@openwop/openwop-conformance 1.47.0 → 1.51.0

package/schemas/self-hosted-runner-dispatch-frame.schema.json

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/self-hosted-runner-dispatch-frame.schema.json",
+  "title": "SelfHostedRunnerDispatchFrame",
+  "description": "RFC 0122 §Registration + channel. A single model/tool DISPATCH STEP the host routes to a registered runner over the runner↔host channel (`self-hosted-runner.md`). The host is the sole orchestration/persistence/replay authority; this frame carries ONE step's inputs, never a whole run. `inputs` is opaque model/tool input (messages, tool arguments) and MUST NOT contain runner-credential material — the runner holds its own credential locally (SECURITY invariant `runner-credential-non-transit`). `seq` is the per-runner monotonic DISPATCH cursor, a DISTINCT sequence from the run event-log `sequence` (they MUST NOT be conflated); a reconnecting runner resumes via `Last-Event-ID` at this cursor and the host drops any redelivered `{runId, stepId}` whose result is already persisted (at-most-once).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["runId", "stepId", "seq", "kind", "inputs"],
+  "properties": {
+    "runId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The backing OpenWOP run this dispatch belongs to. Host-owned run identity."
+    },
+    "stepId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The dispatch step within the run. The `{runId, stepId}` pair is the at-most-once idempotency key: a runner MUST return the result under the same pair, and the host MUST drop (not re-dispatch) a redelivered `{runId, stepId}` whose result is already persisted."
+    },
+    "seq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The per-runner monotonic dispatch cursor for the channel. DISTINCT from the run event-log `sequence` (MUST NOT be conflated — conflating them breaks resume dedup). A reconnecting runner resumes via the SSE `Last-Event-ID` at this cursor so a dispatch is never redelivered past it (`stream-modes.md §Resumption`)."
+    },
+    "kind": {
+      "type": "string",
+      "enum": ["model", "tool"],
+      "description": "Whether this step dispatches a model call (`model`) or a tool call (`tool`). A host MAY advertise only a subset via `selfHostedRunner.dispatchKinds` and route only those kinds to runners."
+    },
+    "provider": {
+      "type": "string",
+      "minLength": 1,
+      "description": "REQUIRED when `kind == 'model'`. The model provider id the runner dispatches to under its locally-held credential (e.g. a subscription CLI login, a private endpoint). Never a host-held credential."
+    },
+    "model": {
+      "type": "string",
+      "minLength": 1,
+      "description": "REQUIRED when `kind == 'model'`. The model id to run."
+    },
+    "tool": {
+      "type": "string",
+      "minLength": 1,
+      "description": "REQUIRED when `kind == 'tool'`. The tool the runner executes locally."
+    },
+    "inputs": {
+      "type": "object",
+      "description": "Opaque model/tool inputs for this step (messages, tool arguments). MUST NOT contain runner-credential material (`runner-credential-non-transit`). The host sends inputs and receives outputs; the credential stays on the runner."
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "kind": { "const": "model" } } },
+      "then": { "required": ["provider", "model"] }
+    },
+    {
+      "if": { "properties": { "kind": { "const": "tool" } } },
+      "then": { "required": ["tool"] }
+    }
+  ],
+  "examples": [
+    {
+      "runId": "run_x",
+      "stepId": "step_3",
+      "seq": 12,
+      "kind": "model",
+      "provider": "anthropic",
+      "model": "claude-opus-4-8",
+      "inputs": { "messages": [{ "role": "user", "content": "summarize the attached notes" }] }
+    },
+    {
+      "runId": "run_y",
+      "stepId": "step_1",
+      "seq": 0,
+      "kind": "tool",
+      "tool": "local.shell.readFile",
+      "inputs": { "path": "/home/user/notes.txt" }
+    }
+  ]
+}

package/schemas/self-hosted-runner-registration.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/self-hosted-runner-registration.schema.json",
+  "title": "SelfHostedRunnerRegistration",
+  "description": "RFC 0122 §Registration + channel. The per-subject runtime record the host keeps for a registered runner after it dials in and authenticates with a host-minted, subject-scoped runner bearer (NEVER a provider credential). This record is per-subject runtime state and MUST NOT appear on `/.well-known/openwop` (only the `selfHostedRunner` capability block does). Work is addressed by `runnerId` (direct) or by capability-match; a capability match MUST filter on `subject` FIRST, then capability, so a subject's step is never routed to another subject's runner (subject-first match, SR-1-adjacent — a normative MUST in `self-hosted-runner.md` §Behavior verified by the gated conformance scenario).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["runnerId", "subject", "capabilities"],
+  "properties": {
+    "runnerId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The host-assigned identifier for this runner connection. Used for direct dispatch addressing."
+    },
+    "subject": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The owning principal — the stable RFC 0048 subject the host stamps on the backing run's `run.metadata`, NOT a fresh id. A runner is bound to exactly one owning subject; capability-match and fork-reroute MUST key on this subject FIRST."
+    },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "What this runner can serve. Empty arrays / omitted keys mean the runner serves none of that kind; capability-match considers only runners whose declared capability covers the dispatch step.",
+      "properties": {
+        "providers": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true,
+          "description": "Model provider ids the runner can dispatch to under its locally-held credentials."
+        },
+        "models": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true,
+          "description": "Specific model ids the runner can run (a refinement of `providers`)."
+        },
+        "tools": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true,
+          "description": "Tool ids the runner can execute locally."
+        }
+      }
+    }
+  },
+  "examples": [
+    {
+      "runnerId": "runner_laptop_01",
+      "subject": "user_42",
+      "capabilities": { "providers": ["anthropic"], "models": ["claude-opus-4-8"] }
+    }
+  ]
+}

package/schemas/self-hosted-runner-result-frame.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/self-hosted-runner-result-frame.schema.json",
+  "title": "SelfHostedRunnerResultFrame",
+  "description": "RFC 0122 §Registration + channel. The runner's answer to one `SelfHostedRunnerDispatchFrame`, POSTed back to the host over ordinary HTTP. The `{runId, stepId}` pair MUST equal the dispatch it answers (the at-most-once idempotency key); `seq` echoes the dispatch cursor. `output` is the opaque model/tool output the host persists as a normal step record — replay reads from persistence and NEVER re-dispatches. `output` MUST NOT contain runner-credential material (`runner-credential-non-transit`), and the host MUST treat it as UNTRUSTED transport: content re-entering an agent loop is fenced `<UNTRUSTED>` (`runner-output-untrusted-transport`). A provider-side error is carried inside `output` (it is still a model/tool output); host-side liveness failure is signalled out-of-band as the retriable `runner_unavailable` error, NOT as a result frame.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["runId", "stepId", "seq", "output"],
+  "properties": {
+    "runId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The run this result answers. MUST equal the dispatch frame's `runId`."
+    },
+    "stepId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The dispatch step this result answers. MUST equal the dispatch frame's `stepId`. The host drops the frame if a result for this `{runId, stepId}` is already persisted (at-most-once)."
+    },
+    "seq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Echoes the answered dispatch frame's per-runner cursor `seq`."
+    },
+    "output": {
+      "type": "object",
+      "description": "Opaque model/tool output for the step, persisted by the host as a normal step record. MUST NOT contain runner-credential material; the host fences it `<UNTRUSTED>` before it re-enters an agent loop (`runner-output-untrusted-transport`). A provider/tool error response is carried here (still an output)."
+    }
+  },
+  "examples": [
+    {
+      "runId": "run_x",
+      "stepId": "step_3",
+      "seq": 12,
+      "output": { "role": "assistant", "content": "Here is a summary of the notes: ..." }
+    }
+  ]
+}

package/schemas/workflow-chain-pack-manifest.schema.json

@@ -88,7 +88,7 @@
         },
         "parameters": {
           "type": "object",
-          "description": "JSON Schema 2020-12 fragment describing the parameter values the host editor MUST collect from the author at drop time. Authors-supplied values are validated against this schema before expansion proceeds; invalid input MUST be rejected with `chain_parameter_invalid`.",
+          "description": "JSON Schema 2020-12 fragment describing the parameter values the host editor MUST collect from the author at drop time. Authors-supplied values are validated against this schema before expansion proceeds; invalid input MUST be rejected with `chain_parameter_invalid`. RECOGNIZED EXTENSION KEY (RFC 0124 / WCP4): a property MAY carry `x-openwop-sensitive: true` to declare the parameter secret-class. A host that recognizes it MUST NOT expansion-time-freeze that parameter (plaintext secret-at-rest leak, SR-1) and MUST NOT materialize it as a plaintext `source:\"variable\"` binding (the value would land in the run-scoped bag / `RunSnapshot.variables` — the same SR-1 leak one layer down). Instead, per the 2026-07-04 §Security amendment: it is deferrable ONLY in a prompt-body position, where it MUST be materialized as a `source:\"secret\"` `PromptVariable` (BYOK-resolved via `capabilities.secrets`, redacted to `[REDACTED:<secretId>]` in `prompt.composed`, never bagged); in ANY other position (whole-value `node.inputs`, embedded non-prompt `config`, or a host lacking deferred / `secrets` support) it MUST fail closed with `sensitive_param_not_deferrable` (422). Per-run supply is a `credentialRef` secret reference, never plaintext. See `workflow-chain-packs.md` §\"Deferred-parameter expansion\" / RFC 0124 §Security.",
           "additionalProperties": true,
           "$comment": "Open by design — this field IS a JSON Schema document, so it must accept any of the 30+ JSON Schema 2020-12 keywords (`type`, `properties`, `required`, `oneOf`, `allOf`, etc.). Strict closure would require importing the JSON Schema meta-schema."
         },
@@ -197,12 +197,32 @@
           "description": "Target node id (must reference a node in `nodes[]`). MAY use `nodeId.inputPort` syntax."
         },
         "condition": {
+          "$ref": "#/$defs/EdgeCondition",
+          "description": "Optional edge condition — the SAME shape as a top-level workflow edge's condition (workflow-definition.schema.json §EdgeCondition). When present, the edge contributes to the target only if the condition holds against the source node's output, letting a chain express content routing (router/switch/conditional branches). Safety-fix (RFC 0013 amendment 2026-07-03): the field was previously typed `string`, contradicting this description; no chain used the string form (hosts dropped the field at expansion), so correcting it to the object shape breaks no conformant behavior."
+        },
+        "triggerRule": {
           "type": "string",
-          "description": "Optional edge condition expression — same shape as a top-level workflow edge's condition."
+          "enum": ["all_success", "any_success", "all_complete", "none_failed", "any_failed"],
+          "default": "all_success",
+          "description": "Optional fan-in / error-routing rule — the SAME shape and enum as a top-level workflow edge's `triggerRule` (workflow-definition.schema.json §WorkflowEdge). Governs how the target node fires given its incoming edges: `all_success` (default — every incoming edge's source succeeded), `any_success`, `all_complete` (fire when all sources have finished regardless of success — best-effort completion), `none_failed`, `any_failed`. Additive (RFC 0125): omitting it is identical to `all_success`, the implicit prior behavior. Mirrors the RFC 0013 2026-07-03 `condition` amendment's WorkflowEdge→FragmentEdge move. Expansion MUST carry this value onto the resulting `WorkflowEdge` so the scheduler honors it (see `workflow-chain-packs.md` §\"Expansion semantics\")."
         }
       },
       "additionalProperties": false
     },
+    "EdgeCondition": {
+      "type": "object",
+      "description": "Edge condition — identical to workflow-definition.schema.json §EdgeCondition (RFC 0013 §edges: 'same shape as a top-level workflow definition'). Inlined here so the manifest schema is self-contained for pack-loader validators.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": ["expression", "equals", "notEquals", "contains", "regex"]
+        },
+        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved')." },
+        "right": { "description": "Right operand value (any JSON value)." },
+        "expression": { "type": "string", "description": "Used when type='expression'." }
+      },
+      "additionalProperties": false
+    },
     "Signing": {
       "type": "object",
       "description": "Optional signing metadata. Reuses node-packs.md §signing unchanged.",

package/src/lib/workflow-chain-expansion.ts

@@ -54,10 +54,25 @@ export interface FragmentNode {
   inputs?: Record<string, unknown>;
 }
 
+/** A fan-in / error-routing rule mirrored from `WorkflowEdge.triggerRule`
+ *  (workflow-definition.schema.json). RFC 0125. */
+export type TriggerRule =
+  | 'all_success'
+  | 'any_success'
+  | 'all_complete'
+  | 'none_failed'
+  | 'any_failed';
+
 export interface FragmentEdge {
   from: string;
   to: string;
-  condition?: string;
+  /** Edge condition — an `EdgeCondition` object (RFC 0013 amendment #818).
+   *  Carried through expansion opaquely; typed `unknown` since the lib does
+   *  not evaluate it. */
+  condition?: unknown;
+  /** Fan-in / error-routing rule (RFC 0125). Carried through expansion onto
+   *  the resulting WorkflowEdge so the scheduler honors it. */
+  triggerRule?: TriggerRule;
 }
 
 /** Per-expansion context the caller supplies. */
@@ -90,7 +105,7 @@ export interface ExpandedFragment {
     inputs?: Record<string, unknown>;
     capabilities?: ReadonlyArray<string>;
   }>;
-  edges: ReadonlyArray<{ from: string; to: string; condition?: string }>;
+  edges: ReadonlyArray<{ from: string; to: string; condition?: unknown; triggerRule?: TriggerRule }>;
   /** Map of original-fragment-id → rewritten-id, so the caller can
    *  wire the parent workflow's adjacent edges into the expansion. */
   idMap: ReadonlyMap<string, string>;
@@ -110,6 +125,12 @@ export class ChainUnresolvableTypeIdError extends Error {
 }
 
 const PARAM_PATTERN = /\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g;
+/** A value that is EXACTLY a single `{{params.<name>}}` token (whole-value),
+ *  distinct from a token embedded in a larger string. Whole-value tokens are
+ *  the only non-prompt position deferrable to a variable-sourced PortValue
+ *  (WCP2 raw-typed rule); an embedded non-prompt token has no runtime `{{}}`
+ *  construct and MUST resolve at expansion time. */
+const WHOLE_VALUE_PATTERN = /^\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}$/;
 
 /** Recursive literal substitution of `{{params.<name>}}` placeholders in
  *  any string field. Non-string values pass through unchanged; nested
@@ -206,8 +227,272 @@ export function expandChain(chain: WorkflowChain, ctx: ExpansionContext): Expand
       to: rewriteEdgeRef(e.to, fragmentNodeIds, prefix),
     };
     if (e.condition !== undefined) out.condition = e.condition;
+    // RFC 0125: carry the fan-in/error-routing rule onto the expanded
+    // WorkflowEdge so the scheduler honors it (mirrors the `condition`
+    // pass-through; without this the field is silently dropped at expansion).
+    if (e.triggerRule !== undefined) out.triggerRule = e.triggerRule;
     return out;
   });
 
   return { nodes: expandedNodes, edges: expandedEdges, idMap };
 }
+
+// ---------------------------------------------------------------------------
+// RFC 0124 (WCP4) — Portable per-run parameter deferral.
+//
+// The DEFERRED expansion mode: instead of freezing `{{params.*}}` values into
+// persisted `config`/`inputs` at drop time (the RFC 0013 default), the host
+// materializes the chain's `parameters` into top-level workflow `variables[]`
+// (author value → `defaultValue`) and rewrites each token into an already-spec'd
+// RUNTIME binding — so the persisted fragment carries ZERO `{{params.*}}` tokens
+// yet every parameter stays overridable per run via `configurable`. This is the
+// spec-authoritative reference for `spec/v1/workflow-chain-packs.md`
+// §"Deferred-parameter expansion (RFC 0124)".
+// ---------------------------------------------------------------------------
+
+/** The parameter JSON Schema fragment (`chain.parameters`), narrowed to the
+ *  fields deferred expansion reads: each property's `type`, `description`, and
+ *  the RFC 0124 `x-openwop-sensitive` extension key. */
+export interface ParameterSchema {
+  properties?: Record<
+    string,
+    { type?: string; description?: string; 'x-openwop-sensitive'?: boolean }
+  >;
+}
+
+/** Host capability context deferred expansion needs (RFC 0124 §Capability
+ *  gating). The prompt-bearing rewrite path requires `prompts.variableSources`
+ *  to include `variable`; a `source:"secret"` sensitive lift requires
+ *  `capabilities.secrets.supported`. */
+export interface DeferredHostContext {
+  /** `capabilities.prompts.variableSources` includes `"variable"`. */
+  promptVariableSource: boolean;
+  /** `capabilities.secrets.supported`. */
+  secretsSupported: boolean;
+}
+
+export interface DeferredExpansionContext {
+  expansionId: string;
+  /** Author-supplied parameter values (already validated) → `defaultValue` seeds. */
+  params: Record<string, unknown>;
+  /** The chain's `parameters` JSON Schema (type + `x-openwop-sensitive` per property). */
+  parameterSchema: ParameterSchema;
+  isTypeIdResolvable: (typeId: string) => boolean;
+  host: DeferredHostContext;
+}
+
+/** A materialized top-level `WorkflowVariable` (subset — the fields deferred
+ *  expansion sets). A NON-sensitive parameter materializes here with its author
+ *  value as `defaultValue`. A sensitive parameter does NOT (its value never
+ *  lands in the run-scoped bag); it is bound as a `source:"secret"` prompt
+ *  variable instead. */
+export interface MaterializedVariable {
+  name: string;
+  type: string;
+  description?: string;
+  defaultValue?: unknown;
+  sensitive?: boolean;
+}
+
+/** A rewritten prompt-template variable slot (RFC 0027). `source:"variable"`
+ *  resolves from the run bag; `source:"secret"` resolves a BYOK secret at
+ *  compose time, redacted in `prompt.composed` (RFC 0124 §Security). */
+export interface PromptVariableBinding {
+  name: string;
+  source: 'variable' | 'secret';
+}
+
+export interface DeferredExpandedFragment {
+  nodes: ExpandedFragment['nodes'];
+  edges: ExpandedFragment['edges'];
+  idMap: ReadonlyMap<string, string>;
+  /** Materialized top-level `variables[]` (non-sensitive params only). */
+  variables: ReadonlyArray<MaterializedVariable>;
+  /** Prompt-site variable bindings introduced by the rewrite. */
+  promptVariables: ReadonlyArray<PromptVariableBinding>;
+  /** Auto-generated `configurableSchema` mapping the BARE param name (the
+   *  normative override key) to its type, so a per-run `configurable` keyed on
+   *  the bare name resolves (R6 cross-host key stability). */
+  configurableSchema: { properties: Record<string, { type: string }> };
+}
+
+/** Thrown when a `x-openwop-sensitive` parameter cannot be securely deferred:
+ *  it resolves to a non-prompt position (whole-value `node.inputs`, embedded
+ *  non-prompt `config`), or the host lacks `secrets`/deferred support. Wire
+ *  code `sensitive_param_not_deferrable` (HTTP 422) per
+ *  `workflow-chain-packs.md` §"Error codes" (RFC 0124 §Security). */
+export class SensitiveParamNotDeferrableError extends Error {
+  readonly code = 'sensitive_param_not_deferrable';
+  readonly httpStatus = 422;
+  constructor(readonly param: string, readonly reason: string) {
+    super(`sensitive_param_not_deferrable: '${param}' — ${reason}`);
+    this.name = 'SensitiveParamNotDeferrableError';
+  }
+}
+
+/** The prompt-bearing `config` fields a token in which is a "prompt position"
+ *  (lifted to a PromptTemplate `{{varName}}` slot). Everything else in `config`
+ *  is a non-prompt position. */
+const PROMPT_CONFIG_FIELDS: ReadonlySet<string> = new Set(['systemPrompt', 'userPrompt']);
+
+/**
+ * Deferred-mode expansion (RFC 0124). Rewrites every `{{params.<name>}}` token
+ * into a spec'd runtime binding and materializes non-sensitive parameters into
+ * top-level `variables[]`, leaving ZERO `{{params.*}}` tokens in the persisted
+ * fragment. Sensitive parameters (`x-openwop-sensitive`) are handled per
+ * §Security: prompt-body → `source:"secret"`; anywhere else → fail closed.
+ *
+ * @throws SensitiveParamNotDeferrableError when a sensitive parameter is in a
+ *   non-prompt position, or the host lacks `secrets` support.
+ * @throws ChainUnresolvableTypeIdError when any node typeId fails resolution.
+ */
+export function expandChainDeferred(
+  chain: WorkflowChain,
+  ctx: DeferredExpansionContext,
+): DeferredExpandedFragment {
+  for (const node of chain.dag.nodes) {
+    if (!ctx.isTypeIdResolvable(node.typeId)) {
+      throw new ChainUnresolvableTypeIdError(node.typeId, chain.chainId);
+    }
+  }
+
+  const props = ctx.parameterSchema.properties ?? {};
+  const isSensitive = (name: string): boolean => props[name]?.['x-openwop-sensitive'] === true;
+  const typeOf = (name: string): string => props[name]?.type ?? 'string';
+
+  const prefix = computePrefix(chain.chainId, ctx.expansionId);
+  const fragmentNodeIds = new Set(chain.dag.nodes.map((n) => n.id));
+  const idMap = new Map<string, string>();
+  for (const id of fragmentNodeIds) idMap.set(id, `${prefix}${id}`);
+
+  const usedParams = new Set<string>();
+  const promptVariables = new Map<string, PromptVariableBinding>();
+
+  /** Rewrite a prompt-position string: each embedded `{{params.x}}` → a
+   *  PromptTemplate `{{x}}` slot. A sensitive param binds `source:"secret"`
+   *  (requires host secrets support), else `source:"variable"`. If the host
+   *  does not advertise the `variable` prompt source at all, the deferred
+   *  prompt path is unavailable — the caller falls back to expansion-time
+   *  substitution (G5); we surface that by returning `null`. */
+  function rewritePrompt(text: string): string | null {
+    if (!ctx.host.promptVariableSource) return null; // G5 fallback → expansion-time
+    return text.replace(PARAM_PATTERN, (_m, name: string) => {
+      usedParams.add(name);
+      if (isSensitive(name)) {
+        if (!ctx.host.secretsSupported) {
+          throw new SensitiveParamNotDeferrableError(name, 'host lacks capabilities.secrets support');
+        }
+        promptVariables.set(name, { name, source: 'secret' });
+      } else {
+        promptVariables.set(name, { name, source: 'variable' });
+      }
+      return `{{${name}}}`;
+    });
+  }
+
+  /** Rewrite a config object: prompt fields → PromptTemplate slots; a token in
+   *  any NON-prompt config field is embedded-non-prompt → sensitive fails
+   *  closed, non-sensitive resolves at expansion time (author-trusted). */
+  function rewriteConfig(config: Record<string, unknown>): Record<string, unknown> {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(config)) {
+      if (typeof v === 'string' && PROMPT_CONFIG_FIELDS.has(k) && PARAM_PATTERN.test(v)) {
+        PARAM_PATTERN.lastIndex = 0;
+        const rewritten = rewritePrompt(v);
+        out[k] = rewritten === null ? substitute(v, ctx.params) : rewritten;
+        continue;
+      }
+      PARAM_PATTERN.lastIndex = 0;
+      if (typeof v === 'string' && PARAM_PATTERN.test(v)) {
+        // embedded non-prompt token
+        PARAM_PATTERN.lastIndex = 0;
+        let m: RegExpExecArray | null;
+        while ((m = PARAM_PATTERN.exec(v)) !== null) {
+          if (isSensitive(m[1])) {
+            throw new SensitiveParamNotDeferrableError(m[1], `embedded non-prompt config field '${k}'`);
+          }
+        }
+        out[k] = substitute(v, ctx.params); // author-trusted expansion-time resolution
+      } else {
+        out[k] = substitute(v, ctx.params);
+      }
+    }
+    return out;
+  }
+
+  /** Rewrite an inputs object: a WHOLE-VALUE `{{params.x}}` → a variable-sourced
+   *  PortValue (WCP2 raw-typed); a sensitive whole-value fails closed (no
+   *  plaintext-bag path for a secret). Embedded input tokens follow the same
+   *  non-prompt rule as config. */
+  function rewriteInputs(inputs: Record<string, unknown>): Record<string, unknown> {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(inputs)) {
+      const whole = typeof v === 'string' ? WHOLE_VALUE_PATTERN.exec(v) : null;
+      if (whole) {
+        const name = whole[1];
+        if (isSensitive(name)) {
+          throw new SensitiveParamNotDeferrableError(name, `whole-value node input '${k}'`);
+        }
+        usedParams.add(name);
+        out[k] = { source: 'variable', variable: name }; // variable-sourced PortValue
+        continue;
+      }
+      PARAM_PATTERN.lastIndex = 0;
+      if (typeof v === 'string' && PARAM_PATTERN.test(v)) {
+        PARAM_PATTERN.lastIndex = 0;
+        let m: RegExpExecArray | null;
+        while ((m = PARAM_PATTERN.exec(v)) !== null) {
+          if (isSensitive(m[1])) {
+            throw new SensitiveParamNotDeferrableError(m[1], `embedded non-prompt input '${k}'`);
+          }
+        }
+        out[k] = substitute(v, ctx.params);
+      } else {
+        out[k] = substitute(v, ctx.params);
+      }
+    }
+    return out;
+  }
+
+  const expandedNodes = chain.dag.nodes.map((n) => {
+    const out: ExpandedFragment['nodes'][number] = { id: `${prefix}${n.id}`, typeId: n.typeId };
+    if (n.name !== undefined) out.name = n.name;
+    if (n.position !== undefined) out.position = n.position;
+    if (n.config !== undefined) out.config = rewriteConfig(n.config);
+    if (n.inputs !== undefined) out.inputs = rewriteInputs(n.inputs);
+    if (chain.capabilities && chain.capabilities.length > 0) out.capabilities = [...chain.capabilities];
+    return out;
+  });
+
+  const expandedEdges = (chain.dag.edges ?? []).map((e) => {
+    const out: ExpandedFragment['edges'][number] = {
+      from: rewriteEdgeRef(e.from, fragmentNodeIds, prefix),
+      to: rewriteEdgeRef(e.to, fragmentNodeIds, prefix),
+    };
+    if (e.condition !== undefined) out.condition = e.condition;
+    if (e.triggerRule !== undefined) out.triggerRule = e.triggerRule;
+    return out;
+  });
+
+  // Materialize NON-sensitive used params into top-level variables[]; build the
+  // bare-param → type configurableSchema for the override key.
+  const variables: MaterializedVariable[] = [];
+  const configurableSchema: { properties: Record<string, { type: string }> } = { properties: {} };
+  for (const name of usedParams) {
+    configurableSchema.properties[name] = { type: typeOf(name) };
+    if (isSensitive(name)) continue; // sensitive value never lands in the bag
+    const v: MaterializedVariable = { name, type: typeOf(name) };
+    if (props[name]?.description !== undefined) v.description = props[name]!.description;
+    if (name in ctx.params) v.defaultValue = ctx.params[name];
+    variables.push(v);
+  }
+
+  return {
+    nodes: expandedNodes,
+    edges: expandedEdges,
+    idMap,
+    variables,
+    promptVariables: [...promptVariables.values()],
+    configurableSchema,
+  };
+}