@openwop/openwop-conformance 1.0.0

package/schemas/run-event.schema.json

@@ -0,0 +1,116 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/run-event.schema.json",
+  "title": "RunEventDoc",
+  "description": "Persisted event document in the run's append-only event log. Source of truth for run state via projection fold. Canonical OpenWOP v1 event envelope.",
+  "type": "object",
+  "required": ["eventId", "runId", "type", "payload", "timestamp", "sequence"],
+  "properties": {
+    "eventId": {
+      "type": "string",
+      "description": "Globally unique ID for this event. Generated by appendAtomic before write; consumers MUST treat as opaque.",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "runId": {
+      "type": "string",
+      "description": "Run this event belongs to.",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "nodeId": {
+      "type": "string",
+      "description": "Set for node-scoped events (node.*, approval.*, clarification.*). Lifted to top-level so projection code can key per-node state machines without payload type coercion.",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "type": {
+      "$ref": "#/$defs/RunEventType"
+    },
+    "payload": {
+      "description": "Event-type-specific payload. Servers MAY validate against per-type schemas; this top-level schema accepts any JSON value.",
+      "type": ["object", "array", "string", "number", "boolean", "null"]
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 timestamp. IO adapters normalize between this canonical form and platform-specific representations (e.g., Firestore Timestamp)."
+    },
+    "sequence": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Monotonic per-run sequence. First event is 0; assigned atomically by appendAtomic."
+    },
+    "schemaVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Per-event schema version. Bumped when an individual event type's payload contract changes. Distinct from per-run eventLogSchemaVersion (which describes the subcollection contract). Reader behavior is tolerant — unknown future versions fold best-effort."
+    },
+    "engineVersion": {
+      "type": "string",
+      "description": "Engine version that produced this event. Used by P4 versioning for compatibility checks."
+    },
+    "causationId": {
+      "type": "string",
+      "description": "Optional ID of the event that caused this one (e.g., node.completed caused by approval.received). Lets projections build causal chains without inferring from timing.",
+      "minLength": 1,
+      "maxLength": 128
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "RunEventType": {
+      "type": "string",
+      "description": "Discriminator for event payload shape. Dotted naming convention. New variants extend the union — readers MUST NOT throw on unknown types (forward-compat: fold best-effort, ignore unknowns).",
+      "enum": [
+        "run.started",
+        "run.completed",
+        "run.failed",
+        "run.cancelled",
+        "run.resuming",
+        "run.paused",
+        "run.resumed",
+        "run.restored-from-snapshot",
+        "node.started",
+        "node.completed",
+        "node.failed",
+        "node.suspended",
+        "node.suspend-failed",
+        "node.resumed",
+        "node.retried",
+        "node.skipped",
+        "node.cancelled",
+        "approval.requested",
+        "approval.received",
+        "clarification.requested",
+        "clarification.resolved",
+        "interrupt.requested",
+        "interrupt.resolved",
+        "channel.written",
+        "artifact.created",
+        "output.chunk",
+        "variable.changed",
+        "log.appended",
+        "version.pinned",
+        "workflow.restored",
+        "workflow.loopback-limit",
+        "workflow.stalled",
+        "cap.breached",
+        "lease.acquired",
+        "lease.renewed",
+        "lease.lost",
+        "lease.handed-off",
+        "replay.diverged",
+        "agent.reasoned",
+        "agent.toolCalled",
+        "agent.toolReturned",
+        "agent.handoff",
+        "agent.decided",
+        "runOrchestrator.decided",
+        "conversation.opened",
+        "conversation.exchanged",
+        "conversation.closed"
+      ]
+    }
+  }
+}

package/schemas/run-options.schema.json

@@ -0,0 +1,81 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/run-options.schema.json",
+  "title": "RunOptions",
+  "description": "Per-run parameter overlay supplied by the caller in `POST /v1/runs`. See `run-options.md` for full semantics. Reserved keys are typed; unknown keys in `configurable` pass through to the engine.",
+  "type": "object",
+  "properties": {
+    "configurable": {
+      "$ref": "#/$defs/Configurable",
+      "description": "Per-run overrides that affect runtime behavior without forking the workflow definition."
+    },
+    "tags": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1, "maxLength": 256 },
+      "maxItems": 100,
+      "uniqueItems": false,
+      "description": "Free-form caller tags for filtering/correlation. Server SHOULD enforce maxItems=100 and per-tag maxLength=256."
+    },
+    "metadata": {
+      "type": "object",
+      "description": "Free-form caller metadata. Persisted on the run doc; surfaces back via `RunSnapshot.metadata`. Server MAY enforce a serialized-size limit (recommended: 50KB)."
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "Configurable": {
+      "type": "object",
+      "description": "Reserved keys are typed below; unknown keys pass through verbatim. Implementations declare which keys they consume via `Capabilities.configurable` when advertised.",
+      "properties": {
+        "recursionLimit": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Override the per-run node-execution ceiling. Server clamps to `Capabilities.limits.maxNodeExecutions`."
+        },
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Override the AI model for nodes that consume `ctx.config.configurable.model`. Examples: `gpt-4`, `claude-opus-4-7`, `gemini-2.5-pro`."
+        },
+        "temperature": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 2,
+          "description": "Override AI temperature. Server SHOULD enforce 0..2 range."
+        },
+        "maxTokens": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Override AI max-tokens cap."
+        },
+        "promptOverrides": {
+          "type": "object",
+          "additionalProperties": { "type": "string" },
+          "description": "Per-prompt-ID variant override. Map of canonical prompt ID -> override text."
+        },
+        "mockProvider": {
+          "$ref": "#/$defs/MockProvider"
+        }
+      },
+      "additionalProperties": true
+    },
+    "MockProvider": {
+      "type": "object",
+      "description": "Routes AI activity calls through a deterministic mock provider instead of real LLM APIs. Test-keys-only — server returns 403 mock_provider_forbidden on production keys. See run-options.md §Mock provider extension (closes F1).",
+      "required": ["id"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Selects a mock provider from the server's catalog (advertised via `Capabilities.testing.mockProviders`). The spec-canonical baseline `stream-text` MUST be supported for OpenWOP v1.0 conformance; other providers (`tool-calls`, `error`, `usage-only`) are recommended but not required.",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "config": {
+          "type": "object",
+          "description": "Per-provider parameter shape. Each provider documents its own keys; see run-options.md §Canonical mock provider catalog. Common shapes (informative — not enforced at this schema level since providers are pluggable):\n\n  - stream-text: { tokens: string[], delayMsPerToken?: integer, finishReason?: string, usage?: object, model?: string }\n  - tool-calls: { toolCalls: object[], delayMsPerToken?: integer }\n  - error: { code: string, message: string, retryable?: boolean, failAfterMs?: integer }\n  - usage-only: { usage: object }"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/schemas/run-orchestrator-decided-event.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/run-orchestrator-decided-event.schema.json",
+  "title": "RunOrchestratorDecidedPayload",
+  "description": "Payload for the `runOrchestrator.decided` RunEvent. Emitted exactly once per orchestrator decision by a `core.orchestrator.supervisor` node (or a host-extension equivalent that advertises orchestration). Carries the deciding agent's identity and the typed decision (orchestrator-decision.schema.json). The event envelope's top-level `nodeId` field carries the supervisor node-id; the payload does NOT duplicate it. See RFC 0006 §E for ordering invariants CO-1/CO-2/CO-3.",
+  "type": "object",
+  "required": ["agentId", "decision"],
+  "properties": {
+    "agentId": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 256,
+      "description": "AgentRef.agentId of the orchestrator that emitted this decision. MUST equal `RunSnapshot.runOrchestrator.agentId` for the run's lifetime — the orchestrator identity is set at the first decision and does not change."
+    },
+    "decision": {
+      "$ref": "https://openwop.dev/spec/v1/orchestrator-decision.schema.json"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/run-snapshot.schema.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/run-snapshot.schema.json",
+  "title": "RunSnapshot",
+  "description": "Projected run state returned by `GET /v1/runs/{runId}`. Source is the run's append-only event log (run-event.schema.json) folded through the `RunProjection`. Forward-compat tolerant: readers MUST ignore unknown fields rather than reject.",
+  "type": "object",
+  "required": ["runId", "workflowId", "status"],
+  "properties": {
+    "runId": {
+      "type": "string",
+      "description": "Globally unique run identifier.",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "workflowId": {
+      "type": "string",
+      "description": "ID of the workflow this run executes.",
+      "minLength": 1
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "pending",
+        "running",
+        "paused",
+        "waiting-approval",
+        "waiting-input",
+        "completed",
+        "failed",
+        "cancelled"
+      ],
+      "description": "Current run state. Forward-compat: future statuses MAY be added; readers SHOULD treat unknown values as terminal-unknown rather than throw."
+    },
+    "currentNodeId": {
+      "type": "string",
+      "description": "Set when the run is suspended at a specific node (`waiting-approval` / `waiting-input`) — identifies which node holds the interrupt."
+    },
+    "startedAt": { "type": "string", "format": "date-time" },
+    "completedAt": { "type": "string", "format": "date-time" },
+    "agent": {
+      "$ref": "agent-ref.schema.json",
+      "description": "Optional run-level agent identity (Multi-Agent Shift Phase 1). When the run is driven by a single agent, this field carries that agent's `AgentRef`. In supervisor-orchestrated runs (Phase 5), this field rotates as workers hand off — it always carries the active worker for the current node. See `runOrchestrator` for the run-lifetime supervisor identity. Absent for runs with no agent provenance (legacy single-actor host)."
+    },
+    "runOrchestrator": {
+      "$ref": "agent-ref.schema.json",
+      "description": "Optional orchestrator-supervisor identity (Multi-Agent Shift Phase 5). When set, this agent owns dispatch decisions across the run's lifetime; `runOrchestrator.decided` events emitted during the run carry this agent's `agentId`. Distinct from `agent` — `agent` rotates with each worker; `runOrchestrator` is set at run start (or first `core.orchestrator.supervisor` node) and MUST NOT change for the run's lifetime. In single-agent runs (no supervisor), this field is absent; in supervisor runs both fields MAY co-exist."
+    },
+    "nodeStates": {
+      "type": "object",
+      "description": "Per-node state map. Keys are nodeIds; values are implementation-shaped state objects. Spec doesn't constrain the inner shape — see version-negotiation.md §node-states."
+    },
+    "variables": {
+      "type": "object",
+      "description": "Workflow-level variables (caller-supplied inputs + per-node outputs that survive the projection)."
+    },
+    "channels": {
+      "type": "object",
+      "description": "Optional typed state channels (see channels-and-reducers.md). Present when the workflow declares channel-aware mode."
+    },
+    "error": {
+      "type": "object",
+      "description": "Set on terminal `failed`. Structured so consumers can route on code without parsing message text.",
+      "required": ["code", "message"],
+      "properties": {
+        "code": { "type": "string", "minLength": 1 },
+        "message": { "type": "string", "minLength": 1 },
+        "details": { "type": "object" }
+      },
+      "additionalProperties": false
+    },
+    "engineVersion": {
+      "type": "string",
+      "description": "Engine version the run was started under. Used by the projection for forward-compat folds."
+    },
+    "eventLogSchemaVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Per-run event-log subcollection schema version. See version-negotiation.md."
+    },
+    "tags": {
+      "type": "array",
+      "items": { "type": "string", "maxLength": 256 },
+      "maxItems": 100,
+      "description": "Caller-supplied tags from `RunOptions.tags`."
+    },
+    "metadata": {
+      "type": "object",
+      "description": "Caller-supplied metadata from `RunOptions.metadata`."
+    },
+    "configurable": {
+      "type": "object",
+      "description": "Per-run overlay from `RunOptions.configurable` (see run-options.md). Reserved keys: `recursionLimit`, `model`, `temperature`, `maxTokens`, `promptOverrides`."
+    },
+    "metrics": {
+      "type": "object",
+      "description": "Aggregate run-level metrics. Forward-compat: readers MUST tolerate missing/unknown fields. Fields are populated lazily as the engine emits them — absence does NOT mean zero. Implementation-specific fields (e.g., legacy `cost: number` estimates) MAY appear alongside the spec-canonical fields below.",
+      "properties": {
+        "openwopCost": {
+          "type": "object",
+          "description": "Spec-canonical cost rollup aggregated from per-node `recordCost()` calls. Keys mirror the `openwop.cost.*` OTel attribute allowlist (see `observability.md` §Cost attribution). Named `openwopCost` rather than `cost` because some implementations carry a legacy `metrics.cost: number` estimate that predates the typed rollup; using a distinct name avoids collision. Multi-provider runs report `provider`/`model` of the LAST contributing call; SDKs that need per-call detail SHOULD subscribe to OTel spans instead of reading this rollup.",
+          "properties": {
+            "usd": { "type": "number", "minimum": 0, "description": "Total USD cost across all node-level recordCost emissions." },
+            "tokens": {
+              "type": "object",
+              "properties": {
+                "input": { "type": "integer", "minimum": 0 },
+                "output": { "type": "integer", "minimum": 0 }
+              },
+              "additionalProperties": false
+            },
+            "model": { "type": "string", "description": "Model identifier of the most recent recordCost emission (e.g., `claude-opus-4-7`). For multi-model runs, surfaces the last value." },
+            "provider": { "type": "string", "description": "Normalized provider name (e.g., `anthropic`, `openai`, `gemini`)." },
+            "duration_ms": { "type": "integer", "minimum": 0, "description": "Sum of per-call durations across all recordCost emissions in this run." }
+          },
+          "additionalProperties": false
+        }
+      }
+    }
+  },
+  "additionalProperties": true
+}

package/schemas/suspend-request.schema.json

@@ -0,0 +1,182 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/suspend-request.schema.json",
+  "title": "InterruptPayload",
+  "description": "Wire format for ctx.interrupt(payload) — the canonical HITL primitive. See spec/v1/interrupt.md for semantics. Discriminated by `kind`. The persisted `interrupt.requested` event carries this payload verbatim plus engine-assigned identity fields.",
+  "type": "object",
+  "required": ["kind", "key", "data"],
+  "properties": {
+    "kind": {
+      "type": "string",
+      "enum": ["approval", "clarification", "external-event", "custom", "conversation.start", "conversation.exchange", "conversation.close", "low-confidence"],
+      "description": "Discriminator for resume-time routing + UI rendering + observability. Multi-Agent Shift Phase 4 adds `conversation.start` / `conversation.exchange` / `conversation.close` for multi-turn user interjections (see ConversationStartData / ConversationExchangeData / ConversationCloseData below). Phase 1 adds `low-confidence` for the confidence-escalation contract (orchestrator-supervisor suspends below threshold; see LowConfidenceData)."
+    },
+    "key": {
+      "type": "string",
+      "description": "Deterministic key used to short-circuit on re-entry after process death. If two interrupt() calls in the same run emit the same key, the second returns the cached result of the first. Recommended: ${runId}:${nodeId}:${interruptCount}.",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "resumeSchema": {
+      "description": "Optional JSON Schema for resume value. Servers SHOULD validate before returning to the suspended executor.",
+      "type": "object"
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Optional auto-reject after this duration. Engine throws InterruptTimeoutError when exceeded."
+    },
+    "data": {
+      "oneOf": [
+        { "$ref": "#/$defs/ApprovalData" },
+        { "$ref": "#/$defs/ClarificationData" },
+        { "$ref": "#/$defs/ExternalEventData" },
+        { "$ref": "#/$defs/CustomData" },
+        { "$ref": "#/$defs/ConversationStartData" },
+        { "$ref": "#/$defs/ConversationExchangeData" },
+        { "$ref": "#/$defs/ConversationCloseData" },
+        { "$ref": "#/$defs/LowConfidenceData" }
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "ApprovalData": {
+      "type": "object",
+      "description": "Payload for kind='approval'. Uses the canonical 5-action OpenWOP approval vocabulary.",
+      "required": ["artifactId", "artifactType", "title", "actions"],
+      "properties": {
+        "artifactId": { "type": "string", "minLength": 1 },
+        "artifactType": { "type": "string", "minLength": 1 },
+        "title": { "type": "string", "minLength": 1 },
+        "description": { "type": "string" },
+        "artifactData": {},
+        "actions": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["accept", "reject", "refine", "edit-accept", "ask"]
+          },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Allowed actions. Server MUST enforce on resolve. The 'ask' action does NOT exit the suspend — Q&A exchanges accumulate via askService until accept/reject/refine/edit-accept fires. See `interrupt.md` §`ApprovalResume` for the action vocabulary + per-action required fields."
+        },
+        "requiredApprovals": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 1,
+          "description": "Multi-approver quorum."
+        },
+        "approversList": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Restrict resolution to these user IDs. Empty/unset = any user with approvals:respond scope."
+        },
+        "rejectionPolicy": {
+          "type": "string",
+          "enum": ["single-veto", "majority"],
+          "default": "single-veto"
+        }
+      }
+    },
+    "ClarificationData": {
+      "type": "object",
+      "description": "Payload for kind='clarification'. AI/system asks the user for missing context before continuing.",
+      "required": ["questions"],
+      "properties": {
+        "questions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["id", "question"],
+            "properties": {
+              "id": { "type": "string", "minLength": 1 },
+              "question": { "type": "string", "minLength": 1 },
+              "schema": { "type": "object", "description": "Optional JSON Schema for the answer." }
+            },
+            "additionalProperties": false
+          },
+          "minItems": 1
+        },
+        "contextType": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "ExternalEventData": {
+      "type": "object",
+      "description": "Payload for kind='external-event'. Engine waits for an external system to POST to /v1/interrupts/{token}.",
+      "required": ["eventType", "correlation"],
+      "properties": {
+        "eventType": {
+          "type": "string",
+          "description": "Stable description of what's awaited. Surfaced in admin panels. Examples: 'stripe.checkout.completed', 'calendar.event.confirmed'."
+        },
+        "correlation": {
+          "type": "object",
+          "description": "Opaque correlation payload — whatever the external system needs to match the interrupt back to its source event."
+        }
+      },
+      "additionalProperties": false
+    },
+    "CustomData": {
+      "type": "object",
+      "description": "Escape hatch for kinds not yet spec'd. Servers MUST accept and persist; UI rendering and admin tooling are best-effort.",
+      "required": ["customKind"],
+      "properties": {
+        "customKind": { "type": "string", "minLength": 1 },
+        "payload": {}
+      },
+      "additionalProperties": false
+    },
+    "ConversationStartData": {
+      "type": "object",
+      "description": "Payload for kind='conversation.start' (Multi-Agent Shift Phase 4). Opens a new multi-turn conversation context. The host mints a `conversationId` and emits `conversation.opened`; subsequent `conversation.exchange` calls reuse the same id.",
+      "required": ["conversationId"],
+      "properties": {
+        "conversationId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "Opaque conversation identifier. Tenant-unique invariant: hosts MUST ensure no two distinct conversations in the same tenant share an id. Cross-host portability is not normative — `conversationId`s minted by one host MUST NOT be assumed resolvable by another."
+        },
+        "title": { "type": "string", "description": "Optional human-readable conversation title surfaced in host UIs." },
+        "initialPrompt": { "type": "string", "description": "Optional system / agent message that opens the conversation. Folds into the `message` reducer as the first turn." }
+      },
+      "additionalProperties": false
+    },
+    "ConversationExchangeData": {
+      "type": "object",
+      "description": "Payload for kind='conversation.exchange' (Multi-Agent Shift Phase 4). Single-turn suspend within an open conversation; resume value MUST validate against the per-turn `outcomeSchema`.",
+      "required": ["conversationId", "prompt"],
+      "properties": {
+        "conversationId": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Active conversation identifier — MUST equal the id minted by a preceding `conversation.start`." },
+        "prompt": { "type": "string", "minLength": 1, "description": "Human-targeted question for this turn." },
+        "outcomeSchema": { "type": "object", "description": "Optional JSON Schema for the resume value (the user's response). Hosts SHOULD validate before resuming the suspended executor — replay determinism + idempotency require validated outcomes per the Phase-4 H4 disposition." },
+        "turnIndex": { "type": "integer", "minimum": 0, "description": "Optional 0-indexed turn within this conversation. Strictly monotonic when populated; absent values are derived host-side from event-log fold." }
+      },
+      "additionalProperties": false
+    },
+    "ConversationCloseData": {
+      "type": "object",
+      "description": "Payload for kind='conversation.close' (Multi-Agent Shift Phase 4). Terminates an open conversation context. Final event in the conversation lifecycle; no further `conversation.exchanged` events MAY follow for this `conversationId` in this run.",
+      "required": ["conversationId"],
+      "properties": {
+        "conversationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "reason": { "type": "string", "description": "Optional close rationale (e.g., 'goal-reached', 'max-turns', 'user-cancelled')." }
+      },
+      "additionalProperties": false
+    },
+    "LowConfidenceData": {
+      "type": "object",
+      "description": "Payload for kind='low-confidence' (Multi-Agent Shift Phase 1 — confidence-escalation contract). Emitted by an agent (typically `core.orchestrator.supervisor`) when its `agent.decided.confidence` falls below the run's resolved escalation threshold. Run transitions to `'waiting-approval'`; an operator ratifies the decision via the resume path.",
+      "required": ["agentId", "threshold", "observed"],
+      "properties": {
+        "agentId": { "type": "string", "minLength": 3, "maxLength": 256, "description": "AgentRef.agentId of the agent that suspended." },
+        "threshold": { "type": "number", "minimum": 0, "maximum": 1, "description": "Resolved escalation threshold for this run (default 0.7 per Phase-1 disposition; per-run override via `RunOptions.configurable.escalationThreshold`)." },
+        "observed": { "type": "number", "minimum": 0, "maximum": 1, "description": "The agent's reported confidence value that triggered the escalation." },
+        "decision": { "description": "Optional sketch of the decision the agent WOULD have emitted at threshold-or-above. Lets operators see the un-ratified choice. Shape mirrors `OrchestratorDecision` or the agent's domain-specific decision type." }
+      },
+      "additionalProperties": false
+    }
+  }
+}