@openwop/openwop-conformance 1.53.1 → 1.57.0

package/schemas/agent-manifest.schema.json

@@ -57,9 +57,14 @@
       "items": { "type": "string", "minLength": 1 },
       "description": "RFC 0092. Host-capability keys this agent needs to run fully — the agent-layer analogue of a node-pack's `peerDependencies`. Dotted identifiers from the discovery vocabulary (`capabilities.md` / `host-capabilities.md`), e.g. `host.workspace`, `aiProviders.toolCalling`, `multiAgent.executionModel.verifier`. A host that does NOT advertise a listed key MUST surface this agent as degraded on `GET /v1/agents` via the existing `degraded[]` inventory field (RFC 0072 §C); it MAY still dispatch at the RFC 0070 floor, but a silent satisfied-looking entry is non-conformant. Advisory about NEED only — never widens the agent's authority. Absent ⇒ no declared requirements."
     },
+    "role": {
+      "type": "string",
+      "enum": ["skill", "assistant"],
+      "description": "RFC 0131. The manifest's kind — EXPLICIT, never inferred from other fields (`handoff` presence does NOT imply `skill`; an assistant may carry a typed entry contract for cross-host interop). `skill`: a composable, task-scoped capability invoked via `handoff` (task→return) and composed by an assistant/roster agent — stateless and replay-clean; declaring this value OPTS IN to the Skill profile (the `allOf` conditional below: MUST declare `handoff`, MUST constrain `memoryShape` to scratchpad-only). `assistant`: a top-level conversational agent a client talks to and that composes skills — no profile binds it. OPTIONAL; when ABSENT the manifest is UNCONSTRAINED — no profile binds it and its meaning is exactly today's (byte- and behavior-identical). Advisory about kind only — never widens `toolAllowlist`, `requiresCapabilities`, or any scope. See `node-packs.md` §`agents[]` (the field) and `agent-memory.md` §B (the memoryShape constraint + the §C-vs-§B reject/degrade contrast)."
+    },
     "memoryShape": {
       "type": "object",
-      "description": "Declares which memory backends the agent reads/writes. Hosts that advertise `capabilities.agents.memoryBackends` MAY filter manifests during install based on these flags. The full memory-shape contract lands in RFC 0004 (Phase 3); RFC 0003 only declares the descriptor field and reserves `longTerm: true` as the redaction-harness trigger.",
+      "description": "Declares which memory backends the agent reads/writes. Hosts that advertise `capabilities.agents.memoryBackends` MAY filter manifests during install based on these flags. The full memory-shape contract lands in RFC 0004 (Phase 3); RFC 0003 only declares the descriptor field and reserves `longTerm: true` as the redaction-harness trigger. RFC 0131: a `role: \"skill\"` manifest MUST constrain `conversation`/`longTerm` to `false`/absent (the Skill profile — persistent + multi-turn memory belong to the composing assistant/roster agent, RFC 0039; a stateful worker undermines replay determinism, RFC 0041).",
       "additionalProperties": false,
       "properties": {
         "scratchpad": {
@@ -130,5 +135,22 @@
   "oneOf": [
     { "required": ["systemPrompt"], "not": { "required": ["systemPromptRef"] } },
     { "required": ["systemPromptRef"], "not": { "required": ["systemPrompt"] } }
+  ],
+  "allOf": [
+    {
+      "$comment": "RFC 0131 §B — the Skill profile. Binds ONLY manifests that opt in with `role: \"skill\"` (absent/`assistant` ⇒ unconstrained). A `role:\"skill\"` manifest MUST declare `handoff` and MUST NOT declare `memoryShape.conversation` or `memoryShape.longTerm` as `true` (scratchpad-only). A violation is a malformed manifest (RFC 0003 §C — an author error caught at publish/install validation), NOT an RFC 0072 §C `degraded[]` runtime tier.",
+      "if": { "properties": { "role": { "const": "skill" } }, "required": ["role"] },
+      "then": {
+        "required": ["handoff"],
+        "properties": {
+          "memoryShape": {
+            "properties": {
+              "conversation": { "const": false },
+              "longTerm": { "const": false }
+            }
+          }
+        }
+      }
+    }
   ]
 }

package/schemas/capabilities.schema.json

@@ -486,6 +486,65 @@
         }
       }
     },
+    "dataResidency": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0129 (`Active`). Data-residency — the host advertises the operator region codes it can pin a run to, and honors-or-rejects an OPTIONAL `residency.region` on run-creation (`POST /v1/runs`): accept iff the requested region is in `regions[]`, else reject `residency_unavailable` (never silently accept-and-ignore). This family advertises the ADMISSION decision only (falsifiable over the wire) — it does NOT assert that the run's data physically remains in-region (unobservable; declared operator intent under RFC 0129 §4, not conformance-gated). A host MUST advertise a region in `regions[]` only if it can actually process a run entirely within it. Absent block ⇒ the host makes no residency promise and MAY ignore or reject a `residency` constraint (but MUST NOT claim to honor it).",
+      "required": ["supported", "regions"],
+      "properties": {
+        "supported": {
+          "const": true,
+          "description": "RFC 0129. Present-and-true when the host performs region admission control per §3. The block is omitted entirely when the host offers no residency pinning."
+        },
+        "regions": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true,
+          "description": "RFC 0129. Opaque operator region codes the host can pin a run to (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). No closed registry — codes are the host's own vocabulary (a global region enum would be unfalsifiable). A host MUST advertise a code here only if it can process a run entirely within it; a run-create `residency.region` not in this list MUST be rejected `residency_unavailable`."
+        }
+      }
+    },
+    "anonymousActor": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0132 (`Active`). Anonymous-actor authorization for public agent surfaces — an opaque, origin-bound, ephemeral, non-cross-linkable, non-PII principal (`run-snapshot.owner.principalKind: \"anonymous\"`) whose authority is a DEFAULT-DENY, explicit per-surface tool grant, never the default-on tool baseline (§C.1). Two tiers: `read` (tenant-scoped, no egress, no secret/BYOK reach — §C.2) and `bounded-write-egress` (writes/egress permitted ONLY behind a mandatory HITL/approval gate (RFC 0051) OR a hard rate-limit + per-session cap, over the RFC 0076 §B / RFC 0079 SSRF-guarded audience-bound egress path, never attaching a tenant credential out-of-audience — §C.3). Every anon tool call emits `authorization.decided` (RFC 0049) attributable to the opaque session id, carrying no PII/credential (§D). The block is OMITTED ENTIRELY when unsupported (const-true `supported`, `dataResidency`-style — never `supported: false`). Absent ⇒ the host runs no tool-enabled public surface under RFC 0132 (e.g. a no-tools single-turn public gateway needs no advertisement).",
+      "required": ["supported", "tiers"],
+      "properties": {
+        "supported": {
+          "const": true,
+          "description": "RFC 0132. Present-and-true when the host honors anonymous-actor authorization per §C. The block is omitted entirely when the host runs no tool-enabled public surface (never `supported: false`)."
+        },
+        "tiers": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "enum": ["read", "bounded-write-egress"] },
+          "description": "RFC 0132 §B. The anon capability tiers this host BEHAVIORALLY honors (truthful-advertisement — a tier the host does not enforce per §C is a dishonest claim; `OPENWOP_REQUIRE_BEHAVIOR=true` MUST fail it). `read`: tenant-scoped reads, no egress, no secrets (§C.2). `bounded-write-egress`: writes/egress ONLY behind a §C.3 control."
+        },
+        "writeEgressControls": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "enum": ["hitl", "rate-limit-session-cap"] },
+          "description": "RFC 0132 §B. REQUIRED and non-empty IFF `bounded-write-egress` ∈ `tiers`; MUST be absent otherwise. The mandatory control(s) the host enforces before an anon write/egress: `hitl` = a per-action approval gate (RFC 0051 — the action suspends pending a human decision); `rate-limit-session-cap` = a hard per-IP/per-window rate limit AND a per-session action cap. A `bounded-write-egress` tier with no advertised control is the fail-open shape §B.2 forbids."
+        },
+        "failClosed": {
+          "const": true,
+          "description": "RFC 0132. An anon tool call whose grant is absent, unresolvable, or errors MUST deny (never default-allow). There is no fail-open anonymous mode. Mirrors `capabilities.authorization.failClosed`."
+        }
+      },
+      "allOf": [
+        {
+          "$comment": "RFC 0132 §B.2 — writeEgressControls is REQUIRED and non-empty when bounded-write-egress is advertised, and MUST be absent otherwise (a control-less write/egress tier is the fail-open shape this RFC forbids).",
+          "if": {
+            "properties": { "tiers": { "contains": { "const": "bounded-write-egress" } } },
+            "required": ["tiers"]
+          },
+          "then": { "required": ["writeEgressControls"] },
+          "else": { "not": { "required": ["writeEgressControls"] } }
+        }
+      ]
+    },
     "credentials": {
       "type": "object",
       "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
@@ -1793,14 +1852,14 @@
         },
         "surfaces": {
           "type": "array",
-          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation).",
-          "items": { "type": "string", "enum": ["artifact-viewer", "route", "settings-panel"] },
+          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation). `canvas-preview` (RFC 0130) mounts inside a host-owned canvas editor.",
+          "items": { "type": "string", "enum": ["artifact-viewer", "route", "settings-panel", "canvas-preview"] },
           "uniqueItems": true
         },
         "hostApi": {
           "type": "array",
           "description": "The `ui-plugin/1` host-RPC methods this host honors. A plugin call to a method not in this set (regardless of the plugin's declared `hostApi`) MUST be rejected with `method_not_allowed` (`frontend-plugin-rpc-allowlist`). A host advertising `artifact.write` MUST enforce the `version`-token optimistic concurrency (RFC 0117 §Concurrency).",
-          "items": { "type": "string", "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate"] },
+          "items": { "type": "string", "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate", "host.announce"] },
           "uniqueItems": true
         },
         "maxEntryBytes": { "type": "integer", "minimum": 1, "description": "Per-plugin entry-bundle byte ceiling the host will load." }
@@ -1901,6 +1960,24 @@
         "hostExpansionSeam": {
           "type": "boolean",
           "description": "RFC 0013 erratum (2026-07-05). OPTIONAL. A **conformance-only test seam** advertisement (category: test harness, cf. `observability.testSeams` — NOT a product capability): when `true`, the host serves `POST /v1/host/sample/workflow-chain:expand` returning the `vendor.openwop.workflow-chain-sample` v1.0.0 expansion that `conformance/src/scenarios/workflow-chain-host-expansion.test.ts` asserts against. Absent/`false` ⇒ that live-host expansion scenario soft-skips; the semantic `workflowChainPacks.supported` claim is witnessed by the server-free `workflow-chain-expansion.test.ts` legs. This flag is DISTINCT from `deferredParameters` (RFC 0124), which is witnessed through its own `POST /v1/host/sample/chain/deferred-expand` seam — so a host MAY advertise `supported` / `deferredParameters.supported` without standing up the RFC 0013 sample-pack seam it was never handed a published fixture for. Advertising `supported:true` no longer conscripts a host into the RFC 0013 host-expansion scenario."
+        },
+        "subChains": {
+          "type": "object",
+          "description": "RFC 0133 (workflow-chain composition, `Accepted`). OPTIONAL. When `supported: true`, the host's `POST …/workflows/from-chain` implements RUNTIME sub-chain composition per `workflow-chain-packs.md` §\"Sub-chain composition (RFC 0133)\": for each `config.subChainRef` reachable from a parent chain, it resolves the referenced chain (sibling or external), recursively expands + co-registers it as its own owned workflow (deterministic TENANT-SCOPED id from `(tenantId, childChainId, version)` — two tenants never collide on the global registry, a shared child registers once across parents in a tenant, a repeat instantiation converges), rewrites the referencing node's `subChainRef` → the minted child `config.workflowId`, and dispatches the child as a child run (`core.subWorkflow` / `core.dispatch` child-run); the `from-chain` response carries `{ workflowId, subChainWorkflowIds[], nodeCount }`. Bounded by a cycle check (`sub_chain_cycle`) + a depth cap (`sub_chain_max_depth_exceeded`). A host that does NOT advertise this block MUST refuse a `subChains`-bearing chain at author/instantiate time with `sub_chain_unsupported` (422) — it never silently flattens. `producedVariables` (RFC 0133 §2) needs NO flag: it is pure variable emission under the base `workflowChainPacks.supported`. Conformance scenarios `chain-subchain-fanout.test.ts` + `chain-subchain-unsupported-refused.test.ts` gate on this flag; the server-free `chain-subchain-sibling` / `chain-subchain-cycle-rejected` / `chain-produced-var-roundtrip` legs run unconditionally against the reference library.",
+          "properties": {
+            "supported": {
+              "type": "boolean",
+              "description": "Whether the host implements runtime sub-chain co-registration + child dispatch. `false` (or omission of this block) signals the host does NOT compose sub-chains and MUST refuse a `subChains`-bearing chain with `sub_chain_unsupported`."
+            },
+            "maxDepth": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 8,
+              "description": "RFC 0133 §1.3 (resolves UQ3). RECOMMENDED default 8. The maximum sub-chain nesting depth the host co-expands; exceeding it fails closed with the DISTINCT code `sub_chain_max_depth_exceeded` (the DoS depth backstop, alongside the `sub_chain_cycle` self-composition check — SECURITY `sub-chain-expansion-bounded`)."
+            }
+          },
+          "required": ["supported"],
+          "additionalProperties": false
         }
       },
       "required": ["supported"],

package/schemas/connection-pack-manifest.schema.json

@@ -65,6 +65,11 @@
           "type": "string",
           "enum": ["communication", "docs", "crm", "dev", "storage", "email-calendar", "ticketing", "data-warehouse", "marketing", "finance", "hr", "esignature", "support", "project-management", "payments", "other"]
         },
+        "vendor": {
+          "type": "string",
+          "minLength": 1,
+          "description": "RFC 0123. OPTIONAL. The commercial vendor / ecosystem this connector belongs to (e.g. \"Microsoft 365\", \"Google\", \"Workday\"). Presentational grouping ONLY — it is NOT the resolution key (RFC 0047 `provider` still resolves auth). Free-form (not an enum) so a new vendor needs no schema change; a host/registry groups connectors sharing a `vendor` under one heading and MUST fall back to the provider `displayName` when it is absent."
+        },
         "auth": {
           "type": "object",
           "required": ["kind"],

package/schemas/frontend-plugin-manifest.schema.json

@@ -64,8 +64,8 @@
         },
         "surface": {
           "type": "string",
-          "description": "Which host surface this plugin renders into. `artifact-viewer` renders a typed artifact (RFC 0071) in a sandbox; `route` mounts a standalone admin/tool page; `settings-panel` contributes a configuration panel. A host degrades a `surface` it does not advertise to nothing (§Degradation).",
-          "enum": ["artifact-viewer", "route", "settings-panel"]
+          "description": "Which host surface this plugin renders into. `artifact-viewer` renders a typed artifact (RFC 0071) in a sandbox; `route` mounts a standalone admin/tool page; `settings-panel` contributes a configuration panel; `canvas-preview` renders the live document preview inside a host-owned canvas editor (RFC 0130). A host degrades a `surface` it does not advertise to nothing (§Degradation).",
+          "enum": ["artifact-viewer", "route", "settings-panel", "canvas-preview"]
         },
         "entry": {
           "type": "string",
@@ -77,10 +77,16 @@
           "description": "The closed allowlist of `ui-plugin/1` host-RPC methods this plugin is permitted to call. The host MUST reject (with an `error` response, never silent execution) any method not in BOTH this declared list AND the host's `capabilities.uiPlugins.hostApi` set (`frontend-plugin-rpc-allowlist`). The plugin holds no credentials; every method is host-mediated and authz-checked.",
           "items": {
             "type": "string",
-            "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate"]
+            "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate", "host.announce"]
           },
           "uniqueItems": true
         },
+        "canvasTypes": {
+          "type": "array",
+          "description": "OPTIONAL; meaningful only for `surface: \"canvas-preview\"` (RFC 0130): the host canvas type id(s) this preview renders. A host mounts the plugin only for matching canvas documents and MUST ignore entries it does not recognize; absent/empty means never auto-mounted.",
+          "items": { "type": "string", "maxLength": 128 },
+          "uniqueItems": true
+        },
         "connectSrc": {
           "type": "array",
           "description": "OPTIONAL explicit `connect-src` CSP exceptions the plugin needs (e.g., a font CDN). Absent → the host serves the plugin under a DENY-EGRESS CSP (`frontend-plugin-egress`): no network egress beyond the host-RPC channel. Any entry here is part of the front-end-review checkpoint (`registry-operations.md`) a reviewer audits; a host MAY refuse a pack whose exceptions it will not grant.",

package/schemas/residency.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/residency.schema.json",
+  "title": "Residency",
+  "description": "RFC 0129 — an OPTIONAL data-residency constraint on a run-creation request (`POST /v1/runs`). A host advertising `capabilities.dataResidency` MUST honor-or-reject: accept iff `region` is in the advertised `dataResidency.regions[]`, else reject `residency_unavailable` (HTTP one-of 400/404/422) and create no run — it MUST NOT silently accept-and-ignore. Absent ⇒ no constraint (host default region). Physical byte-confinement of the accepted run is a declared operator SHOULD (RFC 0129 §4), not a wire guarantee.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["region"],
+  "properties": {
+    "region": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Requested processing region — an opaque operator code from the host's own vocabulary (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). Honored only if present in the host's advertised `capabilities.dataResidency.regions[]`; otherwise the run is rejected `residency_unavailable`."
+    }
+  }
+}

package/schemas/run-snapshot.schema.json

@@ -40,7 +40,12 @@
       "properties": {
         "tenant": { "type": "string", "minLength": 1, "description": "Top-level isolation boundary." },
         "workspace": { "type": "string", "minLength": 1, "description": "Optional sub-tenant within the tenant (RFC 0048 workspace)." },
-        "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." }
+        "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." },
+        "principalKind": {
+          "type": "string",
+          "enum": ["user", "agent", "anonymous"],
+          "description": "RFC 0132. The kind of the acting principal. OPTIONAL and EXPLICIT — absent ⇒ unconstrained (today's RFC 0048 behavior; a host that does not distinguish kinds omits it). `anonymous` ⇒ the RFC 0132 §A anonymous-actor rules and the §C default-deny per-surface grant bind: the `principal` id MUST be opaque, origin-bound, ephemeral, non-cross-linkable, non-PII, and never inherit a role or a default-on tool baseline. A host that advertises `capabilities.anonymousActor` and dispatches through a public surface MUST set `anonymous` on the resulting run. Resolves RFC 0048 §Unresolved-Q1 for the anonymous case."
+        }
       },
       "additionalProperties": false
     },

package/schemas/workflow-chain-pack-manifest.schema.json

@@ -106,6 +106,76 @@
           },
           "uniqueItems": true,
           "description": "Capability traits to propagate to every expanded node. Hosts MUST copy this array into each expanded `WorkflowNode.capabilities` so existing capability gates apply uniformly."
+        },
+        "subChains": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/SubChainRef" },
+          "description": "RFC 0133 §1.1. OPTIONAL. Child chains this chain composes at RUN TIME. Each entry names a chain (a sibling `chainId` in this pack, or an externally published chain) that a node references via `config.subChainRef`. Unlike RFC 0013's author-time inline splice, a referenced sub-chain is co-instantiated as its own registered workflow and dispatched by the parent as a child run (both parent and child stay owned + builder-editable). A host without runtime child dispatch MUST refuse instantiation with `sub_chain_unsupported` (422) rather than flatten. Requires `capabilities.workflowChainPacks.subChains.supported: true`. See `workflow-chain-packs.md` §\"Sub-chain composition (RFC 0133)\"."
+        },
+        "producedVariables": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/ProducedVariable" },
+          "description": "RFC 0133 §2.2. OPTIONAL. Run-scoped values a node writes to the executor's variable bag during the run and downstream nodes read by name via a `{ type:\"variable\", variableName }` input binding — where the value is NOT an author-time `parameter` and rides no typed output port. Prefer edges (a typed `sourceOutput`→`targetInput` hand-off) wherever a node exposes a value on a port; `producedVariables` is only for values written to the run bag with no typed port. On expansion the host emits these into `WorkflowDefinition.variables[]` as run-scoped entries (name + type, no value). Any `{ type:\"variable\" }` read of an UNDECLARED name (not here and not a materialized parameter) is a `variable_undeclared` manifest error. See `workflow-chain-packs.md` §\"Produced (run-scoped) variables (RFC 0133)\"."
+        }
+      },
+      "additionalProperties": false
+    },
+    "SubChainRef": {
+      "type": "object",
+      "required": ["ref"],
+      "description": "RFC 0133 §1.1. A reference to a child chain the parent composes. `ref` is EITHER a string naming a SIBLING `chainId` in this pack's `chains[]`, OR an object naming an externally published chain (resolved + signature-verified like any pack dependency). A sibling `ref` that matches no `chainId`, or an external `ref` that fails resolution/verification, is `sub_chain_unresolved`. A chain that transitively composes itself is `sub_chain_cycle`.",
+      "properties": {
+        "ref": {
+          "oneOf": [
+            {
+              "type": "string",
+              "description": "A sibling `chainId` in the same pack's `chains[]`.",
+              "pattern": "^[a-z][a-zA-Z0-9._-]*$",
+              "minLength": 1,
+              "maxLength": 256
+            },
+            {
+              "type": "object",
+              "required": ["packName", "chainId", "version"],
+              "description": "An externally published chain, resolved + signature-verified like any pack dependency.",
+              "properties": {
+                "packName": { "type": "string", "minLength": 1, "maxLength": 256 },
+                "chainId": { "type": "string", "pattern": "^[a-z][a-zA-Z0-9._-]*$", "minLength": 1, "maxLength": 256 },
+                "version": {
+                  "type": "string",
+                  "description": "Semver range for the external chain. Co-registration SHOULD pin the resolved version into the parent's ownership record for reproducibility (RFC 0133 §Unresolved #1, resolved: pin)."
+                }
+              },
+              "additionalProperties": false
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "ProducedVariable": {
+      "type": "object",
+      "required": ["name", "producedBy", "type"],
+      "description": "RFC 0133 §2.2. A run-scoped variable a chain declares: written by one node and read by others via a `{ type:\"variable\", variableName }` input binding. Run-scoped — carries NO author-time value (that is what `parameters` are for); the manifest distinguishes the two.",
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The variable-bag key downstream nodes read via `{ type:\"variable\", variableName:\"<name>\" }`."
+        },
+        "producedBy": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The `nodes[].id` (within this same fragment) that writes the value."
+        },
+        "type": {
+          "type": "string",
+          "enum": ["string", "number", "boolean", "object", "array"],
+          "description": "JSON-Schema type token for validation/inspection."
+        },
+        "description": {
+          "type": "string",
+          "description": "One-line description of the produced value's meaning."
         }
       },
       "additionalProperties": false
@@ -171,9 +241,17 @@
         },
         "config": {
           "type": "object",
-          "description": "Node config — host-validated against the referenced typeId's config schema. String fields MAY contain `{{params.<name>}}` placeholders that the host MUST substitute at expansion time.",
+          "description": "Node config — host-validated against the referenced typeId's config schema. String fields MAY contain `{{params.<name>}}` placeholders that the host MUST substitute at expansion time. RFC 0133: a `core.subWorkflow` / `core.dispatch` (child-run) node MAY carry `subChainRef: string` — a declared `subChains[].ref` (sibling `chainId` or external ref) the host rewrites to the minted child `workflowId` at co-expansion time (§1.3 step 3). A concrete `config.workflowId` inside a fragment remains INVALID — a chain MUST NOT pin a host-specific workflow id (the `not` guard below enforces it).",
           "additionalProperties": true,
-          "$comment": "Open by design — node config shapes are per-typeId and only known to the host at expansion time when the referenced typeId's config schema is resolved. Cross-typeId enforcement happens at the expansion step, not at manifest-validation time."
+          "not": { "required": ["workflowId"] },
+          "properties": {
+            "subChainRef": {
+              "type": "string",
+              "pattern": "^[a-z][a-zA-Z0-9._-]*$",
+              "description": "RFC 0133 §1.2. A declared `subChains[].ref` this node dispatches as a child run. The host rewrites it to the minted child `config.workflowId` at co-expansion time. MUST match a `subChains[].ref` (sibling `chainId` or external ref's `chainId`), else `sub_chain_unresolved`."
+            }
+          },
+          "$comment": "Open by design — node config shapes are per-typeId and only known to the host at expansion time when the referenced typeId's config schema is resolved. Cross-typeId enforcement happens at the expansion step, not at manifest-validation time. The `not: { required: ['workflowId'] }` guard is the ONE closed constraint: RFC 0133 forbids pinning a concrete host-specific workflow id inside a portable chain fragment (use `subChainRef` instead)."
         },
         "inputs": {
           "type": "object",
@@ -211,14 +289,15 @@
     },
     "EdgeCondition": {
       "type": "object",
-      "description": "Edge condition — identical to workflow-definition.schema.json §EdgeCondition (RFC 0013 §edges: 'same shape as a top-level workflow definition'). Inlined here so the manifest schema is self-contained for pack-loader validators.",
+      "description": "Edge condition — identical to workflow-definition.schema.json §EdgeCondition (RFC 0013 §edges: 'same shape as a top-level workflow definition'). Inlined here so the manifest schema is self-contained for pack-loader validators. RFC 0134 added `truthy`/`falsy` (kept in sync with the top-level def).",
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["expression", "equals", "notEquals", "contains", "regex"]
+          "enum": ["expression", "equals", "notEquals", "contains", "regex", "truthy", "falsy"],
+          "description": "RFC 0134: `truthy`/`falsy` test the resolved value at `left` for truthiness and take NO `right` operand; `left` is required for all operators except `expression`."
         },
-        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved')." },
-        "right": { "description": "Right operand value (any JSON value)." },
+        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved'). Required for every operator except `expression`." },
+        "right": { "description": "Right operand value (any JSON value). Meaningless for `truthy`/`falsy` (RFC 0134)." },
         "expression": { "type": "string", "description": "Used when type='expression'." }
       },
       "additionalProperties": false

package/schemas/workflow-definition.schema.json

@@ -197,10 +197,11 @@
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["expression", "equals", "notEquals", "contains", "regex"]
+          "enum": ["expression", "equals", "notEquals", "contains", "regex", "truthy", "falsy"],
+          "description": "Operator. `equals`/`notEquals`/`contains` compare `left` to `right`; `regex` matches `left` against `right`; `expression` evaluates `expression`. RFC 0134: `truthy`/`falsy` test the resolved value at `left` for JS-style truthiness and take NO `right` operand (the edge contributes iff `left` is truthy — resp. falsy/absent). `left` is required for all operators except `expression`."
         },
-        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved')." },
-        "right": { "description": "Right operand value (any JSON value)." },
+        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved'). Required for every operator except `expression`." },
+        "right": { "description": "Right operand value (any JSON value). Meaningless for `truthy`/`falsy` (RFC 0134) — a host MUST ignore it there, not error." },
         "expression": { "type": "string", "description": "Used when type='expression'." }
       },
       "additionalProperties": false

package/src/lib/anonymousActor.ts

@@ -0,0 +1,99 @@
+/**
+ * Shared helpers for the RFC 0132 anonymous-actor conformance scenarios.
+ *
+ * Reads the `capabilities.anonymousActor` discovery family at the document
+ * ROOT (RFC 0073) and drives the reference-host public-surface seam the
+ * behavioral scenarios probe. Lives in lib/ (not a *.test.ts) so the
+ * scenarios import it via `../lib/anonymousActor.js`.
+ *
+ * The seam is a HOST-EXTENSION sample surface (`/v1/host/sample/anon-surface/…`)
+ * — NOT a normative protocol endpoint. RFC 0132 pins the wire-observable
+ * contract (the capability advert, `owner.principalKind`, the default-deny
+ * grant, the audit reuse of `authorization.decided`); the surface→tool
+ * binding + the seam route are host-owned config. The behavioral scenarios
+ * soft-skip when the seam is unwired (404), so a host that has not yet landed
+ * tool-enabled public dispatch stays green.
+ *
+ * @see spec/v1/capabilities.md §"anonymousActor"
+ * @see RFCS/0132-anonymous-actor-authorization.md
+ */
+import { driver } from './driver.js';
+import { readCapabilityFamily } from './discovery-capabilities.js';
+
+export interface AnonymousActorCap {
+  supported?: boolean;
+  tiers?: string[];
+  writeEgressControls?: string[];
+  failClosed?: boolean;
+}
+
+/** The reference-host sample public-surface seam (host-extension, not normative). */
+export const ANON_SEAM = '/v1/host/sample/anon-surface';
+/** A sample public surface id the seam resolves to a tenant + explicit grant. */
+export const ANON_SURFACE = 'sample-public-widget';
+
+/** Reads `capabilities.anonymousActor` from discovery root; null when unadvertised. */
+export async function readAnonymousActorCap(): Promise<AnonymousActorCap | null> {
+  const fam = await readCapabilityFamily<AnonymousActorCap>('anonymousActor');
+  return fam && typeof fam === 'object' ? fam : null;
+}
+
+/** True when the host advertises the anonymous-actor family. */
+export async function isAnonymousActorAdvertised(): Promise<boolean> {
+  const cap = await readAnonymousActorCap();
+  return cap?.supported === true;
+}
+
+/** The body the reference seam returns for a single anon tool dispatch. */
+export interface AnonDispatchBody {
+  authorizationDecided?: {
+    event?: string;
+    payload?: {
+      principal?: string;
+      action?: string;
+      resource?: string;
+      allowed?: boolean;
+      reason?: string;
+    };
+  };
+  owner?: { tenant?: string; principal?: string; principalKind?: string };
+  egressDecided?: { decision?: string; reason?: string; credentialAttached?: boolean };
+  interrupt?: { kind?: string };
+  result?: unknown;
+  raw?: string;
+}
+
+export interface AnonDispatchResult {
+  status: number;
+  json: AnonDispatchBody | undefined;
+}
+
+/**
+ * Drive one anonymous-actor tool dispatch against the reference seam.
+ * `surface` binds the tenant + explicit grant; `tool` is the tool the anon
+ * session attempts. Returns the raw status so callers can soft-skip on 404
+ * (seam unwired).
+ */
+export async function anonDispatch(body: {
+  surface?: string;
+  tool: string;
+  args?: Record<string, unknown>;
+  destination?: string;
+}): Promise<AnonDispatchResult> {
+  const res = await driver.post(`${ANON_SEAM}/dispatch`, {
+    surface: body.surface ?? ANON_SURFACE,
+    tool: body.tool,
+    ...(body.args ? { args: body.args } : {}),
+    ...(body.destination ? { destination: body.destination } : {}),
+  });
+  return { status: res.status, json: res.json as AnonDispatchBody | undefined };
+}
+
+/** Read the RFC 0078 tool catalog scoped to an anon session on `surface`. */
+export async function anonToolCatalog(
+  surface: string = ANON_SURFACE,
+): Promise<{ status: number; tools: Array<{ name?: string }> }> {
+  const res = await driver.get(`${ANON_SEAM}/tools?surface=${encodeURIComponent(surface)}`);
+  const body = res.json as { tools?: Array<{ name?: string }> } | undefined;
+  return { status: res.status, tools: Array.isArray(body?.tools) ? body!.tools! : [] };
+}