@gregiteen/ssss-cli 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -7,6 +7,85 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.2] - 2026-09-24
+### Fixed
+- The file adapters are now safe to share between processes. Each one checked
+  state and then wrote it as two steps, so concurrent processes could both pass
+  the check: `FileSystemVfs` could lose an update behind a passed
+  compare-and-swap, `FileLeaseStore` could grant the same lease twice (spec §7),
+  `FileIdempotencyStore.put` could replace an existing entry, and
+  `JsonlEventStore` could append one `event_id` twice. Each check-then-write now
+  runs under an exclusive lock file (`O_EXCL`). A lock whose holder process has
+  exited is broken immediately; any lock older than 30 s is treated as stale;
+  a waiter gives up after 40 s with `SSSS_LOCK_TIMEOUT`. Adapters accept
+  `{ lock: { timeoutMs, staleMs } }`. `FileSystemVfs` keeps its locks in a
+  reserved `.ssss-locks/` directory that VFS paths cannot address and `list()`
+  skips. Locking costs about 0.5 ms per write on APFS.
+- `scripts/release.sh` bumps `package.json` and `package-lock.json` and moves the
+  `[Unreleased]` entries into the new version's section instead of inserting a
+  stub above `[Unreleased]`.
+
+### Added
+- `ssss help concurrency`.
+- Conformance checks that race six processes against each file adapter, plus
+  lock checks for dead holders, stale locks, timeouts, symlinked locks, and the
+  reserved VFS lock directory.
+- Git tags `v0.8.0` and `v0.9.0` on commits whose package files match the
+  published npm tarballs byte-for-byte. Both versions were published from
+  uncommitted trees, so no existing commit matched. The push skill now publishes
+  from a clean clone of the release tag.
+
+## [0.9.1] - 2026-09-24
+### Fixed
+- `JsonlEventStore.append` no longer re-reads and re-parses the whole
+  `<workspace>.jsonl` log on every append to reject a duplicate `event_id`.
+  Each store instance reads a log once on its first append, keeps a set of the
+  event ids it has seen, and re-reads only when the log's stat (size, mtime,
+  ctime, inode) shows another instance or process has changed it. A batch of N
+  appends is now one log read instead of N. Replaying 3,250 appends in fresh
+  instances of 400 against a 7,915-event, 9.6 MB log dropped from ~280 s to
+  ~1.7 s. Duplicate rejection, symlink refusal (now also enforced with
+  `O_NOFOLLOW` where the platform has it), 0600 log mode, and replay order are
+  unchanged.
+- `MemoryEventStore.append` checks for duplicates against a set of ids instead
+  of scanning every stored event.
+- The SBOM generator derives the package tarball URL from `package.json`
+  instead of a hardcoded 0.9.0 URL.
+
+### Added
+- 0.9 conformance checks for the JSONL event store: duplicates rejected from
+  the same instance, another instance, and another process; one log read for
+  200 appends; rebuild after a foreign append; replay order and cursor resume;
+  0600 mode; symlink refusal.
+
+## [0.9.0] - 2026-07-10
+### Added
+- Shared application kernel (`kernel.execute`) with verified-principal injection,
+  canonical request hashing, idempotent replay/conflict, resource prepare/finalize/
+  reconcile hooks, and TypeScript command contracts under `@gregiteen/ssss-cli/kernel`.
+- Host adapter contracts and dual reference implementations for VFS, identity/
+  capability authorization, leases, idempotency, events, projections, semantic
+  retrieval/rendering, and generative UI manifests.
+- Runtime primitive authoring (`ssss:primitive` meta-schema), layered registry
+  composition, aliases, dependency ranges, policy floors, and registry integrity locks.
+- CLI surfaces: `ssss primitive`, `ssss registry`, `ssss adapter conformance`, and
+  `ssss migrate 0.8-to-0.9` dry-run diagnostics with backup manifests.
+- Bundle `manifest.dependencies` for primitives, extensions, migrations, and
+  integrity digests aligned with provenance.
+- Dedicated 0.9 conformance suite covering adapters, kernel leases, projection
+  rebuild/drift isolation, UI adversarial cases, and CLI smoke paths.
+
+### Changed
+- Core registry/spec version is now `0.9`. Canonical documents are authored once;
+  multilingual presentation uses embedding/render adapters instead of stored
+  translation trees.
+- The reference engine is a compatibility façade over the shared kernel; hosts must
+  inject adapters rather than re-implement mutation stages.
+
+### Removed
+- The `translation` document primitive and required localized-vault materialization
+  workflow from the 0.9 core surface.
+
 ## [0.8.0] - 2026-07-10
 ### Changed
 - Core registry/spec version is now `0.7`. Registry `patterns`,
@@ -128,14 +207,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **The `.ucw` bundle format (spec §16, registry `bundle`)** — the canonical transportable
   package of a vault: a manifest plus path-sorted files, content-hashed for integrity. The
   manifest declares `ssss_core_version`, `required_extensions`, `export_profile`,
-  `primitive_inventory` (registry-driven, replacing ultrachat's closed `categories` enum),
+  `primitive_inventory` (registry-driven, replacing the legacy closed `categories` enum),
   `provisioning[]`, `parameters[]`, and `provenance{content_hash, exporter, signature?}`.
-  Harvested from ultrachat's `WorkspaceVfsPackageService` and generalized to be portability-
+  Harvested from the legacy `WorkspaceVfsPackageService` and generalized to be portability-
   and registry-driven.
 - **The provisioning contract (spec §17, registry `provisioning`)** — three deterministic,
   idempotent verbs: `export` (pure, profile-filtered), `provision` (params + link-integrity
   + id-remap → replayable envelope plan), `import` (engine replay, idempotent via
-  idempotency_key). Adopts ultrachat's `WorkspaceProvisioningStep.mode`/`system` and
+  idempotency_key). Adopts the legacy `WorkspaceProvisioningStep.mode`/`system` and
   `WorkspaceGraphEdge.relation` as the canonical binding/dependency vocabularies, plus
   `installMode` composition and structural-only `migration`+`patch` upgrades.
 - **Reference engine for bundles (`src/bundle.mjs`)** — dependency-free `exportBundle`,
@@ -166,7 +245,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   real resource bound at provision). Export profiles `backup | template | sale` are filters
   over these classes; `template`/`sale` exports MUST drop all `tenant_private` primitives.
   Files MAY override their type default with `x_portability`. Lifted and generalized from
-  ultrachat's ad-hoc export filter in `WorkspaceVfsPackageService`.
+  the legacy ad-hoc export filter in `WorkspaceVfsPackageService`.
 - **`delete` envelope (spec §6.2)** — promoted from festech's `SsssOperationService` into
   the canonical Operation Contract as the fourth envelope type. Removes a replace-type file,
   rejects append-type targets, and emits a deletion event for audit. Idempotent.

package/README.md

@@ -1,31 +1,22 @@
 # SSSS — Structured Semantic Syntax System
 
 > A database-free, Markdown-first schema and mutation contract for AI-agent state.
-> Turn a running business into a single tradeable file — *a festival in a box.*
+> Turn an autonomous agent ecosystem into a single portable, tradeable bundle.
 
 [![conformance](https://img.shields.io/badge/conformance-fixtures%20%2B%20runtime%20%2B%20bundle-brightgreen)](conformance/)
-[![spec](https://img.shields.io/badge/spec-v0.9%20draft-blue)](docs/ssss-spec.md)
+[![spec](https://img.shields.io/badge/spec-v0.9-blue)](docs/ssss-spec.md)
 [![OKF](https://img.shields.io/badge/OKF-v0.1%20compatible-blue)](docs/ssss-spec.md)
 
-SSSS is the vendor-neutral standard and reference implementation shared by
-[festech.live](https://festech.live), **ultrachat**, and **total-recall**. It defines:
-
-- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`,
-  `rule`, `page`, `assistant`, …), validated against a registry, not hand-written code.
-- **The Operation Contract** (§6) — four envelope types (`operation` / `patch` /
-  `event` / `delete`) for mutating a vault, with idempotency replay and audit.
-- **The Workflow Runtime Contract** (§11.8) — workflows own triggers; daemons,
-  crons, and webhooks derive idempotent event/task/run envelopes from the vault.
-- **Multilingual semantic runtime** (§11.9) — deterministic lexical evidence,
-  injected multilingual embeddings, and runtime rendering with symbolic controls fixed.
-- **Portability classification** (§5.5) — the keystone: every primitive is
-  `structural`, `tenant_private`, or `resource_bound`, so a vault can be *sold*
-  without leaking the operator's private data.
-- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a
-  vault, then `export → provision → import` it into a fresh tenant, deterministically.
-
-This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML
-library to be conformant. The reference engine *is* the validator.
+SSSS is a vendor-neutral standard and reference implementation for portable AI memory and state. It defines:
+
+- **Document primitives** — typed Markdown files with YAML frontmatter (`workflow`, `rule`, `page`, `assistant`, …), validated against a registry, not hand-written code.
+- **The Operation Contract** (§6) — four envelope types (`operation` / `patch` / `event` / `delete`) for mutating a vault, with idempotency replay and audit.
+- **The Workflow Runtime Contract** (§11.8) — workflows own triggers; daemons, crons, and webhooks derive idempotent event/task/run envelopes from the vault.
+- **Multilingual semantic runtime** (§11.9) — deterministic lexical evidence, injected multilingual embeddings, and runtime rendering with symbolic controls fixed.
+- **Portability classification** (§5.5) — the keystone: every primitive is `structural`, `tenant_private`, or `resource_bound`, so a vault can be *sold* or *shared* without leaking private data.
+- **The `.ucw` bundle format** (§16) and **provisioning contract** (§17) — package a vault, then `export → provision → import` it into a fresh environment, deterministically.
+
+This package, `@gregiteen/ssss-cli`, is **dependency-free**: a host needs neither Zod nor a YAML library to be conformant. The reference engine *is* the validator.
 
 ## Install
 
@@ -41,10 +32,9 @@ Requires Node 18+. No runtime dependencies.
 
 ```bash
 ssss new my-app --install                # scaffold + install + run the conformance test
-ssss new my-app --with-total-recall      # also wire the Total Recall memory OS
 ```
 
-Scaffolds a starter `vault/`, a dependency-free conformance test, and a `CLAUDE.md`.
+Scaffolds a starter `vault/`, a dependency-free conformance test, and instructions.
 See `ssss help scaffold`.
 
 ## Quick start — the lifecycle
@@ -56,24 +46,41 @@ vault ──export──▶ .ucw bundle ──provision──▶ envelope plan
 
 ```bash
 # 1. Package a vault as a sellable bundle (drops tenant-private data)
-ssss export ./my-vault --profile sale --out festival.ucw.json
+ssss export ./my-vault --profile sale --out bundle.ucw.json
 
 # 2. Inspect / verify it
-ssss inspect  festival.ucw.json --files
-ssss validate festival.ucw.json
+ssss inspect  bundle.ucw.json --files
+ssss validate bundle.ucw.json
 
 # 3. Stand up a fresh tenant from it
-ssss import festival.ucw.json --vault ./new-tenant \
-  --param business_name="Acme Fest" --param domain=acme.live
+ssss import bundle.ucw.json --vault ./new-tenant \
+  --param company_name="Acme Corp" --param domain=acme.com
 
 # Re-running import commits nothing — it is idempotent.
 ```
 
+## 0.9 application kernel
+
+SSSS 0.9 provides a shared mutation kernel and host adapter contracts for any system using SSSS:
+
+```bash
+ssss primitive create --namespace acme --name "New Item" --language en
+ssss registry compose --extension ./acme-extension.json
+ssss adapter conformance
+ssss migrate 0.8-to-0.9 ./vault
+```
+
+Library subpaths: `@gregiteen/ssss-cli/kernel`, `/vfs`, `/identity`, `/leases`, `/events`, `/projections`, `/semantic`, `/ui`.
+
 ## Commands
 
 | Command | Purpose |
 |---------|---------|
-| `ssss new <dir>` | Scaffold a new SSSS project (`--with-total-recall`, `--install`). |
+| `ssss new <dir>` | Scaffold a new SSSS project (`--install`). |
+| `ssss primitive <verb>` | Create, validate, inspect, or migrate primitive definitions. |
+| `ssss registry <verb>` | Compose, lock, or verify an effective registry. |
+| `ssss adapter conformance` | Run machine-readable VFS/lease/idempotency contract suites. |
+| `ssss migrate 0.8-to-0.9` | Dry-run migration diagnostics with backup manifest. |
 | `ssss export <vault>` | Package a vault into a `.ucw` bundle (§16). Pure & deterministic. |
 | `ssss validate <bundle>` | Check a bundle against the schema + portability rules. |
 | `ssss inspect <bundle>` | Human-readable summary (manifest, inventory, params, steps). |
@@ -86,52 +93,6 @@ ssss import festival.ucw.json --vault ./new-tenant \
 
 Run `ssss <command> --help` for flags, or `ssss help <topic>` for concepts.
 
-## Use as a library
-
-```js
-import { createEngine } from '@gregiteen/ssss-cli/engine';
-import { exportBundle, validateBundle, provisionBundle, importBundle } from '@gregiteen/ssss-cli/bundle';
-import { planWorkflowTrigger } from '@gregiteen/ssss-cli/runtime';
-import { buildSemanticIndex, searchSemanticIndex, renderSemanticRecord } from '@gregiteen/ssss-cli/semantic';
-
-const bundle = exportBundle('./my-vault', { profile: 'sale', name: 'Festival in a Box' });
-const { valid, errors } = validateBundle(bundle);
-
-const engine = createEngine();
-const plan = provisionBundle(bundle, { parameters: { domain: 'acme.live' }, workspaceId: 'ws-1' });
-importBundle(plan.plan, './new-tenant', engine);
-
-const workflowContent = `---
-type: workflow
-name: "Daily Digest"
----
-
-1. Gather messages.
-2. Summarize.
-3. Send digest.
-`;
-const runtimePlan = planWorkflowTrigger({
-  workflowPath: 'workflows/daily-digest/WORKFLOW.md',
-  workflowContent,
-  workspaceId: 'ws-1',
-  trigger: { type: 'cron', id: 'daily-0800', cron: '0 8 * * *' },
-  scheduledFor: '2026-07-02T14:00:00.000Z',
-});
-
-const index = buildSemanticIndex('./my-vault');
-const matches = searchSemanticIndex(index, 'política de reembolsos');
-const rendered = await renderSemanticRecord(matches[0].document, { language: 'es', render: renderer });
-```
-
-Exports: `@gregiteen/ssss-cli` / `@gregiteen/ssss-cli/engine` (Operation Contract engine),
-`@gregiteen/ssss-cli/bundle` (export/provision/import), `@gregiteen/ssss-cli/registry`,
-`@gregiteen/ssss-cli/runtime`, `@gregiteen/ssss-cli/semantic`,
-`@gregiteen/ssss-cli/frontmatter`.
-
-Canonical content is authored once in any language. Multilingual embedding and render
-adapters handle cross-language retrieval and presentation at runtime; primitive IDs,
-field IDs, enum codes, permissions, paths, hashes, and relations never change.
-
 ## Portability — why a vault is safe to sell
 
 | Class | Meaning | In a `sale` export? |
@@ -140,13 +101,11 @@ field IDs, enum codes, permissions, paths, hashes, and relations never change.
 | `resource_bound` | Needs a real resource bound at provision (`domain`, `phone_number`). | ✅ shipped (as a parameter/step) |
 | `tenant_private` | The operator's private data (`task`, customer records). | ❌ **dropped** |
 
-`template` and `sale` exports MUST drop every `tenant_private` file. The reference
-bundle proves it — see `ssss help portability`.
+`template` and `sale` exports MUST drop every `tenant_private` file. The reference bundle proves it — see `ssss help portability`.
 
 ## Conformance
 
-A host MUST NOT claim SSSS conformance without passing the suite in
-[`conformance/`](conformance/):
+A host MUST NOT claim SSSS conformance without passing the suite in `conformance/`:
 
 ```bash
 ssss conformance            # structural + registry validation
@@ -157,10 +116,10 @@ npm test                    # == ssss conformance --engine
 ## Repository layout
 
 ```
-docs/ssss-spec.md          The normative specification (v0.9 draft).
+docs/ssss-spec.md          The normative specification (v0.9).
 docs/help/                 Topic docs surfaced by `ssss help`.
 registry/core.json         15 document + 5 contract primitives; semantic, bundle & provisioning schemas.
-registry/extensions/       Application extension registries (e.g. festech).
+registry/extensions/       Application extension registries.
 src/engine.mjs             Operation Contract engine (§6).
 src/runtime.mjs            Workflow trigger → event/task/run envelope planning (§11.8).
 src/semantic.mjs           Multilingual semantic retrieval + runtime rendering (§11.9).
@@ -174,4 +133,4 @@ skills/ssss/               Packaged SSSS system skill and dependency-free valida
 
 ## License
 
-ISC © Greg Iteen. See [LICENSE](LICENSE).
+ISC © Greg Iteen. See [LICENSE](./LICENSE).

package/VERSION

@@ -1 +1 @@
-0.9.0
+0.9.2

package/conformance/reference-bundle.ucw.json

@@ -17,6 +17,24 @@
       "rule": 1,
       "workflow": 1
     },
+    "dependencies": {
+      "primitives": [
+        "assistant",
+        "domain",
+        "page",
+        "rule",
+        "security_role",
+        "workflow"
+      ],
+      "extensions": [
+        "festech"
+      ],
+      "migrations": [],
+      "integrity": {
+        "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
+        "ssss_core_version": "0.9"
+      }
+    },
     "provisioning": [
       {
         "id": "ws",
@@ -88,7 +106,7 @@
     "file_count": 14,
     "provenance": {
       "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
-      "exporter": "@gregiteen/ssss-cli@0.9.0"
+      "exporter": "@gregiteen/ssss-cli@0.9.2"
     }
   },
   "files": [

package/docs/help/concurrency.md

@@ -0,0 +1,45 @@
+# File adapter concurrency
+
+The reference file adapters can be shared by several processes on one
+filesystem. Each adapter's check-then-write step runs under a lock file, so at
+most one racer wins:
+
+| Adapter | Guarantee across processes | Lock file |
+|---------|----------------------------|-----------|
+| `JsonlEventStore.append` | An `event_id` is appended at most once. | `<events>/<workspace>.jsonl.lock` |
+| `FileSystemVfs.writeAtomic` / `remove` | `ifAbsent`, `ifPresent`, and `version` preconditions are compare-and-swap. | `<vault>/.ssss-locks/<sha256(path)>.lock` |
+| `FileLeaseStore.acquire` / `renew` / `release` | At most one active lease per `(workspace_id, target)` (spec §7). | `<leases>/<sha256>.lease.json.lock` |
+| `FileIdempotencyStore.put` | A second `put` for a key fails instead of replacing the first. | `<idempotency>/<sha256>.json.lock` |
+
+`.ssss-locks/` is reserved: VFS paths under it are rejected and `list()` skips it.
+
+## Crashed holders
+
+A lock records its holder's pid and host. A waiter breaks the lock when the
+holder is on the same host and no longer running, or when the lock is older than
+`staleMs` (default 30 s). A waiter gives up after `timeoutMs` (default 40 s) with
+`SSSS_LOCK_TIMEOUT`. Both are adjustable per adapter:
+
+```js
+new JsonlEventStore(root, { lock: { timeoutMs: 10_000, staleMs: 15_000 } });
+new FileSystemVfs(root, { lock: { timeoutMs: 10_000 } });
+```
+
+Symlinked lock files are refused.
+
+## Limits
+
+- Locks are advisory: only writers using these adapters take them. Writers from
+  `@gregiteen/ssss-cli` 0.9.1 and earlier do not.
+- The kernel's idempotency check for `event` envelopes is read before commit and
+  written after, so two processes sending the same idempotency key at the same
+  moment can each append an event. `operation`, `patch`, and `delete` are
+  protected by the VFS compare-and-swap.
+- Network filesystems must support exclusive create (`O_EXCL`).
+- Dead-holder detection assumes processes that share the filesystem have
+  distinct hostnames (containers with the same hostname and separate pid
+  namespaces would look dead to each other). Stale detection compares the lock's
+  mtime with the local clock, so hosts' clocks must agree to well within
+  `staleMs`.
+
+See also: `ssss help leases`, `ssss help conformance`.

package/docs/help/overview.md

@@ -13,10 +13,12 @@ kernel, a registry-driven validator, multilingual semantic adapters, and the
 | Piece | Where | What it is |
 |-------|-------|------------|
 | Spec | `docs/ssss-spec.md` | The normative standard. |
-| Core registry | `registry/core.json` | The 15 document primitives + 5 contract primitives, plus semantic (§11.9), bundle (§16), and provisioning (§17) contracts. |
-| Engine | `src/engine.mjs` | The §6 Operation Contract pipeline (operation/patch/event/delete). |
+| Core registry | `registry/core.json` | Document primitives + contracts for semantic (§11.9), bundle (§16), and provisioning (§17). |
+| Kernel | `src/kernel.mjs` | Shared 0.9 mutation authority (`kernel.execute`) used by hosts and the reference engine. |
+| Engine | `src/engine.mjs` | Compatibility façade over the kernel for the §6 Operation Contract. |
 | Runtime | `src/runtime.mjs` | The §11.8 workflow trigger → event/task/run envelope planner. |
 | Semantic | `src/semantic.mjs` | Lexical evidence, multilingual embeddings, privacy filters, and runtime rendering (§11.9). |
+| Adapters | `src/vfs.mjs`, `leases.mjs`, `events.mjs`, … | Host-injectable storage/security/projection contracts. |
 | Bundle | `src/bundle.mjs` | export / validate / provision / import (§16–§17). |
 | Conformance | `conformance/` | Fixtures every host must pass. |
 
@@ -31,7 +33,9 @@ vault ──export──▶ .ucw bundle ──provision──▶ envelope plan
 
 Run `ssss help <topic>` for any of:
 `runtime`, `semantic`, `portability`, `bundle`, `provisioning`,
-`export`, `provision`, `import`, `conformance`, `autolink`.
+`export`, `provision`, `import`, `conformance`, `autolink`, `leases`,
+`concurrency`.
 
 Run `ssss <command> --help` for: `export`, `validate`, `inspect`, `provision`,
-`import`, `semantic`, `autolink`, `conformance`.
+`import`, `semantic`, `primitive`, `registry`, `adapter`, `migrate`,
+`autolink`, `conformance`.

package/docs/ssss-spec.md

@@ -1,14 +1,15 @@
 # SSSS — Structured Semantic Syntax System
 
-**Specification v0.7 — Draft**
+**Specification v0.9**
 
 > This is the canonical, vendor-neutral specification for SSSS. It is the ground
 > truth on which all SSSS implementations are built. It is intended to be vendored
-> byte-for-byte into any repository that implements SSSS (e.g. the UltraChat
+> byte-for-byte into any repository that implements SSSS (e.g. a compatible host
 > Sovereign AI OS, the Total Recall reference kernel).
 >
-> Status: **Draft**. The format, type registry, and conformance contract are under
-> active development. Expect breaking changes until v1.0.
+> Status: **Stable for 0.9**. The format, type registry, and conformance contract
+> are settled for this version; until v1.0 a later version MAY still introduce
+> breaking changes.
 >
 > Implementation-specific detail (routes, services, storage backends, deployment)
 > does **not** belong in this document — it belongs in each implementation's own
@@ -1156,7 +1157,7 @@ opaque ID as the slug and keep the human-readable label in `title` / `name`.
 This document is versioned independently of any host and of the conformance
 fixture set.
 
-- The spec version is stated in the document header (currently **v0.9 — Draft**).
+- The spec version is stated in the document header (currently **v0.9**).
 - Breaking changes to the file format, the type registry, or the Operation
   Contract increment the spec version.
 - Until **v1.0**, any version MAY introduce breaking changes.
@@ -1248,14 +1249,14 @@ inside, the resources it must bind at provision time, and provenance.
 | `ssss_core_version` | yes | The `registry/core.json` `spec_version` the bundle targets (e.g. `"0.3"`). A host MUST refuse a bundle whose core version it does not support. |
 | `required_extensions` | yes | Array of extension registry ids the files rely on (e.g. `["festech"]`). Empty array if the bundle uses only core primitives. A host MUST refuse a bundle naming an extension it has not loaded. |
 | `export_profile` | yes | `backup` \| `template` \| `sale` — the §5.5 profile this bundle was built under. Determines the allowed portability classes. |
-| `primitive_inventory` | yes | Map of primitive `type` → count, over every file in the bundle (replaces ultrachat's hard-coded `categories`; it is registry-driven, so extension types appear automatically). |
+| `primitive_inventory` | yes | Map of primitive `type` → count, over every file in the bundle (replaces the legacy hard-coded `categories`; it is registry-driven, so extension types appear automatically). |
 | `provisioning` | yes | Array of provisioning steps (§17.2) — the ordered, declarative plan for binding this bundle into a live workspace. Empty for a pure `backup` that is restored in place. |
 | `parameters` | no | Array of parameter definitions (§16.5) the importer must resolve (e.g. business name, domain). |
 | `source_workspace_id` | no | Origin workspace; OMITTED or nulled in `template`/`sale` profiles (it is operator-identifying). |
 | `file_count` | yes | Length of `files`; a cheap integrity check. |
 | `provenance` | yes | `{ content_hash, exporter, signature? }` (§16.3). |
 
-`primitive_inventory` supersedes ultrachat's fixed `categories` object and `provisioning`
+`primitive_inventory` supersedes the legacy fixed `categories` object and `provisioning`
 supersedes its `capabilities` booleans: both are now open and registry-driven rather than a
 closed enum, so a bundle full of `festech` extension primitives inventories and provisions
 them without a spec change.
@@ -1284,7 +1285,7 @@ honoring `x_portability`) MUST be permitted by `export_profile`.
 
 `parameters` are the values an importer must supply to turn a template into a running
 instance — the difference between "a festival in a box" and "*this* festival." The schema is
-adopted verbatim from ultrachat's `WorkspaceTemplateVariableDefinition`:
+adopted verbatim from the legacy `WorkspaceTemplateVariableDefinition`:
 
 | Field | Meaning |
 |-------|---------|
@@ -1325,7 +1326,7 @@ restoring an SSSS business are reliable operations rather than bespoke migration
 ### 17.2 Provisioning Steps & Binding Vocabulary
 
 A manifest's `provisioning` array is an ordered list of steps. The step schema and its
-controlled vocabularies are adopted from ultrachat's `WorkspaceProvisioningStep` and
+controlled vocabularies are adopted from the legacy `WorkspaceProvisioningStep` and
 `WorkspaceGraphEdge`:
 
 A **step** is `{ id, label, system, mode, required, notes? }`:
@@ -1358,7 +1359,7 @@ cannot resolve a link MUST fail the provision rather than emit a dangling refere
 ### 17.4 Composition & Upgrade
 
 - **Composition** — a bundle MAY depend on other bundles. A dependency carries an
-  `installMode` of `optional | recommended | required` (adopted from ultrachat's
+  `installMode` of `optional | recommended | required` (adopted from the legacy
   `WorkspaceMarketplaceRecommendation`). `provision` installs `required` dependencies before
   the bundle itself; `optional`/`recommended` are surfaced to the operator.
 - **Upgrade** — moving an installed bundle from `v2` to a `v1`-conformant shape (or any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gregiteen/ssss-cli",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "CLI tools and the reference engine for the Structured Semantic Syntax System",
   "main": "src/engine.mjs",
   "exports": {

package/registry/core.json

@@ -205,7 +205,7 @@
       "required": ["key", "label", "type", "scope", "source"],
       "optional": ["required", "description", "defaultValue", "options", "dependsOn"],
       "source_enum": ["user", "llm", "graph", "system"],
-      "note": "Adopted verbatim from ultrachat WorkspaceTemplateVariableDefinition; resource_bound requirements ship as parameters of source user/system."
+      "note": "resource_bound requirements ship as parameters of source user/system."
     },
     "conformance": "A host MUST refuse a bundle whose `ssss_core_version` it does not support or that names a `required_extensions` entry it has not loaded. An exporter MUST NOT emit a file whose resolved portability class is excluded by `export_profile`. `primitive_inventory` MUST count every file by its registry `type`.",
     "spec_ref": "§16"