@gregiteen/ssss-cli 0.9.0 → 0.9.1

package/scripts/conformance.mjs

@@ -691,6 +691,53 @@ async function runCliSmokeConformance() {
     check('ssss import --dry-run reports would-commit counts and leaves target empty',
       dryRunOut.includes('would commit') && dryRunFiles.length === 0,
       dryRunOut.trim());
+
+    const primitiveOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'primitive', 'create',
+      '--namespace', 'acme',
+      '--name', '顧客予約',
+      '--language', 'ja',
+      '--fields', JSON.stringify([{ id: 'status', name: '状態', kind: 'enum', values: ['pending', 'confirmed'], required: true }]),
+    ], { encoding: 'utf8' }));
+    check('ssss primitive create emits a stable qualified identity',
+      /^acme:p_[a-f0-9]{20}$/.test(primitiveOut.primitive_id),
+      JSON.stringify(primitiveOut));
+
+    const defPath = path.join(tmp, 'definition.json');
+    fs.writeFileSync(defPath, `${JSON.stringify(primitiveOut)}\n`);
+    const inspectOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'primitive', 'inspect',
+      defPath,
+    ], { encoding: 'utf8' }));
+    const extensionPath = path.join(tmp, 'extension.json');
+    fs.writeFileSync(extensionPath, `${JSON.stringify(inspectOut.registry)}\n`);
+    const lockOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'registry', 'lock',
+      '--extension', extensionPath,
+    ], { encoding: 'utf8' }));
+    check('ssss registry lock emits integrity metadata',
+      typeof lockOut.integrity === 'string' && lockOut.integrity.startsWith('sha256:'),
+      JSON.stringify(lockOut));
+
+    const adapterOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'adapter', 'conformance',
+    ], { encoding: 'utf8' }));
+    check('ssss adapter conformance report is machine-readable and green',
+      adapterOut.passed === true && adapterOut.suites?.vfs_memory?.passed === true,
+      JSON.stringify(adapterOut));
+
+    const migrateOut = JSON.parse(execFileSync('node', [
+      path.join(__dirname, 'ssss.mjs'),
+      'migrate', '0.8-to-0.9',
+      vault,
+    ], { encoding: 'utf8' }));
+    check('ssss migrate 0.8-to-0.9 dry-run emits backup manifest without writes',
+      migrateOut.dry_run === true && migrateOut.writes_performed === 0 && Array.isArray(migrateOut.backup_manifest),
+      JSON.stringify(migrateOut));
   } finally {
     fs.rmSync(tmp, { recursive: true, force: true });
   }

package/scripts/generate-sbom.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * Generate a minimal SPDX-lite SBOM for @gregiteen/ssss-cli publish artifacts.
+ * Dependency-free: packages only what is declared in package.json (zero runtime deps).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+
+function walk(dir, out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === '.git') continue;
+    const abs = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(abs, out);
+    else if (entry.isFile()) out.push(abs);
+  }
+  return out;
+}
+
+const files = walk(root).filter(
+  (f) =>
+    !f.includes(`${path.sep}artifacts${path.sep}`) &&
+    !f.endsWith('package-lock.json'),
+);
+
+const packages = [
+  {
+    name: pkg.name,
+    version: pkg.version,
+    downloadLocation: `https://registry.npmjs.org/${pkg.name}/-/${pkg.name.split('/').pop()}-${pkg.version}.tgz`,
+    filesAnalyzed: true,
+    licenseConcluded: pkg.license || 'NOASSERTION',
+  },
+];
+
+// Zero runtime dependencies by design — still list optional peer/dev if present
+for (const [section, deps] of Object.entries({
+  dependencies: pkg.dependencies || {},
+  optionalDependencies: pkg.optionalDependencies || {},
+})) {
+  for (const [name, version] of Object.entries(deps)) {
+    packages.push({
+      name,
+      version: String(version).replace(/^[\^~]/, ''),
+      relationship: section,
+    });
+  }
+}
+
+const fileEntries = files.map((abs) => {
+  const rel = path.relative(root, abs).split(path.sep).join('/');
+  const buf = fs.readFileSync(abs);
+  return {
+    fileName: rel,
+    checksums: [
+      {
+        algorithm: 'SHA256',
+        checksumValue: crypto.createHash('sha256').update(buf).digest('hex'),
+      },
+    ],
+  };
+});
+
+const sbom = {
+  spdxVersion: 'SPDX-2.3',
+  dataLicense: 'CC0-1.0',
+  SPDXID: 'SPDXRef-DOCUMENT',
+  name: `${pkg.name}-${pkg.version}`,
+  documentNamespace: `https://github.com/gregiteen/ssss/sbom/${pkg.version}`,
+  creationInfo: {
+    created: new Date().toISOString(),
+    creators: ['Tool: ssss-generate-sbom'],
+  },
+  packages,
+  files: fileEntries,
+  relationships: [
+    {
+      spdxElementId: 'SPDXRef-DOCUMENT',
+      relationshipType: 'DESCRIBES',
+      relatedSpdxElement: 'SPDXRef-Package',
+    },
+  ],
+  comment:
+    'SSSS reference package is intentionally dependency-free at runtime. Host apps supply adapters.',
+};
+
+const outDir = path.join(root, 'artifacts');
+fs.mkdirSync(outDir, { recursive: true });
+const outFile = path.join(outDir, `sbom-${pkg.version}.spdx.json`);
+fs.writeFileSync(outFile, `${JSON.stringify(sbom, null, 2)}\n`);
+console.log(`SBOM written: ${outFile}`);
+console.log(`Packages: ${packages.length}, files hashed: ${fileEntries.length}`);

package/scripts/phase9-cross-host-corpus.mjs

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+/**
+ * Phase 9 — shared cross-host command corpus.
+ *
+ * Runs a normalized set of Operation Contract envelopes through the package
+ * kernel (MemoryVfs + memory durable stores) and prints a machine-readable
+ * report. Hosts can re-run the same envelopes via their bridges and compare
+ * success/valid/type verdicts against this reference.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { createKernel, canonicalRequestHash } from '../src/kernel.mjs';
+import { FileSystemVfs } from '../src/vfs.mjs';
+import { MemoryEventStore } from '../src/events.mjs';
+import { MemoryIdempotencyStore } from '../src/idempotency.mjs';
+import { MemoryLeaseStore } from '../src/leases.mjs';
+import { createValidator } from '../src/validator.mjs';
+import { loadRegistries } from '../src/registry.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function ruleContent(name) {
+  return [
+    '---',
+    'type: rule',
+    `title: ${name}`,
+    `description: Phase 9 corpus rule ${name}`,
+    'timestamp: 2026-07-10T00:00:00Z',
+    `name: ${name}`,
+    '---',
+    '',
+    `Body for ${name}.`,
+    '',
+  ].join('\n');
+}
+
+function spanishRuleContent() {
+  return [
+    '---',
+    'type: rule',
+    'title: Bienvenida',
+    'description: Regla estructural de corpus multilingüe',
+    'timestamp: 2026-07-10T00:00:00Z',
+    'name: bienvenida',
+    '---',
+    '',
+    'Cuerpo en español.',
+    '',
+  ].join('\n');
+}
+
+const CORPUS = [
+  {
+    id: 'corpus-rule-create',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-rule-1',
+      path: 'rules/welcome.md',
+      content: ruleContent('welcome'),
+    },
+    expect: { success: true, valid: true },
+  },
+  {
+    id: 'corpus-rule-idempotent-replay',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-rule-1',
+      path: 'rules/welcome.md',
+      content: ruleContent('welcome'),
+    },
+    expect: { success: true, valid: true, replay: true },
+  },
+  {
+    id: 'corpus-rule-idempotent-conflict',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-rule-1',
+      path: 'rules/welcome.md',
+      content: ruleContent('welcome-changed'),
+    },
+    expect: { success: false },
+  },
+  {
+    id: 'corpus-dry-run',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-dry-1',
+      path: 'rules/dry.md',
+      content: ruleContent('dry'),
+      dry_run: true,
+    },
+    expect: { success: true, valid: true, dry_run: true },
+  },
+  {
+    id: 'corpus-multilingual-rule',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-es-1',
+      path: 'rules/bienvenida.md',
+      content: spanishRuleContent(),
+    },
+    expect: { success: true, valid: true },
+  },
+  {
+    id: 'corpus-missing-actor-denied',
+    envelope: {
+      type: 'operation',
+      workspace_id: 'ws-corpus',
+      idempotency_key: 'corpus-no-actor',
+      path: 'rules/no-actor.md',
+      content: ruleContent('no-actor'),
+    },
+    principal: null,
+    expect: { success: false },
+  },
+];
+
+function principal() {
+  return {
+    id: 'phase9:corpus',
+    kind: 'system',
+    workspaceIds: ['ws-corpus'],
+    capabilities: ['*:*'],
+    authentication: { provider: 'phase9-corpus', assurance: 'system' },
+  };
+}
+
+async function main() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ssss-phase9-corpus-'));
+  const registrySet = loadRegistries();
+  const validator = createValidator({ registrySet });
+  const kernel = createKernel({
+    vfs: new FileSystemVfs(root),
+    eventStore: new MemoryEventStore(),
+    leaseStore: new MemoryLeaseStore(),
+    idempotencyStore: new MemoryIdempotencyStore(),
+    validator,
+  });
+
+  const results = [];
+  for (const caseDef of CORPUS) {
+    const p =
+      caseDef.principal === null
+        ? null
+        : caseDef.principal || principal();
+    let result;
+    try {
+      if (!p) {
+        // Simulate host fail-closed before kernel when identity missing
+        result = {
+          success: false,
+          validation: { valid: false, errors: ['Missing actor'] },
+        };
+      } else {
+        result = await kernel.execute(caseDef.envelope, { principal: p });
+      }
+    } catch (error) {
+      result = {
+        success: false,
+        validation: { valid: false, errors: [error.message] },
+        error: error.message,
+      };
+    }
+
+    const verdict = {
+      id: caseDef.id,
+      success: !!result.success,
+      valid: !!result.validation?.valid,
+      replay: !!result.replay,
+      dry_run: !!result.dry_run || !!caseDef.envelope.dry_run,
+      type: result.validation?.type || null,
+      errors: result.validation?.errors || [],
+      request_hash: canonicalRequestHash(caseDef.envelope),
+    };
+
+    const ok =
+      (caseDef.expect.success === undefined ||
+        verdict.success === caseDef.expect.success) &&
+      (caseDef.expect.valid === undefined ||
+        verdict.valid === caseDef.expect.valid) &&
+      (caseDef.expect.replay === undefined ||
+        verdict.replay === caseDef.expect.replay) &&
+      (caseDef.expect.dry_run === undefined ||
+        verdict.dry_run === caseDef.expect.dry_run);
+
+    results.push({ ...verdict, passed: ok });
+    console.log(`${ok ? '✅' : '❌'} ${caseDef.id} success=${verdict.success} valid=${verdict.valid}`);
+  }
+
+  const report = {
+    suite: 'phase9-cross-host-corpus',
+    package: '@gregiteen/ssss-cli',
+    version: JSON.parse(
+      fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8'),
+    ).version,
+    generated_at: new Date().toISOString(),
+    passed: results.every((r) => r.passed),
+    results,
+  };
+
+  const outDir = path.join(__dirname, '../artifacts');
+  fs.mkdirSync(outDir, { recursive: true });
+  const outFile = path.join(outDir, 'phase9-cross-host-corpus.json');
+  fs.writeFileSync(outFile, `${JSON.stringify(report, null, 2)}\n`);
+  console.log(`\nReport: ${outFile}`);
+  console.log(`Overall: ${report.passed ? 'PASS' : 'FAIL'} (${results.filter((r) => r.passed).length}/${results.length})`);
+
+  fs.rmSync(root, { recursive: true, force: true });
+  process.exit(report.passed ? 0 : 1);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/skills/ssss/SKILL.md

@@ -1,221 +1,49 @@
 ---
 type: skill
-title: SSSS System Manager
+title: SSSS Protocol Reference
 name: ssss
-description: "Inspect, validate, implement, or change SSSS primitives, registries, kernel commands, VFS/security adapters, events, projections, multilingual semantic runtime, generative UI, bundles, and host adapters. MANDATORY: Read this file before editing SSSS files or code."
-timestamp: 2026-07-10T00:00:00Z
+description: "Use this skill when reading, writing, parsing, validating, or extending SSSS -- the Structured Semantic Syntax System: the SSSS Core Contract API, VFS-native primitives, operation/patch/event envelopes, leases, and projections. MANDATORY: You MUST read the full SKILL.md file before executing."
+timestamp: 2026-07-15T00:00:00Z
 ---
 
-# SSSS — Structured Semantic Syntax System Manager
+# SSSS — Structured Semantic Syntax System Reference
 
-SSSS is a vendor-neutral, Markdown-first state and mutation contract. Canonical
-state is typed Markdown plus append-only events. Databases, indexes, queues,
-dashboards, and search stores are host projections unless explicitly documented
-as external resources.
+You are operating in a repository that implements, extends, or relies on the **Structured Semantic Syntax System (SSSS)**. SSSS is a database-free, Markdown-first schema and mutation contract for AI-agent state.
 
-## Establish Ground Truth First
+This skill provides the normative rules for interacting with an SSSS-compliant vault or host engine (like Total Recall). 
 
-Do not infer the contract from an installed skill snapshot.
+## ⚠️ The VFS-First Mandate (Absolute Rule)
 
-1. Find the repository root and inspect `package.json`, `VERSION`,
-   `registry/core.json`, and `docs/ssss-spec.md` when they exist.
-2. Treat `registry/core.json` as the machine-readable primitive contract and
-   `docs/ssss-spec.md` as the normative explanation.
-3. Treat `src/engine.mjs`, `src/runtime.mjs`, `src/semantic.mjs`,
-   `src/bundle.mjs`, `src/registry.mjs`, and `src/frontmatter.mjs` as the
-   reference behavior.
-4. Treat host schemas and services as adapters or extension registries. Never
-   promote host-only fields into the core standard without an explicit spec and
-   registry change.
-5. Read the current package name and version instead of hard-coding an alias.
-   In this checkout the published package is `@gregiteen/ssss-cli`; the CLI is
-   `ssss`.
+**NEVER use raw database inserts, updates, or deletes to mutate application state in an SSSS environment!**
 
-If those files are absent, inspect the installed
-`@gregiteen/ssss-cli/registry/core.json` export. Use the bundled reference only
-as a fallback and report that the result is snapshot-based.
+All persistent state (memories, agents, workflows, tasks) lives in the Virtual File System (VFS) as Markdown files with YAML frontmatter. The VFS is the absolute source of truth. 
+- If you are interacting via CLI: Use `npx total-recall remember` or `npx total-recall recall`.
+- If you are building host code: You must route mutations through the SSSS **Operation Contract** engine (which handles idempotency, leasing, and semantic indexing), or use the provided API wrappers. Do not bypass the engine to write files directly.
 
-## Authority Order
+## SSSS Core Concepts
 
-When sources disagree, resolve drift in this order:
+### 1. Primitives (The Data Model)
+Data in SSSS is defined by standard primitives (e.g. `workflow`, `assistant`, `skill`, `memory`). Each primitive has a defined schema (in `registry/core.json` or extension registries) and belongs to a specific Portability Class:
+- `structural`: Logic and system prompts (e.g. rules, workflows). Included in export templates.
+- `tenant_private`: User data (e.g. chats, tasks). NEVER included in templates.
+- `resource_bound`: Requires external setup (e.g. Twilio numbers). Exported only as a requirement.
 
-1. Conformance fixtures and tests for observed executable behavior.
-2. `registry/core.json` for required fields, enums, append behavior, and
-   portability.
-3. `docs/ssss-spec.md` for normative semantics.
-4. Reference engine/runtime/bundle code.
-5. Host extension registry and host adapter documentation.
-6. Skills, examples, README prose, and copied mirrors.
+### 2. The Operation Contract (Envelopes)
+When an SSSS engine processes a write, it receives an **Envelope**:
+- `operation`: Creates or completely replaces a document.
+- `patch`: Merges partial data into a document (e.g. updating task status).
+- `event`: Appends an immutable log entry to a document.
+- `delete`: Tombstones a replace-type document.
 
-Do not silently pick one side. Identify the mismatch, decide whether code or
-canon is wrong, update every affected source, and add a regression check.
+### 3. Idempotency and Leases
+- **Idempotency**: All mutations must provide an `idempotency_key`. The engine ensures duplicate submissions do not result in duplicate state.
+- **Leases**: Background tasks and workflows use the Lease store to acquire temporary locks on documents to prevent race conditions during execution.
 
-## Document Contract
+### 4. Bundles (.ucw)
+An SSSS vault can be packaged into a `.ucw` (Universal Containerized Workspace) bundle. A bundle is a portable snapshot containing a manifest, deterministic file paths, and content hashes for cryptographic integrity.
 
-Every SSSS document has YAML frontmatter and a Markdown body. SSSS-managed
-documents require the universal fields:
+## Validation 
 
-- `type`
-- `title`
-- `description`
-- `timestamp`
-
-Primitive-specific required fields are additive. An SSSS-managed skill also
-requires `name`; a schema-v2 memory has knowledge-graph fields; a workflow
-requires `name`.
-
-Unknown frontmatter fields must be preserved for forward compatibility. Never
-drop a nested map, array, or unknown field during parse/serialize or patch.
-
-Registry declarations are executable contract. Enforce `required_fields`,
-`required_when`, `enums`, `patterns`, `immutable_fields`, `references`,
-`append_only`, and `portability`. Reject malformed extension definitions,
-symlinked registry files, and core or sibling type collisions during load.
-
-## Mutation Contract
-
-Agent-generated mutations flow through the Operation Contract:
-
-```text
-validate envelope
-  -> verify safe workspace/idempotency/actor identifiers
-  -> resolve and contain the target path
-  -> replay or reject the idempotency key + request hash
-  -> authorize with verified actor identity (fail closed)
-  -> validate any active lease (fail closed)
-  -> validate universal + primitive-specific content
-  -> commit atomically
-  -> append the audit event
-```
-
-The mutation envelopes are:
-
-- `operation` — create or fully replace a replace-type document.
-- `patch` — merge an existing replace-type document without changing `type`.
-- `event` — append an immutable event record.
-- `delete` — remove a replace-type document and emit an audit event; reject
-  append-type targets.
-
-Use `dry_run: true` for model-generated preflight. Idempotency is scoped by the
-effective request, not the key alone: the same request replays, while the same
-workspace/key with a different request hash is a conflict.
-
-## Append, Lease, and Path Safety
-
-- `conversation` and `run` are append-only. Preserve prior bytes and append new
-  records; never rewrite or delete them.
-- Events are immutable.
-- Paths must be relative, contained vault paths. Reject absolute paths,
-  backslashes, null bytes, empty segments, `.`/`..`, directory targets, and
-  symlink escapes.
-- Leases are actor-owned, operation-linked, expiring locks. Missing, mismatched,
-  malformed, or unreadable lease state fails closed.
-- Hosts must overwrite caller-supplied actor data with verified session identity
-  before authorization.
-
-## Workflow Runtime
-
-Workflow frontmatter owns the schedule. Cron, daemon, webhook, file watcher, and
-event-loop processes are wake-up mechanisms, not a second scheduling database.
-
-Use `@gregiteen/ssss-cli/runtime` to deterministically derive the trigger event,
-task, and run envelopes. Duplicate ticks must replay idempotently. Queues and
-task dashboards are disposable projections over workflow state and events.
-
-## Bundles and Portability
-
-Every document primitive resolves to one portability class:
-
-- `structural` — reusable model shipped in templates and sale bundles.
-- `tenant_private` — operator/customer runtime data; excluded from template and
-  sale exports.
-- `resource_bound` — exported only as a requirement declaration; never leak the
-  seller's bound resource value.
-
-Bundle paths must be unique, safe, and symlink-free. Validate content hashes,
-required extensions, primitive inventory, core version, parameters, and link
-integrity before import. Preflight the complete plan before the first commit so a
-late invalid envelope cannot leave a partial install. Provisioning produces
-deterministic Operation Contract envelopes; re-import must be a no-op.
-
-## Multilingual Semantic Runtime
-
-Treat semantic indexes and rendered text/UI as disposable projections. Canonical
-documents are authored once in any language; do not create translation documents or
-localized canonical trees.
-
-- Index only `structural` documents by default. Include `tenant_private` and
-  `resource_bound` sources only after an explicit authorized opt-in.
-- Derive stable identity from `semantic_id`, then `resource`, then source path.
-- Build edges from explicit `relations`, wiki links, and Markdown links.
-- Record embedding model identity and vector dimensions and report lexical and
-  semantic evidence separately.
-- Render language at runtime through an injected adapter. Preserve primitive IDs,
-  field IDs, enum codes, actions, permissions, paths, versions, hashes, and relations.
-
-## Scope and Host Adapters
-
-The core standard does not collapse host ownership layers. A host may implement
-global/project or system/account/workspace overlays, but must document precedence
-and preserve isolation. Shared system skills should be inherited through an
-overlay rather than copied into every workspace.
-
-When working in Total Recall, use its validated-write and memory-validator
-adapter if those modules exist. In another host, locate its extension registry
-and conformance bridge. Do not quote Total Recall paths as universal SSSS
-architecture.
-
-## Procedure for Changes
-
-1. Classify the change: core primitive, contract behavior, runtime behavior,
-   semantic/runtime-rendering behavior, bundle/provisioning behavior, projection, or
-   host extension.
-2. Inspect the registry, spec section, implementation, fixtures, and host bridge
-   for that surface.
-3. Make the smallest coherent change across code and canon.
-4. Add positive, negative, replay, and invalid-path cases where applicable.
-5. Run focused validation, then the full conformance gate.
-6. Update skill/reference mirrors only after the executable contract is green.
-
-## Validation
-
-Validate a Markdown document with the dependency-free skill helper:
-
-```bash
-node skills/ssss/scripts/validate-schema.mjs path/to/document.md
-```
-
-In the SSSS reference repository, the required gate is:
-
-```bash
-npm test
-```
-
-It covers registry/engine parity, shipped-skill conformance, Operation Contract
-fixtures, workflow runtime behavior, lease/frontmatter regressions,
-extension-registry hardening, multilingual semantic behavior,
-bundle/provisioning round trips, and CLI smoke tests.
-
-For host adapters, run the host's named SSSS conformance command as well. Do not
-substitute a loose YAML parse or a generic typecheck for the SSSS gate.
-
-## Do Not
-
-- Do not treat an installed skill, copied spec, or README as newer than the live
-  registry and conformance suite.
-- Do not use raw file writes for agent-generated vault mutations.
-- Do not make a derived database/index/queue the canonical record.
-- Do not add a primitive in prose without registry and fixture coverage.
-- Do not translate symbolic control fields or index private content by default.
-- Do not materialize a projection inside its source vault.
-- Do not mix document primitives with contract envelopes.
-- Do not claim conformance from HTTP success or file creation alone.
-- Do not publish package names, versions, or exporter identities without reading
-  them from current package metadata.
-
-## References
-
-Read `references/contract-reference.md` for the compact topology, primitive
-families, package entry points, and drift checklist. For normative detail, read
-the exact linked section of `docs/ssss-spec.md` rather than loading a stale
-vendored copy.
+If you are writing tests or schemas in a host repository, ensure that:
+1. `MemoryNodeSchema` validations provide all required SSSS v2 properties (`status`, `created`, `updated`, `last_accessed`, `source`, `decay`).
+2. Schema changes maintain strict compatibility with the Open Knowledge Format (OKF) standard if applicable.

package/src/authorization.mjs

@@ -33,9 +33,10 @@ export function createCapabilityAuthorizer(options = {}) {
     if (principal.kind !== 'system' && !principal.workspaceIds.includes(workspaceId)) {
       return { allowed: false, reason: `Principal '${principal.id}' is not scoped to workspace '${workspaceId}'.` };
     }
+    const floorKey = definition?.qualified_type || definition?.primitive_id || definition?.type;
     const required = new Set([
       ...requiredCapabilities(definition, action),
-      ...(policyFloors[definition?.qualified_type || definition?.type]?.[action] || []),
+      ...(policyFloors[floorKey]?.[action] || []),
       ...(context.policyFloor || []),
     ]);
     const granted = new Set(principal.capabilities || []);