satroot 1.4.0__py3-none-any.whl

satroot-1.4.0.dist-info/METADATA

@@ -0,0 +1,3013 @@
+Metadata-Version: 2.4
+Name: satroot
+Version: 1.4.0
+Summary: SATROOT-1: one native satoshi as root witness for unbounded semantic token state.
+Author-email: PARTH MAURIA SAXENA <parthms.id@gmail.com>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/parthod0x/satroot
+Project-URL: Repository, https://github.com/parthod0x/satroot
+Project-URL: Changelog, https://github.com/parthod0x/satroot/blob/main/CHANGELOG.md
+Keywords: bsv,bitcoin,satoshi,tokens,semantic-ledger,machine-native
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Provides-Extra: crypto
+Requires-Dist: cryptography>=42; extra == "crypto"
+Provides-Extra: validation
+Requires-Dist: jsonschema>=4.23; extra == "validation"
+Dynamic: license-file
+
+# SATROOT
+
+**SATROOT** is a one-satoshi-rooted semantic asset protocol.
+
+Its base primitive, **SATROOT-1**, treats one native BSV satoshi UTXO as the irreducible accounting floor and uses that UTXO as a root witness, authority handle, and namespace anchor for deterministic protocol state.
+
+The core rule is simple:
+
+> The satoshi is not subdivided. The satoshi anchors a protocol-defined state space.
+
+## Project thesis
+
+SATROOT starts from one idea:
+
+> A satoshi is the floor of value; it is not the ceiling of meaning.
+
+That means one satoshi can anchor a replayable semantic ledger without pretending to create sub-satoshis. Token units, credits, receipts, rights, and other objects live as protocol-defined state above the native chain unit.
+
+## Quickstart
+
+Requires Python 3.10 or newer. From a clone of this repo:
+
+```bash
+pip install -e .
+satroot1 replay examples/events_floor1.json
+```
+
+That replays the checked-in `FLOOR1` demo ledger and prints its deterministic balances and state hash. Add the extras for the full surface: `pip install -e ".[crypto,validation]"` enables ed25519 signing (used by the anchored lanes) and JSON-schema validation (used by the publication workspace generators). Every checked-in example runs on placeholder roots — see `ANCHORS.md` for the real testnet anchoring record, and `SPEC.md` for the protocol itself. Licensed Apache-2.0.
+
+## What this repo delivers
+
+This repository ships the `SATROOT-1` kernel, six registered profiles, the publication ladder, and the anchored proof loop:
+
+- `SPEC.md` - human-readable protocol specification.
+- `ARCHITECTURE.md` - top-level model, layer boundaries, and deliverable framing.
+- `BOUNDARIES.md` - claim discipline, non-goals, and legal boundary language.
+- `ROADMAP.md` - project scope, deliverables, and released plus planned protocol profiles.
+- `ANCHORS.md` - the only checked-in record of real on-chain outpoints and transaction ids.
+- `KEY_MANAGEMENT.md` - operational guidance for composing the frozen signature schemes: custody separation, verifier-only distribution, rotation, and the lint-versus-verify trust model (`*-lint` is structural; `verify-*` is the cryptographic gate).
+- `CHANGELOG.md`, `RELEASE_CHECKLIST.md`, `CITATION.cff` - release history, pre-tag gates, and citation metadata.
+- `protocol/satroot1.schema.json` - JSON schema for genesis and event records.
+- `protocol/satroot1.bundle-manifest.schema.json` - JSON schema for signed bundle manifests.
+- `protocol/satroot1.bundle-index.schema.json` - JSON schema for bundle index catalogs.
+- `protocol/satroot1.release-manifest.schema.json` - JSON schema for signed release manifests.
+- `protocol/satroot1.release-catalog.schema.json` - JSON schema for multi-release catalogs.
+- `protocol/satroot1.release-catalog-manifest.schema.json` - JSON schema for signed multi-release catalog manifests.
+- `protocol/satroot1.release-catalog-index.schema.json` - JSON schema for multi-catalog release index exports.
+- `protocol/satroot1.release-catalog-index-manifest.schema.json` - JSON schema for signed multi-catalog release index manifests.
+- `protocol/satroot1.demo-catalog-summary.schema.json` - JSON schema for demo catalog workspace summaries.
+- `protocol/satroot1.publication-stack-summary.schema.json` - JSON schema for publication-stack workspace summaries.
+- `protocol/satroot1.publication-network-summary.schema.json` - JSON schema for publication-network workspace summaries.
+- `protocol/satroot1.publication-descriptor-index.schema.json` - JSON schema for publication descriptor indexes.
+- `protocol/satroot1.publication-descriptor-index-manifest.schema.json` - JSON schema for signed publication descriptor index manifests.
+- `protocol/satroot1.publication-metadata-manifest.schema.json` - JSON schema for signed publication metadata bundles.
+- `protocol/satroot1.publication-metadata-catalog.schema.json` - JSON schema for multi-bundle publication metadata catalogs.
+- `protocol/satroot1.publication-metadata-catalog-manifest.schema.json` - JSON schema for signed publication metadata catalog manifests.
+- `protocol/satroot1.publication-registry.schema.json` - JSON schema for top-level publication registries.
+- `protocol/satroot1.publication-registry-manifest.schema.json` - JSON schema for signed publication registry manifests.
+- `protocol/satroot1.profile-registry.json` - explicit compatibility registry for supported profiles.
+- `src/satroot1.py` - reference parser, deterministic replay engine, and signing utility CLI.
+- `src/satroot_*_smoke.py` and `scripts/run_*.py` - the packaged smoke-lane modules and repo-local entrypoints, from per-profile lanes up through the operator proof, release gate, and the four anchored lanes.
+- `examples/` - seven runnable demo ledgers (`FLOOR1`, `USDROOT1`, `APICREDIT1`, `RECEIPT1`, `IDENTITY1`, `LICENSE1`, `EVENT1`) and the reusable preset trees.
+- `examples/README.md` - guide to the reusable example preset trees, including collection-backed companions.
+- `examples/catalog_presets/` - reusable SATROOT demo catalog scenario presets.
+- `examples/bundle_index_presets/` - reusable SATROOT bundle-index presets.
+- `examples/release_catalog_presets/` - reusable SATROOT release-catalog publication presets.
+- `examples/release_catalog_index_presets/` - reusable SATROOT release-catalog-index publication presets.
+- `examples/publication_descriptor_index_presets/` - reusable SATROOT publication-descriptor-index presets.
+- `examples/publication_metadata_catalog_presets/` - reusable SATROOT publication-metadata-catalog presets.
+- `examples/publication_catalog_workspace_presets/` - reusable SATROOT publication-catalog-workspace presets.
+- `examples/registry_presets/` - reusable SATROOT publication-registry presets.
+- `examples/registry_workspace_presets/` - reusable SATROOT publication-registry-workspace presets.
+- `examples/network_presets/` - reusable SATROOT publication-network presets.
+- `examples/stack_presets/` - reusable SATROOT end-to-end publication-stack presets.
+- `tests/` - test modules covering the kernel plus every packaged smoke lane.
+- `profiles/stable/SATROOT-STABLE-1.md` - reference-only stable-value profile draft.
+- `profiles/machine/SATROOT-MACHINE-1.md` - prepaid machine-credit profile draft.
+- `profiles/receipt/SATROOT-RECEIPT-1.md` - receipt and invoice object profile draft.
+- `profiles/identity/SATROOT-IDENTITY-1.md` - identity and authority object profile draft.
+- `profiles/license/SATROOT-LICENSE-1.md` - license and usage-right object profile draft.
+- `profiles/event/SATROOT-EVENT-1.md` - event-stream head object profile draft.
+
+## SATROOT-1 in one sentence
+
+`SATROOT-1` turns one satoshi into a root-bound namespace for deterministic semantic token state.
+
+For the higher-level framing of how BSV, the SATROOT kernel, and the profile system fit together, see `ARCHITECTURE.md`.
+
+The `SATROOT-1` kernel defines:
+
+- a `root_id` bound to a one-satoshi UTXO,
+- a genesis record,
+- `mint`, `transfer`, `burn`, `freeze`, and `rotate-authority` events,
+- strict sequencing with `prev_event_id`,
+- deterministic replay and balance computation,
+- a supply invariant,
+- explicit root authority rotation for mint-control handoff,
+- explicit freeze / unfreeze controls for account-level balance locks,
+- registry-backed profile compatibility checks,
+- runtime guardrails for stable reference-only profile metadata,
+- runtime guardrails for machine and singleton-object profile metadata,
+- a canonical signing payload model,
+- a built-in `hmac-sha256` reference verifier path for shared-secret environments,
+- an optional `ed25519` verifier path behind the `crypto` extra,
+- explicit `signature_scheme` and `signature_key_id` protocol metadata,
+- optional `event_id` and `state_hash` verification,
+- reference helpers for signing a single event or a whole ledger,
+- profile-aware genesis scaffolding for base and draft SATROOT profiles,
+- event scaffolding for valid non-genesis SATROOT records from an existing ledger or explicit references,
+- append-and-sign event workflows for extending existing demo or signed ledgers,
+- profile-aware lifecycle helpers for common machine-credit consumption flows,
+- a one-shot SATROOT-MACHINE-1 machine-credit demo bootstrap for runnable machine-profile artifact generation,
+- a one-shot SATROOT-MACHINE-1 signed demo-bundle bootstrap for release-ready machine-profile artifacts,
+- a one-shot SATROOT-MACHINE-1 demo-release bootstrap for bundle plus release publication generation,
+- a one-shot SATROOT-MACHINE-1 demo-catalog bootstrap for workspace-ready machine-profile release lanes,
+- a one-shot SATROOT-MACHINE-1 publication-catalog-workspace bootstrap for machine-profile descriptor and metadata publication lanes,
+- a one-shot SATROOT-MACHINE-1 publication-registry-workspace bootstrap for machine-profile descriptor, metadata, and registry publication lanes,
+- profile-aware lifecycle helpers for singleton receipt, identity, and license transfer, archival, and retirement flows,
+- a one-shot singleton receipt/identity/license demo bootstrap for runnable object-profile lifecycle artifacts,
+- a one-shot singleton receipt/identity/license signed demo-bundle bootstrap for verifiable object-profile artifacts,
+- a one-shot singleton receipt/identity/license demo-release bootstrap for bundle plus release publication generation,
+- a one-shot SATROOT-STABLE-1 reference-demo bootstrap for runnable stable-profile artifact generation,
+- a one-shot SATROOT-STABLE-1 signed demo-bundle bootstrap for release-ready stable-profile artifacts,
+- a one-shot SATROOT-STABLE-1 demo-release bootstrap for bundle plus release publication generation,
+- a one-shot multi-profile demo catalog workspace bootstrap for bundles plus signed catalog release generation,
+- repeated-preset multi-profile demo release collection bootstraps for packaging mixed generated releases into reusable release collections,
+- repeated-preset multi-profile demo release catalog publication bootstraps for turning mixed generated releases into signed release catalogs in one step,
+- repeated-preset multi-profile demo release catalog index publication bootstraps for turning mixed generated releases into signed release-catalog index publications in one step,
+- a `satroot1` CLI entry point for replay and signing workflows,
+- verifier-aware CLI replay for `demo`, `hmac-sha256`, and `ed25519` ledgers,
+- schema-aware CLI validation for raw SATROOT-1 JSON files,
+- commitment-aware CLI annotation for adding deterministic `event_id` and `state_hash` fields,
+- signer-map bootstrapping helpers for deriving `signer -> key_id` mappings from ledgers,
+- HMAC secret generation helpers for controlled shared-secret workflows,
+- Ed25519 private-key generation helpers for bootstrapping SATROOT signing workflows,
+- one-shot HMAC workflow bootstrapping for signer maps plus shared-secret material,
+- Ed25519 key-derivation helpers for producing replay-ready public key maps from private key maps,
+- one-shot Ed25519 workflow bootstrapping for signer maps plus private/public key material,
+- one-shot signed-ledger bundle generation for HMAC and Ed25519 workflows,
+- machine-readable signed bundle manifests describing artifacts, verifier-material scope, per-file hashes, and the full final replay snapshot,
+- manifest-only bundle inspection via `bundle-summary` when replay is unnecessary,
+- structural bundle linting via `bundle-lint` for missing files and manifest layout drift,
+- unsigned multi-bundle inspection via `bundle-index-summary` before release signing,
+- structural bundle-index linting via `bundle-index-lint` for nested bundle manifest drift,
+- release-level inspection via `release-summary` when signature verification is unnecessary,
+- structural release linting via `release-lint` for bundle-index and manifest drift,
+- deterministic bundle-index generation for release catalogs spanning multiple bundles,
+- discovery-based bundle catalog packaging from parent artifact directories,
+- optional release metadata on bundle indexes for channel, label, and published-at packaging context,
+- signed release-manifest generation for authenticating distributable bundle-index publications,
+- release-key bootstrap helpers for HMAC and Ed25519 publication signing workflows,
+- one-shot `publish-release` orchestration for ready-to-verify release directories,
+- preset export commands for deriving reusable bundle-index presets back from generated signed release inputs,
+- deterministic release-catalog generation for aggregating multiple signed release publications,
+- catalog-level inspection via `release-catalog-summary` when signature verification is unnecessary,
+- structural release-catalog linting via `release-catalog-lint` for catalog and nested release drift,
+- signed release-catalog-manifest generation for authenticating multi-release catalogs,
+- one-shot `publish-release-catalog` orchestration for ready-to-verify release-catalog directories,
+- deterministic release-catalog-index generation for aggregating multiple signed release-catalog publications,
+- index-level inspection via `release-catalog-index-summary` when signature verification is unnecessary,
+- structural release-catalog-index linting via `release-catalog-index-lint` for index and nested catalog drift,
+- signed release-catalog-index-manifest generation for authenticating multi-catalog release indexes,
+- one-shot `publish-release-catalog-index` orchestration for ready-to-verify release-catalog-index directories,
+- preset export commands for deriving reusable release-catalog and release-catalog-index presets back from generated signed artifact layers,
+- one-shot `bootstrap-genesis-bundle` scaffolding for signed starter bundles from profile-aware genesis defaults,
+- one-shot `bootstrap-release-publication` orchestration for release material plus signed publication outputs,
+- one-shot `bootstrap-release-catalog-publication` orchestration for release-catalog material plus signed publication outputs,
+- one-shot `bootstrap-release-catalog-index-publication` orchestration for release-catalog-index material plus signed publication outputs,
+- demo-catalog inspection via `demo-catalog-summary` and structural linting via `demo-catalog-lint`,
+- one-shot `bootstrap-publication-stack` orchestration for preset-driven bundles, releases, and release-catalog outputs in one workspace,
+- `publish-publication-stack` for consolidating existing demo catalog workspaces into one signed release-catalog stack,
+- `publish-machine-publication-stack` for consolidating existing SATROOT-MACHINE-1 demo catalog workspaces into one machine-only signed release-catalog stack,
+- publication-stack inspection via `publication-stack-summary` and structural linting via `publication-stack-lint`,
+- `bootstrap-publication-stack-collection` for copying existing publication stack workspaces into reusable higher-level collections,
+- one-shot `bootstrap-publication-network` orchestration for preset-driven stacks plus a top-level release-catalog-index output in one workspace,
+- `publish-publication-network` for consolidating existing publication stack workspaces into one signed release-catalog-index network,
+- `publish-machine-publication-network` for consolidating existing SATROOT-MACHINE-1 publication stack workspaces into one machine-only signed release-catalog-index network,
+- publication-network inspection via `publication-network-summary` and structural linting via `publication-network-lint`,
+- one-shot `bootstrap-publication-catalog-workspace` orchestration for generating reusable descriptor-index and metadata-catalog lanes from arbitrary SATROOT artifacts,
+- `publish-publication-catalog-workspace` for consolidating an existing publication descriptor index plus publication metadata catalog into one reusable publication-catalog workspace,
+- publication-catalog-workspace inspection via `publication-catalog-workspace-summary` and structural linting via `publication-catalog-workspace-lint`,
+- one-shot `bootstrap-publication-registry-workspace` orchestration for copying a release-catalog-index publication, generating descriptor and metadata publication lanes, and emitting a top-level signed registry workspace,
+- `publish-publication-registry-workspace` for consolidating an existing publication-catalog workspace plus release-catalog-index source into one signed publication-registry workspace,
+- publication-registry-workspace inspection via `publication-registry-workspace-summary` and structural linting via `publication-registry-workspace-lint`,
+- publication-registry inspection via `publication-registry-summary` and structural linting via `publication-registry-lint`,
+- `inventory-artifacts` for scanning a directory tree and summarizing discovered SATROOT artifacts across bundle, release, catalog, index, registry, and workspace layers,
+- preset export commands for deriving reusable demo-catalog, publication-stack, publication-network, publication-catalog-workspace, and publication-registry-workspace presets back from generated workspaces,
+- `render-publication-report` for turning detected SATROOT artifacts or workspaces into human-readable markdown reports,
+- `export-publication-descriptor` for emitting normalized JSON descriptors from detected SATROOT artifacts or workspaces,
+- `build-publication-descriptor-index` for aggregating many detected SATROOT descriptors into one machine-readable registry,
+- signed publication-descriptor-index-manifest generation for authenticating descriptor registries,
+- `build-machine-publication-descriptor-index` and `build-stable-publication-descriptor-index` for enforcing machine-only or stable-only validation before descriptor-index generation,
+- `build-machine-publication-descriptor-index-manifest` and `build-stable-publication-descriptor-index-manifest` for signing only machine-validated or stable-validated descriptor indexes,
+- `publish-publication-descriptor-index`, `publish-machine-publication-descriptor-index`, and `publish-stable-publication-descriptor-index` for writing signed descriptor-index publication directories from existing signer material,
+- one-shot `bootstrap-publication-descriptor-index-publication` orchestration for descriptor indexes plus signing material,
+- publication-descriptor-index inspection via `publication-descriptor-index-summary` and structural linting via `publication-descriptor-index-lint`,
+- preset export commands for deriving reusable publication-descriptor-index presets back from generated descriptor index publications,
+- signed publication-metadata-manifest generation for authenticating one artifact's rendered report plus normalized descriptor,
+- `build-machine-publication-metadata-manifest` for signing only machine-validated publication report and descriptor pairs,
+- `build-stable-publication-metadata-manifest` for signing only stable-validated publication report and descriptor pairs,
+- `publish-publication-metadata-bundle`, `publish-machine-publication-metadata-bundle`, and `publish-stable-publication-metadata-bundle` for writing signed publication metadata bundles from existing signer material,
+- publication-metadata-bundle inspection via `publication-metadata-bundle-summary` and structural linting via `publication-metadata-bundle-lint`,
+- `bootstrap-machine-publication-metadata-bundle` for generating machine-only publication metadata bundles with SATROOT-MACHINE-1 artifact validation before signing,
+- `bootstrap-stable-publication-metadata-bundle` for generating stable-only publication metadata bundles with SATROOT-STABLE-1 artifact validation before signing,
+- `build-publication-metadata-catalog` for aggregating many publication metadata bundles into one machine-readable registry,
+- `build-machine-publication-metadata-catalog` and `build-stable-publication-metadata-catalog` for enforcing machine-only or stable-only validation before catalog generation,
+- signed publication-metadata-catalog-manifest generation for authenticating publication metadata catalogs,
+- `build-machine-publication-metadata-catalog-manifest` and `build-stable-publication-metadata-catalog-manifest` for signing only machine-validated or stable-validated publication metadata catalogs,
+- `publish-publication-metadata-catalog`, `publish-machine-publication-metadata-catalog`, and `publish-stable-publication-metadata-catalog` for writing signed metadata-catalog publication directories from existing signer material,
+- one-shot `bootstrap-publication-metadata-catalog-publication` orchestration for metadata catalogs plus signing material,
+- publication-metadata-catalog inspection via `publication-metadata-catalog-summary` and structural linting via `publication-metadata-catalog-lint`,
+- preset export commands for deriving reusable publication-metadata-catalog presets back from generated metadata catalog publications,
+- `build-publication-registry` for binding descriptor, metadata, and release-catalog-index publications into one top-level signed namespace artifact,
+- `build-machine-publication-registry` and `build-stable-publication-registry` for enforcing machine-only or stable-only validation before registry generation,
+- signed publication-registry-manifest generation for authenticating top-level publication registries,
+- `build-machine-publication-registry-manifest` and `build-stable-publication-registry-manifest` for signing only machine-validated or stable-validated publication registries,
+- `publish-publication-registry`, `publish-machine-publication-registry`, and `publish-stable-publication-registry` for writing signed registry publication directories from existing signer material,
+- one-shot `bootstrap-publication-registry-publication` orchestration for registry publications plus signing material,
+- preset export commands for deriving reusable publication-registry presets back from generated registry publications,
+- demo-catalog, publication-stack, and publication-network summary schema validation for exported workspace summaries,
+- signed bundle verification against manifest and verifier material,
+- bundle-manifest, bundle-index, release-manifest, release-catalog, release-catalog-manifest, release-catalog-index, release-catalog-index-manifest, publication-descriptor-index, publication-descriptor-index-manifest, publication-metadata-manifest, publication-metadata-catalog, publication-metadata-catalog-manifest, publication-registry, publication-registry-manifest, demo-catalog-summary, publication-stack-summary, and publication-network-summary schema validation for exported signed artifacts,
+- replay snapshots that preserve profile/genesis metadata for higher-layer namespace use cases.
+
+## Current demo
+
+`FLOOR1` is the proof token in this repo.
+
+It demonstrates:
+
+- one root satoshi,
+- `1,000,000,000` semantic units,
+- deterministic balance updates through signed protocol events,
+- no claim that the satoshi itself has been subdivided.
+
+## Intended use
+
+SATROOT-1 is meant for prototypes, timestamped proof-of-concept work, and machine-native ledgers where balances are semantic protocol state anchored to a satoshi rather than native chain assets.
+
+## Non-goals
+
+SATROOT-1 does not claim to be:
+
+- a new blockchain,
+- a BSV consensus change,
+- a sub-satoshi mechanism,
+- a stablecoin by default,
+- a redemption or reserve framework,
+- a security token framework,
+- an exchange-listing or universal wallet standard.
+
+## Profile lanes and preset tree
+
+The base protocol stays intentionally small. Expansion belongs in separate profiles, and the released profile lanes below all follow that rule.
+
+This repo includes the stable-value profile:
+
+- `SATROOT-STABLE-1` for reference-value accounting units,
+- `examples/genesis_usdroot1.json` for a `USDROOT1` genesis record,
+- `examples/events_usdroot1.json` for a runnable reference-only ledger flow,
+- `satroot1 bootstrap-stable-demo` for generating new reference-only demo ledgers on demand, with optional stable-only preset defaults,
+- `satroot1 bootstrap-stable-demo-bundle` for generating signed stable demo bundles directly from profile parameters or a stable-only preset,
+- `satroot1 bootstrap-stable-demo-release` for generating signed stable demo bundles plus release directories in one step, with optional stable-only preset defaults,
+- `satroot1 bootstrap-stable-demo-release-collection` for generating multiple stable-only demo release workspaces from repeated stable presets and packaging them into one reusable release collection,
+- `satroot1 bootstrap-stable-demo-release-catalog-publication` for generating multiple stable-only demo release workspaces from repeated stable presets, snapshotting them into a release collection, and bootstrapping a signed stable release catalog publication in one step,
+- `satroot1 bootstrap-stable-demo-release-catalog-index-publication` for generating multiple stable-only demo release workspaces from repeated stable presets, bootstrapping a stable release catalog publication, and then bootstrapping a signed stable release catalog index publication in one step,
+- `satroot1 bootstrap-stable-demo-catalog` for generating a reusable single-stable demo catalog workspace that can feed the broader catalog and publication flows, with optional stable-only preset support,
+- `satroot1 bootstrap-demo-publication-stack` for generating one or more mixed-profile demo catalog workspaces from repeated generic presets and publishing them as a signed release-catalog stack in one step,
+- `satroot1 bootstrap-demo-publication-network` for generating one or more mixed-profile demo catalog workspaces from repeated generic presets, bootstrapping a publication stack, and then publishing that stack as a signed release-catalog index in one step,
+- `satroot1 bootstrap-demo-publication-catalog-workspace` for generating multiple mixed-profile demo catalog workspaces from repeated generic presets and deriving shared descriptor-index and metadata publication lanes in one reusable publication catalog workspace,
+- `satroot1 bootstrap-demo-publication-registry-workspace` for generating multiple mixed-profile demo catalog workspaces from repeated generic presets, deriving shared publication lanes, and binding them to a generated publication network in one signed registry workspace,
+- `satroot1 bootstrap-stable-demo-publication-stack` for generating multiple stable-only demo catalog workspaces from repeated stable presets and publishing them as a signed release-catalog stack in one step,
+- `satroot1 bootstrap-stable-demo-publication-network` for generating multiple stable-only demo catalog workspaces from repeated stable presets, bootstrapping a stable publication stack, and then publishing that stack as a signed release-catalog index in one step,
+- `satroot1 bootstrap-stable-demo-publication-catalog-workspace` for generating multiple stable-only demo catalog workspaces from repeated stable presets and deriving shared descriptor-index and metadata publication lanes in one reusable publication catalog workspace,
+- `satroot1 bootstrap-stable-demo-publication-registry-workspace` for generating multiple stable-only demo catalog workspaces from repeated stable presets, deriving shared publication lanes, and binding them to a generated stable publication network in one signed registry workspace,
+- `satroot1 bootstrap-stable-publication-stack` for generating one or more stable-only demo catalog workspaces and publishing them as a release-catalog stack,
+- `satroot1 bootstrap-stable-publication-network` for generating one or more stable-only publication stacks and publishing them as a release-catalog index,
+- `satroot1 bootstrap-stable-publication-catalog-workspace` for generating a stable demo catalog workspace plus descriptor-index and metadata publication lanes in one step, with optional nested demo-catalog and publication-catalog-workspace presets,
+- `satroot1 publish-stable-publication-catalog-workspace` for re-wrapping existing stable descriptor and metadata lanes back into a stable-validated publication catalog workspace,
+- `satroot1 export-stable-publication-catalog-workspace-preset` for exporting that stable publication catalog workspace shape back into a validated reusable preset,
+- `satroot1 bootstrap-stable-publication-registry-workspace` for generating a stable publication catalog workspace and binding it to a stable release-catalog-index source in one signed registry workspace, with optional nested demo-catalog, publication-catalog-workspace, and publication-registry-workspace presets, including frozen `release_collection_dir`-backed nested catalog presets where `--release-key-id` is only needed when a nested publication-network preset is being generated,
+- `satroot1 publish-stable-publication-registry-workspace` for binding an existing stable publication catalog workspace to a stable release-catalog-index source while preserving stable provenance,
+- `satroot1 export-stable-publication-registry-workspace-preset` for exporting that stable publication registry workspace shape back into a validated reusable preset,
+- `satroot1 export-stable-publication-descriptor-index-preset`, `satroot1 export-stable-publication-metadata-catalog-preset`, and `satroot1 export-stable-publication-registry-preset` for exporting stable component publications back into validated reusable presets.
+- checked-in example presets now cover generic, machine-only, and stable-only component publication layers across `examples/bundle_index_presets/`, `examples/release_catalog_presets/`, `examples/release_catalog_index_presets/`, `examples/publication_descriptor_index_presets/`, `examples/publication_metadata_catalog_presets/`, `examples/publication_catalog_workspace_presets/`, `examples/registry_workspace_presets/`, and `examples/registry_presets/`.
+- `examples/bundle_index_presets/`, `examples/release_catalog_presets/`, and `examples/release_catalog_index_presets/` now also include collection-backed companion presets for frozen generated bundle, release, and release-catalog sets.
+- `examples/stack_presets/`, `examples/network_presets/`, `examples/publication_metadata_catalog_presets/`, `examples/publication_catalog_workspace_presets/`, `examples/registry_workspace_presets/`, and `examples/registry_presets/` now also include collection-backed companion presets for frozen demo-catalog, publication-stack, publication-network, publication-metadata-bundle, publication-catalog-workspace, and publication-registry inputs.
+- `examples/README.md` maps the generic, machine, stable, and collection-backed preset trees if you want one entry point into the full example set.
+
+If you want the shortest path into the checked-in reusable SATROOT preset tree, start here:
+
+- Generic lower release layers:
+  `examples/catalog_presets/ai_compute_catalog.json`
+  `examples/bundle_index_presets/ai_compute_bundle_index.json`
+  `examples/release_catalog_presets/ai_compute_release_stack.json`
+  `examples/release_catalog_index_presets/ai_compute_catalog_network.json`
+- Generic publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/ai_compute_publication_metadata_catalog.json`
+  `examples/publication_catalog_workspace_presets/ai_compute_publication_catalog_workspace.json`
+  `examples/stack_presets/ai_compute_publication_stack.json`
+  `examples/network_presets/ai_compute_publication_network.json`
+  `examples/registry_workspace_presets/ai_compute_publication_registry_workspace.json`
+- Generic collection-backed lower release layers:
+  `examples/catalog_presets/ai_compute_catalog_collection_backed.json`
+  `examples/bundle_index_presets/ai_compute_bundle_index_collection_backed.json`
+  `examples/release_catalog_presets/ai_compute_release_stack_collection_backed.json`
+  `examples/release_catalog_index_presets/ai_compute_catalog_network_collection_backed.json`
+- Generic collection-backed publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/ai_compute_publication_metadata_catalog_collection_backed.json`
+  `examples/publication_catalog_workspace_presets/ai_compute_publication_catalog_workspace_collection_backed.json`
+  `examples/stack_presets/ai_compute_publication_stack_collection_backed.json`
+  `examples/network_presets/ai_compute_publication_network_collection_backed.json`
+  `examples/registry_workspace_presets/ai_compute_publication_registry_workspace_collection_backed.json`
+  `examples/registry_workspace_presets/ai_compute_publication_registry_workspace_catalog_release_collection_backed.json`
+- Machine lower release layers:
+  `examples/catalog_presets/machine_compute_catalog.json`
+  `examples/bundle_index_presets/machine_compute_bundle_index.json`
+  `examples/release_catalog_presets/machine_compute_release_stack.json`
+  `examples/release_catalog_index_presets/machine_compute_catalog_network.json`
+- Machine publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/machine_compute_publication_metadata_catalog.json`
+  `examples/publication_catalog_workspace_presets/machine_compute_publication_catalog_workspace.json`
+  `examples/stack_presets/machine_compute_publication_stack.json`
+  `examples/network_presets/machine_compute_publication_network.json`
+  `examples/registry_workspace_presets/machine_compute_publication_registry_workspace.json`
+- Machine collection-backed lower release layers:
+  `examples/catalog_presets/machine_compute_catalog_collection_backed.json`
+  `examples/bundle_index_presets/machine_compute_bundle_index_collection_backed.json`
+  `examples/release_catalog_presets/machine_compute_release_stack_collection_backed.json`
+  `examples/release_catalog_index_presets/machine_compute_catalog_network_collection_backed.json`
+- Machine collection-backed publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/machine_compute_publication_metadata_catalog_collection_backed.json`
+  `examples/publication_catalog_workspace_presets/machine_compute_publication_catalog_workspace_collection_backed.json`
+  `examples/stack_presets/machine_compute_publication_stack_collection_backed.json`
+  `examples/network_presets/machine_compute_publication_network_collection_backed.json`
+  `examples/registry_workspace_presets/machine_compute_publication_registry_workspace_collection_backed.json`
+  `examples/registry_workspace_presets/machine_compute_publication_registry_workspace_catalog_release_collection_backed.json`
+- Stable lower release layers:
+  `examples/catalog_presets/stable_reference_catalog.json`
+  `examples/bundle_index_presets/stable_reference_bundle_index.json`
+  `examples/release_catalog_presets/stable_reference_release_stack.json`
+  `examples/release_catalog_index_presets/stable_reference_catalog_network.json`
+- Stable publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/stable_reference_publication_metadata_catalog.json`
+  `examples/publication_catalog_workspace_presets/stable_reference_publication_catalog_workspace.json`
+  `examples/stack_presets/stable_reference_publication_stack.json`
+  `examples/network_presets/stable_reference_publication_network.json`
+  `examples/registry_workspace_presets/stable_reference_publication_registry_workspace.json`
+- Stable collection-backed lower release layers:
+  `examples/catalog_presets/stable_reference_catalog_collection_backed.json`
+  `examples/bundle_index_presets/stable_reference_bundle_index_collection_backed.json`
+  `examples/release_catalog_presets/stable_reference_release_stack_collection_backed.json`
+  `examples/release_catalog_index_presets/stable_reference_catalog_network_collection_backed.json`
+- Stable collection-backed publication metadata/catalog/stack/network/registry-workspace:
+  `examples/publication_metadata_catalog_presets/stable_reference_publication_metadata_catalog_collection_backed.json`
+  `examples/publication_catalog_workspace_presets/stable_reference_publication_catalog_workspace_collection_backed.json`
+  `examples/stack_presets/stable_reference_publication_stack_collection_backed.json`
+  `examples/network_presets/stable_reference_publication_network_collection_backed.json`
+  `examples/registry_workspace_presets/stable_reference_publication_registry_workspace_collection_backed.json`
+  `examples/registry_workspace_presets/stable_reference_publication_registry_workspace_catalog_release_collection_backed.json`
+- Collection-backed top-level registry publications:
+  `examples/registry_presets/ai_compute_publication_registry_collection_backed.json`
+  `examples/registry_presets/machine_compute_publication_registry_collection_backed.json`
+  `examples/registry_presets/stable_reference_publication_registry_collection_backed.json`
+- Frozen-release self-contained top-level registry publications:
+  `examples/registry_presets/ai_compute_publication_registry_workspace_catalog_release_collection_backed.json`
+  `examples/registry_presets/machine_compute_publication_registry_workspace_catalog_release_collection_backed.json`
+  `examples/registry_presets/stable_reference_publication_registry_workspace_catalog_release_collection_backed.json`
+- Workspace-backed top-level registry publications:
+  `examples/registry_presets/ai_compute_publication_registry_workspace_backed.json`
+  `examples/registry_presets/machine_compute_publication_registry_workspace_backed.json`
+  `examples/registry_presets/stable_reference_publication_registry_workspace_backed.json`
+
+This repo also now includes the first machine-credit profile draft:
+
+- `SATROOT-MACHINE-1` for prepaid machine-native service credits,
+- `examples/genesis_apicredit1.json` for an `APICREDIT1` genesis record,
+- `examples/events_apicredit1.json` for a runnable machine-credit ledger flow,
+- `satroot1 bootstrap-machine-demo` for generating new machine-credit demo ledgers on demand, with optional machine-only preset defaults,
+- `satroot1 bootstrap-machine-demo-bundle` for generating signed machine-credit demo bundles directly from profile parameters or a machine-only preset,
+- `satroot1 bootstrap-machine-demo-release` for generating signed machine-credit demo bundles plus release directories in one step, with optional machine-only preset defaults,
+- `satroot1 bootstrap-machine-demo-release-collection` for generating multiple machine-only demo release workspaces from repeated machine presets and packaging them into one reusable release collection,
+- `satroot1 bootstrap-machine-demo-release-catalog-publication` for generating multiple machine-only demo release workspaces from repeated machine presets, snapshotting them into a release collection, and bootstrapping a signed machine release catalog publication in one step,
+- `satroot1 bootstrap-machine-demo-release-catalog-index-publication` for generating multiple machine-only demo release workspaces from repeated machine presets, bootstrapping a machine release catalog publication, and then bootstrapping a signed machine release catalog index publication in one step,
+- `satroot1 bootstrap-machine-demo-catalog` for generating a reusable single-machine demo catalog workspace that can feed the stack, network, and publication flows, now with optional generic demo-catalog preset support,
+- `satroot1 bootstrap-machine-demo-publication-stack` for generating multiple machine-only demo catalog workspaces from repeated machine presets and publishing them as a signed release-catalog stack in one step,
+- `satroot1 bootstrap-machine-demo-publication-network` for generating multiple machine-only demo catalog workspaces from repeated machine presets, bootstrapping a machine publication stack, and then publishing that stack as a signed release-catalog index in one step,
+- `satroot1 bootstrap-machine-demo-publication-catalog-workspace` for generating multiple machine-only demo catalog workspaces from repeated machine presets and deriving shared descriptor-index and metadata publication lanes in one reusable publication catalog workspace,
+- `satroot1 bootstrap-machine-demo-publication-registry-workspace` for generating multiple machine-only demo catalog workspaces from repeated machine presets, deriving shared publication lanes, and binding them to a generated machine publication network in one signed registry workspace,
+- `satroot1 bootstrap-machine-publication-stack` for generating one or more machine-only demo catalog workspaces and publishing them as a release-catalog stack,
+- `satroot1 publish-machine-publication-stack` for consolidating existing machine-only demo catalog workspaces into the same SATROOT-MACHINE-1 publication stack shape,
+- `satroot1 bootstrap-machine-publication-network` for generating one or more machine-only publication stacks and publishing them as a release-catalog index,
+- `satroot1 publish-machine-publication-network` for consolidating existing machine-only publication stack workspaces into the same SATROOT-MACHINE-1 publication network shape,
+- `satroot1 bootstrap-machine-publication-catalog-workspace` for generating a machine demo catalog workspace plus descriptor-index and metadata publication lanes in one step, now with optional nested demo-catalog and publication-catalog-workspace presets,
+- `satroot1 publish-machine-publication-catalog-workspace` for re-wrapping existing publication descriptor and metadata lanes back into a machine-validated publication catalog workspace,
+- `satroot1 export-machine-publication-catalog-workspace-preset` for exporting that machine publication catalog workspace shape back into a validated reusable preset,
+- `satroot1 bootstrap-machine-publication-registry-workspace` for generating a machine publication catalog workspace and binding it to a release-catalog-index source in one signed registry workspace, now with optional nested demo-catalog, publication-catalog-workspace, and publication-registry-workspace presets, including frozen `release_collection_dir`-backed nested catalog presets where `--release-key-id` is only needed when a nested publication-network preset is being generated,
+- `satroot1 publish-machine-publication-registry-workspace` for binding an existing machine publication catalog workspace to a release-catalog-index source while preserving machine provenance,
+- `satroot1 export-machine-publication-registry-workspace-preset` for exporting that machine publication registry workspace shape back into a validated reusable preset.
+
+This repo also now includes the first receipt-object profile draft:
+
+- `SATROOT-RECEIPT-1` for invoice and receipt state objects,
+- `examples/genesis_receipt1.json` for a `RECEIPT1` genesis record,
+- `examples/events_receipt1.json` for a runnable receipt lifecycle ledger flow,
+- `satroot1 bootstrap-singleton-demo --profile SATROOT-RECEIPT-1` for generating new receipt/identity/license singleton demo ledgers on demand,
+- `satroot1 bootstrap-singleton-demo-bundle --profile SATROOT-RECEIPT-1` for generating signed receipt/identity/license demo bundles on demand,
+- `satroot1 bootstrap-singleton-demo-release --profile SATROOT-RECEIPT-1` for generating signed receipt/identity/license demo bundles plus release directories in one step,
+- `satroot1 bootstrap-singleton-demo-bundle-index --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license demo bundles from presets and packaging them into a reusable bundle index,
+- `satroot1 bootstrap-singleton-demo-release-collection --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license demo releases from presets and packaging them into a reusable release collection,
+- `satroot1 bootstrap-singleton-demo-release-catalog-publication --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license demo releases from presets and bootstrapping a signed release catalog publication in one step,
+- `satroot1 bootstrap-singleton-demo-release-catalog-index-publication --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license demo releases from presets and bootstrapping a signed release-catalog index publication in one step,
+- `satroot1 bootstrap-singleton-demo-publication-stack --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license singleton demo catalog workspaces from presets and publishing them as a signed release-catalog stack in one step,
+- `satroot1 bootstrap-singleton-demo-publication-network --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license singleton demo catalog workspaces from presets, bootstrapping a singleton publication stack, and then publishing that stack as a signed release-catalog index in one step,
+- `satroot1 bootstrap-singleton-demo-publication-catalog-workspace --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license singleton demo catalog workspaces from presets and deriving shared descriptor and metadata publication lanes in one reusable publication catalog workspace,
+- `satroot1 bootstrap-singleton-demo-publication-registry-workspace --profile SATROOT-RECEIPT-1` for generating repeated receipt/identity/license singleton demo catalog workspaces from presets, deriving shared publication lanes, and binding them to a generated singleton publication network in one signed registry workspace.
+
+This repo also now includes the first identity-object profile draft:
+
+- `SATROOT-IDENTITY-1` for identity and authority state objects,
+- `examples/genesis_identity1.json` for an `IDENTITY1` genesis record,
+- `examples/events_identity1.json` for a runnable identity lifecycle ledger flow.
+
+This repo also now includes the first license-object profile draft:
+
+- `SATROOT-LICENSE-1` for license and usage-right state objects,
+- `examples/genesis_license1.json` for a `LICENSE1` genesis record,
+- `examples/events_license1.json` for a runnable license lifecycle ledger flow.
+
+The sixth registered profile extends the singleton family to event streams:
+
+- `SATROOT-EVENT-1` for append-only event-stream head objects with deterministic publisher handoff,
+- `examples/genesis_event1.json` for an `EVENT1` genesis record,
+- `examples/events_event1.json` for a runnable stream-custody handoff ledger flow,
+- `python scripts/run_event_profile_smoke.py` (or `python -m satroot_event_profile_smoke` / `satroot-event-profile-smoke`) for its dedicated verification lane.
+
+The event lane is a full member of the demo catalog matrix, the profile-matrix smoke, and the federation surface, alongside the five original profiles.
+
+Further profile work can extend that pattern beyond the six registered profiles for:
+
+- additional authority object profiles,
+- additional rights profiles.
+
+## Run tests
+
+For a quick local smoke run, pick one lane:
+
+```bash
+python -m pytest tests/test_stable_profile_smoke.py
+```
+
+Running bare `python -m pytest` collects the entire suite (1,600+ tests generating full publication workspaces) and is slow; prefer the chunked helper below for full runs.
+
+For the full suite, prefer the chunked helper:
+
+```bash
+python scripts/run_pytest_chunked.py
+```
+
+For a stable-profile end-to-end smoke pass that replays the checked-in `USDROOT1` example and generates a full `SATROOT-STABLE-1` publication registry workspace:
+
+```bash
+python scripts/run_stable_profile_smoke.py
+```
+
+By default that writes into `.tmp_stable_profile_smoke_run/` so the generated workspace stays clearly disposable.
+
+For the matching machine-credit lane, there is now an end-to-end smoke pass that replays `APICREDIT1` and generates a full `SATROOT-MACHINE-1` publication registry workspace:
+
+```bash
+python scripts/run_machine_profile_smoke.py
+```
+
+That one writes into `.tmp_machine_profile_smoke_run/` by default.
+
+For the lower operator layer above individual bundles, there are now stable and machine bundle-index smoke passes that stage two checked-in presets, generate reusable signed bundle collections, and build one bundle index above each lane:
+
+```bash
+python scripts/run_machine_demo_bundle_index_smoke.py
+python scripts/run_stable_demo_bundle_index_smoke.py
+```
+
+Those write into `.tmp_machine_demo_bundle_index_smoke_run/` and `.tmp_stable_demo_bundle_index_smoke_run/` by default.
+
+For the higher-level machine release-catalog operator lane, there is also a smoke pass that stages two machine-only catalog presets from the checked-in compute example, generates a signed multi-release collection, and bootstraps a signed machine release catalog publication:
+
+```bash
+python scripts/run_machine_demo_release_catalog_smoke.py
+```
+
+That one writes into `.tmp_machine_demo_release_catalog_smoke_run/` by default.
+
+For the matching stable release-catalog operator lane, there is a parallel smoke pass built from the checked-in stable reference catalog preset:
+
+```bash
+python scripts/run_stable_demo_release_catalog_smoke.py
+```
+
+That one writes into `.tmp_stable_demo_release_catalog_smoke_run/` by default.
+
+For the release-catalog index layer above those same stable and machine operator lanes, there are matching smokes that stage two checked-in presets, generate signed collections, bootstrap release catalog publications, and then bootstrap signed release catalog index publications:
+
+```bash
+python scripts/run_machine_demo_release_catalog_index_smoke.py
+python scripts/run_stable_demo_release_catalog_index_smoke.py
+```
+
+Those write into `.tmp_machine_demo_release_catalog_index_smoke_run/` and `.tmp_stable_demo_release_catalog_index_smoke_run/` by default.
+
+For the receipt-object lane, there is now a matching end-to-end smoke pass that replays `RECEIPT1` and materializes a full `SATROOT-RECEIPT-1` singleton publication registry workspace from the checked-in receipt preset:
+
+```bash
+python scripts/run_receipt_profile_smoke.py
+```
+
+That one writes into `.tmp_receipt_profile_smoke_run/` by default.
+
+For the lower singleton operator layer above individual receipt, identity, and license bundles, there are now matching bundle-index smoke passes that stage two checked-in presets, generate reusable signed bundle collections, and build one bundle index above each lane:
+
+```bash
+python scripts/run_receipt_demo_bundle_index_smoke.py
+python scripts/run_identity_demo_bundle_index_smoke.py
+python scripts/run_license_demo_bundle_index_smoke.py
+```
+
+Those write into `.tmp_receipt_demo_bundle_index_smoke_run/`, `.tmp_identity_demo_bundle_index_smoke_run/`, and `.tmp_license_demo_bundle_index_smoke_run/` by default.
+
+For the identity-object lane, there is now a matching end-to-end smoke pass that replays `IDENTITY1` and materializes a full `SATROOT-IDENTITY-1` singleton publication registry workspace from the checked-in identity preset:
+
+```bash
+python scripts/run_identity_profile_smoke.py
+```
+
+That one writes into `.tmp_identity_profile_smoke_run/` by default.
+
+For the license-object lane, there is now a matching end-to-end smoke pass that replays `LICENSE1` and materializes a full `SATROOT-LICENSE-1` singleton publication registry workspace from the checked-in license preset:
+
+```bash
+python scripts/run_license_profile_smoke.py
+```
+
+That one writes into `.tmp_license_profile_smoke_run/` by default.
+
+After `pip install -e .`, the packaged entrypoints are available too:
+
+```bash
+python -m satroot_test
+```
+
+or:
+
+```bash
+satroot-test
+```
+
+For the preferred local pre-tag release gate above the individual verification surfaces, use:
+
+```bash
+python -m satroot_release_gate_smoke
+```
+
+or:
+
+```bash
+satroot-release-gate-smoke
+```
+
+That one writes into `.tmp_release_gate_smoke_run/` by default and runs installed-module import smoke, the top-level operator proof, and chunked pytest together into one consolidated release-gate report.
+
+The GitHub Actions test workflow now uses this same release-gate wrapper as its single umbrella check after installed-module import smoke: the operator proof inside the gate re-runs the ladder, federation, registry, and anchored surfaces, and chunked pytest covers every per-lane smoke test, so CI does not repeat the narrower smoke workflows as separate steps.
+
+The preferred top-level verification for the currently released operator surface is:
+
+```bash
+python -m satroot_operator_proof_smoke
+```
+
+or:
+
+```bash
+satroot-operator-proof-smoke
+```
+
+That one writes into `.tmp_operator_proof_smoke_run/` by default and runs the stable/machine publication ladder, the singleton publication ladder, the mixed-profile federation smoke, and the collection-backed federated registry publication round trip, plus the four anchored surfaces — anchored demo, anchored publication, on-chain envelope, and envelope verification — for eight surfaces total in one consolidated proof report, with the two ed25519 surfaces skipping gracefully without the `[crypto]` extra.
+
+If you only want the released per-profile verification surface beneath that top-level proof, use:
+
+```bash
+python -m satroot_profile_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-profile-matrix-smoke
+```
+
+That one writes into `.tmp_profile_matrix_smoke_run/` by default and runs the stable, machine, receipt, identity, and license profile smoke workflows into one consolidated report.
+
+For the matching lower singleton operator layer, there is also:
+
+```bash
+python -m satroot_singleton_demo_bundle_index_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-singleton-demo-bundle-index-matrix-smoke
+```
+
+That one writes into `.tmp_singleton_demo_bundle_index_matrix_smoke_run/` by default and runs the receipt, identity, and license singleton demo bundle-index smoke workflows into one consolidated report.
+
+For the next singleton operator layer above those bundle indexes, there is also:
+
+```bash
+python -m satroot_singleton_demo_release_catalog_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-singleton-demo-release-catalog-matrix-smoke
+```
+
+That one writes into `.tmp_singleton_demo_release_catalog_matrix_smoke_run/` by default and runs the receipt, identity, and license singleton demo release-catalog smoke workflows into one consolidated report.
+
+For the next singleton operator layer above those per-profile catalogs, there is also:
+
+```bash
+python -m satroot_singleton_demo_release_catalog_index_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-singleton-demo-release-catalog-index-matrix-smoke
+```
+
+That one writes into `.tmp_singleton_demo_release_catalog_index_matrix_smoke_run/` by default and runs the receipt, identity, and license singleton demo release-catalog-index smoke workflows into one consolidated report.
+
+If you want the full singleton operator ladder in one pass, there is also:
+
+```bash
+python -m satroot_singleton_publication_ladder_smoke
+```
+
+or:
+
+```bash
+satroot-singleton-publication-ladder-smoke
+```
+
+That one writes into `.tmp_singleton_publication_ladder_smoke_run/` by default and runs the singleton bundle-index, release-catalog, and release-catalog-index matrix smokes together into one consolidated ladder report.
+
+For the lowest multi-bundle operator layer above those direct profile smokes, there is also:
+
+```bash
+python -m satroot_demo_bundle_index_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-demo-bundle-index-matrix-smoke
+```
+
+That one writes into `.tmp_demo_bundle_index_matrix_smoke_run/` by default and runs the stable and machine demo bundle-index smoke workflows into one consolidated report.
+
+For the lower operator layer above single releases but beneath the profile federation proof, there is also:
+
+```bash
+python -m satroot_demo_release_catalog_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-demo-release-catalog-matrix-smoke
+```
+
+That one writes into `.tmp_demo_release_catalog_matrix_smoke_run/` by default and runs the stable and machine demo release-catalog smoke workflows into one consolidated report.
+
+For the next layer up in that same operator ladder, there is also:
+
+```bash
+python -m satroot_demo_release_catalog_index_matrix_smoke
+```
+
+or:
+
+```bash
+satroot-demo-release-catalog-index-matrix-smoke
+```
+
+That one writes into `.tmp_demo_release_catalog_index_matrix_smoke_run/` by default and runs the stable and machine demo release-catalog-index smoke workflows into one consolidated report.
+
+If you want that full stable/machine operator ladder in one pass, there is also:
+
+```bash
+python -m satroot_publication_ladder_smoke
+```
+
+or:
+
+```bash
+satroot-publication-ladder-smoke
+```
+
+That one writes into `.tmp_publication_ladder_smoke_run/` by default and runs the stable/machine bundle-index, release-catalog, and release-catalog-index matrix smokes together into one consolidated ladder report.
+
+For the first operator-facing federation check above those released lanes, there is also:
+
+```bash
+python -m satroot_profile_federation_smoke
+```
+
+or:
+
+```bash
+satroot-profile-federation-smoke
+```
+
+That one writes into `.tmp_profile_federation_smoke_run/` by default, reuses the released profile matrix, freezes the resulting per-profile demo-catalog, publication-stack, publication-network, publication-catalog-workspace, and publication-registry-workspace outputs into explicit collections, builds one shared mixed-profile publication catalog workspace plus publication registry workspace above the federated network, snapshots those mixed top-level workspaces into their own explicit collections too, and round-trips the federated catalog workspace, stack, network, and top-level registry workspace back through exported nested presets.
+
+If you want the next higher proof layer above that federated workspace surface, there is also:
+
+```bash
+python -m satroot_federated_registry_collection_smoke
+```
+
+or:
+
+```bash
+satroot-federated-registry-collection-smoke
+```
+
+That one writes into `.tmp_federated_registry_collection_smoke_run/` by default, reruns the mixed-profile federation smoke, reuses the generated top-level `publication_registry_workspace_collection`, bootstraps a top-level publication-registry publication from that collection-backed preset, exports the generated publication back into a preset, and bootstraps the publication again to prove the collection-backed registry publication round trip.
+
+There is also a packaged stable-profile smoke entrypoint:
+
+```bash
+python -m satroot_stable_profile_smoke
+```
+
+or:
+
+```bash
+satroot-stable-profile-smoke
+```
+
+And the machine-credit lane has the same packaged entrypoints:
+
+```bash
+python -m satroot_machine_profile_smoke
+```
+
+or:
+
+```bash
+satroot-machine-profile-smoke
+```
+
+The singleton receipt lane also has lower publication-ladder wrappers:
+
+```bash
+python scripts/run_receipt_demo_release_catalog_smoke.py
+python scripts/run_receipt_demo_release_catalog_index_smoke.py
+```
+
+or:
+
+```bash
+python -m satroot_receipt_demo_release_catalog_smoke
+python -m satroot_receipt_demo_release_catalog_index_smoke
+```
+
+The singleton identity lane exposes the same local and packaged flows:
+
+```bash
+python scripts/run_identity_demo_release_catalog_smoke.py
+python scripts/run_identity_demo_release_catalog_index_smoke.py
+```
+
+or:
+
+```bash
+python -m satroot_identity_demo_release_catalog_smoke
+python -m satroot_identity_demo_release_catalog_index_smoke
+```
+
+The singleton license lane exposes the same local and packaged flows:
+
+```bash
+python scripts/run_license_demo_release_catalog_smoke.py
+python scripts/run_license_demo_release_catalog_index_smoke.py
+```
+
+or:
+
+```bash
+python -m satroot_license_demo_release_catalog_smoke
+python -m satroot_license_demo_release_catalog_index_smoke
+```
+
+And the stable and machine demo release-catalog operator lanes have packaged entrypoints too:
+
+```bash
+python -m satroot_stable_demo_release_catalog_smoke
+python -m satroot_machine_demo_release_catalog_smoke
+```
+
+or:
+
+```bash
+satroot-stable-demo-release-catalog-smoke
+satroot-machine-demo-release-catalog-smoke
+```
+
+And the matching index-layer operator lanes have packaged entrypoints too:
+
+```bash
+python -m satroot_stable_demo_release_catalog_index_smoke
+python -m satroot_machine_demo_release_catalog_index_smoke
+```
+
+or:
+
+```bash
+satroot-stable-demo-release-catalog-index-smoke
+satroot-machine-demo-release-catalog-index-smoke
+```
+
+The receipt lane has the same packaged entrypoints:
+
+```bash
+python -m satroot_receipt_profile_smoke
+```
+
+or:
+
+```bash
+satroot-receipt-profile-smoke
+```
+
+The identity lane has the same packaged entrypoints:
+
+```bash
+python -m satroot_identity_profile_smoke
+```
+
+or:
+
+```bash
+satroot-identity-profile-smoke
+```
+
+The license lane has the same packaged entrypoints:
+
+```bash
+python -m satroot_license_profile_smoke
+```
+
+or:
+
+```bash
+satroot-license-profile-smoke
+```
+
+The three chunked-runner forms (`scripts/run_pytest_chunked.py`, `python -m satroot_test`, `satroot-test`) collect from the full `tests/` tree by default.
+
+You can also resume from a later point or reduce chunk size:
+
+```bash
+python scripts/run_pytest_chunked.py --chunk-size 50 --start 1001
+```
+
+or:
+
+```bash
+python -m satroot_test --chunk-size 50 --start 1001
+```
+
+or:
+
+```bash
+satroot-test --chunk-size 50 --start 1001
+```
+
+Current suite note:
+
+```text
+the tests/ tree is large enough that chunked execution is the preferred full-suite path
+```
+
+## Signing utilities
+
+Install the package in editable mode to expose the `satroot1` command:
+
+```bash
+pip install -e .
+```
+
+Install the optional crypto path when you want Ed25519 support:
+
+```bash
+pip install -e .[crypto]
+```
+
+Install the optional schema-validation path when you want `satroot1 validate`:
+
+```bash
+pip install -e .[validation]
+```
+
+Install both optional paths together:
+
+```bash
+pip install -e .[crypto,validation]
+```
+
+Replay a ledger:
+
+```bash
+satroot1 replay examples/events_floor1.json
+```
+
+Replay an HMAC-signed ledger with verifier material:
+
+```bash
+satroot1 replay signed_events.json --scheme hmac-sha256 --secrets-json secrets.json
+```
+
+Validate a raw SATROOT event file against the protocol schema:
+
+```bash
+satroot1 validate examples/events_floor1.json
+```
+
+Annotate a ledger with deterministic event commitments:
+
+```bash
+satroot1 annotate-ledger examples/events_floor1.json --output annotated_events.json
+```
+
+Build a signer-to-key map directly from a ledger:
+
+```bash
+satroot1 init-signer-key-map examples/events_floor1.json --output signer_keys.json
+```
+
+Scaffold a profile-aware genesis record with valid defaults:
+
+```bash
+satroot1 init-genesis --symbol USDCLI1 --name "SATROOT CLI Dollar" --profile SATROOT-STABLE-1 --profile-field reference_unit=EUR --profile-field intended_use=cli-reference-ledger --output genesis.json
+```
+
+Scaffold the next event directly from an existing ledger:
+
+```bash
+satroot1 init-event --action transfer --events-json examples/events_floor1.json --signer bob --from bob --to issuer --amount 1000 --output next_event.json
+```
+
+Append and sign the next event directly onto an existing ledger:
+
+```bash
+satroot1 append-event signed_events.json --action transfer --signer bob --from bob --to issuer --amount 1000 --scheme hmac-sha256 --signer-key-map-json signer_key_map.json --secrets-json secrets.json --include-state-hash --output appended_events.json
+```
+
+Generate a runnable SATROOT-STABLE-1 reference-only demo ledger:
+
+```bash
+satroot1 bootstrap-stable-demo --symbol USDCLI2 --name "Stable CLI Demo" --reference-unit EUR --output-dir stable_demo
+```
+
+That stable demo bootstrap can also resolve its symbol, name, and profile defaults from a stable-only preset:
+
+```bash
+satroot1 bootstrap-stable-demo --preset-json examples/catalog_presets/stable_reference_catalog.json --output-dir stable_demo_preset
+```
+
+Generate a runnable SATROOT-MACHINE-1 machine-credit demo ledger:
+
+```bash
+satroot1 bootstrap-machine-demo --symbol APIDEMO2 --name "Machine CLI Demo" --service-scope inference-api --billing-unit token --output-dir machine_demo
+```
+
+That machine demo bootstrap can also resolve its symbol, name, and profile defaults from a machine-only preset:
+
+```bash
+satroot1 bootstrap-machine-demo --preset-json examples/catalog_presets/machine_compute_catalog.json --output-dir machine_demo_preset
+```
+
+Generate a runnable receipt, identity, or license singleton demo ledger:
+
+```bash
+satroot1 bootstrap-singleton-demo --profile SATROOT-IDENTITY-1 --symbol IDDEMO2 --name "Identity CLI Demo" --next-holder controller_v2 --no-archive --no-retire --output-dir singleton_identity
+```
+
+Generate a signed receipt, identity, or license singleton demo bundle:
+
+```bash
+satroot1 bootstrap-singleton-demo-bundle --profile SATROOT-RECEIPT-1 --symbol RECBUNDLE2 --name "Receipt Bundle CLI" --scheme hmac-sha256 --output-dir singleton_bundle
+```
+
+Generate a signed receipt, identity, or license singleton demo bundle plus release directory:
+
+```bash
+satroot1 bootstrap-singleton-demo-release --profile SATROOT-LICENSE-1 --symbol LICRELCLI1 --name "License Release CLI" --scheme hmac-sha256 --release-key-id release-key --channel stable --label "SATROOT License Release" --published-at 2026-06-28T12:00:00Z --output-dir singleton_release
+```
+
+If you want the reusable packaging layer just below releases for a single receipt, identity, or license profile, there is now a singleton wrapper that filters repeated demo presets down to one singleton profile, snapshots the generated bundles into a bundle collection, and writes a reusable bundle index in one step:
+
+```bash
+satroot1 bootstrap-singleton-demo-bundle-index --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --label "Receipt Bundle Index" --output-dir singleton_bundle_index
+```
+
+If you want the next packaging layer up, there is also a singleton release-collection wrapper that keeps one singleton profile from repeated presets and packages the generated releases into a reusable collection:
+
+```bash
+satroot1 bootstrap-singleton-demo-release-collection --profile SATROOT-LICENSE-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --label "License Release Collection" --output-dir singleton_release_collection
+```
+
+And if you want a signed catalog on top of those repeated singleton releases, the singleton release-catalog wrapper bootstraps the collection workspace and catalog publication together:
+
+```bash
+satroot1 bootstrap-singleton-demo-release-catalog-publication --profile SATROOT-IDENTITY-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --label "Identity Release Catalog" --output-dir singleton_release_catalog
+```
+
+And if you want the singleton lane all the way up at the top publication index layer, there is now a singleton release-catalog-index wrapper too:
+
+```bash
+satroot1 bootstrap-singleton-demo-release-catalog-index-publication --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --label "Receipt Release Catalog Index" --output-dir singleton_release_catalog_index
+```
+
+And if you want those repeated singleton presets to continue upward into the publication workspace lanes, there are now singleton publication-stack and publication-network wrappers as well:
+
+```bash
+satroot1 bootstrap-singleton-demo-publication-stack --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --label "Receipt Publication Stack" --output-dir singleton_publication_stack
+satroot1 bootstrap-singleton-demo-publication-network --profile SATROOT-IDENTITY-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --catalog-label "Identity Publication Stack" --label "Identity Publication Network" --output-dir singleton_publication_network
+```
+
+And if you want the singleton lane to keep going through descriptor/metadata and top-level registry packaging, there are matching workspace wrappers there too:
+
+```bash
+satroot1 bootstrap-singleton-demo-publication-catalog-workspace --profile SATROOT-LICENSE-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --descriptor-index-label "License Workspace Descriptor Index" --publication-metadata-catalog-label "License Workspace Metadata Catalog" --output-dir singleton_publication_catalog_workspace
+satroot1 bootstrap-singleton-demo-publication-registry-workspace --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --publication-registry-label "Receipt Publication Registry" --output-dir singleton_publication_registry_workspace
+```
+
+Once you have frozen one of those singleton release collections, the checked-in singleton registry-workspace and top-level registry presets in `examples/registry_workspace_presets/` and `examples/registry_presets/` can also be reused directly:
+
+```bash
+satroot1 bootstrap-singleton-demo-release-collection --profile SATROOT-RECEIPT-1 --preset-json examples/catalog_presets/receipt_invoice_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir examples/generated_receipt_release_collection_workspace
+cp -r examples/generated_receipt_release_collection_workspace/release_collection examples/generated_receipt_release_collection
+satroot1 bootstrap-demo-publication-network --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --output-dir generated_publication_network
+satroot1 bootstrap-publication-network-collection generated_publication_network --output-dir generated_publication_network_collection
+satroot1 bootstrap-publication-registry-workspace --preset-json examples/registry_workspace_presets/receipt_invoice_publication_registry_workspace_catalog_release_collection_backed.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir receipt_frozen_registry_workspace
+satroot1 bootstrap-publication-registry-publication --preset-json examples/registry_presets/receipt_invoice_publication_registry_workspace_catalog_release_collection_backed.json --scheme hmac-sha256 --key-id registry-key --output-dir receipt_frozen_registry
+```
+
+Generate a signed SATROOT-STABLE-1 reference-only demo bundle:
+
+```bash
+satroot1 bootstrap-stable-demo-bundle --symbol USDBUNDLE2 --name "Stable Bundle CLI" --scheme hmac-sha256 --reference-unit CHF --output-dir stable_bundle
+```
+
+That stable bundle bootstrap can also resolve its stable symbol, name, and profile defaults from a stable-only preset:
+
+```bash
+satroot1 bootstrap-stable-demo-bundle --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --output-dir stable_bundle_preset
+```
+
+For Ed25519 stable bundles, you can also emit a verifier-only variant that excludes `private_keys.json`:
+
+```bash
+satroot1 bootstrap-stable-demo-bundle --symbol USDEDCLI1 --name "Stable Bundle Ed25519" --scheme ed25519 --reference-unit AUD --output-dir stable_bundle_ed25519 --verifier-only
+```
+
+Generate a signed SATROOT-STABLE-1 demo bundle plus release directory:
+
+```bash
+satroot1 bootstrap-stable-demo-release --symbol USDRELCLI1 --name "Stable Release CLI" --scheme hmac-sha256 --release-key-id release-key --reference-unit JPY --channel stable --label "SATROOT Stable Release" --published-at 2026-06-27T12:00:00Z --output-dir stable_release
+```
+
+That stable release bootstrap can also inherit release metadata defaults from the same stable-only preset:
+
+```bash
+satroot1 bootstrap-stable-demo-release --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir stable_release_preset
+```
+
+If you want to generate multiple stable demo releases from one or more stable preset files and package them straight into a reusable release collection, repeat `--preset-json` for each member you want to generate:
+
+```bash
+satroot1 bootstrap-stable-demo-release-collection --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir stable_release_collection_workspace --label "SATROOT Stable Collection Override"
+```
+
+If you want the reusable packaging layer just below releases, there is also a stable wrapper that generates repeated bundles, snapshots them into a stable bundle collection, and writes a reusable bundle index in one step:
+
+```bash
+satroot1 bootstrap-stable-demo-bundle-index --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --label "Stable Demo Bundle Index" --output-dir stable_bundle_index_workspace
+```
+
+And if you want the next layer up in the same shot, there is a stable wrapper that generates those releases, snapshots the release collection, and bootstraps a signed release catalog publication:
+
+```bash
+satroot1 bootstrap-stable-demo-release-catalog-publication --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --release-label "Stable Collection Override" --label "Stable Demo Release Catalog" --output-dir stable_demo_release_catalog_publication
+```
+
+And if you want the next publication layer above that as well, there is a stable wrapper that continues on to a signed release catalog index publication:
+
+```bash
+satroot1 bootstrap-stable-demo-release-catalog-index-publication --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --catalog-label "Stable Demo Release Catalog" --label "Stable Demo Release Catalog Index" --output-dir stable_demo_release_catalog_index_publication
+```
+
+Generate a reusable SATROOT-STABLE-1 reference-only demo catalog workspace:
+
+```bash
+satroot1 bootstrap-stable-demo-catalog --symbol USDCATST1 --name "Stable Catalog CLI" --scheme hmac-sha256 --release-key-id release-key --reference-unit CHF --profile-field intended_use=treasury-credit --channel stable --label "SATROOT Stable Catalog" --published-at 2026-07-04T04:00:00Z --output-dir stable_catalog_workspace
+```
+
+That stable catalog bootstrap can also resolve its symbol, name, stable fields, and release metadata from a stable-only SATROOT demo-catalog preset:
+
+```bash
+satroot1 bootstrap-stable-demo-catalog --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir stable_catalog_workspace_preset --label "SATROOT Stable Catalog Override"
+```
+
+Generate a signed SATROOT-MACHINE-1 machine-credit demo bundle:
+
+```bash
+satroot1 bootstrap-machine-demo-bundle --symbol APIBUNDLE2 --name "Machine Bundle CLI" --scheme hmac-sha256 --service-scope batch-jobs --output-dir machine_bundle
+```
+
+That bundle bootstrap can also resolve its machine symbol, name, and profile defaults from a machine-only preset:
+
+```bash
+satroot1 bootstrap-machine-demo-bundle --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --output-dir machine_bundle_preset
+```
+
+Generate a signed SATROOT-MACHINE-1 machine-credit demo bundle plus release directory:
+
+```bash
+satroot1 bootstrap-machine-demo-release --symbol APIRELCLI1 --name "Machine Release CLI" --scheme hmac-sha256 --release-key-id release-key --service-scope render-farm --channel stable --label "SATROOT Machine Release" --published-at 2026-06-28T06:00:00Z --output-dir machine_release
+```
+
+The release bootstrap can also merge machine ledger defaults and release metadata from the same machine-only preset:
+
+```bash
+satroot1 bootstrap-machine-demo-release --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir machine_release_preset --label "SATROOT Machine Release Override"
+```
+
+If you want to generate multiple machine demo releases from one or more machine preset files and package them straight into a reusable release collection, repeat `--preset-json` for each member you want to generate:
+
+```bash
+satroot1 bootstrap-machine-demo-release-collection --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir machine_release_collection_workspace --label "SATROOT Machine Collection Override"
+```
+
+If you want the reusable packaging layer just below releases, there is also a machine wrapper that generates repeated bundles, snapshots them into a machine bundle collection, and writes a reusable bundle index in one step:
+
+```bash
+satroot1 bootstrap-machine-demo-bundle-index --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --label "Machine Demo Bundle Index" --output-dir machine_bundle_index_workspace
+```
+
+And if you want the next layer up in the same shot, there is a machine wrapper that generates those releases, snapshots the release collection, and bootstraps a signed release catalog publication:
+
+```bash
+satroot1 bootstrap-machine-demo-release-catalog-publication --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --release-label "Machine Collection Override" --label "Machine Demo Release Catalog" --output-dir machine_demo_release_catalog_publication
+```
+
+And if you want the next publication layer above that as well, there is a machine wrapper that continues on to a signed release catalog index publication:
+
+```bash
+satroot1 bootstrap-machine-demo-release-catalog-index-publication --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --catalog-label "Machine Demo Release Catalog" --label "Machine Demo Release Catalog Index" --output-dir machine_demo_release_catalog_index_publication
+```
+
+If you want the reusable packaging layer directly at the mixed-profile bundle level, there is also a generic wrapper that generates repeated preset-based bundles, snapshots them into one bundle collection, and writes a reusable top-level bundle index:
+
+```bash
+satroot1 bootstrap-demo-bundle-index --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/ai_compute_catalog.json --scheme hmac-sha256 --label "SATROOT Demo Bundle Index" --output-dir demo_bundle_index_workspace
+```
+
+Generate a reusable SATROOT-MACHINE-1 machine-credit demo catalog workspace:
+
+```bash
+satroot1 bootstrap-machine-demo-catalog --symbol APICAT1 --name "Machine Catalog CLI" --scheme hmac-sha256 --release-key-id release-key --service-scope batch-inference --billing-unit job --profile-field intended_use=cluster-credit --channel stable --label "SATROOT Machine Catalog" --published-at 2026-07-03T04:00:00Z --output-dir machine_catalog_workspace
+```
+
+That machine catalog bootstrap can also resolve its symbol, name, machine fields, and release metadata from a machine-only SATROOT demo-catalog preset:
+
+```bash
+satroot1 bootstrap-machine-demo-catalog --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir machine_catalog_workspace_preset --label "SATROOT Machine Catalog Override"
+```
+
+If you already have multiple machine-credit release directories and want a machine-validated signed catalog without stepping up into the publication stack yet:
+
+```bash
+satroot1 bootstrap-machine-release-catalog-publication machine_release_alpha/release_manifest.json machine_release_beta/bundle_index.json --output-dir machine_release_catalog --channel machine --label "SATROOT Machine Release Catalog" --published-at 2026-07-04T03:00:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+For the stable-only lane, there is now a matching SATROOT-STABLE-1 wrapper:
+
+```bash
+satroot1 bootstrap-stable-release-catalog-publication stable_release_alpha/release_manifest.json stable_release_beta/bundle_index.json --output-dir stable_release_catalog --channel stable --label "SATROOT Stable Release Catalog" --published-at 2026-07-15T03:00:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+And if you already manage signing material yourself, there is a matching publish wrapper that rejects any non-machine release inputs:
+
+```bash
+satroot1 publish-machine-release-catalog machine_release_alpha machine_release_beta --output-dir machine_release_catalog --channel machine --label "SATROOT Machine Release Catalog" --published-at 2026-07-04T03:00:00Z --scheme hmac-sha256 --key-id catalog-key --secrets-json release_hmac/release_secrets.json
+```
+
+The stable-only lane now has the same publish wrapper with SATROOT-STABLE-1 validation:
+
+```bash
+satroot1 publish-stable-release-catalog stable_release_alpha stable_release_beta --output-dir stable_release_catalog --channel stable --label "SATROOT Stable Release Catalog" --published-at 2026-07-15T03:00:00Z --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret
+```
+
+If you only want the unsigned JSON catalog first, there is also a machine-validated build-only variant:
+
+```bash
+satroot1 build-machine-release-catalog machine_release_alpha machine_release_beta/release_manifest.json --channel machine --label "SATROOT Machine Release Catalog" --published-at 2026-07-04T03:00:00Z --output machine_release_catalog.json
+```
+
+```bash
+satroot1 build-stable-release-catalog stable_release_alpha stable_release_beta/release_manifest.json --channel stable --label "SATROOT Stable Release Catalog" --published-at 2026-07-15T03:45:00Z --output stable_release_catalog.json
+```
+
+And if you want to sign that unsigned machine catalog separately, the manifest step has a matching machine-only guard as well:
+
+```bash
+satroot1 build-machine-release-catalog-manifest machine_release_catalog.json --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret --output machine_release_catalog_manifest.json
+```
+
+```bash
+satroot1 build-stable-release-catalog-manifest stable_release_catalog.json --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret --output stable_release_catalog_manifest.json
+```
+
+To publish a higher-level machine-only index across multiple machine release catalogs, there is now a matching machine wrapper at the release-catalog-index layer:
+
+```bash
+satroot1 bootstrap-machine-release-catalog-index-publication machine_release_catalog_alpha/release_catalog.json machine_release_catalog_beta/release_catalog_manifest.json --output-dir machine_release_catalog_index --channel machine --label "SATROOT Machine Catalog Network" --published-at 2026-07-04T06:00:00Z --scheme hmac-sha256 --key-id index-key
+```
+
+The stable-only lane has the same convenience wrapper for SATROOT-STABLE-1 release catalogs:
+
+```bash
+satroot1 bootstrap-stable-release-catalog-index-publication stable_release_catalog_alpha/release_catalog.json stable_release_catalog_beta/release_catalog_manifest.json --output-dir stable_release_catalog_index --channel stable --label "SATROOT Stable Catalog Network" --published-at 2026-07-15T06:00:00Z --scheme hmac-sha256 --key-id index-key
+```
+
+And the publish variant likewise rejects any non-machine release catalog inputs:
+
+```bash
+satroot1 publish-machine-release-catalog-index machine_release_catalog_alpha machine_release_catalog_beta --output-dir machine_release_catalog_index --channel machine --label "SATROOT Machine Catalog Network" --published-at 2026-07-04T06:00:00Z --scheme hmac-sha256 --key-id index-key --secrets-json release_hmac/release_secrets.json
+```
+
+```bash
+satroot1 publish-stable-release-catalog-index stable_release_catalog_alpha stable_release_catalog_beta --output-dir stable_release_catalog_index --channel stable --label "SATROOT Stable Catalog Network" --published-at 2026-07-15T06:00:00Z --scheme hmac-sha256 --key-id index-key --secret index-secret
+```
+
+There is also a matching unsigned machine-only builder for the index JSON:
+
+```bash
+satroot1 build-machine-release-catalog-index machine_release_catalog_alpha machine_release_catalog_beta/release_catalog_manifest.json --channel machine --label "SATROOT Machine Catalog Network" --published-at 2026-07-04T06:00:00Z --output machine_release_catalog_index.json
+```
+
+```bash
+satroot1 build-stable-release-catalog-index stable_release_catalog_alpha stable_release_catalog_beta/release_catalog_manifest.json --channel stable --label "SATROOT Stable Catalog Network" --published-at 2026-07-15T06:45:00Z --output stable_release_catalog_index.json
+```
+
+And the top-level machine catalog index can be signed the same way with machine-only validation preserved:
+
+```bash
+satroot1 build-machine-release-catalog-index-manifest machine_release_catalog_index.json --scheme hmac-sha256 --key-id index-key --secret index-secret --output machine_release_catalog_index_manifest.json
+```
+
+```bash
+satroot1 build-stable-release-catalog-index-manifest stable_release_catalog_index.json --scheme hmac-sha256 --key-id index-key --secret index-secret --output stable_release_catalog_index_manifest.json
+```
+
+Generate a reusable SATROOT-STABLE-1 publication catalog workspace directly from stable-profile inputs:
+
+```bash
+satroot1 bootstrap-stable-publication-catalog-workspace --symbol STBPUBCAT1 --name "Stable Publication Catalog CLI" --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --intended-use merchant-clearing --channel stable --label "SATROOT Stable Catalog" --descriptor-index-label "Stable Descriptor Index" --publication-metadata-catalog-label "Stable Metadata Catalog" --output-dir stable_publication_catalog_workspace
+```
+
+The same wrapper can also layer a stable-only demo-catalog preset with a generic publication-catalog-workspace preset:
+
+```bash
+satroot1 bootstrap-stable-publication-catalog-workspace --catalog-preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/publication_catalog_workspace_presets/stable_reference_publication_catalog_workspace.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --output-dir stable_publication_catalog_workspace_preset --publication-metadata-catalog-label "SATROOT Stable Metadata Catalog Override"
+```
+
+Generate a reusable SATROOT-STABLE-1 publication registry workspace directly from stable-profile inputs plus a stable publication network source:
+
+```bash
+satroot1 bootstrap-stable-publication-registry-workspace --publication-network-dir stable_publication_network --symbol STBPUBREG1 --name "Stable Publication Registry CLI" --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --intended-use merchant-clearing --channel stable --label "SATROOT Stable Catalog" --descriptor-index-label "Stable Descriptor Index" --publication-metadata-catalog-label "Stable Metadata Catalog" --publication-registry-label "Stable Publication Registry" --output-dir stable_publication_registry_workspace
+```
+
+That registry wrapper can also compose the stable catalog preset, a publication-catalog-workspace preset, and a publication-registry-workspace preset:
+
+```bash
+satroot1 bootstrap-stable-publication-registry-workspace --catalog-preset-json examples/catalog_presets/stable_reference_catalog.json --publication-catalog-workspace-preset-json examples/publication_catalog_workspace_presets/stable_reference_publication_catalog_workspace.json --preset-json examples/registry_workspace_presets/stable_reference_publication_registry_workspace.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir stable_publication_registry_workspace_preset --publication-registry-label "SATROOT Stable Registry Override"
+```
+
+If the nested stable catalog comes from a frozen one-release collection, that same command can skip `--release-key-id` unless `--publication-network-preset-json` is generating a nested network. A self-contained registry-workspace preset can now carry that nested stable catalog preset for you:
+
+```bash
+satroot1 bootstrap-stable-publication-registry-workspace --preset-json examples/registry_workspace_presets/stable_reference_publication_registry_workspace_catalog_release_collection_backed.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir stable_publication_registry_workspace_frozen_catalog
+```
+
+Generate a reusable SATROOT-MACHINE-1 publication catalog workspace directly from machine-profile inputs:
+
+```bash
+satroot1 bootstrap-machine-publication-catalog-workspace --symbol APIPUBCAT1 --name "Machine Publication Catalog CLI" --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --service-scope batch-inference --billing-unit job --profile-field intended_use=cluster-credit --channel stable --label "SATROOT Machine Catalog" --descriptor-index-label "Machine Descriptor Index" --publication-metadata-catalog-label "Machine Metadata Catalog" --output-dir machine_publication_catalog_workspace
+```
+
+The same wrapper can also layer a machine-only demo-catalog preset with a generic publication-catalog-workspace preset:
+
+```bash
+satroot1 bootstrap-machine-publication-catalog-workspace --catalog-preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/publication_catalog_workspace_presets/machine_compute_publication_catalog_workspace.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --output-dir machine_publication_catalog_workspace_preset --publication-metadata-catalog-label "SATROOT Machine Metadata Catalog Override"
+```
+
+Generate a reusable SATROOT-MACHINE-1 publication registry workspace directly from machine-profile inputs plus a publication network source:
+
+```bash
+satroot1 bootstrap-machine-publication-registry-workspace --publication-network-dir publication_network --symbol APIPUBREG1 --name "Machine Publication Registry CLI" --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --service-scope batch-inference --billing-unit job --profile-field intended_use=cluster-credit --channel stable --label "SATROOT Machine Catalog" --descriptor-index-label "Machine Descriptor Index" --publication-metadata-catalog-label "Machine Metadata Catalog" --publication-registry-label "Machine Publication Registry" --output-dir machine_publication_registry_workspace
+```
+
+That registry wrapper can also compose the machine catalog preset, a publication-catalog-workspace preset, and a publication-registry-workspace preset:
+
+```bash
+satroot1 bootstrap-machine-publication-registry-workspace --catalog-preset-json examples/catalog_presets/machine_compute_catalog.json --publication-catalog-workspace-preset-json examples/publication_catalog_workspace_presets/machine_compute_publication_catalog_workspace.json --preset-json examples/registry_workspace_presets/machine_compute_publication_registry_workspace.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir machine_publication_registry_workspace_preset --publication-registry-label "SATROOT Machine Registry Override"
+```
+
+If the nested machine catalog comes from a frozen one-release collection, that same command can skip `--release-key-id` unless `--publication-network-preset-json` is generating a nested network. A self-contained registry-workspace preset can now carry that nested machine catalog preset for you:
+
+```bash
+satroot1 bootstrap-machine-publication-registry-workspace --preset-json examples/registry_workspace_presets/machine_compute_publication_registry_workspace_catalog_release_collection_backed.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir machine_publication_registry_workspace_frozen_catalog
+```
+
+Generate a full multi-profile demo catalog workspace with `bundles/`, `release/`, and a root `summary.json` in one step:
+
+```bash
+satroot1 bootstrap-demo-catalog --scheme hmac-sha256 --release-key-id release-key --output-dir catalog_workspace --channel stable --label "SATROOT Demo Catalog" --published-at 2026-06-28T22:00:00Z
+```
+
+That workspace bootstrap can also be narrowed to selected profiles with per-profile symbol and name overrides:
+
+```bash
+satroot1 bootstrap-demo-catalog --scheme hmac-sha256 --release-key-id release-key --output-dir catalog_workspace_subset --profile SATROOT-MACHINE-1 --profile SATROOT-IDENTITY-1 --symbol-override SATROOT-MACHINE-1=APISET2 --name-override "SATROOT-IDENTITY-1=SATROOT Identity Subset" --channel stable --label "SATROOT Subset Catalog" --published-at 2026-06-28T22:30:00Z
+```
+
+Per-profile metadata can also be overridden inside the catalog bootstrap with `PROFILE:field=value` entries:
+
+```bash
+satroot1 bootstrap-demo-catalog --scheme hmac-sha256 --release-key-id release-key --output-dir catalog_workspace_fields --profile SATROOT-STABLE-1 --profile SATROOT-MACHINE-1 --profile-field-override SATROOT-STABLE-1:reference_unit=EUR --profile-field-override SATROOT-STABLE-1:intended_use=treasury-ledger --profile-field-override SATROOT-MACHINE-1:service_scope=batch-inference --profile-field-override SATROOT-MACHINE-1:billing_unit=job --profile-field-override SATROOT-MACHINE-1:intended_use=compute-credit --channel stable --label "SATROOT Field Override Catalog" --published-at 2026-06-28T23:00:00Z
+```
+
+Per-profile structural demo parameters can be overridden too, so the catalog can generate different ledger shapes and singleton lifecycles from one command:
+
+```bash
+satroot1 bootstrap-demo-catalog --scheme hmac-sha256 --release-key-id release-key --output-dir catalog_workspace_structure --profile SATROOT-STABLE-1 --profile SATROOT-MACHINE-1 --profile SATROOT-IDENTITY-1 --profile-structure-override SATROOT-STABLE-1:merchant_account=merchant_beta --profile-structure-override SATROOT-STABLE-1:service_account=settlement_node --profile-structure-override SATROOT-STABLE-1:merchant_burn_amount=0 --profile-structure-override SATROOT-MACHINE-1:tenant_account=tenant_b --profile-structure-override SATROOT-MACHINE-1:worker_account=worker_beta --profile-structure-override SATROOT-MACHINE-1:worker_burn_amount=0 --profile-structure-override SATROOT-IDENTITY-1:holder_account=controller_a --profile-structure-override SATROOT-IDENTITY-1:next_holder=none --profile-structure-override SATROOT-IDENTITY-1:retire=false --channel stable --label "SATROOT Structure Override Catalog" --published-at 2026-06-29T00:00:00Z
+```
+
+For repeatable scenario generation, `bootstrap-demo-catalog` can also load a checked-in preset file and still accept CLI overrides on top:
+
+```bash
+satroot1 bootstrap-demo-catalog --scheme hmac-sha256 --release-key-id release-key --output-dir catalog_workspace_preset --preset-json examples/catalog_presets/ai_compute_catalog.json --label "SATROOT AI Compute Catalog Override"
+```
+
+For higher-level mixed-profile release packaging, the generic lane can also generate repeated releases directly from repeated demo-catalog presets and snapshot them into one reusable release collection:
+
+```bash
+satroot1 bootstrap-demo-release-collection --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/ai_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir demo_release_collection_workspace --label "SATROOT Demo Collection Override"
+```
+
+That same repeated-preset mixed-profile lane can bootstrap a signed release catalog publication in one step:
+
+```bash
+satroot1 bootstrap-demo-release-catalog-publication --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/ai_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --release-label "SATROOT Demo Collection Override" --label "SATROOT Demo Release Catalog" --output-dir demo_release_catalog_publication
+```
+
+And one layer higher, it can bootstrap a signed release catalog index publication without separately invoking the collection or catalog steps:
+
+```bash
+satroot1 bootstrap-demo-release-catalog-index-publication --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/ai_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --catalog-label "SATROOT Demo Release Catalog" --label "SATROOT Demo Release Catalog Index" --output-dir demo_release_catalog_index_publication
+```
+
+Consume burn-on-use machine credit from a `SATROOT-MACHINE-1` ledger:
+
+```bash
+satroot1 consume-machine-credit signed_machine_events.json --signer worker_node --amount 1000 --scheme hmac-sha256 --signer-key-map-json signer_key_map.json --secrets-json secrets.json --include-state-hash --output consumed_machine_events.json
+```
+
+Archive a singleton receipt, identity, or license object into an archive account:
+
+```bash
+satroot1 archive-singleton-object signed_receipt_events.json --signer buyer --scheme hmac-sha256 --signer-key-map-json signer_key_map.json --secrets-json secrets.json --include-state-hash --output archived_receipt_events.json
+```
+
+Transfer a singleton receipt, identity, or license object to its next active holder:
+
+```bash
+satroot1 transfer-singleton-object signed_identity_events.json --signer node_alpha --to rotated_controller --scheme hmac-sha256 --signer-key-map-json signer_key_map.json --secrets-json secrets.json --include-state-hash --output transferred_identity_events.json
+```
+
+Retire an already archived singleton receipt, identity, or license object:
+
+```bash
+satroot1 retire-singleton-object archived_receipt_events.json --signer archive --scheme hmac-sha256 --signer-key-map-json signer_key_map.json --secrets-json secrets.json --include-state-hash --output retired_receipt_events.json
+```
+
+Scaffold a genesis record and emit a signed starter bundle in one step:
+
+```bash
+satroot1 bootstrap-genesis-bundle --symbol BUNDLE1 --name "SATROOT Bundle Asset" --scheme hmac-sha256 --profile SATROOT-MACHINE-1 --output-dir starter_bundle
+```
+
+Bootstrap the full Ed25519 workflow from a ledger in one step:
+
+```bash
+satroot1 bootstrap-ed25519-workflow examples/events_floor1.json --output-dir ed25519_bootstrap
+```
+
+Bootstrap the full HMAC workflow from a ledger in one step:
+
+```bash
+satroot1 bootstrap-hmac-workflow examples/events_floor1.json --output-dir hmac_bootstrap
+```
+
+Bootstrap and emit a full signed HMAC ledger bundle in one step:
+
+```bash
+satroot1 bootstrap-signed-ledger examples/events_floor1.json --scheme hmac-sha256 --output-dir signed_hmac_bundle
+```
+
+That bundle now includes `bundle_manifest.json` alongside the emitted signer/key material and ledger files, with per-file SHA-256 hashes for the exported artifacts and the full final SATROOT replay snapshot for downstream inspection.
+
+For Ed25519 workflows, you can also emit a verifier-only bundle that excludes `private_keys.json` and records `verification_material_scope="public-only"` in the manifest:
+
+```bash
+satroot1 bootstrap-signed-ledger examples/events_floor1.json --scheme ed25519 --output-dir signed_ed25519_bundle --verifier-only
+```
+
+Verify a signed bundle directory end to end:
+
+```bash
+satroot1 verify-bundle signed_hmac_bundle
+```
+
+Read a bundle manifest summary without replaying the ledger:
+
+```bash
+satroot1 bundle-summary signed_hmac_bundle
+```
+
+Lint bundle structure without replaying the ledger:
+
+```bash
+satroot1 bundle-lint signed_hmac_bundle
+```
+
+Read a release publication summary without signature verification:
+
+```bash
+satroot1 release-summary stable_release
+```
+
+Lint release structure and referenced bundle manifests without signature verification:
+
+```bash
+satroot1 release-lint stable_release
+```
+
+Build a bundle index catalog from one or more bundle directories:
+
+```bash
+satroot1 build-bundle-index signed_hmac_bundle --output bundle_index.json
+```
+
+If the source bundles should remain strictly inside the SATROOT-MACHINE-1 lane, the machine-only wrapper rejects any non-machine bundle before writing the unsigned index:
+
+```bash
+satroot1 build-machine-bundle-index machine_bundle_alpha machine_bundle_beta --channel machine --label "SATROOT Machine Bundle Index" --published-at 2026-07-14T02:00:00Z --output machine_bundle_index.json
+```
+
+The stable-only lane now has the same guard for SATROOT-STABLE-1 bundle collections:
+
+```bash
+satroot1 build-stable-bundle-index stable_bundle_alpha stable_bundle_beta --channel stable --label "SATROOT Stable Bundle Index" --published-at 2026-07-15T02:00:00Z --output stable_bundle_index.json
+```
+
+Or drive the same bundle discovery and release metadata defaults from a preset:
+
+```bash
+satroot1 build-bundle-index --preset-json examples/bundle_index_presets/ai_compute_bundle_index.json --output bundle_index.json
+```
+
+Or discover bundle directories recursively under a parent artifacts folder:
+
+```bash
+satroot1 build-bundle-index --discover-under generated_artifacts --output bundle_index.json
+```
+
+If you want to scan first and then reuse the discovered bundle set deterministically, `inventory-artifacts` output can also feed that same build step:
+
+```bash
+satroot1 inventory-artifacts generated_artifacts > artifact_inventory.json
+satroot1 build-bundle-index --inventory-json artifact_inventory.json --output bundle_index.json
+```
+
+For a reusable lower-layer capture, you can also copy signed bundles into a checked-in collection and then point bundle-index or release commands at that collection directly:
+
+```bash
+satroot1 bootstrap-bundle-collection signed_hmac_bundle machine_bundle --output-dir bundle_collection
+satroot1 build-bundle-index --bundle-collection-dir bundle_collection --channel stable --label "Collection Bundle Index" --output bundle_index.json
+```
+
+Attach lightweight release metadata to a bundle index:
+
+```bash
+satroot1 build-bundle-index signed_hmac_bundle --channel stable --label "SATROOT FLOOR1 Demo" --published-at 2026-06-22T12:00:00Z --output bundle_index.json
+```
+
+Inspect that unsigned bundle index before signing it into a release:
+
+```bash
+satroot1 bundle-index-summary bundle_index.json
+```
+
+Lint the unsigned bundle index and its referenced nested manifests without needing a release manifest first:
+
+```bash
+satroot1 bundle-index-lint bundle_index.json
+```
+
+Build a signed release manifest from a bundle index:
+
+```bash
+satroot1 build-release-manifest bundle_index.json --scheme hmac-sha256 --key-id release-key --secret release-secret --output release_manifest.json
+```
+
+If that unsigned bundle index should remain machine-only, the matching manifest wrapper validates every referenced nested bundle before signing:
+
+```bash
+satroot1 build-machine-release-manifest machine_bundle_index.json --scheme hmac-sha256 --key-id release-key --secret release-secret --output machine_release_manifest.json
+```
+
+The stable-only lane now has a matching manifest wrapper that rejects any non-stable nested bundle:
+
+```bash
+satroot1 build-stable-release-manifest stable_bundle_index.json --scheme hmac-sha256 --key-id release-key --secret release-secret --output stable_release_manifest.json
+```
+
+Bootstrap reusable HMAC release-signing material:
+
+```bash
+satroot1 bootstrap-release-hmac --key-id release-key --output-dir release_hmac
+```
+
+Build a release manifest from generated HMAC release material:
+
+```bash
+satroot1 build-release-manifest bundle_index.json --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json --output release_manifest.json
+```
+
+Publish a release directory with both `bundle_index.json` and `release_manifest.json` in one step:
+
+```bash
+satroot1 publish-release signed_hmac_bundle --output-dir stable_release --channel stable --label "SATROOT FLOOR1 Demo" --published-at 2026-06-26T12:00:00Z --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json
+```
+
+For the machine-only release lane, `publish-machine-release` and `bootstrap-machine-release-publication` give the same convenience flow while enforcing SATROOT-MACHINE-1 bundle inputs:
+
+```bash
+satroot1 publish-machine-release machine_bundle_alpha machine_bundle_beta --output-dir machine_release --channel machine --label "SATROOT Machine Release" --published-at 2026-07-14T03:00:00Z --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json
+```
+
+Those bundle-index and release commands can also take the root directory produced by `bootstrap-machine-demo-release` or `bootstrap-stable-demo-release`; SATROOT will automatically reuse the nested `bundle/` directory.
+
+```bash
+satroot1 bootstrap-machine-release-publication machine_bundle_alpha machine_bundle_beta --output-dir machine_release_bootstrap --channel machine --label "SATROOT Machine Release" --published-at 2026-07-14T03:00:00Z --scheme hmac-sha256 --key-id release-key
+```
+
+The stable-only lane now has matching release wrappers with SATROOT-STABLE-1 bundle validation preserved:
+
+```bash
+satroot1 publish-stable-release stable_bundle_alpha stable_bundle_beta --output-dir stable_release --channel stable --label "SATROOT Stable Release" --published-at 2026-07-15T03:00:00Z --scheme hmac-sha256 --key-id release-key --secret release-secret
+```
+
+```bash
+satroot1 bootstrap-stable-release-publication stable_bundle_alpha stable_bundle_beta --output-dir stable_release_bootstrap --channel stable --label "SATROOT Stable Release" --published-at 2026-07-15T03:00:00Z --scheme hmac-sha256 --key-id release-key
+```
+
+That same release flow can also discover multiple bundle directories under a parent workspace:
+
+```bash
+satroot1 publish-release --discover-under generated_artifacts --output-dir catalog_release --channel stable --label "SATROOT Multi Bundle Demo" --published-at 2026-06-28T18:00:00Z --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json
+```
+
+Or reuse a previously saved inventory report instead of repeating the directory scan:
+
+```bash
+satroot1 publish-release --inventory-json artifact_inventory.json --output-dir catalog_release --channel stable --label "SATROOT Multi Bundle Demo" --published-at 2026-06-28T18:00:00Z --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json
+```
+
+And that same bundle discovery plus release metadata can come from the bundle-index preset:
+
+```bash
+satroot1 publish-release --preset-json examples/bundle_index_presets/ai_compute_bundle_index.json --output-dir catalog_release --scheme hmac-sha256 --key-id release-key --secrets-json release_hmac/release_secrets.json
+```
+
+Bootstrap release signing material and publish a ready-to-verify release directory in one step:
+
+```bash
+satroot1 bootstrap-release-publication starter_bundle --output-dir release_bootstrap --channel stable --label "SATROOT Starter Release" --published-at 2026-06-26T12:00:00Z --scheme hmac-sha256 --key-id release-key
+```
+
+For catalog-style packaging, you can point that bootstrap flow at a parent directory and let it discover nested bundles automatically:
+
+```bash
+satroot1 bootstrap-release-publication --discover-under generated_artifacts --output-dir catalog_bootstrap --channel stable --label "SATROOT Catalog Release" --published-at 2026-06-28T19:00:00Z --scheme hmac-sha256 --key-id release-key
+```
+
+That bootstrap path also accepts the same bundle-index preset:
+
+```bash
+satroot1 bootstrap-release-publication --preset-json examples/bundle_index_presets/ai_compute_bundle_index.json --output-dir catalog_bootstrap --scheme hmac-sha256 --key-id release-key
+```
+
+Build a higher-level release catalog from multiple signed release directories:
+
+```bash
+satroot1 build-release-catalog stable_release machine_release --channel stable --label "SATROOT Release Catalog" --published-at 2026-06-30T05:00:00Z --output release_catalog.json
+```
+
+That catalog build can also harvest the `release_dir` entries from a saved inventory report:
+
+```bash
+satroot1 build-release-catalog --inventory-json artifact_inventory.json --channel stable --label "SATROOT Release Catalog" --published-at 2026-06-30T05:00:00Z --output release_catalog.json
+```
+
+For reusable multi-release packaging, you can snapshot signed releases into a release collection and point the catalog layer at that saved set:
+
+```bash
+satroot1 bootstrap-release-collection stable_release machine_release --output-dir release_collection
+satroot1 build-release-catalog --release-collection-dir release_collection --channel stable --label "Collection Release Catalog" --output release_catalog.json
+```
+
+The stable and machine lanes now also have one-shot wrappers that generate multiple preset-backed demo release workspaces and then snapshot them into the same reusable release-collection shape:
+
+```bash
+satroot1 bootstrap-stable-demo-release-collection --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir stable_release_collection_workspace --label "SATROOT Stable Collection Override"
+satroot1 bootstrap-machine-demo-release-collection --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --output-dir machine_release_collection_workspace --label "SATROOT Machine Collection Override"
+```
+
+If you also want to bootstrap the signed release catalog publication immediately on top of those generated release collections, there are matching one-shot wrappers for that layer too:
+
+```bash
+satroot1 bootstrap-stable-demo-release-catalog-publication --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --release-label "Stable Collection Override" --label "Stable Demo Release Catalog" --output-dir stable_demo_release_catalog_publication
+satroot1 bootstrap-machine-demo-release-catalog-publication --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --scheme hmac-sha256 --key-id catalog-key --release-label "Machine Collection Override" --label "Machine Demo Release Catalog" --output-dir machine_demo_release_catalog_publication
+```
+
+There are now matching one-shot wrappers for the next layer as well, so the same repeated demo presets can flow all the way up into a signed release catalog index publication:
+
+```bash
+satroot1 bootstrap-stable-demo-release-catalog-index-publication --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --catalog-label "Stable Demo Release Catalog" --label "Stable Demo Release Catalog Index" --output-dir stable_demo_release_catalog_index_publication
+satroot1 bootstrap-machine-demo-release-catalog-index-publication --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --bundle-scheme hmac-sha256 --release-key-id release-key --catalog-scheme hmac-sha256 --catalog-key-id catalog-key --scheme hmac-sha256 --key-id index-key --catalog-label "Machine Demo Release Catalog" --label "Machine Demo Release Catalog Index" --output-dir machine_demo_release_catalog_index_publication
+```
+
+That same repeated-preset pattern now extends through the publication stack and publication network layers too:
+
+```bash
+satroot1 bootstrap-demo-publication-stack --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --label "SATROOT Demo Publication Stack" --output-dir demo_publication_stack
+satroot1 bootstrap-demo-publication-network --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --catalog-label "SATROOT Demo Publication Stack" --label "SATROOT Demo Publication Network" --output-dir demo_publication_network
+satroot1 bootstrap-singleton-demo-publication-stack --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --label "Singleton Receipt Publication Stack" --output-dir singleton_demo_publication_stack
+satroot1 bootstrap-singleton-demo-publication-network --profile SATROOT-IDENTITY-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --catalog-label "Singleton Identity Publication Stack" --label "Singleton Identity Publication Network" --output-dir singleton_demo_publication_network
+satroot1 bootstrap-singleton-demo-publication-catalog-workspace --profile SATROOT-LICENSE-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --descriptor-index-label "Singleton License Workspace Descriptor Index" --publication-metadata-catalog-label "Singleton License Workspace Metadata Catalog" --output-dir singleton_demo_publication_catalog_workspace
+satroot1 bootstrap-singleton-demo-publication-registry-workspace --profile SATROOT-RECEIPT-1 --preset-json singleton_alpha.json --preset-json singleton_beta.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --publication-registry-label "Singleton Receipt Publication Registry" --output-dir singleton_demo_publication_registry_workspace
+satroot1 bootstrap-stable-demo-publication-stack --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --label "Stable Demo Publication Stack" --output-dir stable_demo_publication_stack
+satroot1 bootstrap-machine-demo-publication-stack --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --label "Machine Demo Publication Stack" --output-dir machine_demo_publication_stack
+satroot1 bootstrap-stable-demo-publication-network --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --catalog-label "Stable Demo Publication Stack" --label "Stable Demo Publication Network" --output-dir stable_demo_publication_network
+satroot1 bootstrap-machine-demo-publication-network --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --catalog-label "Machine Demo Publication Stack" --label "Machine Demo Publication Network" --output-dir machine_demo_publication_network
+```
+
+And the same repeated demo presets can now feed directly into reusable publication catalog workspaces as well:
+
+```bash
+satroot1 bootstrap-demo-publication-catalog-workspace --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --release-label "SATROOT Demo Catalog Release Override" --descriptor-index-label "SATROOT Demo Workspace Descriptor Index" --publication-metadata-catalog-label "SATROOT Demo Workspace Metadata Catalog" --output-dir demo_publication_catalog_workspace
+satroot1 bootstrap-stable-demo-publication-catalog-workspace --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --release-label "Stable Demo Catalog Release Override" --descriptor-index-label "Stable Demo Workspace Descriptor Index" --publication-metadata-catalog-label "Stable Demo Workspace Metadata Catalog" --output-dir stable_demo_publication_catalog_workspace
+satroot1 bootstrap-machine-demo-publication-catalog-workspace --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --release-label "Machine Demo Catalog Release Override" --descriptor-index-label "Machine Demo Workspace Descriptor Index" --publication-metadata-catalog-label "Machine Demo Workspace Metadata Catalog" --output-dir machine_demo_publication_catalog_workspace
+```
+
+And that same repeated-preset path now reaches the registry workspace layer too:
+
+```bash
+satroot1 bootstrap-demo-publication-registry-workspace --preset-json examples/catalog_presets/ai_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --release-label "SATROOT Demo Registry Release Override" --release-catalog-label "SATROOT Demo Registry Publication Stack" --release-catalog-index-label "SATROOT Demo Registry Publication Network" --descriptor-index-label "SATROOT Demo Registry Descriptor Index" --publication-metadata-catalog-label "SATROOT Demo Registry Metadata Catalog" --publication-registry-label "SATROOT Demo Publication Registry" --output-dir demo_publication_registry_workspace
+satroot1 bootstrap-stable-demo-publication-registry-workspace --preset-json examples/catalog_presets/stable_reference_catalog.json --preset-json examples/catalog_presets/stable_reference_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --release-label "Stable Demo Registry Release Override" --release-catalog-label "Stable Demo Registry Publication Stack" --release-catalog-index-label "Stable Demo Registry Publication Network" --descriptor-index-label "Stable Demo Registry Descriptor Index" --publication-metadata-catalog-label "Stable Demo Registry Metadata Catalog" --publication-registry-label "Stable Demo Publication Registry" --output-dir stable_demo_publication_registry_workspace
+satroot1 bootstrap-machine-demo-publication-registry-workspace --preset-json examples/catalog_presets/machine_compute_catalog.json --preset-json examples/catalog_presets/machine_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --release-label "Machine Demo Registry Release Override" --release-catalog-label "Machine Demo Registry Publication Stack" --release-catalog-index-label "Machine Demo Registry Publication Network" --descriptor-index-label "Machine Demo Registry Descriptor Index" --publication-metadata-catalog-label "Machine Demo Registry Metadata Catalog" --publication-registry-label "Machine Demo Publication Registry" --output-dir machine_demo_publication_registry_workspace
+```
+
+Those release-catalog flows also accept the generated release files directly, so you can mix `release_manifest.json` and `bundle_index.json` inputs when that is what you already have on hand:
+
+```bash
+satroot1 bootstrap-release-catalog-publication stable_release/bundle_index.json machine_release/release_manifest.json --output-dir release_catalog_bootstrap --channel stable --label "SATROOT Release Catalog" --published-at 2026-06-30T05:00:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+Publish a signed release catalog directory in one step:
+
+```bash
+satroot1 publish-release-catalog stable_release machine_release --output-dir release_catalog_pub --channel stable --label "SATROOT Release Catalog" --published-at 2026-06-30T05:00:00Z --scheme hmac-sha256 --key-id catalog-key --secrets-json release_hmac/release_secrets.json
+```
+
+Or bootstrap fresh signing material for that release catalog publication:
+
+```bash
+satroot1 bootstrap-release-catalog-publication stable_release machine_release --output-dir release_catalog_bootstrap --channel stable --label "SATROOT Release Catalog" --published-at 2026-06-30T05:00:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+Those lower release commands also accept `--bundle-collection-dir`, so the same saved bundle set can drive both `publish-release` and `bootstrap-release-publication` without repeating discovery flags or long bundle lists.
+
+At the next layer up, `build-release-catalog`, `publish-release-catalog`, and `bootstrap-release-catalog-publication` also accept `--release-collection-dir`, including the machine and stable wrappers, so the same saved release set can be reused without repeating release discovery or long release lists.
+
+They also accept generated demo-catalog workspace roots, or a workspace `summary.json`, and automatically reuse the nested `release/` directory when you point them at those generated artifacts directly.
+
+For repeatable multi-release packaging, the release-catalog commands can also load a checked-in preset file and still accept CLI overrides on top:
+
+```bash
+satroot1 bootstrap-release-catalog-publication --preset-json examples/release_catalog_presets/ai_compute_release_stack.json --output-dir release_catalog_bootstrap --label "SATROOT AI Compute Release Stack Override" --scheme hmac-sha256 --key-id catalog-key
+```
+
+For a higher-level network of signed release catalogs, you can build and publish a release-catalog index the same way:
+
+```bash
+satroot1 build-release-catalog-index release_catalog_bootstrap another_release_catalog --channel network --label "SATROOT Catalog Network" --published-at 2026-07-02T05:00:00Z --output release_catalog_index.json
+satroot1 bootstrap-release-catalog-index-publication --preset-json examples/release_catalog_index_presets/ai_compute_catalog_network.json --output-dir release_catalog_index_bootstrap --label "SATROOT AI Compute Catalog Network Override" --scheme hmac-sha256 --key-id index-key
+```
+
+Saved inventory reports work at that layer too, using the discovered `release_catalog_dir` entries:
+
+```bash
+satroot1 build-release-catalog-index --inventory-json artifact_inventory.json --channel network --label "SATROOT Catalog Network" --published-at 2026-07-02T05:00:00Z --output release_catalog_index.json
+```
+
+For reusable higher-level packaging, you can also snapshot signed release catalogs into a release-catalog collection and point the index layer at that saved set:
+
+```bash
+satroot1 bootstrap-release-catalog-collection release_catalog_bootstrap another_release_catalog --output-dir release_catalog_collection
+satroot1 build-release-catalog-index --release-catalog-collection-dir release_catalog_collection --channel network --label "Collection Catalog Network" --output release_catalog_index.json
+```
+
+That higher-level index lane likewise accepts either the signed catalog directory or the generated `release_catalog.json` / `release_catalog_manifest.json` files:
+
+```bash
+satroot1 bootstrap-release-catalog-index-publication release_catalog_bootstrap/release_catalog.json another_release_catalog/release_catalog_manifest.json --output-dir release_catalog_index_bootstrap --channel network --label "SATROOT Catalog Network" --published-at 2026-07-02T05:00:00Z --scheme hmac-sha256 --key-id index-key
+```
+
+Those release-catalog-index commands also accept `--release-catalog-collection-dir`, including the machine and stable wrappers, so the same saved catalog set can drive `build-release-catalog-index`, `publish-release-catalog-index`, and `bootstrap-release-catalog-index-publication` without repeating catalog discovery or long catalog lists.
+
+They likewise accept publication-stack workspace roots, or a stack `summary.json`, and automatically reuse the nested `release_catalog/` directory.
+
+For a single end-to-end workspace, `bootstrap-publication-stack` can take multiple demo-catalog presets plus an optional release-catalog preset and emit catalog workspaces and a top-level release catalog in one shot:
+
+```bash
+satroot1 bootstrap-publication-stack --catalog-preset-json examples/catalog_presets/ai_compute_catalog.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-preset-json examples/release_catalog_presets/ai_compute_release_stack.json --release-catalog-key-id catalog-key --output-dir publication_stack --label "SATROOT Stack Override"
+```
+
+If you want the whole stack described in one checked-in file, `bootstrap-publication-stack` also accepts a dedicated stack preset:
+
+```bash
+satroot1 bootstrap-publication-stack --stack-preset-json examples/stack_presets/ai_compute_publication_stack.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --output-dir publication_stack --label "SATROOT Stack Override"
+```
+
+For a machine-only lane on the same preset format, `bootstrap-machine-publication-stack` validates that every nested catalog preset resolves to `SATROOT-MACHINE-1` only:
+
+```bash
+satroot1 bootstrap-machine-publication-stack --stack-preset-json examples/stack_presets/machine_compute_publication_stack.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --output-dir machine_publication_stack --label "Machine Stack Override"
+```
+
+There is now a matching stable-only lane that validates every nested catalog preset resolves to `SATROOT-STABLE-1` only:
+
+```bash
+satroot1 bootstrap-stable-publication-stack --stack-preset-json examples/stack_presets/stable_reference_publication_stack.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --output-dir stable_publication_stack --label "Stable Stack Override"
+```
+
+That same stack preset shape can also point at a previously copied `catalog_workspace_collection_dir` when you want to reuse an already-frozen set of generated demo catalog workspaces. Exported stack presets preserve that collection reference even when they also emit nested catalog presets, so round-tripped preset trees keep provenance without making the collection itself the execution input.
+
+There is now a checked-in collection-backed companion preset for that flow too:
+
+```bash
+satroot1 bootstrap-publication-stack --stack-preset-json examples/stack_presets/ai_compute_publication_stack_collection_backed.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --output-dir publication_stack_collection_backed --label "SATROOT Collection-Backed Stack Override"
+```
+
+To generate multiple stack workspaces and a top-level signed release-catalog index in one pass, use `bootstrap-publication-network` with one or more stack presets:
+
+```bash
+satroot1 bootstrap-publication-network --stack-preset-json examples/stack_presets/ai_compute_publication_stack.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-preset-json examples/release_catalog_index_presets/ai_compute_catalog_network.json --release-catalog-index-key-id index-key --output-dir publication_network --label "SATROOT Network Override"
+```
+
+If you want the whole network described in one checked-in file, `bootstrap-publication-network` also accepts a dedicated network preset:
+
+```bash
+satroot1 bootstrap-publication-network --network-preset-json examples/network_presets/ai_compute_publication_network.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --output-dir publication_network --label "SATROOT Network Override"
+```
+
+That same network preset shape can also point at a previously copied `publication_stack_collection_dir` when you want to reuse an already-frozen set of generated stack workspaces. Exported network presets preserve that collection reference even when they also emit nested stack presets, so round-tripped preset trees keep provenance without making the collection itself the execution input.
+
+There is now a checked-in collection-backed companion preset for that flow too:
+
+```bash
+satroot1 bootstrap-publication-network --network-preset-json examples/network_presets/ai_compute_publication_network_collection_backed.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --output-dir publication_network_collection_backed --label "SATROOT Collection-Backed Network Override"
+```
+
+If you want to freeze already-generated publication networks for reuse one layer higher, there are matching collection commands there too:
+
+```bash
+satroot1 bootstrap-publication-network-collection publication_network_alpha publication_network_beta --output-dir publication_network_collection
+```
+
+There is also a machine-only convenience wrapper that validates every nested stack preset stays on the machine lane:
+
+```bash
+satroot1 bootstrap-machine-publication-network --network-preset-json examples/network_presets/machine_compute_publication_network.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --output-dir machine_publication_network --label "Machine Network Override"
+```
+
+And there is a stable-only wrapper that does the same for `SATROOT-STABLE-1` stack presets:
+
+```bash
+satroot1 bootstrap-stable-publication-network --network-preset-json examples/network_presets/stable_reference_publication_network.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --output-dir stable_publication_network --label "Stable Network Override"
+```
+
+If you already have generated demo catalog workspaces and just want to consolidate them into one signed publication stack, use `publish-publication-stack`:
+
+```bash
+satroot1 publish-publication-stack generated_catalogs/stable_workspace generated_catalogs/machine_workspace --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir publication_stack_from_existing --label "Published Existing Stack"
+```
+
+```bash
+satroot1 publish-publication-stack --inventory-json artifact_inventory.json --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir publication_stack_from_existing --label "Inventory Published Stack"
+```
+
+```bash
+satroot1 publish-publication-stack --catalog-workspace-collection-dir generated_catalog_workspace_collection --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir publication_stack_from_collection --label "Collection Published Stack"
+```
+
+That collection flag also accepts `generated_catalog_workspace_collection/summary.json` directly, and exported stack presets normalize the preserved provenance back to the collection root.
+
+That same publish lane can now also load a stack preset that preserves source `catalog_workspace_dirs`, which makes exported stack presets reusable for both bootstrap and publish workflows:
+
+```bash
+satroot1 publish-publication-stack --preset-json exported_stack.json --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir publication_stack_from_preset --label "Published Stack From Preset"
+```
+
+A checked-in example of that publish-oriented preset shape lives at `examples/stack_presets/ai_compute_publication_stack_publish.json`.
+
+For existing machine-only catalog workspaces, `publish-machine-publication-stack` applies the same publish flow but rejects any nested bundle set that is not purely `SATROOT-MACHINE-1`:
+
+```bash
+satroot1 publish-machine-publication-stack generated_machine_catalogs/catalog_alpha generated_machine_catalogs/catalog_beta --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir machine_publication_stack_from_existing --label "Published Machine Stack"
+```
+
+There is now a matching stable-only wrapper for existing `SATROOT-STABLE-1` catalog workspaces:
+
+```bash
+satroot1 publish-stable-publication-stack generated_stable_catalogs/catalog_alpha generated_stable_catalogs/catalog_beta --scheme hmac-sha256 --release-catalog-key-id catalog-key --output-dir stable_publication_stack_from_existing --label "Published Stable Stack"
+```
+
+If you want to freeze a reusable set of generated stack workspaces for later network assembly, use `bootstrap-publication-stack-collection`:
+
+```bash
+satroot1 bootstrap-publication-stack-collection generated_stacks/stack_alpha generated_stacks/stack_beta --output-dir publication_stack_collection
+```
+
+One layer lower, if you want to freeze a reusable set of generated demo catalog workspaces for later stack assembly, use `bootstrap-demo-catalog-workspace-collection`:
+
+```bash
+satroot1 bootstrap-demo-catalog-workspace-collection generated_catalogs/stable_workspace generated_catalogs/machine_workspace --output-dir generated_catalog_workspace_collection
+```
+
+Once you start deriving publication catalog workspaces themselves, you can freeze those higher-level descriptor-plus-metadata assemblies for later reuse with `bootstrap-publication-catalog-workspace-collection`:
+
+```bash
+satroot1 bootstrap-publication-catalog-workspace-collection generated_publication_catalogs/catalog_alpha generated_publication_catalogs/catalog_beta --output-dir publication_catalog_workspace_collection
+```
+
+At the top workspace layer, `bootstrap-publication-registry-workspace-collection` does the same for fully assembled registry workspaces when you want to preserve reusable end-to-end publication roots:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace-collection generated_publication_registries/registry_alpha generated_publication_registries/registry_beta --output-dir publication_registry_workspace_collection
+```
+
+If you already have generated publication stack workspaces and want a top-level signed network without regenerating the nested stacks, use `publish-publication-network`:
+
+```bash
+satroot1 publish-publication-network generated_stacks/stack_alpha generated_stacks/stack_beta --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir publication_network_from_existing --label "Published Existing Network"
+```
+
+```bash
+satroot1 publish-publication-network --inventory-json artifact_inventory.json --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir publication_network_from_existing --label "Inventory Published Network"
+```
+
+```bash
+satroot1 publish-publication-network --publication-stack-collection-dir publication_stack_collection --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir publication_network_from_collection --label "Collection Published Network"
+```
+
+The `--publication-stack-collection-dir` flag likewise accepts `publication_stack_collection/summary.json`, while exported network presets continue to preserve the collection root rather than the summary file path.
+
+And because exported network presets now preserve source `publication_stack_dirs`, the same checked-in preset can also drive a publish-only consolidation flow:
+
+```bash
+satroot1 publish-publication-network --preset-json exported_network.json --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir publication_network_from_preset --label "Published Network From Preset"
+```
+
+There is a matching checked-in example at `examples/network_presets/ai_compute_publication_network_publish.json`.
+
+For existing machine-only stack workspaces, `publish-machine-publication-network` enforces the same SATROOT-MACHINE-1-only constraint across every nested catalog workspace:
+
+```bash
+satroot1 publish-machine-publication-network generated_machine_stacks/stack_alpha generated_machine_stacks/stack_beta --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir machine_publication_network_from_existing --label "Published Machine Network"
+```
+
+And there is now a stable-only wrapper for existing `SATROOT-STABLE-1` publication stack workspaces:
+
+```bash
+satroot1 publish-stable-publication-network generated_stable_stacks/stack_alpha generated_stable_stacks/stack_beta --scheme hmac-sha256 --release-catalog-index-key-id index-key --output-dir stable_publication_network_from_existing --label "Published Stable Network"
+```
+
+If you already have a publication descriptor index and matching publication metadata catalog publication, you can wrap them back into a reusable catalog workspace with `publish-publication-catalog-workspace`:
+
+```bash
+satroot1 publish-publication-catalog-workspace publication_descriptor_index publication_metadata_catalog --output-dir publication_catalog_workspace_from_existing
+```
+
+```bash
+satroot1 publish-publication-catalog-workspace --inventory-json artifact_inventory.json --output-dir publication_catalog_workspace_from_existing
+```
+
+If those source publication directories already live in an exported publication-registry preset, the same command can load them directly:
+
+```bash
+satroot1 publish-publication-catalog-workspace --preset-json exported_registry.json --output-dir publication_catalog_workspace_from_preset
+```
+
+For a machine-only publication lane, `publish-machine-publication-catalog-workspace` looks for at least one nested demo-catalog descriptor whose `bundle_profiles` are entirely `SATROOT-MACHINE-1` and preserves that source machine workspace provenance in the published summary:
+
+```bash
+satroot1 publish-machine-publication-catalog-workspace machine_publication_descriptor_index machine_publication_metadata_catalog --output-dir machine_publication_catalog_workspace_from_existing
+```
+
+There is now a matching stable-only catalog wrapper that requires the descriptor and metadata lanes to resolve back to `SATROOT-STABLE-1` sources:
+
+```bash
+satroot1 publish-stable-publication-catalog-workspace stable_publication_descriptor_index stable_publication_metadata_catalog --output-dir stable_publication_catalog_workspace_from_existing
+```
+
+If you already have a publication catalog workspace and just want to bind it to a release-catalog-index source without regenerating the descriptor or metadata lanes, use `publish-publication-registry-workspace`:
+
+```bash
+satroot1 publish-publication-registry-workspace publication_catalog_workspace --publication-network-dir publication_network --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir publication_registry_workspace_from_existing --label "Published Existing Registry Workspace"
+```
+
+```bash
+satroot1 publish-publication-registry-workspace --inventory-json artifact_inventory.json --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir publication_registry_workspace_from_existing --label "Inventory Published Registry Workspace"
+```
+
+```bash
+satroot1 publish-publication-registry-workspace --publication-catalog-workspace-collection-dir publication_catalog_workspace_collection/summary.json --publication-network-collection-dir publication_network_collection/summary.json --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir publication_registry_workspace_from_collection --label "Collection Published Registry Workspace"
+```
+
+Both collection flags also accept the collection directory itself, and any later exported registry-workspace preset preserves the collection root rather than the nested `summary.json` path.
+
+That publish wrapper can also load an exported registry-workspace preset for the source catalog workspace, optional network/index source, and publication-registry metadata defaults:
+
+```bash
+satroot1 publish-publication-registry-workspace --preset-json exported_registry_workspace.json --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir publication_registry_workspace_from_preset --label "Published Registry Workspace From Preset"
+```
+
+If that exported preset carries a nested `publication_network_preset` instead of a direct `publication_network_dir`, the publish wrapper can materialize the copied `publication_network/` for you as long as you also provide the nested release signing key ids:
+
+```bash
+satroot1 publish-publication-registry-workspace --preset-json exported_registry_workspace_with_network.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace_from_nested_preset --label "Published Registry Workspace From Nested Preset"
+```
+
+If that source catalog workspace is machine-validated, `publish-machine-publication-registry-workspace` carries forward the machine publication catalog provenance as well:
+
+```bash
+satroot1 publish-machine-publication-registry-workspace machine_publication_catalog_workspace --publication-network-dir publication_network --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir machine_publication_registry_workspace_from_existing --label "Published Machine Registry Workspace"
+```
+
+And there is a stable-only companion that enforces stable catalog and release-catalog-index provenance before signing the top-level registry:
+
+```bash
+satroot1 publish-stable-publication-registry-workspace stable_publication_catalog_workspace --publication-network-dir stable_publication_network --scheme hmac-sha256 --publication-registry-key-id registry-key --output-dir stable_publication_registry_workspace_from_existing --label "Published Stable Registry Workspace"
+```
+
+To scan a generated tree and see which SATROOT bundles, releases, catalogs, indexes, registries, and workspaces are present, use `inventory-artifacts`:
+
+```bash
+satroot1 inventory-artifacts publication_network
+```
+
+If you only want to report artifacts rooted directly at the given path and skip nested directories, add `--non-recursive`:
+
+```bash
+satroot1 inventory-artifacts publication_network --non-recursive
+```
+
+Those saved inventory reports can be reused directly by `build-bundle-index`, `publish-release`, `bootstrap-release-publication`, `build-release-catalog`, `publish-release-catalog`, `bootstrap-release-catalog-publication`, `build-release-catalog-index`, `publish-release-catalog-index`, `bootstrap-release-catalog-index-publication`, `publish-publication-stack`, `publish-publication-network`, `publish-publication-catalog-workspace`, `publish-publication-registry-workspace`, `build-publication-descriptor-index`, `bootstrap-publication-descriptor-index-publication`, `build-publication-metadata-catalog`, `bootstrap-publication-metadata-catalog-publication`, `build-publication-registry`, `bootstrap-publication-registry-publication`, `bootstrap-publication-catalog-workspace`, and `bootstrap-publication-registry-workspace` via `--inventory-json`.
+
+To derive a reusable preset back from a generated demo catalog workspace:
+
+```bash
+satroot1 export-demo-catalog-preset catalog_workspace --output exported_catalog.json
+```
+
+This export also accepts `catalog_workspace/summary.json` directly.
+
+To derive a reusable bundle-index preset back from either a release directory or an existing `bundle_index.json`:
+
+```bash
+satroot1 export-bundle-index-preset release_bootstrap --output exported_bundle_index.json
+```
+
+That export also accepts `release_manifest.json` directly.
+
+If that bundle index was originally built from `--bundle-collection-dir`, the exported preset now preserves that `bundle_collection_dir` reference instead of expanding back to explicit `bundle_dirs`.
+
+To derive reusable presets back from higher-level signed catalog artifacts, either from the directory or the underlying JSON payload:
+
+```bash
+satroot1 export-release-catalog-preset publication_stack/release_catalog --output exported_release_catalog.json
+satroot1 export-release-catalog-index-preset publication_network/release_catalog_index/release_catalog_index.json --output exported_release_catalog_index.json
+```
+
+The release catalog and release catalog index preset exports also accept their matching `*_manifest.json` files directly.
+
+The machine-only release lanes have matching preset-export wrappers:
+
+```bash
+satroot1 export-machine-bundle-index-preset machine_release_bootstrap --output exported_machine_bundle_index.json
+satroot1 export-machine-release-catalog-preset machine_release_catalog_alpha/release_catalog.json --output exported_machine_release_catalog.json
+```
+
+Those machine-only bundle-index exports also accept `release_manifest.json` directly, and the machine release-catalog export accepts `release_catalog_manifest.json`.
+
+The stable-only release lanes now have matching preset-export wrappers too:
+
+```bash
+satroot1 export-stable-bundle-index-preset stable_release_bootstrap --output exported_stable_bundle_index.json
+satroot1 export-stable-release-catalog-preset stable_release_catalog_alpha/release_catalog.json --output exported_stable_release_catalog.json
+satroot1 export-stable-release-catalog-index-preset stable_release_catalog_index_publication --output exported_stable_release_catalog_index.json
+```
+
+The same manifest-backed shortcut works for the stable wrappers: `release_manifest.json`, `release_catalog_manifest.json`, and `release_catalog_index_manifest.json`.
+
+The publication-registry and publication-index exports follow the same pattern, so you can point them at either the publication directory or the generated JSON payload:
+
+```bash
+satroot1 export-publication-registry-preset publication_registry_publication/publication_registry.json --output exported_registry.json
+satroot1 export-publication-metadata-catalog-preset publication_metadata_catalog_publication --output exported_publication_metadata_catalog.json
+satroot1 export-publication-descriptor-index-preset publication_descriptor_index_publication/publication_descriptor_index.json --output exported_publication_descriptor_index.json
+```
+
+Those publication-layer export commands also accept their matching manifest files directly: `publication_registry_manifest.json`, `publication_metadata_catalog_manifest.json`, and `publication_descriptor_index_manifest.json`.
+
+To derive a publication stack preset and also emit nested demo catalog preset files alongside it:
+
+```bash
+satroot1 export-publication-stack-preset publication_stack --catalog-preset-dir exported_catalog_presets --output exported_stack.json
+```
+
+Every workspace-backed export command in this lane also accepts the workspace `summary.json` path instead of the workspace directory itself, so `publication_stack/summary.json` works here too.
+
+Exported stack presets now also preserve source `catalog_workspace_dirs`, so the same preset can be fed back into `publish-publication-stack` without needing the nested demo-catalog preset files at runtime.
+
+For a machine-only stack, there is a matching export wrapper that validates nested exported catalog presets stay on `SATROOT-MACHINE-1`:
+
+```bash
+satroot1 export-machine-publication-stack-preset machine_publication_stack --catalog-preset-dir exported_machine_catalog_presets --output exported_machine_stack.json
+```
+
+The stable-only stack lane now has the same export wrapper with `SATROOT-STABLE-1` validation:
+
+```bash
+satroot1 export-stable-publication-stack-preset stable_publication_stack --catalog-preset-dir exported_stable_catalog_presets --output exported_stable_stack.json
+```
+
+To derive a publication network preset and recursively emit nested stack and catalog preset files:
+
+```bash
+satroot1 export-publication-network-preset publication_network --stack-preset-dir exported_stack_presets --catalog-preset-dir exported_catalog_presets --output exported_network.json
+```
+
+The same export command also accepts `publication_network/summary.json` directly.
+
+Those exported network presets also preserve source `publication_stack_dirs`, which makes them reusable for `publish-publication-network` in addition to the bootstrap lane.
+
+And the machine-only network lane can be exported the same way while validating nested stack and catalog presets remain machine-only:
+
+```bash
+satroot1 export-machine-publication-network-preset machine_publication_network --stack-preset-dir exported_machine_stack_presets --catalog-preset-dir exported_machine_catalog_presets --output exported_machine_network.json
+```
+
+The stable-only network lane now has the same export wrapper for nested stable stack and catalog presets:
+
+```bash
+satroot1 export-stable-publication-network-preset stable_publication_network --stack-preset-dir exported_stable_stack_presets --catalog-preset-dir exported_stable_catalog_presets --output exported_stable_network.json
+```
+
+At the lower release layers, release catalog preset export can now also emit nested bundle-index presets while still preserving source `release_dirs` for publish/bootstrap reuse. When the signed catalog came from `--release-collection-dir`, the exported preset keeps that `release_collection_dir` provenance even if nested bundle-index presets are also emitted:
+
+```bash
+satroot1 export-release-catalog-preset release_catalog --bundle-index-preset-dir exported_bundle_index_presets --output exported_release_catalog.json
+```
+
+The machine-only and stable-only wrappers validate those nested bundle-index presets against `SATROOT-MACHINE-1` and `SATROOT-STABLE-1` respectively:
+
+```bash
+satroot1 export-machine-release-catalog-preset machine_release_catalog --bundle-index-preset-dir exported_machine_bundle_index_presets --output exported_machine_release_catalog.json
+satroot1 export-stable-release-catalog-preset stable_release_catalog --bundle-index-preset-dir exported_stable_bundle_index_presets --output exported_stable_release_catalog.json
+```
+
+Release catalog index preset export can likewise emit nested release-catalog presets and, beneath those, nested bundle-index presets:
+
+```bash
+satroot1 export-release-catalog-index-preset release_catalog_index --release-catalog-preset-dir exported_release_catalog_presets --bundle-index-preset-dir exported_bundle_index_presets --output exported_release_catalog_index.json
+```
+
+Those top-level release catalog index presets still preserve source `release_catalog_dirs`, and collection-backed exports keep `release_catalog_collection_dir` even when nested release-catalog presets are emitted, so the nested preset tree remains an export-time convenience while the original collection provenance survives round-trip export.
+
+To render a human-readable markdown report for a generated SATROOT artifact or workspace:
+
+```bash
+satroot1 render-publication-report publication_network
+```
+
+The report renderer auto-detects bundle, bundle-index, publication-metadata-bundle, release, release-catalog, release-catalog-index, publication-descriptor-index, publication-metadata-catalog, demo-catalog, publication-stack, publication-network, publication-catalog-workspace, publication-registry-workspace, and publication-registry inputs, and it can also write to a file:
+
+```bash
+satroot1 render-publication-report stable_release --output stable_release_report.md
+```
+
+For a normalized machine-readable export of the same detected artifact metadata, use `export-publication-descriptor`:
+
+```bash
+satroot1 export-publication-descriptor publication_network --output publication_network_descriptor.json
+```
+
+That same descriptor export path also accepts raw `bundle_index.json` inputs or directories that contain them:
+
+```bash
+satroot1 export-publication-descriptor bundle_index.json --output bundle_index_descriptor.json
+```
+
+Bootstrapped publication metadata bundles can also be inspected the same way:
+
+```bash
+satroot1 render-publication-report publication_metadata_bundle
+```
+
+To aggregate many detected artifacts into one descriptor registry, use `build-publication-descriptor-index`:
+
+```bash
+satroot1 build-publication-descriptor-index --discover-under publication_network --channel network --label "SATROOT Descriptor Index" --output publication_descriptor_index.json
+```
+
+If those discovered artifacts must stay fully inside the SATROOT-MACHINE-1 lane, the machine-only wrapper validates each nested artifact before writing the unsigned index:
+
+```bash
+satroot1 build-machine-publication-descriptor-index machine_publication_catalog_workspace machine_release_catalog_alpha --channel machine --label "Machine Descriptor Index" --published-at 2026-07-14T04:00:00Z --output machine_publication_descriptor_index.json
+```
+
+```bash
+satroot1 build-stable-publication-descriptor-index stable_publication_catalog_workspace stable_release_catalog_alpha --channel stable --label "Stable Descriptor Index" --published-at 2026-07-15T04:00:00Z --output stable_publication_descriptor_index.json
+```
+
+If you already captured a deterministic artifact scan, that same descriptor-index build can replay it directly:
+
+```bash
+satroot1 build-publication-descriptor-index --inventory-json artifact_inventory.json --channel network --label "Inventory Descriptor Index" --published-at 2026-07-08T02:30:00Z --output publication_descriptor_index.json
+```
+
+To bootstrap signing material plus a ready-to-verify signed publication descriptor index:
+
+```bash
+satroot1 bootstrap-publication-descriptor-index-publication --discover-under publication_network --output-dir publication_descriptor_index_publication --channel network --label "SATROOT Descriptor Publication" --scheme hmac-sha256 --key-id descriptor-key
+```
+
+If you already have signer material and just want the signed publication directory, the publish convenience path writes the same `publication_descriptor_index.json` plus `publication_descriptor_index_manifest.json` layout without generating fresh secrets or keys:
+
+```bash
+satroot1 publish-publication-descriptor-index --discover-under publication_network --output-dir publication_descriptor_index_publication --channel network --label "SATROOT Descriptor Publication" --published-at 2026-07-09T02:00:00Z --scheme hmac-sha256 --key-id descriptor-key --secret descriptor-secret
+```
+
+That descriptor-index lane now also has matching machine-only manifest and bootstrap wrappers:
+
+```bash
+satroot1 build-machine-publication-descriptor-index-manifest machine_publication_descriptor_index.json --scheme hmac-sha256 --key-id descriptor-key --secret descriptor-secret --output machine_publication_descriptor_index_manifest.json
+```
+
+```bash
+satroot1 build-stable-publication-descriptor-index-manifest stable_publication_descriptor_index.json --scheme hmac-sha256 --key-id descriptor-key --secret descriptor-secret --output stable_publication_descriptor_index_manifest.json
+```
+
+```bash
+satroot1 bootstrap-machine-publication-descriptor-index-publication machine_publication_catalog_workspace --output-dir machine_publication_descriptor_index_publication --channel machine --label "Machine Descriptor Publication" --published-at 2026-07-14T04:30:00Z --scheme hmac-sha256 --key-id descriptor-key
+```
+
+```bash
+satroot1 bootstrap-stable-publication-descriptor-index-publication stable_publication_catalog_workspace --output-dir stable_publication_descriptor_index_publication --channel stable --label "Stable Descriptor Publication" --published-at 2026-07-15T04:30:00Z --scheme hmac-sha256 --key-id descriptor-key
+```
+
+For repeatable descriptor-index packaging, that same command can also load a preset:
+
+```bash
+satroot1 bootstrap-publication-descriptor-index-publication --preset-json examples/publication_descriptor_index_presets/ai_compute_publication_descriptor_index.json --output-dir publication_descriptor_index_publication --label "SATROOT Descriptor Publication Override" --scheme hmac-sha256 --key-id descriptor-key
+```
+
+```bash
+satroot1 bootstrap-machine-publication-descriptor-index-publication --preset-json examples/publication_descriptor_index_presets/ai_compute_publication_descriptor_index.json --output-dir machine_publication_descriptor_index_publication --label "SATROOT Machine Descriptor Publication Override" --scheme hmac-sha256 --key-id descriptor-key
+```
+
+Saved inventory reports can also drive the signed descriptor-index bootstrap directly:
+
+```bash
+satroot1 bootstrap-publication-descriptor-index-publication --inventory-json artifact_inventory.json --output-dir publication_descriptor_index_publication --channel network --label "Inventory Descriptor Publication" --published-at 2026-07-08T02:45:00Z --scheme hmac-sha256 --key-id descriptor-key
+```
+
+To bootstrap a signed publication report plus descriptor bundle for one artifact:
+
+```bash
+satroot1 bootstrap-publication-metadata-bundle publication_network --output-dir publication_metadata_bundle --scheme hmac-sha256 --key-id metadata-key
+```
+
+```bash
+satroot1 publish-publication-metadata-bundle publication_network --output-dir publication_metadata_bundle --scheme hmac-sha256 --key-id metadata-key --secret metadata-secret
+```
+
+```bash
+satroot1 build-publication-metadata-manifest publication_metadata_bundle/publication_report.md publication_metadata_bundle/publication_descriptor.json --scheme hmac-sha256 --key-id metadata-key --secret metadata-secret --output publication_metadata_manifest.json
+```
+
+To verify that bundle later:
+
+```bash
+satroot1 verify-publication-metadata-manifest publication_metadata_bundle/publication_metadata_manifest.json --secrets-json publication_metadata_bundle/publication_metadata_secrets.json
+```
+
+To aggregate multiple publication metadata bundles into one signed catalog:
+
+```bash
+satroot1 bootstrap-publication-metadata-catalog-publication --discover-under publication_metadata_root --output-dir publication_metadata_catalog_publication --channel network --label "SATROOT Metadata Catalog" --scheme hmac-sha256 --key-id catalog-key
+```
+
+```bash
+satroot1 build-publication-metadata-catalog publication_metadata_bundle_alpha publication_metadata_bundle_beta --channel network --label "SATROOT Metadata Catalog" --published-at 2026-07-08T04:00:00Z --output publication_metadata_catalog.json
+```
+
+```bash
+satroot1 build-publication-metadata-catalog --inventory-json artifact_inventory.json --channel network --label "Inventory Metadata Catalog" --published-at 2026-07-08T03:30:00Z --output publication_metadata_catalog.json
+```
+
+```bash
+satroot1 build-publication-metadata-catalog-manifest publication_metadata_catalog.json --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret --output publication_metadata_catalog_manifest.json
+```
+
+```bash
+satroot1 publish-publication-metadata-catalog publication_metadata_bundle_alpha publication_metadata_bundle_beta --output-dir publication_metadata_catalog_publication --channel network --label "SATROOT Metadata Catalog" --published-at 2026-07-09T04:00:00Z --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret
+```
+
+Those metadata-catalog publish commands can also take a generated `publication_catalog_workspace` or `publication_registry_workspace` root, or the matching `summary.json`, and will expand the nested `publication_metadata_bundles/` lane automatically.
+
+They can also take `--publication-metadata-bundle-collection-dir` when the bundle set was already captured in a reusable collection summary, and exported metadata-catalog presets preserve that collection reference instead of flattening back to explicit bundle paths.
+
+If those publication metadata bundles must stay entirely inside the SATROOT-MACHINE-1 lane, the machine-only wrappers validate each nested artifact before building, signing, or bootstrapping the catalog:
+
+```bash
+satroot1 bootstrap-machine-publication-metadata-bundle machine_publication_catalog_workspace --output-dir machine_publication_metadata_bundle --scheme hmac-sha256 --key-id metadata-key
+```
+
+```bash
+satroot1 bootstrap-stable-publication-metadata-bundle stable_publication_catalog_workspace --output-dir stable_publication_metadata_bundle --scheme hmac-sha256 --key-id metadata-key
+```
+
+```bash
+satroot1 build-machine-publication-metadata-manifest machine_publication_metadata_bundle/publication_report.md machine_publication_metadata_bundle/publication_descriptor.json --scheme hmac-sha256 --key-id metadata-key --secret metadata-secret --output machine_publication_metadata_manifest.json
+```
+
+```bash
+satroot1 build-stable-publication-metadata-manifest stable_publication_metadata_bundle/publication_report.md stable_publication_metadata_bundle/publication_descriptor.json --scheme hmac-sha256 --key-id metadata-key --secret metadata-secret --output stable_publication_metadata_manifest.json
+```
+
+```bash
+satroot1 build-machine-publication-metadata-catalog machine_publication_metadata_workspace machine_publication_metadata_catalog --channel machine --label "Machine Metadata Catalog" --published-at 2026-07-14T05:00:00Z --output machine_publication_metadata_catalog.json
+```
+
+```bash
+satroot1 build-stable-publication-metadata-catalog stable_publication_metadata_workspace stable_publication_metadata_catalog --channel stable --label "Stable Metadata Catalog" --published-at 2026-07-15T05:00:00Z --output stable_publication_metadata_catalog.json
+```
+
+```bash
+satroot1 build-machine-publication-metadata-catalog-manifest machine_publication_metadata_catalog.json --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret --output machine_publication_metadata_catalog_manifest.json
+```
+
+```bash
+satroot1 build-stable-publication-metadata-catalog-manifest stable_publication_metadata_catalog.json --scheme hmac-sha256 --key-id catalog-key --secret catalog-secret --output stable_publication_metadata_catalog_manifest.json
+```
+
+```bash
+satroot1 bootstrap-machine-publication-metadata-catalog-publication machine_publication_metadata_workspace machine_publication_metadata_catalog --output-dir machine_publication_metadata_catalog_publication --channel machine --label "Machine Metadata Catalog Publication" --published-at 2026-07-14T05:30:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+```bash
+satroot1 bootstrap-stable-publication-metadata-catalog-publication stable_publication_metadata_workspace stable_publication_metadata_catalog --output-dir stable_publication_metadata_catalog_publication --channel stable --label "Stable Metadata Catalog Publication" --published-at 2026-07-15T05:30:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+For repeatable metadata-catalog packaging, that same command can also load a preset:
+
+```bash
+satroot1 bootstrap-publication-metadata-catalog-publication --preset-json examples/publication_metadata_catalog_presets/ai_compute_publication_metadata_catalog.json --output-dir publication_metadata_catalog_publication --label "SATROOT Metadata Catalog Override" --scheme hmac-sha256 --key-id catalog-key
+```
+
+```bash
+satroot1 bootstrap-machine-publication-metadata-catalog-publication --preset-json examples/publication_metadata_catalog_presets/ai_compute_publication_metadata_catalog.json --output-dir machine_publication_metadata_catalog_publication --label "SATROOT Machine Metadata Catalog Override" --scheme hmac-sha256 --key-id catalog-key
+```
+
+If the publication metadata bundle set was already captured by `inventory-artifacts`, the signed bootstrap can consume that saved inventory directly:
+
+```bash
+satroot1 bootstrap-publication-metadata-catalog-publication --inventory-json artifact_inventory.json --output-dir publication_metadata_catalog_publication --channel network --label "Inventory Metadata Catalog Publication" --published-at 2026-07-08T04:15:00Z --scheme hmac-sha256 --key-id catalog-key
+```
+
+To verify that catalog later:
+
+```bash
+satroot1 verify-publication-metadata-catalog-manifest publication_metadata_catalog_publication/publication_metadata_catalog_manifest.json --secrets-json publication_metadata_catalog_publication/publication_metadata_catalog_secrets.json
+```
+
+To bind the release-catalog-index, descriptor-index, and metadata-catalog lanes into one signed publication registry:
+
+```bash
+satroot1 bootstrap-publication-registry-publication --release-catalog-index-dir publication_network/release_catalog_index --publication-descriptor-index-dir publication_descriptor_index_publication --publication-metadata-catalog-dir publication_metadata_catalog_publication --output-dir publication_registry_publication --channel network --label "SATROOT Publication Registry" --scheme hmac-sha256 --key-id registry-key
+```
+
+```bash
+satroot1 build-publication-registry --release-catalog-index-dir publication_network/release_catalog_index --publication-descriptor-index-dir publication_descriptor_index_publication --publication-metadata-catalog-dir publication_metadata_catalog_publication --channel network --label "SATROOT Publication Registry" --published-at 2026-07-08T05:00:00Z --output publication_registry.json
+```
+
+```bash
+satroot1 build-publication-registry --inventory-json artifact_inventory.json --channel network --label "Inventory Publication Registry" --published-at 2026-07-09T02:30:00Z --output publication_registry.json
+```
+
+```bash
+satroot1 build-publication-registry-manifest publication_registry.json --scheme hmac-sha256 --key-id registry-key --secret registry-secret --output publication_registry_manifest.json
+```
+
+```bash
+satroot1 publish-publication-registry --release-catalog-index-dir publication_network/release_catalog_index --publication-descriptor-index-dir publication_descriptor_index_publication --publication-metadata-catalog-dir publication_metadata_catalog_publication --output-dir publication_registry_publication --channel network --label "SATROOT Publication Registry" --published-at 2026-07-09T05:00:00Z --scheme hmac-sha256 --key-id registry-key --secret registry-secret
+```
+
+At that top publication layer, the `--release-catalog-index-dir`, `--publication-descriptor-index-dir`, and `--publication-metadata-catalog-dir` flags can also point at generated `publication_network`, `publication_catalog_workspace`, or `publication_registry_workspace` roots, or their `summary.json` files, and SATROOT will resolve the nested publication component directories for you.
+
+If all three registry components come from the same `publication_registry_workspace` root or `summary.json`, exported publication-registry presets preserve that higher-level source as `publication_registry_workspace_dir` instead of flattening back to the three nested publication directories.
+
+If all three component lanes must remain SATROOT-MACHINE-1 validated, the machine-only wrappers enforce that before building, signing, or bootstrapping the top-level registry:
+
+```bash
+satroot1 build-machine-publication-registry --release-catalog-index-dir machine_release_catalog_index_publication --publication-descriptor-index-dir machine_publication_descriptor_index_publication --publication-metadata-catalog-dir machine_publication_metadata_catalog_publication --channel machine --label "Machine Publication Registry" --published-at 2026-07-14T06:00:00Z --output machine_publication_registry.json
+```
+
+```bash
+satroot1 build-stable-publication-registry --release-catalog-index-dir stable_release_catalog_index_publication --publication-descriptor-index-dir stable_publication_descriptor_index_publication --publication-metadata-catalog-dir stable_publication_metadata_catalog_publication --channel stable --label "Stable Publication Registry" --published-at 2026-07-15T06:00:00Z --output stable_publication_registry.json
+```
+
+```bash
+satroot1 build-machine-publication-registry-manifest machine_publication_registry.json --scheme hmac-sha256 --key-id registry-key --secret registry-secret --output machine_publication_registry_manifest.json
+```
+
+```bash
+satroot1 build-stable-publication-registry-manifest stable_publication_registry.json --scheme hmac-sha256 --key-id registry-key --secret registry-secret --output stable_publication_registry_manifest.json
+```
+
+```bash
+satroot1 bootstrap-machine-publication-registry-publication --release-catalog-index-dir machine_release_catalog_index_publication --publication-descriptor-index-dir machine_publication_descriptor_index_publication --publication-metadata-catalog-dir machine_publication_metadata_catalog_publication --output-dir machine_publication_registry_publication --channel machine --label "Machine Publication Registry" --published-at 2026-07-14T06:30:00Z --scheme hmac-sha256 --key-id registry-key
+```
+
+```bash
+satroot1 bootstrap-stable-publication-registry-publication --release-catalog-index-dir stable_release_catalog_index_publication --publication-descriptor-index-dir stable_publication_descriptor_index_publication --publication-metadata-catalog-dir stable_publication_metadata_catalog_publication --output-dir stable_publication_registry_publication --channel stable --label "Stable Publication Registry" --published-at 2026-07-15T06:30:00Z --scheme hmac-sha256 --key-id registry-key
+```
+
+```bash
+satroot1 bootstrap-publication-registry-publication --inventory-json artifact_inventory.json --output-dir publication_registry_publication --channel network --label "Inventory Publication Registry" --published-at 2026-07-09T03:00:00Z --scheme hmac-sha256 --key-id registry-key
+```
+
+To generate that whole registry workspace from an existing publication network in one shot:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --publication-network-dir publication_network --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace --descriptor-index-label "Workspace Descriptor Index" --publication-metadata-catalog-label "Workspace Metadata Catalog" --publication-registry-label "Workspace Publication Registry"
+```
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --inventory-json artifact_inventory.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace --descriptor-index-label "Inventory Workspace Descriptor Index" --publication-metadata-catalog-label "Inventory Workspace Metadata Catalog" --publication-registry-label "Inventory Workspace Publication Registry"
+```
+
+If you already have a reusable publication catalog workspace, the registry workspace bootstrap can copy that lane instead of regenerating descriptor and metadata publications:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --publication-network-dir publication_network --publication-catalog-workspace-dir publication_catalog_workspace --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace --publication-registry-label "Workspace Publication Registry"
+```
+
+That same registry-workspace layer can also consume a previously frozen `publication_network_collection_dir` as long as it contains exactly one publication network workspace. If you also freeze a reusable publication catalog workspace collection, the registry-workspace preset layer can now preserve `publication_catalog_workspace_collection_dir` alongside the network collection provenance, and generated nested network presets can in turn preserve their underlying `publication_stack_collection_dir` provenance too:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --publication-network-collection-dir publication_network_collection --publication-catalog-workspace-dir publication_catalog_workspace --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace --publication-registry-label "Workspace Publication Registry"
+```
+
+Those collection flags also accept `publication_network_collection/summary.json` and `publication_catalog_workspace_collection/summary.json` directly when you want to point at the frozen collection summaries instead of the collection roots.
+
+There is also a checked-in collection-backed companion preset for the same registry-workspace shape. That checked-in example now resolves both a frozen `publication_network_collection_dir` and a frozen `publication_catalog_workspace_collection_dir` directly from the preset:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --preset-json examples/registry_workspace_presets/ai_compute_publication_registry_workspace_collection_backed.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace_collection_backed
+```
+
+If the nested generic demo catalog comes from a frozen one-release collection, the same top-level registry workspace can now round-trip from a self-contained preset that carries both the nested catalog preset and the frozen publication network collection reference:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --preset-json examples/registry_workspace_presets/ai_compute_publication_registry_workspace_catalog_release_collection_backed.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace_frozen_catalog
+```
+
+To generate just the reusable descriptor-index plus metadata-catalog workspace without the top-level registry lane:
+
+```bash
+satroot1 bootstrap-publication-catalog-workspace --discover-under publication_network --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --output-dir publication_catalog_workspace --descriptor-index-label "Workspace Descriptor Index" --publication-metadata-catalog-label "Workspace Metadata Catalog"
+```
+
+```bash
+satroot1 bootstrap-publication-catalog-workspace --inventory-json artifact_inventory.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --output-dir publication_catalog_workspace --descriptor-index-label "Inventory Workspace Descriptor Index" --publication-metadata-catalog-label "Inventory Workspace Metadata Catalog"
+```
+
+For a checked-in repeatable publication-catalog-workspace composition, the same command can also load a preset:
+
+```bash
+satroot1 bootstrap-publication-catalog-workspace --preset-json examples/publication_catalog_workspace_presets/ai_compute_publication_catalog_workspace.json --scheme hmac-sha256 --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --output-dir publication_catalog_workspace --descriptor-index-label "SATROOT Workspace Descriptor Index Override"
+```
+
+For a checked-in repeatable registry-workspace composition, the same command can also load a preset:
+
+```bash
+satroot1 bootstrap-publication-registry-workspace --preset-json examples/registry_workspace_presets/ai_compute_publication_registry_workspace.json --scheme hmac-sha256 --release-key-id release-key --release-catalog-key-id catalog-key --release-catalog-index-key-id index-key --publication-descriptor-index-key-id descriptor-key --publication-metadata-key-id metadata-key --publication-metadata-catalog-key-id catalog-key --publication-registry-key-id registry-key --output-dir publication_registry_workspace --publication-registry-label "SATROOT Workspace Registry Override"
+```
+
+For a checked-in repeatable top-level registry publication, use the publication preset:
+
+```bash
+satroot1 bootstrap-publication-registry-publication --preset-json examples/registry_presets/ai_compute_publication_registry.json --output-dir publication_registry_publication --label "SATROOT Publication Registry Override" --scheme hmac-sha256 --key-id registry-key
+```
+
+```bash
+satroot1 bootstrap-machine-publication-registry-publication --preset-json examples/registry_presets/ai_compute_publication_registry.json --output-dir machine_publication_registry_publication --label "SATROOT Machine Registry Override" --scheme hmac-sha256 --key-id registry-key
+```
+
+If you want the top-level registry publication preset itself to point at one generated `publication_registry_workspace` root instead of three separate nested publication component directories, there are checked-in workspace-backed companions for that too:
+
+```bash
+satroot1 bootstrap-publication-registry-publication --preset-json examples/registry_presets/ai_compute_publication_registry_workspace_backed.json --output-dir publication_registry_publication_workspace_backed --label "SATROOT Workspace-Backed Publication Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-machine-publication-registry-publication --preset-json examples/registry_presets/machine_compute_publication_registry_workspace_backed.json --output-dir machine_publication_registry_publication_workspace_backed --label "SATROOT Machine Workspace-Backed Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-stable-publication-registry-publication --preset-json examples/registry_presets/stable_reference_publication_registry_workspace_backed.json --output-dir stable_publication_registry_publication_workspace_backed --label "SATROOT Stable Workspace-Backed Registry Override" --scheme hmac-sha256 --key-id registry-key
+```
+
+There are matching collection-backed companions when you want the top-level registry publication preset to preserve lineage to one generated `publication_registry_workspace_collection_dir`, with the nested workspace member resolved automatically at load time:
+
+```bash
+satroot1 bootstrap-publication-registry-publication --preset-json examples/registry_presets/ai_compute_publication_registry_collection_backed.json --output-dir publication_registry_publication_collection_backed --label "SATROOT Collection-Backed Publication Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-machine-publication-registry-publication --preset-json examples/registry_presets/machine_compute_publication_registry_collection_backed.json --output-dir machine_publication_registry_publication_collection_backed --label "SATROOT Machine Collection-Backed Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-stable-publication-registry-publication --preset-json examples/registry_presets/stable_reference_publication_registry_collection_backed.json --output-dir stable_publication_registry_publication_collection_backed --label "SATROOT Stable Collection-Backed Registry Override" --scheme hmac-sha256 --key-id registry-key
+```
+
+If you want that top-level registry publication preset to be fully self-contained for the frozen one-release catalog path, there are checked-in companions that point at a nested `publication_registry_workspace_preset`, which in turn carries a nested collection-backed catalog preset and a single-member publication-network collection reference:
+
+```bash
+satroot1 bootstrap-publication-registry-publication --preset-json examples/registry_presets/ai_compute_publication_registry_workspace_catalog_release_collection_backed.json --output-dir publication_registry_publication_frozen_catalog --label "SATROOT Frozen Catalog Publication Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-machine-publication-registry-publication --preset-json examples/registry_presets/machine_compute_publication_registry_workspace_catalog_release_collection_backed.json --output-dir machine_publication_registry_publication_frozen_catalog --label "SATROOT Machine Frozen Catalog Registry Override" --scheme hmac-sha256 --key-id registry-key
+satroot1 bootstrap-stable-publication-registry-publication --preset-json examples/registry_presets/stable_reference_publication_registry_workspace_catalog_release_collection_backed.json --output-dir stable_publication_registry_publication_frozen_catalog --label "SATROOT Stable Frozen Catalog Registry Override" --scheme hmac-sha256 --key-id registry-key
+```
+
+To verify that registry later:
+
+```bash
+satroot1 verify-publication-registry-manifest publication_registry_publication/publication_registry_manifest.json --secrets-json publication_registry_publication/publication_registry_secrets.json
+```
+
+To derive a reusable preset back from a generated registry publication:
+
+```bash
+satroot1 export-publication-registry-preset publication_registry_publication --output exported_registry.json
+```
+
+If that registry was built from one `publication_registry_workspace` root or `summary.json`, the exported preset keeps that workspace reference so later bootstrap and publish flows can resolve the nested component publications automatically.
+
+If you want that exported top-level registry preset to be self-contained for the frozen one-release catalog flow, the export command can also emit a nested registry-workspace preset and nested catalog preset in one pass:
+
+```bash
+satroot1 export-publication-registry-preset publication_registry_publication_frozen_catalog --publication-registry-workspace-preset-path exported_registry_workspace.json --catalog-preset-path exported_catalog.json --output exported_registry.json
+```
+
+The machine and stable wrappers expose the same nested export flags on `export-machine-publication-registry-preset` and `export-stable-publication-registry-preset`.
+
+The checked-in `examples/registry_presets/` directory now includes companion workspace-backed registry presets for the generic, machine, and stable lanes when you want a reusable registry preset to point at one generated `publication_registry_workspace` root instead of three separate publication component directories.
+
+Machine-only publication lanes now have matching preset-export wrappers too:
+
+```bash
+satroot1 export-machine-release-catalog-index-preset machine_release_catalog_index_publication --output exported_machine_release_catalog_index.json
+```
+
+```bash
+satroot1 export-machine-publication-descriptor-index-preset machine_publication_descriptor_index_publication --output exported_machine_publication_descriptor_index.json
+```
+
+```bash
+satroot1 export-machine-publication-metadata-catalog-preset machine_publication_metadata_catalog_publication --output exported_machine_publication_metadata_catalog.json
+```
+
+```bash
+satroot1 export-machine-publication-registry-preset machine_publication_registry_publication --output exported_machine_registry.json
+```
+
+The stable-only publication component lane now has matching validated export wrappers too:
+
+```bash
+satroot1 export-stable-publication-descriptor-index-preset stable_publication_descriptor_index_publication --output exported_stable_publication_descriptor_index.json
+```
+
+```bash
+satroot1 export-stable-publication-metadata-catalog-preset stable_publication_metadata_catalog_publication --output exported_stable_publication_metadata_catalog.json
+```
+
+```bash
+satroot1 export-stable-publication-registry-preset stable_publication_registry_publication --output exported_stable_registry.json
+```
+
+To derive a reusable preset back from a generated registry workspace:
+
+```bash
+satroot1 export-publication-registry-workspace-preset publication_registry_workspace --output exported_registry_workspace.json
+```
+
+That export also accepts `publication_registry_workspace/summary.json` directly, and the same summary-path shortcut works for the machine-only and stable-only registry workspace export wrappers.
+
+That registry-workspace export can also emit nested publication-catalog-workspace and publication-registry preset files, and the nested catalog preset can in turn emit descriptor-index and metadata-catalog presets:
+
+```bash
+satroot1 export-publication-registry-workspace-preset publication_registry_workspace --publication-catalog-workspace-preset-path exported_catalog_workspace.json --publication-descriptor-index-preset-path exported_descriptor_index.json --publication-metadata-catalog-preset-path exported_metadata_catalog.json --publication-registry-preset-path exported_registry.json --output exported_registry_workspace.json
+```
+
+If that nested generic catalog came from a frozen one-release collection, `--catalog-preset-path` can also emit the nested SATROOT demo catalog preset so the exported registry-workspace preset can rebuild its nested catalog lane from `--preset-json` alone:
+
+```bash
+satroot1 export-publication-registry-workspace-preset publication_registry_workspace --catalog-preset-path exported_catalog.json --publication-catalog-workspace-preset-path exported_catalog_workspace.json --output exported_registry_workspace.json
+```
+
+Published machine registry-workspace exports are a little stricter: when the original source network is not SATROOT-MACHINE-1-only, the exported machine preset falls back to `release_catalog_index_dir` instead of preserving a generic `publication_network_dir`, so the preset stays reusable by machine-only publish/bootstrap flows.
+
+For the machine-only registry lane, the matching export wrapper validates that the workspace still carries machine provenance. If the nested machine catalog came from a frozen one-release collection, `--catalog-preset-path` can also emit that nested machine catalog preset for a self-contained round-trip:
+
+```bash
+satroot1 export-machine-publication-registry-workspace-preset machine_publication_registry_workspace --catalog-preset-path exported_machine_catalog.json --publication-catalog-workspace-preset-path exported_machine_catalog_workspace.json --output exported_machine_registry_workspace.json
+```
+
+The stable-only registry lane has the same provenance guard, but validates `SATROOT-STABLE-1` sources instead. The same `--catalog-preset-path` flow works there for frozen one-release stable catalogs:
+
+```bash
+satroot1 export-stable-publication-registry-workspace-preset stable_publication_registry_workspace --catalog-preset-path exported_stable_catalog.json --publication-catalog-workspace-preset-path exported_stable_catalog_workspace.json --output exported_stable_registry_workspace.json
+```
+
+To derive a reusable preset back from a generated publication catalog workspace:
+
+```bash
+satroot1 export-publication-catalog-workspace-preset publication_catalog_workspace --output exported_catalog_workspace.json
+```
+
+Like the stack, network, and registry-workspace exports, this command also accepts `publication_catalog_workspace/summary.json` instead of the workspace directory.
+
+If you want the component publications captured as reusable presets at the same time, the catalog-workspace export can also emit nested descriptor-index and metadata-catalog preset files:
+
+```bash
+satroot1 export-publication-catalog-workspace-preset publication_catalog_workspace --publication-descriptor-index-preset-path exported_descriptor_index.json --publication-metadata-catalog-preset-path exported_metadata_catalog.json --output exported_catalog_workspace.json
+```
+
+And the machine-only publication catalog lane can be exported with the same validation guard:
+
+```bash
+satroot1 export-machine-publication-catalog-workspace-preset machine_publication_catalog_workspace --output exported_machine_catalog_workspace.json
+```
+
+There is a matching stable-only catalog export wrapper for `SATROOT-STABLE-1` publication catalog workspaces:
+
+```bash
+satroot1 export-stable-publication-catalog-workspace-preset stable_publication_catalog_workspace --output exported_stable_catalog_workspace.json
+```
+
+To derive a reusable preset back from a generated metadata catalog publication:
+
+```bash
+satroot1 export-publication-metadata-catalog-preset publication_metadata_catalog_publication --output exported_publication_metadata_catalog.json
+```
+
+If that catalog was built from `--publication-metadata-bundle-collection-dir`, the exported preset keeps the same collection reference so a later bootstrap or publish round-trip can reuse it directly.
+
+To derive a reusable preset back from a generated descriptor index publication:
+
+```bash
+satroot1 export-publication-descriptor-index-preset publication_descriptor_index_publication --output exported_publication_descriptor_index.json
+```
+
+Inspect a publication descriptor index without signature verification:
+
+```bash
+satroot1 publication-descriptor-index-summary publication_descriptor_index_publication
+```
+
+Lint a publication descriptor index and its referenced SATROOT artifacts:
+
+```bash
+satroot1 publication-descriptor-index-lint publication_descriptor_index_publication
+```
+
+Those publication descriptor and registry inspection commands also accept the generated manifest or payload file directly:
+
+```bash
+satroot1 publication-descriptor-index-summary publication_descriptor_index_publication/publication_descriptor_index_manifest.json
+satroot1 publication-registry-lint publication_registry_publication/publication_registry.json
+```
+
+Inspect a publication metadata catalog without signature verification:
+
+```bash
+satroot1 publication-metadata-catalog-summary publication_metadata_catalog_publication
+```
+
+Lint a publication metadata catalog and its referenced publication metadata bundles:
+
+```bash
+satroot1 publication-metadata-catalog-lint publication_metadata_catalog_publication
+```
+
+Those publication metadata catalog inspection commands also accept the generated manifest or payload file directly:
+
+```bash
+satroot1 publication-metadata-catalog-summary publication_metadata_catalog_publication/publication_metadata_catalog_manifest.json
+```
+
+Inspect a bootstrapped publication metadata bundle without signature verification:
+
+```bash
+satroot1 publication-metadata-bundle-summary publication_metadata_bundle
+```
+
+Lint a publication metadata bundle, its stored report/descriptor files, and the currently referenced packaged SATROOT artifact:
+
+```bash
+satroot1 publication-metadata-bundle-lint publication_metadata_bundle
+```
+
+Inspect a release catalog publication without signature verification:
+
+```bash
+satroot1 release-catalog-summary release_catalog_bootstrap
+```
+
+Those read-only release inspection commands also accept the generated manifest or payload file directly when you are already focused on one artifact:
+
+```bash
+satroot1 release-summary stable_release/release_manifest.json
+satroot1 release-catalog-lint release_catalog_bootstrap/release_catalog.json
+satroot1 release-catalog-index-summary release_catalog_index_bootstrap/release_catalog_index_manifest.json
+```
+
+Lint a release catalog publication and all referenced release directories:
+
+```bash
+satroot1 release-catalog-lint release_catalog_bootstrap
+```
+
+Inspect a release-catalog index publication without signature verification:
+
+```bash
+satroot1 release-catalog-index-summary release_catalog_index_bootstrap
+```
+
+Lint a release-catalog index publication and all referenced release-catalog directories:
+
+```bash
+satroot1 release-catalog-index-lint release_catalog_index_bootstrap
+```
+
+Inspect a demo catalog workspace without signature verification:
+
+```bash
+satroot1 demo-catalog-summary catalog_workspace
+```
+
+Lint a demo catalog workspace, its nested release, and all referenced bundle directories:
+
+```bash
+satroot1 demo-catalog-lint catalog_workspace
+```
+
+Those workspace inspection commands also accept the generated `summary.json` directly when you already have the summary file open:
+
+```bash
+satroot1 demo-catalog-summary catalog_workspace/summary.json
+satroot1 publication-stack-lint publication_stack/summary.json
+satroot1 publication-network-summary publication_network/summary.json
+satroot1 publication-catalog-workspace-lint publication_catalog_workspace/summary.json
+satroot1 publication-registry-workspace-summary publication_registry_workspace/summary.json
+```
+
+The reusable collection layers now have matching summary commands too, so frozen bundle/release/workspace sets can be inspected without manually opening `summary.json`:
+
+```bash
+satroot1 bundle-collection-summary bundle_collection
+satroot1 release-collection-summary release_collection/summary.json
+satroot1 release-catalog-collection-summary release_catalog_collection
+satroot1 demo-catalog-workspace-collection-summary catalog_workspace_collection
+satroot1 publication-stack-collection-summary publication_stack_collection
+satroot1 publication-network-collection-summary publication_network_collection/summary.json
+satroot1 publication-metadata-bundle-collection-summary publication_metadata_bundle_collection
+satroot1 publication-catalog-workspace-collection-summary publication_catalog_workspace_collection
+satroot1 publication-registry-workspace-collection-summary publication_registry_workspace_collection/summary.json
+```
+
+Those same reusable collection layers now expose matching lint commands too, so copied collection members can be checked in place without dropping down into each directory one-by-one:
+
+```bash
+satroot1 bundle-collection-lint bundle_collection
+satroot1 release-collection-lint release_collection/summary.json
+satroot1 release-catalog-collection-lint release_catalog_collection
+satroot1 demo-catalog-workspace-collection-lint catalog_workspace_collection
+satroot1 publication-stack-collection-lint publication_stack_collection
+satroot1 publication-network-collection-lint publication_network_collection/summary.json
+satroot1 publication-metadata-bundle-collection-lint publication_metadata_bundle_collection
+satroot1 publication-catalog-workspace-collection-lint publication_catalog_workspace_collection
+satroot1 publication-registry-workspace-collection-lint publication_registry_workspace_collection/summary.json
+```
+
+Inspect a publication stack workspace without signature verification:
+
+```bash
+satroot1 publication-stack-summary publication_stack
+```
+
+Lint a publication stack workspace, its nested release catalog, and all referenced catalog workspaces:
+
+```bash
+satroot1 publication-stack-lint publication_stack
+```
+
+Inspect a publication network workspace without signature verification:
+
+```bash
+satroot1 publication-network-summary publication_network
+```
+
+Lint a publication network workspace, its nested release-catalog index, and all referenced stack summaries:
+
+```bash
+satroot1 publication-network-lint publication_network
+```
+
+Inspect a publication catalog workspace without signature verification:
+
+```bash
+satroot1 publication-catalog-workspace-summary publication_catalog_workspace
+```
+
+Lint a publication catalog workspace, its generated publication components, and all referenced publication metadata bundles:
+
+```bash
+satroot1 publication-catalog-workspace-lint publication_catalog_workspace
+```
+
+Inspect a publication registry workspace without signature verification:
+
+```bash
+satroot1 publication-registry-workspace-summary publication_registry_workspace
+```
+
+Lint a publication registry workspace, its copied/generated publication components, and all referenced publication metadata bundles:
+
+```bash
+satroot1 publication-registry-workspace-lint publication_registry_workspace
+```
+
+Inspect a publication registry without signature verification:
+
+```bash
+satroot1 publication-registry-summary publication_registry_publication
+```
+
+Lint a publication registry and its referenced descriptor, metadata, and release-catalog-index components:
+
+```bash
+satroot1 publication-registry-lint publication_registry_publication
+```
+
+Validate a bundle manifest directly against the SATROOT manifest schema:
+
+```bash
+satroot1 validate-bundle-manifest signed_hmac_bundle/bundle_manifest.json
+```
+
+Validate a bundle index directly against the SATROOT bundle-index schema:
+
+```bash
+satroot1 validate-bundle-index bundle_index.json
+```
+
+Validate a signed release manifest directly against the SATROOT release-manifest schema:
+
+```bash
+satroot1 validate-release-manifest release_manifest.json
+```
+
+Validate a release catalog, release-catalog index, publication workspace summaries, and their signed manifests directly against the SATROOT schemas:
+
+```bash
+satroot1 validate-release-catalog release_catalog.json
+satroot1 validate-release-catalog-manifest release_catalog_manifest.json
+satroot1 validate-release-catalog-index release_catalog_index.json
+satroot1 validate-release-catalog-index-manifest release_catalog_index_manifest.json
+satroot1 validate-demo-catalog-summary catalog_workspace/summary.json
+satroot1 validate-publication-stack-summary publication_stack/summary.json
+satroot1 validate-publication-network-summary publication_network/summary.json
+```
+
+Verify a signed release manifest against its bundle index:
+
+```bash
+satroot1 verify-release-manifest release_manifest.json --secrets-json release_secrets.json
+```
+
+Verify a signed release catalog manifest against its release catalog:
+
+```bash
+satroot1 verify-release-catalog-manifest release_catalog_manifest.json --secrets-json release_catalog_secrets.json
+```
+
+Verify a signed release-catalog index manifest against its release-catalog index:
+
+```bash
+satroot1 verify-release-catalog-index-manifest release_catalog_index_manifest.json --secrets-json release_catalog_index_secrets.json
+```
+
+Sign a full demo ledger with the built-in demo signature mode:
+
+```bash
+satroot1 sign-ledger examples/events_floor1.json --scheme demo
+```
+
+Sign a ledger with shared-secret HMAC verification metadata:
+
+```bash
+satroot1 sign-ledger examples/events_floor1.json --scheme hmac-sha256 --signer-key-map-json signer_keys.json --secrets-json secrets.json --include-state-hash --output signed_events.json
+```
+
+Replay an Ed25519-signed ledger with public keys:
+
+```bash
+satroot1 replay signed_events.json --scheme ed25519 --public-keys-json public_keys.json
+```
+
+Generate an Ed25519 private-key map for SATROOT key IDs:
+
+```bash
+satroot1 generate-ed25519-private-keys --key-id issuer-key --key-id alice-key --output private_keys.json
+```
+
+Generate HMAC shared secrets for SATROOT key IDs:
+
+```bash
+satroot1 generate-hmac-secrets --key-id issuer-key --key-id alice-key --output secrets.json
+```
+
+Derive an Ed25519 public-key map from SATROOT private keys:
+
+```bash
+satroot1 derive-ed25519-public-keys private_keys.json --output public_keys.json
+```
+
+Annotate a signed HMAC ledger without changing its signed payload:
+
+```bash
+satroot1 annotate-ledger signed_events.json --scheme hmac-sha256 --secrets-json secrets.json --output annotated_signed_events.json
+```
+
+Sign a single event record:
+
+```bash
+satroot1 sign-event event.json --scheme hmac-sha256 --key-id issuer-key --secret issuer-secret
+```
+
+The same CLI also runs directly from the source tree without installing:
+
+```bash
+python src/satroot1.py replay examples/events_floor1.json
+```
+
+## Run the demo ledgers
+
+```bash
+satroot1 replay examples/events_floor1.json
+```
+
+Reference-only stable profile demo:
+
+```bash
+satroot1 replay examples/events_usdroot1.json
+```
+
+Machine-credit profile demo:
+
+```bash
+satroot1 replay examples/events_apicredit1.json
+```
+
+Receipt profile demo:
+
+```bash
+satroot1 replay examples/events_receipt1.json
+```
+
+Identity profile demo:
+
+```bash
+satroot1 replay examples/events_identity1.json
+```
+
+License profile demo:
+
+```bash
+satroot1 replay examples/events_license1.json
+```
+
+## Important demo note
+
+The example `root_id` values in `examples/` are placeholders:
+
+```text
+0000000000000000000000000000000000000000000000000000000000000000:0
+```
+
+Replace it only when intentionally anchoring to a real one-satoshi UTXO.
+
+## Anchored lanes
+
+The anchored demo lane is the designated entry point for that intentional replacement. It is the first of the four anchored lanes — anchored demo, anchored publication, on-chain envelope, and envelope verification — which are the only lanes ever meant to carry a real outpoint or transaction id, and always only via run-time flags:
+
+```bash
+python scripts/run_anchored_demo_smoke.py
+python -m satroot_anchored_demo_smoke --root-id <txid>:<vout>
+```
+
+It binds one dedicated identity demo namespace to a `root_id` that defaults to its own distinct placeholder (`6666...6666:0`), signs the namespace lifecycle with the `ed25519` scheme instead of the demo or hmac schemes, and emits a report proving five things: the semantic state hash binds the `root_id`, the ed25519 bundle verifies against its generated key material, replay is deterministic, events carrying a foreign root are rejected with `root_id mismatch`, and no ledger event kind models root custody.
+
+That last check is the root lifecycle rule made concrete: moving the root satoshi on-chain never appears in the ledger and cannot alter the semantic state hash. Binding a real one-satoshi outpoint (testnet first) only changes the `root_id` string passed at run time — never the event rules, and never a checked-in file. The lane requires the `[crypto]` extra (`pip install -e ".[crypto]"`).
+
+The companion anchored publication lane pushes the same anchored namespace through the full publication ladder — signed bundles, release, catalog, network, and registry workspace — with ed25519 signing end to end, and verifies the root binding in every generated bundle genesis:
+
+```bash
+python scripts/run_anchored_publication_smoke.py
+python -m satroot_anchored_publication_smoke --root-id <txid>:<vout>
+```
+
+The on-chain envelope lane completes the loop, building the SPEC section 4 commitment script (`OP_FALSE OP_RETURN "SATROOT1" <content-type> <payload>`) for a namespace's root and state hash — deterministically and fully offline; the operator broadcasts the result out-of-band:
+
+```bash
+python scripts/run_onchain_envelope_smoke.py
+python -m satroot_onchain_envelope_smoke --root-id <txid>:<vout> --state-hash sha256:<hex>
+```
+
+The envelope verification lane closes the read side: given a serialized transaction's raw bytes (fetched out-of-band), it confirms — fully offline — that the bytes hash to the expected transaction id and carry exactly one `SATROOT1` envelope output matching the rebuilt commitment byte for byte:
+
+```bash
+python scripts/run_envelope_verification_smoke.py
+python -m satroot_envelope_verification_smoke --raw-tx-hex-file <path> --root-id <txid>:<vout> --state-hash sha256:<hex> --expected-txid <txid>
+```
+
+Intentional anchored runs against real outpoints are recorded in `ANCHORS.md`, the only place in the repository where a real outpoint may appear.