@gregiteen/ssss-cli 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -7,6 +7,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-09-24
+### Fixed
+- `JsonlEventStore.append` no longer re-reads and re-parses the whole
+  `<workspace>.jsonl` log on every append to reject a duplicate `event_id`.
+  Each store instance reads a log once on its first append, keeps a set of the
+  event ids it has seen, and re-reads only when the log's stat (size, mtime,
+  ctime, inode) shows another instance or process has changed it. A batch of N
+  appends is now one log read instead of N. Replaying 3,250 appends in fresh
+  instances of 400 against a 7,915-event, 9.6 MB log dropped from ~280 s to
+  ~1.7 s. Duplicate rejection, symlink refusal (now also enforced with
+  `O_NOFOLLOW` where the platform has it), 0600 log mode, and replay order are
+  unchanged.
+- `MemoryEventStore.append` checks for duplicates against a set of ids instead
+  of scanning every stored event.
+- The SBOM generator derives the package tarball URL from `package.json`
+  instead of a hardcoded 0.9.0 URL.
+
+### Added
+- 0.9 conformance checks for the JSONL event store: duplicates rejected from
+  the same instance, another instance, and another process; one log read for
+  200 appends; rebuild after a foreign append; replay order and cursor resume;
+  0600 mode; symlink refusal.
+
+## [0.9.0] - 2026-07-10
+### Added
+- Shared application kernel (`kernel.execute`) with verified-principal injection,
+  canonical request hashing, idempotent replay/conflict, resource prepare/finalize/
+  reconcile hooks, and TypeScript command contracts under `@gregiteen/ssss-cli/kernel`.
+- Host adapter contracts and dual reference implementations for VFS, identity/
+  capability authorization, leases, idempotency, events, projections, semantic
+  retrieval/rendering, and generative UI manifests.
+- Runtime primitive authoring (`ssss:primitive` meta-schema), layered registry
+  composition, aliases, dependency ranges, policy floors, and registry integrity locks.
+- CLI surfaces: `ssss primitive`, `ssss registry`, `ssss adapter conformance`, and
+  `ssss migrate 0.8-to-0.9` dry-run diagnostics with backup manifests.
+- Bundle `manifest.dependencies` for primitives, extensions, migrations, and
+  integrity digests aligned with provenance.
+- Dedicated 0.9 conformance suite covering adapters, kernel leases, projection
+  rebuild/drift isolation, UI adversarial cases, and CLI smoke paths.
+
+### Changed
+- Core registry/spec version is now `0.9`. Canonical documents are authored once;
+  multilingual presentation uses embedding/render adapters instead of stored
+  translation trees.
+- The reference engine is a compatibility façade over the shared kernel; hosts must
+  inject adapters rather than re-implement mutation stages.
+
+### Removed
+- The `translation` document primitive and required localized-vault materialization
+  workflow from the 0.9 core surface.
+
 ## [0.8.0] - 2026-07-10
 ### Changed
 - Core registry/spec version is now `0.7`. Registry `patterns`,
@@ -128,14 +179,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **The `.ucw` bundle format (spec §16, registry `bundle`)** — the canonical transportable
   package of a vault: a manifest plus path-sorted files, content-hashed for integrity. The
   manifest declares `ssss_core_version`, `required_extensions`, `export_profile`,
-  `primitive_inventory` (registry-driven, replacing ultrachat's closed `categories` enum),
+  `primitive_inventory` (registry-driven, replacing the legacy closed `categories` enum),
   `provisioning[]`, `parameters[]`, and `provenance{content_hash, exporter, signature?}`.
-  Harvested from ultrachat's `WorkspaceVfsPackageService` and generalized to be portability-
+  Harvested from the legacy `WorkspaceVfsPackageService` and generalized to be portability-
   and registry-driven.
 - **The provisioning contract (spec §17, registry `provisioning`)** — three deterministic,
   idempotent verbs: `export` (pure, profile-filtered), `provision` (params + link-integrity
   + id-remap → replayable envelope plan), `import` (engine replay, idempotent via
-  idempotency_key). Adopts ultrachat's `WorkspaceProvisioningStep.mode`/`system` and
+  idempotency_key). Adopts the legacy `WorkspaceProvisioningStep.mode`/`system` and
   `WorkspaceGraphEdge.relation` as the canonical binding/dependency vocabularies, plus
   `installMode` composition and structural-only `migration`+`patch` upgrades.
 - **Reference engine for bundles (`src/bundle.mjs`)** — dependency-free `exportBundle`,
@@ -166,7 +217,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   real resource bound at provision). Export profiles `backup | template | sale` are filters
   over these classes; `template`/`sale` exports MUST drop all `tenant_private` primitives.
   Files MAY override their type default with `x_portability`. Lifted and generalized from
-  ultrachat's ad-hoc export filter in `WorkspaceVfsPackageService`.
+  the legacy ad-hoc export filter in `WorkspaceVfsPackageService`.
 - **`delete` envelope (spec §6.2)** — promoted from festech's `SsssOperationService` into
   the canonical Operation Contract as the fourth envelope type. Removes a replace-type file,
   rejects append-type targets, and emits a deletion event for audit. Idempotent.

package/README.md

@@ -1,31 +1,22 @@
 # SSSS — Structured Semantic Syntax System
 
 > A database-free, Markdown-first schema and mutation contract for AI-agent state.
-> Turn a running business into a single tradeable file — *a festival in a box.*
+> Turn an autonomous agent ecosystem into a single portable, tradeable bundle.
 
 [![conformance](https://img.shields.io/badge/conformance-fixtures%20%2B%20runtime%20%2B%20bundle-brightgreen)](conformance/)
-[![spec](https://img.shields.io/badge/spec-v0.9%20draft-blue)](docs/ssss-spec.md)
+[![spec](https://img.shields.io/badge/spec-v0.9-blue)](docs/ssss-spec.md)
 [![OKF](https://img.shields.io/badge/OKF-v0.1%20compatible-blue)](docs/ssss-spec.md)
 
-SSSS is the vendor-neutral standard and reference implementation shared by
-[festech.live](https://festech.live), **ultrachat**, and **total-recall**. It defines:
-
-- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`,
-  `rule`, `page`, `assistant`, …), validated against a registry, not hand-written code.
-- **The Operation Contract** (§6) — four envelope types (`operation` / `patch` /
-  `event` / `delete`) for mutating a vault, with idempotency replay and audit.
-- **The Workflow Runtime Contract** (§11.8) — workflows own triggers; daemons,
-  crons, and webhooks derive idempotent event/task/run envelopes from the vault.
-- **Multilingual semantic runtime** (§11.9) — deterministic lexical evidence,
-  injected multilingual embeddings, and runtime rendering with symbolic controls fixed.
-- **Portability classification** (§5.5) — the keystone: every primitive is
-  `structural`, `tenant_private`, or `resource_bound`, so a vault can be *sold*
-  without leaking the operator's private data.
-- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a
-  vault, then `export → provision → import` it into a fresh tenant, deterministically.
-
-This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML
-library to be conformant. The reference engine *is* the validator.
+SSSS is a vendor-neutral standard and reference implementation for portable AI memory and state. It defines:
+
+- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`, `rule`, `page`, `assistant`, …), validated against a registry, not hand-written code.
+- **The Operation Contract** (§6) — four envelope types (`operation` / `patch` / `event` / `delete`) for mutating a vault, with idempotency replay and audit.
+- **The Workflow Runtime Contract** (§11.8) — workflows own triggers; daemons, crons, and webhooks derive idempotent event/task/run envelopes from the vault.
+- **Multilingual semantic runtime** (§11.9) — deterministic lexical evidence, injected multilingual embeddings, and runtime rendering with symbolic controls fixed.
+- **Portability classification** (§5.5) — the keystone: every primitive is `structural`, `tenant_private`, or `resource_bound`, so a vault can be *sold* or *shared* without leaking private data.
+- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a vault, then `export → provision → import` it into a fresh environment, deterministically.
+
+This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML library to be conformant. The reference engine *is* the validator.
 
 ## Install
 
@@ -41,10 +32,9 @@ Requires Node 18+. No runtime dependencies.
 
 ```bash
 ssss new my-app --install                # scaffold + install + run the conformance test
-ssss new my-app --with-total-recall      # also wire the Total Recall memory OS
 ```
 
-Scaffolds a starter `vault/`, a dependency-free conformance test, and a `CLAUDE.md`.
+Scaffolds a starter `vault/`, a dependency-free conformance test, and instructions.
 See `ssss help scaffold`.
 
 ## Quick start — the lifecycle
@@ -56,24 +46,41 @@ vault ──export──▶ .ucw bundle ──provision──▶ envelope plan
 
 ```bash
 # 1. Package a vault as a sellable bundle (drops tenant-private data)
-ssss export ./my-vault --profile sale --out festival.ucw.json
+ssss export ./my-vault --profile sale --out bundle.ucw.json
 
 # 2. Inspect / verify it
-ssss inspect  festival.ucw.json --files
-ssss validate festival.ucw.json
+ssss inspect  bundle.ucw.json --files
+ssss validate bundle.ucw.json
 
 # 3. Stand up a fresh tenant from it
-ssss import festival.ucw.json --vault ./new-tenant \
-  --param business_name="Acme Fest" --param domain=acme.live
+ssss import bundle.ucw.json --vault ./new-tenant \
+  --param company_name="Acme Corp" --param domain=acme.com
 
 # Re-running import commits nothing — it is idempotent.
 ```
 
+## 0.9 application kernel
+
+SSSS 0.9 provides a shared mutation kernel and host adapter contracts for any system using SSSS:
+
+```bash
+ssss primitive create --namespace acme --name "New Item" --language en
+ssss registry compose --extension ./acme-extension.json
+ssss adapter conformance
+ssss migrate 0.8-to-0.9 ./vault
+```
+
+Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/leases`, `/events`, `/projections`, `/semantic`, `/ui`.
+
 ## Commands
 
 | Command | Purpose |
 |---------|---------|
-| `ssss new <dir>` | Scaffold a new SSSS project (`--with-total-recall`, `--install`). |
+| `ssss new <dir>` | Scaffold a new SSSS project (`--install`). |
+| `ssss primitive <verb>` | Create, validate, inspect, or migrate primitive definitions. |
+| `ssss registry <verb>` | Compose, lock, or verify an effective registry. |
+| `ssss adapter conformance` | Run machine-readable VFS/lease/idempotency contract suites. |
+| `ssss migrate 0.8-to-0.9` | Dry-run migration diagnostics with backup manifest. |
 | `ssss export <vault>` | Package a vault into a `.ucw` bundle (§16). Pure & deterministic. |
 | `ssss validate <bundle>` | Check a bundle against the schema + portability rules. |
 | `ssss inspect <bundle>` | Human-readable summary (manifest, inventory, params, steps). |
@@ -86,52 +93,6 @@ ssss import festival.ucw.json --vault ./new-tenant \
 
 Run `ssss <command> --help` for flags, or `ssss help <topic>` for concepts.
 
-## Use as a library
-
-```js
-import { createEngine } from '@gregiteen/ssss-cli/engine';
-import { exportBundle, validateBundle, provisionBundle, importBundle } from '@gregiteen/ssss-cli/bundle';
-import { planWorkflowTrigger } from '@gregiteen/ssss-cli/runtime';
-import { buildSemanticIndex, searchSemanticIndex, renderSemanticRecord } from '@gregiteen/ssss-cli/semantic';
-
-const bundle = exportBundle('./my-vault', { profile: 'sale', name: 'Festival in a Box' });
-const { valid, errors } = validateBundle(bundle);
-
-const engine = createEngine();
-const plan = provisionBundle(bundle, { parameters: { domain: 'acme.live' }, workspaceId: 'ws-1' });
-importBundle(plan.plan, './new-tenant', engine);
-
-const workflowContent = `---
-type: workflow
-name: "Daily Digest"
----
-
-1. Gather messages.
-2. Summarize.
-3. Send digest.
-`;
-const runtimePlan = planWorkflowTrigger({
-  workflowPath: 'workflows/daily-digest/WORKFLOW.md',
-  workflowContent,
-  workspaceId: 'ws-1',
-  trigger: { type: 'cron', id: 'daily-0800', cron: '0 8 * * *' },
-  scheduledFor: '2026-07-02T14:00:00.000Z',
-});
-
-const index = buildSemanticIndex('./my-vault');
-const matches = searchSemanticIndex(index, 'política de reembolsos');
-const rendered = await renderSemanticRecord(matches[0].document, { language: 'es', render: renderer });
-```
-
-Exports: `@gregiteen/ssss-cli` / `@gregiteen/ssss-cli/engine` (Operation Contract engine),
-`@gregiteen/ssss-cli/bundle` (export/provision/import), `@gregiteen/ssss-cli/registry`,
-`@gregiteen/ssss-cli/runtime`, `@gregiteen/ssss-cli/semantic`,
-`@gregiteen/ssss-cli/frontmatter`.
-
-Canonical content is authored once in any language. Multilingual embedding and render
-adapters handle cross-language retrieval and presentation at runtime; primitive IDs,
-field IDs, enum codes, permissions, paths, hashes, and relations never change.
-
 ## Portability — why a vault is safe to sell
 
 | Class | Meaning | In a `sale` export? |
@@ -140,13 +101,11 @@ field IDs, enum codes, permissions, paths, hashes, and relations never change.
 | `resource_bound` | Needs a real resource bound at provision (`domain`, `phone_number`). | ✅ shipped (as a parameter/step) |
 | `tenant_private` | The operator's private data (`task`, customer records). | ❌ **dropped** |
 
-`template` and `sale` exports MUST drop every `tenant_private` file. The reference
-bundle proves it — see `ssss help portability`.
+`template` and `sale` exports MUST drop every `tenant_private` file. The reference bundle proves it — see `ssss help portability`.
 
 ## Conformance
 
-A host MUST NOT claim SSSS conformance without passing the suite in
-[`conformance/`](conformance/):
+A host MUST NOT claim SSSS conformance without passing the suite in `conformance/`:
 
 ```bash
 ssss conformance            # structural + registry validation
@@ -157,10 +116,10 @@ npm test                    # == ssss conformance --engine
 ## Repository layout
 
 ```
-docs/ssss-spec.md          The normative specification (v0.9 draft).
+docs/ssss-spec.md          The normative specification (v0.9).
 docs/help/                 Topic docs surfaced by `ssss help`.
 registry/core.json         15 document + 5 contract primitives; semantic, bundle & provisioning schemas.
-registry/extensions/       Application extension registries (e.g. festech).
+registry/extensions/       Application extension registries.
 src/engine.mjs             Operation Contract engine (§6).
 src/runtime.mjs            Workflow trigger → event/task/run envelope planning (§11.8).
 src/semantic.mjs           Multilingual semantic retrieval + runtime rendering (§11.9).
@@ -174,4 +133,4 @@ skills/ssss/               Packaged SSSS system skill and dependency-free valida
 
 ## License
 
-ISC © Greg Iteen. See [LICENSE](LICENSE).
+ISC © Greg Iteen. See [LICENSE](./LICENSE).

package/VERSION

@@ -1 +1 @@
-0.9.0
+0.9.1

package/conformance/reference-bundle.ucw.json

@@ -17,6 +17,24 @@
       "rule": 1,
       "workflow": 1
     },
+    "dependencies": {
+      "primitives": [
+        "assistant",
+        "domain",
+        "page",
+        "rule",
+        "security_role",
+        "workflow"
+      ],
+      "extensions": [
+        "festech"
+      ],
+      "migrations": [],
+      "integrity": {
+        "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
+        "ssss_core_version": "0.9"
+      }
+    },
     "provisioning": [
       {
         "id": "ws",
@@ -88,7 +106,7 @@
     "file_count": 14,
     "provenance": {
       "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
-      "exporter": "@gregiteen/ssss-cli@0.9.0"
+      "exporter": "@gregiteen/ssss-cli@0.9.1"
     }
   },
   "files": [

package/docs/help/overview.md

@@ -13,10 +13,12 @@ kernel, a registry-driven validator, multilingual semantic adapters, and the
 | Piece | Where | What it is |
 |-------|-------|------------|
 | Spec | `docs/ssss-spec.md` | The normative standard. |
-| Core registry | `registry/core.json` | The 15 document primitives + 5 contract primitives, plus semantic (§11.9), bundle (§16), and provisioning (§17) contracts. |
-| Engine | `src/engine.mjs` | The §6 Operation Contract pipeline (operation/patch/event/delete). |
+| Core registry | `registry/core.json` | Document primitives + contracts for semantic (§11.9), bundle (§16), and provisioning (§17). |
+| Kernel | `src/kernel.mjs` | Shared 0.9 mutation authority (`kernel.execute`) used by hosts and the reference engine. |
+| Engine | `src/engine.mjs` | Compatibility façade over the kernel for the §6 Operation Contract. |
 | Runtime | `src/runtime.mjs` | The §11.8 workflow trigger → event/task/run envelope planner. |
 | Semantic | `src/semantic.mjs` | Lexical evidence, multilingual embeddings, privacy filters, and runtime rendering (§11.9). |
+| Adapters | `src/vfs.mjs`, `leases.mjs`, `events.mjs`, … | Host-injectable storage/security/projection contracts. |
 | Bundle | `src/bundle.mjs` | export / validate / provision / import (§16–§17). |
 | Conformance | `conformance/` | Fixtures every host must pass. |
 
@@ -34,4 +36,5 @@ Run `ssss help <topic>` for any of:
 `export`, `provision`, `import`, `conformance`, `autolink`.
 
 Run `ssss <command> --help` for: `export`, `validate`, `inspect`, `provision`,
-`import`, `semantic`, `autolink`, `conformance`.
+`import`, `semantic`, `primitive`, `registry`, `adapter`, `migrate`,
+`autolink`, `conformance`.

package/docs/ssss-spec.md

@@ -1,14 +1,15 @@
 # SSSS — Structured Semantic Syntax System
 
-**Specification v0.7 — Draft**
+**Specification v0.9**
 
 > This is the canonical, vendor-neutral specification for SSSS. It is the ground
 > truth on which all SSSS implementations are built. It is intended to be vendored
-> byte-for-byte into any repository that implements SSSS (e.g. the UltraChat
+> byte-for-byte into any repository that implements SSSS (e.g. a compatible host
 > Sovereign AI OS, the Total Recall reference kernel).
 >
-> Status: **Draft**. The format, type registry, and conformance contract are under
-> active development. Expect breaking changes until v1.0.
+> Status: **Stable for 0.9**. The format, type registry, and conformance contract
+> are settled for this version; until v1.0 a later version MAY still introduce
+> breaking changes.
 >
 > Implementation-specific detail (routes, services, storage backends, deployment)
 > does **not** belong in this document — it belongs in each implementation's own
@@ -1156,7 +1157,7 @@ opaque ID as the slug and keep the human-readable label in `title` / `name`.
 This document is versioned independently of any host and of the conformance
 fixture set.
 
-- The spec version is stated in the document header (currently **v0.9 — Draft**).
+- The spec version is stated in the document header (currently **v0.9**).
 - Breaking changes to the file format, the type registry, or the Operation
   Contract increment the spec version.
 - Until **v1.0**, any version MAY introduce breaking changes.
@@ -1248,14 +1249,14 @@ inside, the resources it must bind at provision time, and provenance.
 | `ssss_core_version` | yes | The `registry/core.json` `spec_version` the bundle targets (e.g. `"0.3"`). A host MUST refuse a bundle whose core version it does not support. |
 | `required_extensions` | yes | Array of extension registry ids the files rely on (e.g. `["festech"]`). Empty array if the bundle uses only core primitives. A host MUST refuse a bundle naming an extension it has not loaded. |
 | `export_profile` | yes | `backup` \| `template` \| `sale` — the §5.5 profile this bundle was built under. Determines the allowed portability classes. |
-| `primitive_inventory` | yes | Map of primitive `type` → count, over every file in the bundle (replaces ultrachat's hard-coded `categories`; it is registry-driven, so extension types appear automatically). |
+| `primitive_inventory` | yes | Map of primitive `type` → count, over every file in the bundle (replaces the legacy hard-coded `categories`; it is registry-driven, so extension types appear automatically). |
 | `provisioning` | yes | Array of provisioning steps (§17.2) — the ordered, declarative plan for binding this bundle into a live workspace. Empty for a pure `backup` that is restored in place. |
 | `parameters` | no | Array of parameter definitions (§16.5) the importer must resolve (e.g. business name, domain). |
 | `source_workspace_id` | no | Origin workspace; OMITTED or nulled in `template`/`sale` profiles (it is operator-identifying). |
 | `file_count` | yes | Length of `files`; a cheap integrity check. |
 | `provenance` | yes | `{ content_hash, exporter, signature? }` (§16.3). |
 
-`primitive_inventory` supersedes ultrachat's fixed `categories` object and `provisioning`
+`primitive_inventory` supersedes the legacy fixed `categories` object and `provisioning`
 supersedes its `capabilities` booleans: both are now open and registry-driven rather than a
 closed enum, so a bundle full of `festech` extension primitives inventories and provisions
 them without a spec change.
@@ -1284,7 +1285,7 @@ honoring `x_portability`) MUST be permitted by `export_profile`.
 
 `parameters` are the values an importer must supply to turn a template into a running
 instance — the difference between "a festival in a box" and "*this* festival." The schema is
-adopted verbatim from ultrachat's `WorkspaceTemplateVariableDefinition`:
+adopted verbatim from the legacy `WorkspaceTemplateVariableDefinition`:
 
 | Field | Meaning |
 |-------|---------|
@@ -1325,7 +1326,7 @@ restoring an SSSS business are reliable operations rather than bespoke migration
 ### 17.2 Provisioning Steps & Binding Vocabulary
 
 A manifest's `provisioning` array is an ordered list of steps. The step schema and its
-controlled vocabularies are adopted from ultrachat's `WorkspaceProvisioningStep` and
+controlled vocabularies are adopted from the legacy `WorkspaceProvisioningStep` and
 `WorkspaceGraphEdge`:
 
 A **step** is `{ id, label, system, mode, required, notes? }`:
@@ -1358,7 +1359,7 @@ cannot resolve a link MUST fail the provision rather than emit a dangling refere
 ### 17.4 Composition & Upgrade
 
 - **Composition** — a bundle MAY depend on other bundles. A dependency carries an
-  `installMode` of `optional | recommended | required` (adopted from ultrachat's
+  `installMode` of `optional | recommended | required` (adopted from the legacy
   `WorkspaceMarketplaceRecommendation`). `provision` installs `required` dependencies before
   the bundle itself; `optional`/`recommended` are surfaced to the operator.
 - **Upgrade** — moving an installed bundle from `v2` to a `v1`-conformant shape (or any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gregiteen/ssss-cli",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "CLI tools and the reference engine for the Structured Semantic Syntax System",
   "main": "src/engine.mjs",
   "exports": {

package/registry/core.json

@@ -205,7 +205,7 @@
       "required": ["key", "label", "type", "scope", "source"],
       "optional": ["required", "description", "defaultValue", "options", "dependsOn"],
       "source_enum": ["user", "llm", "graph", "system"],
-      "note": "Adopted verbatim from ultrachat WorkspaceTemplateVariableDefinition; resource_bound requirements ship as parameters of source user/system."
+      "note": "resource_bound requirements ship as parameters of source user/system."
     },
     "conformance": "A host MUST refuse a bundle whose `ssss_core_version` it does not support or that names a `required_extensions` entry it has not loaded. An exporter MUST NOT emit a file whose resolved portability class is excluded by `export_profile`. `primitive_inventory` MUST count every file by its registry `type`.",
     "spec_ref": "§16"

package/scripts/conformance-09.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import { definePrimitive, definitionsToExtensionRegistry } from '../src/primitive.mjs';
@@ -13,7 +14,13 @@ import {
 import { createValidator } from '../src/validator.mjs';
 import { FileSystemVfs, MemoryVfs, runVfsContract } from '../src/vfs.mjs';
 import { JsonlEventStore, MemoryEventStore, createCanonicalEvent } from '../src/events.mjs';
-import { ProjectionCoordinator } from '../src/projections.mjs';
+import {
+  ProjectionCoordinator,
+  createSqlProjectionAdapter,
+  createSearchProjectionAdapter,
+  createQueueProjectionAdapter,
+  createViewModelProjectionAdapter,
+} from '../src/projections.mjs';
 import { createKernel } from '../src/kernel.mjs';
 import { UiRegistry, actionToEnvelope, createDeterministicUi, planUi, validateUiManifest } from '../src/ui.mjs';
 import { createCommandHandler, createDomainCommand } from '../src/http.mjs';
@@ -21,6 +28,84 @@ import { detectDirectWrites } from '../src/guard.mjs';
 import { MemoryLeaseStore, FileLeaseStore, runLeaseContract } from '../src/leases.mjs';
 import { MemoryIdempotencyStore, FileIdempotencyStore, runIdempotencyContract } from '../src/idempotency.mjs';
 import { createCapabilityAuthorizer } from '../src/authorization.mjs';
+import { validateVerifiedPrincipal } from '../src/authorization.mjs';
+
+async function rejects(promise, pattern) {
+  try { await promise; return false; } catch (error) { return pattern.test(error.message); }
+}
+
+async function replayed(store, options) {
+  const items = [];
+  for await (const item of store.replay(options)) items.push(item);
+  return items;
+}
+
+// Counts bytes JsonlEventStore reads from disk, to prove appends do not re-read the log.
+async function bytesReadDuring(fn) {
+  const { readSync, readFileSync } = fs;
+  let bytes = 0;
+  fs.readSync = (...args) => { const read = readSync(...args); bytes += read; return read; };
+  fs.readFileSync = (...args) => { const out = readFileSync(...args); bytes += Buffer.byteLength(out); return out; };
+  try { await fn(); } finally { fs.readSync = readSync; fs.readFileSync = readFileSync; }
+  return bytes;
+}
+
+async function checkJsonlEventStoreIndex(root, principal, check) {
+  let seq = 0;
+  const make = (workspace = 'acme') => createCanonicalEvent({
+    workspace_id: workspace, action: 'event', subject: 'events/indexed.md',
+    operation_id: `indexed-${++seq}`, idempotency_key: `indexed-${seq}`, principal,
+  });
+  const log = path.join(root, 'acme.jsonl');
+  const first = new JsonlEventStore(root);
+  const second = new JsonlEventStore(root);
+  const appended = [];
+  const add = async (store, event) => { await store.append(event); appended.push(event.event_id); return event; };
+
+  const own = await add(first, make());
+  check('jsonl event store rejects a duplicate from its own index', await rejects(first.append(own), /Duplicate event_id/));
+  const foreign = await add(second, make());
+  check('jsonl event store rejects a duplicate appended by another store instance', await rejects(first.append(foreign), /Duplicate event_id/));
+  const external = make();
+  execFileSync(process.execPath, ['--input-type=module', '-e', [
+    `import { JsonlEventStore } from ${JSON.stringify(new URL('../src/events.mjs', import.meta.url).href)};`,
+    `await new JsonlEventStore(${JSON.stringify(root)}).append(${JSON.stringify(external)});`,
+  ].join('\n')]);
+  appended.push(external.event_id);
+  check('jsonl event store rejects a duplicate appended by another process', await rejects(second.append(external), /Duplicate event_id/));
+  await add(first, make());
+  check('jsonl event store rejects a duplicate after interleaved writers', await rejects(second.append(own), /Duplicate event_id/));
+
+  const seeded = fs.statSync(log).size;
+  const fresh = new JsonlEventStore(root);
+  const batchBytes = await bytesReadDuring(async () => { for (let i = 0; i < 200; i++) await add(fresh, make()); });
+  check('jsonl event store reads the log once for many appends from one instance', batchBytes === seeded, `read ${batchBytes} bytes; log was ${seeded}`);
+  await add(second, make());
+  const revalidateBytes = await bytesReadDuring(() => add(fresh, make()));
+  check('jsonl event store rebuilds its index after another writer appends', revalidateBytes > seeded);
+
+  const other = [];
+  for (let i = 0; i < 3; i++) other.push((await (i % 2 ? second : first).append(make('aaa'))).event_id);
+  const acme = await replayed(fresh, { workspaceId: 'acme' });
+  check('jsonl event store replays one log in append order',
+    JSON.stringify(acme.map((item) => item.event.event_id)) === JSON.stringify(appended)
+    && acme.every((item, index) => item.cursor === index + 1));
+  const all = await replayed(fresh, {});
+  const expected = [...other, ...appended];
+  const resumed = await replayed(fresh, { cursor: 2 });
+  check('jsonl event store replays all logs in file order and resumes from a cursor',
+    JSON.stringify(all.map((item) => item.event.event_id)) === JSON.stringify(expected)
+    && JSON.stringify(resumed.map((item) => item.event.event_id)) === JSON.stringify(expected.slice(2)));
+
+  if (process.platform !== 'win32') {
+    check('jsonl event logs are created with mode 0600', (fs.statSync(path.join(root, 'aaa.jsonl')).mode & 0o777) === 0o600);
+  }
+  const target = path.join(root, 'target.txt');
+  fs.writeFileSync(target, '');
+  fs.symlinkSync(target, path.join(root, 'linked.jsonl'));
+  check('jsonl event store refuses symlinked logs',
+    await rejects(fresh.append(make('linked')), /Symlinked event logs are forbidden/) && fs.readFileSync(target, 'utf8') === '');
+}
 
 export async function runKernel09Conformance() {
   const checks = [];
@@ -93,11 +178,23 @@ export async function runKernel09Conformance() {
       ['filesystem', new FileLeaseStore(path.join(temp, 'leases'))],
     ]) check(`${name} lease store passes the shared contract`, (await runLeaseContract(store)).passed);
 
-    const authorize = createCapabilityAuthorizer();
+    const authorize = createCapabilityAuthorizer({
+      policyFloors: { [definition.primitive_id]: { delete: ['booking:admin'] } },
+    });
+    check('verified principal contract requires provenance', !validateVerifiedPrincipal({ id: 'x', kind: 'human', workspaceIds: [] }).valid);
+    check('verified principal contract accepts complete identity', validateVerifiedPrincipal({
+      id: 'greg', kind: 'human', workspaceIds: ['acme'], authentication: { provider: 'conformance', assurance: 'verified' },
+    }).valid);
     const protectedPrincipal = { id: 'agent', kind: 'agent', workspaceIds: ['acme'], capabilities: ['booking:update'], authentication: { provider: 'test', assurance: 'verified' } };
     const protectedContext = { principal: protectedPrincipal, workspaceId: 'acme', definition, action: 'patch', context: { requiredAssurance: 'elevated' } };
     check('protected actions require authentication step-up', !(await authorize(protectedContext)).allowed);
     check('protected actions require explicit verified-human confirmation', !(await authorize({ ...protectedContext, principal: { ...protectedPrincipal, kind: 'human', authentication: { provider: 'test', assurance: 'elevated' } }, context: { requiresHumanConfirmation: true } })).allowed);
+    check('policy floors fail closed without elevated capabilities', !(await authorize({
+      principal: { ...protectedPrincipal, capabilities: ['booking:delete'] },
+      workspaceId: 'acme',
+      definition,
+      action: 'delete',
+    })).allowed);
 
     const vfs = new MemoryVfs();
     const eventStore = new MemoryEventStore();
@@ -110,27 +207,61 @@ export async function runKernel09Conformance() {
       reset: async () => projected.clear(),
       snapshot: async () => Object.fromEntries([...projected.entries()].sort()),
     });
-    const kernel = createKernel({ vfs, eventStore, projectionCoordinator: coordinator, validator });
+    const sql = createSqlProjectionAdapter();
+    const search = createSearchProjectionAdapter();
+    const queue = createQueueProjectionAdapter();
+    const viewModel = createViewModelProjectionAdapter();
+    for (const adapter of [sql, search, queue, viewModel]) coordinator.register(adapter);
+    const leaseStore = new MemoryLeaseStore();
+    const kernel = createKernel({
+      vfs, eventStore, projectionCoordinator: coordinator, validator, leaseStore, authorize,
+    });
     const principal = {
-      id: 'greg', kind: 'human', workspaceIds: ['acme'], capabilities: ['booking:create', 'booking:update', 'booking:delete'],
+      id: 'greg', kind: 'human', workspaceIds: ['acme'], capabilities: ['booking:create', 'booking:update', 'booking:delete', 'booking:admin'],
       authentication: { provider: 'conformance', assurance: 'verified' },
     };
     const createEnvelope = { type: 'operation', workspace_id: 'acme', idempotency_key: 'create-booking', path: 'bookings/one.md', content };
     const created = await kernel.execute(createEnvelope, { principal });
     check('shared kernel commits an authorized runtime primitive', created.success, JSON.stringify(created));
+    const leaseDenied = await kernel.execute({
+      type: 'patch', workspace_id: 'acme', idempotency_key: 'lease-denied', path: 'bookings/one.md', patches: { status: 'confirmed' },
+    }, { principal, requireLease: true });
+    check('kernel fails closed when a required lease is missing', leaseDenied.success === false && /lease/i.test(leaseDenied.validation.errors.join(' ')));
+    const lease = await leaseStore.acquire({
+      workspace_id: 'acme', target: 'bookings/one.md', principal_id: principal.id, operation_id: 'lease-ok',
+    }, 30_000);
+    const leased = await kernel.execute({
+      type: 'patch', workspace_id: 'acme', idempotency_key: 'lease-ok', path: 'bookings/one.md',
+      patches: { status: 'confirmed' }, lease_id: lease.lease_id, operation_id: 'lease-ok',
+    }, { principal, requireLease: true });
+    check('kernel accepts a matching verified lease', leased.success, JSON.stringify(leased));
     const replay = await kernel.execute(createEnvelope, { principal });
     check('exact retries replay idempotently', replay.replay === true);
     const conflict = await kernel.execute({ ...createEnvelope, content: content.replace('status: pending', 'status: confirmed') }, { principal });
     check('idempotency key reuse with changed content conflicts', conflict.success === false);
-    const patched = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'patch-booking', path: 'bookings/one.md', patches: { status: 'confirmed' } }, { principal });
-    check('shared kernel patches and events the primitive', patched.success && await eventStore.size() === 2);
+    const patched = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'patch-booking', path: 'bookings/one.md', patches: { status: 'pending' } }, { principal });
+    check('shared kernel patches and events the primitive', patched.success && await eventStore.size() === 3);
     check('projection dispatch follows committed events', projected.has('bookings/one.md'));
+    const sqlSnap = await sql.snapshot();
+    const searchSnap = await search.snapshot();
+    const queueSnap = await queue.snapshot();
+    const viewSnap = await viewModel.snapshot();
+    check('SQL/search/queue/view-model adapters receive events',
+      Object.values(sqlSnap).some((row) => row.subject === 'bookings/one.md')
+      && Object.hasOwn(searchSnap, 'bookings/one.md')
+      && queueSnap.length >= 1
+      && viewSnap['bookings/one.md']?.last_action);
     const rebuilt = await coordinator.replay('bookings', { rebuild: true });
-    check('projection is rebuildable from the event log', rebuilt.applied === 2 && projected.has('bookings/one.md'));
+    check('projection is rebuildable from the event log', rebuilt.applied === 3 && projected.has('bookings/one.md'));
     const expectedProjectionHash = rebuilt.output_hash;
     projected.set('tampered', 'direct-write');
     check('projection drift is detectable', (await coordinator.detectDrift('bookings', expectedProjectionHash)).drift);
     projected.delete('tampered');
+    const sqlBefore = await sql.snapshot();
+    await coordinator.replay(sql.id, { rebuild: true });
+    check('projections can be deleted and rebuilt without losing canonical meaning',
+      JSON.stringify(await sql.snapshot()) === JSON.stringify(sqlBefore)
+      && (await vfs.read('bookings/one.md'))?.hash);
     coordinator.register({ id: 'broken', apply: async () => { throw new Error('projection offline'); } });
     const beforeFailure = (await vfs.read('bookings/one.md')).hash;
     const failureDispatch = await coordinator.dispatch(createCanonicalEvent({ workspace_id: 'acme', action: 'patch', subject: 'bookings/one.md', operation_id: 'projection-failure', idempotency_key: 'projection-failure', principal }));
@@ -145,6 +276,7 @@ export async function runKernel09Conformance() {
       for await (const item of store.replay({ workspaceId: 'acme' })) if (item.event.event_id === sample.event_id) replayed++;
       check(`${name} event store is append-only and replayable`, duplicate && replayed === 1);
     }
+    await checkJsonlEventStoreIndex(path.join(temp, 'events-index'), principal, check);
     const denied = await kernel.execute({ type: 'patch', workspace_id: 'acme', idempotency_key: 'denied', path: 'bookings/one.md', patches: { status: 'pending' } }, {
       principal: { ...principal, id: 'outsider', workspaceIds: [], capabilities: ['*:*'] },
     });