@openwop/openwop-conformance 1.54.0 → 1.58.0

package/schemas/capabilities.schema.json

@@ -504,6 +504,47 @@
         }
       }
     },
+    "anonymousActor": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0132 (`Active`). Anonymous-actor authorization for public agent surfaces — an opaque, origin-bound, ephemeral, non-cross-linkable, non-PII principal (`run-snapshot.owner.principalKind: \"anonymous\"`) whose authority is a DEFAULT-DENY, explicit per-surface tool grant, never the default-on tool baseline (§C.1). Two tiers: `read` (tenant-scoped, no egress, no secret/BYOK reach — §C.2) and `bounded-write-egress` (writes/egress permitted ONLY behind a mandatory HITL/approval gate (RFC 0051) OR a hard rate-limit + per-session cap, over the RFC 0076 §B / RFC 0079 SSRF-guarded audience-bound egress path, never attaching a tenant credential out-of-audience — §C.3). Every anon tool call emits `authorization.decided` (RFC 0049) attributable to the opaque session id, carrying no PII/credential (§D). The block is OMITTED ENTIRELY when unsupported (const-true `supported`, `dataResidency`-style — never `supported: false`). Absent ⇒ the host runs no tool-enabled public surface under RFC 0132 (e.g. a no-tools single-turn public gateway needs no advertisement).",
+      "required": ["supported", "tiers"],
+      "properties": {
+        "supported": {
+          "const": true,
+          "description": "RFC 0132. Present-and-true when the host honors anonymous-actor authorization per §C. The block is omitted entirely when the host runs no tool-enabled public surface (never `supported: false`)."
+        },
+        "tiers": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "enum": ["read", "bounded-write-egress"] },
+          "description": "RFC 0132 §B. The anon capability tiers this host BEHAVIORALLY honors (truthful-advertisement — a tier the host does not enforce per §C is a dishonest claim; `OPENWOP_REQUIRE_BEHAVIOR=true` MUST fail it). `read`: tenant-scoped reads, no egress, no secrets (§C.2). `bounded-write-egress`: writes/egress ONLY behind a §C.3 control."
+        },
+        "writeEgressControls": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "enum": ["hitl", "rate-limit-session-cap"] },
+          "description": "RFC 0132 §B. REQUIRED and non-empty IFF `bounded-write-egress` ∈ `tiers`; MUST be absent otherwise. The mandatory control(s) the host enforces before an anon write/egress: `hitl` = a per-action approval gate (RFC 0051 — the action suspends pending a human decision); `rate-limit-session-cap` = a hard per-IP/per-window rate limit AND a per-session action cap. A `bounded-write-egress` tier with no advertised control is the fail-open shape §B.2 forbids."
+        },
+        "failClosed": {
+          "const": true,
+          "description": "RFC 0132. An anon tool call whose grant is absent, unresolvable, or errors MUST deny (never default-allow). There is no fail-open anonymous mode. Mirrors `capabilities.authorization.failClosed`."
+        }
+      },
+      "allOf": [
+        {
+          "$comment": "RFC 0132 §B.2 — writeEgressControls is REQUIRED and non-empty when bounded-write-egress is advertised, and MUST be absent otherwise (a control-less write/egress tier is the fail-open shape this RFC forbids).",
+          "if": {
+            "properties": { "tiers": { "contains": { "const": "bounded-write-egress" } } },
+            "required": ["tiers"]
+          },
+          "then": { "required": ["writeEgressControls"] },
+          "else": { "not": { "required": ["writeEgressControls"] } }
+        }
+      ]
+    },
     "credentials": {
       "type": "object",
       "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
@@ -1811,14 +1852,14 @@
         },
         "surfaces": {
           "type": "array",
-          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation).",
-          "items": { "type": "string", "enum": ["artifact-viewer", "route", "settings-panel"] },
+          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation). `canvas-preview` (RFC 0130) mounts inside a host-owned canvas editor.",
+          "items": { "type": "string", "enum": ["artifact-viewer", "route", "settings-panel", "canvas-preview"] },
           "uniqueItems": true
         },
         "hostApi": {
           "type": "array",
           "description": "The `ui-plugin/1` host-RPC methods this host honors. A plugin call to a method not in this set (regardless of the plugin's declared `hostApi`) MUST be rejected with `method_not_allowed` (`frontend-plugin-rpc-allowlist`). A host advertising `artifact.write` MUST enforce the `version`-token optimistic concurrency (RFC 0117 §Concurrency).",
-          "items": { "type": "string", "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate"] },
+          "items": { "type": "string", "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate", "host.announce"] },
           "uniqueItems": true
         },
         "maxEntryBytes": { "type": "integer", "minimum": 1, "description": "Per-plugin entry-bundle byte ceiling the host will load." }
@@ -1919,6 +1960,24 @@
         "hostExpansionSeam": {
           "type": "boolean",
           "description": "RFC 0013 erratum (2026-07-05). OPTIONAL. A **conformance-only test seam** advertisement (category: test harness, cf. `observability.testSeams` — NOT a product capability): when `true`, the host serves `POST /v1/host/sample/workflow-chain:expand` returning the `vendor.openwop.workflow-chain-sample` v1.0.0 expansion that `conformance/src/scenarios/workflow-chain-host-expansion.test.ts` asserts against. Absent/`false` ⇒ that live-host expansion scenario soft-skips; the semantic `workflowChainPacks.supported` claim is witnessed by the server-free `workflow-chain-expansion.test.ts` legs. This flag is DISTINCT from `deferredParameters` (RFC 0124), which is witnessed through its own `POST /v1/host/sample/chain/deferred-expand` seam — so a host MAY advertise `supported` / `deferredParameters.supported` without standing up the RFC 0013 sample-pack seam it was never handed a published fixture for. Advertising `supported:true` no longer conscripts a host into the RFC 0013 host-expansion scenario."
+        },
+        "subChains": {
+          "type": "object",
+          "description": "RFC 0133 (workflow-chain composition, `Accepted`). OPTIONAL. When `supported: true`, the host's `POST …/workflows/from-chain` implements RUNTIME sub-chain composition per `workflow-chain-packs.md` §\"Sub-chain composition (RFC 0133)\": for each `config.subChainRef` reachable from a parent chain, it resolves the referenced chain (sibling or external), recursively expands + co-registers it as its own owned workflow (deterministic TENANT-SCOPED id from `(tenantId, childChainId, version)` — two tenants never collide on the global registry, a shared child registers once across parents in a tenant, a repeat instantiation converges), rewrites the referencing node's `subChainRef` → the minted child `config.workflowId`, and dispatches the child as a child run (`core.subWorkflow` / `core.dispatch` child-run); the `from-chain` response carries `{ workflowId, subChainWorkflowIds[], nodeCount }`. Bounded by a cycle check (`sub_chain_cycle`) + a depth cap (`sub_chain_max_depth_exceeded`). A host that does NOT advertise this block MUST refuse a `subChains`-bearing chain at author/instantiate time with `sub_chain_unsupported` (422) — it never silently flattens. `producedVariables` (RFC 0133 §2) needs NO flag: it is pure variable emission under the base `workflowChainPacks.supported`. Conformance scenarios `chain-subchain-fanout.test.ts` + `chain-subchain-unsupported-refused.test.ts` gate on this flag; the server-free `chain-subchain-sibling` / `chain-subchain-cycle-rejected` / `chain-produced-var-roundtrip` legs run unconditionally against the reference library.",
+          "properties": {
+            "supported": {
+              "type": "boolean",
+              "description": "Whether the host implements runtime sub-chain co-registration + child dispatch. `false` (or omission of this block) signals the host does NOT compose sub-chains and MUST refuse a `subChains`-bearing chain with `sub_chain_unsupported`."
+            },
+            "maxDepth": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 8,
+              "description": "RFC 0133 §1.3 (resolves UQ3). RECOMMENDED default 8. The maximum sub-chain nesting depth the host co-expands; exceeding it fails closed with the DISTINCT code `sub_chain_max_depth_exceeded` (the DoS depth backstop, alongside the `sub_chain_cycle` self-composition check — SECURITY `sub-chain-expansion-bounded`)."
+            }
+          },
+          "required": ["supported"],
+          "additionalProperties": false
         }
       },
       "required": ["supported"],

package/schemas/connection-pack-manifest.schema.json

@@ -65,6 +65,11 @@
           "type": "string",
           "enum": ["communication", "docs", "crm", "dev", "storage", "email-calendar", "ticketing", "data-warehouse", "marketing", "finance", "hr", "esignature", "support", "project-management", "payments", "other"]
         },
+        "vendor": {
+          "type": "string",
+          "minLength": 1,
+          "description": "RFC 0123. OPTIONAL. The commercial vendor / ecosystem this connector belongs to (e.g. \"Microsoft 365\", \"Google\", \"Workday\"). Presentational grouping ONLY — it is NOT the resolution key (RFC 0047 `provider` still resolves auth). Free-form (not an enum) so a new vendor needs no schema change; a host/registry groups connectors sharing a `vendor` under one heading and MUST fall back to the provider `displayName` when it is absent."
+        },
         "auth": {
           "type": "object",
           "required": ["kind"],

package/schemas/frontend-plugin-manifest.schema.json

@@ -64,8 +64,8 @@
         },
         "surface": {
           "type": "string",
-          "description": "Which host surface this plugin renders into. `artifact-viewer` renders a typed artifact (RFC 0071) in a sandbox; `route` mounts a standalone admin/tool page; `settings-panel` contributes a configuration panel. A host degrades a `surface` it does not advertise to nothing (§Degradation).",
-          "enum": ["artifact-viewer", "route", "settings-panel"]
+          "description": "Which host surface this plugin renders into. `artifact-viewer` renders a typed artifact (RFC 0071) in a sandbox; `route` mounts a standalone admin/tool page; `settings-panel` contributes a configuration panel; `canvas-preview` renders the live document preview inside a host-owned canvas editor (RFC 0130). A host degrades a `surface` it does not advertise to nothing (§Degradation).",
+          "enum": ["artifact-viewer", "route", "settings-panel", "canvas-preview"]
         },
         "entry": {
           "type": "string",
@@ -77,10 +77,16 @@
           "description": "The closed allowlist of `ui-plugin/1` host-RPC methods this plugin is permitted to call. The host MUST reject (with an `error` response, never silent execution) any method not in BOTH this declared list AND the host's `capabilities.uiPlugins.hostApi` set (`frontend-plugin-rpc-allowlist`). The plugin holds no credentials; every method is host-mediated and authz-checked.",
           "items": {
             "type": "string",
-            "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate"]
+            "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate", "host.announce"]
           },
           "uniqueItems": true
         },
+        "canvasTypes": {
+          "type": "array",
+          "description": "OPTIONAL; meaningful only for `surface: \"canvas-preview\"` (RFC 0130): the host canvas type id(s) this preview renders. A host mounts the plugin only for matching canvas documents and MUST ignore entries it does not recognize; absent/empty means never auto-mounted.",
+          "items": { "type": "string", "maxLength": 128 },
+          "uniqueItems": true
+        },
         "connectSrc": {
           "type": "array",
           "description": "OPTIONAL explicit `connect-src` CSP exceptions the plugin needs (e.g., a font CDN). Absent → the host serves the plugin under a DENY-EGRESS CSP (`frontend-plugin-egress`): no network egress beyond the host-RPC channel. Any entry here is part of the front-end-review checkpoint (`registry-operations.md`) a reviewer audits; a host MAY refuse a pack whose exceptions it will not grant.",

package/schemas/run-snapshot.schema.json

@@ -40,7 +40,12 @@
       "properties": {
         "tenant": { "type": "string", "minLength": 1, "description": "Top-level isolation boundary." },
         "workspace": { "type": "string", "minLength": 1, "description": "Optional sub-tenant within the tenant (RFC 0048 workspace)." },
-        "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." }
+        "principal": { "type": "string", "minLength": 1, "description": "Acting identity (user or agent) — opaque id, never PII." },
+        "principalKind": {
+          "type": "string",
+          "enum": ["user", "agent", "anonymous"],
+          "description": "RFC 0132. The kind of the acting principal. OPTIONAL and EXPLICIT — absent ⇒ unconstrained (today's RFC 0048 behavior; a host that does not distinguish kinds omits it). `anonymous` ⇒ the RFC 0132 §A anonymous-actor rules and the §C default-deny per-surface grant bind: the `principal` id MUST be opaque, origin-bound, ephemeral, non-cross-linkable, non-PII, and never inherit a role or a default-on tool baseline. A host that advertises `capabilities.anonymousActor` and dispatches through a public surface MUST set `anonymous` on the resulting run. Resolves RFC 0048 §Unresolved-Q1 for the anonymous case."
+        }
       },
       "additionalProperties": false
     },

package/schemas/workflow-chain-pack-manifest.schema.json

@@ -86,6 +86,10 @@
           "type": "string",
           "description": "One-paragraph description of what the chain produces. Surfaced in host editor tile hover-text."
         },
+        "internal": {
+          "type": "boolean",
+          "description": "RFC 0135 — when true, this chain is a composition-only fragment (typically an RFC 0133 sub-chain child): hosts MUST omit it from default template-gallery/picker listings while keeping it loadable, resolvable by id, composable, and expandable exactly like any other chain. Presentational/discovery semantics only — NOT an authorization boundary (a host MUST NOT treat it as access control). Absent ⇒ false (listed). See workflow-chain-packs.md §\"Chain visibility (RFC 0135)\"."
+        },
         "parameters": {
           "type": "object",
           "description": "JSON Schema 2020-12 fragment describing the parameter values the host editor MUST collect from the author at drop time. Authors-supplied values are validated against this schema before expansion proceeds; invalid input MUST be rejected with `chain_parameter_invalid`. RECOGNIZED EXTENSION KEY (RFC 0124 / WCP4): a property MAY carry `x-openwop-sensitive: true` to declare the parameter secret-class. A host that recognizes it MUST NOT expansion-time-freeze that parameter (plaintext secret-at-rest leak, SR-1) and MUST NOT materialize it as a plaintext `source:\"variable\"` binding (the value would land in the run-scoped bag / `RunSnapshot.variables` — the same SR-1 leak one layer down). Instead, per the 2026-07-04 §Security amendment: it is deferrable ONLY in a prompt-body position, where it MUST be materialized as a `source:\"secret\"` `PromptVariable` (BYOK-resolved via `capabilities.secrets`, redacted to `[REDACTED:<secretId>]` in `prompt.composed`, never bagged); in ANY other position (whole-value `node.inputs`, embedded non-prompt `config`, or a host lacking deferred / `secrets` support) it MUST fail closed with `sensitive_param_not_deferrable` (422). Per-run supply is a `credentialRef` secret reference, never plaintext. See `workflow-chain-packs.md` §\"Deferred-parameter expansion\" / RFC 0124 §Security.",
@@ -106,6 +110,76 @@
           },
           "uniqueItems": true,
           "description": "Capability traits to propagate to every expanded node. Hosts MUST copy this array into each expanded `WorkflowNode.capabilities` so existing capability gates apply uniformly."
+        },
+        "subChains": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/SubChainRef" },
+          "description": "RFC 0133 §1.1. OPTIONAL. Child chains this chain composes at RUN TIME. Each entry names a chain (a sibling `chainId` in this pack, or an externally published chain) that a node references via `config.subChainRef`. Unlike RFC 0013's author-time inline splice, a referenced sub-chain is co-instantiated as its own registered workflow and dispatched by the parent as a child run (both parent and child stay owned + builder-editable). A host without runtime child dispatch MUST refuse instantiation with `sub_chain_unsupported` (422) rather than flatten. Requires `capabilities.workflowChainPacks.subChains.supported: true`. See `workflow-chain-packs.md` §\"Sub-chain composition (RFC 0133)\"."
+        },
+        "producedVariables": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/ProducedVariable" },
+          "description": "RFC 0133 §2.2. OPTIONAL. Run-scoped values a node writes to the executor's variable bag during the run and downstream nodes read by name via a `{ type:\"variable\", variableName }` input binding — where the value is NOT an author-time `parameter` and rides no typed output port. Prefer edges (a typed `sourceOutput`→`targetInput` hand-off) wherever a node exposes a value on a port; `producedVariables` is only for values written to the run bag with no typed port. On expansion the host emits these into `WorkflowDefinition.variables[]` as run-scoped entries (name + type, no value). Any `{ type:\"variable\" }` read of an UNDECLARED name (not here and not a materialized parameter) is a `variable_undeclared` manifest error. See `workflow-chain-packs.md` §\"Produced (run-scoped) variables (RFC 0133)\"."
+        }
+      },
+      "additionalProperties": false
+    },
+    "SubChainRef": {
+      "type": "object",
+      "required": ["ref"],
+      "description": "RFC 0133 §1.1. A reference to a child chain the parent composes. `ref` is EITHER a string naming a SIBLING `chainId` in this pack's `chains[]`, OR an object naming an externally published chain (resolved + signature-verified like any pack dependency). A sibling `ref` that matches no `chainId`, or an external `ref` that fails resolution/verification, is `sub_chain_unresolved`. A chain that transitively composes itself is `sub_chain_cycle`.",
+      "properties": {
+        "ref": {
+          "oneOf": [
+            {
+              "type": "string",
+              "description": "A sibling `chainId` in the same pack's `chains[]`.",
+              "pattern": "^[a-z][a-zA-Z0-9._-]*$",
+              "minLength": 1,
+              "maxLength": 256
+            },
+            {
+              "type": "object",
+              "required": ["packName", "chainId", "version"],
+              "description": "An externally published chain, resolved + signature-verified like any pack dependency.",
+              "properties": {
+                "packName": { "type": "string", "minLength": 1, "maxLength": 256 },
+                "chainId": { "type": "string", "pattern": "^[a-z][a-zA-Z0-9._-]*$", "minLength": 1, "maxLength": 256 },
+                "version": {
+                  "type": "string",
+                  "description": "Semver range for the external chain. Co-registration SHOULD pin the resolved version into the parent's ownership record for reproducibility (RFC 0133 §Unresolved #1, resolved: pin)."
+                }
+              },
+              "additionalProperties": false
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "ProducedVariable": {
+      "type": "object",
+      "required": ["name", "producedBy", "type"],
+      "description": "RFC 0133 §2.2. A run-scoped variable a chain declares: written by one node and read by others via a `{ type:\"variable\", variableName }` input binding. Run-scoped — carries NO author-time value (that is what `parameters` are for); the manifest distinguishes the two.",
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The variable-bag key downstream nodes read via `{ type:\"variable\", variableName:\"<name>\" }`."
+        },
+        "producedBy": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The `nodes[].id` (within this same fragment) that writes the value."
+        },
+        "type": {
+          "type": "string",
+          "enum": ["string", "number", "boolean", "object", "array"],
+          "description": "JSON-Schema type token for validation/inspection."
+        },
+        "description": {
+          "type": "string",
+          "description": "One-line description of the produced value's meaning."
         }
       },
       "additionalProperties": false
@@ -171,9 +245,17 @@
         },
         "config": {
           "type": "object",
-          "description": "Node config — host-validated against the referenced typeId's config schema. String fields MAY contain `{{params.<name>}}` placeholders that the host MUST substitute at expansion time.",
+          "description": "Node config — host-validated against the referenced typeId's config schema. String fields MAY contain `{{params.<name>}}` placeholders that the host MUST substitute at expansion time. RFC 0133: a `core.subWorkflow` / `core.dispatch` (child-run) node MAY carry `subChainRef: string` — a declared `subChains[].ref` (sibling `chainId` or external ref) the host rewrites to the minted child `workflowId` at co-expansion time (§1.3 step 3). A concrete `config.workflowId` inside a fragment remains INVALID — a chain MUST NOT pin a host-specific workflow id (the `not` guard below enforces it).",
           "additionalProperties": true,
-          "$comment": "Open by design — node config shapes are per-typeId and only known to the host at expansion time when the referenced typeId's config schema is resolved. Cross-typeId enforcement happens at the expansion step, not at manifest-validation time."
+          "not": { "required": ["workflowId"] },
+          "properties": {
+            "subChainRef": {
+              "type": "string",
+              "pattern": "^[a-z][a-zA-Z0-9._-]*$",
+              "description": "RFC 0133 §1.2. A declared `subChains[].ref` this node dispatches as a child run. The host rewrites it to the minted child `config.workflowId` at co-expansion time. MUST match a `subChains[].ref` (sibling `chainId` or external ref's `chainId`), else `sub_chain_unresolved`."
+            }
+          },
+          "$comment": "Open by design — node config shapes are per-typeId and only known to the host at expansion time when the referenced typeId's config schema is resolved. Cross-typeId enforcement happens at the expansion step, not at manifest-validation time. The `not: { required: ['workflowId'] }` guard is the ONE closed constraint: RFC 0133 forbids pinning a concrete host-specific workflow id inside a portable chain fragment (use `subChainRef` instead)."
         },
         "inputs": {
           "type": "object",
@@ -211,14 +293,15 @@
     },
     "EdgeCondition": {
       "type": "object",
-      "description": "Edge condition — identical to workflow-definition.schema.json §EdgeCondition (RFC 0013 §edges: 'same shape as a top-level workflow definition'). Inlined here so the manifest schema is self-contained for pack-loader validators.",
+      "description": "Edge condition — identical to workflow-definition.schema.json §EdgeCondition (RFC 0013 §edges: 'same shape as a top-level workflow definition'). Inlined here so the manifest schema is self-contained for pack-loader validators. RFC 0134 added `truthy`/`falsy` (kept in sync with the top-level def).",
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["expression", "equals", "notEquals", "contains", "regex"]
+          "enum": ["expression", "equals", "notEquals", "contains", "regex", "truthy", "falsy"],
+          "description": "RFC 0134: `truthy`/`falsy` test the resolved value at `left` for truthiness and take NO `right` operand; `left` is required for all operators except `expression`."
         },
-        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved')." },
-        "right": { "description": "Right operand value (any JSON value)." },
+        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved'). Required for every operator except `expression`." },
+        "right": { "description": "Right operand value (any JSON value). Meaningless for `truthy`/`falsy` (RFC 0134)." },
         "expression": { "type": "string", "description": "Used when type='expression'." }
       },
       "additionalProperties": false

package/schemas/workflow-definition.schema.json

@@ -197,10 +197,11 @@
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["expression", "equals", "notEquals", "contains", "regex"]
+          "enum": ["expression", "equals", "notEquals", "contains", "regex", "truthy", "falsy"],
+          "description": "Operator. `equals`/`notEquals`/`contains` compare `left` to `right`; `regex` matches `left` against `right`; `expression` evaluates `expression`. RFC 0134: `truthy`/`falsy` test the resolved value at `left` for JS-style truthiness and take NO `right` operand (the edge contributes iff `left` is truthy — resp. falsy/absent). `left` is required for all operators except `expression`."
         },
-        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved')." },
-        "right": { "description": "Right operand value (any JSON value)." },
+        "left": { "type": "string", "description": "Left operand path (e.g., 'status', 'output.approved'). Required for every operator except `expression`." },
+        "right": { "description": "Right operand value (any JSON value). Meaningless for `truthy`/`falsy` (RFC 0134) — a host MUST ignore it there, not error." },
         "expression": { "type": "string", "description": "Used when type='expression'." }
       },
       "additionalProperties": false

package/src/lib/anonymousActor.ts

@@ -0,0 +1,99 @@
+/**
+ * Shared helpers for the RFC 0132 anonymous-actor conformance scenarios.
+ *
+ * Reads the `capabilities.anonymousActor` discovery family at the document
+ * ROOT (RFC 0073) and drives the reference-host public-surface seam the
+ * behavioral scenarios probe. Lives in lib/ (not a *.test.ts) so the
+ * scenarios import it via `../lib/anonymousActor.js`.
+ *
+ * The seam is a HOST-EXTENSION sample surface (`/v1/host/sample/anon-surface/…`)
+ * — NOT a normative protocol endpoint. RFC 0132 pins the wire-observable
+ * contract (the capability advert, `owner.principalKind`, the default-deny
+ * grant, the audit reuse of `authorization.decided`); the surface→tool
+ * binding + the seam route are host-owned config. The behavioral scenarios
+ * soft-skip when the seam is unwired (404), so a host that has not yet landed
+ * tool-enabled public dispatch stays green.
+ *
+ * @see spec/v1/capabilities.md §"anonymousActor"
+ * @see RFCS/0132-anonymous-actor-authorization.md
+ */
+import { driver } from './driver.js';
+import { readCapabilityFamily } from './discovery-capabilities.js';
+
+export interface AnonymousActorCap {
+  supported?: boolean;
+  tiers?: string[];
+  writeEgressControls?: string[];
+  failClosed?: boolean;
+}
+
+/** The reference-host sample public-surface seam (host-extension, not normative). */
+export const ANON_SEAM = '/v1/host/sample/anon-surface';
+/** A sample public surface id the seam resolves to a tenant + explicit grant. */
+export const ANON_SURFACE = 'sample-public-widget';
+
+/** Reads `capabilities.anonymousActor` from discovery root; null when unadvertised. */
+export async function readAnonymousActorCap(): Promise<AnonymousActorCap | null> {
+  const fam = await readCapabilityFamily<AnonymousActorCap>('anonymousActor');
+  return fam && typeof fam === 'object' ? fam : null;
+}
+
+/** True when the host advertises the anonymous-actor family. */
+export async function isAnonymousActorAdvertised(): Promise<boolean> {
+  const cap = await readAnonymousActorCap();
+  return cap?.supported === true;
+}
+
+/** The body the reference seam returns for a single anon tool dispatch. */
+export interface AnonDispatchBody {
+  authorizationDecided?: {
+    event?: string;
+    payload?: {
+      principal?: string;
+      action?: string;
+      resource?: string;
+      allowed?: boolean;
+      reason?: string;
+    };
+  };
+  owner?: { tenant?: string; principal?: string; principalKind?: string };
+  egressDecided?: { decision?: string; reason?: string; credentialAttached?: boolean };
+  interrupt?: { kind?: string };
+  result?: unknown;
+  raw?: string;
+}
+
+export interface AnonDispatchResult {
+  status: number;
+  json: AnonDispatchBody | undefined;
+}
+
+/**
+ * Drive one anonymous-actor tool dispatch against the reference seam.
+ * `surface` binds the tenant + explicit grant; `tool` is the tool the anon
+ * session attempts. Returns the raw status so callers can soft-skip on 404
+ * (seam unwired).
+ */
+export async function anonDispatch(body: {
+  surface?: string;
+  tool: string;
+  args?: Record<string, unknown>;
+  destination?: string;
+}): Promise<AnonDispatchResult> {
+  const res = await driver.post(`${ANON_SEAM}/dispatch`, {
+    surface: body.surface ?? ANON_SURFACE,
+    tool: body.tool,
+    ...(body.args ? { args: body.args } : {}),
+    ...(body.destination ? { destination: body.destination } : {}),
+  });
+  return { status: res.status, json: res.json as AnonDispatchBody | undefined };
+}
+
+/** Read the RFC 0078 tool catalog scoped to an anon session on `surface`. */
+export async function anonToolCatalog(
+  surface: string = ANON_SURFACE,
+): Promise<{ status: number; tools: Array<{ name?: string }> }> {
+  const res = await driver.get(`${ANON_SEAM}/tools?surface=${encodeURIComponent(surface)}`);
+  const body = res.json as { tools?: Array<{ name?: string }> } | undefined;
+  return { status: res.status, tools: Array.isArray(body?.tools) ? body!.tools! : [] };
+}