Spiral/cyc 018 spiral core update

.github/workflows/spiral-integration.yml

@@ -0,0 +1,41 @@
+name: Spiral integration
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  merge_group:
+    types: [checks_requested]
+
+jobs:
+  spiral-integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      - run: pip install -r .spiral-core/requirements.txt
+
+      - if: github.event_name == 'pull_request'
+        run: >-
+          node .spiral-core/bin/spiral.mjs validate integration
+          --base '${{ github.event.pull_request.base.sha }}'
+          --head '${{ github.event.pull_request.head.sha }}'
+          --base-branch '${{ github.event.pull_request.base.ref }}'
+          --head-branch '${{ github.event.pull_request.head.ref }}'
+
+      # Candidate cycle closure/branch correspondence was checked on pull_request.
+      # Validate the exact queued combined snapshot rather than reconstructing only the individual PR.
+      - if: github.event_name == 'merge_group'
+        run: python .spiral-core/bin/spiral-rdf.py --repo . --tree '${{ github.sha }}'

.spiral/cycles/CYC-018.md

@@ -0,0 +1,174 @@
+---
+id: CYC-018
+---
+
+# Cycle: Spiral Core Process Update
+
+Repository branch: `spiral/CYC-018-spiral-core-update`
+Branch verified: verified on 2026-08-18 with `git branch --show-current`, branched from `master` after accepted CYC-017 was merged.
+
+## Analyze
+
+Project state / prior evaluation that makes this cycle relevant:
+
+SimplyStore uses `.spiral-core` as its installed Spiral Developer process source. The latest accepted SimplyStore cycle is CYC-017, and there is no active product cycle. The human requested updating `.spiral-core` and adjusting local process before the next durability/product cycle.
+
+Nearest important risk / uncertainty / desired movement:
+
+If the local process remains behind the installed Spiral core, future cycles may use outdated collaboration, validation, or artifact guidance. Conversely, blindly adopting upstream changes without checking their relevance can add local ceremony or contradict SimplyStore's established working defaults.
+
+Relevant human direction / feedback:
+
+The human explicitly requested: "Before the next cycle, please update .spiral-core and adjust the process."
+
+Continuation on 2026-08-19: the human asked to update `.spiral-core` again and follow any new instructions.
+
+Governing higher-level plan / direction:
+
+This is a process-maintenance cycle governed by Spiral's process-evolution and Git history rules. It intentionally precedes the next product durability cycle.
+
+Current position in that plan:
+
+CYC-017 is accepted and merged. The next product direction remains durability integrity/tamper detection, but this cycle temporarily updates the process substrate first.
+
+## Plan
+
+### Cycle goal
+
+Update `.spiral-core` to the latest upstream version available from `github.com/muze-labs/spiral-developer`, inspect the process changes, and adjust SimplyStore's local process/project context where those changes materially apply.
+
+### Why now / why this cycle boundary
+
+The human asked to do this before the next product cycle. Keeping it separate avoids mixing process-adoption changes with durability/runtime behavior changes.
+
+### Plan continuity decision
+
+Revise local process substrate before continuing the durability roadmap. This does not replace the next product goal; it prepares the repository to run it under the current Spiral process.
+
+### Current starting evidence
+
+- `.spiral-core` is currently at `3111b784531e327da75801f5ba8b61e891341d5f`.
+- `.spiral/project-context.md` records no active cycle and CYC-017 as latest accepted.
+- `master` is clean and contains the CYC-017 merge.
+
+### Evaluation basis
+
+- `.spiral-core` is updated to the latest fetched upstream commit.
+- Upstream changes since the prior core commit are inspected and summarized.
+- Local `AGENTS.md` and/or `.spiral/project-context.md` are adjusted only where the upstream process changes materially apply to SimplyStore.
+- No SimplyStore runtime/product behavior changes.
+- Relevant process/provenance checks pass or any limits are recorded.
+
+### Likely work
+
+- Fetch `.spiral-core` upstream.
+- Inspect commit log and changed files since the current submodule commit.
+- Move the submodule pointer.
+- Read changed upstream docs/prompts/cultures/profiles that affect local work.
+- Update local process context/instructions where needed.
+- Record implementation/evidence artifacts if the changes are material.
+
+### Explicit non-goals
+
+- Start the integrity/tamper-detection product cycle.
+- Change SimplyStore runtime code, tests, durable format, REST API, or JavaScript query API.
+- Rewrite existing cycle history.
+- Adopt upstream changes locally when they are irrelevant to SimplyStore.
+
+### Pause / re-plan conditions
+
+- Upstream process changes materially conflict with existing accepted SimplyStore process commitments.
+- The submodule cannot be fetched or checked out.
+- The update requires product/runtime changes.
+
+## Act
+
+Important artifacts / semantic commits produced:
+
+- `4cefd007da682ce8ef46ccfc4852882fb34e2003` opened CYC-018 on `spiral/CYC-018-spiral-core-update`.
+- `IMP-20260818-09ZEF-1` records the local adoption of `.spiral-core` distributed-development and integration-validation guidance.
+- `EVD-20260818-09ZEF-2` records verification of the process update and local validation limits.
+- `EVD-20260818-09ZEF-3` records the later Python retry, successful tree/prospective-integration validation, and remaining worktree-validation limitation.
+- `EVD-20260819-09ZEF-4` records verification of the later `.spiral-core` update to `8d4b2c738a413abd4cccca740ce958f486e5f7af` and the new Active-cycle integration guard.
+
+Material implementation decisions or deviations from the initial likely work:
+
+- `.spiral-core` was updated from `3111b784531e327da75801f5ba8b61e891341d5f` to `b24a5e8e301437561f2ed7e60486014cebae12c6`.
+- `.spiral-core` was later updated again from `b24a5e8e301437561f2ed7e60486014cebae12c6` to `8d4b2c738a413abd4cccca740ce958f486e5f7af`.
+- Future new artifacts should use worktree-local distributed IDs from `node .spiral-core/bin/spiral.mjs allocate <TYPE>`.
+- CYC-018 retains its legacy sequential ID because it was opened before this upstream process change was adopted locally.
+- SimplyStore now has a GitHub Actions adapter for Spiral integration validation, but branch protection settings remain outside repository control.
+- The old repository-local CYC-016 validator was made tolerant of distributed artifact IDs, while its CYC-016-specific branch/traversal behavior remains a known limit.
+- A local `.spiral/vocabulary.ttl` file was added so tree-based validation has the needed causal relation hierarchy when `.spiral-core` appears only as a submodule gitlink.
+- The GitHub merge-group workflow validates the merge-group commit tree directly because current worktree validation includes `.spiral-core`'s own Turtle artifacts.
+- The pull-request workflow now passes base/head branch names to Spiral integration validation so cycle closure and branch/cycle correspondence can be checked where hosting metadata is available.
+- Local process guidance now records the new rule that Active cycle branches do not merge outward and that parallel material revisions of the same governed artifact require explicit convergence lineage with `sd:transforms`.
+
+Out-of-scope discoveries retained for later:
+
+- Local Spiral validation requires Python `rdflib`; after retrying Python setup, a temporary virtual environment under `/tmp` worked.
+- `node .spiral-core/bin/spiral.mjs validate` still fails in this submodule-consuming repository because it recursively includes `.spiral-core`'s own Turtle artifacts.
+
+## Evaluate
+
+Integrated result against cycle goal:
+
+The cycle goal is met. `.spiral-core` is updated to the latest fetched upstream commit, the upstream distributed-development and integration-validation guidance was inspected, and SimplyStore's local process surface was adjusted where the changes materially apply.
+
+Evidence / acceptance result:
+
+`EVD-20260818-09ZEF-2` records the initial verification evidence. `EVD-20260818-09ZEF-3` updates that evidence after Python setup was retried: tree/prospective-integration validation now passes with a temporary virtual environment, while worktree validation remains blocked by upstream submodule scanning behavior. `EVD-20260819-09ZEF-4` verifies the latest core update and confirms that branch-aware integration validation correctly rejected CYC-018 while it remained `sd:Active`. The human accepted the cycle on 2026-08-19.
+
+Metric or risk movement:
+
+The risk of future artifact ID conflicts in concurrent work is reduced by adopting worktree-local distributed allocation. The risk of accepting locally valid but integration-invalid Spiral graph changes is reduced by adding a pre-merge integration validation expectation and GitHub workflow adapter.
+
+The risk of accidentally merging unfinished cycle work is further reduced by adopting the upstream Active-cycle integration guard. The risk of clean Git merges silently combining independent governed-artifact meanings is reduced by recording the explicit-convergence rule in local process context.
+
+What changed in our understanding:
+
+Spiral core now treats integration context as a brownfield intake topic. SimplyStore's previous intake was still materially complete, but needed an added integration-context section.
+
+Surprises / model mismatches:
+
+The current environment can run the new Spiral RDF validator through a temporary `/tmp` virtual environment. The remaining validator mismatch is not Python setup: worktree validation recursively includes `.spiral-core`'s own Turtle files and reports duplicate artifact IDs in this submodule-consuming repository.
+
+Known compromises:
+
+- CYC-018 keeps its legacy sequential ID because it was opened before the distributed-ID process was adopted locally.
+- Branch protection/required-check settings are external to the repository and remain unknown.
+- The old repository-local validator remains CYC-016-specific.
+- Local worktree validation with the new core CLI remains unsuitable until upstream excludes nested process repositories or accepts an explicit graph root.
+
+Unresolved issues within current goal:
+
+No repository changes remain. Local tree/prospective-integration validation works with a prepared Python environment; local worktree validation remains an upstream tooling limitation recorded for follow-up.
+
+Candidate next-cycle inputs:
+
+- Continue the durability roadmap with integrity/tamper detection after CYC-018 is accepted and merged.
+- Consider configuring repository branch protection so the new Spiral integration workflow is required.
+
+Human evaluation / feedback:
+
+Accepted by the human on 2026-08-19 after reviewing the summary of Spiral process changes. The accepted result is that SimplyStore now follows the updated distributed Spiral process: distributed artifact allocation, branch-aware integration validation, no outward merge of Active cycle branches, and explicit convergence lineage for parallel governed-artifact revisions.
+
+Cycle accepted, still open, or deliberately re-planned:
+
+Accepted. Ready for prospective integration validation against the current `master`.
+
+## Process learning
+
+What context/constraint/evaluation helped:
+
+The new distributed-ID allocator immediately prevented us from continuing the old global-next-number habit for new implementation/evidence artifacts.
+
+What bookkeeping was useless:
+
+None identified; this cycle was process-maintenance work, so the process bookkeeping itself was the subject of the change.
+
+What should the environment learn from this cycle:
+
+Future SimplyStore Spiral artifacts should be allocated through the core CLI. Future integration should validate the candidate against the current target, not only the branch snapshot.
+
+Later core update added two important distributed-process lessons: cycle acceptance must be recorded before outward integration, and Git textual merge is not enough evidence when two histories materially changed the same governed artifact.

.spiral/cycles/CYC-018.ttl

@@ -0,0 +1,9 @@
+@prefix sd: <https://muze.nl/ns/spiral-developer#> .
+@prefix dcterms: <http://purl.org/dc/terms/> .
+@prefix project: <https://github.com/simplyedit/simplystore/spiral#> .
+
+project:CYC-018
+    a sd:Cycle ;
+    dcterms:identifier "CYC-018" ;
+    sd:repositoryPath ".spiral/cycles/CYC-018.md" ;
+    sd:status sd:Accepted .

.spiral/evidence/EVD-20260818-09ZEF-2.md

@@ -0,0 +1,88 @@
+---
+id: EVD-20260818-09ZEF-2
+---
+
+# Verification Evidence: Spiral Core Process Update
+
+## Claim being verified
+
+`IMP-20260818-09ZEF-1` updates SimplyStore's local Spiral Developer process adoption to `.spiral-core` commit `b24a5e8e301437561f2ed7e60486014cebae12c6` and applies the upstream distributed-development and integration-validation process changes that matter locally.
+
+## Why this evidence exists
+
+The human requested updating `.spiral-core` and adjusting the local process before the next product durability cycle. The upstream core update changes how new artifact IDs should be allocated and adds a prospective integration validation boundary, both of which affect future SimplyStore cycles.
+
+## Implementation under test
+
+| Artifact/path/symbol | Commit | Role |
+|---|---|---|
+| `.spiral-core` | `569e0eaab953b6294ba1c9e04204b25f95612df4` | Submodule pointer updated to upstream `b24a5e8e301437561f2ed7e60486014cebae12c6`. |
+| `AGENTS.md` | `278a9cacc55464644276f3ef904a646b91998300` | Local instructions updated for distributed artifact allocation and pre-merge validation. |
+| `.spiral/project-context.md` | `278a9cacc55464644276f3ef904a646b91998300` | Project context updated with new core hash, integration context, allocator direction, and local validator dependency limit. |
+| `.github/workflows/spiral-integration.yml` | `278a9cacc55464644276f3ef904a646b91998300` | GitHub adapter for pull-request and merge-group Spiral validation. |
+| `scripts/validate-spiral-provenance.mjs` | `569e0eaab953b6294ba1c9e04204b25f95612df4` | Legacy CYC-016 validator made tolerant of distributed artifact IDs. |
+| `.spiral/implementations/IMP-20260818-09ZEF-1.*` | `569e0eaab953b6294ba1c9e04204b25f95612df4` | Process-adoption implementation provenance. |
+
+## Evidence method
+
+- [x] Automated test
+- [x] Property/invariant check
+- [x] Static analysis
+- [ ] Benchmark
+- [x] Manual observation
+- [ ] Integration exercise
+- [ ] Other:
+
+## Result
+
+Commands run:
+
+```text
+git -C .spiral-core fetch origin
+git -C .spiral-core log --oneline --decorate HEAD..origin/main
+git -C .spiral-core diff --name-status HEAD..origin/main
+git -C .spiral-core checkout origin/main
+git -C .spiral-core rev-parse HEAD
+node .spiral-core/bin/spiral.mjs --help
+node .spiral-core/bin/spiral.mjs status
+node .spiral-core/bin/spiral.mjs workspace init
+node .spiral-core/bin/spiral.mjs allocate IMP
+node .spiral-core/bin/spiral.mjs allocate EVD
+npm test
+git diff --check
+grep -R -nE "gitCommit \"[0-9a-f]{7,39}\"" .spiral/implementations/IMP-20260818-09ZEF-1.ttl
+git merge-base --is-ancestor 278a9cacc55464644276f3ef904a646b91998300 HEAD
+git merge-base --is-ancestor 4cefd007da682ce8ef46ccfc4852882fb34e2003 HEAD
+node scripts/validate-spiral-provenance.mjs
+node .spiral-core/bin/spiral.mjs validate
+```
+
+Results:
+
+- `.spiral-core` updated from `3111b784531e327da75801f5ba8b61e891341d5f` to `b24a5e8e301437561f2ed7e60486014cebae12c6`.
+- Upstream changes since the prior adopted core commit add distributed artifact identity/allocation, a Spiral CLI, prospective integration validation, hosted CI adapter examples, and updated intake/git/review guidance.
+- Worktree-local allocator namespace initialized as `09ZEF`; allocated IDs were `IMP-20260818-09ZEF-1` and `EVD-20260818-09ZEF-2`.
+- `AGENTS.md` now points agents to `docs/distributed-development.md`, instructs future new artifacts to use `node .spiral-core/bin/spiral.mjs allocate <TYPE>`, and records the pre-merge integration validation expectation.
+- `.spiral/project-context.md` now records `master` as authoritative integration branch, the history-preserving review/merge boundary, the Spiral integration validation command, the GitHub workflow adapter, and the local validator dependency limitation.
+- `.github/workflows/spiral-integration.yml` adapts the upstream GitHub example to this repository's `.spiral-core` submodule path.
+- The legacy repository-local validator now accepts distributed artifact IDs, then fails at its known CYC-016-specific branch check: `Expected CYC-016 branch, got spiral/CYC-018-spiral-core-update`.
+- The new Spiral core validator could not run locally because Python package `rdflib` is unavailable.
+- Attempting `python3 -m pip install --user -r .spiral-core/requirements.txt` failed because the OS is an externally managed Python environment.
+- Attempting `python3 -m venv /tmp/simplystore-spiral-venv` failed because `python3-venv` / `ensurepip` is unavailable.
+- `uv`, `pipx`, and Python `rdflib` were not installed in this environment.
+- `npm test` passed: 16/16 startup durability tests.
+- `git diff --check` passed.
+- No accidental short Git hashes were found in the new implementation Turtle reference.
+- The new implementation Turtle references point to existing ancestor commits.
+
+## Failure cases / limits
+
+- Local execution of `node .spiral-core/bin/spiral.mjs validate` still requires a prepared Python environment with `rdflib`.
+- The GitHub Actions workflow is only a repository-side adapter. Repository branch protection/required-check settings are external hosting configuration and remain unknown.
+- Existing historical artifacts keep their legacy sequential IDs; this is intentional.
+- CYC-018 itself keeps a legacy sequential cycle ID because it was opened before the updated distributed-ID process was adopted locally.
+- `scripts/validate-spiral-provenance.mjs` remains CYC-016-specific and should not be treated as the general current validator.
+
+## Evidence quality
+
+This evidence is sufficient for the process-update claim: the submodule was updated, the upstream process delta was inspected, local instructions/context were adjusted where relevant, the new allocator was initialized and used, the CI adapter was added, product tests still pass, and local validation limitations are explicit rather than hidden.

.spiral/evidence/EVD-20260818-09ZEF-2.ttl

@@ -0,0 +1,14 @@
+@prefix sd: <https://muze.nl/ns/spiral-developer#> .
+@prefix dcterms: <http://purl.org/dc/terms/> .
+@prefix project: <https://github.com/simplyedit/simplystore/spiral#> .
+
+project:EVD-20260818-09ZEF-2
+    a sd:VerificationEvidence ;
+    dcterms:identifier "EVD-20260818-09ZEF-2" ;
+    sd:repositoryPath ".spiral/evidence/EVD-20260818-09ZEF-2.md" ;
+    sd:status sd:Active ;
+    sd:verifies [
+        a sd:ArtifactReference ;
+        sd:artifact project:IMP-20260818-09ZEF-1 ;
+        sd:gitCommit "569e0eaab953b6294ba1c9e04204b25f95612df4"
+    ] .