files, content-hashed for
+integrity. The container file is conventionally named `*.ucw.json`.
+
+## Shape
+
+```jsonc
+{
+  "manifest": {
+    "name": "Festival in a Box",
+    "description": "...",
+    "version": "0.1.0",
+    "exported_at": "1970-01-01T00:00:00.000Z",   // frozen → deterministic export
+    "ssss_core_version": "0.6",
+    "required_extensions": ["festech"],
+    "export_profile": "sale",                      // backup | template | sale
+    "primitive_inventory": { "workflow": 1, "page": 1, "rule": 1, "assistant": 1, "domain": 1 },
+    "provisioning": [ /* steps, see `ssss help provisioning` */ ],
+    "parameters":  [ /* template variables, see below */ ],
+    "file_count": 5,
+    "provenance": {
+      "content_hash": "sha256:…",                  // over the canonical file serialization
+      "exporter": "@ssss/cli"
+    }
+  },
+  "files": [ { "path": "rules/refund-policy.md", "content": "---\n…" } ]
+}
+```
+
+## Integrity
+
+`provenance.content_hash` is `sha256` over the canonical (path-sorted) serialization
+of `files`. `ssss validate` recomputes it and rejects any mismatch — a bundle cannot
+be silently edited. `primitive_inventory` is registry-driven (a count per `type`),
+not a closed category enum.
+
+## Parameters
+
+Each entry in `parameters[]` is a template variable resolved at provision time:
+`{ key, label, type, scope, source }` where `source ∈ user | llm | graph | system`.
+Required parameters must be supplied (`ssss provision --param key=value`) or the
+plan is rejected.
+
+Commands: `ssss export`, `ssss validate`, `ssss inspect`.
+See also: `ssss help provisioning`, `ssss help portability`.

package/docs/help/conformance.md

@@ -0,0 +1,34 @@
+# Conformance (spec §12)
+
+A host MUST NOT claim SSSS conformance without passing the canonical suite in
+`conformance/`. It is the shared test every implementation runs.
+
+```bash
+ssss conformance                 # structural + registry portability validation
+ssss conformance --engine        # also replay every fixture + round-trip the reference bundle in-process
+ssss conformance --endpoint <url> --token <pat>   # run the fixtures against a live host
+```
+
+## What `--engine` proves
+
+1. **All Operation Contract fixtures** (`conformance/fixtures.json`) replay through
+   the reference engine (`src/engine.mjs`) and produce the expected responses —
+   create/patch/event/delete, dry-run, idempotency, and failure cases.
+2. **The reference bundle round-trips**: `validate → provision → import → re-import`
+   on `conformance/reference-bundle.ucw.json`, asserting
+   - the bundle's schema + content hash are valid,
+   - the `sale` profile carries no `tenant_private` file,
+   - provision resolves parameters and link integrity,
+   - import commits every file, and a second import commits **zero** (idempotent),
+   - no `tenant_private` file ever lands on disk.
+3. **Workflow runtime checks** (`src/runtime.mjs`) prove a workflow trigger plans
+   deterministic event/task envelopes, duplicate daemon ticks replay idempotently,
+   and worker-created runs commit through the Operation Contract.
+
+## Endpoint mode
+
+`--endpoint` POSTs each fixture's `request` to a host's Operation Contract endpoint
+and diffs the response — this is how festech / ultrachat / total-recall prove they
+implement the *same* standard rather than three drifting copies.
+
+See also: `conformance/README.md`, `ssss help runtime`, `ssss help provisioning`.

package/docs/help/export.md

@@ -0,0 +1,20 @@
+# `ssss export`
+
+Package a vault directory into a `.ucw` bundle (spec §16). Pure and deterministic:
+the same vault + profile yields a byte-identical bundle (the timestamp is frozen and
+the files are content-hashed), so exports are diffable and cacheable.
+
+```bash
+ssss export <vault-dir> [--profile backup|template|sale] [--out file.ucw.json]
+```
+
+Walks every `*.md` under the vault (skipping dotfiles and the `.events` log), reads
+each file's `type` from frontmatter, resolves its portability class (§5.5), and keeps
+only the classes the profile permits. The dropped files are reported with
+`--show-dropped`.
+
+Common flags: `--name`, `--description`, `--bundle-version`, `--exporter`,
+`--ext <name>` (declare a required extension, repeatable), `--registry <dir>`.
+
+Run `ssss export --help` for the full flag list.
+See also: `ssss help portability`, `ssss help bundle`.

package/docs/help/import.md

@@ -0,0 +1,19 @@
+# `ssss import`
+
+Replay a bundle (or a pre-built plan) into a target vault through the reference
+engine (spec §17.1, §6). Idempotent: each envelope carries a deterministic
+idempotency key, so importing the same bundle twice commits nothing the second time.
+
+```bash
+ssss import <bundle.ucw.json> --vault <dir> [--param key=value]
+ssss import --plan plan.json   --vault <dir>     # replay a plan from `ssss provision`
+```
+
+- `--vault <dir>` is required and is created if missing.
+- Without `--plan`, import provisions inline first (resolving `--param` flags); a
+  failed provision (unresolved params / dangling links) aborts before any write.
+- `--dry-run` validates every envelope without committing.
+- The summary reports `committed`, `unchanged (idempotent)`, and `failed` counts.
+
+Run `ssss import --help` for the full flag list.
+See also: `ssss help provisioning`, `ssss provision`.

package/docs/help/overview.md

@@ -0,0 +1,33 @@
+# SSSS — overview
+
+The **Structured Semantic Syntax System** is a database-free, Markdown-first schema
+and mutation contract for AI-agent state. A vault is a directory of Markdown files
+with YAML frontmatter; every file declares a `type` defined in the registry.
+
+`@ssss/cli` is the reference implementation: a dependency-free Operation Contract
+engine, a registry-driven validator, and the `.ucw` bundle/provisioning tooling.
+
+## The pieces
+
+| Piece | Where | What it is |
+|-------|-------|------------|
+| Spec | `docs/ssss-spec.md` | The normative standard. |
+| Core registry | `registry/core.json` | The 14 document primitives + 5 contract primitives, plus the bundle (§16) and provisioning (§17) schemas. |
+| Engine | `src/engine.mjs` | The §6 Operation Contract pipeline (operation/patch/event/delete). |
+| Runtime | `src/runtime.mjs` | The §11.8 workflow trigger → event/task/run envelope planner. |
+| Bundle | `src/bundle.mjs` | export / validate / provision / import (§16–§17). |
+| Conformance | `conformance/` | Fixtures every host must pass. |
+
+## The lifecycle
+
+```
+vault ──export──▶ .ucw bundle ──provision──▶ envelope plan ──import──▶ new vault
+        (§16, pure)            (§17, params + links)        (§6, idempotent)
+```
+
+## Commands
+
+Run `ssss help <topic>` for any of:
+`runtime`, `portability`, `bundle`, `provisioning`, `export`, `provision`, `import`, `conformance`, `autolink`.
+
+Run `ssss <command> --help` for: `export`, `validate`, `inspect`, `provision`, `import`, `autolink`, `conformance`.

package/docs/help/portability.md

@@ -0,0 +1,27 @@
+# Portability classification (spec §5.5) — the keystone
+
+Every document primitive declares a **portability class**. This is what makes a
+vault sellable without leaking the operator's private data.
+
+| Class | Meaning | Example types |
+|-------|---------|---------------|
+| `structural` | The sellable business model — the thing a buyer wants. | `workflow`, `rule`, `page`, `assistant` |
+| `tenant_private` | The operator's private data. **Never** sold or templated. | `task`, customer records |
+| `resource_bound` | Needs a real resource bound at provision time. | `domain`, `phone_number`, `integration_connection` |
+
+A file MAY override its type default with `x_portability` in frontmatter. The most
+restrictive of (type default, override) wins.
+
+## Export profiles are filters over the classes
+
+| Profile | Includes | Use |
+|---------|----------|-----|
+| `backup` | structural + tenant_private + resource_bound | Full operator backup/restore. |
+| `template` | structural + resource_bound | A reusable template, private data stripped. |
+| `sale` | structural + resource_bound | A tradeable business, private data stripped. |
+
+> `template` and `sale` exports MUST drop every `tenant_private` primitive. The
+> reference bundle (`conformance/reference-bundle.ucw.json`) proves this: its
+> `task` ticket is dropped from the `sale` export.
+
+See also: `ssss help bundle`, `ssss help export`.

package/docs/help/provision.md

@@ -0,0 +1,19 @@
+# `ssss provision`
+
+Plan a bundle install (spec §17): resolve parameters, check link integrity under
+id-remap, and emit an ordered list of Operation Contract envelopes. Pure — it never
+touches the filesystem, so it is safe to run and diff before importing.
+
+```bash
+ssss provision <bundle.ucw.json> --param key=value [--workspace id] [--prefix path] [--out plan.json]
+```
+
+- Required parameters that are neither supplied nor defaulted cause a non-zero exit.
+- Any `[[link]]` that points outside the bundle is reported as a dangling link and
+  fails the plan.
+- `--prefix` relocates every file under a target path; link checks follow the remap.
+- Each envelope gets a deterministic idempotency key, so the resulting plan is safe
+  to import more than once.
+
+Run `ssss provision --help` for the full flag list.
+See also: `ssss help provisioning`, `ssss import`.

package/docs/help/provisioning.md

@@ -0,0 +1,43 @@
+# The provisioning contract (spec §17)
+
+Three deterministic, idempotent verbs move a bundle from an export into a live vault.
+
+| Verb | Signature | What it does |
+|------|-----------|--------------|
+| `export` | vault + profile → bundle | Pure. Profile-filtered, content-hashed. |
+| `provision` | bundle + params → plan | Resolves parameters + link integrity + id-remap → an ordered list of Operation Contract envelopes. Touches no filesystem. |
+| `import` | plan + engine → state | Replays each envelope through the §6 engine. Idempotent. |
+
+```
+ssss export ./vault --profile sale --out fest.ucw.json
+ssss provision fest.ucw.json --param domain=acme.live --out plan.json
+ssss import --plan plan.json --vault ./new-tenant
+# or in one step:
+ssss import fest.ucw.json --vault ./new-tenant --param domain=acme.live
+```
+
+## Determinism & idempotency (§17.3)
+
+- **Id-remap.** `--prefix` relocates every file under a target path; link integrity
+  is checked against the remapped target, so `[[links]]` never dangle after a move.
+- **Idempotency keys.** Each envelope's key is `sha256(workspace_id + ':' + path)`,
+  truncated. Re-importing the same plan commits nothing new — `import` reports the
+  unchanged count.
+- **Link integrity.** `provision` fails closed if any `[[ref]]` points at a file not
+  present in the bundle.
+
+## Provisioning steps & binding vocabulary (§17.2)
+
+`manifest.provisioning[]` describes the real-world resources an importer must wire up.
+Each step: `{ id, label, system, mode, required }`.
+
+- `system ∈ workspace | branding | email | phone | domains | accounts | deployments | marketplace | tabs | automation`
+- `mode ∈ existing | provision | install | generate | configure`
+
+Graph edges use relations like `uses_brand`, `owns_domain`, `routes_calls_to`,
+`deploys_to`, `installs_pack`. Composition across bundles uses `installMode ∈
+optional | recommended | required`; upgrades are structural-only via `migration` +
+`patch`.
+
+Commands: `ssss provision`, `ssss import`.
+See also: `ssss help bundle`, `ssss help portability`.

package/docs/help/roles.md

@@ -0,0 +1,61 @@
+# Security roles & RBAC (spec §5.4 security_role, §6.3 Stage 5.5)
+
+Every write goes through Stage 5.5 — Granular Authorization — after content
+validation and before commit. It's fail-closed: a write with no verified
+`actor.role` is denied, never silently promoted to a default role.
+
+## The `security_role` primitive
+
+```markdown
+---
+type: security_role
+name: "editor"
+permissions:
+  - "write:workflow"
+  - "write:assistant"
+  - "read:*"
+---
+
+Can edit workflows and assistants; read-only on everything else.
+```
+
+Canonical location: `roles/<role>/ROLE.md`, where `<role>` matches the
+`name` field. `permissions` is a flat list — see the grammar below.
+
+## Permission grammar
+
+| Pattern | Grants |
+|---|---|
+| `write:<type>` | Write access to exactly one primitive type. |
+| `read:<type>` | Read access to exactly one primitive type. |
+| `*:<type>` | Read + write on exactly one primitive type. |
+| `write:*` | Write access to every primitive type, including `event`. |
+| `read:*` | Read access to every primitive type. |
+| `*:*` | Full access. |
+
+`event` envelopes have no resolved document type, so they're gated on the
+fixed permission `write:event` specifically — `write:<some other type>`
+does **not** satisfy it, and neither does an unrelated wildcard scoped to a
+document type.
+
+## The three non-negotiable role behaviors
+
+| `actor.role` | Behavior |
+|---|---|
+| `"system"` | Unconditional bypass. Used by trusted internal callers (the provisioning pipeline stamps every generated envelope this way — see `ssss help provisioning`). Not data-driven; don't expect a `roles/system/ROLE.md`. |
+| `"admin"` | Hardcoded `write:*`/`read:*`, regardless of `roles/admin/ROLE.md`'s content (a file there can only add to this, never restrict it). |
+| *(absent)* | **Denied.** A host that exposes the Operation Contract to untrusted clients MUST overwrite `actor` with verified session identity before the envelope reaches the engine (spec §6.3 Stage 3). A missing `actor.role` is not a default — it's an authorization failure. |
+
+Any other role name is resolved by reading `roles/<role>/ROLE.md` from the
+target vault at write time. No file there means zero permissions.
+
+## Auditing this yourself
+
+The `rbac-fail-open-auditor` agent skill (`.agent/skills/rbac-fail-open-auditor/`)
+builds an adversarial envelope matrix and runs it against the reference
+engine to catch regressions in this logic — including the specific
+historical bug it's named after (a fail-open default that briefly shipped
+in this repo's own uncommitted history; see that skill's
+`references/stage-5-5-rbac-notes.md` for the full case study).
+
+See also: `ssss help portability`, `ssss help bundle`.

package/docs/help/runtime.md

@@ -0,0 +1,78 @@
+# Workflow runtime (spec §11.8)
+
+SSSS workflows are runtime definitions, not cron jobs stored somewhere else. The
+canonical schedule lives in the `workflow` primitive's `triggers[]` frontmatter.
+Cron, systemd, serverless schedules, webhooks, browser alarms, and queue workers
+are wake-up mechanisms.
+
+## Canonical loop
+
+```
+workflow trigger
+  -> workflow_triggered event envelope
+  -> task operation envelope
+  -> task lease / worker claim
+  -> run operation or append
+  -> task status patch
+  -> projection rebuild
+```
+
+Every mutation goes through the Operation Contract. A daemon MUST NOT write vault
+files directly.
+
+## Trigger source of truth
+
+```yaml
+---
+type: workflow
+name: "Daily Digest"
+triggers:
+  - type: cron
+    id: daily-0800
+    cron: "0 8 * * *"
+    timezone: "America/Denver"
+    misfire_policy: run_once
+    concurrency: skip_if_running
+isActive: true
+---
+```
+
+Supported trigger types are `manual`, `cron`, `interval`, `event`, `webhook`,
+`file_change`, and `condition`.
+
+## Idempotency
+
+Runtime-created work uses this dedupe basis:
+
+```text
+workspace_id + workflow_id + trigger_id + scheduled_for
+```
+
+Two daemon ticks for the same scheduled instant MUST produce the same task
+idempotency key. This is how SSSS avoids duplicate tasks without making a scheduler
+database canonical.
+
+## Reference helpers
+
+Use `@ssss/cli/runtime` when building a host daemon:
+
+```js
+import { createEngine } from '@ssss/cli/engine';
+import { planWorkflowTrigger } from '@ssss/cli/runtime';
+
+const plan = planWorkflowTrigger({
+  workflowPath: 'workflows/daily-digest/WORKFLOW.md',
+  workflowContent,
+  workspaceId: 'ws-1',
+  trigger: { type: 'cron', id: 'daily-0800', cron: '0 8 * * *' },
+  scheduledFor: '2026-07-02T14:00:00.000Z',
+});
+
+const engine = createEngine();
+for (const envelope of plan.envelopes) {
+  engine.processOperation(envelope, './vault');
+}
+```
+
+`ssss conformance --engine` includes runtime checks that prove deterministic task
+planning, idempotent duplicate ticks, and run creation through the reference engine.

package/docs/help/scaffold.md

@@ -0,0 +1,47 @@
+# `ssss new` — scaffold a project
+
+Create a fresh, ready-to-run repo wired for SSSS (and optionally Total Recall).
+
+```bash
+ssss new my-app                          # scaffold ./my-app
+ssss new my-app --install                # also npm install + run the conformance test
+ssss new my-app --with-total-recall      # also wire the Total Recall memory OS
+ssss new my-app --with-total-recall --install
+```
+
+## What you get
+
+```
+my-app/
+  package.json        @ssss/cli pinned to this CLI's version tag; npm test = node --test
+  vault/              Starter SSSS documents:
+    rules/welcome.md         (structural)
+    workflows/onboarding.md  (structural, links [[welcome]])
+    assistants/concierge.md  (structural)
+    tasks/first-task.md      (tenant_private — dropped from sale/template exports)
+  test/ssss-conformance.test.mjs   Replays the canonical fixtures through the engine
+                                    AND round-trips the vault as a sale bundle.
+  CLAUDE.md           Agent guide (source-of-truth + portability rules).
+  README.md  .gitignore
+```
+
+The generated test is **dependency-free** (`node --test`): it proves the toolchain
+implements the Operation Contract (§6) and that the starter vault exports, validates,
+provisions, and re-imports idempotently as a `sale` bundle (§16/§17) — with the
+`tenant_private` task correctly dropped.
+
+## Flags
+
+| Flag | Effect |
+|------|--------|
+| `--name <s>` | Package name (default: the directory name). |
+| `--with-total-recall` | Add `total-recall-brain` + memory wiring to CLAUDE.md/README. |
+| `--install` | Run `npm install`, Total Recall `init` (if requested), then `npm test`. |
+| `--no-git` | Skip `git init`. |
+| `--ref <git-ref>` | Pin `@ssss/cli` to a specific tag/branch/SHA (default: this CLI's version tag). |
+| `--force` | Scaffold into a non-empty directory. |
+
+Shelling out (git/npm/npx) uses `execFileSync` with fixed argument vectors — no shell,
+no interpolation.
+
+See also: `ssss help portability`, `ssss help provisioning`, `ssss export`.