@gregiteen/ssss-cli 0.9.2 → 0.9.4

package/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-09-25
+### Fixed
+- The kernel now returns symbolic failure codes with transport status mapping,
+  reconciles prepared resources on dry runs and pre-commit failures, and keeps
+  logged commits intact when resource finalization or projection dispatch fails.
+- The reference frontmatter parser handles the documented block-scalar subset,
+  and capability and legacy-role checks match the v0.9 authorization contract.
+
+### Changed
+- Aligned the v0.9 specification, conformance fixture statuses, and reference
+  implementation. The in-process runner checks expected HTTP statuses, and
+  `npm test` validates the spec's example documents and contract tables.
+- Exposed every repository skill to Codex through relative links in
+  `.agents/skills`, while keeping the project Total Recall brain private.
+- The release SBOM now hashes only the files included in the npm package.
+
+### Added
+- Completed the `SPEC_CODE_ALIGNMENT` project documentation and audit.
+- Expanded the SSSS project-management skill with workflow references,
+  document checks, and review guidance.
+
+## [0.9.3] - 2026-09-24
+### Fixed
+- Two processes sending an `event` envelope with the same idempotency key at the
+  same moment could both append an event, because the kernel records the result
+  only after committing and `event` envelopes have no VFS compare-and-swap. The
+  kernel now derives an `event` envelope's `event_id` from `(workspace_id,
+  idempotency_key)` (`idempotentEventId`, UUIDv5), so the event store rejects
+  the second append. Any request that loses at commit re-reads the idempotency
+  store and returns the winner's result as a replay, or an idempotency conflict
+  when its request differs. If a process dies after appending an event but
+  before recording its result, retries of that key now fail instead of
+  appending a second event.
+
+### Added
+- `idempotentEventId(workspaceId, idempotencyKey)` in `@gregiteen/ssss-cli/events`.
+- Conformance checks racing six kernel processes on one `event` idempotency key,
+  with identical and with differing content.
+
 ## [0.9.2] - 2026-09-24
 ### Fixed
 - The file adapters are now safe to share between processes. Each one checked

package/VERSION

@@ -1 +1 @@
-0.9.2
+0.9.4

package/conformance/fixtures.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://ssss.dev/conformance/v1",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Canonical SSSS Operation Contract conformance fixtures. These define the canonical request/response shapes for the Operation Contract (spec §6) and are the shared test contract every SSSS implementation MUST pass. A host is conformant only if, for every fixture, it produces the expected response and status code (spec §12).",
   "spec_url": "../docs/ssss-spec.md",
   "operation_types": {
@@ -159,6 +159,9 @@
         "idempotency_key": "22222222-2222-2222-2222-222222222222",
         "path": "assistants/bad-bot/ASSISTANT.md",
         "workspace_id": "TEST_WORKSPACE_ID",
+        "actor": {
+          "role": "system"
+        },
         "content": "---\ntype: assistant\ntitle: \"Create Assistant — Missing Required Name Field\"\ntimestamp: \"2026-07-02T00:00:00Z\"\ndescription: \"Missing the name field.\"\n---\n\n## Instructions\n\nBroken bot.",
         "intent": "Conformance fixture: missing required name field"
       },
@@ -302,7 +305,7 @@
           ]
         }
       },
-      "expected_http_status": 422
+      "expected_http_status": 400
     },
     {
       "id": "fixture-008",
@@ -413,7 +416,7 @@
           ]
         }
       },
-      "expected_http_status": 422
+      "expected_http_status": 401
     },
     {
       "id": "fixture-012",
@@ -469,9 +472,9 @@
             "Missing required field 'object' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md.",
             "Missing required field 'sentiment_polarity' for type 'memory' when schema_version==2 in memory/incomplete-schema2.md."
           ]
-        },
-        "expected_http_status": 422
-      }
+        }
+      },
+      "expected_http_status": 422
     },
     {
       "id": "fixture-014",
@@ -611,7 +614,7 @@
           ]
         }
       },
-      "expected_http_status": 422
+      "expected_http_status": 403
     },
     {
       "id": "fixture-019",
@@ -754,21 +757,27 @@
         "idempotency_key": "35353535-3535-3535-3535-353535353535",
         "path": "rules/translatable-refund-rule.md",
         "workspace_id": "TEST_WORKSPACE_ID",
-        "actor": { "role": "system" },
+        "actor": {
+          "role": "system"
+        },
         "content": "---\ntype: rule\ntitle: \"Política de reembolsos\"\ndescription: \"Explica cuándo están disponibles los reembolsos.\"\ntimestamp: \"2026-07-10T00:00:00Z\"\nname: refund-policy\nlanguage: es\n---\nLos reembolsos están disponibles antes de la fecha límite.",
         "intent": "Conformance fixture: create a non-English structural source"
       },
       "expected_response": {
         "success": true,
         "type": "operation",
-        "validation": { "valid": true, "type": "rule", "errors": [] }
+        "validation": {
+          "valid": true,
+          "type": "rule",
+          "errors": []
+        }
       }
     }
   ],
   "error_codes": {
     "400": "invalid_request — Invalid parameters, directory traversal, malformed request envelope, or path template mismatch",
-    "401": "unauthorized — Missing or invalid auth token / session",
-    "403": "forbidden — Access denied (workspace membership check failed or system scope isolation violation)",
+    "401": "unauthorized — Missing or invalid verified principal (no authenticated identity reached the kernel)",
+    "403": "forbidden — The verified principal is not scoped to the workspace or lacks a required capability",
     "404": "not_found — The requested file to patch or delete does not exist",
     "409": "lease_conflict, version_conflict, or idempotency_conflict — Lease locked, out-of-date expected version, or idempotency key replay payload mismatch",
     "422": "validation_failed — Primitive registry/conformance validation errors (contains validation.errors and repair in body)",
@@ -781,5 +790,5 @@
   ],
   "maintained_by": "SSSS standard (canonical: this repo)",
   "provenance": "Seeded from the festech.live reference implementation, which authored the original shared contract; canonicalized here as the vendor-neutral source of truth.",
-  "last_updated": "2026-07-10"
+  "last_updated": "2026-09-24"
 }

package/conformance/reference-bundle.ucw.json

@@ -106,7 +106,7 @@
     "file_count": 14,
     "provenance": {
       "content_hash": "sha256:7febd673938a3dc04c068e0bf08097a9783c09e612606d2df9a4db8dcb8907f5",
-      "exporter": "@gregiteen/ssss-cli@0.9.2"
+      "exporter": "@gregiteen/ssss-cli@0.9.4"
     }
   },
   "files": [

package/docs/help/concurrency.md

@@ -13,6 +13,23 @@ most one racer wins:
 
 `.ssss-locks/` is reserved: VFS paths under it are rejected and `list()` skips it.
 
+## Same idempotency key from two processes
+
+The kernel records a request's result only after it commits, so two processes
+can both miss the stored result for one key. The commit step then decides:
+
+- `operation`, `patch`, `delete`: the VFS compare-and-swap lets one commit; the
+  other fails its precondition.
+- `event`: the event's `event_id` is derived from `(workspace_id,
+  idempotency_key)` (`idempotentEventId`, a UUIDv5), so the event store rejects
+  the second append.
+
+The loser then re-reads the idempotency store: if the winner has already
+recorded its result, the loser returns it as a replay (or an idempotency
+conflict when its request differs); otherwise it fails and a retry replays. If a
+process dies after appending an event but before recording the result, retries
+of that key fail rather than append a second event.
+
 ## Crashed holders
 
 A lock records its holder's pid and host. A waiter breaks the lock when the
@@ -31,10 +48,6 @@ Symlinked lock files are refused.
 
 - Locks are advisory: only writers using these adapters take them. Writers from
   `@gregiteen/ssss-cli` 0.9.1 and earlier do not.
-- The kernel's idempotency check for `event` envelopes is read before commit and
-  written after, so two processes sending the same idempotency key at the same
-  moment can each append an event. `operation`, `patch`, and `delete` are
-  protected by the VFS compare-and-swap.
 - Network filesystems must support exclusive create (`O_EXCL`).
 - Dead-holder detection assumes processes that share the filesystem have
   distinct hostnames (containers with the same hostname and separate pid