@openwop/openwop-conformance 1.51.0 → 1.53.0

package/fixtures/pack-manifests/workflow-chain-sample.pack.json

@@ -0,0 +1,129 @@
+{
+  "name": "vendor.openwop.workflow-chain-sample",
+  "version": "1.0.0",
+  "kind": "workflow-chain",
+  "description": "Reference workflow-chain pack proving the RFC 0013 manifest format works end-to-end across schema validation, registry indexing, and the reference expansion library. Two chains: a 1-node 'summarize text' chain showing literal parameter substitution, and a 2-node 'fetch-and-summarize' chain showing multi-node DAG composition with edge wiring and capability propagation. In-tree only (NOT published to packs.openwop.dev); the canonical proof that the chain-pack contract is implementable with real-world-shaped content.",
+  "author": "openwop project",
+  "license": "Apache-2.0",
+  "homepage": "https://openwop.dev/spec/v1/workflow-chain-packs.md",
+  "repository": "https://github.com/openwop/openwop",
+  "engines": {
+    "openwop": ">=1.1 <2.0.0"
+  },
+  "chains": [
+    {
+      "chainId": "vendor.openwop.workflow-chain-sample.summarize-text",
+      "version": "1.0.0",
+      "label": "Summarize Text",
+      "description": "Drag-tile that expands to a single core.ai.callPrompt with the summarization system prompt + author-supplied length / tone parameters substituted in. Mirrors the 'Generate PRD' positive example from workflow-chain-packs.md §Examples — the canonical 1-node chain shape.",
+      "parameters": {
+        "type": "object",
+        "required": ["sourceText"],
+        "properties": {
+          "sourceText": {
+            "type": "string",
+            "description": "The text to summarize. Surfaced via {{params.sourceText}} placeholder in the system prompt."
+          },
+          "targetLength": {
+            "type": "string",
+            "enum": ["one-sentence", "one-paragraph", "executive-summary"],
+            "default": "one-paragraph",
+            "description": "How long the summary should be."
+          },
+          "tone": {
+            "type": "string",
+            "default": "neutral",
+            "description": "Tone for the summary (e.g., 'casual', 'technical', 'executive')."
+          }
+        }
+      },
+      "dag": {
+        "nodes": [
+          {
+            "id": "summarize-call",
+            "typeId": "core.ai.callPrompt",
+            "name": "Summarize",
+            "position": { "x": 0, "y": 0 },
+            "config": {
+              "systemPrompt": "You are an expert summarizer. Produce a {{params.targetLength}} summary in a {{params.tone}} tone. Avoid lists unless the source uses them. Avoid hedging.\n\nSource text:\n{{params.sourceText}}",
+              "envelopeType": "summary.v1",
+              "provider": "anthropic"
+            },
+            "inputs": {}
+          }
+        ],
+        "edges": []
+      },
+      "outputs": {
+        "summaryText": {
+          "type": "string",
+          "description": "The summarized text from the AI call's envelope payload."
+        }
+      },
+      "capabilities": ["cacheable"]
+    },
+    {
+      "chainId": "vendor.openwop.workflow-chain-sample.fetch-and-summarize",
+      "version": "1.0.0",
+      "label": "Fetch &amp; Summarize URL",
+      "description": "Drag-tile that expands to a two-node DAG: core.openwop.http.get fetches the URL, then core.ai.callPrompt summarizes the response body. Demonstrates multi-node chain composition with edge wiring, parameter substitution across multiple nodes, and capability propagation (side-effectful from the HTTP fetch propagates to both expanded nodes per spec §Capability propagation).",
+      "parameters": {
+        "type": "object",
+        "required": ["url"],
+        "properties": {
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "The URL to fetch. Surfaced via {{params.url}} in the HTTP node config."
+          },
+          "targetLength": {
+            "type": "string",
+            "enum": ["one-sentence", "one-paragraph", "executive-summary"],
+            "default": "one-paragraph"
+          }
+        }
+      },
+      "dag": {
+        "nodes": [
+          {
+            "id": "fetch",
+            "typeId": "core.openwop.http.get",
+            "name": "Fetch URL",
+            "position": { "x": 0, "y": 0 },
+            "config": {
+              "url": "{{params.url}}",
+              "timeoutMs": 30000
+            },
+            "inputs": {}
+          },
+          {
+            "id": "summarize",
+            "typeId": "core.ai.callPrompt",
+            "name": "Summarize",
+            "position": { "x": 280, "y": 0 },
+            "config": {
+              "systemPrompt": "Produce a {{params.targetLength}} summary of the fetched page content. Strip navigation, ads, and boilerplate. Focus on the article body.",
+              "envelopeType": "summary.v1",
+              "provider": "anthropic"
+            },
+            "inputs": {}
+          }
+        ],
+        "edges": [
+          { "from": "fetch.body", "to": "summarize.sourceText" }
+        ]
+      },
+      "outputs": {
+        "summaryText": {
+          "type": "string",
+          "description": "The summarized page content."
+        },
+        "sourceUrl": {
+          "type": "string",
+          "description": "Echo of the input URL for downstream reference."
+        }
+      },
+      "capabilities": ["side-effectful"]
+    }
+  ]
+}

package/fixtures/trigger-events/trigger-event-change.json

@@ -0,0 +1,17 @@
+{
+  "source": "change",
+  "subscriptionId": "sub_13",
+  "deliveryId": "dlv_a7b8",
+  "dedupKey": "contacts:lsn:0/1C4F9D0",
+  "receivedAt": "2026-07-06T12:01:00Z",
+  "verified": true,
+  "contentTrust": "untrusted",
+  "permittedPurposes": ["analytics"],
+  "change": {
+    "op": "update",
+    "table": "contacts",
+    "changelogId": "0/1C4F9D0",
+    "before": { "id": 77, "tier": "free" },
+    "after": { "id": 77, "tier": "pro" }
+  }
+}

package/fixtures/trigger-events/trigger-event-stream.json

@@ -0,0 +1,16 @@
+{
+  "source": "stream",
+  "subscriptionId": "sub_12",
+  "deliveryId": "dlv_e5f6",
+  "dedupKey": "events:3:88412",
+  "receivedAt": "2026-07-06T12:00:00Z",
+  "verified": true,
+  "contentTrust": "untrusted",
+  "stream": {
+    "topic": "events",
+    "partition": 3,
+    "offset": "88412",
+    "key": "user_77",
+    "message": { "type": "page_view", "path": "/pricing" }
+  }
+}

package/fixtures.md

@@ -482,11 +482,12 @@ Each JSON is a valid `WorkflowDefinition` per `../schemas/workflow-definition.sc
 
 ## Pack-manifest fixtures
 
-The `fixtures/pack-manifests/` sub-directory holds canonical pack manifests used as schema-level proof points (validated server-free against `../schemas/node-pack-manifest.schema.json`). They are NOT seeded into a server — they exist to assert the canonical schema accepts each documented pack-name scope.
+The `fixtures/pack-manifests/` sub-directory holds canonical pack manifests used as schema-level proof points (validated server-free against `../schemas/node-pack-manifest.schema.json`, or `../schemas/workflow-chain-pack-manifest.schema.json` for `kind: "workflow-chain"`). Most are NOT seeded into a server — they assert the canonical schema accepts each documented pack-name scope. The `workflow-chain-sample.pack` fixture is the exception: it is the **bundled, host-syncable** `vendor.openwop.workflow-chain-sample` pack that `workflow-chain-host-expansion.test.ts` loads (and that a live host serving the RFC 0013 `/v1/host/sample/workflow-chain:expand` seam vendors) — so the published pack is the single contract source for that live-host witness.
 
-| Fixture                | `name`                               | Purpose                                                                                                        |
-| ---------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
-| `pack-private-example` | `private.example-host.example-tools` | Asserts the v1.0 pack-name pattern accepts the `private.<host>.*` scope reserved for host-internal registries. |
+| Fixture                     | `name`                                 | Purpose                                                                                                                                                                                                                                                                              |
+| --------------------------- | -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pack-private-example`      | `private.example-host.example-tools`   | Asserts the v1.0 pack-name pattern accepts the `private.<host>.*` scope reserved for host-internal registries.                                                                                                                                                                       |
+| `workflow-chain-sample.pack` | `vendor.openwop.workflow-chain-sample` | RFC 0013 `kind: "workflow-chain"` reference pack (2 chains: 1-node `summarize-text` + 2-node `fetch-and-summarize`). **Bundled + host-syncable** (2026-07-05 erratum A-lite): `workflow-chain-host-expansion.test.ts` loads it and derives the expected expansion from the `expandChain()` reference library, so a serving host's `/v1/host/sample/workflow-chain:expand` output is checked against the spec algorithm for the identical published pack — no hardcoded expansion. |
 
 Pack-manifest fixtures are exercised by the server-free `fixtures-valid.test.ts` scenarios — adding one runs the schema validator against it automatically.
 
@@ -512,6 +513,8 @@ The `fixtures/trigger-events/` sub-directory holds canonical external-event inge
 | Fixture                                      | Schema                                        | Purpose                                                                                                                            |
 | -------------------------------------------- | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
 | `trigger-event-email`                        | `trigger-event.schema.json`                   | Canonical positive `source:"email"` TriggerEvent — `verified`, `contentTrust:"untrusted"`, an `AttachmentRef` with a host-internal `ref`. Drives the §F.1 one-of, AttachmentRef, and contentTrust shape assertions. |
+| `trigger-event-stream`                       | `trigger-event.schema.json`                   | Canonical positive `source:"stream"` TriggerEvent (RFC 0127) — broker coordinates (`topic`/`partition`/`offset`/`key`) + `message` body, dedup key composed from the coordinates. Drives the stream-side schema assertions in `trigger-stream-cdc-sources.test.ts`. |
+| `trigger-event-change`                       | `trigger-event.schema.json`                   | Canonical positive `source:"change"` TriggerEvent (RFC 0127) — REQUIRED `op:"update"` + `table`/`changelogId`/`before`/`after` row images, plus a `permittedPurposes` label (RFC 0128). Drives the op-REQUIRED negative + the label shape assertions in `trigger-stream-cdc-sources.test.ts` / `purpose-propagation.test.ts`. |
 | `trigger-subscription-registration-email`    | `trigger-subscription-registration.schema.json` | Canonical positive registration (`source:"email"`, `workflowId`, `verification.mode:"required"`). Drives the registration shape assertions. |
 
 Negative cases (cross-source sub-objects, raw attachment URLs, `Authorization` headers) are inline test data in `trigger-ingestion.test.ts` per suite convention — a deliberately-invalid fixture file would fail the automatic sweep.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.51.0",
+  "version": "1.53.0",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/schemas/capabilities.schema.json

@@ -470,6 +470,22 @@
         }
       }
     },
+    "purposePropagation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0128 (`Active`). Purpose-propagation — the host reads and RE-EMITS `permittedPurposes` labels (opaque purpose strings riding the A2A `metadata.openwop.permittedPurposes` extension and the `TriggerEvent.permittedPurposes` field) on onward OpenWOP-envelope hops of the same data, narrowing at most and never widening; a `[]` label is honored as no-onward-use. This family advertises label PROPAGATION only — it does NOT claim the host enforces purpose limits on its own internal use (that is declared intent under the receiver's local governance, RFC 0128 §4, deliberately not conformance-gated). A host MUST NOT advertise `supported: true` until RFC 0128 reaches `Accepted` and propagation is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block ⇒ labels pass through unread as unknown metadata (pre-RFC behavior).",
+      "required": ["supported"],
+      "properties": {
+        "supported": {
+          "type": "boolean",
+          "description": "RFC 0128. When `true`, the host preserves and re-emits received `permittedPurposes` labels per RFC 0128 §3 (re-emit on OpenWOP-envelope onward hops; MAY narrow; MUST NOT widen; derived outputs never carry a purpose absent from any contributing labelled input; `[]` ⇒ no onward hop)."
+        },
+        "propagatesOnward": {
+          "type": "boolean",
+          "description": "RFC 0128. When `true`, the host's onward OpenWOP-envelope hops (A2A forwards, trigger/sync events to OpenWOP peers) re-emit the label. Distinct from `supported` only for hosts that read labels but have no onward-hop surface at all; a host WITH onward hops advertising `supported: true` MUST also propagate."
+        }
+      }
+    },
     "credentials": {
       "type": "object",
       "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
@@ -1699,13 +1715,13 @@
             "backoff": { "type": "string", "enum": ["none", "fixed", "exponential"], "description": "Backoff strategy between attempts." }
           }
         },
-        "sources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"] }, "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source — the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset." },
+        "sources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"] }, "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source — the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset." },
         "ingestion": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0099 §F.3 (additive). External-event ingestion advertisement — which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent ⇒ the host does NOT externally-ingest (today's behavior — schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run — over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
+          "description": "RFC 0099 §F.3 (additive). External-event ingestion advertisement — which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`/`stream`/`change`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent ⇒ the host does NOT externally-ingest (today's behavior — schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run — over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
           "properties": {
-            "externalSources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "email", "form"] }, "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099. The honesty gate — each MUST normalize to a `TriggerEvent` and start a run." },
+            "externalSources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "email", "form", "stream", "change"] }, "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099 (`stream`/`change` per RFC 0127). The honesty gate — each MUST normalize to a `TriggerEvent` and start a run." },
             "maxBodyBytes": { "type": "integer", "minimum": 1, "description": "Inbound body cap (webhook body / email / form), reusing the RFC 0076 §B response-cap discipline." },
             "verification": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook-signature", "email-dmarc", "form-origin"] }, "description": "Which source-authenticity checks the host performs. An advertised check MUST actually be performed (RFC 0099 §F.3 / UQ1)." },
             "registrationEndpoint": { "type": "boolean", "description": "`true` ⇒ the host serves `POST /v1/trigger-subscriptions` (RFC 0099 §F.2) for portable external-event subscription creation." }

package/schemas/run-event-payloads.schema.json

@@ -1739,7 +1739,7 @@
       "required": ["subscriptionId", "source", "fromState", "toState"],
       "properties": {
         "subscriptionId": { "type": "string", "minLength": 1, "description": "The TriggerSubscription this state change is for." },
-        "source":         { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"], "description": "The subscription source." },
+        "source":         { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"], "description": "The subscription source." },
         "fromState":      { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "Prior state." },
         "toState":        { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "New state." },
         "reason":         { "type": "string", "enum": ["retry-exhausted", "operator-paused", "signature-invalid", "backpressure", "source-removed", "provenance-unevaluable"], "description": "MAY — a machine-stable reason code (a CLOSED enum — a free-form reason is a leak vector that would let a host spill an inbound URL/host/header into it). The load-bearing field is `toState`." }

package/schemas/trigger-event.schema.json

@@ -2,15 +2,15 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v1/trigger-event.schema.json",
   "title": "TriggerEvent",
-  "description": "RFC 0099 §F.1. The normalized external-event envelope a host hands a started run as `ctx.triggerData` when an externally-originated event (`webhook`/`email`/`form`) is delivered to an `active` TriggerSubscription (RFC 0083). This is an IN-RUN payload only — it never appears on the durable event log; the `trigger.delivery.attempted` event stays content-free (RFC 0083 §C / SECURITY `trigger-ingestion-content-redaction`). A TriggerEvent carries exactly the per-source sub-object matching its `source`. All content is `untrusted` (SECURITY `threat-model-prompt-injection.md`).",
+  "description": "RFC 0099 §F.1. The normalized external-event envelope a host hands a started run as `ctx.triggerData` when an externally-originated event (`webhook`/`email`/`form`/`stream`/`change`) is delivered to an `active` TriggerSubscription (RFC 0083). This is an IN-RUN payload only — it never appears on the durable event log; the `trigger.delivery.attempted` event stays content-free (RFC 0083 §C / SECURITY `trigger-ingestion-content-redaction`). A TriggerEvent carries exactly the per-source sub-object matching its `source`. All content is `untrusted` (SECURITY `threat-model-prompt-injection.md`).",
   "type": "object",
   "additionalProperties": false,
   "required": ["source", "subscriptionId", "deliveryId", "receivedAt"],
   "properties": {
     "source": {
       "type": "string",
-      "enum": ["webhook", "email", "form"],
-      "description": "Which external source originated the event. A TriggerEvent MUST carry exactly the per-source sub-object matching this value and MUST NOT carry the others (RFC 0099 §F.1)."
+      "enum": ["webhook", "email", "form", "stream", "change"],
+      "description": "Which external source originated the event. A TriggerEvent MUST carry exactly the per-source sub-object matching this value and MUST NOT carry the others (RFC 0099 §F.1; `stream`/`change` per RFC 0127)."
     },
     "subscriptionId": {
       "type": "string",
@@ -40,23 +40,38 @@
       "enum": ["untrusted"],
       "description": "Always `untrusted`. Inbound external content reaching an LLM node MUST be wrapped per `threat-model-prompt-injection.md` §UNTRUSTED; a TriggerEvent MUST NOT directly advance a HITL approval gate (the `prompt-injection-mcp-no-approval` invariant generalizes)."
     },
+    "permittedPurposes": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "RFC 0128 — OPTIONAL declared uses the receiver is permitted to make of the accompanying data. Opaque purpose strings mapped to the host's local vocabulary; carries purpose categories only, never subject identifiers or consent records. Absent ⇒ unlabelled (no constraint asserted); `[]` ⇒ no onward use permitted (NOT the same as absent). A host advertising `purposePropagation` MUST honor the RFC 0128 §3 propagation rules for this label."
+    },
     "webhook": { "$ref": "#/$defs/WebhookEvent" },
     "email": { "$ref": "#/$defs/EmailEvent" },
-    "form": { "$ref": "#/$defs/FormEvent" }
+    "form": { "$ref": "#/$defs/FormEvent" },
+    "stream": { "$ref": "#/$defs/StreamEvent" },
+    "change": { "$ref": "#/$defs/ChangeEvent" }
   },
   "allOf": [
     {
       "description": "RFC 0099 §F.1 — a TriggerEvent MUST carry exactly the per-source sub-object matching its `source` and MUST NOT carry the others.",
       "if": { "properties": { "source": { "const": "webhook" } } },
-      "then": { "not": { "anyOf": [{ "required": ["email"] }, { "required": ["form"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["email"] }, { "required": ["form"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
     },
     {
       "if": { "properties": { "source": { "const": "email" } } },
-      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["form"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["form"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
     },
     {
       "if": { "properties": { "source": { "const": "form" } } },
-      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }] } }
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["stream"] }, { "required": ["change"] }] } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "stream" } } },
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["form"] }, { "required": ["change"] }] } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "change" } } },
+      "then": { "not": { "anyOf": [{ "required": ["webhook"] }, { "required": ["email"] }, { "required": ["form"] }, { "required": ["stream"] }] } }
     }
   ],
   "$defs": {
@@ -98,6 +113,31 @@
         "files": { "type": "array", "items": { "$ref": "#/$defs/AttachmentRef" } }
       }
     },
+    "StreamEvent": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Present iff `source == \"stream\"` (RFC 0127). One message consumed from a streaming broker (Kafka / Kinesis / Pub-Sub); the host is the consumer and each delivered message normalizes to one TriggerEvent. The broker connection is a credential-brokered egress (RFC 0095), never a wire field.",
+      "properties": {
+        "topic": { "type": "string", "description": "The broker topic/stream/subscription name the message was consumed from." },
+        "partition": { "type": "integer", "minimum": 0, "description": "Broker partition/shard, where the broker has one. With `offset`, feeds the RFC 0127 §4 dedup-key guidance `(topic, partition, offset)`." },
+        "offset": { "type": "string", "description": "Broker offset / sequence number as an opaque string (brokers disagree on integer width)." },
+        "key": { "type": "string", "description": "The message key, where the broker has one." },
+        "message": { "description": "The consumed message payload — parsed JSON, or a string for non-JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." }
+      }
+    },
+    "ChangeEvent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["op"],
+      "description": "Present iff `source == \"change\"` (RFC 0127). One change-data-capture record from a warehouse/database changelog. `op` is REQUIRED. The warehouse connection is a credential-brokered egress (RFC 0095), never a wire field.",
+      "properties": {
+        "op": { "type": "string", "enum": ["insert", "update", "delete"], "description": "The change operation. REQUIRED (RFC 0127 §2 / resolved Q1 — one `change` source with an `op` discriminator, not per-verb sources)." },
+        "table": { "type": "string", "description": "The source table/collection/entity name. With `changelogId`, feeds the RFC 0127 §4 dedup-key guidance `(table, changelog-id)`." },
+        "changelogId": { "type": "string", "description": "The changelog position/LSN/row-version as an opaque string." },
+        "before": { "description": "The pre-image row where the feed provides one (typically `update`/`delete`). Parsed JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." },
+        "after": { "description": "The post-image row where the feed provides one (typically `insert`/`update`). Parsed JSON. Bounded by `triggerBridge.ingestion.maxBodyBytes`." }
+      }
+    },
     "AttachmentRef": {
       "type": "object",
       "additionalProperties": false,
@@ -144,6 +184,39 @@
         "headers": { "X-Event-Type": "issue.created" },
         "body": { "issue": { "id": 42, "title": "Bug" } }
       }
+    },
+    {
+      "source": "stream",
+      "subscriptionId": "sub_12",
+      "deliveryId": "dlv_e5f6",
+      "dedupKey": "events:3:88412",
+      "receivedAt": "2026-07-06T12:00:00Z",
+      "verified": true,
+      "contentTrust": "untrusted",
+      "stream": {
+        "topic": "events",
+        "partition": 3,
+        "offset": "88412",
+        "key": "user_77",
+        "message": { "type": "page_view", "path": "/pricing" }
+      }
+    },
+    {
+      "source": "change",
+      "subscriptionId": "sub_13",
+      "deliveryId": "dlv_a7b8",
+      "dedupKey": "contacts:lsn:0/1C4F9D0",
+      "receivedAt": "2026-07-06T12:01:00Z",
+      "verified": true,
+      "contentTrust": "untrusted",
+      "permittedPurposes": ["analytics"],
+      "change": {
+        "op": "update",
+        "table": "contacts",
+        "changelogId": "0/1C4F9D0",
+        "before": { "id": 77, "tier": "free" },
+        "after": { "id": 77, "tier": "pro" }
+      }
     }
   ]
 }

package/schemas/trigger-subscription-registration.schema.json

@@ -9,7 +9,7 @@
   "properties": {
     "source": {
       "type": "string",
-      "enum": ["webhook", "email", "form"],
+      "enum": ["webhook", "email", "form", "stream", "change"],
       "description": "The external source this subscription ingests. MUST appear in the host's `capabilities.triggerBridge.ingestion.externalSources[]`."
     },
     "workflowId": {

package/schemas/trigger-subscription.schema.json

@@ -8,7 +8,7 @@
   "required": ["subscriptionId", "source", "state"],
   "properties": {
     "subscriptionId": { "type": "string", "minLength": 1, "description": "Stable host-unique id for the subscription. Correlates the §C delivery events + the management surface." },
-    "source": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form"], "description": "Which trigger source backs the subscription. Channels beyond these (Slack/Discord/SMS) bridge as a vendor extension by registering a subscription of the closest source kind (§E)." },
+    "source": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"], "description": "Which trigger source backs the subscription. Channels beyond these (Slack/Discord/SMS) bridge as a vendor extension by registering a subscription of the closest source kind (§E)." },
     "state": { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"], "description": "The §B state. `active`: accepting + delivering; `paused`: retained, not delivering (operator-held); `failed`: delivery failing past policy (the webhooks.md circuit-breaker generalized); `dead-lettered`: terminal, deliveries routed to the RFC 0053 sink." },
     "dedupEnabled": { "type": "boolean", "description": "When true, the host de-duplicates inbound events by `dedupKey` within the retention window (§C-1; the idempotency.md Layer-1 model applied to inbound triggers)." },
     "retryPolicy": {

package/schemas/workflow-definition.schema.json

@@ -111,7 +111,7 @@
       "type": "object",
       "required": ["id", "typeId", "name", "position", "config", "inputs"],
       "properties": {
-        "id": { "type": "string", "minLength": 1 },
+        "id": { "type": "string", "minLength": 1, "description": "Node identifier, unique within the workflow. Intentionally has NO `maxLength` — RFC 0013 chain expansion mints ids of the form `${chainIdSlug}_${expansionId}_${fragmentId}` where `chainIdSlug` is an unbounded reverse-DNS string, so an expanded node id can exceed any short cap. A host MUST NOT reject or truncate a node id by length (no host-imposed `maxLength` stricter than this schema)." },
         "typeId": {
           "type": "string",
           "description": "Canonical node type ID (e.g., 'core.ai.callPrompt', 'core.chat.approvalGate'). Reserved prefixes: 'core.*' for spec-canonical, 'vendor.<org>.*' for third-party.",

package/src/lib/workflow-chain-expansion.ts

@@ -126,17 +126,33 @@ export class ChainUnresolvableTypeIdError extends Error {
 
 const PARAM_PATTERN = /\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g;
 /** A value that is EXACTLY a single `{{params.<name>}}` token (whole-value),
- *  distinct from a token embedded in a larger string. Whole-value tokens are
- *  the only non-prompt position deferrable to a variable-sourced PortValue
- *  (WCP2 raw-typed rule); an embedded non-prompt token has no runtime `{{}}`
- *  construct and MUST resolve at expansion time. */
+ *  distinct from a token embedded in a larger string. Under expansion-time
+ *  substitution a whole-value token resolves to the RAW TYPED parameter value
+ *  rather than a string coercion (WCP2 raw-typed rule); under deferred mode it
+ *  is the only non-prompt position deferrable to a variable-sourced PortValue.
+ *  An embedded non-prompt token has no runtime `{{}}` construct and MUST resolve
+ *  at expansion time. */
 const WHOLE_VALUE_PATTERN = /^\{\{params\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}$/;
 
-/** Recursive literal substitution of `{{params.<name>}}` placeholders in
- *  any string field. Non-string values pass through unchanged; nested
- *  arrays/objects are walked. */
+/** Recursive substitution of `{{params.<name>}}` placeholders in any string
+ *  field. Two cases per `workflow-chain-packs.md` §"Parameter substitution":
+ *    - WHOLE-VALUE: a string that is exactly one `{{params.x}}` token resolves
+ *      to the RAW typed parameter value (object / array / number / boolean
+ *      survive as their JSON type instead of being stringified).
+ *    - EMBEDDED: one or more tokens inside surrounding text do literal string
+ *      substitution.
+ *  Non-string values pass through unchanged; nested arrays/objects are walked. */
 function substitute(value: unknown, params: Record<string, unknown>): unknown {
   if (typeof value === 'string') {
+    const whole = WHOLE_VALUE_PATTERN.exec(value);
+    if (whole) {
+      // Whole-value token — return the raw typed value so a param typed
+      // `object` / `array` / `number` / `boolean` reaches the node config
+      // intact. `undefined` (undeclared param) collapses to the empty string,
+      // matching the embedded-token convention below.
+      const v = params[whole[1] as string];
+      return v === undefined ? '' : v;
+    }
     return value.replace(PARAM_PATTERN, (_match, name: string) => {
       const v = params[name];
       // Per the spec, parameter values are validated against the chain's

package/src/scenarios/fixtures-valid.test.ts

@@ -110,6 +110,12 @@ describe('fixtures: node-pack-manifest schema validity', () => {
   ajv.addSchema(promptKindSchema, './prompt-kind.schema.json');
   const schema = JSON.parse(readFileSync(PACK_MANIFEST_SCHEMA_PATH, 'utf8'));
   const validate = ajv.compile(schema);
+  // A `pack-manifests/` fixture may be a node pack OR a `kind: "workflow-chain"`
+  // pack (RFC 0013) — pick the schema by `kind`, exactly as the registry does.
+  const chainSchema = JSON.parse(
+    readFileSync(join(SCHEMAS_DIR, 'workflow-chain-pack-manifest.schema.json'), 'utf8'),
+  );
+  const validateChain = ajv.compile(chainSchema);
 
   const files = readdirSync(PACK_MANIFEST_FIXTURES_DIR)
     .filter((f) => f.endsWith('.json'))
@@ -120,17 +126,22 @@ describe('fixtures: node-pack-manifest schema validity', () => {
   });
 
   for (const file of files) {
-    it(`pack-manifests/${file} validates against node-pack-manifest.schema.json`, () => {
+    it(`pack-manifests/${file} validates against its kind's manifest schema`, () => {
       const data = JSON.parse(
         readFileSync(join(PACK_MANIFEST_FIXTURES_DIR, file), 'utf8'),
-      );
-      const ok = validate(data);
-      const errors = (validate.errors ?? [])
+      ) as { kind?: string };
+      const isChain = data.kind === 'workflow-chain';
+      const v = isChain ? validateChain : validate;
+      const schemaName = isChain
+        ? 'workflow-chain-pack-manifest.schema.json'
+        : 'node-pack-manifest.schema.json';
+      const ok = v(data);
+      const errors = (v.errors ?? [])
         .map((e: ErrorObject) => `${e.instancePath || '/'}: ${e.message}`)
         .join('\n');
       expect(
         ok,
-        `Fixture pack-manifests/${file} fails node-pack-manifest schema:\n${errors}`,
+        `Fixture pack-manifests/${file} fails ${schemaName}:\n${errors}`,
       ).toBe(true);
     });
   }