total-recall-brain 3.45.0 → 3.46.1

package/scaffold/.agent/skills/total-recall/plugins/security/ui/home.js

@@ -0,0 +1,283 @@
+const PLATFORM_LABELS = {
+  darwin: 'macOS', linux: 'Linux', win32: 'Windows', android: 'Android',
+};
+const STATES = {
+  'at-risk': 'At risk', incomplete: 'Incomplete', 'review-required': 'Review required',
+  passed: 'Passed in inspected scope', reviewed: 'Manually reviewed', plan: 'Plan only',
+  unavailable: 'Unavailable', 'header-check-passed': 'Header check passed',
+  pass: 'Observed', fail: 'Needs attention', review: 'Review', unverified: 'Unverified',
+  'user-confirmed': 'User confirmed', 'not-applicable': 'Not applicable',
+};
+const CHECKS = {
+  firewall: 'Firewall', 'disk-encryption': 'Disk encryption', gatekeeper: 'Application assessment',
+  'system-integrity': 'System integrity', 'automatic-updates': 'Automatic updates',
+  'ssh-permitrootlogin': 'SSH root login', 'ssh-passwordauthentication': 'SSH passwords',
+  'ssh-permitemptypasswords': 'SSH empty passwords', 'ssh-pubkeyauthentication': 'SSH public keys',
+  'ssh-file-permissions': 'SSH permissions', 'listening-ports': 'Listening services', 'udp-bindings': 'UDP bindings',
+  'ro.boot.flash.locked': 'Bootloader lock', 'ro.crypto.state': 'Reported disk protection',
+  'ro.build.version.security_patch': 'Reported security patch', 'device-settings-review': 'Device settings review',
+};
+const ASSESSMENTS = new Set(['machine', 'network', 'fleet', 'plugins', 'audit', 'harden', 'probe', 'scan', 'device', 'android']);
+
+const MARKUP = [
+  '<style>',
+  ':host{display:block;color:var(--color-text,#22342d);background:var(--color-background,#f4f0e6);font:var(--typography-body-font-size,15px)/1.55 var(--typography-body-font-family,system-ui,sans-serif)}',
+  '*{box-sizing:border-box}main{max-width:68rem;margin:auto;padding:clamp(16px,4vw,42px)}',
+  'header{display:grid;grid-template-columns:1fr auto;align-items:start;gap:var(--spacing-md,16px);border-bottom:2px solid var(--color-primary,#31564b);padding-bottom:var(--spacing-lg,22px)}',
+  '.mark{letter-spacing:.14em;font-weight:700;text-transform:uppercase;font-size:.72em;color:var(--color-primary,#31564b)}',
+  'h2{margin:.1em 0;font:600 clamp(2rem,6vw,3.5rem)/1.05 var(--typography-title-font-family,Georgia,serif)}',
+  'h3{font:600 1.4rem var(--typography-title-font-family,Georgia,serif);margin:0 0 .45em}p{margin:.4em 0;color:var(--color-muted,#4d6157)}',
+  'dl{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,10rem),1fr));gap:var(--spacing-md,16px);margin:1.1em 0;padding:var(--spacing-md,16px) 0;border-block:1px solid var(--color-border,#aab6a8)}',
+  'dt{font-weight:700;font-size:.75em;letter-spacing:.06em;text-transform:uppercase;color:var(--color-muted,#4d6157)}dd{margin:.15em 0 0;overflow-wrap:anywhere}',
+  '.workbench{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr);gap:var(--spacing-xl,28px);align-items:start;margin-top:var(--spacing-xl,28px)}',
+  'article{min-width:0;padding-left:var(--spacing-md,16px);border-left:3px solid var(--color-primary,#31564b)}',
+  '.buttons,form{display:flex;flex-wrap:wrap;align-items:end;gap:var(--spacing-sm,8px);margin:.7em 0}form>label{display:grid;flex:1 1 12rem;gap:.2em}',
+  'button,input,select{min-height:44px;font:inherit;color:inherit;padding:.38em .75em;border:1px solid var(--color-primary,#31564b);border-radius:var(--radius-sm,4px);background:var(--color-surface,#fdfbf5)}',
+  'button{cursor:pointer;font-weight:650}button:disabled{opacity:.6;cursor:default}button:not(:disabled):hover{background:var(--color-primary-soft,#dce9dd)}',
+  'button:focus-visible,input:focus-visible,select:focus-visible,summary:focus-visible{outline:3px solid var(--color-primary,#31564b);outline-offset:3px}',
+  'details{padding:.55em 0;border-top:1px solid var(--color-border,#aab6a8)}summary{display:flex;align-items:center;min-height:44px;cursor:pointer;font-weight:700}summary::before{content:"+";margin-right:.6em}details[open]>summary::before{content:"−"}',
+  '.confirm{display:flex;align-items:center;min-height:44px}#repair-confirm{min-height:0;margin:.4em .4em .4em 0}#report-state{color:var(--color-primary,#31564b);font-weight:750}#checks{padding-left:1.15em;margin:0}#checks li{margin:.25em 0}#device-checks label{display:grid;gap:.25em;margin:.65em 0}#device-checks select{justify-self:start}',
+  '@media(max-width:620px){header,.workbench{grid-template-columns:1fr}header>button{justify-self:start}}',
+  '</style>',
+  '<main aria-label="Security evidence desk">',
+  '<header><div><div class="mark">Total Recall · Security</div><h2>Evidence desk</h2><p>Choose what to inspect, then review the observed scope.</p></div><button type="button" id="refresh-status">Refresh status</button></header>',
+  '<dl aria-label="Local capability status"><div><dt>Runtime platform</dt><dd id="platform">Checking…</dd></div><div><dt>Assessment profiles</dt><dd id="profiles">Checking…</dd></div><div><dt>Session owner</dt><dd id="auth">Checking…</dd></div></dl>',
+  '<p id="local-state" role="status">Reading local capability metadata…</p>',
+  '<div class="workbench"><section aria-label="Start an assessment">',
+  '<h3>Assess a target</h3><p>Use the machine, network and mesh controls for targets you administer.</p>',
+  '<div class="buttons"><button type="button" data-action="machine">This machine</button><button type="button" data-action="network">Network posture</button><button type="button" data-action="fleet">Mesh fleet</button></div>',
+  '<details><summary>Mesh target</summary><form id="mesh-form"><label>Discovered machine<input id="target" maxlength="128" required></label><button type="button">Inspect target</button></form></details>',
+  '<details><summary>Source and plugin review</summary><div class="buttons"><button type="button" data-action="plugins">Installed plugins</button><button type="button" data-action="audit">Baseline audit</button></div><form id="scan-form"><label>Source directory<input id="source" maxlength="512" required></label><button type="button">Review source</button></form></details>',
+  '<details><summary>Website headers</summary><p>Check a single HTTPS URL you are authorized to test.</p><form id="web-form"><label>HTTPS URL<input id="website" type="url" maxlength="512" required placeholder="https://example.org"></label><button type="button">Check response</button></form></details>',
+  '<details><summary>Device evidence</summary><p>Guided answers are your observations. Enter only a label and the outcome of each check.</p>',
+  '<form id="device-form"><label>Platform<select id="device-platform"><option value="ios">iPhone</option><option value="ipados">iPad</option><option value="android">Android</option><option value="chromeos">ChromeOS</option><option value="chromeos-flex">ChromeOS Flex</option><option value="windows">Windows</option></select></label><label>Device label<input id="device-label" maxlength="80" required></label><button type="button">Load review</button></form>',
+  '<section id="device-review" hidden><div id="device-checks"></div><button type="button" id="evaluate-device">Evaluate review</button></section>',
+  '<form id="android-form"><label>Already authorized Android serial<input id="android-serial" maxlength="128" required></label><button type="button">Read Android properties</button></form></details>',
+  '<details><summary>SSH permission repair</summary><p>Preview the local plan. Repair changes recognized SSH file modes on this machine and rechecks them.</p><div class="buttons"><button type="button" data-action="harden">Preview plan</button></div>',
+  '<label class="confirm"><input type="checkbox" id="repair-confirm"> Apply local SSH permission repair</label><div class="buttons"><button type="button" id="repair" disabled>Repair and verify</button></div></details>',
+  '</section><article aria-label="Assessment report"><h3>Observed evidence</h3><p id="report-state" role="status">No assessment requested</p><dl id="facts" hidden></dl><ul id="checks"></ul></article></div>',
+  '</main>',
+].join('\n');
+
+function parseReport(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value) && !Object.hasOwn(value, 'output')) return value;
+  const raw = typeof value === 'string' ? value : value?.output;
+  if (typeof raw !== 'string' || raw.length > 1_048_576) return null;
+  const text = raw.trim();
+  const candidates = [text, text.slice(text.lastIndexOf('\n{\n') + 1), text.slice(text.lastIndexOf('\n') + 1)];
+  for (const candidate of candidates) {
+    try {
+      const report = JSON.parse(candidate);
+      if (report && typeof report === 'object' && !Array.isArray(report)) return report;
+    } catch { /* A transport error may have no structured report. */ }
+  }
+  return null;
+}
+
+function stateLabel(value) {
+  return typeof value === 'string' && Object.hasOwn(STATES, value) ? STATES[value] : null;
+}
+
+function number(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? String(value) : null;
+}
+
+export class SecurityHome extends HTMLElement {
+  connectedCallback() {
+    if (this.shadowRoot) return;
+    const root = this.attachShadow({ mode: 'open' });
+    root.innerHTML = MARKUP;
+    root.querySelector('#refresh-status').addEventListener('click', () => void this.refresh());
+    root.querySelectorAll('[data-action]').forEach(button => {
+      button.addEventListener('click', () => void this.assess(button.dataset.action));
+    });
+    const field = id => root.getElementById(id);
+    // Dashboard panels run in a sandbox without form submission.
+    const bindAssessment = (id, callback) => {
+      const form = field(id);
+      const run = () => { if (form.reportValidity()) callback(); };
+      form.querySelector('button').addEventListener('click', run);
+      form.addEventListener('keydown', event => {
+        if (event.key !== 'Enter' || event.isComposing || !event.target.matches('input')) return;
+        event.preventDefault();
+        run();
+      });
+    };
+    const identity = () => ['--platform', field('device-platform').value, '--device', field('device-label').value.trim()];
+    bindAssessment('mesh-form', () => void this.assess('fleet', ['--target', field('target').value.trim()]));
+    bindAssessment('scan-form', () => void this.assess('scan', [field('source').value.trim()]));
+    bindAssessment('android-form', () => void this.assess('android', ['--serial', field('android-serial').value.trim()]));
+    bindAssessment('device-form', () => void this.assess('device', identity()));
+    bindAssessment('web-form', () => {
+      try {
+        const url = new URL(field('website').value);
+        if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) throw new Error();
+        void this.assess('probe', ['--url', url.href]);
+      } catch {
+        this.clearReport('Enter an authorized HTTPS URL without credentials, query or fragment.');
+      }
+    });
+    const clearReview = () => {
+      field('device-review').hidden = true;
+      field('device-checks').replaceChildren();
+    };
+    field('device-platform').addEventListener('change', clearReview);
+    field('device-label').addEventListener('input', clearReview);
+    field('evaluate-device').addEventListener('click', () => {
+      const observations = {};
+      for (const select of field('device-checks').querySelectorAll('select[data-observed-at]')) {
+        observations[select.dataset.check] = { status: select.value, observedAt: select.dataset.observedAt };
+      }
+      void this.assess('device', [...identity(), '--answers-json', JSON.stringify(observations)]);
+    });
+    field('repair-confirm').addEventListener('change', () => {
+      field('repair').disabled = this.busy || !field('repair-confirm').checked;
+    });
+    field('repair').addEventListener('click', () => {
+      if (field('repair-confirm').checked) void this.assess('machine', ['--apply-permissions']);
+    });
+    void this.refresh();
+  }
+
+  async request(action, args = []) {
+    let report;
+    try { report = parseReport(await this.host?.run(action, [...args, '--json'])); }
+    catch (error) { report = parseReport(error?.message); }
+    if (!report || report.status === 'failed') throw new Error('No usable assessment result');
+    return report;
+  }
+
+  async refresh() {
+    const root = this.shadowRoot;
+    const button = root.querySelector('#refresh-status');
+    button.disabled = true;
+    const state = root.querySelector('#local-state');
+    state.textContent = 'Reading local capability metadata…';
+    try {
+      const report = await this.request('status');
+      if (report.plugin !== 'security' || !Array.isArray(report.device_coverage?.platforms)) throw new Error();
+      const platform = report.host_platform;
+      root.querySelector('#platform').textContent = Object.hasOwn(PLATFORM_LABELS, platform) ? PLATFORM_LABELS[platform] : 'Other runtime';
+      root.querySelector('#profiles').textContent = String(report.device_coverage.platforms.length);
+      root.querySelector('#auth').textContent = report.auth_integration === 'auth' ? 'Bundled Auth' : 'Unavailable';
+      state.textContent = 'Capability metadata available. Assessments run on demand.';
+    } catch {
+      for (const id of ['platform', 'profiles', 'auth']) root.getElementById(id).textContent = 'Unavailable';
+      state.textContent = 'Local capability metadata is unavailable.';
+    } finally {
+      button.disabled = false;
+    }
+  }
+
+  clearReport(message) {
+    const root = this.shadowRoot;
+    root.querySelector('#report-state').textContent = message;
+    const facts = root.querySelector('#facts');
+    facts.replaceChildren();
+    facts.hidden = true;
+    root.querySelector('#checks').replaceChildren();
+  }
+
+  async assess(action, args = []) {
+    if (this.busy || !ASSESSMENTS.has(action)) return;
+    const root = this.shadowRoot;
+    const confirm = root.querySelector('#repair-confirm');
+    if (args.includes('--apply-permissions') && (action !== 'machine' || !confirm.checked)) return;
+    if (args.some(arg => arg === '')) {
+      this.clearReport('Enter a target before requesting an assessment.');
+      return;
+    }
+    this.busy = true;
+    const controls = Array.from(root.querySelectorAll('button:not(#refresh-status), input, select'));
+    for (const control of controls) control.disabled = true;
+    this.clearReport('Waiting for assessment…');
+    try {
+      const report = await this.request(action, args);
+      this.renderEvidence(report);
+      if (action === 'device' && report.schema === 'security-device/v1' && !args.includes('--answers-json')) {
+        this.renderDeviceReview(report.checks);
+      }
+    } catch {
+      this.clearReport('Assessment unavailable. No result was established.');
+    } finally {
+      this.busy = false;
+      for (const control of controls) control.disabled = false;
+      confirm.checked = false;
+      root.querySelector('#repair').disabled = true;
+    }
+  }
+
+  renderEvidence(report) {
+    const root = this.shadowRoot;
+    const headerStates = report.security_headers && typeof report.security_headers === 'object'
+      ? Object.values(report.security_headers).filter(value => typeof value === 'boolean') : [];
+    const needsReview = report.ok === false || report.passed === false || headerStates.includes(false);
+    const state = report.remediation?.status === 'failed' ? 'Permission repair incomplete'
+      : stateLabel(report.status) || (needsReview ? 'Review required' : 'Assessment returned');
+    root.querySelector('#report-state').textContent = state;
+    const facts = root.querySelector('#facts');
+    const coverage = report.coverage || report.machine?.coverage || {};
+    const pairs = [
+      ['Observed checks or machines', number(coverage.observed)],
+      ['Total checks', number(coverage.total)],
+      ['Selected machines', number(coverage.selected)],
+      ['Manually reviewed', number(coverage.reviewed)],
+      ['Source findings', number(report.total_findings ?? report.findings_count)],
+      ['Plugins assessed', number(report.total_plugins ?? report.plugins_audited)],
+      ['SSH permissions changed', number(report.remediation?.changed ?? report.applied_count)],
+      ['HTTPS response status', number(report.status)],
+      ['Response latency (ms)', number(report.latency_ms)],
+    ];
+    if (headerStates.length) pairs.push(['Expected headers present', headerStates.filter(Boolean).length + ' of ' + headerStates.length]);
+    for (const [label, value] of pairs) {
+      if (value === null) continue;
+      const entry = document.createElement('div');
+      const term = document.createElement('dt');
+      const detail = document.createElement('dd');
+      term.textContent = label;
+      detail.textContent = value;
+      entry.append(term, detail);
+      facts.append(entry);
+    }
+    facts.hidden = facts.childElementCount === 0;
+    const checks = report.checks || report.machine?.checks;
+    if (!Array.isArray(checks)) return;
+    for (const check of checks) {
+      const label = check && Object.hasOwn(CHECKS, check.id) ? CHECKS[check.id] : null;
+      const result = stateLabel(check?.state);
+      if (!label || !result) continue;
+      const item = document.createElement('li');
+      item.textContent = label + ' · ' + result;
+      root.querySelector('#checks').append(item);
+    }
+  }
+
+  renderDeviceReview(checks) {
+    if (!Array.isArray(checks)) return;
+    const root = this.shadowRoot;
+    const form = root.querySelector('#device-checks');
+    form.replaceChildren();
+    for (const check of checks.slice(0, 24)) {
+      if (!check || typeof check.id !== 'string' || !/^[a-z][a-z0-9-]{0,60}$/.test(check.id) || typeof check.title !== 'string') continue;
+      const label = document.createElement('label');
+      const title = document.createElement('span');
+      title.textContent = check.title.slice(0, 120);
+      const guidance = document.createElement('small');
+      guidance.textContent = typeof check.remediation === 'string' ? check.remediation.slice(0, 500) : '';
+      const select = document.createElement('select');
+      select.dataset.check = check.id;
+      select.setAttribute('aria-label', title.textContent);
+      for (const [value, text] of [['unknown', 'Not checked'], ['secure', 'Protection confirmed'], ['needs-attention', 'Needs attention']]) {
+        const option = document.createElement('option');
+        option.value = value;
+        option.textContent = text;
+        select.append(option);
+      }
+      select.addEventListener('change', () => { select.dataset.observedAt = new Date().toISOString(); });
+      label.append(title, guidance, select);
+      form.append(label);
+    }
+    root.querySelector('#device-review').hidden = form.childElementCount === 0;
+  }
+}
+if (!customElements.get('tr-security-home')) customElements.define('tr-security-home', SecurityHome);

package/scaffold/.agent/skills/total-recall/plugins/ssss/DESIGN.md

@@ -0,0 +1,93 @@
+---
+version: alpha
+name: SSSS ledger
+description: Inspection and contract workbench for the canonical SSSS engine, skill and scaffold.
+colors:
+  ink: "#1b1814"
+  panel: "#27211a"
+  line: "#564636"
+  paper: "#f7ebd6"
+  quiet: "#c2b59f"
+  amber: "#b98439"
+  gold: "#f4c97a"
+  pass: "#c2e4ad"
+  fail: "#ffaaa1"
+typography:
+  heading:
+    fontFamily: IBM Plex Sans, system-ui, sans-serif
+    fontSize: 18px
+    fontWeight: 650
+    lineHeight: 1.3
+  body:
+    fontFamily: IBM Plex Sans, system-ui, sans-serif
+    fontSize: 14px
+    fontWeight: 400
+    lineHeight: 1.45
+  evidence:
+    fontFamily: IBM Plex Mono, ui-monospace, monospace
+    fontSize: 13px
+    fontWeight: 400
+    lineHeight: 1.5
+spacing:
+  xs: 4px
+  sm: 8px
+  md: 12px
+  lg: 16px
+rounded:
+  sm: 5px
+  md: 10px
+components:
+  ledger-sheet:
+    backgroundColor: "{colors.ink}"
+    textColor: "{colors.paper}"
+    borderColor: "{colors.line}"
+    borderWidth: 1px
+    borderStyle: solid
+    rounded: "{rounded.md}"
+    padding: "{spacing.lg}"
+    typography: "{typography.body}"
+  ledger-slot:
+    backgroundColor: "{colors.panel}"
+    textColor: "{colors.paper}"
+    borderColor: "{colors.amber}"
+    borderStyle: solid
+    borderWidth: 0 0 0 3px
+    padding: 12px 16px
+  evidence-readout:
+    backgroundColor: "{colors.panel}"
+    textColor: "{colors.paper}"
+    rounded: "{rounded.sm}"
+    padding: "{spacing.md}"
+    typography: "{typography.evidence}"
+  field-pointer:
+    textColor: "{colors.gold}"
+    typography: "{typography.evidence}"
+  verdict-pass:
+    textColor: "{colors.pass}"
+  verdict-fail:
+    textColor: "{colors.fail}"
+---
+
+# SSSS ledger
+
+Operators open this Home to check whether the engine, the portable skill and the managed project scaffold all match the canonical release. From there they can repair managed files, validate a document, verify a registry lock, run engine conformance or create a new project. The page answers one question first: is this installation complete and current? Every other check is an action the operator chooses.
+
+## Identity
+
+The mark is four offset strokes on one spine, like the ruled entries of a ledger. Ink, parchment and amber carry the palette. Amber is the spine: each reading slot has an amber rule on its leading edge, joining the skill and scaffold to the engine identity above them. Gold marks the primary action and the field names that carry a verdict. Pass and fail tones are reserved for verdicts.
+
+## Typography
+
+Headings and body text use IBM Plex Sans. File paths, integrity hashes, JSON pointers and conformance output use IBM Plex Mono, so an operator can compare them character by character.
+
+## Layout
+
+The installation ledger comes first: engine and spec version, skill, then scaffold, each as a slot with its value and the path or failure beneath. Below it, the controls are grouped by the artifact they check: one document, one registry lock, one new project. Each group shows its own verdict. Long evidence such as conformance output scrolls inside its readout instead of stretching the page.
+
+## States
+
+Nothing is seeded. Before the first reading the ledger shows dashes. If the command bridge is missing, or a reply cannot be parsed, the Home says the reading is unavailable and why, and clears earlier readings. A failure names the part that failed and the time of the attempt. Controls are disabled while an operation is running.
+
+## Motion and accessibility
+
+A new verdict slides 3px into place. Reduced motion turns this off. Every control has a visible gold focus ring and a 44px minimum target. Verdicts are announced through a polite live region. Pass and fail are shown in words as well as color.

package/scaffold/.agent/skills/total-recall/plugins/ssss/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-ssss",
-      "version": "0.1.3",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5"

package/scaffold/.agent/skills/total-recall/plugins/ssss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
@@ -11,6 +11,7 @@
     "ui/",
     "scripts/",
     "cli.mjs",
+    "DESIGN.md",
     "plugin.json"
   ],
   "scripts": {

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
   "use_cases": ["software-development", "state-conformance"],
@@ -72,10 +72,12 @@
     "name": "SSSS", "color": "#b98439", "accent": "#f4c97a", "font": "ibm-plex",
     "density": "compact", "radius": "sm", "header": "ledger-rule", "logo": "ui/logo.svg"
   },
+  "auth": { "plugin": "auth", "methods": ["passkey", "google-oauth2"], "session_verification": true },
   "ui": {
-    "design_tokens": "ui/DESIGN.md",
+    "design_tokens": "DESIGN.md",
+    "home": "home",
     "elements": [
-      {"id":"card","kind":"card","tag":"tr-ssss-card","module":"ui/card.js","description":"SSSS installation and contract workbench"}
+      {"id":"home","kind":"panel","tag":"tr-ssss-home","module":"ui/home.js","description":"SSSS installation ledger with document, registry, scaffold and conformance checks"}
     ]
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/ui/chunks/conformance.md

@@ -0,0 +1,26 @@
+---
+type: ui-chunk:chunk
+plugin: ssss
+id: conformance
+title: Engine conformance
+description: Runs the canonical SSSS reference engine conformance suite and reports its exit code and full output as evidence.
+timestamp: '2026-11-08T08:12:00Z'
+intents: ["run ssss conformance", "does the ssss engine pass its suite", "engine conformance evidence"]
+surfaces: [page]
+operations: [conformance]
+data: ["conformance:/ok", "conformance:/exitCode", "conformance:/signal", "conformance:/output", "conformance:/error", "conformance:/checkedAt"]
+panel: home
+---
+<section class="ssss-suite" data-design-component="ledger-sheet" aria-labelledby="ssss-conformance-title">
+  <style>
+    .ssss-suite { display:grid; gap:var(--spacing-md, 12px); }
+    .ssss-suite h2 { margin:0; font:var(--typography-heading-font-weight, 650) var(--typography-heading-font-size, 18px)/var(--typography-heading-line-height, 1.3) var(--typography-heading-font-family, sans-serif); }
+    .ssss-suite p { margin:0; color:var(--color-quiet, #c2b59f); }
+  </style>
+  <h2 id="ssss-conformance-title">Engine conformance</h2>
+  <p>Runs the reference engine suite that ships with the canonical package, with a two-minute limit. This checks the engine, not your installation or your documents.</p>
+  <div data-design-component="evidence-readout">
+    <p>Passes only on exit code 0. The suite's own output is kept whole as evidence. A timeout or signal is reported as a failure with its cause.</p>
+    <code data-design-component="field-pointer">exitCode · signal · output · error</code>
+  </div>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/ssss/ui/chunks/registry.md

@@ -0,0 +1,37 @@
+---
+type: ui-chunk:chunk
+plugin: ssss
+id: registry
+title: Registry lock
+description: Compares a registry lock file's integrity with the effective SSSS registry composed from the canonical core and any extension registries.
+timestamp: '2026-11-08T08:12:00Z'
+intents: ["verify ssss registry lock", "has the registry drifted", "compare registry integrity", "check extension registry lock"]
+surfaces: [page]
+operations: [registry]
+data: ["registry:/ok", "registry:/valid", "registry:/expected_integrity", "registry:/actual_integrity", "registry:/specVersion", "registry:/error", "registry:/checkedAt"]
+panel: home
+---
+<section class="ssss-lock" data-design-component="ledger-sheet" aria-labelledby="ssss-registry-title">
+  <style>
+    .ssss-lock { display:grid; gap:var(--spacing-md, 12px); }
+    .ssss-lock h2 { margin:0; font:var(--typography-heading-font-weight, 650) var(--typography-heading-font-size, 18px)/var(--typography-heading-line-height, 1.3) var(--typography-heading-font-family, sans-serif); }
+    .ssss-lock p { margin:0; color:var(--color-quiet, #c2b59f); }
+    .ssss-lock .pair { display:grid; grid-template-columns:repeat(auto-fit, minmax(min(100%, 220px), 1fr)); gap:var(--spacing-sm, 8px); }
+    .ssss-lock .pair > div { display:grid; gap:var(--spacing-xs, 4px); }
+  </style>
+  <h2 id="ssss-registry-title">Registry lock</h2>
+  <p>A lock matches only when its integrity equals the integrity of the registry this engine composes now.</p>
+  <div class="pair">
+    <div data-design-component="ledger-slot">
+      <strong>Expected</strong>
+      <span>Computed from the canonical core and the extensions you name.</span>
+      <code data-design-component="field-pointer">expected_integrity</code>
+    </div>
+    <div data-design-component="ledger-slot">
+      <strong>In the lock</strong>
+      <span>Read from the lock file. Empty when the lock has none.</span>
+      <code data-design-component="field-pointer">actual_integrity</code>
+    </div>
+  </div>
+  <p>The verdict is <code data-design-component="field-pointer">valid</code>. It is checked against spec <code data-design-component="field-pointer">specVersion</code>.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/ssss/ui/chunks/repair.md

@@ -0,0 +1,42 @@
+---
+type: ui-chunk:chunk
+plugin: ssss
+id: repair
+title: Repair managed files
+description: Restores missing, stale or previously repinned managed SSSS skill and scaffold files in the selected brain, then verifies them again.
+timestamp: '2026-11-08T08:12:00Z'
+intents: ["repair ssss installation", "restore missing ssss skill", "fix stale ssss scaffold", "replace dangling ssss skill link"]
+surfaces: [page]
+operations: [repair]
+data: ["repair:/ok", "repair:/version", "repair:/specVersion", "repair:/skill/ok", "repair:/skill/files", "repair:/scaffold/ok", "repair:/scaffold/files", "repair:/recoveredFrom", "repair:/replacedLink/path", "repair:/replacedLink/target", "repair:/error", "repair:/checkedAt"]
+panel: home
+---
+<section class="ssss-repair" data-design-component="ledger-sheet" aria-labelledby="ssss-repair-title">
+  <style>
+    .ssss-repair { display:grid; gap:var(--spacing-md, 12px); }
+    .ssss-repair h2 { margin:0; font:var(--typography-heading-font-weight, 650) var(--typography-heading-font-size, 18px)/var(--typography-heading-line-height, 1.3) var(--typography-heading-font-family, sans-serif); }
+    .ssss-repair p, .ssss-repair dd { margin:0; }
+    .ssss-repair dl { display:grid; gap:var(--spacing-sm, 8px); margin:0; }
+    .ssss-repair dt { color:var(--color-paper, #f7ebd6); font-weight:650; }
+    .ssss-repair dd { color:var(--color-quiet, #c2b59f); }
+    .ssss-repair .warn { color:var(--color-gold, #f4c97a); }
+  </style>
+  <h2 id="ssss-repair-title">Repair managed files</h2>
+  <p class="warn">Writes to the selected brain. It runs only when you choose Repair in the SSSS Home panel.</p>
+  <dl>
+    <div data-design-component="ledger-slot">
+      <dt>What it replaces</dt>
+      <dd>Managed skill and scaffold files that are missing or differ from the canonical release. A dangling or stale skill link becomes a managed folder. The link's target is left untouched.</dd>
+    </div>
+    <div data-design-component="ledger-slot">
+      <dt>What it keeps</dt>
+      <dd>Your skill wrapper and any unrelated files. A previously repinned scaffold is set aside, not deleted.</dd>
+      <dd><code data-design-component="field-pointer">recoveredFrom · replacedLink.path · replacedLink.target</code></dd>
+    </div>
+    <div data-design-component="ledger-slot">
+      <dt>How it reports</dt>
+      <dd>The same ledger as the installation check, read again after the repair. If verification still fails, the error names the part.</dd>
+      <dd><code data-design-component="field-pointer">ok · skill.files · scaffold.files · error</code></dd>
+    </div>
+  </dl>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/ssss/ui/chunks/scaffold.md

@@ -0,0 +1,33 @@
+---
+type: ui-chunk:chunk
+plugin: ssss
+id: scaffold
+title: New SSSS project
+description: Creates a complete canonical SSSS project in a new or empty directory inside the workspace, optionally with an extension and Total Recall wiring.
+timestamp: '2026-11-08T08:12:00Z'
+intents: ["scaffold an ssss project", "create a new ssss app", "start a project with total recall wiring", "new project with extension registry"]
+surfaces: [page]
+operations: [scaffold]
+data: ["scaffold:/ok", "scaffold:/directory", "scaffold:/files", "scaffold:/version", "scaffold:/error", "scaffold:/checkedAt"]
+panel: home
+---
+<section class="ssss-new" data-design-component="ledger-sheet" aria-labelledby="ssss-scaffold-title">
+  <style>
+    .ssss-new { display:grid; gap:var(--spacing-md, 12px); }
+    .ssss-new h2 { margin:0; font:var(--typography-heading-font-weight, 650) var(--typography-heading-font-size, 18px)/var(--typography-heading-line-height, 1.3) var(--typography-heading-font-family, sans-serif); }
+    .ssss-new p { margin:0; color:var(--color-quiet, #c2b59f); }
+    .ssss-new ol { margin:0; padding-left:1.4em; display:grid; gap:var(--spacing-xs, 4px); }
+    .ssss-new .warn { color:var(--color-gold, #f4c97a); }
+  </style>
+  <h2 id="ssss-scaffold-title">New SSSS project</h2>
+  <p class="warn">Creates files. It runs only when you choose Create project in the SSSS Home panel.</p>
+  <ol>
+    <li>The canonical generator builds the whole project in a private staging folder.</li>
+    <li>The result must include its conformance test, or nothing is published.</li>
+    <li>The project moves into your directory only if that directory is new or empty.</li>
+  </ol>
+  <div data-design-component="ledger-slot">
+    <p>The result reports where the project went, every file created and the engine release that generated it.</p>
+    <code data-design-component="field-pointer">directory · files · version · error</code>
+  </div>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/ssss/ui/chunks/status.md

@@ -0,0 +1,43 @@
+---
+type: ui-chunk:chunk
+plugin: ssss
+id: status
+title: Installation ledger
+description: Shows whether the engine, the portable SSSS skill and the managed project scaffold in the selected brain match the canonical release.
+timestamp: '2026-11-08T08:12:00Z'
+intents: ["check ssss installation", "is the ssss skill current", "inspect ssss scaffold", "ssss engine version"]
+surfaces: [page]
+operations: [status]
+data: ["status:/ok", "status:/version", "status:/specVersion", "status:/skill/ok", "status:/skill/files", "status:/skill/path", "status:/skill/error", "status:/scaffold/ok", "status:/scaffold/files", "status:/scaffold/path", "status:/scaffold/error", "status:/checkedAt"]
+panel: home
+---
+<section class="ssss-ledger" data-design-component="ledger-sheet" aria-labelledby="ssss-status-title">
+  <style>
+    .ssss-ledger { display:grid; gap:var(--spacing-md, 12px); }
+    .ssss-ledger h2 { margin:0; font:var(--typography-heading-font-weight, 650) var(--typography-heading-font-size, 18px)/var(--typography-heading-line-height, 1.3) var(--typography-heading-font-family, sans-serif); }
+    .ssss-ledger p { margin:0; color:var(--color-quiet, #c2b59f); }
+    .ssss-ledger ol { display:grid; grid-template-columns:repeat(auto-fit, minmax(min(100%, 190px), 1fr)); gap:1px; margin:0; padding:0; list-style:none; background:var(--color-line, #564636); }
+    .ssss-ledger li { display:grid; gap:var(--spacing-xs, 4px); }
+    .ssss-ledger strong { color:var(--color-paper, #f7ebd6); }
+  </style>
+  <h2 id="ssss-status-title">Installation ledger</h2>
+  <p>Three entries on one spine. The release is complete only when all three agree.</p>
+  <ol>
+    <li data-design-component="ledger-slot">
+      <strong>Engine and spec</strong>
+      <span>The canonical engine release and the specification version it implements.</span>
+      <code data-design-component="field-pointer">version · specVersion</code>
+    </li>
+    <li data-design-component="ledger-slot">
+      <strong>Portable skill</strong>
+      <span>Every managed skill file matches its pinned hash. A local wrapper is preserved.</span>
+      <code data-design-component="field-pointer">skill.ok · skill.files · skill.path · skill.error</code>
+    </li>
+    <li data-design-component="ledger-slot">
+      <strong>Project scaffold</strong>
+      <span>The complete starter project, held under the brain with its integrity receipt.</span>
+      <code data-design-component="field-pointer">scaffold.ok · scaffold.files · scaffold.path · scaffold.error</code>
+    </li>
+  </ol>
+  <p>Read-only. Choose the brain and run the check from the SSSS Home panel.</p>
+</section>