@openwop/openwop-conformance 1.72.2 → 1.98.0

package/schemas/capabilities.schema.json

@@ -4,26 +4,58 @@
   "title": "Capabilities",
   "description": "openwop capability declaration returned from `GET /.well-known/openwop`. Required v1 fields identify the protocol version, envelope catalog, schema versions, and base limits. Optional v1 fields have stable shapes but MAY be omitted when unsupported.",
   "type": "object",
-  "required": ["protocolVersion", "supportedEnvelopes", "schemaVersions", "limits"],
+  "required": [
+    "protocolVersion",
+    "supportedEnvelopes",
+    "schemaVersions",
+    "limits"
+  ],
   "properties": {
     "protocolVersion": {
       "type": "string",
-      "description": "openwop protocol version the server speaks (e.g., `1.0`). Independent of `engineVersion` (which gates persisted-doc compatibility per version-negotiation.md).",
-      "minLength": 1
+      "description": "RFC 0149 \u00a7C \u2014 openwop protocol version the server speaks, as ASCII `<major>.<minor>` with no leading zero except zero itself. `1.0` and `1.12` are valid; `1`, `1.0.0`, `v1.0`, and `01.0` are not. The integer major is the hard compatibility boundary and the integer minor is the additive contract level; PATCH belongs to suite and SDK versions, not the spec version. Previously constrained only by `minLength: 1`, which admitted `v1.0`, `1.0.0`, and `banana` \u2014 a negotiation the wire could not decide, since neither integer can be extracted from an unconstrained string. Independent of `engineVersion` (which gates persisted-doc compatibility per version-negotiation.md).",
+      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+    },
+    "contractProvenance": {
+      "type": "object",
+      "description": "RFC 0146 (`Active`). Which corpus revision this host's contract handling corresponds to \u2014 the copy it validates and serves against. OPTIONAL; absent \u21d2 UNSPECIFIED provenance, neither current nor stale, and a consumer MUST NOT infer a version from its absence. ADVISORY: a consumer MUST NOT reject a request, refuse interop, or fail a run solely because this differs from its own \u2014 v1.x corpus revisions are additive, so a host on an older revision is conformant and this field detects drift rather than making drift an error. Nothing else on the wire answers this: `protocolVersion` is `1.0` across the entire v1 line (the drift happens inside that value) and `schemaVersions` is per-envelope-type. NOT an integrity check \u2014 `corpusCommit` says WHICH contract, never whether the copy was modified.",
+      "properties": {
+        "suiteVersion": {
+          "type": "string",
+          "description": "A published `@openwop/openwop-conformance` version, e.g. `1.73.0`. Mirrors `schemas/CORPUS-STAMP.json` so a host depending on the package can echo its own stamp rather than hand-maintaining a constant.",
+          "minLength": 1
+        },
+        "corpusCommit": {
+          "type": "string",
+          "description": "Full 40-character commit SHA of the openwop repository. A vendor build identifier does NOT belong here \u2014 `implementation` already exists for that.",
+          "pattern": "^[0-9a-f]{40}$"
+        }
+      },
+      "additionalProperties": false
     },
     "supportedEnvelopes": {
       "type": "array",
-      "items": { "type": "string", "minLength": 1 },
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
       "description": "Envelope `type` strings the engine recognizes (e.g., `prd.create`, `theme.create`, `tasks.create`, `clarification.request`)."
     },
     "schemaVersions": {
       "type": "object",
-      "additionalProperties": { "type": "integer", "minimum": 0 },
+      "additionalProperties": {
+        "type": "integer",
+        "minimum": 0
+      },
       "description": "Active schema version per envelope type (e.g., `{ \"prd.create\": 2 }`)."
     },
     "limits": {
       "type": "object",
-      "required": ["clarificationRounds", "schemaRounds", "envelopesPerTurn"],
+      "required": [
+        "clarificationRounds",
+        "schemaRounds",
+        "envelopesPerTurn"
+      ],
       "properties": {
         "clarificationRounds": {
           "type": "integer",
@@ -68,21 +100,26 @@
         "maxRequestBodyBytes": {
           "type": "integer",
           "minimum": 1,
-          "description": "RFC 0094 §H. Maximum REST request body size (bytes) the host accepts. Optional v1 field per `capabilities.md` §3 (previously documented as reserved — the closed `limits` object made advertising it a schema-validation failure). Hosts that advertise it MUST enforce it."
+          "description": "RFC 0094 \u00a7H. Maximum REST request body size (bytes) the host accepts. Optional v1 field per `capabilities.md` \u00a73 (previously documented as reserved \u2014 the closed `limits` object made advertising it a schema-validation failure). Hosts that advertise it MUST enforce it."
         }
       },
       "additionalProperties": false,
-      "description": "Hard limits enforced by the engine. See capabilities.md §3."
+      "description": "Hard limits enforced by the engine. See capabilities.md \u00a73."
     },
     "envelopeStrictness": {
       "type": "string",
-      "enum": ["warn", "strict"],
-      "description": "AI Envelope schema-version drift handling per `spec/v1/ai-envelope.md` §\"Capability handshake integration\" (DRAFT v1.x). Optional in v1.x; default when absent is `warn`. Under `warn`, the engine MUST attempt validation against the advertised version of a kind and log `envelope_schema_version_drift` when the emitted `schemaVersion` is lower than advertised. Under `strict`, the same condition MUST cause refusal with `unknown_schema_version`. Emitted `schemaVersion` higher than advertised MUST refuse regardless of strictness."
+      "enum": [
+        "warn",
+        "strict"
+      ],
+      "description": "AI Envelope schema-version drift handling per `spec/v1/ai-envelope.md` \u00a7\"Capability handshake integration\" (DRAFT v1.x). Optional in v1.x; default when absent is `warn`. Under `warn`, the engine MUST attempt validation against the advertised version of a kind and log `envelope_schema_version_drift` when the emitted `schemaVersion` is lower than advertised. Under `strict`, the same condition MUST cause refusal with `unknown_schema_version`. Emitted `schemaVersion` higher than advertised MUST refuse regardless of strictness."
     },
     "envelopeContracts": {
       "type": "object",
-      "description": "AI Envelope contract-gating advertisement per `spec/v1/ai-envelope.md` §\"Capability handshake integration\" (DRAFT v1.x). Optional in v1.x. When `advertised: true`, the host's node-pack manifests carry `EnvelopeContract` blocks per `ai-envelope.md` §\"Envelope Contract\"; tooling and conformance scenarios gate on this flag. When `advertised: false` or the block is absent, hosts MAY accept envelopes without per-typeId `accepts[]` enforcement.",
-      "required": ["advertised"],
+      "description": "AI Envelope contract-gating advertisement per `spec/v1/ai-envelope.md` \u00a7\"Capability handshake integration\" (DRAFT v1.x). Optional in v1.x. When `advertised: true`, the host's node-pack manifests carry `EnvelopeContract` blocks per `ai-envelope.md` \u00a7\"Envelope Contract\"; tooling and conformance scenarios gate on this flag. When `advertised: false` or the block is absent, hosts MAY accept envelopes without per-typeId `accepts[]` enforcement.",
+      "required": [
+        "advertised"
+      ],
       "properties": {
         "advertised": {
           "type": "boolean",
@@ -93,36 +130,48 @@
     },
     "envelopes": {
       "type": "object",
-      "description": "Envelope LLM-contract advertisement container introduced by the RFC 0030–0033 envelope-hardening track. Each sub-block is independently opt-in; hosts that adopt a subset advertise only the sub-blocks they implement. `additionalProperties: true` reserved for future RFCs that extend the track; host-private extensions go under `x-host-<host>-<key>` per `host-extensions.md` §\"Canonical-prefix table\".",
+      "description": "Envelope LLM-contract advertisement container introduced by the RFC 0030\u20130033 envelope-hardening track. Each sub-block is independently opt-in; hosts that adopt a subset advertise only the sub-blocks they implement. `additionalProperties: true` reserved for future RFCs that extend the track; host-private extensions go under `x-host-<host>-<key>` per `host-extensions.md` \u00a7\"Canonical-prefix table\".",
       "additionalProperties": true,
       "properties": {
         "reasoning": {
           "type": "object",
-          "description": "RFC 0030 §A + §C. Host's envelope payload schemas support the OPTIONAL `reasoning` field on kinds where multi-step reasoning materially improves output quality; the host's system-prompt-injection helper instructs the model to populate it. Absent block = no advertisement (the field MAY still appear on envelope schemas; this advertisement signals the host's prompt-injection posture).",
+          "description": "RFC 0030 \u00a7A + \u00a7C. Host's envelope payload schemas support the OPTIONAL `reasoning` field on kinds where multi-step reasoning materially improves output quality; the host's system-prompt-injection helper instructs the model to populate it. Absent block = no advertisement (the field MAY still appear on envelope schemas; this advertisement signals the host's prompt-injection posture).",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "Host's envelope payload schemas carry `reasoning` (OPTIONAL) on kinds where reasoning materially improves output quality, per RFC 0030 §A. Hosts SHOULD prompt the model to populate the field; hosts MUST NOT reject envelopes where `reasoning` is absent (the field is OPTIONAL by spec); hosts SHALL NOT route on `reasoning` contents."
+              "description": "Host's envelope payload schemas carry `reasoning` (OPTIONAL) on kinds where reasoning materially improves output quality, per RFC 0030 \u00a7A. Hosts SHOULD prompt the model to populate the field; hosts MUST NOT reject envelopes where `reasoning` is absent (the field is OPTIONAL by spec); hosts SHALL NOT route on `reasoning` contents."
             },
             "promptDirective": {
               "type": "string",
-              "enum": ["mandatory", "advisory", "off"],
-              "description": "Strength of the host's system-prompt instruction to populate `reasoning`. `mandatory`: the directive is firmly worded (the host instructs the model very forcefully to emit `reasoning`). `advisory` (default when absent): the directive is suggestive. `off`: the host emits no directive — applications that want `reasoning` populated must inject the instruction themselves. Note: `mandatory` is a prompt-injection posture, NOT a wire-level refusal contract — hosts MUST NOT reject envelopes where `reasoning` is absent regardless of this value."
+              "enum": [
+                "mandatory",
+                "advisory",
+                "off"
+              ],
+              "description": "Strength of the host's system-prompt instruction to populate `reasoning`. `mandatory`: the directive is firmly worded (the host instructs the model very forcefully to emit `reasoning`). `advisory` (default when absent): the directive is suggestive. `off`: the host emits no directive \u2014 applications that want `reasoning` populated must inject the instruction themselves. Note: `mandatory` is a prompt-injection posture, NOT a wire-level refusal contract \u2014 hosts MUST NOT reject envelopes where `reasoning` is absent regardless of this value."
             }
           }
         },
         "tierOneSubsetCompliance": {
           "type": "string",
-          "enum": ["strict", "warn", "off"],
-          "description": "RFC 0030 §B + §C. Host's self-attested compliance posture for the Tier-1 cross-vendor structured-output subset documented in `spec/v1/structured-output-subset.md`. `strict`: every host-served envelope schema passes the static subset-compliance check (object-root, `additionalProperties: false` everywhere, every property in `required`, no `oneOf`/`allOf`/`not`/`prefixItems`/`propertyNames`, no string format/pattern/length constraints, no number bounds, no array bounds, ≤5 nesting depth, ≤100 property count). `warn`: host serves non-compliant schemas but logs the violations. `off` (default when absent): no self-attestation. The conformance-suite static-subset scenario gates on this flag."
+          "enum": [
+            "strict",
+            "warn",
+            "off"
+          ],
+          "description": "RFC 0030 \u00a7B + \u00a7C. Host's self-attested compliance posture for the Tier-1 cross-vendor structured-output subset documented in `spec/v1/structured-output-subset.md`. `strict`: every host-served envelope schema passes the static subset-compliance check (object-root, `additionalProperties: false` everywhere, every property in `required`, no `oneOf`/`allOf`/`not`/`prefixItems`/`propertyNames`, no string format/pattern/length constraints, no number bounds, no array bounds, \u22645 nesting depth, \u2264100 property count). `warn`: host serves non-compliant schemas but logs the violations. `off` (default when absent): no self-attestation. The conformance-suite static-subset scenario gates on this flag."
         },
         "reliability": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["supported"],
-          "description": "RFC 0032 §C. Host emits the envelope-reliability event family on documented adverse paths. Hosts opt into the family via `supported: true` AND explicitly list the events they emit via `events[]`. Hosts that advertise `supported: true` MUST include at least `envelope.retry.exhausted` and `envelope.refusal` in `events[]` (the two MUST-tier events). The other four (`envelope.retry.attempted`, `envelope.truncated`, `envelope.nlToFormat.engaged`, `envelope.recovery.applied`) are SHOULD/MAY-tier per RFC 0032 §B and may be omitted.",
+          "required": [
+            "supported"
+          ],
+          "description": "RFC 0032 \u00a7C. Host emits the envelope-reliability event family on documented adverse paths. Hosts opt into the family via `supported: true` AND explicitly list the events they emit via `events[]`. Hosts that advertise `supported: true` MUST include at least `envelope.retry.exhausted` and `envelope.refusal` in `events[]` (the two MUST-tier events). The other four (`envelope.retry.attempted`, `envelope.truncated`, `envelope.nlToFormat.engaged`, `envelope.recovery.applied`) are SHOULD/MAY-tier per RFC 0032 \u00a7B and may be omitted.",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -148,23 +197,25 @@
               "type": "integer",
               "minimum": 1,
               "maximum": 16,
-              "description": "Host's retry budget per envelope emission. Conformance scenarios use this to construct fixtures that exercise the retry-exhausted path. Independent of `capabilities.limits.schemaRounds` (which is the engine-side per-emission cap) — `maxRetryAttempts` reports the host's actual configured value, not the spec's upper bound."
+              "description": "Host's retry budget per envelope emission. Conformance scenarios use this to construct fixtures that exercise the retry-exhausted path. Independent of `capabilities.limits.schemaRounds` (which is the engine-side per-emission cap) \u2014 `maxRetryAttempts` reports the host's actual configured value, not the spec's upper bound."
             },
             "completion": {
               "type": "object",
               "additionalProperties": false,
-              "required": ["distinguishesTruncation"],
-              "description": "RFC 0033 §E. Host's self-attested envelope-completion contract posture — does the host distinguish truncation from schema-violation in its retry routing per RFC 0033 §A + §B + §C?",
+              "required": [
+                "distinguishesTruncation"
+              ],
+              "description": "RFC 0033 \u00a7E. Host's self-attested envelope-completion contract posture \u2014 does the host distinguish truncation from schema-violation in its retry routing per RFC 0033 \u00a7A + \u00a7B + \u00a7C?",
               "properties": {
                 "distinguishesTruncation": {
                   "type": "boolean",
-                  "description": "Host implements RFC 0033's truncation-vs-schema-violation retry-routing distinction: truncation → increased output budget (NO corrective fragment); schema-violation → corrective system fragment (NO budget increase). When `false` or absent, the host conflates the two paths (legacy behavior); RFC 0033 conformance scenarios soft-skip."
+                  "description": "Host implements RFC 0033's truncation-vs-schema-violation retry-routing distinction: truncation \u2192 increased output budget (NO corrective fragment); schema-violation \u2192 corrective system fragment (NO budget increase). When `false` or absent, the host conflates the two paths (legacy behavior); RFC 0033 conformance scenarios soft-skip."
                 },
                 "truncationBudgetMultiplier": {
                   "type": "number",
                   "minimum": 1,
                   "maximum": 8,
-                  "description": "Host's per-attempt output-budget multiplier on truncation retries. Informational; clients MAY surface this in cost-estimation UIs. Defaults to 2 when absent and `distinguishesTruncation: true`. Spec recommendation is 2× per RFC 0033 §B."
+                  "description": "Host's per-attempt output-budget multiplier on truncation retries. Informational; clients MAY surface this in cost-estimation UIs. Defaults to 2 when absent and `distinguishesTruncation: true`. Spec recommendation is 2\u00d7 per RFC 0033 \u00a7B."
                 }
               }
             }
@@ -174,26 +225,38 @@
     },
     "prompts": {
       "type": "object",
-      "description": "RFC 0027 + RFC 0028 prompt-template support advertisement. The `supported` flag gates **node-execution resolution** of PromptRef values per RFC 0027 (Phase A); the separate `endpointsSupported` flag gates the **REST surface** at `/v1/prompts*` per RFC 0028 (Phase B). The two axes are independent — a host MAY implement Phase A composition without exposing the REST surface, and vice versa. Absent block = no support; consumers passing PromptRef values to such a host MUST tolerate the keys being treated as opaque strings.",
-      "required": ["supported"],
+      "description": "RFC 0027 + RFC 0028 prompt-template support advertisement. The `supported` flag gates **node-execution resolution** of PromptRef values per RFC 0027 (Phase A); the separate `endpointsSupported` flag gates the **REST surface** at `/v1/prompts*` per RFC 0028 (Phase B). The two axes are independent \u2014 a host MAY implement Phase A composition without exposing the REST surface, and vice versa. Absent block = no support; consumers passing PromptRef values to such a host MUST tolerate the keys being treated as opaque strings.",
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "RFC 0027 Phase A. When `true`, the host resolves PromptRef values in `WorkflowNode.config.{systemPromptRef, userPromptRef, additionalPromptRefs}` at node-execution time AND emits `prompt.composed` run events per spec/v1/prompts.md §\"Composition + observability\". Does NOT imply the `/v1/prompts*` REST surface is available — see `endpointsSupported` for that. False or absent = the PromptRef keys on `WorkflowNode.config` are treated as opaque strings and never composed."
+          "description": "RFC 0027 Phase A. When `true`, the host resolves PromptRef values in `WorkflowNode.config.{systemPromptRef, userPromptRef, additionalPromptRefs}` at node-execution time AND emits `prompt.composed` run events per spec/v1/prompts.md \u00a7\"Composition + observability\". Does NOT imply the `/v1/prompts*` REST surface is available \u2014 see `endpointsSupported` for that. False or absent = the PromptRef keys on `WorkflowNode.config` are treated as opaque strings and never composed."
         },
         "endpointsSupported": {
           "type": "boolean",
-          "description": "RFC 0028 §A. When `true`, the host serves the `/v1/prompts*` REST surface — at minimum the read endpoints (`listPromptTemplates`, `getPromptTemplate`, `renderPromptTemplate`). The mutating endpoints additionally require `mutableLibrary: true`; the pack-install path additionally requires `packsSupported: true`. False or absent = every `/v1/prompts*` request returns `501 capability_not_provided`. Independent of `supported` — a host MAY advertise `supported: true, endpointsSupported: false` (composition without library REST) or `supported: false, endpointsSupported: true` (library REST against an external resolver, e.g., a façade host)."
+          "description": "RFC 0028 \u00a7A. When `true`, the host serves the `/v1/prompts*` REST surface \u2014 at minimum the read endpoints (`listPromptTemplates`, `getPromptTemplate`, `renderPromptTemplate`). The mutating endpoints additionally require `mutableLibrary: true`; the pack-install path additionally requires `packsSupported: true`. False or absent = every `/v1/prompts*` request returns `501 capability_not_provided`. Independent of `supported` \u2014 a host MAY advertise `supported: true, endpointsSupported: false` (composition without library REST) or `supported: false, endpointsSupported: true` (library REST against an external resolver, e.g., a fa\u00e7ade host)."
         },
         "templateKinds": {
           "type": "array",
-          "items": { "$ref": "./prompt-kind.schema.json" },
+          "items": {
+            "$ref": "./prompt-kind.schema.json"
+          },
           "uniqueItems": true,
-          "description": "Subset of PromptKind values the host accepts. Defaults to all four (`system`, `user`, `few-shot`, `schema-hint`) when omitted. The $ref resolves to the shared `prompt-kind.schema.json` `$def` per RFC 0027 §A — uses a relative URI so redocly's lint walker resolves it against the local file rather than fetching the openwop.dev URL."
+          "description": "Subset of PromptKind values the host accepts. Defaults to all four (`system`, `user`, `few-shot`, `schema-hint`) when omitted. The $ref resolves to the shared `prompt-kind.schema.json` `$def` per RFC 0027 \u00a7A \u2014 uses a relative URI so redocly's lint walker resolves it against the local file rather than fetching the openwop.dev URL."
         },
         "variableSources": {
           "type": "array",
-          "items": { "type": "string", "enum": ["input", "variable", "secret", "context"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "input",
+              "variable",
+              "secret",
+              "context"
+            ]
+          },
           "uniqueItems": true,
           "description": "Subset of PromptVariable.source values the host supports. `secret` SHOULD only appear when `capabilities.secrets.supported` is also true."
         },
@@ -205,21 +268,25 @@
         },
         "observability": {
           "type": "string",
-          "enum": ["off", "hashed", "full"],
+          "enum": [
+            "off",
+            "hashed",
+            "full"
+          ],
           "description": "How `prompt.composed` events expose resolved bodies. `off`: event not emitted. `hashed`: payload carries only sha256 + per-variable-binding hashes (no plaintext). `full`: payload carries the composed body with secret-sourced values redacted to `[REDACTED:<secretId>]` markers and untrusted segments wrapped in `<UNTRUSTED>` markers. Default when absent: `hashed`."
         },
         "packsSupported": {
           "type": "boolean",
-          "description": "RFC 0028 §C. When `true`, the host installs `kind: \"prompt\"` registry packs and exposes their templates at `GET /v1/prompts` with `meta.source: \"pack\"` + `meta.packName` + `meta.packVersion`. When `false` or absent, packs are not loaded; only host built-ins and (when `mutableLibrary: true`) user-created templates are visible."
+          "description": "RFC 0028 \u00a7C. When `true`, the host installs `kind: \"prompt\"` registry packs and exposes their templates at `GET /v1/prompts` with `meta.source: \"pack\"` + `meta.packName` + `meta.packVersion`. When `false` or absent, packs are not loaded; only host built-ins and (when `mutableLibrary: true`) user-created templates are visible."
         },
         "mutableLibrary": {
           "type": "boolean",
-          "description": "RFC 0028 §C. When `true`, the host honors the mutating endpoints `POST /v1/prompts`, `PUT /v1/prompts/{templateId}`, `DELETE /v1/prompts/{templateId}`. When `false` or absent, those endpoints return 501. Pack-sourced and host-built-in templates remain read-only even under `mutableLibrary: true` — deletion of those returns 403 per RFC 0028 §A."
+          "description": "RFC 0028 \u00a7C. When `true`, the host honors the mutating endpoints `POST /v1/prompts`, `PUT /v1/prompts/{templateId}`, `DELETE /v1/prompts/{templateId}`. When `false` or absent, those endpoints return 501. Pack-sourced and host-built-in templates remain read-only even under `mutableLibrary: true` \u2014 deletion of those returns 403 per RFC 0028 \u00a7A."
         },
         "library": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0028 §C. Per-library configuration knobs that influence how clients call the prompt surface.",
+          "description": "RFC 0028 \u00a7C. Per-library configuration knobs that influence how clients call the prompt surface.",
           "properties": {
             "id": {
               "type": "string",
@@ -240,17 +307,25 @@
         "defaults": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0029 §B. Per-kind host-default PromptRefs that apply at resolution chain layer 4 (`host-defaults`) per `spec/v1/prompts.md` §\"Resolution chain (normative)\". Advertised so clients can preview the full chain at edit time without dispatching a node. Hosts MAY ship per-kind defaults; the openwop spec ships none.",
+          "description": "RFC 0029 \u00a7B. Per-kind host-default PromptRefs that apply at resolution chain layer 4 (`host-defaults`) per `spec/v1/prompts.md` \u00a7\"Resolution chain (normative)\". Advertised so clients can preview the full chain at edit time without dispatching a node. Hosts MAY ship per-kind defaults; the openwop spec ships none.",
           "properties": {
-            "system": { "$ref": "./prompt-ref.schema.json" },
-            "user": { "$ref": "./prompt-ref.schema.json" },
-            "few-shot": { "$ref": "./prompt-ref.schema.json" },
-            "schema-hint": { "$ref": "./prompt-ref.schema.json" }
+            "system": {
+              "$ref": "./prompt-ref.schema.json"
+            },
+            "user": {
+              "$ref": "./prompt-ref.schema.json"
+            },
+            "few-shot": {
+              "$ref": "./prompt-ref.schema.json"
+            },
+            "schema-hint": {
+              "$ref": "./prompt-ref.schema.json"
+            }
           }
         },
         "agentBindings": {
           "type": "boolean",
-          "description": "RFC 0029 §B. When `true`, the host honors `AgentManifest.promptOverrides[kind]` and `AgentManifest.promptLibraryRef` at resolution chain layer 2 (`agent-overrides` / `agent-library-default`) per `spec/v1/prompts.md` §\"Resolution chain (normative)\". When `false` or absent, layer 2 is skipped — the host applies only layers 1, 3, 4. Conformance scenarios for agent-binding resolution are gated on this flag."
+          "description": "RFC 0029 \u00a7B. When `true`, the host honors `AgentManifest.promptOverrides[kind]` and `AgentManifest.promptLibraryRef` at resolution chain layer 2 (`agent-overrides` / `agent-library-default`) per `spec/v1/prompts.md` \u00a7\"Resolution chain (normative)\". When `false` or absent, layer 2 is skipped \u2014 the host applies only layers 1, 3, 4. Conformance scenarios for agent-binding resolution are gated on this flag."
         }
       },
       "additionalProperties": false
@@ -263,9 +338,15 @@
       "type": "object",
       "description": "Optional v1 server identity (name + version + vendor).",
       "properties": {
-        "name": { "type": "string" },
-        "version": { "type": "string" },
-        "vendor": { "type": "string" }
+        "name": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "vendor": {
+          "type": "string"
+        }
       },
       "additionalProperties": false
     },
@@ -281,17 +362,29 @@
     },
     "supportedTransports": {
       "type": "array",
-      "items": { "type": "string", "enum": ["rest", "mcp", "a2a", "grpc"] },
+      "items": {
+        "type": "string",
+        "enum": [
+          "rest",
+          "mcp",
+          "a2a",
+          "grpc"
+        ]
+      },
       "description": "Optional v1 transport advertisement. REST is required whether or not this field is present."
     },
     "grpc": {
       "type": "object",
-      "description": "RFC 0094 §H. gRPC transport advertisement per `grpc-transport.md` §\"Capability advertisement\". Optional — absent ⇒ the host exposes no gRPC transport. A host that exposes the gRPC surface advertises this block AND includes `\"grpc\"` in `supportedTransports`. REST + SSE remain exposed regardless.",
-      "required": ["supported", "service", "tls"],
+      "description": "RFC 0094 \u00a7H. gRPC transport advertisement per `grpc-transport.md` \u00a7\"Capability advertisement\". Optional \u2014 absent \u21d2 the host exposes no gRPC transport. A host that exposes the gRPC surface advertises this block AND includes `\"grpc\"` in `supportedTransports`. REST + SSE remain exposed regardless.",
+      "required": [
+        "supported",
+        "service",
+        "tls"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "Toggle — `true` when the gRPC surface is live."
+          "description": "Toggle \u2014 `true` when the gRPC surface is live."
         },
         "endpoint": {
           "type": "string",
@@ -302,11 +395,15 @@
         "service": {
           "type": "string",
           "const": "openwop.v1.Engine",
-          "description": "Canonical service name. v1 hosts MUST use `openwop.v1.Engine` per `grpc-transport.md` §\"Field semantics\"."
+          "description": "Canonical service name. v1 hosts MUST use `openwop.v1.Engine` per `grpc-transport.md` \u00a7\"Field semantics\"."
         },
         "tls": {
           "type": "string",
-          "enum": ["required", "optional", "disabled"],
+          "enum": [
+            "required",
+            "optional",
+            "disabled"
+          ],
           "description": "TLS posture. Production hosts MUST set `\"required\"`."
         }
       },
@@ -314,16 +411,18 @@
     },
     "configurable": {
       "type": "object",
-      "description": "Optional v1 per-run overlay schema — what `RunOptions.configurable` keys this server honors."
+      "description": "Optional v1 per-run overlay schema \u2014 what `RunOptions.configurable` keys this server honors."
     },
     "nodePackRuntimes": {
       "type": "object",
-      "description": "Optional v1 advertisement of node-pack runtimes the host loads. See `node-packs.md` §runtime formats and RFC 0008 (WASM ABI). Hosts that don't load packs MAY omit this block entirely. NOTE: this block intentionally uses `additionalProperties: true` (here and on the nested runtime objects) so a future RFC may add a runtime type (e.g., `python-wasm`, `js-wasm`) without a breaking-change rev of this schema; the trade is that a strict-mode validator will accept arbitrary extra keys under these objects. A future RFC that promotes the open-set fields to first-class SHOULD tighten them to `additionalProperties: false` in the same RFC.",
+      "description": "Optional v1 advertisement of node-pack runtimes the host loads. See `node-packs.md` \u00a7runtime formats and RFC 0008 (WASM ABI). Hosts that don't load packs MAY omit this block entirely. NOTE: this block intentionally uses `additionalProperties: true` (here and on the nested runtime objects) so a future RFC may add a runtime type (e.g., `python-wasm`, `js-wasm`) without a breaking-change rev of this schema; the trade is that a strict-mode validator will accept arbitrary extra keys under these objects. A future RFC that promotes the open-set fields to first-class SHOULD tighten them to `additionalProperties: false` in the same RFC.",
       "properties": {
         "wasm": {
           "type": "object",
           "description": "WASM core-module runtime per RFC 0008. Hosts that load `runtime.language: \"wasm\"` packs MUST advertise `supported: true` and at least one entry in `abiVersions[]`. `additionalProperties: true` preserved for future RFC 0008 amendments (e.g., per-pack memory accounting fields).",
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -337,13 +436,13 @@
               },
               "uniqueItems": true,
               "minItems": 1,
-              "description": "ABI versions the loader accepts. v1.1 hosts MUST include `1`. Packs declaring `openwop_abi_version()` outside this list MUST be rejected at load time per RFC 0008 §H."
+              "description": "ABI versions the loader accepts. v1.1 hosts MUST include `1`. Packs declaring `openwop_abi_version()` outside this list MUST be rejected at load time per RFC 0008 \u00a7H."
             },
             "maxMemoryBytes": {
               "type": "integer",
               "minimum": 1048576,
               "maximum": 8589934592,
-              "description": "Per-pack memory ceiling enforced by the host loader. Range: 1 MiB ≤ value ≤ 8 GiB. RFC 0008 §K — when a pack exceeds this, the host MUST emit `cap.breached` with `kind: \"wasm-memory\"`."
+              "description": "Per-pack memory ceiling enforced by the host loader. Range: 1 MiB \u2264 value \u2264 8 GiB. RFC 0008 \u00a7K \u2014 when a pack exceeds this, the host MUST emit `cap.breached` with `kind: \"wasm-memory\"`."
             },
             "loadedPacks": {
               "type": "array",
@@ -352,7 +451,7 @@
                 "minLength": 1
               },
               "uniqueItems": true,
-              "description": "Pack names that passed instantiation (ABI check + load). Packs rejected per RFC 0008 §H MUST NOT appear here. Hosts MAY advertise this for observability; conformance asserts rejection by absence (Track 7)."
+              "description": "Pack names that passed instantiation (ABI check + load). Packs rejected per RFC 0008 \u00a7H MUST NOT appear here. Hosts MAY advertise this for observability; conformance asserts rejection by absence (Track 7)."
             }
           },
           "additionalProperties": true
@@ -361,7 +460,9 @@
           "type": "object",
           "description": "WASM Component Model variant (WIT-defined interfaces). Reserved for hosts that load `runtime.language: \"wasm-component\"` packs. `additionalProperties: true` preserved until the Component Model spec stabilises in the v1.x line; tighten in the RFC that promotes wasm-component to a first-class runtime alongside `wasm`.",
           "properties": {
-            "supported": { "type": "boolean" }
+            "supported": {
+              "type": "boolean"
+            }
           },
           "additionalProperties": true
         }
@@ -380,7 +481,11 @@
               "type": "array",
               "items": {
                 "type": "string",
-                "enum": ["http/json", "http/protobuf", "grpc"]
+                "enum": [
+                  "http/json",
+                  "http/protobuf",
+                  "grpc"
+                ]
               },
               "uniqueItems": true,
               "description": "OTLP export protocols the host supports emitting. `http/json` and `http/protobuf` are mandatory for hosts advertising OTel emission; `grpc` is opt-in per Track 11."
@@ -391,7 +496,7 @@
         "testSeams": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0034 — Conformance-only test seams under the host-extension namespace. Hosts that opt in expose introspection endpoints so cross-host conformance scenarios can verify BYOK canaries do not leak into OTel span attributes or debug-bundle exports. Production hosts SHOULD return 404 or 403 from these seams unless an env-gate (e.g., `OPENWOP_TEST_OTEL_SCRAPE=true`) is set.",
+          "description": "RFC 0034 \u2014 Conformance-only test seams under the host-extension namespace. Hosts that opt in expose introspection endpoints so cross-host conformance scenarios can verify BYOK canaries do not leak into OTel span attributes or debug-bundle exports. Production hosts SHOULD return 404 or 403 from these seams unless an env-gate (e.g., `OPENWOP_TEST_OTEL_SCRAPE=true`) is set.",
           "properties": {
             "otelScrape": {
               "type": "boolean",
@@ -413,7 +518,9 @@
     "secrets": {
       "type": "object",
       "description": "Optional v1 secret/credential resolution advertisement. Clients gate BYOK flows on this. Hosts that don't store credentials return `supported: false`.",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -423,14 +530,21 @@
           "type": "array",
           "items": {
             "type": "string",
-            "enum": ["tenant", "user", "run", "workspace"]
+            "enum": [
+              "tenant",
+              "user",
+              "run",
+              "workspace"
+            ]
           },
           "uniqueItems": true,
-          "description": "Subset of scopes the host implements. Tenant-scoped secrets are workspace-shared; user-scoped are per-end-user; run-scoped are ephemeral per-run; `workspace` (RFC 0046/0048) is the explicit sub-tenant scope. Appended `workspace` is additive — hosts that omit it are unaffected."
+          "description": "Subset of scopes the host implements. Tenant-scoped secrets are workspace-shared; user-scoped are per-end-user; run-scoped are ephemeral per-run; `workspace` (RFC 0046/0048) is the explicit sub-tenant scope. Appended `workspace` is additive \u2014 hosts that omit it are unaffected."
         },
         "resolution": {
           "type": "string",
-          "enum": ["host-managed"],
+          "enum": [
+            "host-managed"
+          ],
           "description": "Resolution mode. v1.x supports only `host-managed` (clients reference stored secrets via opaque ids); reserved for future modes."
         }
       },
@@ -438,8 +552,10 @@
     },
     "connections": {
       "type": "object",
-      "description": "RFC 0095 (`Draft`). Connection packs — portable, registry-distributable provider definitions (`kind: \"connection\"`, `connection-pack-manifest.schema.json`) that the RFC 0045/0047 `provider` string resolves against. Only useful alongside `oauth.supported` (RFC 0047) or `credentials.supported` (RFC 0046); a host SHOULD NOT advertise this block without at least one of those.",
-      "required": ["packsSupported"],
+      "description": "RFC 0095 (`Draft`). Connection packs \u2014 portable, registry-distributable provider definitions (`kind: \"connection\"`, `connection-pack-manifest.schema.json`) that the RFC 0045/0047 `provider` string resolves against. Only useful alongside `oauth.supported` (RFC 0047) or `credentials.supported` (RFC 0046); a host SHOULD NOT advertise this block without at least one of those.",
+      "required": [
+        "packsSupported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -447,7 +563,7 @@
         },
         "packsSupported": {
           "type": "boolean",
-          "description": "RFC 0095 §C. When `true`, the host installs `kind: \"connection\"` registry packs and MUST implement the §B.6 resolution contract: an RFC 0045 connector's `auth.provider` (or an RFC 0047 `host.oauth` provider string) resolves against the installed connection pack whose `provider.id` matches, with installed-vs-built-in precedence per SemVer §11 and `connection_provider_unresolved` / `connection_provider_conflict` diagnostics. When `false` or absent, connection packs are not loaded and provider resolution stays implementation-defined."
+          "description": "RFC 0095 \u00a7C. When `true`, the host installs `kind: \"connection\"` registry packs and MUST implement the \u00a7B.6 resolution contract: an RFC 0045 connector's `auth.provider` (or an RFC 0047 `host.oauth` provider string) resolves against the installed connection pack whose `provider.id` matches, with installed-vs-built-in precedence per SemVer \u00a711 and `connection_provider_unresolved` / `connection_provider_conflict` diagnostics. When `false` or absent, connection packs are not loaded and provider resolution stays implementation-defined."
         }
       },
       "additionalProperties": false
@@ -455,8 +571,10 @@
     "selfHostedRunner": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0122 (`Active`). The host routes a run's per-step model/tool dispatch to a user-controlled RUNNER that dials OUT to the host over a persistent channel (SSE receive + POST result) and holds the local credentials the host cannot reach (a subscription CLI login per RFC 0121, a private endpoint per RFC 0108). The host stays the sole orchestration/persistence/replay authority; the runner is a stateless dispatch executor. This is the discovery-time capability shape ONLY; the per-subject `SelfHostedRunnerRegistration` record stays OFF `/.well-known/openwop`. A host MUST NOT advertise `supported: true` until RFC 0122 reaches `Accepted` and the channel is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block ⇒ no runner advertisement.",
-      "required": ["supported"],
+      "description": "RFC 0122 (`Active`). The host routes a run's per-step model/tool dispatch to a user-controlled RUNNER that dials OUT to the host over a persistent channel (SSE receive + POST result) and holds the local credentials the host cannot reach (a subscription CLI login per RFC 0121, a private endpoint per RFC 0108). The host stays the sole orchestration/persistence/replay authority; the runner is a stateless dispatch executor. This is the discovery-time capability shape ONLY; the per-subject `SelfHostedRunnerRegistration` record stays OFF `/.well-known/openwop`. A host MUST NOT advertise `supported: true` until RFC 0122 reaches `Accepted` and the channel is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block \u21d2 no runner advertisement.",
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -464,21 +582,29 @@
         },
         "dispatchKinds": {
           "type": "array",
-          "items": { "type": "string", "enum": ["model", "tool"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "model",
+              "tool"
+            ]
+          },
           "uniqueItems": true,
-          "description": "OPTIONAL. Which dispatch kinds the host routes to runners. A host MAY implement `model` first and add `tool` later behind the same capability gate (openwop-app ADR 0182 Phase 5 lands model-dispatch first). Absent ⇒ implementation-defined, but a host SHOULD enumerate what it actually routes."
+          "description": "OPTIONAL. Which dispatch kinds the host routes to runners. A host MAY implement `model` first and add `tool` later behind the same capability gate (openwop-app ADR 0182 Phase 5 lands model-dispatch first). Absent \u21d2 implementation-defined, but a host SHOULD enumerate what it actually routes."
         }
       }
     },
     "purposePropagation": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0128 (`Active`). Purpose-propagation — the host reads and RE-EMITS `permittedPurposes` labels (opaque purpose strings riding the A2A `metadata.openwop.permittedPurposes` extension and the `TriggerEvent.permittedPurposes` field) on onward OpenWOP-envelope hops of the same data, narrowing at most and never widening; a `[]` label is honored as no-onward-use. This family advertises label PROPAGATION only — it does NOT claim the host enforces purpose limits on its own internal use (that is declared intent under the receiver's local governance, RFC 0128 §4, deliberately not conformance-gated). A host MUST NOT advertise `supported: true` until RFC 0128 reaches `Accepted` and propagation is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block ⇒ labels pass through unread as unknown metadata (pre-RFC behavior).",
-      "required": ["supported"],
+      "description": "RFC 0128 (`Active`). Purpose-propagation \u2014 the host reads and RE-EMITS `permittedPurposes` labels (opaque purpose strings riding the A2A `metadata.openwop.permittedPurposes` extension and the `TriggerEvent.permittedPurposes` field) on onward OpenWOP-envelope hops of the same data, narrowing at most and never widening; a `[]` label is honored as no-onward-use. This family advertises label PROPAGATION only \u2014 it does NOT claim the host enforces purpose limits on its own internal use (that is declared intent under the receiver's local governance, RFC 0128 \u00a74, deliberately not conformance-gated). A host MUST NOT advertise `supported: true` until RFC 0128 reaches `Accepted` and propagation is honored (truthful-advertisement, `OPENWOP_REQUIRE_BEHAVIOR=true`). Absent block \u21d2 labels pass through unread as unknown metadata (pre-RFC behavior).",
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "RFC 0128. When `true`, the host preserves and re-emits received `permittedPurposes` labels per RFC 0128 §3 (re-emit on OpenWOP-envelope onward hops; MAY narrow; MUST NOT widen; derived outputs never carry a purpose absent from any contributing labelled input; `[]` ⇒ no onward hop)."
+          "description": "RFC 0128. When `true`, the host preserves and re-emits received `permittedPurposes` labels per RFC 0128 \u00a73 (re-emit on OpenWOP-envelope onward hops; MAY narrow; MUST NOT widen; derived outputs never carry a purpose absent from any contributing labelled input; `[]` \u21d2 no onward hop)."
         },
         "propagatesOnward": {
           "type": "boolean",
@@ -489,44 +615,63 @@
     "dataResidency": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0129 (`Active`). Data-residency — the host advertises the operator region codes it can pin a run to, and honors-or-rejects an OPTIONAL `residency.region` on run-creation (`POST /v1/runs`): accept iff the requested region is in `regions[]`, else reject `residency_unavailable` (never silently accept-and-ignore). This family advertises the ADMISSION decision only (falsifiable over the wire) — it does NOT assert that the run's data physically remains in-region (unobservable; declared operator intent under RFC 0129 §4, not conformance-gated). A host MUST advertise a region in `regions[]` only if it can actually process a run entirely within it. Absent block ⇒ the host makes no residency promise and MAY ignore or reject a `residency` constraint (but MUST NOT claim to honor it).",
-      "required": ["supported", "regions"],
+      "description": "RFC 0129 (`Active`). Data-residency \u2014 the host advertises the operator region codes it can pin a run to, and honors-or-rejects an OPTIONAL `residency.region` on run-creation (`POST /v1/runs`): accept iff the requested region is in `regions[]`, else reject `residency_unavailable` (never silently accept-and-ignore). This family advertises the ADMISSION decision only (falsifiable over the wire) \u2014 it does NOT assert that the run's data physically remains in-region (unobservable; declared operator intent under RFC 0129 \u00a74, not conformance-gated). A host MUST advertise a region in `regions[]` only if it can actually process a run entirely within it. Absent block \u21d2 the host makes no residency promise and MAY ignore or reject a `residency` constraint (but MUST NOT claim to honor it).",
+      "required": [
+        "supported",
+        "regions"
+      ],
       "properties": {
         "supported": {
           "const": true,
-          "description": "RFC 0129. Present-and-true when the host performs region admission control per §3. The block is omitted entirely when the host offers no residency pinning."
+          "description": "RFC 0129. Present-and-true when the host performs region admission control per \u00a73. The block is omitted entirely when the host offers no residency pinning."
         },
         "regions": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
-          "description": "RFC 0129. Opaque operator region codes the host can pin a run to (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). No closed registry — codes are the host's own vocabulary (a global region enum would be unfalsifiable). A host MUST advertise a code here only if it can process a run entirely within it; a run-create `residency.region` not in this list MUST be rejected `residency_unavailable`."
+          "description": "RFC 0129. Opaque operator region codes the host can pin a run to (e.g. `\"eu\"`, `\"us\"`, `\"eu-west-1\"`). No closed registry \u2014 codes are the host's own vocabulary (a global region enum would be unfalsifiable). A host MUST advertise a code here only if it can process a run entirely within it; a run-create `residency.region` not in this list MUST be rejected `residency_unavailable`."
         }
       }
     },
     "anonymousActor": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0132 (`Active`). Anonymous-actor authorization for public agent surfaces — an opaque, origin-bound, ephemeral, non-cross-linkable, non-PII principal (`run-snapshot.owner.principalKind: \"anonymous\"`) whose authority is a DEFAULT-DENY, explicit per-surface tool grant, never the default-on tool baseline (§C.1). Two tiers: `read` (tenant-scoped, no egress, no secret/BYOK reach — §C.2) and `bounded-write-egress` (writes/egress permitted ONLY behind a mandatory HITL/approval gate (RFC 0051) OR a hard rate-limit + per-session cap, over the RFC 0076 §B / RFC 0079 SSRF-guarded audience-bound egress path, never attaching a tenant credential out-of-audience — §C.3). Every anon tool call emits `authorization.decided` (RFC 0049) attributable to the opaque session id, carrying no PII/credential (§D). The block is OMITTED ENTIRELY when unsupported (const-true `supported`, `dataResidency`-style — never `supported: false`). Absent ⇒ the host runs no tool-enabled public surface under RFC 0132 (e.g. a no-tools single-turn public gateway needs no advertisement).",
-      "required": ["supported", "tiers"],
+      "description": "RFC 0132 (`Active`). Anonymous-actor authorization for public agent surfaces \u2014 an opaque, origin-bound, ephemeral, non-cross-linkable, non-PII principal (`run-snapshot.owner.principalKind: \"anonymous\"`) whose authority is a DEFAULT-DENY, explicit per-surface tool grant, never the default-on tool baseline (\u00a7C.1). Two tiers: `read` (tenant-scoped, no egress, no secret/BYOK reach \u2014 \u00a7C.2) and `bounded-write-egress` (writes/egress permitted ONLY behind a mandatory HITL/approval gate (RFC 0051) OR a hard rate-limit + per-session cap, over the RFC 0076 \u00a7B / RFC 0079 SSRF-guarded audience-bound egress path, never attaching a tenant credential out-of-audience \u2014 \u00a7C.3). Every anon tool call emits `authorization.decided` (RFC 0049) attributable to the opaque session id, carrying no PII/credential (\u00a7D). The block is OMITTED ENTIRELY when unsupported (const-true `supported`, `dataResidency`-style \u2014 never `supported: false`). Absent \u21d2 the host runs no tool-enabled public surface under RFC 0132 (e.g. a no-tools single-turn public gateway needs no advertisement).",
+      "required": [
+        "supported",
+        "tiers"
+      ],
       "properties": {
         "supported": {
           "const": true,
-          "description": "RFC 0132. Present-and-true when the host honors anonymous-actor authorization per §C. The block is omitted entirely when the host runs no tool-enabled public surface (never `supported: false`)."
+          "description": "RFC 0132. Present-and-true when the host honors anonymous-actor authorization per \u00a7C. The block is omitted entirely when the host runs no tool-enabled public surface (never `supported: false`)."
         },
         "tiers": {
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "enum": ["read", "bounded-write-egress"] },
-          "description": "RFC 0132 §B. The anon capability tiers this host BEHAVIORALLY honors (truthful-advertisement — a tier the host does not enforce per §C is a dishonest claim; `OPENWOP_REQUIRE_BEHAVIOR=true` MUST fail it). `read`: tenant-scoped reads, no egress, no secrets (§C.2). `bounded-write-egress`: writes/egress ONLY behind a §C.3 control."
+          "items": {
+            "enum": [
+              "read",
+              "bounded-write-egress"
+            ]
+          },
+          "description": "RFC 0132 \u00a7B. The anon capability tiers this host BEHAVIORALLY honors (truthful-advertisement \u2014 a tier the host does not enforce per \u00a7C is a dishonest claim; `OPENWOP_REQUIRE_BEHAVIOR=true` MUST fail it). `read`: tenant-scoped reads, no egress, no secrets (\u00a7C.2). `bounded-write-egress`: writes/egress ONLY behind a \u00a7C.3 control."
         },
         "writeEgressControls": {
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "enum": ["hitl", "rate-limit-session-cap"] },
-          "description": "RFC 0132 §B. REQUIRED and non-empty IFF `bounded-write-egress` ∈ `tiers`; MUST be absent otherwise. The mandatory control(s) the host enforces before an anon write/egress: `hitl` = a per-action approval gate (RFC 0051 — the action suspends pending a human decision); `rate-limit-session-cap` = a hard per-IP/per-window rate limit AND a per-session action cap. A `bounded-write-egress` tier with no advertised control is the fail-open shape §B.2 forbids."
+          "items": {
+            "enum": [
+              "hitl",
+              "rate-limit-session-cap"
+            ]
+          },
+          "description": "RFC 0132 \u00a7B. REQUIRED and non-empty IFF `bounded-write-egress` \u2208 `tiers`; MUST be absent otherwise. The mandatory control(s) the host enforces before an anon write/egress: `hitl` = a per-action approval gate (RFC 0051 \u2014 the action suspends pending a human decision); `rate-limit-session-cap` = a hard per-IP/per-window rate limit AND a per-session action cap. A `bounded-write-egress` tier with no advertised control is the fail-open shape \u00a7B.2 forbids."
         },
         "failClosed": {
           "const": true,
@@ -535,20 +680,40 @@
       },
       "allOf": [
         {
-          "$comment": "RFC 0132 §B.2 — writeEgressControls is REQUIRED and non-empty when bounded-write-egress is advertised, and MUST be absent otherwise (a control-less write/egress tier is the fail-open shape this RFC forbids).",
+          "$comment": "RFC 0132 \u00a7B.2 \u2014 writeEgressControls is REQUIRED and non-empty when bounded-write-egress is advertised, and MUST be absent otherwise (a control-less write/egress tier is the fail-open shape this RFC forbids).",
           "if": {
-            "properties": { "tiers": { "contains": { "const": "bounded-write-egress" } } },
-            "required": ["tiers"]
+            "properties": {
+              "tiers": {
+                "contains": {
+                  "const": "bounded-write-egress"
+                }
+              }
+            },
+            "required": [
+              "tiers"
+            ]
+          },
+          "then": {
+            "required": [
+              "writeEgressControls"
+            ]
           },
-          "then": { "required": ["writeEgressControls"] },
-          "else": { "not": { "required": ["writeEgressControls"] } }
+          "else": {
+            "not": {
+              "required": [
+                "writeEgressControls"
+              ]
+            }
+          }
         }
       ]
     },
     "credentials": {
       "type": "object",
-      "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract — sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY — never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
-      "required": ["supported"],
+      "description": "RFC 0046 (`Draft`). Portable credential resolution + lifecycle contract \u2014 sibling to `secrets`, first-class store-at-rest + workspace sharing + two-key-overlap rotation. A pack references a credential by `{ ref, scope }` (see `credential-reference.schema.json`); the host resolves it into the node sandbox ONLY \u2014 never into inputs, persisted variables, channels, any run.* event payload, the debug bundle, or replay state (SECURITY invariant `credential-payload-redaction`). Supersedes the informal BYOK annex; the `secrets` advertisement stays valid.",
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -556,7 +721,14 @@
         },
         "scopes": {
           "type": "array",
-          "items": { "type": "string", "enum": ["user", "workspace", "tenant"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "user",
+              "workspace",
+              "tenant"
+            ]
+          },
           "uniqueItems": true,
           "description": "Subset of resolution scopes the host implements. `workspace` is the RFC 0048 sub-tenant; `tenant` and `user` align with the `secrets.scopes` vocabulary."
         },
@@ -566,7 +738,10 @@
         },
         "rotation": {
           "type": "string",
-          "enum": ["none", "two-key-overlap"],
+          "enum": [
+            "none",
+            "two-key-overlap"
+          ],
           "description": "`two-key-overlap`: old + new credential both resolve as valid during a grace window, then the old fails with `credential_not_found` (mirrors `openwop-auth-api-key-rotation`). `none`: no rotation surface."
         },
         "sharing": {
@@ -578,8 +753,10 @@
     },
     "feedback": {
       "type": "object",
-      "description": "RFC 0056 (`Draft`). Non-blocking human/agent quality signals (rating / correction / label / flag) attached to a run, event, or node. Annotations are a per-run side-resource recorded via `POST /v1/runs/{runId}/annotations`, listed via `GET`, and surfaced live via the `run.annotated` SSE notification — they are NOT entries in the replayable run event log (see RFC 0056 §B/§D). Hosts that do not advertise `supported: true` return `501 capability_not_provided` on the annotation endpoints.",
-      "required": ["supported"],
+      "description": "RFC 0056 (`Draft`). Non-blocking human/agent quality signals (rating / correction / label / flag) attached to a run, event, or node. Annotations are a per-run side-resource recorded via `POST /v1/runs/{runId}/annotations`, listed via `GET`, and surfaced live via the `run.annotated` SSE notification \u2014 they are NOT entries in the replayable run event log (see RFC 0056 \u00a7B/\u00a7D). Hosts that do not advertise `supported: true` return `501 capability_not_provided` on the annotation endpoints.",
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -587,13 +764,28 @@
         },
         "targets": {
           "type": "array",
-          "items": { "type": "string", "enum": ["run", "event", "node"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "run",
+              "event",
+              "node"
+            ]
+          },
           "uniqueItems": true,
           "description": "Which annotation-target granularities the host accepts. Absent = `run` only."
         },
         "signals": {
           "type": "array",
-          "items": { "type": "string", "enum": ["rating", "correction", "label", "flag"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "rating",
+              "correction",
+              "label",
+              "flag"
+            ]
+          },
           "uniqueItems": true,
           "description": "Which signal kinds the host accepts. Absent = all four."
         }
@@ -602,7 +794,7 @@
     },
     "replay": {
       "type": "object",
-      "description": "Replay / fork surface (`spec/v1/replay.md`; profile `openwop-replay-fork`). DECLARED FOR THE FIRST TIME BY RFC 0140 — hosts have emitted this block since the fork endpoint shipped, but it was never in this schema and validated only via the root's `additionalProperties: true`. The pre-existing fields are declared here exactly as already emitted and consumed, so no host's current document is invalidated; `additionalProperties` stays permissive for the same reason.",
+      "description": "Replay / fork surface (`spec/v1/replay.md`; profile `openwop-replay-fork`). DECLARED FOR THE FIRST TIME BY RFC 0140 \u2014 hosts have emitted this block since the fork endpoint shipped, but it was never in this schema and validated only via the root's `additionalProperties: true`. The pre-existing fields are declared here exactly as already emitted and consumed, so no host's current document is invalidated; `additionalProperties` stays permissive for the same reason.",
       "properties": {
         "supported": {
           "type": "boolean",
@@ -610,7 +802,13 @@
         },
         "modes": {
           "type": "array",
-          "items": { "type": "string", "enum": ["replay", "branch"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "replay",
+              "branch"
+            ]
+          },
           "uniqueItems": true,
           "description": "Fork modes the host implements. `replay` = deterministic re-execution; `branch` = divergent execution with an optional `runOptionsOverlay`. A host supporting only `branch` still satisfies the `openwop-replay-fork` predicate."
         },
@@ -624,28 +822,43 @@
             "windowSeconds": {
               "type": "integer",
               "minimum": 0,
-              "description": "How long a run stays fork-eligible (`replay.md` §\"Retention and garbage collection\"). OPTIONAL — the spec requires hosts to document retention, not to advertise the window."
+              "description": "How long a run stays fork-eligible (`replay.md` \u00a7\"Retention and garbage collection\"). OPTIONAL \u2014 the spec requires hosts to document retention, not to advertise the window."
             }
           },
           "description": "OPTIONAL retention metadata."
         },
         "sideEffectSuppression": {
           "type": "string",
-          "enum": ["recorded-outcome", "none"],
+          "enum": [
+            "recorded-outcome",
+            "none"
+          ],
           "default": "none",
-          "description": "RFC 0140. An ASSURANCE ADVERTISEMENT of the mechanism by which the host meets `replay.md` §\"Determinism guarantees\" caveat 1 for a `mode:\"replay\"` fork — NOT a gate on the obligation, which is unconditional. `recorded-outcome`: a side-effecting node does NOT execute during a replay — the host reproduces the source run's recorded terminal outcome for the same `(nodeId, attempt)`, or fails the node closed with `replay_source_missing`. The guarantee is WHOLE-RUN: a host MUST NOT advertise it if any class of side-effecting node can still fire during a replay (a partial guarantee would violate `replay.md` §C.2 observable-state equivalence for the unsuppressed classes). `none` (default; absent means this) — NO mechanism is declared. The host remains bound by `replay.md` §\"Determinism guarantees\" caveat 1 (an unconditional MUST that a node calling an external API consult the durable invocation log, so the external system is NOT called twice) exactly as before; conformance simply has nothing to probe. This is NOT permission to re-fire effects. Scoped to `replay` mode; `branch` is a new execution whose effects the operator asked for."
+          "description": "RFC 0140. An ASSURANCE ADVERTISEMENT of the mechanism by which the host meets `replay.md` \u00a7\"Determinism guarantees\" caveat 1 for a `mode:\"replay\"` fork \u2014 NOT a gate on the obligation, which is unconditional. `recorded-outcome`: a side-effecting node does NOT execute during a replay \u2014 the host reproduces the source run's recorded terminal outcome for the same `(nodeId, attempt)`, or fails the node closed with `replay_source_missing`. The guarantee is WHOLE-RUN: a host MUST NOT advertise it if any class of side-effecting node can still fire during a replay (a partial guarantee would violate `replay.md` \u00a7C.2 observable-state equivalence for the unsuppressed classes). `none` (default; absent means this) \u2014 NO mechanism is declared. The host remains bound by `replay.md` \u00a7\"Determinism guarantees\" caveat 1 (an unconditional MUST that a node calling an external API consult the durable invocation log, so the external system is NOT called twice) exactly as before; conformance simply has nothing to probe. This is NOT permission to re-fire effects. Scoped to `replay` mode; `branch` is a new execution whose effects the operator asked for."
         }
       }
     },
     "oauth": {
       "type": "object",
       "description": "RFC 0047 (`Draft`). Host performs OAuth 2.0 grants (authorization-code + refresh) on a user's behalf for connector nodes, stores the acquired token as a `host.credentials` (RFC 0046) entry, refreshes it transparently, and resolves it into the node sandbox as a bearer token. Token material NEVER crosses the wire (SECURITY invariant `credential-payload-redaction`). Distinct from `auth` host-authentication profiles (RFC 0010 = who is the caller; this = what third-party token a node holds).",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean", "description": "Host implements the host.oauth third-party token acquisition + refresh contract." },
+        "supported": {
+          "type": "boolean",
+          "description": "Host implements the host.oauth third-party token acquisition + refresh contract."
+        },
         "grants": {
           "type": "array",
-          "items": { "type": "string", "enum": ["authorization_code", "client_credentials", "refresh_token"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "authorization_code",
+              "client_credentials",
+              "refresh_token"
+            ]
+          },
           "uniqueItems": true,
           "description": "OAuth 2.0 grant types the host performs on a node's behalf."
         },
@@ -654,12 +867,32 @@
           "description": "Provider catalog the host can acquire tokens for. A connector node's `auth.provider` MUST match an `id` here.",
           "items": {
             "type": "object",
-            "required": ["id"],
+            "required": [
+              "id"
+            ],
             "properties": {
-              "id": { "type": "string", "minLength": 1, "description": "Stable provider id, e.g. `slack`, `google`." },
-              "authUrl": { "type": "string", "format": "uri", "description": "Authorization endpoint." },
-              "tokenUrl": { "type": "string", "format": "uri", "description": "Token endpoint." },
-              "scopesSupported": { "type": "array", "items": { "type": "string" }, "description": "Scopes this provider exposes." }
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Stable provider id, e.g. `slack`, `google`."
+              },
+              "authUrl": {
+                "type": "string",
+                "format": "uri",
+                "description": "Authorization endpoint."
+              },
+              "tokenUrl": {
+                "type": "string",
+                "format": "uri",
+                "description": "Token endpoint."
+              },
+              "scopesSupported": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Scopes this provider exposes."
+              }
             },
             "additionalProperties": false
           }
@@ -670,19 +903,40 @@
     "authorization": {
       "type": "object",
       "description": "RFC 0049 (`Draft`). Maps an RFC 0048 principal's role to scopes (reusing the API-key scope grammar in `auth.md`) and surfaces authorization decisions as `authorization.decided` events. Fail-closed: an absent/unseeded role denies (SECURITY invariant `authorization-fail-closed`).",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean", "description": "Host implements the role→scope authorization-decision contract." },
-        "failClosed": { "const": true, "description": "Absent/unseeded role denies; resolver errors deny. MUST be true when present — see SECURITY invariant `authorization-fail-closed`." },
+        "supported": {
+          "type": "boolean",
+          "description": "Host implements the role\u2192scope authorization-decision contract."
+        },
+        "failClosed": {
+          "const": true,
+          "description": "Absent/unseeded role denies; resolver errors deny. MUST be true when present \u2014 see SECURITY invariant `authorization-fail-closed`."
+        },
         "roles": {
           "type": "array",
           "description": "Role catalog. A principal's role resolves to this scope set; a request is authorized when any role-derived scope matches the required scope per the API-key scope-match semantics.",
           "items": {
             "type": "object",
-            "required": ["role", "scopes"],
+            "required": [
+              "role",
+              "scopes"
+            ],
             "properties": {
-              "role": { "type": "string", "minLength": 1 },
-              "scopes": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+              "role": {
+                "type": "string",
+                "minLength": 1
+              },
+              "scopes": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "uniqueItems": true
+              }
             },
             "additionalProperties": false
           }
@@ -692,14 +946,19 @@
     },
     "runtimeCapabilities": {
       "type": "array",
-      "items": { "type": "string", "minLength": 1 },
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
       "uniqueItems": true,
-      "description": "Optional v1 host-advertised opaque capability ids that NodeModules may declare in `NodeModule.requires`. Naming convention: dotted, domain-scoped (`chat.sendPrompt`, `canvas.write`, `secrets.byok`). Provider value shapes are documented per-capability alongside consumers, NOT in the protocol package — the protocol owns the *check*, not domain provider contracts. A client that submits a workflow whose nodes declare a `requires` entry SHOULD first verify the host advertises that capability; a host that lacks a capability MUST refuse to dispatch nodes that declare it, terminating the run with `RunSnapshot.error.code = 'capability_not_provided'`. See `capabilities.md` §\"Runtime capabilities\"."
+      "description": "Optional v1 host-advertised opaque capability ids that NodeModules may declare in `NodeModule.requires`. Naming convention: dotted, domain-scoped (`chat.sendPrompt`, `canvas.write`, `secrets.byok`). Provider value shapes are documented per-capability alongside consumers, NOT in the protocol package \u2014 the protocol owns the *check*, not domain provider contracts. A client that submits a workflow whose nodes declare a `requires` entry SHOULD first verify the host advertises that capability; a host that lacks a capability MUST refuse to dispatch nodes that declare it, terminating the run with `RunSnapshot.error.code = 'capability_not_provided'`. See `capabilities.md` \u00a7\"Runtime capabilities\"."
     },
     "multiPartyConversation": {
       "type": "object",
-      "description": "RFC 0101 — Multi-party group conversation (shared transcript + speaker attribution). When advertised with `supported: true`, the host honors the RFC 0101 normative contract: (1) it accepts an OPTIONAL `participants: AgentRef[]` roster on `conversation.opened` (`conversation-event.schema.json`); (2) it REQUIRES a `speakerId` (the roster INSTANCE id, `host:<id>` per RFC 0086) on every `role: 'agent'` turn; and (3) when a `participants` roster is present it MUST reject a turn whose `speakerId` is not a roster member. Absent block ⇒ no advertisement: the host runs single-agent conversations (RFC 0005) and treats `participants`/`speakerId` as opaque, unenforced fields. Advertising `supported: true` without honoring (1)+(2)+(3) is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated conformance scenarios). Host product policy — turn-taking order, round count, synchronous vs. async rounds — stays NON-normative (RFC 0101 §Spec); only roster membership, agent-turn attribution, and this capability are normative. Requires `conversationPrimitive: true` (RFC 0005) — this block extends the single-agent conversation primitive, it does not replace it.",
-      "required": ["supported"],
+      "description": "RFC 0101 \u2014 Multi-party group conversation (shared transcript + speaker attribution). When advertised with `supported: true`, the host honors the RFC 0101 normative contract: (1) it accepts an OPTIONAL `participants: AgentRef[]` roster on `conversation.opened` (`conversation-event.schema.json`); (2) it REQUIRES a `speakerId` (the roster INSTANCE id, `host:<id>` per RFC 0086) on every `role: 'agent'` turn; and (3) when a `participants` roster is present it MUST reject a turn whose `speakerId` is not a roster member. Absent block \u21d2 no advertisement: the host runs single-agent conversations (RFC 0005) and treats `participants`/`speakerId` as opaque, unenforced fields. Advertising `supported: true` without honoring (1)+(2)+(3) is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated conformance scenarios). Host product policy \u2014 turn-taking order, round count, synchronous vs. async rounds \u2014 stays NON-normative (RFC 0101 \u00a7Spec); only roster membership, agent-turn attribution, and this capability are normative. Requires `conversationPrimitive: true` (RFC 0005) \u2014 this block extends the single-agent conversation primitive, it does not replace it.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
         "supported": {
@@ -709,14 +968,16 @@
         "maxParticipants": {
           "type": "integer",
           "minimum": 2,
-          "description": "RFC 0101. OPTIONAL host ceiling on the size of the `conversation.opened.participants` roster. A multi-party council has at least 2 participants. When advertised, the host MUST reject a `conversation.opened` whose `participants` array exceeds this count. Absent ⇒ the host does not bound the roster size on the wire."
+          "description": "RFC 0101. OPTIONAL host ceiling on the size of the `conversation.opened.participants` roster. A multi-party council has at least 2 participants. When advertised, the host MUST reject a `conversation.opened` whose `participants` array exceeds this count. Absent \u21d2 the host does not bound the roster size on the wire."
         }
       }
     },
     "conversationTurnModelProvenance": {
       "type": "object",
-      "description": "RFC 0109 — Conversation-turn model provenance. When advertised with `supported: true`, the host stamps the OPTIONAL `agent.model` object (`{ provider, model }`) on `role: 'agent'` conversation turns (`conversation-turn.schema.json`), recording which model produced the turn. The stamp is NON-SECRET + NON-PII (`additionalProperties: false` on `agent.model` forbids any credential/endpoint/prompt — the SR-1 guard) and is read VERBATIM on `:fork` (never re-resolved, so a forked transcript preserves the original provenance). Absent block ⇒ no advertisement: the host omits `agent.model` and treats it as an opaque, unenforced field. Advertising `supported: true` without stamping is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated scenario). Additive over RFC 0005 — extends the conversation primitive, does not replace it.",
-      "required": ["supported"],
+      "description": "RFC 0109 \u2014 Conversation-turn model provenance. When advertised with `supported: true`, the host stamps the OPTIONAL `agent.model` object (`{ provider, model }`) on `role: 'agent'` conversation turns (`conversation-turn.schema.json`), recording which model produced the turn. The stamp is NON-SECRET + NON-PII (`additionalProperties: false` on `agent.model` forbids any credential/endpoint/prompt \u2014 the SR-1 guard) and is read VERBATIM on `:fork` (never re-resolved, so a forked transcript preserves the original provenance). Absent block \u21d2 no advertisement: the host omits `agent.model` and treats it as an opaque, unenforced field. Advertising `supported: true` without stamping is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated scenario). Additive over RFC 0005 \u2014 extends the conversation primitive, does not replace it.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
         "supported": {
@@ -727,8 +988,10 @@
     },
     "channelPresence": {
       "type": "object",
-      "description": "RFC 0110 — Channel presence (online + typing). When advertised with `supported: true`, the host emits the OPTIONAL `channel.presence` RunEvent (`channel-presence-payload.schema.json`) for a `type:'channel'` conversation, carrying the currently-present member subject refs + optional per-member typing. Presence is EPHEMERAL live state: the host MUST NOT persist it to the replayable event log / transcript and it MUST NOT affect replay or `:fork` (the load-bearing distinction from the persisted `conversation.exchanged` turn). Membership-gated: every ref MUST be a current participant and the event MUST NOT be delivered to a non-member (DEFAULT-DENY, CTI-1). NON-PII (opaque RFC 0041 subject refs only). Absent block ⇒ no advertisement: the host emits no presence. Advertising `supported: true` without emitting is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated scenario). Additive over RFC 0005.",
-      "required": ["supported"],
+      "description": "RFC 0110 \u2014 Channel presence (online + typing). When advertised with `supported: true`, the host emits the OPTIONAL `channel.presence` RunEvent (`channel-presence-payload.schema.json`) for a `type:'channel'` conversation, carrying the currently-present member subject refs + optional per-member typing. Presence is EPHEMERAL live state: the host MUST NOT persist it to the replayable event log / transcript and it MUST NOT affect replay or `:fork` (the load-bearing distinction from the persisted `conversation.exchanged` turn). Membership-gated: every ref MUST be a current participant and the event MUST NOT be delivered to a non-member (DEFAULT-DENY, CTI-1). NON-PII (opaque RFC 0041 subject refs only). Absent block \u21d2 no advertisement: the host emits no presence. Advertising `supported: true` without emitting is a dishonest wire claim (`OPENWOP_REQUIRE_BEHAVIOR=true` fails the gated scenario). Additive over RFC 0005.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
         "supported": {
@@ -739,78 +1002,111 @@
     },
     "multiAgent": {
       "type": "object",
-      "description": "RFC 0037 — Multi-agent execution model + handoff state machine. Hosts that advertise implement the supervisor→dispatch→harvest loop + the 4-state handoff state machine + the `core.workflowChain.event` emission contract per spec/v1/multi-agent-execution.md. Absent block = host implements RFCs 0006/0007/0022 individually with implementation flexibility on integration semantics; conformance scenarios gating on this flag soft-skip on absence.",
+      "description": "RFC 0037 \u2014 Multi-agent execution model + handoff state machine. Hosts that advertise implement the supervisor\u2192dispatch\u2192harvest loop + the 4-state handoff state machine + the `core.workflowChain.event` emission contract per spec/v1/multi-agent-execution.md. Absent block = host implements RFCs 0006/0007/0022 individually with implementation flexibility on integration semantics; conformance scenarios gating on this flag soft-skip on absence.",
       "additionalProperties": false,
       "properties": {
         "executionModel": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["supported", "version"],
+          "required": [
+            "supported",
+            "version"
+          ],
           "if": {
-            "properties": { "tier": { "const": "experimental" } },
-            "required": ["tier"]
+            "properties": {
+              "tier": {
+                "const": "experimental"
+              }
+            },
+            "required": [
+              "tier"
+            ]
           },
           "then": {
-            "required": ["experimentalUntil"]
+            "required": [
+              "experimentalUntil"
+            ]
           },
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "Host implements the execution loop + handoff state machine per spec/v1/multi-agent-execution.md §\"Execution loop\" + §\"Handoff state machine\". When true, the host MUST emit `core.workflowChain.event` records on every handoff transition per the §\"Transition events\" table."
+              "description": "Host implements the execution loop + handoff state machine per spec/v1/multi-agent-execution.md \u00a7\"Execution loop\" + \u00a7\"Handoff state machine\". When true, the host MUST emit `core.workflowChain.event` records on every handoff transition per the \u00a7\"Transition events\" table."
             },
             "tier": {
               "type": "string",
-              "enum": ["stable", "experimental"],
+              "enum": [
+                "stable",
+                "experimental"
+              ],
               "default": "stable",
-              "description": "RFC 0042 — stability claim for this capability advertisement. `stable` (the default when absent) means the host commits to the wire shape across v1.x minors. `experimental` means the host advertises the surface as a preview; the wire shape MAY shift compatibly without notice until the underlying RFC graduates to `Accepted` and the host re-advertises as `stable`. Hosts MUST omit the field for capabilities whose underlying RFC is already `Accepted`."
+              "description": "RFC 0042 \u2014 stability claim for this capability advertisement. `stable` (the default when absent) means the host commits to the wire shape across v1.x minors. `experimental` means the host advertises the surface as a preview; the wire shape MAY shift compatibly without notice until the underlying RFC graduates to `Accepted` and the host re-advertises as `stable`. Hosts MUST omit the field for capabilities whose underlying RFC is already `Accepted`."
             },
             "experimentalUntil": {
               "type": "string",
               "format": "date",
               "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
-              "description": "RFC 0042 §B — required when `tier` is `experimental`. ISO-8601 `YYYY-MM-DD` no more than 12 months past the discovery response date. Reaching this date without graduating the underlying RFC to `Accepted` MUST result in the host either flipping tier to `stable` OR retracting the capability advertisement (or — with an open deprecation RFC — extending with a new `experimentalUntil` per §B sub-block 2)."
+              "description": "RFC 0042 \u00a7B \u2014 required when `tier` is `experimental`. ISO-8601 `YYYY-MM-DD` no more than 12 months past the discovery response date. Reaching this date without graduating the underlying RFC to `Accepted` MUST result in the host either flipping tier to `stable` OR retracting the capability advertisement (or \u2014 with an open deprecation RFC \u2014 extending with a new `experimentalUntil` per \u00a7B sub-block 2)."
             },
             "version": {
               "type": "integer",
               "minimum": 1,
               "maximum": 6,
-              "description": "Profile version. 1 = Phase 1 (execution-loop framework + planner→worker handoff). 2 = Phase 2 (confidence-floor escalation + agent-memory lifecycle, RFC 0039). 3 = Phase 3 (cross-host causation, RFC 0040). 4 = Phase 4 (replay determinism under nondeterministic models, RFC 0041). 5 = Phase 5 (stateful agent-loop lifecycle — per-iteration workspace+memory snapshot inputs, the observable `iteration` counter on `runOrchestrator.decided`, and stateful HITL resume, RFC 0061). 6 = Phase 6 (verifier/critic turn — the `agent.verified` event + `successCriteria` on the `terminate` decision, RFC 0090). A host advertising `version: N` MUST implement all phases 1..N additively."
+              "description": "Profile version. 1 = Phase 1 (execution-loop framework + planner\u2192worker handoff). 2 = Phase 2 (confidence-floor escalation + agent-memory lifecycle, RFC 0039). 3 = Phase 3 (cross-host causation, RFC 0040). 4 = Phase 4 (replay determinism under nondeterministic models, RFC 0041). 5 = Phase 5 (stateful agent-loop lifecycle \u2014 per-iteration workspace+memory snapshot inputs, the observable `iteration` counter on `runOrchestrator.decided`, and stateful HITL resume, RFC 0061). 6 = Phase 6 (verifier/critic turn \u2014 the `agent.verified` event + `successCriteria` on the `terminate` decision, RFC 0090). A host advertising `version: N` MUST implement all phases 1..N additively."
             },
             "verifier": {
               "type": "object",
               "additionalProperties": false,
-              "required": ["supported"],
-              "description": "RFC 0090 (`version >= 6`). The verifier/critic turn: the host emits `agent.verified` over a prior result and (optionally) gates commit on the verdict. Absent ⇒ no verifier turn; conformance scenarios soft-skip.",
+              "required": [
+                "supported"
+              ],
+              "description": "RFC 0090 (`version >= 6`). The verifier/critic turn: the host emits `agent.verified` over a prior result and (optionally) gates commit on the verdict. Absent \u21d2 no verifier turn; conformance scenarios soft-skip.",
               "properties": {
-                "supported": { "type": "boolean", "description": "Host emits `agent.verified` and honors RFC 0090 §A. Applies only when `version >= 6`." },
-                "gating": { "type": "boolean", "description": "Host enforces the RFC 0090 §B commit-gating contract: a `fail` verdict blocks merge/terminate (fail-closed, composing RFC 0063); `revise` routes back to an actor turn. Absent/false ⇒ the verdict is observability-only." }
+                "supported": {
+                  "type": "boolean",
+                  "description": "Host emits `agent.verified` and honors RFC 0090 \u00a7A. Applies only when `version >= 6`."
+                },
+                "gating": {
+                  "type": "boolean",
+                  "description": "Host enforces the RFC 0090 \u00a7B commit-gating contract: a `fail` verdict blocks merge/terminate (fail-closed, composing RFC 0063); `revise` routes back to an actor turn. Absent/false \u21d2 the verdict is observability-only."
+                }
               }
             },
             "confidenceEscalationFloor": {
               "type": "number",
               "minimum": 0.5,
               "maximum": 1.0,
-              "description": "RFC 0039 §A. Operator-declared confidence floor at or above the spec floor of 0.5; when an OrchestratorDecision carries `confidence` below this floor, the host MUST escalate via a `clarify` or `escalate` interrupt instead of executing the decision. Absent: the spec floor 0.5 applies. Values < 0.5 are non-conformant; values > 1.0 are nonsense. Applies only when `version >= 2`."
+              "description": "RFC 0039 \u00a7A. Operator-declared confidence floor at or above the spec floor of 0.5; when an OrchestratorDecision carries `confidence` below this floor, the host MUST escalate via a `clarify` or `escalate` interrupt instead of executing the decision. Absent: the spec floor 0.5 applies. Values < 0.5 are non-conformant; values > 1.0 are nonsense. Applies only when `version >= 2`."
             },
             "confidenceEscalationInterruptKind": {
               "type": "string",
               "anyOf": [
-                { "const": "clarification" },
-                { "const": "approval" },
-                { "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$" }
+                {
+                  "const": "clarification"
+                },
+                {
+                  "const": "approval"
+                },
+                {
+                  "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$"
+                }
               ],
-              "description": "RFC 0044 — the literal `interrupt.kind` the host emits when escalating a below-floor confidence decision per RFC 0039 §A. `clarification` and `approval` are the canonical values matching the clarify-OR-approval choice in RFC 0039 §A; vendor-extension kinds use the canonical host-extension namespace `^x-host-<host>-<kind>$` per `spec/v1/host-extensions.md` §\"Canonical prefixes\". When advertised, hosts MUST emit an interrupt of the advertised kind on every confidence-escalation event AND the host's downstream `interrupt.md` mapping determines the `waiting-*` terminal status. Absent: conformance assumes the host uses one of the two canonical kinds (the relaxed assertion accepts either). Hosts using vendor kinds MUST also publish a non-normative kind-mapping document per RFC 0044 §C."
+              "description": "RFC 0044 \u2014 the literal `interrupt.kind` the host emits when escalating a below-floor confidence decision per RFC 0039 \u00a7A. `clarification` and `approval` are the canonical values matching the clarify-OR-approval choice in RFC 0039 \u00a7A; vendor-extension kinds use the canonical host-extension namespace `^x-host-<host>-<kind>$` per `spec/v1/host-extensions.md` \u00a7\"Canonical prefixes\". When advertised, hosts MUST emit an interrupt of the advertised kind on every confidence-escalation event AND the host's downstream `interrupt.md` mapping determines the `waiting-*` terminal status. Absent: conformance assumes the host uses one of the two canonical kinds (the relaxed assertion accepts either). Hosts using vendor kinds MUST also publish a non-normative kind-mapping document per RFC 0044 \u00a7C."
             },
             "crossChildMemoryConcurrency": {
               "type": "string",
-              "enum": ["strict", "advisory"],
-              "description": "RFC 0039 §B. Cross-child memory-write concurrency posture when version >= 2. `strict` (default when absent): the host serializes concurrent writes from sibling dispatched children to the parent's shared memory scope. `advisory`: the host opts out of the serialization MUST and documents last-write-wins semantics out-of-band. Hosts that choose advisory SHOULD also advertise their resolution rule under `crossChildMemoryConcurrencyResolution` (reserved field; follow-up clarification)."
+              "enum": [
+                "strict",
+                "advisory"
+              ],
+              "description": "RFC 0039 \u00a7B. Cross-child memory-write concurrency posture when version >= 2. `strict` (default when absent): the host serializes concurrent writes from sibling dispatched children to the parent's shared memory scope. `advisory`: the host opts out of the serialization MUST and documents last-write-wins semantics out-of-band. Hosts that choose advisory SHOULD also advertise their resolution rule under `crossChildMemoryConcurrencyResolution` (reserved field; follow-up clarification)."
             },
             "crossHostCausation": {
               "type": "object",
-              "description": "RFC 0040 §D — Phase 3 cross-host causation linking. When advertised, the host honors the cross-host `causationId` extension (a `causationHostId` field on event payloads pointing at the originating host), W3C `traceparent` propagation across MCP + A2A composition boundaries, and (when `ancestryEndpointSupported: true`) the `GET /v1/runs/{runId}/ancestry` cross-host parent-chain endpoint. Hosts advertising `version: 3` MUST advertise this sub-block with `supported: true` and a stable `hostId`.",
+              "description": "RFC 0040 \u00a7D \u2014 Phase 3 cross-host causation linking. When advertised, the host honors the cross-host `causationId` extension (a `causationHostId` field on event payloads pointing at the originating host), W3C `traceparent` propagation across MCP + A2A composition boundaries, and (when `ancestryEndpointSupported: true`) the `GET /v1/runs/{runId}/ancestry` cross-host parent-chain endpoint. Hosts advertising `version: 3` MUST advertise this sub-block with `supported: true` and a stable `hostId`.",
               "additionalProperties": false,
-              "required": ["supported"],
+              "required": [
+                "supported"
+              ],
               "properties": {
                 "supported": {
                   "type": "boolean",
@@ -823,15 +1119,17 @@
                 },
                 "ancestryEndpointSupported": {
                   "type": "boolean",
-                  "description": "Host serves `GET /v1/runs/{runId}/ancestry` returning the cross-host parent chain per RFC 0040 §C. Optional even when crossHostCausation.supported is true — hosts that emit `causationHostId` but don't expose the ancestry-walking endpoint still satisfy the per-event chaining contract; this flag advertises the additional endpoint."
+                  "description": "Host serves `GET /v1/runs/{runId}/ancestry` returning the cross-host parent chain per RFC 0040 \u00a7C. Optional even when crossHostCausation.supported is true \u2014 hosts that emit `causationHostId` but don't expose the ancestry-walking endpoint still satisfy the per-event chaining contract; this flag advertises the additional endpoint."
                 }
               }
             },
             "replayDeterminism": {
               "type": "object",
-              "description": "RFC 0041 §D — Phase 4 replay determinism. When advertised, the host honors the LLM cache-key recipe in `replay.md` §\"LLM cache-key recipe\" as NORMATIVE (graduated from informative for version >= 4), emits `replay.divergedAtRefusal` events + fails with `replay_diverged_at_refusal` on refusal-divergence (RFC 0041 §B), and guarantees observable-output-sequence determinism per RFC 0041 §C. Hosts advertising `version: 4` MUST advertise this sub-block with `supported: true`.",
+              "description": "RFC 0041 \u00a7D \u2014 Phase 4 replay determinism. When advertised, the host honors the LLM cache-key recipe in `replay.md` \u00a7\"LLM cache-key recipe\" as NORMATIVE (graduated from informative for version >= 4), emits `replay.divergedAtRefusal` events + fails with `replay_diverged_at_refusal` on refusal-divergence (RFC 0041 \u00a7B), and guarantees observable-output-sequence determinism per RFC 0041 \u00a7C. Hosts advertising `version: 4` MUST advertise this sub-block with `supported: true`.",
               "additionalProperties": false,
-              "required": ["supported"],
+              "required": [
+                "supported"
+              ],
               "properties": {
                 "supported": {
                   "type": "boolean",
@@ -840,45 +1138,56 @@
                 "llmCacheKeyRecipe": {
                   "type": "string",
                   "anyOf": [
-                    { "const": "spec-rfc-0041" },
-                    { "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$" }
+                    {
+                      "const": "spec-rfc-0041"
+                    },
+                    {
+                      "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$"
+                    }
                   ],
-                  "description": "The LLM cache-key recipe the host honors. `spec-rfc-0041` = the canonical recipe in `replay.md` §\"LLM cache-key recipe\" §A + §B + §C. Vendor-specific recipes use the canonical host-extension namespace string matching `^x-host-<host>-<recipe-name>$` per `spec/v1/host-extensions.md` §\"Canonical prefixes\"; the matching algorithm MUST be documented at the host's discovery doc."
+                  "description": "The LLM cache-key recipe the host honors. `spec-rfc-0041` = the canonical recipe in `replay.md` \u00a7\"LLM cache-key recipe\" \u00a7A + \u00a7B + \u00a7C. Vendor-specific recipes use the canonical host-extension namespace string matching `^x-host-<host>-<recipe-name>$` per `spec/v1/host-extensions.md` \u00a7\"Canonical prefixes\"; the matching algorithm MUST be documented at the host's discovery doc."
                 },
                 "refusalDivergenceEmission": {
                   "type": "boolean",
-                  "description": "Host emits `replay.divergedAtRefusal` events + fails replay with `error.code: replay_diverged_at_refusal` per RFC 0041 §B. Hosts advertising `version: 4` MUST set this to `true`."
+                  "description": "Host emits `replay.divergedAtRefusal` events + fails replay with `error.code: replay_diverged_at_refusal` per RFC 0041 \u00a7B. Hosts advertising `version: 4` MUST set this to `true`."
                 }
               }
             },
             "statefulResume": {
               "type": "boolean",
-              "description": "RFC 0061 (`version >= 5`). When `true`, a `clarify`/`escalate` HITL suspend resumes the execution loop at the SAME iteration — the `runOrchestrator.decided.iteration` counter does not reset or skip — with the per-iteration memory (RFC 0039 MAE-3) + workspace (RFC 0059) snapshot lineage intact, so a mid-loop human interrupt does not lose progress. A distinct claim from plain replay re-entrancy (deterministic replay of a completed prefix); this is about a LIVE suspend preserving the counter. Omitted by hosts on `version < 5`."
+              "description": "RFC 0061 (`version >= 5`). When `true`, a `clarify`/`escalate` HITL suspend resumes the execution loop at the SAME iteration \u2014 the `runOrchestrator.decided.iteration` counter does not reset or skip \u2014 with the per-iteration memory (RFC 0039 MAE-3) + workspace (RFC 0059) snapshot lineage intact, so a mid-loop human interrupt does not lose progress. A distinct claim from plain replay re-entrancy (deterministic replay of a completed prefix); this is about a LIVE suspend preserving the counter. Omitted by hosts on `version < 5`."
             },
             "transcriptWindow": {
               "type": "integer",
               "minimum": 1,
-              "description": "RFC 0061 (`version >= 5`). Host-advertised count of recent event-log entries the host feeds each orchestrator turn as the iteration's transcript input (§C input 3). Advertise-and-honor; not a fixed wire constant. Absent ⇒ the host does not bound the transcript window on the wire."
+              "description": "RFC 0061 (`version >= 5`). Host-advertised count of recent event-log entries the host feeds each orchestrator turn as the iteration's transcript input (\u00a7C input 3). Advertise-and-honor; not a fixed wire constant. Absent \u21d2 the host does not bound the transcript window on the wire."
             },
             "contextBudget": {
               "type": "object",
-              "description": "RFC 0111 (`Active`, `version >= 5`). Opt-in, token-denominated bound on the orchestrator transcript the host feeds each iteration, plus a declared summarization contract for turns evicted beyond that budget. SCOPE: governs the RFC 0061 per-iteration ORCHESTRATOR-LOOP transcript (`multi-agent-execution.md` §\"Per-iteration state inputs\" input 3 — the same transcript `transcriptWindow` bounds), NOT a general chat-conversation history. A host whose orchestrator loop does not run real model turns (e.g. a mock supervisor) MUST NOT advertise this block, exactly as it MUST NOT dishonestly advertise `transcriptWindow`. Budget-only advertisement (`transcriptTokenBudget` + `tokenCounter` WITHOUT `summarization.supported`) is valid for a host that HAS a real orchestrator loop but does not summarize. Purely additive: a host that omits this block behaves exactly as today, including `transcriptWindow`'s `absent ⇒ unbounded` default (NOT flipped by this RFC). Complements (does not replace) the event-count `transcriptWindow`; when both bound a turn the host MUST honor whichever is tighter. Summarization here is a NONDETERMINISTIC host output governed exactly like an RFC 0041 envelope: each substitution MUST be recorded as a `context.summarized` event whose `summaryRef` artifact replay reuses (never re-summarizes) per `multi-agent-execution.md` §\"Context economy (RFC 0111)\".",
+              "description": "RFC 0111 (`Active`, `version >= 5`). Opt-in, token-denominated bound on the orchestrator transcript the host feeds each iteration, plus a declared summarization contract for turns evicted beyond that budget. SCOPE: governs the RFC 0061 per-iteration ORCHESTRATOR-LOOP transcript (`multi-agent-execution.md` \u00a7\"Per-iteration state inputs\" input 3 \u2014 the same transcript `transcriptWindow` bounds), NOT a general chat-conversation history. A host whose orchestrator loop does not run real model turns (e.g. a mock supervisor) MUST NOT advertise this block, exactly as it MUST NOT dishonestly advertise `transcriptWindow`. Budget-only advertisement (`transcriptTokenBudget` + `tokenCounter` WITHOUT `summarization.supported`) is valid for a host that HAS a real orchestrator loop but does not summarize. Purely additive: a host that omits this block behaves exactly as today, including `transcriptWindow`'s `absent \u21d2 unbounded` default (NOT flipped by this RFC). Complements (does not replace) the event-count `transcriptWindow`; when both bound a turn the host MUST honor whichever is tighter. Summarization here is a NONDETERMINISTIC host output governed exactly like an RFC 0041 envelope: each substitution MUST be recorded as a `context.summarized` event whose `summaryRef` artifact replay reuses (never re-summarizes) per `multi-agent-execution.md` \u00a7\"Context economy (RFC 0111)\".",
               "additionalProperties": false,
               "properties": {
                 "transcriptTokenBudget": {
                   "type": "integer",
                   "minimum": 1,
-                  "description": "RFC 0111. Max tokens of transcript the host feeds any single orchestrator turn, measured in the unit named by `tokenCounter`. Advertise-and-honor; complements (does not replace) `transcriptWindow`. When both are present the host MUST honor whichever bound is tighter for a given turn. Absent ⇒ no token bound on the transcript (only the event-count `transcriptWindow`, if any, applies)."
+                  "description": "RFC 0111. Max tokens of transcript the host feeds any single orchestrator turn, measured in the unit named by `tokenCounter`. Advertise-and-honor; complements (does not replace) `transcriptWindow`. When both are present the host MUST honor whichever bound is tighter for a given turn. Absent \u21d2 no token bound on the transcript (only the event-count `transcriptWindow`, if any, applies)."
                 },
                 "tokenCounter": {
                   "type": "string",
-                  "enum": ["o200k_base", "cl100k_base", "chars", "host-defined"],
-                  "description": "RFC 0111. The unit `transcriptTokenBudget` is denominated in, so the bound is interpretable across hosts. REQUIRED when `transcriptTokenBudget` is present (enforced via the `if/then` clause). `o200k_base`/`cl100k_base` are tokenizer encodings; `chars` counts UTF-8/Unicode characters (a tokenizer-free unit a client can reason about directly); `host-defined` is an opaque host unit. Same enum as RFC 0113 `memory.injectionBudget.tokenCounter` — transcript (0111) and memory (0113) budgets denominate in one consistent vocabulary; no shared `$ref` (decoupled)."
+                  "enum": [
+                    "o200k_base",
+                    "cl100k_base",
+                    "chars",
+                    "host-defined"
+                  ],
+                  "description": "RFC 0111. The unit `transcriptTokenBudget` is denominated in, so the bound is interpretable across hosts. REQUIRED when `transcriptTokenBudget` is present (enforced via the `if/then` clause). `o200k_base`/`cl100k_base` are tokenizer encodings; `chars` counts UTF-8/Unicode characters (a tokenizer-free unit a client can reason about directly); `host-defined` is an opaque host unit. Same enum as RFC 0113 `memory.injectionBudget.tokenCounter` \u2014 transcript (0111) and memory (0113) budgets denominate in one consistent vocabulary; no shared `$ref` (decoupled)."
                 },
                 "summarization": {
                   "type": "object",
                   "additionalProperties": false,
-                  "required": ["supported"],
+                  "required": [
+                    "supported"
+                  ],
                   "description": "RFC 0111. Declared contract for turns evicted beyond `transcriptTokenBudget`. When `supported: true`, the host MAY replace older in-window turns with a host-produced summary; it MUST keep the most recent `keepLastTurns` turns verbatim and MUST NOT summarize the active (most recent) turn. Each substitution MUST be recorded as a `context.summarized` event and is replay-governed under RFC 0041 (replay reuses the recorded `summaryRef`, never re-summarizes).",
                   "properties": {
                     "supported": {
@@ -887,19 +1196,32 @@
                     },
                     "strategy": {
                       "type": "string",
-                      "enum": ["sliding-window", "recursive", "map-reduce"],
-                      "description": "RFC 0111. Informational descriptor of the host's summarization strategy. `sliding-window` keeps a recent verbatim tail and summarizes the prefix; `recursive` folds prior summaries into new ones; `map-reduce` summarizes chunks then combines. Does not change the replay-determinism contract — all strategies record `context.summarized` and reuse `summaryRef` on replay."
+                      "enum": [
+                        "sliding-window",
+                        "recursive",
+                        "map-reduce"
+                      ],
+                      "description": "RFC 0111. Informational descriptor of the host's summarization strategy. `sliding-window` keeps a recent verbatim tail and summarizes the prefix; `recursive` folds prior summaries into new ones; `map-reduce` summarizes chunks then combines. Does not change the replay-determinism contract \u2014 all strategies record `context.summarized` and reuse `summaryRef` on replay."
                     },
                     "keepLastTurns": {
                       "type": "integer",
                       "minimum": 0,
-                      "description": "RFC 0111. Number of most-recent turns kept verbatim at the head of the window; older in-window turns MAY be replaced by a summary. The active (most recent) turn MUST NOT be summarized regardless of this value. Absent ⇒ host-defined verbatim floor."
+                      "description": "RFC 0111. Number of most-recent turns kept verbatim at the head of the window; older in-window turns MAY be replaced by a summary. The active (most recent) turn MUST NOT be summarized regardless of this value. Absent \u21d2 host-defined verbatim floor."
                     }
                   }
                 }
               },
-              "if": { "required": ["transcriptTokenBudget"] },
-              "then": { "required": ["transcriptTokenBudget", "tokenCounter"] }
+              "if": {
+                "required": [
+                  "transcriptTokenBudget"
+                ]
+              },
+              "then": {
+                "required": [
+                  "transcriptTokenBudget",
+                  "tokenCounter"
+                ]
+              }
             }
           }
         }
@@ -907,13 +1229,15 @@
     },
     "modelCapabilities": {
       "type": "object",
-      "description": "RFC 0031. Host implements model-capability gating + (optional) substitution per `NodeModule.requiredModelCapabilities` + `NodeModule.fallbackModel`. Distinct from `runtimeCapabilities` which gates on HOST capabilities — `modelCapabilities` gates on MODEL capabilities (structured-output support, discriminator-enum support, long-context, native reasoning, function-calling). Absent block = no advertisement; NodeModules' `requiredModelCapabilities` are treated as opaque metadata and dispatch proceeds without checks.",
+      "description": "RFC 0031. Host implements model-capability gating + (optional) substitution per `NodeModule.requiredModelCapabilities` + `NodeModule.fallbackModel`. Distinct from `runtimeCapabilities` which gates on HOST capabilities \u2014 `modelCapabilities` gates on MODEL capabilities (structured-output support, discriminator-enum support, long-context, native reasoning, function-calling). Absent block = no advertisement; NodeModules' `requiredModelCapabilities` are treated as opaque metadata and dispatch proceeds without checks.",
       "additionalProperties": false,
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "Host honors `NodeModule.requiredModelCapabilities` and emits `model.capability.substituted` / `model.capability.insufficient` events per RFC 0031 §B + §D. When `false` or absent, the fields are treated as opaque metadata and dispatch proceeds without capability checks."
+          "description": "Host honors `NodeModule.requiredModelCapabilities` and emits `model.capability.substituted` / `model.capability.insufficient` events per RFC 0031 \u00a7B + \u00a7D. When `false` or absent, the fields are treated as opaque metadata and dispatch proceeds without capability checks."
         },
         "advertised": {
           "type": "array",
@@ -922,23 +1246,35 @@
             "pattern": "^([a-z][a-z0-9-]*|x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*)$"
           },
           "uniqueItems": true,
-          "description": "Capability identifiers the host's active model advertises. Clients MAY introspect this at install time to determine whether their NodeModules' `requiredModelCapabilities` are satisfiable without fallback. Spec-reserved identifiers per RFC 0031 §C + RFC 0055: `structured-output`, `discriminator-enum`, `long-context`, `reasoning` (model-native thinking-tokens), `function-calling`, `vision-input` (model accepts image content in the prompt), `audio-input` (model accepts audio content), `audio-output` (model emits audio content), `image-output` (model emits images directly in its completion, distinct from the host-side `aiProviders.imageGeneration` tool surface). This is an open, pattern-validated registry — NOT a closed enum; growth requires an RFC. Host-private extensions MUST prefix with `x-host-<host>-`."
+          "description": "Capability identifiers the host's active model advertises. Clients MAY introspect this at install time to determine whether their NodeModules' `requiredModelCapabilities` are satisfiable without fallback. Spec-reserved identifiers per RFC 0031 \u00a7C + RFC 0055: `structured-output`, `discriminator-enum`, `long-context`, `reasoning` (model-native thinking-tokens), `function-calling`, `vision-input` (model accepts image content in the prompt), `audio-input` (model accepts audio content), `audio-output` (model emits audio content), `image-output` (model emits images directly in its completion, distinct from the host-side `aiProviders.imageGeneration` tool surface). This is an open, pattern-validated registry \u2014 NOT a closed enum; growth requires an RFC. Host-private extensions MUST prefix with `x-host-<host>-`."
         },
         "substitutionSupported": {
           "type": "boolean",
-          "description": "Host honors `NodeModule.fallbackModel` substitution per RFC 0031 §B step 3. When `false` or absent, hosts MUST refuse to dispatch (step 4) on any unmet capability — they MUST NOT attempt fallback even when the field is declared on the NodeModule. Recursive fallback is NOT permitted (RFC 0031 §\"Unresolved questions\" #3)."
+          "description": "Host honors `NodeModule.fallbackModel` substitution per RFC 0031 \u00a7B step 3. When `false` or absent, hosts MUST refuse to dispatch (step 4) on any unmet capability \u2014 they MUST NOT attempt fallback even when the field is declared on the NodeModule. Recursive fallback is NOT permitted (RFC 0031 \u00a7\"Unresolved questions\" #3)."
         }
       }
     },
     "providerUsage": {
       "type": "object",
-      "description": "RFC 0026. Hosts that emit `provider.usage` events after every LLM provider invocation per RFC 0026 §B. The event carries per-call token counts in the durable event log; cost rollup remains in `RunSnapshot.metrics.openwopCost`. Old hosts ignore.",
+      "description": "RFC 0026. Hosts that emit `provider.usage` events after every LLM provider invocation per RFC 0026 \u00a7B. The event carries per-call token counts in the durable event log; cost rollup remains in `RunSnapshot.metrics.openwopCost`. Old hosts ignore.",
       "properties": {
-        "supported": { "type": "boolean", "description": "Host emits one `provider.usage` event per LLM provider call." },
-        "costEstimates": { "type": "boolean", "description": "When true, the host includes `costEstimateUsd` on `provider.usage` events using its internal rate table. When false/absent, only token counts are emitted." },
-        "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "Default ISO 4217 currency for `costEstimateUsd` values. When absent, USD is assumed." }
+        "supported": {
+          "type": "boolean",
+          "description": "Host emits one `provider.usage` event per LLM provider call."
+        },
+        "costEstimates": {
+          "type": "boolean",
+          "description": "When true, the host includes `costEstimateUsd` on `provider.usage` events using its internal rate table. When false/absent, only token counts are emitted."
+        },
+        "currency": {
+          "type": "string",
+          "pattern": "^[A-Z]{3}$",
+          "description": "Default ISO 4217 currency for `costEstimateUsd` values. When absent, USD is assumed."
+        }
       },
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false
     },
     "aiProviders": {
@@ -947,67 +1283,107 @@
       "properties": {
         "supported": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
-          "description": "Provider ids the host's AI-proxy can route to. Conventional ids (RFC 0067 §C recommended vocabulary — advisory, not a closed set): `anthropic`, `openai`, `gemini`, `vertex`, `bedrock`, `mistral`, `cohere`, `openrouter`, `litellm`, `together`, `huggingface`, `qwen`, `ollama`, `vllm`. Hosts MAY add vendor-prefixed extensions; clients MUST tolerate unknown ids."
+          "description": "Provider ids the host's AI-proxy can route to. Conventional ids (RFC 0067 \u00a7C recommended vocabulary \u2014 advisory, not a closed set): `anthropic`, `openai`, `gemini`, `vertex`, `bedrock`, `mistral`, `cohere`, `openrouter`, `litellm`, `together`, `huggingface`, `qwen`, `ollama`, `vllm`. Hosts MAY add vendor-prefixed extensions; clients MUST tolerate unknown ids."
         },
         "byok": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
-          "description": "Subset of `supported` for which BYOK is permitted. Empty array → all calls use platform-managed keys; non-empty → clients MAY pass `ai.credentialRef` in `RunOptions.configurable` for matching providers."
+          "description": "Subset of `supported` for which BYOK is permitted. Empty array \u2192 all calls use platform-managed keys; non-empty \u2192 clients MAY pass `ai.credentialRef` in `RunOptions.configurable` for matching providers."
         },
         "selfHosted": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
-          "description": "RFC 0108. Subset of `supported` whose entries are operator- or tenant-configured OpenAI-compatible endpoints (e.g. an Ollama / vLLM / LM Studio / any `/v1/chat/completions`-compatible server), as opposed to a host-managed connection to a known public vendor. Each entry MUST also appear in `supported`. An entry MAY also appear in `byok` (the endpoint requires a client/tenant-supplied key) or be absent from it (the endpoint needs no key, e.g. a default Ollama). The provider id is an OPAQUE label chosen by the host; it MUST NOT encode the endpoint's network location (scheme, host, port, path, or base-URL) per RFC 0108 §A.3, and the endpoint location MUST NOT be disclosed on any wire surface (see the `self-hosted-endpoint-no-disclosure` SECURITY invariant). A client MUST NOT infer model capabilities from a `selfHosted` id (RFC 0108 §B); the only authoritative capability sources are `modelCapabilities.advertised[]` (RFC 0031) and `aiProviders.input.modalities` (RFC 0091)."
+          "description": "RFC 0108. Subset of `supported` whose entries are operator- or tenant-configured OpenAI-compatible endpoints (e.g. an Ollama / vLLM / LM Studio / any `/v1/chat/completions`-compatible server), as opposed to a host-managed connection to a known public vendor. Each entry MUST also appear in `supported`. An entry MAY also appear in `byok` (the endpoint requires a client/tenant-supplied key) or be absent from it (the endpoint needs no key, e.g. a default Ollama). The provider id is an OPAQUE label chosen by the host; it MUST NOT encode the endpoint's network location (scheme, host, port, path, or base-URL) per RFC 0108 \u00a7A.3, and the endpoint location MUST NOT be disclosed on any wire surface (see the `self-hosted-endpoint-no-disclosure` SECURITY invariant). A client MUST NOT infer model capabilities from a `selfHosted` id (RFC 0108 \u00a7B); the only authoritative capability sources are `modelCapabilities.advertised[]` (RFC 0031) and `aiProviders.input.modalities` (RFC 0091)."
         },
         "speechSynthesis": {
           "const": "supported",
-          "description": "RFC 0105. When present (value MUST be the string `\"supported\"`), the host exposes `ctx.callSpeechSynthesizer({ text, voiceId, mimeType?, format?, languageCode?, ... })` returning a binary audio asset (host-served `url` OR inline `base64` + `mimeType`), paralleling `aiProviders.imageGeneration`. Absent ⇒ no TTS; a call MUST be rejected with `speech_synthesis_unsupported` (never a no-op). Voices are referenced by an opaque host-resolved `voiceId`; the spec does NOT enumerate voices. TTS provider ids are advertised via the existing `aiProviders.supported[]` (the call's `provider?` MUST be a member); there is no `speechSynthesis` sub-field for providers. Per-host model/voice routing is a host choice."
+          "description": "RFC 0105. When present (value MUST be the string `\"supported\"`), the host exposes `ctx.callSpeechSynthesizer({ text, voiceId, mimeType?, format?, languageCode?, ... })` returning a binary audio asset (host-served `url` OR inline `base64` + `mimeType`), paralleling `aiProviders.imageGeneration`. Absent \u21d2 no TTS; a call MUST be rejected with `speech_synthesis_unsupported` (never a no-op). Voices are referenced by an opaque host-resolved `voiceId`; the spec does NOT enumerate voices. TTS provider ids are advertised via the existing `aiProviders.supported[]` (the call's `provider?` MUST be a member); there is no `speechSynthesis` sub-field for providers. Per-host model/voice routing is a host choice."
         },
         "input": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0091. Multimodal PERCEPTION input on `ctx.callAI` — the modalities a `callAI` message ContentPart may carry as model INPUT. Absent ⇒ text-only (today's behavior); a `string` message content is always valid. Distinct from `imageGeneration` (output) and the `ai-envelope.md` media emission types (output).",
+          "description": "RFC 0091. Multimodal PERCEPTION input on `ctx.callAI` \u2014 the modalities a `callAI` message ContentPart may carry as model INPUT. Absent \u21d2 text-only (today's behavior); a `string` message content is always valid. Distinct from `imageGeneration` (output) and the `ai-envelope.md` media emission types (output).",
           "properties": {
             "modalities": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "enum": ["text", "image", "audio", "document"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "text",
+                  "image",
+                  "audio",
+                  "document"
+                ]
+              },
               "description": "Input modalities the host's `callAI` accepts as ContentParts. `text` is implicit even when omitted. A ContentPart whose `type` is not advertised here MUST be rejected with `unsupported_modality` (never silently dropped)."
             },
-            "maxBytesPerPart": { "type": "integer", "minimum": 1, "description": "Optional host cap on a single inline (`data`) or `mediaRef` part." }
+            "maxBytesPerPart": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Optional host cap on a single inline (`data`) or `mediaRef` part."
+            }
           }
         },
         "authModes": {
           "type": "object",
-          "description": "RFC 0067 (`Active`), extended by RFC 0121 (`Active`). Optional per-provider advertisement of HOW the host expects a provider's credential to be supplied. Keys are provider ids appearing in `supported`; values are the auth modes the host honors for that provider. Absent ⇒ no advertisement: a provider in `byok` defaults to `apiKey` semantics (client passes `ai.credentialRef`); a provider in `supported` but not in `byok` defaults to `none` (platform-managed). This map only DESCRIBES the supply mechanism — `oauth-pkce`/`oauth-device` flow mechanics compose RFC 0047 `host.oauth` and resolve credentials by `ref` (RFC 0046), never on `ai.credentialRef`. A provider with `apiKey` MUST appear in `byok`; a provider whose modes are exactly `[\"none\"]` MUST NOT appear in `byok`. `subscription` (RFC 0121) advertises that a provider credential may be supplied by reusing the caller's existing personal, non-metered consumer subscription (e.g. Claude Pro/Max, ChatGPT Plus) rather than a metered API key; a `subscription` provider MUST appear in `byok`, is referenced by `ref` (RFC 0046) like the `oauth-*` modes (never on `ai.credentialRef`), and its credential MUST bind at `host.credentials` `scope:\"user\"` — never tenant/workspace-shared (SECURITY invariant `subscription-credential-user-scope-only`). Consumers MUST ignore an auth mode they don't recognize rather than reject the discovery doc.",
+          "description": "RFC 0067 (`Active`), extended by RFC 0121 (`Active`). Optional per-provider advertisement of HOW the host expects a provider's credential to be supplied. Keys are provider ids appearing in `supported`; values are the auth modes the host honors for that provider. Absent \u21d2 no advertisement: a provider in `byok` defaults to `apiKey` semantics (client passes `ai.credentialRef`); a provider in `supported` but not in `byok` defaults to `none` (platform-managed). This map only DESCRIBES the supply mechanism \u2014 `oauth-pkce`/`oauth-device` flow mechanics compose RFC 0047 `host.oauth` and resolve credentials by `ref` (RFC 0046), never on `ai.credentialRef`. A provider with `apiKey` MUST appear in `byok`; a provider whose modes are exactly `[\"none\"]` MUST NOT appear in `byok`. `subscription` (RFC 0121) advertises that a provider credential may be supplied by reusing the caller's existing personal, non-metered consumer subscription (e.g. Claude Pro/Max, ChatGPT Plus) rather than a metered API key; a `subscription` provider MUST appear in `byok`, is referenced by `ref` (RFC 0046) like the `oauth-*` modes (never on `ai.credentialRef`), and its credential MUST bind at `host.credentials` `scope:\"user\"` \u2014 never tenant/workspace-shared (SECURITY invariant `subscription-credential-user-scope-only`). Consumers MUST ignore an auth mode they don't recognize rather than reject the discovery doc.",
           "additionalProperties": {
             "type": "array",
             "minItems": 1,
             "uniqueItems": true,
             "items": {
               "type": "string",
-              "enum": ["apiKey", "oauth-pkce", "oauth-device", "none", "subscription"]
+              "enum": [
+                "apiKey",
+                "oauth-pkce",
+                "oauth-device",
+                "none",
+                "subscription"
+              ]
             }
           }
         },
         "policies": {
           "type": "object",
-          "description": "Optional v1 host-side policy enforcement modes for per-provider gating. Omitted → no enforcement; clients see only `optional` semantics. When present, MUST declare `modes` — an empty `{}` is not a valid third state. See `capabilities.md` §`aiProviders.policies`.",
-          "required": ["modes"],
+          "description": "Optional v1 host-side policy enforcement modes for per-provider gating. Omitted \u2192 no enforcement; clients see only `optional` semantics. When present, MUST declare `modes` \u2014 an empty `{}` is not a valid third state. See `capabilities.md` \u00a7`aiProviders.policies`.",
+          "required": [
+            "modes"
+          ],
           "properties": {
             "modes": {
               "type": "array",
-              "items": { "type": "string", "enum": ["disabled", "optional", "required", "restricted"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "disabled",
+                  "optional",
+                  "required",
+                  "restricted"
+                ]
+              },
               "uniqueItems": true,
               "description": "Subset of policy modes this host can enforce. `disabled` = provider may not be used; `optional` = no restriction (default); `required` = BYOK required; `restricted` = model must match the policy's `allowedModels` glob list. Hosts MAY support a subset; clients MUST tolerate any subset."
             },
             "scopes": {
               "type": "array",
-              "items": { "type": "string", "minLength": 1 },
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
               "uniqueItems": true,
               "description": "Resolution layers the host evaluates. Conventional ids: `workspace`, `project`, `canvas-type`. Precedence is host-defined and SHOULD be documented per-deployment."
             },
@@ -1023,12 +1399,12 @@
           "type": "integer",
           "minimum": 0,
           "default": 262144,
-          "description": "RFC 0055 §C rule 2 — optional cap (bytes) on inline base64 in `media.*` envelope payloads. A `media.{image,audio,file}` asset above this size MUST be served by a tenant-scoped `url` reference rather than inlined (bounds event-log + replay-payload size). Default 256 KiB (262144) when absent. A host MAY set 0 to force URL references for all emitted media."
+          "description": "RFC 0055 \u00a7C rule 2 \u2014 optional cap (bytes) on inline base64 in `media.*` envelope payloads. A `media.{image,audio,file}` asset above this size MUST be served by a tenant-scoped `url` reference rather than inlined (bounds event-log + replay-payload size). Default 256 KiB (262144) when absent. A host MAY set 0 to force URL references for all emitted media."
         },
         "realtimeVoice": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0106. Optional real-time voice profile. Absent ⇒ no live voice (a call to `ctx.callTranscriber` MUST be rejected with `transcription_unsupported`, and `stream:true` on `ctx.callSpeechSynthesizer` with `streaming_unsupported`). `ctx.callTranscriber` resolves a `Promise` at `turn_commit` with the settled final transcript and emits the interim/final/endpoint signals as `voice.*` run-events on the durable event log (the single canonical record); the streaming synthesis arm resolves a `Promise` at completion and announces clause-boundary chunks as `voice.synthesis_chunk` metadata run-events (bytes by `streamRef`/`url`, not inlined past the host cap).",
+          "description": "RFC 0106. Optional real-time voice profile. Absent \u21d2 no live voice (a call to `ctx.callTranscriber` MUST be rejected with `transcription_unsupported`, and `stream:true` on `ctx.callSpeechSynthesizer` with `streaming_unsupported`). `ctx.callTranscriber` resolves a `Promise` at `turn_commit` with the settled final transcript and emits the interim/final/endpoint signals as `voice.*` run-events on the durable event log (the single canonical record); the streaming synthesis arm resolves a `Promise` at completion and announces clause-boundary chunks as `voice.synthesis_chunk` metadata run-events (bytes by `streamRef`/`url`, not inlined past the host cap).",
           "properties": {
             "transcription": {
               "const": "streaming",
@@ -1039,7 +1415,10 @@
               "description": "When present (value MUST be `\"streaming\"`), the RFC 0105 `ctx.callSpeechSynthesizer` request honors `stream: true` (chunked synthesis). REQUIRES `aiProviders.speechSynthesis: \"supported\"` (enforced by the if/then closure on `aiProviders`)."
             },
             "turnDetection": {
-              "enum": ["vad", "semantic"],
+              "enum": [
+                "vad",
+                "semantic"
+              ],
               "description": "Endpointing sophistication. `vad` = silence-threshold endpointing only; `semantic` = a turn detector that emits `voice.endpoint_candidate` distinct from `voice.turn_commit`. Requires `transcription`."
             },
             "bargeIn": {
@@ -1048,14 +1427,18 @@
             }
           },
           "dependentRequired": {
-            "turnDetection": ["transcription"],
-            "bargeIn": ["transcription"]
+            "turnDetection": [
+              "transcription"
+            ],
+            "bargeIn": [
+              "transcription"
+            ]
           }
         },
         "promptPrefixCache": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0116. Host honors the AI-envelope `generate` request's optional `cachePrefixId` as a provider-cache routing hint — tenant-namespaced (SECURITY invariant `prompt-prefix-cache-cross-tenant-isolation`), secret-free, and replay-invariant (a cache hit/miss MUST NOT change the recorded envelope or `provider.usage.inputTokens`/`outputTokens`). Absent ⇒ a host MUST ignore `cachePrefixId` (no error, no behavior change). PROVIDER-SCOPED: prefix caching is provider-specific (e.g. Anthropic ephemeral), so this is NOT a universal claim — see `providers`.",
+          "description": "RFC 0116. Host honors the AI-envelope `generate` request's optional `cachePrefixId` as a provider-cache routing hint \u2014 tenant-namespaced (SECURITY invariant `prompt-prefix-cache-cross-tenant-isolation`), secret-free, and replay-invariant (a cache hit/miss MUST NOT change the recorded envelope or `provider.usage.inputTokens`/`outputTokens`). Absent \u21d2 a host MUST ignore `cachePrefixId` (no error, no behavior change). PROVIDER-SCOPED: prefix caching is provider-specific (e.g. Anthropic ephemeral), so this is NOT a universal claim \u2014 see `providers`.",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1063,26 +1446,42 @@
             },
             "providers": {
               "type": "array",
-              "items": { "type": "string", "minLength": 1 },
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
               "uniqueItems": true,
-              "description": "RFC 0116. The subset of `aiProviders.supported[]` for which the host honors `cachePrefixId` (prefix caching is provider-specific). A request whose routed provider is NOT in this list MUST have `cachePrefixId` ignored. Absent ⇒ host-defined per-provider routing; NOT a universal claim across providers."
+              "description": "RFC 0116. The subset of `aiProviders.supported[]` for which the host honors `cachePrefixId` (prefix caching is provider-specific). A request whose routed provider is NOT in this list MUST have `cachePrefixId` ignored. Absent \u21d2 host-defined per-provider routing; NOT a universal claim across providers."
             }
           },
-          "required": ["supported"]
+          "required": [
+            "supported"
+          ]
         }
       },
       "additionalProperties": false,
       "allOf": [
         {
-          "$comment": "RFC 0106 §A closure: realtimeVoice.synthesis (streaming TTS) requires the whole-file TTS surface aiProviders.speechSynthesis to be advertised.",
+          "$comment": "RFC 0106 \u00a7A closure: realtimeVoice.synthesis (streaming TTS) requires the whole-file TTS surface aiProviders.speechSynthesis to be advertised.",
           "if": {
             "type": "object",
-            "required": ["realtimeVoice"],
+            "required": [
+              "realtimeVoice"
+            ],
             "properties": {
-              "realtimeVoice": { "type": "object", "required": ["synthesis"] }
+              "realtimeVoice": {
+                "type": "object",
+                "required": [
+                  "synthesis"
+                ]
+              }
             }
           },
-          "then": { "required": ["speechSynthesis"] }
+          "then": {
+            "required": [
+              "speechSynthesis"
+            ]
+          }
         }
       ]
     },
@@ -1092,7 +1491,10 @@
       "properties": {
         "mockProviders": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
           "description": "Mock-provider IDs this server recognizes via `RunOptions.configurable.mockProvider.id`. Servers claiming OpenWOP v1.0 conformance MUST include `stream-text`. Other canonical providers (`tool-calls`, `error`, `usage-only`) are recommended. Implementations MAY add their own (vendor-prefixed)."
         },
@@ -1105,10 +1507,21 @@
         "forceEngineVersionRange": {
           "type": "object",
           "description": "Range of engine versions the server can be forced into via the `X-Force-Engine-Version` request header (test-keys-only). Used by the conformance suite to verify forward-compat fold-best-effort across the version-negotiation matrix. Closes F5.",
-          "required": ["min", "max"],
+          "required": [
+            "min",
+            "max"
+          ],
           "properties": {
-            "min": { "type": "integer", "minimum": 0, "description": "Lowest forceable engine version. Typically (current - 1) so back-compat is exercised." },
-            "max": { "type": "integer", "minimum": 0, "description": "Highest forceable engine version. Typically (current + 1) so forward-compat is exercised." }
+            "min": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Lowest forceable engine version. Typically (current - 1) so back-compat is exercised."
+            },
+            "max": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Highest forceable engine version. Typically (current + 1) so forward-compat is exercised."
+            }
           },
           "additionalProperties": false
         }
@@ -1121,19 +1534,22 @@
       "properties": {
         "mockAgent": {
           "type": "boolean",
-          "description": "RFC 0023 §B.2. When `true`, the host has registered the `core.conformance.mock-agent` typeId. The scenarios `agentReasoningEvents.test.ts` and `agentConfidenceEscalation.test.ts` rely on the typeId being reachable. Hosts that register the typeId only for workflow ids matching the conformance fixture prefix (`conformance-*`) and refuse it for other tenants MAY still advertise `true` — the advertisement says only that the typeId is reachable from the conformance suite, not that it is reachable from arbitrary workflows."
+          "description": "RFC 0023 \u00a7B.2. When `true`, the host has registered the `core.conformance.mock-agent` typeId. The scenarios `agentReasoningEvents.test.ts` and `agentConfidenceEscalation.test.ts` rely on the typeId being reachable. Hosts that register the typeId only for workflow ids matching the conformance fixture prefix (`conformance-*`) and refuse it for other tenants MAY still advertise `true` \u2014 the advertisement says only that the typeId is reachable from the conformance suite, not that it is reachable from arbitrary workflows."
         },
         "certificationBundleUrl": {
           "type": "string",
           "format": "uri",
-          "description": "OPTIONAL (RFC 0089). URL of the host's most recent conformance certification bundle (`conformance-certification-bundle.schema.json`) — a machine-readable attestation binding this host's claimed profiles to the reproducible run that substantiates them. Omitting it is fully conformant; clients MUST tolerate its absence."
+          "description": "OPTIONAL (RFC 0089). URL of the host's most recent conformance certification bundle (`conformance-certification-bundle.schema.json`) \u2014 a machine-readable attestation binding this host's claimed profiles to the reproducible run that substantiates them. Omitting it is fully conformant; clients MUST tolerate its absence."
         }
       },
       "additionalProperties": false
     },
     "fixtures": {
       "type": "array",
-      "items": { "type": "string", "minLength": 1 },
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
       "uniqueItems": true,
       "description": "Optional v1 fixture workflow IDs the host has seeded. The conformance suite uses this list to decide which fixture-dependent scenarios run vs. skip. Each ID matches a stub at `node_modules/@openwop/openwop-conformance/fixtures/{id}.json`. Hosts MAY advertise vendor-prefixed IDs; clients MUST tolerate unknown IDs. Empty array or absent means the host advertises no fixtures."
     },
@@ -1153,7 +1569,17 @@
           "type": "array",
           "items": {
             "type": "string",
-            "enum": ["reasoning", "tool-using", "chat", "code", "vision", "multimodal", "embedding", "classification", "retrieval"]
+            "enum": [
+              "reasoning",
+              "tool-using",
+              "chat",
+              "code",
+              "vision",
+              "multimodal",
+              "embedding",
+              "classification",
+              "retrieval"
+            ]
           },
           "uniqueItems": true,
           "description": "Optional list of `AgentRef.modelClass` values this host supports for hosted agents (Phase 2). Pack manifests whose `modelClass` is not in this list MUST refuse install with `unsupported_model_class`."
@@ -1164,15 +1590,22 @@
         },
         "memoryBackends": {
           "type": "array",
-          "items": { "type": "string", "enum": ["long-term"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "long-term"
+            ]
+          },
           "uniqueItems": true,
           "description": "Optional list of memory backends (Phase 3). `long-term` means the host implements `ExecutionHost.memory` against a durable store with the SR-1 redaction invariant intact end-to-end. Hosts that don't wire `MemoryAdapter` omit this field."
         },
         "memoryConsolidation": {
           "type": "object",
-          "description": "RFC 0068 (`Draft`). Background reconciliation of LONG-TERM memory (merge/dedup/supersede/strengthen) — distinct from RFC 0062 token-budgeted distillation of TRANSACTIONAL memory. A host advertising this emits `agent.memory.consolidated` (content-free) after a consolidation pass. Requires `agents.memoryBackends` to include `long-term`. SR-1 carry-forward + CTI-1 (RFC 0004) hold across the pass. Hosts that omit this block do not consolidate; the conformance scenarios skip cleanly.",
+          "description": "RFC 0068 (`Draft`). Background reconciliation of LONG-TERM memory (merge/dedup/supersede/strengthen) \u2014 distinct from RFC 0062 token-budgeted distillation of TRANSACTIONAL memory. A host advertising this emits `agent.memory.consolidated` (content-free) after a consolidation pass. Requires `agents.memoryBackends` to include `long-term`. SR-1 carry-forward + CTI-1 (RFC 0004) hold across the pass. Hosts that omit this block do not consolidate; the conformance scenarios skip cleanly.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1180,16 +1613,22 @@
             },
             "schedule": {
               "type": "string",
-              "enum": ["host-managed", "scheduled", "on-demand"],
+              "enum": [
+                "host-managed",
+                "scheduled",
+                "on-demand"
+              ],
               "description": "How a consolidation pass is initiated. `host-managed`: a host-internal cadence clients do not control (default when absent and supported:true). `scheduled`: bound to a `capabilities.scheduling` (RFC 0052) trigger. `on-demand`: the host runs a pass when explicitly requested. A host MAY honor more than one path but advertises the primary."
             }
           }
         },
         "commitments": {
           "type": "object",
-          "description": "RFC 0068 (`Draft`). Inferred STANDING commitments — durable, memory-derived intentions the host promotes into a time- or predicate-gated arm that fires a run later, without a fresh user turn. When an arm fires the host emits `commitment.fired` (content-free — the intention text lives in SR-1-redacted memory). Composes RFC 0052 (time arms) / RFC 0060 (predicate arms) for the fire substrate. Hosts that omit this block do not infer commitments; the conformance scenario skips cleanly.",
+          "description": "RFC 0068 (`Draft`). Inferred STANDING commitments \u2014 durable, memory-derived intentions the host promotes into a time- or predicate-gated arm that fires a run later, without a fresh user turn. When an arm fires the host emits `commitment.fired` (content-free \u2014 the intention text lives in SR-1-redacted memory). Composes RFC 0052 (time arms) / RFC 0060 (predicate arms) for the fire substrate. Hosts that omit this block do not infer commitments; the conformance scenario skips cleanly.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1197,9 +1636,15 @@
             },
             "fireConditions": {
               "type": "array",
-              "items": { "type": "string", "enum": ["time", "predicate"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "time",
+                  "predicate"
+                ]
+              },
               "uniqueItems": true,
-              "description": "Which fire-condition kinds the host supports. `time` composes RFC 0052 scheduling; `predicate` composes RFC 0060 heartbeat. Absent ⇒ `['time']`."
+              "description": "Which fire-condition kinds the host supports. `time` composes RFC 0052 scheduling; `predicate` composes RFC 0060 heartbeat. Absent \u21d2 `['time']`."
             }
           }
         },
@@ -1213,58 +1658,74 @@
         },
         "manifestRuntime": {
           "type": "object",
-          "description": "RFC 0070. Agent-manifest runtime floor — the minimal tier that makes a published agent pack (RFC 0003) runnable. When `supported: true`, the host implements RFC 0003 `installAgents`: it loads each installed pack's `agents[]` into an in-process AgentRegistry, resolves `systemPromptRef` + `handoff.*SchemaRef` from the tarball at install (RFC 0003 §C/§D), and can DISPATCH a manifest agent on the existing `core.dispatch`/orchestrator loop (RFC 0007/0037/0061). Does NOT imply swarm/consensus (`host.agentRuntime`), long-term memory (`agents.memoryBackends`), or crews beyond `agents.dispatch`. A host advertising `host.agentRuntime: supported` is treated as also satisfying this flag (RFC 0070 §B). Hosts that omit this block do not instantiate manifest agents (today's default).",
+          "description": "RFC 0070. Agent-manifest runtime floor \u2014 the minimal tier that makes a published agent pack (RFC 0003) runnable. When `supported: true`, the host implements RFC 0003 `installAgents`: it loads each installed pack's `agents[]` into an in-process AgentRegistry, resolves `systemPromptRef` + `handoff.*SchemaRef` from the tarball at install (RFC 0003 \u00a7C/\u00a7D), and can DISPATCH a manifest agent on the existing `core.dispatch`/orchestrator loop (RFC 0007/0037/0061). Does NOT imply swarm/consensus (`host.agentRuntime`), long-term memory (`agents.memoryBackends`), or crews beyond `agents.dispatch`. A host advertising `host.agentRuntime: supported` is treated as also satisfying this flag (RFC 0070 \u00a7B). Hosts that omit this block do not instantiate manifest agents (today's default).",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "REQUIRED when the block is present. When `true`, the host loads + dispatches pack-declared manifest agents. A host with `supported: true` MUST enforce each dispatched agent's `toolAllowlist` (RFC 0002 §A14) and MUST NOT leak BYOK plaintext into `agent.*` events or handoff payloads (SR-1)."
+              "description": "REQUIRED when the block is present. When `true`, the host loads + dispatches pack-declared manifest agents. A host with `supported: true` MUST enforce each dispatched agent's `toolAllowlist` (RFC 0002 \u00a7A14) and MUST NOT leak BYOK plaintext into `agent.*` events or handoff payloads (SR-1)."
             },
             "handoffValidation": {
               "type": "boolean",
               "default": false,
-              "description": "When `true`, the host validates inbound task payloads against the agent's `handoff.taskSchemaRef` before dispatch and outbound results against `handoff.returnSchemaRef` before persistence (RFC 0003 §D). When `false`/absent, manifests carrying `handoff` schemas are dispatched with opaque payloads."
+              "description": "When `true`, the host validates inbound task payloads against the agent's `handoff.taskSchemaRef` before dispatch and outbound results against `handoff.returnSchemaRef` before persistence (RFC 0003 \u00a7D). When `false`/absent, manifests carrying `handoff` schemas are dispatched with opaque payloads."
             },
             "installScope": {
               "type": "string",
-              "enum": ["host", "tenant"],
+              "enum": [
+                "host",
+                "tenant"
+              ],
               "default": "host",
-              "description": "RFC 0074. Scope at which manifest agents are installed/approved and therefore enumerated by GET /v1/agents. 'host' (default): a single host-global inventory; the endpoint returns the same set for every caller (RFC 0072's original behavior). 'tenant': agents are installed per tenant·workspace (RFC 0048 owner triple); GET /v1/agents returns ONLY the agents available to the authenticated principal's workspace, and an unapproved/unknown agent 404s — the surface never discloses another tenant's inventory. Does not change dispatch (RFC 0072 §B, owner-triple-scoped POST /v1/runs) or any floor safety guarantee (toolAllowlist/systemPromptRef/SR-1 stay mandatory regardless of scope)."
+              "description": "RFC 0074. Scope at which manifest agents are installed/approved and therefore enumerated by GET /v1/agents. 'host' (default): a single host-global inventory; the endpoint returns the same set for every caller (RFC 0072's original behavior). 'tenant': agents are installed per tenant\u00b7workspace (RFC 0048 owner triple); GET /v1/agents returns ONLY the agents available to the authenticated principal's workspace, and an unapproved/unknown agent 404s \u2014 the surface never discloses another tenant's inventory. Does not change dispatch (RFC 0072 \u00a7B, owner-triple-scoped POST /v1/runs) or any floor safety guarantee (toolAllowlist/systemPromptRef/SR-1 stay mandatory regardless of scope)."
             }
           }
         },
         "liveRuntime": {
           "type": "object",
-          "description": "RFC 0077. The host executes manifest agents against LIVE models and tools (not the deterministic RFC 0070 sample floor) per the normative AgentManifest→live-run mapping (`multi-agent-execution.md` §\"Live manifest dispatch\"), and emits the `agent.invocation.started`/`agent.invocation.completed` content-free bracket around the existing `agent.*` family. REQUIRES `agents.manifestRuntime.supported: true` — `liveRuntime` is a strict superset of the floor. The floor's mandatory safety guarantees (toolAllowlist enforcement, handoff inbound validation, tenant scoping, untrusted-model-output handling, fail-closed per-tool authorization) stay unconditional under `liveRuntime`. Hosts that omit this block run the floor only; the behavioral conformance scenarios skip cleanly.",
+          "description": "RFC 0077. The host executes manifest agents against LIVE models and tools (not the deterministic RFC 0070 sample floor) per the normative AgentManifest\u2192live-run mapping (`multi-agent-execution.md` \u00a7\"Live manifest dispatch\"), and emits the `agent.invocation.started`/`agent.invocation.completed` content-free bracket around the existing `agent.*` family. REQUIRES `agents.manifestRuntime.supported: true` \u2014 `liveRuntime` is a strict superset of the floor. The floor's mandatory safety guarantees (toolAllowlist enforcement, handoff inbound validation, tenant scoping, untrusted-model-output handling, fail-closed per-tool authorization) stay unconditional under `liveRuntime`. Hosts that omit this block run the floor only; the behavioral conformance scenarios skip cleanly.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "REQUIRED when present. When `true`, the host performs live manifest dispatch per the §B mapping and emits the `agent.invocation.*` bracket. Gated on `agents.manifestRuntime.supported: true`."
+              "description": "REQUIRED when present. When `true`, the host performs live manifest dispatch per the \u00a7B mapping and emits the `agent.invocation.*` bracket. Gated on `agents.manifestRuntime.supported: true`."
             },
             "structuredOutput": {
               "type": "boolean",
-              "description": "When `true`, the host validates the terminal result against the agent's `handoff.returnSchemaRef` and fails the run with a structured-output error on a non-conforming result rather than shipping it. Absent ⇒ `false` (runs live but does not enforce `returnSchemaRef`)."
+              "description": "When `true`, the host validates the terminal result against the agent's `handoff.returnSchemaRef` and fails the run with a structured-output error on a non-conforming result rather than shipping it. Absent \u21d2 `false` (runs live but does not enforce `returnSchemaRef`)."
             },
             "confidenceEscalation": {
               "type": "boolean",
-              "description": "When `true`, the host honors `AgentManifest.confidence.defaultThreshold` and triggers the RFC 0002 §F escalation contract when an `agent.decided` confidence falls below the effective threshold, rather than silently accepting the decision. Absent ⇒ `false`."
+              "description": "When `true`, the host honors `AgentManifest.confidence.defaultThreshold` and triggers the RFC 0002 \u00a7F escalation contract when an `agent.decided` confidence falls below the effective threshold, rather than silently accepting the decision. Absent \u21d2 `false`."
             },
             "sources": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "enum": ["workflow-node", "run-api", "chat-mention"] },
-              "description": "Which invocation entry points the host exposes for live manifest dispatch. `workflow-node`: an agent step inside a workflow run (RFC 0072 §B); `run-api`: an agent as the root of POST /v1/runs; `chat-mention`: a chat @agent invocation mapped onto the run surface. Enum membership is NOT mandatory — a host with no chat surface simply omits `chat-mention`. Absent ⇒ `['workflow-node']` (the RFC 0072 §B normative path). All advertised sources MUST emit the identical `agent.invocation.*` + `agent.*` event family."
+              "items": {
+                "type": "string",
+                "enum": [
+                  "workflow-node",
+                  "run-api",
+                  "chat-mention"
+                ]
+              },
+              "description": "Which invocation entry points the host exposes for live manifest dispatch. `workflow-node`: an agent step inside a workflow run (RFC 0072 \u00a7B); `run-api`: an agent as the root of POST /v1/runs; `chat-mention`: a chat @agent invocation mapped onto the run surface. Enum membership is NOT mandatory \u2014 a host with no chat surface simply omits `chat-mention`. Absent \u21d2 `['workflow-node']` (the RFC 0072 \u00a7B normative path). All advertised sources MUST emit the identical `agent.invocation.*` + `agent.*` event family."
             }
           }
         },
         "evalSuite": {
           "type": "object",
-          "description": "RFC 0081. The host runs portable `agent-eval-suite.schema.json` suites as eval runs (a `mode: \"eval\"` projection over POST /v1/runs, RFC 0081 §B), emits the `eval.started`/`eval.scored`/`eval.completed` content-free family, and terminates with an `eval-summary.schema.json` scorecard. Composes RFC 0026 (per-task cost), RFC 0054 (regression baseline diff), RFC 0056 (human override of an auto-score). Hosts that omit this block reject `mode: \"eval\"` with 501; the behavioral conformance scenario soft-skips. The summary + events are content-free (SECURITY invariant `eval-summary-no-content-leak`).",
+          "description": "RFC 0081. The host runs portable `agent-eval-suite.schema.json` suites as eval runs (a `mode: \"eval\"` projection over POST /v1/runs, RFC 0081 \u00a7B), emits the `eval.started`/`eval.scored`/`eval.completed` content-free family, and terminates with an `eval-summary.schema.json` scorecard. Composes RFC 0026 (per-task cost), RFC 0054 (regression baseline diff), RFC 0056 (human override of an auto-score). Hosts that omit this block reject `mode: \"eval\"` with 501; the behavioral conformance scenario soft-skips. The summary + events are content-free (SECURITY invariant `eval-summary-no-content-leak`).",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1273,13 +1734,22 @@
             "modes": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "enum": ["golden", "rubric", "adversarial", "regression", "live-shadow"] },
-              "description": "Which eval modes the host actually implements (RFC 0081 §D closed vocabulary). Truthful advertisement (RFC 0031): a host advertises ONLY the modes it gates on; a suite requesting an unadvertised mode is rejected at run-create with `400 validation_error`. Absent ⇒ no modes (the host advertises `supported` but gates nothing — effectively shape-only)."
+              "items": {
+                "type": "string",
+                "enum": [
+                  "golden",
+                  "rubric",
+                  "adversarial",
+                  "regression",
+                  "live-shadow"
+                ]
+              },
+              "description": "Which eval modes the host actually implements (RFC 0081 \u00a7D closed vocabulary). Truthful advertisement (RFC 0031): a host advertises ONLY the modes it gates on; a suite requesting an unadvertised mode is rejected at run-create with `400 validation_error`. Absent \u21d2 no modes (the host advertises `supported` but gates nothing \u2014 effectively shape-only)."
             },
             "maxTasksPerSuite": {
               "type": "integer",
               "minimum": 1,
-              "description": "MAY. Host ceiling on tasks per suite; a suite exceeding it is rejected at run-create (the RFC 0058 §A clamp pattern)."
+              "description": "MAY. Host ceiling on tasks per suite; a suite exceeding it is rejected at run-create (the RFC 0058 \u00a7A clamp pattern)."
             },
             "maxCostUsdPerSuite": {
               "type": "number",
@@ -1290,9 +1760,11 @@
         },
         "deployment": {
           "type": "object",
-          "description": "RFC 0082. The host implements an agent deployment lifecycle: per-(agentId, version) deployment records with the seven-state machine (draft/test/staged/active/paused/deprecated/rolled-back), named-channel binding (`agentId@channel` / `@latest` resolved + pinned per-(run, agentId, channel) at first resolution per §B), optional canary traffic-split, a rollback pointer, the content-free `deployment.*` audit events, and the `POST /v1/agents/{agentId}/deployments` promotion contract composing RFC 0049 (`deploy:*` fail-closed scopes) + RFC 0051 (approvalGate) + RFC 0081 (`requiredEval`). Hosts that omit this block reject a `channel`-bearing `AgentRef` with `validation_error` and 501 the deployment endpoint. The promotion endpoint + behavioral lifecycle scenario + reference-host store land at Active → Accepted.",
+          "description": "RFC 0082. The host implements an agent deployment lifecycle: per-(agentId, version) deployment records with the seven-state machine (draft/test/staged/active/paused/deprecated/rolled-back), named-channel binding (`agentId@channel` / `@latest` resolved + pinned per-(run, agentId, channel) at first resolution per \u00a7B), optional canary traffic-split, a rollback pointer, the content-free `deployment.*` audit events, and the `POST /v1/agents/{agentId}/deployments` promotion contract composing RFC 0049 (`deploy:*` fail-closed scopes) + RFC 0051 (approvalGate) + RFC 0081 (`requiredEval`). Hosts that omit this block reject a `channel`-bearing `AgentRef` with `validation_error` and 501 the deployment endpoint. The promotion endpoint + behavioral lifecycle scenario + reference-host store land at Active \u2192 Accepted.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1301,30 +1773,46 @@
             "channels": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "minLength": 1 },
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
               "description": "The named channels the host resolves (e.g. `[\"stable\", \"canary\", \"latest\"]`). Truthful advertisement (RFC 0031): a `channel` not in this list resolves to no version and fails the run with `no_active_deployment`."
             },
             "canary": {
               "type": "boolean",
-              "description": "When `true`, the host implements canary traffic-split (a per-run §B draw assigns the run to one of the channel's active versions by `canaryPercent`). When `false`/absent, the host MUST reject any `canaryPercent < 100`."
+              "description": "When `true`, the host implements canary traffic-split (a per-run \u00a7B draw assigns the run to one of the channel's active versions by `canaryPercent`). When `false`/absent, the host MUST reject any `canaryPercent < 100`."
             },
             "rollback": {
               "type": "boolean",
-              "description": "When `true`, the host implements the `rollbackPointer` recovery path (active→rolled-back restoring a prior version to active)."
+              "description": "When `true`, the host implements the `rollbackPointer` recovery path (active\u2192rolled-back restoring a prior version to active)."
             },
             "states": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "enum": ["draft", "test", "staged", "active", "paused", "deprecated", "rolled-back"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "draft",
+                  "test",
+                  "staged",
+                  "active",
+                  "paused",
+                  "deprecated",
+                  "rolled-back"
+                ]
+              },
               "description": "The subset of the seven lifecycle states the host implements. Truthful advertisement (RFC 0031): the host MUST reject a transition into a state not advertised here."
             }
           }
         },
         "roster": {
           "type": "object",
-          "description": "RFC 0086. The host maintains a standing agent roster: named, tenant-scoped agent INSTANCES (the 'digital-twin employee') that reference a manifest/deployment and own a workflow portfolio, discoverable via GET /v1/agents/roster, with trigger-fired portfolio runs attributed to the member via the content-free `roster.run.initiated` event. REQUIRES `agents.manifestRuntime.supported: true` (a roster entry instantiates a manifest agent). Triggers compose RFC 0052 (schedule) + RFC 0083 (durable work-item bridge) — no new WorkflowTrigger.type; the concrete work surface (a Kanban board) stays a host/vendor extension (§E). Hosts that omit this block do not maintain a roster (the roster reads 501). The roster-management endpoints + behavioral attribution scenario + reference-host store land at Active → Accepted.",
+          "description": "RFC 0086. The host maintains a standing agent roster: named, tenant-scoped agent INSTANCES (the 'digital-twin employee') that reference a manifest/deployment and own a workflow portfolio, discoverable via GET /v1/agents/roster, with trigger-fired portfolio runs attributed to the member via the content-free `roster.run.initiated` event. REQUIRES `agents.manifestRuntime.supported: true` (a roster entry instantiates a manifest agent). Triggers compose RFC 0052 (schedule) + RFC 0083 (durable work-item bridge) \u2014 no new WorkflowTrigger.type; the concrete work surface (a Kanban board) stays a host/vendor extension (\u00a7E). Hosts that omit this block do not maintain a roster (the roster reads 501). The roster-management endpoints + behavioral attribution scenario + reference-host store land at Active \u2192 Accepted.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -1332,30 +1820,41 @@
             },
             "installScope": {
               "type": "string",
-              "enum": ["host", "tenant"],
+              "enum": [
+                "host",
+                "tenant"
+              ],
               "description": "RFC 0074 carry-forward. `host`: a single global roster. `tenant`: roster entries are scoped per owner triple; GET /v1/agents/roster returns only the caller's entries and a cross-tenant entry 404s. MUST equal `agents.manifestRuntime.installScope` (a roster cannot be host-global while its manifests are tenant-scoped, or vice-versa)."
             },
             "portfolioTriggerSources": {
               "type": "array",
               "uniqueItems": true,
-              "items": { "type": "string", "minLength": 1 },
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
               "description": "Which RFC 0052/0083 trigger sources fire portfolio runs on this host (e.g. `[\"schedule\", \"queue\", \"webhook\"]`). Truthful advertisement (RFC 0031): a source not listed does not fire portfolios here."
             }
           }
         },
         "orgChart": {
           "type": "object",
-          "description": "RFC 0087. The host maintains a tenant-scoped, DESCRIPTIVE org-chart over RFC 0086 roster members: departments + roles with acyclic `reportsTo` edges + a derived responsibility roll-up, discoverable via GET /v1/agents/org-chart. The load-bearing guarantee (§B `org-position-no-authority-escalation`): an org edge confers NO authority — it MUST NOT widen `toolAllowlist` (RFC 0002 §A14), grant an RBAC scope (RFC 0049), or bypass an approval gate (RFC 0051); org position MUST NOT be an authorization input. The schema carries no authority-bearing field, and a conformant host MUST NOT derive authority from position out-of-band. REQUIRES `agents.roster.supported: true` (the chart's members are roster entries). Hosts that omit this block have no org-chart surface (the read 501s). The org-chart-management endpoints + behavioral non-authority scenario + reference-host store land at Active → Accepted.",
+          "description": "RFC 0087. The host maintains a tenant-scoped, DESCRIPTIVE org-chart over RFC 0086 roster members: departments + roles with acyclic `reportsTo` edges + a derived responsibility roll-up, discoverable via GET /v1/agents/org-chart. The load-bearing guarantee (\u00a7B `org-position-no-authority-escalation`): an org edge confers NO authority \u2014 it MUST NOT widen `toolAllowlist` (RFC 0002 \u00a7A14), grant an RBAC scope (RFC 0049), or bypass an approval gate (RFC 0051); org position MUST NOT be an authorization input. The schema carries no authority-bearing field, and a conformant host MUST NOT derive authority from position out-of-band. REQUIRES `agents.roster.supported: true` (the chart's members are roster entries). Hosts that omit this block have no org-chart surface (the read 501s). The org-chart-management endpoints + behavioral non-authority scenario + reference-host store land at Active \u2192 Accepted.",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "REQUIRED when present. When `true`, the host serves the tenant-scoped org-chart + the responsibility roll-up. The §B non-authority guarantee holds at every `installScope` — it is never gated, weakened, or opt-out."
+              "description": "REQUIRED when present. When `true`, the host serves the tenant-scoped org-chart + the responsibility roll-up. The \u00a7B non-authority guarantee holds at every `installScope` \u2014 it is never gated, weakened, or opt-out."
             },
             "installScope": {
               "type": "string",
-              "enum": ["host", "tenant"],
+              "enum": [
+                "host",
+                "tenant"
+              ],
               "description": "RFC 0074 carry-forward. `host`: a single global chart. `tenant`: charts are scoped per owner triple; GET /v1/agents/org-chart returns only the caller's chart. SHOULD equal `agents.roster.installScope` (the members are roster entries)."
             },
             "departmentNesting": {
@@ -1364,14 +1863,14 @@
             },
             "responsibilityView": {
               "type": "boolean",
-              "description": "When `true`, the host computes the §D responsibility roll-up (the union of a department's members' RFC 0086 portfolios) on GET /v1/agents/org-chart/{departmentId}."
+              "description": "When `true`, the host computes the \u00a7D responsibility roll-up (the union of a department's members' RFC 0086 portfolios) on GET /v1/agents/org-chart/{departmentId}."
             }
           }
         },
         "dispatchMapping": {
           "type": "boolean",
           "default": false,
-          "description": "Phase 6.1 (RFC 0022 §A). When `true`, host honors `inputMapping` / `outputMapping` / `perWorkerInputMappings` / `perWorkerOutputMappings` on `DispatchConfig` — building child inputs from parent variables before dispatch and harvesting child variables into parent variables on completion. Implies (but does NOT require) `agents.dispatch: true`. Hosts that set `agents.dispatch: true` but omit / `false` this flag MUST refuse workflows that carry non-empty mapping fields at registration with `validation_error` + `details.requiredCapability: 'agents.dispatchMapping'`."
+          "description": "Phase 6.1 (RFC 0022 \u00a7A). When `true`, host honors `inputMapping` / `outputMapping` / `perWorkerInputMappings` / `perWorkerOutputMappings` on `DispatchConfig` \u2014 building child inputs from parent variables before dispatch and harvesting child variables into parent variables on completion. Implies (but does NOT require) `agents.dispatch: true`. Hosts that set `agents.dispatch: true` but omit / `false` this flag MUST refuse workflows that carry non-empty mapping fields at registration with `validation_error` + `details.requiredCapability: 'agents.dispatchMapping'`."
         },
         "reasoning": {
           "type": "object",
@@ -1379,7 +1878,11 @@
           "properties": {
             "verbosity": {
               "type": "string",
-              "enum": ["summary", "full", "off"],
+              "enum": [
+                "summary",
+                "full",
+                "off"
+              ],
               "description": "Default reasoning verbosity for `agent.reasoned` events when the run does not override via `RunOptions.configurable.reasoningVerbosity`."
             },
             "tokenLimit": {
@@ -1398,17 +1901,28 @@
         "subRunAttestation": {
           "type": "boolean",
           "default": false,
-          "description": "RFC 0063 (`Active`). When `true`, host honors the optional `outputAttestation` block on `core.subWorkflow`: computes a content checksum (RFC 8785 JCS + SHA-256, the `replay.md` recipe) over a child's harvested outputs and surfaces it as the additive optional `attestation` object on the existing `core.workflowChain.event { phase: 'output.harvested' }` (RFC 0037) BEFORE applying `outputMapping`; when the config sets `requireApproval: true`, suspends the parent via an `approval` interrupt (RFC 0051) before merge and fails closed (no `accept`/`edit-accept` ⇒ no merge). Reuses RFC 0051's `approval` kind + RFC 0049 scopes for `principalScope` — no new interrupt kind, event type, or error code. Hosts that omit / `false` this flag treat `outputAttestation` as inert (blind merge, today's behavior)."
+          "description": "RFC 0063 (`Active`). When `true`, host honors the optional `outputAttestation` block on `core.subWorkflow`: computes a content checksum (RFC 8785 JCS + SHA-256, the `replay.md` recipe) over a child's harvested outputs and surfaces it as the additive optional `attestation` object on the existing `core.workflowChain.event { phase: 'output.harvested' }` (RFC 0037) BEFORE applying `outputMapping`; when the config sets `requireApproval: true`, suspends the parent via an `approval` interrupt (RFC 0051) before merge and fails closed (no `accept`/`edit-accept` \u21d2 no merge). Reuses RFC 0051's `approval` kind + RFC 0049 scopes for `principalScope` \u2014 no new interrupt kind, event type, or error code. Hosts that omit / `false` this flag treat `outputAttestation` as inert (blind merge, today's behavior)."
         },
         "proposals": {
           "type": "object",
-          "description": "RFC 0096 (`Active`). Reviewable learning — the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. A host advertising this serves the `/v1/host/sample/proposals` surface (promotable to `/v1/proposals`) and emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC — no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). Hosts that omit this block do not synthesize proposals; the conformance scenarios skip cleanly.",
+          "description": "RFC 0096 (`Active`). Reviewable learning \u2014 the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. A host advertising this serves the `/v1/host/sample/proposals` surface (promotable to `/v1/proposals`) and emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC \u2014 no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). Hosts that omit this block do not synthesize proposals; the conformance scenarios skip cleanly.",
           "additionalProperties": false,
-          "required": ["artifactKinds", "activation"],
+          "required": [
+            "artifactKinds",
+            "activation"
+          ],
           "properties": {
             "artifactKinds": {
               "type": "array",
-              "items": { "type": "string", "enum": ["agent-pack", "workflow-chain-pack", "prompt-template", "automation"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "agent-pack",
+                  "workflow-chain-pack",
+                  "prompt-template",
+                  "automation"
+                ]
+              },
               "uniqueItems": true,
               "description": "Which reusable artifact kinds the host can propose. `agent-pack` (RFC 0003), `workflow-chain-pack` (RFC 0013), `prompt-template` (RFC 0027), `automation` (RFC 0052 scheduled job)."
             },
@@ -1419,25 +1933,42 @@
             },
             "activation": {
               "type": "string",
-              "enum": ["approval-gate", "direct-rbac"],
+              "enum": [
+                "approval-gate",
+                "direct-rbac"
+              ],
               "description": "`approval-gate`: `apply` MUST drive an RFC 0051 gate (role/scope/quorum, audited override) and MUST NOT install unless granted/overridden. `direct-rbac`: `apply` requires only the RFC 0049 scope the host advertises for activation."
             }
           }
         },
         "goals": {
           "type": "object",
-          "description": "RFC 0097 (`Active`). Standing goals — a durable objective with explicit completion criteria, evaluated by a host-side judge (RFC 0090 verifier or host evaluator), that keeps an agent working across turns/runs until the judge is satisfied, a declared RFC 0058 bound is crossed, or the agent escalates (RFC 0044). A host advertising this serves `/v1/host/sample/goals` (promotable to `/v1/goals`) and emits the content-free `goal.evaluated` / `goal.closed` events. Completion MUST be the judge's verdict — a client MUST NOT set `state: satisfied` directly. Continuation MUST be bounded. Hosts that omit this block do not run standing goals; the conformance scenarios skip cleanly.",
+          "description": "RFC 0097 (`Active`). Standing goals \u2014 a durable objective with explicit completion criteria, evaluated by a host-side judge (RFC 0090 verifier or host evaluator), that keeps an agent working across turns/runs until the judge is satisfied, a declared RFC 0058 bound is crossed, or the agent escalates (RFC 0044). A host advertising this serves `/v1/host/sample/goals` (promotable to `/v1/goals`) and emits the content-free `goal.evaluated` / `goal.closed` events. Completion MUST be the judge's verdict \u2014 a client MUST NOT set `state: satisfied` directly. Continuation MUST be bounded. Hosts that omit this block do not run standing goals; the conformance scenarios skip cleanly.",
           "additionalProperties": false,
-          "required": ["judge", "continuation"],
+          "required": [
+            "judge",
+            "continuation"
+          ],
           "properties": {
             "judge": {
               "type": "string",
-              "enum": ["verifier", "host"],
+              "enum": [
+                "verifier",
+                "host"
+              ],
               "description": "`verifier`: completion is an RFC 0090 verifier verdict. `host`: an opaque host evaluator."
             },
             "continuation": {
               "type": "array",
-              "items": { "type": "string", "enum": ["schedule", "commitment", "heartbeat", "manual"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "schedule",
+                  "commitment",
+                  "heartbeat",
+                  "manual"
+                ]
+              },
               "uniqueItems": true,
               "description": "How a goal re-engages work between judge checks. `schedule` (RFC 0052), `commitment` (RFC 0068), `heartbeat` (RFC 0060), `manual`."
             },
@@ -1457,7 +1988,7 @@
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "When `true`, host implements the four-operation MemoryAdapter contract (`list`, `get`, `put`, `delete`) per RFC 0004 §A."
+          "description": "When `true`, host implements the four-operation MemoryAdapter contract (`list`, `get`, `put`, `delete`) per RFC 0004 \u00a7A."
         },
         "maxEntrySizeBytes": {
           "type": "integer",
@@ -1466,21 +1997,27 @@
         },
         "ttlSupported": {
           "type": "boolean",
-          "description": "When `true`, host honors `expiresAt` per RFC 0004 §E."
+          "description": "When `true`, host honors `expiresAt` per RFC 0004 \u00a7E."
         },
         "compaction": {
           "type": "object",
           "description": "RFC 0012 Memory Compaction Profile (Accepted 2026-05-15). Hosts that distill many short-lived MemoryEntry rows into fewer long-lived ones MAY advertise here; advertising implies the SR-1 carry-forward invariant (`SECURITY/invariants.yaml` row `memory-compaction-sr-1-carry-forward`).",
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "REQUIRED when the sub-block is present. When `true`, host performs compaction over `longTerm` memory and emits the `memory.compacted` event per `observability.md` §Canonical event vocabulary."
+              "description": "REQUIRED when the sub-block is present. When `true`, host performs compaction over `longTerm` memory and emits the `memory.compacted` event per `observability.md` \u00a7Canonical event vocabulary."
             },
             "trigger": {
               "type": "string",
-              "enum": ["host-managed", "client-requested", "both"],
-              "description": "REQUIRED when `supported: true` per RFC 0012 §A (enforced via the `if/then` clause). `host-managed` runs on a host-internal schedule clients do not control. `client-requested` and `both` are reserved enum values; v1.x normates only `host-managed`."
+              "enum": [
+                "host-managed",
+                "client-requested",
+                "both"
+              ],
+              "description": "REQUIRED when `supported: true` per RFC 0012 \u00a7A (enforced via the `if/then` clause). `host-managed` runs on a host-internal schedule clients do not control. `client-requested` and `both` are reserved enum values; v1.x normates only `host-managed`."
             },
             "maxInputEntries": {
               "type": "integer",
@@ -1490,37 +2027,74 @@
             "maxOutputBytes": {
               "type": "integer",
               "minimum": 0,
-              "description": "Informational ceiling on the distilled entry size. SHOULD be ≤ `memory.maxEntrySizeBytes`."
+              "description": "Informational ceiling on the distilled entry size. SHOULD be \u2264 `memory.maxEntrySizeBytes`."
             }
           },
           "additionalProperties": false,
-          "if": { "properties": { "supported": { "const": true } }, "required": ["supported"] },
-          "then": { "required": ["supported", "trigger"] }
+          "if": {
+            "properties": {
+              "supported": {
+                "const": true
+              }
+            },
+            "required": [
+              "supported"
+            ]
+          },
+          "then": {
+            "required": [
+              "supported",
+              "trigger"
+            ]
+          }
         },
         "distillation": {
           "type": "object",
-          "description": "RFC 0062 (`Active`). Scheduled, token-budgeted background compaction — the 'dream' pattern — built on compaction (RFC 0012) + scheduling (RFC 0052) + the workspace index (RFC 0059). A distillation run IS a compaction run with a mandatory token budget, an optional schedule, and a retrieval index wrapped around it; it reuses the `memory.compacted` event (extended with the additive optional `distillation` sub-object) rather than a parallel `memory.distilled` event. SR-1 carry-forward (RFC 0012 §D) holds — a distilled archive MUST NOT re-expose a redacted secret. Hosts that omit this block keep plain on-demand compaction (RFC 0012) or no memory.",
-          "required": ["supported"],
+          "description": "RFC 0062 (`Active`). Scheduled, token-budgeted background compaction \u2014 the 'dream' pattern \u2014 built on compaction (RFC 0012) + scheduling (RFC 0052) + the workspace index (RFC 0059). A distillation run IS a compaction run with a mandatory token budget, an optional schedule, and a retrieval index wrapped around it; it reuses the `memory.compacted` event (extended with the additive optional `distillation` sub-object) rather than a parallel `memory.distilled` event. SR-1 carry-forward (RFC 0012 \u00a7D) holds \u2014 a distilled archive MUST NOT re-expose a redacted secret. Hosts that omit this block keep plain on-demand compaction (RFC 0012) or no memory.",
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false,
-          "properties": {
-            "supported": { "type": "boolean", "description": "REQUIRED when the sub-block is present. When `true`, host honors the `distillation.tokenBudget` reserved run-option key, runs budgeted distillation over `longTerm` memory, writes a stable archive, and emits `memory.compacted` with the `distillation` sub-object." },
-            "maxTokenBudget": { "type": "integer", "minimum": 1, "description": "Largest per-run distillation token budget the host honors. A supplied `distillation.tokenBudget` is clamped to this; absent ⇒ the host defaults to this." },
-            "scheduled": { "type": "boolean", "description": "When `true`, host can initiate distillation on a schedule (requires `capabilities.scheduling`, RFC 0052). Distillation MAY also run on-demand without scheduling." },
-            "indexEmitted": { "type": "boolean", "description": "When `true`, host writes a retrievable memory-index manifest (`MEMORY-INDEX.json`, a workspace file per RFC 0059) after distillation; updating it emits `workspace.updated`." },
-            "tokenizerName": { "type": "string", "description": "Identifier of the tokenizer the budget is counted against (e.g. `claude`, `gpt-4`). The budget is best-effort-honest per this tokenizer (±10% conformance tolerance), not byte-exact." },
-            "archiveRetention": { "type": "string", "description": "ISO-8601 duration (e.g. `P30D`) the distilled archives persist before GC. Recursive distillation (distilling prior archives) is allowed; each level re-checks SR-1." }
-          }
-        },
-        "attribution": {
-          "type": "object",
-          "description": "RFC 0057 Memory write-attribution. Hosts that emit per-node memory provenance on the run event log MAY advertise here. Advertising `emitsWriteEvents: true` commits the host to emit a `memory.written` RunEvent for every memory write a run makes (identifiers only, never content), and implies the SECURITY invariants `memory-attribution-no-content` + `memory-attribution-tenant-scoped`.",
-          "required": ["supported"],
           "properties": {
             "supported": {
-              "const": true,
-              "description": "REQUIRED when the sub-block is present. The block is omitted entirely by hosts that do not support write attribution."
+              "type": "boolean",
+              "description": "REQUIRED when the sub-block is present. When `true`, host honors the `distillation.tokenBudget` reserved run-option key, runs budgeted distillation over `longTerm` memory, writes a stable archive, and emits `memory.compacted` with the `distillation` sub-object."
             },
-            "emitsWriteEvents": {
+            "maxTokenBudget": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Largest per-run distillation token budget the host honors. A supplied `distillation.tokenBudget` is clamped to this; absent \u21d2 the host defaults to this."
+            },
+            "scheduled": {
+              "type": "boolean",
+              "description": "When `true`, host can initiate distillation on a schedule (requires `capabilities.scheduling`, RFC 0052). Distillation MAY also run on-demand without scheduling."
+            },
+            "indexEmitted": {
+              "type": "boolean",
+              "description": "When `true`, host writes a retrievable memory-index manifest (`MEMORY-INDEX.json`, a workspace file per RFC 0059) after distillation; updating it emits `workspace.updated`."
+            },
+            "tokenizerName": {
+              "type": "string",
+              "description": "Identifier of the tokenizer the budget is counted against (e.g. `claude`, `gpt-4`). The budget is best-effort-honest per this tokenizer (\u00b110% conformance tolerance), not byte-exact."
+            },
+            "archiveRetention": {
+              "type": "string",
+              "description": "ISO-8601 duration (e.g. `P30D`) the distilled archives persist before GC. Recursive distillation (distilling prior archives) is allowed; each level re-checks SR-1."
+            }
+          }
+        },
+        "attribution": {
+          "type": "object",
+          "description": "RFC 0057 Memory write-attribution. Hosts that emit per-node memory provenance on the run event log MAY advertise here. Advertising `emitsWriteEvents: true` commits the host to emit a `memory.written` RunEvent for every memory write a run makes (identifiers only, never content), and implies the SECURITY invariants `memory-attribution-no-content` + `memory-attribution-tenant-scoped`.",
+          "required": [
+            "supported"
+          ],
+          "properties": {
+            "supported": {
+              "const": true,
+              "description": "REQUIRED when the sub-block is present. The block is omitted entirely by hosts that do not support write attribution."
+            },
+            "emitsWriteEvents": {
               "type": "boolean",
               "description": "When `true`, the host emits `memory.written` (per `run-event-payloads.schema.json#/$defs/memoryWritten`) for every memory write during a run. When `false` or absent, consumers MUST tolerate the event never appearing."
             }
@@ -1529,47 +2103,88 @@
         },
         "writable": {
           "type": "boolean",
-          "description": "RFC 0080 §A (`write` dimension). Absent ⇒ the host implements the full RFC 0004 four-operation MemoryAdapter (`put`/`delete` available — i.e. writable), the back-compatible default. A read-only host (`get`/`list` only) MUST set `writable: false` so a consumer can distinguish a read-only store from a read/write one. Only meaningful when `supported: true`."
+          "description": "RFC 0080 \u00a7A (`write` dimension). Absent \u21d2 the host implements the full RFC 0004 four-operation MemoryAdapter (`put`/`delete` available \u2014 i.e. writable), the back-compatible default. A read-only host (`get`/`list` only) MUST set `writable: false` so a consumer can distinguish a read-only store from a read/write one. Only meaningful when `supported: true`."
         },
         "search": {
           "type": "object",
-          "description": "RFC 0080 §A (`search` dimension) — NEW optional. Semantic or filtered query beyond the RFC 0004 `list` enumeration. Absent ⇒ only `list`/`get` retrieval is advertised. The query path itself stays the host-internal MemoryAdapter (RFC 0080 §B — no portable `GET /v1/memory` at v1.x).",
-          "required": ["supported"],
+          "description": "RFC 0080 \u00a7A (`search` dimension) \u2014 NEW optional. Semantic or filtered query beyond the RFC 0004 `list` enumeration. Absent \u21d2 only `list`/`get` retrieval is advertised. The query path itself stays the host-internal MemoryAdapter (RFC 0080 \u00a7B \u2014 no portable `GET /v1/memory` at v1.x).",
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false,
           "properties": {
-            "supported": { "type": "boolean", "description": "REQUIRED when the sub-block is present. When `true`, the host supports memory query beyond `list` (semantic and/or filter modes per `modes`)." },
+            "supported": {
+              "type": "boolean",
+              "description": "REQUIRED when the sub-block is present. When `true`, the host supports memory query beyond `list` (semantic and/or filter modes per `modes`)."
+            },
             "modes": {
               "type": "array",
-              "items": { "type": "string", "enum": ["semantic", "filter"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "semantic",
+                  "filter"
+                ]
+              },
               "uniqueItems": true,
-              "description": "The query modes the host supports. `semantic` = embedding/similarity retrieval; `filter` = structured predicate query over entry metadata. Omitted ⇒ unspecified mode (the host supports some query beyond `list`)."
+              "description": "The query modes the host supports. `semantic` = embedding/similarity retrieval; `filter` = structured predicate query over entry metadata. Omitted \u21d2 unspecified mode (the host supports some query beyond `list`)."
             }
           }
         },
         "retention": {
           "type": "object",
-          "description": "RFC 0080 §A (`retention/forget` dimension) — NEW optional. TTL expiry (`agent-memory.md §TTL`) and/or an explicit forget operation. Absent ⇒ no TTL beyond `ttlSupported` and no forget operation advertised. `forget` is a host-managed mutation OUTSIDE the replay envelope (RFC 0080 §UQ3 / `replay.md` §Recorded-fact events — a replay re-reads the log-recorded snapshot, not live memory).",
+          "description": "RFC 0080 \u00a7A (`retention/forget` dimension) \u2014 NEW optional. TTL expiry (`agent-memory.md \u00a7TTL`) and/or an explicit forget operation. Absent \u21d2 no TTL beyond `ttlSupported` and no forget operation advertised. `forget` is a host-managed mutation OUTSIDE the replay envelope (RFC 0080 \u00a7UQ3 / `replay.md` \u00a7Recorded-fact events \u2014 a replay re-reads the log-recorded snapshot, not live memory).",
           "additionalProperties": false,
           "properties": {
-            "ttl": { "type": "boolean", "description": "When `true`, memory entries expire per `expiresAt` (the `ttlSupported` semantics surfaced as a named retention dimension)." },
-            "forget": { "type": "boolean", "description": "When `true`, the host supports a tenant-scoped delete-by-subject forget operation (composes the CTI-1 cross-tenant invariant — a forget MUST NOT cross tenant boundaries)." }
+            "ttl": {
+              "type": "boolean",
+              "description": "When `true`, memory entries expire per `expiresAt` (the `ttlSupported` semantics surfaced as a named retention dimension)."
+            },
+            "forget": {
+              "type": "boolean",
+              "description": "When `true`, the host supports a tenant-scoped delete-by-subject forget operation (composes the CTI-1 cross-tenant invariant \u2014 a forget MUST NOT cross tenant boundaries)."
+            }
           }
         },
         "injectionBudget": {
           "type": "object",
-          "description": "RFC 0113 (`Active`). The host honors `MemoryListOptions.tokenBudget` — a token-denominated bound on a single injection read (the live read that feeds a turn), distinct from RFC 0062 distillation's background-compaction budget. Advertising it commits the host to return a token-bounded prefix of the ranked entry list (over-budget single entry omitted, never truncated mid-entry) over the SR-1-redacted, CTI-1-single-tenant result set. Relevance ranking is NOT advertised here — `rank:'relevance'` delegates to the existing `memory.search` semantic mode (RFC 0080), so there is exactly one relevance surface in the corpus. Hosts that omit this block do not honor `tokenBudget` (a supplied `tokenBudget` is ignored, today's `limit`/`tag` behavior).",
+          "description": "RFC 0113 (`Active`). The host honors `MemoryListOptions.tokenBudget` \u2014 a token-denominated bound on a single injection read (the live read that feeds a turn), distinct from RFC 0062 distillation's background-compaction budget. Advertising it commits the host to return a token-bounded prefix of the ranked entry list (over-budget single entry omitted, never truncated mid-entry) over the SR-1-redacted, CTI-1-single-tenant result set. Relevance ranking is NOT advertised here \u2014 `rank:'relevance'` delegates to the existing `memory.search` semantic mode (RFC 0080), so there is exactly one relevance surface in the corpus. Hosts that omit this block do not honor `tokenBudget` (a supplied `tokenBudget` is ignored, today's `limit`/`tag` behavior).",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
-            "supported": { "type": "boolean", "description": "REQUIRED when the sub-block is present. When `true`, the host honors `MemoryListOptions.tokenBudget` per `agent-memory.md` §\"Injection budget\"." },
+            "supported": {
+              "type": "boolean",
+              "description": "REQUIRED when the sub-block is present. When `true`, the host honors `MemoryListOptions.tokenBudget` per `agent-memory.md` \u00a7\"Injection budget\"."
+            },
             "tokenCounter": {
               "type": "string",
-              "enum": ["o200k_base", "cl100k_base", "chars", "host-defined"],
-              "description": "The unit `tokenBudget` is denominated in. REQUIRED when `injectionBudget.supported` (enforced via the `if/then` clause). `o200k_base`/`cl100k_base` are tokenizer encodings; `chars` counts UTF-8/Unicode characters of the entry `content` (a tokenizer-free unit a client can reason about directly — preferred over opaque `host-defined`); `host-defined` is an opaque host unit. The over-budget-single-entry-omitted rule applies regardless of unit. RFC 0111 aligns to these same values when it lands (0113 lands first); no shared `$ref` (decoupled)."
+              "enum": [
+                "o200k_base",
+                "cl100k_base",
+                "chars",
+                "host-defined"
+              ],
+              "description": "The unit `tokenBudget` is denominated in. REQUIRED when `injectionBudget.supported` (enforced via the `if/then` clause). `o200k_base`/`cl100k_base` are tokenizer encodings; `chars` counts UTF-8/Unicode characters of the entry `content` (a tokenizer-free unit a client can reason about directly \u2014 preferred over opaque `host-defined`); `host-defined` is an opaque host unit. The over-budget-single-entry-omitted rule applies regardless of unit. RFC 0111 aligns to these same values when it lands (0113 lands first); no shared `$ref` (decoupled)."
             }
           },
-          "if": { "properties": { "supported": { "const": true } }, "required": ["supported"] },
-          "then": { "required": ["supported", "tokenCounter"] }
+          "if": {
+            "properties": {
+              "supported": {
+                "const": true
+              }
+            },
+            "required": [
+              "supported"
+            ]
+          },
+          "then": {
+            "required": [
+              "supported",
+              "tokenCounter"
+            ]
+          }
         }
       },
       "additionalProperties": true
@@ -1580,19 +2195,19 @@
     },
     "subWorkflow": {
       "type": "object",
-      "description": "Capability surface for `core.subWorkflow` extensions. The baseline `core.subWorkflow` contract (RFC 0007 + `node-packs.md` §contract) is unconditional and does NOT require a capability flag; this object carries the additive extensions a host MAY support. Added by RFC 0022 §B + §C.",
+      "description": "Capability surface for `core.subWorkflow` extensions. The baseline `core.subWorkflow` contract (RFC 0007 + `node-packs.md` \u00a7contract) is unconditional and does NOT require a capability flag; this object carries the additive extensions a host MAY support. Added by RFC 0022 \u00a7B + \u00a7C.",
       "properties": {
         "inputMapping": {
           "type": "boolean",
           "default": false,
-          "description": "RFC 0022 §B. When `true`, host honors the `inputMapping` field on `core.subWorkflow` configs — seeding the child workflow's initial variable bag from `parentVariables[parentKey]` projections, overriding any matching `variables[].defaultValue` declaration on the child. When `false` or absent, hosts MUST refuse workflows that carry a non-empty `inputMapping` at registration with `validation_error` + `details.requiredCapability: 'subWorkflow.inputMapping'`. Silent ignore is NOT conformant."
+          "description": "RFC 0022 \u00a7B. When `true`, host honors the `inputMapping` field on `core.subWorkflow` configs \u2014 seeding the child workflow's initial variable bag from `parentVariables[parentKey]` projections, overriding any matching `variables[].defaultValue` declaration on the child. When `false` or absent, hosts MUST refuse workflows that carry a non-empty `inputMapping` at registration with `validation_error` + `details.requiredCapability: 'subWorkflow.inputMapping'`. Silent ignore is NOT conformant."
         }
       },
       "additionalProperties": false
     },
     "fs": {
       "type": "object",
-      "description": "RFC 0014 (`Active`). Filesystem capability — read/write/list/stat/delete inside a sandbox root. Required by the `core.openwop.files` pack. Hosts MUST resolve every input path relative to `sandboxRoot`, reject any path that escapes via `..` segments or symlinks, and enforce `maxFileSizeBytes` on write. Path-traversal rejection is normative — see `SECURITY/invariants.yaml` row `fs-path-traversal`.",
+      "description": "RFC 0014 (`Active`). Filesystem capability \u2014 read/write/list/stat/delete inside a sandbox root. Required by the `core.openwop.files` pack. Hosts MUST resolve every input path relative to `sandboxRoot`, reject any path that escapes via `..` segments or symlinks, and enforce `maxFileSizeBytes` on write. Path-traversal rejection is normative \u2014 see `SECURITY/invariants.yaml` row `fs-path-traversal`.",
       "properties": {
         "supported": {
           "type": "boolean",
@@ -1611,10 +2226,21 @@
           "type": "object",
           "description": "Image-processing sub-capability. Optional.",
           "properties": {
-            "supported": { "type": "boolean" },
+            "supported": {
+              "type": "boolean"
+            },
             "formats": {
               "type": "array",
-              "items": { "type": "string", "enum": ["jpeg", "png", "webp", "avif", "gif"] }
+              "items": {
+                "type": "string",
+                "enum": [
+                  "jpeg",
+                  "png",
+                  "webp",
+                  "avif",
+                  "gif"
+                ]
+              }
             }
           },
           "additionalProperties": false
@@ -1623,7 +2249,9 @@
           "type": "object",
           "description": "PDF-processing sub-capability. Optional.",
           "properties": {
-            "supported": { "type": "boolean" }
+            "supported": {
+              "type": "boolean"
+            }
           },
           "additionalProperties": false
         },
@@ -1631,27 +2259,62 @@
           "type": "object",
           "description": "Network file-transport sub-capabilities. Optional.",
           "properties": {
-            "ftp": { "type": "boolean" },
-            "sftp": { "type": "boolean" },
-            "ssh": { "type": "boolean" }
+            "ftp": {
+              "type": "boolean"
+            },
+            "sftp": {
+              "type": "boolean"
+            },
+            "ssh": {
+              "type": "boolean"
+            }
           },
           "additionalProperties": false
         }
       },
-      "if": { "properties": { "supported": { "const": true } }, "required": ["supported"] },
-      "then": { "required": ["supported", "sandboxRoot"] },
+      "if": {
+        "properties": {
+          "supported": {
+            "const": true
+          }
+        },
+        "required": [
+          "supported"
+        ]
+      },
+      "then": {
+        "required": [
+          "supported",
+          "sandboxRoot"
+        ]
+      },
       "additionalProperties": false
     },
     "kvStorage": {
       "type": "object",
       "description": "RFC 0015 (`Active`). TTL-aware key-value store with atomic increment + compare-and-swap. Required by `core.openwop.storage` kv-* nodes. Hosts MUST partition values by tenant (`kv-cross-tenant-isolation` invariant) and atomically apply increments + CAS when those flags are advertised.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "maxKeyBytes": { "type": "integer", "minimum": 0 },
-        "maxValueBytes": { "type": "integer", "minimum": 0 },
-        "maxTtlSeconds": { "type": "integer", "minimum": 0 },
-        "atomicIncrement": { "type": "boolean" },
-        "compareAndSwap": { "type": "boolean" }
+        "supported": {
+          "type": "boolean"
+        },
+        "maxKeyBytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "maxValueBytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "maxTtlSeconds": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "atomicIncrement": {
+          "type": "boolean"
+        },
+        "compareAndSwap": {
+          "type": "boolean"
+        }
       },
       "additionalProperties": false
     },
@@ -1659,29 +2322,62 @@
       "type": "object",
       "description": "RFC 0016 (`Active`). Structured-record store with user-defined schemas. Sibling to kvStorage. Cross-tenant isolation enforced (mirrors RFC 0015 invariant).",
       "properties": {
-        "supported": { "type": "boolean" },
-        "maxRowsPerTable": { "type": "integer", "minimum": 0 },
-        "maxColumnsPerRow": { "type": "integer", "minimum": 0 },
-        "indexable": { "type": "boolean" },
-        "fullTextSearch": { "type": "boolean" }
+        "supported": {
+          "type": "boolean"
+        },
+        "maxRowsPerTable": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "maxColumnsPerRow": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "indexable": {
+          "type": "boolean"
+        },
+        "fullTextSearch": {
+          "type": "boolean"
+        }
       },
       "additionalProperties": false
     },
     "queueBus": {
       "type": "object",
-      "description": "RFC 0017 (`Active`). Inbound queue + stream capability — publish, consume (trigger), ack/nack/dead-letter. Cross-tenant message isolation invariant (`queue-cross-tenant-isolation`). Sibling to host.messaging (which is outbound-egress-only).",
+      "description": "RFC 0017 (`Active`). Inbound queue + stream capability \u2014 publish, consume (trigger), ack/nack/dead-letter. Cross-tenant message isolation invariant (`queue-cross-tenant-isolation`). Sibling to host.messaging (which is outbound-egress-only).",
       "properties": {
-        "supported": { "type": "boolean" },
+        "supported": {
+          "type": "boolean"
+        },
         "backends": {
           "type": "array",
-          "items": { "type": "string", "enum": ["rabbitmq", "kafka", "sqs", "sns", "pubsub", "mqtt", "nats", "redis-streams", "in-memory"] }
+          "items": {
+            "type": "string",
+            "enum": [
+              "rabbitmq",
+              "kafka",
+              "sqs",
+              "sns",
+              "pubsub",
+              "mqtt",
+              "nats",
+              "redis-streams",
+              "in-memory"
+            ]
+          }
+        },
+        "deadLetterSupported": {
+          "type": "boolean"
         },
-        "deadLetterSupported": { "type": "boolean" },
         "stream": {
           "type": "object",
           "properties": {
-            "supported": { "type": "boolean" },
-            "fromBeginning": { "type": "boolean" }
+            "supported": {
+              "type": "boolean"
+            },
+            "fromBeginning": {
+              "type": "boolean"
+            }
           },
           "additionalProperties": false
         }
@@ -1690,112 +2386,260 @@
     },
     "scheduling": {
       "type": "object",
-      "description": "RFC 0052 (`Draft`). Time-based run initiation behind the `schedule` trigger — gives the trigger a portable, durable, once-per-tick execution contract. Composes with `queueBus` (RFC 0017) where the host backs scheduling with a queue; orthogonal to the in-DAG `core.control.delay` primitive (which delays a node mid-run, not run initiation).",
-      "required": ["supported"],
+      "description": "RFC 0052 (`Draft`). Time-based run initiation behind the `schedule` trigger \u2014 gives the trigger a portable, durable, once-per-tick execution contract. Composes with `queueBus` (RFC 0017) where the host backs scheduling with a queue; orthogonal to the in-DAG `core.control.delay` primitive (which delays a node mid-run, not run initiation).",
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean" },
-        "cron": { "type": "boolean", "description": "Host honors cron-expression schedules." },
-        "delayed": { "type": "boolean", "description": "Host honors one-shot delayed execution." },
-        "calendar": { "type": "boolean", "description": "Host honors calendar-reference schedules." },
-        "maxFutureHorizon": { "type": "string", "description": "ISO-8601 duration (e.g. `P90D`); the farthest-future a run may be scheduled. Schedules beyond it MUST be rejected with `schedule_horizon_exceeded`." }
+        "supported": {
+          "type": "boolean"
+        },
+        "cron": {
+          "type": "boolean",
+          "description": "Host honors cron-expression schedules."
+        },
+        "delayed": {
+          "type": "boolean",
+          "description": "Host honors one-shot delayed execution."
+        },
+        "calendar": {
+          "type": "boolean",
+          "description": "Host honors calendar-reference schedules."
+        },
+        "maxFutureHorizon": {
+          "type": "string",
+          "description": "ISO-8601 duration (e.g. `P90D`); the farthest-future a run may be scheduled. Schedules beyond it MUST be rejected with `schedule_horizon_exceeded`."
+        }
       },
       "additionalProperties": false
     },
     "heartbeat": {
       "type": "object",
       "description": "RFC 0060 (`Draft`). System-managed, predicate-gated polling: a short-interval, runtime-bounded evaluation of an idempotent predicate that emits state-change events and conditionally enqueues a run, rather than re-running an agent blindly. Composes with `scheduling` (RFC 0052) for the once-per-tick interval substrate; the controlled, request-shaped exception to openwop's poll-free design (`positioning.md`).",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean" },
-        "minIntervalSec": { "type": "integer", "minimum": 1, "description": "Smallest interval the host honors; requests below it clamp up." },
-        "maxRuntimeMs": { "type": "integer", "minimum": 1, "description": "Per-tick predicate-evaluation budget; bounded above by `capabilities.limits.maxRunDurationMs` (RFC 0058) as the hard ceiling. Over-budget evaluation is terminated and reported as `heartbeat.evaluated { status: 'timeout' }`." }
+        "supported": {
+          "type": "boolean"
+        },
+        "minIntervalSec": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Smallest interval the host honors; requests below it clamp up."
+        },
+        "maxRuntimeMs": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Per-tick predicate-evaluation budget; bounded above by `capabilities.limits.maxRunDurationMs` (RFC 0058) as the hard ceiling. Over-budget evaluation is terminated and reported as `heartbeat.evaluated { status: 'timeout' }`."
+        }
       },
       "additionalProperties": false
     },
     "toolHooks": {
       "type": "object",
-      "description": "RFC 0064 (`Active`) — sibling of `heartbeat`. Per-tool authorization + rate limiting + content-free tool-call audit fields, layered on the existing `agent.toolCalled` / `agent.toolReturned` events (RFC 0002). Generalizes the MCP-specific bridges across transports (mcp / http / native). Reuses RFC 0049's `forbidden` error + `authorization-fail-closed` invariant and the existing `rate_limited` error — no new event type, error code, or invariant.",
-      "required": ["supported"],
+      "description": "RFC 0064 (`Active`) \u2014 sibling of `heartbeat`. Per-tool authorization + rate limiting + content-free tool-call audit fields, layered on the existing `agent.toolCalled` / `agent.toolReturned` events (RFC 0002). Generalizes the MCP-specific bridges across transports (mcp / http / native). Reuses RFC 0049's `forbidden` error + `authorization-fail-closed` invariant and the existing `rate_limited` error \u2014 no new event type, error code, or invariant.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean" },
-        "prePostEvents": { "type": "boolean", "description": "Host populates `argsHash`/`principal`/`transport` on `agent.toolCalled` + `status`/`durationMs` on `agent.toolReturned` for every external tool call." },
-        "perToolAuthorization": { "type": "boolean", "description": "Host enforces per-tool scopes against the run principal (RFC 0049), fail-closed; a lacked-or-unevaluable scope yields `agent.toolReturned { status: 'forbidden' }` + a `forbidden` (403) error and the tool is never invoked." },
-        "perToolRateLimit": { "type": "boolean", "description": "Host applies a per-`(principal, tool)` token-bucket rate limit; exhaustion yields `agent.toolReturned { status: 'rate_limited' }` + a `rate_limited` (429) error." }
+        "supported": {
+          "type": "boolean"
+        },
+        "prePostEvents": {
+          "type": "boolean",
+          "description": "Host populates `argsHash`/`principal`/`transport` on `agent.toolCalled` + `status`/`durationMs` on `agent.toolReturned` for every external tool call."
+        },
+        "perToolAuthorization": {
+          "type": "boolean",
+          "description": "Host enforces per-tool scopes against the run principal (RFC 0049), fail-closed; a lacked-or-unevaluable scope yields `agent.toolReturned { status: 'forbidden' }` + a `forbidden` (403) error and the tool is never invoked."
+        },
+        "perToolRateLimit": {
+          "type": "boolean",
+          "description": "Host applies a per-`(principal, tool)` token-bucket rate limit; exhaustion yields `agent.toolReturned { status: 'rate_limited' }` + a `rate_limited` (429) error."
+        }
       }
     },
     "toolCatalog": {
       "type": "object",
-      "description": "RFC 0078 (`Active`). The host exposes a read-only projection of its tool surfaces (node-pack / workflow / MCP / connector / host-extension) at `GET /v1/tools` + `GET /v1/tools/{toolId}`, returning `ToolDescriptor` records (`tool-descriptor.schema.json`). Optional; hosts that omit it expose no catalog (today's behavior) and the conformance scenarios skip cleanly. Read-only — the catalog never mutates tools; tool invocation stays on the existing surfaces (agent dispatch, `core.dispatch`, MCP). The listing is authorization-scoped + non-disclosing (RFC 0074 pattern).",
-      "required": ["supported"],
+      "description": "RFC 0078 (`Active`). The host exposes a read-only projection of its tool surfaces (node-pack / workflow / MCP / connector / host-extension) at `GET /v1/tools` + `GET /v1/tools/{toolId}`, returning `ToolDescriptor` records (`tool-descriptor.schema.json`). Optional; hosts that omit it expose no catalog (today's behavior) and the conformance scenarios skip cleanly. Read-only \u2014 the catalog never mutates tools; tool invocation stays on the existing surfaces (agent dispatch, `core.dispatch`, MCP). The listing is authorization-scoped + non-disclosing (RFC 0074 pattern).",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "REQUIRED when present. `true` ⇒ `GET /v1/tools` + `GET /v1/tools/{toolId}` are served per RFC 0078 §B." },
+        "supported": {
+          "type": "boolean",
+          "description": "REQUIRED when present. `true` \u21d2 `GET /v1/tools` + `GET /v1/tools/{toolId}` are served per RFC 0078 \u00a7B."
+        },
         "sources": {
           "type": "array",
           "uniqueItems": true,
-          "items": { "type": "string", "enum": ["node-pack", "workflow", "mcp", "connector", "host-extension"] },
-          "description": "Which tool sources the catalog projects. A host advertises only the sources it actually surfaces; a consumer MUST tolerate any subset. Absent ⇒ all sources the host implements."
+          "items": {
+            "type": "string",
+            "enum": [
+              "node-pack",
+              "workflow",
+              "mcp",
+              "connector",
+              "host-extension"
+            ]
+          },
+          "description": "Which tool sources the catalog projects. A host advertises only the sources it actually surfaces; a consumer MUST tolerate any subset. Absent \u21d2 all sources the host implements."
+        },
+        "sessionLifecycle": {
+          "type": "boolean",
+          "description": "`true` \u21d2 the host emits the RFC 0078 \u00a7D tool-session lifecycle events (`tool.session.opened`/`tool.session.closed`, content-free) bracketing the existing RFC 0064 `agent.toolCalled`/`agent.toolReturned` call events for multi-step interactions. Absent \u21d2 `false` (single-shot tool calls only)."
         },
-        "sessionLifecycle": { "type": "boolean", "description": "`true` ⇒ the host emits the RFC 0078 §D tool-session lifecycle events (`tool.session.opened`/`tool.session.closed`, content-free) bracketing the existing RFC 0064 `agent.toolCalled`/`agent.toolReturned` call events for multi-step interactions. Absent ⇒ `false` (single-shot tool calls only)." },
-        "compactView": { "type": "boolean", "description": "RFC 0112. `true` ⇒ the host honors `GET /v1/tools?view=compact` + `GET /v1/tools/{toolId}?view=compact`, returning the `{ tools: CompactToolDescriptor[] }` projection (`compact-tool-descriptor.schema.json`): the heavy descriptor fields (`outputSchema`/`auth`/`egress`/`approval`/`replayPolicy`/`costHint`/`latencyHint`) are dropped and any `inputSchema` is bounded to the compact structural subset. The compact `tools[]` carries the same `toolId` set as the standard view for the same principal. Absent ⇒ the host treats `view=compact` as an unknown query param (standard view)." }
+        "compactView": {
+          "type": "boolean",
+          "description": "RFC 0112. `true` \u21d2 the host honors `GET /v1/tools?view=compact` + `GET /v1/tools/{toolId}?view=compact`, returning the `{ tools: CompactToolDescriptor[] }` projection (`compact-tool-descriptor.schema.json`): the heavy descriptor fields (`outputSchema`/`auth`/`egress`/`approval`/`replayPolicy`/`costHint`/`latencyHint`) are dropped and any `inputSchema` is bounded to the compact structural subset. The compact `tools[]` carries the same `toolId` set as the standard view for the same principal. Absent \u21d2 the host treats `view=compact` as an unknown query param (standard view)."
+        }
       }
     },
     "httpClient": {
       "type": "object",
-      "description": "Host outbound-HTTP surface. The host's HTTP-client node egress (e.g. `core.http.request`) MUST be SSRF-guarded (`ssrfGuard: true`) with a positive `maxResponseBodyBytes` cap — the `http-client-ssrf-guard` protocol invariant. RFC 0076 §B adds the OPTIONAL `safeFetch` sub-capability: a host-mediated `ctx.http.safeFetch(url, init?)` exposed to pack runtime code, backed by the SAME SSRF guard (resolve→pin→connect, metadata-endpoint blocklist, DNS-rebinding defeat) so packs need not reach for raw DNS/sockets. See `host-capabilities.md` §host.http.",
-      "required": ["supported"],
+      "description": "Host outbound-HTTP surface. The host's HTTP-client node egress (e.g. `core.http.request`) MUST be SSRF-guarded (`ssrfGuard: true`) with a positive `maxResponseBodyBytes` cap \u2014 the `http-client-ssrf-guard` protocol invariant. RFC 0076 \u00a7B adds the OPTIONAL `safeFetch` sub-capability: a host-mediated `ctx.http.safeFetch(url, init?)` exposed to pack runtime code, backed by the SAME SSRF guard (resolve\u2192pin\u2192connect, metadata-endpoint blocklist, DNS-rebinding defeat) so packs need not reach for raw DNS/sockets. See `host-capabilities.md` \u00a7host.http.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean" },
-        "ssrfGuard": { "type": "boolean", "description": "Host rejects egress to loopback / RFC 1918 / link-local / cloud-metadata addresses (resolve→pin→connect). MUST be `true` when `supported` (the `http-client-ssrf-guard` invariant)." },
-        "maxResponseBodyBytes": { "type": "integer", "minimum": 1, "description": "Positive ceiling on a response body the host will buffer. Reused by `safeFetch`." },
-        "requestTimeoutMs": { "type": "integer", "minimum": 1, "description": "Host-enforced per-request wall-clock timeout (also applies to `safeFetch`)." },
-        "methods": { "type": "array", "items": { "type": "string" }, "description": "HTTP methods the client surface accepts (e.g. `GET`, `POST`)." },
+        "supported": {
+          "type": "boolean"
+        },
+        "ssrfGuard": {
+          "type": "boolean",
+          "description": "Host rejects egress to loopback / RFC 1918 / link-local / cloud-metadata addresses (resolve\u2192pin\u2192connect). MUST be `true` when `supported` (the `http-client-ssrf-guard` invariant)."
+        },
+        "maxResponseBodyBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Positive ceiling on a response body the host will buffer. Reused by `safeFetch`."
+        },
+        "requestTimeoutMs": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Host-enforced per-request wall-clock timeout (also applies to `safeFetch`)."
+        },
+        "methods": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "HTTP methods the client surface accepts (e.g. `GET`, `POST`)."
+        },
         "safeFetch": {
           "type": "object",
-          "description": "RFC 0076 §B. Host-provided `ctx.http.safeFetch(url, init?)` for pack runtime code — the pack-facing exposure of the SSRF-guarded client. When advertised, the host MUST apply the §host.http SSRF defense + clamps (incl. refusing `Connection: upgrade`), and — when `toolHooks.prePostEvents` is also advertised — MUST emit the `agent.toolCalled`/`agent.toolReturned` pair (`transport: 'http'`) for each call. A pack that uses `safeFetch` need not declare `net.dns` in `runtime.requires` (the host owns resolution; RFC 0076 §A).",
-          "required": ["supported"],
+          "description": "RFC 0076 \u00a7B. Host-provided `ctx.http.safeFetch(url, init?)` for pack runtime code \u2014 the pack-facing exposure of the SSRF-guarded client. When advertised, the host MUST apply the \u00a7host.http SSRF defense + clamps (incl. refusing `Connection: upgrade`), and \u2014 when `toolHooks.prePostEvents` is also advertised \u2014 MUST emit the `agent.toolCalled`/`agent.toolReturned` pair (`transport: 'http'`) for each call. A pack that uses `safeFetch` need not declare `net.dns` in `runtime.requires` (the host owns resolution; RFC 0076 \u00a7A).",
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false,
           "properties": {
-            "supported": { "type": "boolean" }
+            "supported": {
+              "type": "boolean"
+            }
           }
         },
         "egressPolicy": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0079. The host evaluates credential provenance (`credential-provenance.schema.json`) + the audience-binding MUST (§C) on credentialed egress and emits `egress.decided` (§B). Requires `httpClient.safeFetch` (the egress mechanism). Absent ⇒ the host does not perform provenance binding (the RFC 0076 §B SSRF guard still applies); the conformance behavioral scenarios skip cleanly. Closes the credential↔destination-binding question RFC 0076 §B parked.",
-          "required": ["supported"],
+          "description": "RFC 0079. The host evaluates credential provenance (`credential-provenance.schema.json`) + the audience-binding MUST (\u00a7C) on credentialed egress and emits `egress.decided` (\u00a7B). Requires `httpClient.safeFetch` (the egress mechanism). Absent \u21d2 the host does not perform provenance binding (the RFC 0076 \u00a7B SSRF guard still applies); the conformance behavioral scenarios skip cleanly. Closes the credential\u2194destination-binding question RFC 0076 \u00a7B parked.",
+          "required": [
+            "supported"
+          ],
           "properties": {
-            "supported": { "type": "boolean", "description": "REQUIRED when present. `true` ⇒ the §C audience-binding MUST is enforced + `egress.decided` is emitted." },
-            "decisions": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["allowed", "denied", "downgraded", "approval-required"] }, "description": "MAY — which decision outcomes the host implements. Absent ⇒ at least `allowed` + `denied`." }
+            "supported": {
+              "type": "boolean",
+              "description": "REQUIRED when present. `true` \u21d2 the \u00a7C audience-binding MUST is enforced + `egress.decided` is emitted."
+            },
+            "decisions": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "enum": [
+                  "allowed",
+                  "denied",
+                  "downgraded",
+                  "approval-required"
+                ]
+              },
+              "description": "MAY \u2014 which decision outcomes the host implements. Absent \u21d2 at least `allowed` + `denied`."
+            }
           }
         }
       }
     },
     "artifactTypes": {
       "type": "object",
-      "description": "RFC 0071, amended by RFC 0075; declared by RFC 0144. Host artifact-type surface — an advertisement (no `ctx.artifactTypes.*` method) that changes how the host treats the artifact references already on the wire (`nodes[].artifact.typeId`, `WorkflowNode.artifactType`, `artifact.created.artifactType`). Carries the corpus's only emission MUST: a host advertising `store: true` MUST persist registered artifacts and emit `artifact.created`. See `host-capabilities.md` §host.artifactTypes and `artifact-type-packs.md` §\"Host capability\". The discovery key is the PLAIN family name at the document root (RFC 0137 G16); `host.artifactTypes` is the capability IDENTIFIER used in pack `peerDependencies`, not this key.",
+      "description": "RFC 0071, amended by RFC 0075; declared by RFC 0144. Host artifact-type surface \u2014 an advertisement (no `ctx.artifactTypes.*` method) that changes how the host treats the artifact references already on the wire (`nodes[].artifact.typeId`, `WorkflowNode.artifactType`, `artifact.created.artifactType`). Carries the corpus's only emission MUST: a host advertising `store: true` MUST persist registered artifacts and emit `artifact.created`. See `host-capabilities.md` \u00a7host.artifactTypes and `artifact-type-packs.md` \u00a7\"Host capability\". The discovery key is the PLAIN family name at the document root (RFC 0137 G16); `host.artifactTypes` is the capability IDENTIFIER used in pack `peerDependencies`, not this key.",
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "Host honors registered artifact types — validates an artifact whose type is registered (pack-installed or host-native) against that type's schema before emitting `artifact.created`, setting `registered: true` + `registrationSource`. Unregistered types stay accepted unvalidated with `registered: false`." },
-        "store": { "type": "boolean", "description": "`true` ⇒ the host persists artifacts of registered types AND emits `artifact.created`. Advertising this is a commitment to emit; RFC 0142 leg B is the witness." },
-        "render": { "type": "boolean", "description": "Advisory — the spec defines no rendering surface. A host advertising `false` for a type it can `store` MUST still accept and store the artifact and MUST NOT fail the run for lack of a renderer (the store-without-render negotiation guarantee)." },
-        "export": { "type": "array", "items": { "type": "string" }, "description": "Export-format identifiers the host can materialize, drawn from declared `exportFormats`. Advisory." },
+        "supported": {
+          "type": "boolean",
+          "description": "Host honors registered artifact types \u2014 validates an artifact whose type is registered (pack-installed or host-native) against that type's schema before emitting `artifact.created`, setting `registered: true` + `registrationSource`. Unregistered types stay accepted unvalidated with `registered: false`."
+        },
+        "store": {
+          "type": "boolean",
+          "description": "`true` \u21d2 the host persists artifacts of registered types AND emits `artifact.created`. Advertising this is a commitment to emit; RFC 0142 leg B is the witness."
+        },
+        "render": {
+          "type": "boolean",
+          "description": "Advisory \u2014 the spec defines no rendering surface. A host advertising `false` for a type it can `store` MUST still accept and store the artifact and MUST NOT fail the run for lack of a renderer (the store-without-render negotiation guarantee)."
+        },
+        "export": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Export-format identifiers the host can materialize, drawn from declared `exportFormats`. Advisory."
+        },
         "types": {
           "type": "object",
-          "description": "RFC 0075 per-type facets, keyed by `artifactTypeId`. Each entry overrides the global object for that type; the global object is the fallback for any type not listed (absent ⇒ host-global semantics; any facet absent ⇒ the global default — additive).",
+          "description": "RFC 0075 per-type facets, keyed by `artifactTypeId`. Each entry overrides the global object for that type; the global object is the fallback for any type not listed (absent \u21d2 host-global semantics; any facet absent \u21d2 the global default \u2014 additive).",
           "additionalProperties": {
             "type": "object",
             "additionalProperties": false,
             "properties": {
-              "validated": { "type": "boolean", "description": "The runtime validation guarantee — `true` ⇒ the host validates this type before emit, so emits `registered: true`. Decoupled from `schemaVersions`, which is a version DECLARATION only." },
-              "validation": { "type": "string", "enum": ["open", "closed"], "description": "Mirrors `ArtifactType.validation`, surfacing schema strictness in discovery so a consumer needn't fetch the schema. Default `\"open\"` per `COMPATIBILITY.md` §2.1." },
-              "schemaVersion": { "type": "integer", "minimum": 0 },
-              "registrationSource": { "type": "string", "enum": ["pack", "host"], "description": "RFC 0145. Provenance of this registered type: `pack` (an installed artifact-type pack backs it) or `host` (host-native, validated against a host-known schema with no pack). Mirrors `artifact.created.registrationSource` and MUST match what the host would emit for this type — the two surfaces MUST NOT disagree. OPTIONAL; absent ⇒ unspecified provenance, NOT a default of `pack`. Discloses which §\"Schema distribution\" regime applies: serving the canonical schema URL is a MUST for host-registered (no-pack) types and only a SHOULD for pack-backed ones, and nothing else in the advert reveals which. A host MUST NOT infer this from the identifier's shape — `vendor.*` is a registry namespace, not an installation claim." },
-              "store": { "type": "boolean" },
-              "render": { "type": "boolean" },
-              "export": { "type": "array", "items": { "type": "string" } }
+              "validated": {
+                "type": "boolean",
+                "description": "The runtime validation guarantee \u2014 `true` \u21d2 the host validates this type before emit, so emits `registered: true`. Decoupled from `schemaVersions`, which is a version DECLARATION only."
+              },
+              "validation": {
+                "type": "string",
+                "enum": [
+                  "open",
+                  "closed"
+                ],
+                "description": "Mirrors `ArtifactType.validation`, surfacing schema strictness in discovery so a consumer needn't fetch the schema. Default `\"open\"` per `COMPATIBILITY.md` \u00a72.1."
+              },
+              "schemaVersion": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "registrationSource": {
+                "type": "string",
+                "enum": [
+                  "pack",
+                  "host"
+                ],
+                "description": "RFC 0145. Provenance of this registered type: `pack` (an installed artifact-type pack backs it) or `host` (host-native, validated against a host-known schema with no pack). Mirrors `artifact.created.registrationSource` and MUST match what the host would emit for this type \u2014 the two surfaces MUST NOT disagree. OPTIONAL; absent \u21d2 unspecified provenance, NOT a default of `pack`. Discloses which \u00a7\"Schema distribution\" regime applies: serving the canonical schema URL is a MUST for host-registered (no-pack) types and only a SHOULD for pack-backed ones, and nothing else in the advert reveals which. A host MUST NOT infer this from the identifier's shape \u2014 `vendor.*` is a registry namespace, not an installation claim."
+              },
+              "store": {
+                "type": "boolean"
+              },
+              "render": {
+                "type": "boolean"
+              },
+              "export": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
             }
           }
         }
@@ -1803,177 +2647,461 @@
     },
     "forms": {
       "type": "object",
-      "description": "RFC 0137; declared by RFC 0144. Host form-content-pack surface — like `artifactTypes` it adds no `ctx.forms.*` method; it advertises that the host resolves registered form templates from installed `kind: \"form-content\"` packs and instantiates them through its own normal create path. See `host-capabilities.md` §host.forms and `form-content-packs.md`. The discovery key is the PLAIN family name at the document root (RFC 0137 G16); a host may additionally carry a deprecated dotted `\"host.forms\"` mirror during migration — root `additionalProperties` stays `true` so that document remains valid.",
+      "description": "RFC 0137; declared by RFC 0144. Host form-content-pack surface \u2014 like `artifactTypes` it adds no `ctx.forms.*` method; it advertises that the host resolves registered form templates from installed `kind: \"form-content\"` packs and instantiates them through its own normal create path. See `host-capabilities.md` \u00a7host.forms and `form-content-packs.md`. The discovery key is the PLAIN family name at the document root (RFC 0137 G16); a host may additionally carry a deprecated dotted `\"host.forms\"` mirror during migration \u2014 root `additionalProperties` stays `true` so that document remains valid.",
       "additionalProperties": false,
       "properties": {
-        "contentPacks": { "type": "boolean", "description": "`true` ⇒ the host instantiates registered form templates. Normative consequences (`form-content-packs.md` §\"Instantiation\"): create through the SAME path a hand-authored form uses; degrade an unrecognized field type to a plain text input rather than failing; keep the instantiated form fully editable; execute nothing from the pack; sanitize/validate/authorize submissions exactly as hand-typed input. Pack-authored strings are UNTRUSTED and MUST propagate `meta.contentTrust: \"untrusted\"` into interpolated prompt segments (invariant `form-content-pack-string-trust-boundary`) — a signature proves authorship, not content safety." }
+        "contentPacks": {
+          "type": "boolean",
+          "description": "`true` \u21d2 the host instantiates registered form templates. Normative consequences (`form-content-packs.md` \u00a7\"Instantiation\"): create through the SAME path a hand-authored form uses; degrade an unrecognized field type to a plain text input rather than failing; keep the instantiated form fully editable; execute nothing from the pack; sanitize/validate/authorize submissions exactly as hand-typed input. Pack-authored strings are UNTRUSTED and MUST propagate `meta.contentTrust: \"untrusted\"` into interpolated prompt segments (invariant `form-content-pack-string-trust-boundary`) \u2014 a signature proves authorship, not content safety."
+        }
       }
     },
     "aiEnvelope": {
       "type": "object",
-      "description": "Declared by RFC 0144. Host typed-envelope generation surface (`ctx.aiEnvelope.generate`), routing the call through the host's BYOK provider layer. Opinionated about envelope shape, unlike the lower-level `aiProviders` capability which returns raw model output. See `host-capabilities.md` §host.aiEnvelope and `ai-envelope.md`.",
+      "description": "Declared by RFC 0144. Host typed-envelope generation surface (`ctx.aiEnvelope.generate`), routing the call through the host's BYOK provider layer. Opinionated about envelope shape, unlike the lower-level `aiProviders` capability which returns raw model output. See `host-capabilities.md` \u00a7host.aiEnvelope and `ai-envelope.md`.",
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "`true` ⇒ `ctx.aiEnvelope.generate` is exposed. Absent/`false` ⇒ packs binding this surface fail with `host_capability_missing`." },
-        "await": { "type": "boolean", "description": "`true` ⇒ `ctx.aiEnvelope.await` is ALSO exposed. `generate` is required whenever the family is advertised; `await` is required only when this sub-flag is." }
+        "supported": {
+          "type": "boolean",
+          "description": "`true` \u21d2 `ctx.aiEnvelope.generate` is exposed. Absent/`false` \u21d2 packs binding this surface fail with `host_capability_missing`."
+        },
+        "await": {
+          "type": "boolean",
+          "description": "`true` \u21d2 `ctx.aiEnvelope.await` is ALSO exposed. `generate` is required whenever the family is advertised; `await` is required only when this sub-flag is."
+        }
       }
     },
     "promptLibrary": {
       "type": "object",
-      "description": "Declared by RFC 0144. Host prompt-lookup surface (`ctx.promptLibrary.get`), returning a prompt pinned to a specific version so replay stays deterministic. Consumed by `core.ai.callPrompt`. See `host-capabilities.md` §host.promptLibrary.",
+      "description": "Declared by RFC 0144. Host prompt-lookup surface (`ctx.promptLibrary.get`), returning a prompt pinned to a specific version so replay stays deterministic. Consumed by `core.ai.callPrompt`. See `host-capabilities.md` \u00a7host.promptLibrary.",
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "`true` ⇒ `ctx.promptLibrary.get(promptId)` resolves a `{ promptId, systemPrompt, version, envelopeType? }` record. The returned `version` MUST pin the prompt text for replay." }
+        "supported": {
+          "type": "boolean",
+          "description": "`true` \u21d2 `ctx.promptLibrary.get(promptId)` resolves a `{ promptId, systemPrompt, version, envelopeType? }` record. The returned `version` MUST pin the prompt text for replay."
+        }
       }
     },
     "agentRuntime": {
       "type": "object",
-      "description": "Declared by RFC 0144. The heavyweight swarm/consensus SUPERSET of the agent surface — spawn, delegate, consensus, message-send, skill-invoke, swarm-execute over RFC 0002/0003/0007 primitives. Advertising it IMPLIES `agents.manifestRuntime` (RFC 0070 §B), since `spawn({ manifestId })` instantiates a manifest agent; hosts needing only single-agent or crew dispatch advertise that floor and omit this family. Per-tool authorization, rate limiting, and the content-free tool-call audit trail live in the top-level `toolHooks` block, NOT under this family. See `host-capabilities.md` §host.agentRuntime.",
+      "description": "Declared by RFC 0144. The heavyweight swarm/consensus SUPERSET of the agent surface \u2014 spawn, delegate, consensus, message-send, skill-invoke, swarm-execute over RFC 0002/0003/0007 primitives. Advertising it IMPLIES `agents.manifestRuntime` (RFC 0070 \u00a7B), since `spawn({ manifestId })` instantiates a manifest agent; hosts needing only single-agent or crew dispatch advertise that floor and omit this family. Per-tool authorization, rate limiting, and the content-free tool-call audit trail live in the top-level `toolHooks` block, NOT under this family. See `host-capabilities.md` \u00a7host.agentRuntime.",
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "`true` ⇒ `ctx.agentRuntime.*` is exposed AND `agents.manifestRuntime` is implied (RFC 0070 §B). A multi-tenant host additionally advertises `agents.manifestRuntime.installScope: 'tenant'` (RFC 0074) so `GET /v1/agents` scopes to the caller's owner triple." }
+        "supported": {
+          "type": "boolean",
+          "description": "`true` \u21d2 `ctx.agentRuntime.*` is exposed AND `agents.manifestRuntime` is implied (RFC 0070 \u00a7B). A multi-tenant host additionally advertises `agents.manifestRuntime.installScope: 'tenant'` (RFC 0074) so `GET /v1/agents` scopes to the caller's owner triple."
+        }
       }
     },
     "deadLetter": {
       "type": "object",
       "description": "RFC 0053 (`Draft`). Run-level dead-letter sink for terminally-failed runs/nodes. On retry exhaustion (RFC 0009), the run is routed to a durable, inspectable sink and a `run.dead_lettered` event is emitted; dead-lettered runs remain fork-eligible (RFC 0011) for the retention window. Distinct from `queueBus.deadLetterSupported`, which dead-letters transport *messages*, not *runs*.",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean" },
-        "retentionDays": { "type": "integer", "minimum": 1, "description": "Days a dead-lettered run is retained for inspection/fork before purge." }
+        "supported": {
+          "type": "boolean"
+        },
+        "retentionDays": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Days a dead-lettered run is retained for inspection/fork before purge."
+        }
       },
       "additionalProperties": false
     },
     "webhooks": {
       "type": "object",
-      "description": "Webhook delivery surface (`webhooks.md`). The base contract is best-effort (5s per-attempt timeout, a circuit breaker, no durable retry). RFC 0083 adds the OPTIONAL `durable` mode: when `true`, webhook delivery participates in the trigger-bridge durable model (subscription states + retry policy + dead-letter on exhaustion) instead of the best-effort circuit-breaker-then-drop. Absent `durable` ⇒ the best-effort default, explicitly unchanged.",
+      "description": "Webhook delivery surface (`webhooks.md`). The base contract is best-effort (5s per-attempt timeout, a circuit breaker, no durable retry). RFC 0083 adds the OPTIONAL `durable` mode: when `true`, webhook delivery participates in the trigger-bridge durable model (subscription states + retry policy + dead-letter on exhaustion) instead of the best-effort circuit-breaker-then-drop. Absent `durable` \u21d2 the best-effort default, explicitly unchanged.",
       "additionalProperties": true,
       "properties": {
-        "supported": { "type": "boolean", "description": "Host serves the `webhooks.md` signed-delivery surface." },
-        "signatureAlgorithms": { "type": "array", "items": { "type": "string" }, "uniqueItems": true, "description": "HMAC signature algorithm ids the host supports (e.g. `v1`)." },
-        "durable": { "type": "boolean", "description": "RFC 0083 §A — OPTIONAL opt-in. `true` ⇒ webhook delivery is durable (a trigger-bridge source); absent/`false` ⇒ the best-effort `webhooks.md` contract, unchanged. The best-effort default is NOT relaxed." }
+        "supported": {
+          "type": "boolean",
+          "description": "Host serves the `webhooks.md` signed-delivery surface."
+        },
+        "signatureAlgorithms": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true,
+          "description": "HMAC signature algorithm ids the host supports (e.g. `v1`)."
+        },
+        "durable": {
+          "type": "boolean",
+          "description": "RFC 0083 \u00a7A \u2014 OPTIONAL opt-in. `true` \u21d2 webhook delivery is durable (a trigger-bridge source); absent/`false` \u21d2 the best-effort `webhooks.md` contract, unchanged. The best-effort default is NOT relaxed."
+        }
       }
     },
     "triggerBridge": {
       "type": "object",
-      "description": "RFC 0083 (`Active`). Composes the existing scheduling (RFC 0052), dead-letter (RFC 0053), queue-bus (RFC 0017), webhook, and cross-host-causation (RFC 0040) primitives into one uniform durable inbound-work contract: standardized subscription states + a delivery-attempt/dedup/retry model + trigger→run causation. Backs the derived `openwop-trigger-bridge` profile. Channels (Slack/email/SMS) stay vendor extensions (§E) — only their bridge into a run is uniform. Hosts that omit it have no uniform trigger contract (today's behavior); the conformance behavioral scenarios skip cleanly.",
-      "required": ["supported"],
+      "description": "RFC 0083 (`Active`). Composes the existing scheduling (RFC 0052), dead-letter (RFC 0053), queue-bus (RFC 0017), webhook, and cross-host-causation (RFC 0040) primitives into one uniform durable inbound-work contract: standardized subscription states + a delivery-attempt/dedup/retry model + trigger\u2192run causation. Backs the derived `openwop-trigger-bridge` profile. Channels (Slack/email/SMS) stay vendor extensions (\u00a7E) \u2014 only their bridge into a run is uniform. Hosts that omit it have no uniform trigger contract (today's behavior); the conformance behavioral scenarios skip cleanly.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "REQUIRED when present. `true` ⇒ the host implements the §B state machine + §C delivery model + emits the two `trigger.*` events." },
-        "subscriptionStates": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["active", "paused", "failed", "dead-lettered"] }, "description": "The subscription states the host implements (the §B four-state vocabulary). Absent ⇒ at least `active` + `dead-lettered`." },
-        "dedup": { "type": "boolean", "description": "`true` ⇒ the host de-duplicates inbound events by `dedupKey` within the retention window (§C-1; at-least-once becomes effectively-once)." },
+        "supported": {
+          "type": "boolean",
+          "description": "REQUIRED when present. `true` \u21d2 the host implements the \u00a7B state machine + \u00a7C delivery model + emits the two `trigger.*` events."
+        },
+        "subscriptionStates": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": [
+              "active",
+              "paused",
+              "failed",
+              "dead-lettered"
+            ]
+          },
+          "description": "The subscription states the host implements (the \u00a7B four-state vocabulary). Absent \u21d2 at least `active` + `dead-lettered`."
+        },
+        "dedup": {
+          "type": "boolean",
+          "description": "`true` \u21d2 the host de-duplicates inbound events by `dedupKey` within the retention window (\u00a7C-1; at-least-once becomes effectively-once)."
+        },
         "retryPolicy": {
           "type": "object",
           "additionalProperties": false,
-          "description": "The host's default delivery retry policy (§C-2).",
+          "description": "The host's default delivery retry policy (\u00a7C-2).",
           "properties": {
-            "maxAttempts": { "type": "integer", "minimum": 1, "description": "Max delivery attempts before dead-lettering." },
-            "backoff": { "type": "string", "enum": ["none", "fixed", "exponential"], "description": "Backoff strategy between attempts." }
+            "maxAttempts": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Max delivery attempts before dead-lettering."
+            },
+            "backoff": {
+              "type": "string",
+              "enum": [
+                "none",
+                "fixed",
+                "exponential"
+              ],
+              "description": "Backoff strategy between attempts."
+            }
           }
         },
-        "sources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "schedule", "queue", "email", "form", "stream", "change"] }, "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source — the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset." },
+        "sources": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": [
+              "webhook",
+              "schedule",
+              "queue",
+              "email",
+              "form",
+              "stream",
+              "change"
+            ]
+          },
+          "description": "Which trigger sources bridge uniformly. A source listed here MUST have a registerable `TriggerSubscription` driven through the four-state machine AND emit the two `trigger.*` events for that source \u2014 the list MUST NOT over-claim a source the host has as a feature but does not wire as a durable trigger subscription. A consumer MUST tolerate any subset."
+        },
         "ingestion": {
           "type": "object",
           "additionalProperties": false,
-          "description": "RFC 0099 §F.3 (additive). External-event ingestion advertisement — which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`/`stream`/`change`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent ⇒ the host does NOT externally-ingest (today's behavior — schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run — over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
+          "description": "RFC 0099 \u00a7F.3 (additive). External-event ingestion advertisement \u2014 which of `sources[]` the host actually ingests from EXTERNALLY-originated events (`webhook`/`email`/`form`/`stream`/`change`), normalizing each to a `TriggerEvent` (`trigger-event.schema.json`) and starting a run. Absent \u21d2 the host does NOT externally-ingest (today's behavior \u2014 schedule/queue only). A source in `externalSources[]` MUST actually accept an external event, normalize it, and start a run \u2014 over-claiming is a dishonest advertisement. A consumer MUST tolerate any subset.",
           "properties": {
-            "externalSources": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook", "email", "form", "stream", "change"] }, "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099 (`stream`/`change` per RFC 0127). The honesty gate — each MUST normalize to a `TriggerEvent` and start a run." },
-            "maxBodyBytes": { "type": "integer", "minimum": 1, "description": "Inbound body cap (webhook body / email / form), reusing the RFC 0076 §B response-cap discipline." },
-            "verification": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["webhook-signature", "email-dmarc", "form-origin"] }, "description": "Which source-authenticity checks the host performs. An advertised check MUST actually be performed (RFC 0099 §F.3 / UQ1)." },
-            "registrationEndpoint": { "type": "boolean", "description": "`true` ⇒ the host serves `POST /v1/trigger-subscriptions` (RFC 0099 §F.2) for portable external-event subscription creation." }
+            "externalSources": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "enum": [
+                  "webhook",
+                  "email",
+                  "form",
+                  "stream",
+                  "change"
+                ]
+              },
+              "description": "Which of `sources[]` are EXTERNALLY ingested per RFC 0099 (`stream`/`change` per RFC 0127). The honesty gate \u2014 each MUST normalize to a `TriggerEvent` and start a run."
+            },
+            "maxBodyBytes": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Inbound body cap (webhook body / email / form), reusing the RFC 0076 \u00a7B response-cap discipline."
+            },
+            "verification": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "enum": [
+                  "webhook-signature",
+                  "email-dmarc",
+                  "form-origin"
+                ]
+              },
+              "description": "Which source-authenticity checks the host performs. An advertised check MUST actually be performed (RFC 0099 \u00a7F.3 / UQ1)."
+            },
+            "registrationEndpoint": {
+              "type": "boolean",
+              "description": "`true` \u21d2 the host serves `POST /v1/trigger-subscriptions` (RFC 0099 \u00a7F.2) for portable external-event subscription creation."
+            }
           }
         }
       }
     },
-    "a2a": {
-      "type": "object",
-      "additionalProperties": false,
-      "description": "RFC 0100 (`Active`). The host exposes itself as an A2A (Agent2Agent) agent. `supported: true` alone ⇒ the SYNCHRONOUS `message/send` → poll `tasks/get` round-trip already specified by `a2a-integration.md` (today's behavior — no regression). The optional `streaming`/`pushNotifications`/`durableTasks` flags gate the RFC 0100 async/durable additions (resubscribe re-attach, push config, persisted `A2ATaskState` so `tasks/get` returns live state after disconnect). Absent block ⇒ no A2A advertisement.",
-      "required": ["supported", "agentCardUrl"],
-      "properties": {
-        "supported": { "type": "boolean", "description": "Host exposes itself as an A2A agent." },
-        "agentCardUrl": { "type": "string", "format": "uri", "description": "The A2A 0.3 well-known agent card URL (`/.well-known/agent-card.json`)." },
-        "streaming": { "type": "boolean", "description": "Host supports `message/stream` + `tasks/resubscribe` (A2A `capabilities.streaming`). Gates the RFC 0100 §3 resubscribe re-attach." },
-        "pushNotifications": { "type": "boolean", "description": "Host supports A2A push-notification config (A2A `capabilities.push_notifications`). Gates the RFC 0100 §4 push contract; a caller-supplied `pushConfig.url` is SSRF-validated (`a2a-push-egress-ssrf`)." },
-        "durableTasks": { "type": "boolean", "description": "RFC 0100 §2. Host PERSISTS the projected Task (`A2ATaskState`) per backing run; `tasks/get` returns live state after disconnect. Absent/false ⇒ synchronous round-trip only." }
-      }
-    },
+    "a2a": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "RFC 0100 (`Active`). The host exposes itself as an A2A (Agent2Agent) agent. `supported: true` alone \u21d2 the SYNCHRONOUS `message/send` \u2192 poll `tasks/get` round-trip already specified by `a2a-integration.md` (today's behavior \u2014 no regression). The optional `streaming`/`pushNotifications`/`durableTasks` flags gate the RFC 0100 async/durable additions (resubscribe re-attach, push config, persisted `A2ATaskState` so `tasks/get` returns live state after disconnect). Absent block \u21d2 no A2A advertisement.",
+      "required": [
+        "supported",
+        "agentCardUrl"
+      ],
+      "properties": {
+        "supported": {
+          "type": "boolean",
+          "description": "Host exposes itself as an A2A agent."
+        },
+        "agentCardUrl": {
+          "type": "string",
+          "format": "uri",
+          "description": "The A2A 0.3 well-known agent card URL (`/.well-known/agent-card.json`)."
+        },
+        "streaming": {
+          "type": "boolean",
+          "description": "Host supports `message/stream` + `tasks/resubscribe` (A2A `capabilities.streaming`). Gates the RFC 0100 \u00a73 resubscribe re-attach."
+        },
+        "pushNotifications": {
+          "type": "boolean",
+          "description": "Host supports A2A push-notification config (A2A `capabilities.push_notifications`). Gates the RFC 0100 \u00a74 push contract; a caller-supplied `pushConfig.url` is SSRF-validated (`a2a-push-egress-ssrf`)."
+        },
+        "durableTasks": {
+          "type": "boolean",
+          "description": "RFC 0100 \u00a72. Host PERSISTS the projected Task (`A2ATaskState`) per backing run; `tasks/get` returns live state after disconnect. Absent/false \u21d2 synchronous round-trip only."
+        },
+        "protocolVersions": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[0-9]+\\.[0-9]+$"
+          },
+          "description": "RFC 0152 \u00a7A \u2014 every A2A protocol version this host speaks, newest-preferred first by convention. An A2A-capable host MUST advertise a non-empty array. `supported: true` WITHOUT versions is deprecated and CANNOT substantiate a current-A2A claim: it says the host speaks some A2A, which is not a fact a peer can negotiate against."
+        },
+        "preferredVersion": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+$",
+          "description": "RFC 0152 \u00a7A \u2014 MUST be present in `protocolVersions`. New hosts SHOULD prefer `1.0`."
+        },
+        "profiles": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^a2a-[0-9]+\\.[0-9]+(-legacy)?$"
+          },
+          "description": "RFC 0152 \u00a7A \u2014 named composition profiles, e.g. `a2a-1.0`, `a2a-0.3-legacy`. A legacy-only host advertises only the `-legacy` profile, which makes the deprecation explicit and time-boundable rather than implicit in a bare `supported: true`."
+        }
+      }
+    },
     "budget": {
       "type": "object",
-      "description": "RFC 0084 (`Active`). Enforceable per-run SPEND governance — the reserved `budget` run-options key (`budget-policy.schema.json`), the content-free `budget.{reserved,consumed,threshold.crossed,exhausted}` events, and hard-stop enforcement via `cap.breached{kind:\"budget-*\"}`. Orthogonal to RFC 0058 (which owns wall-time + loop-iterations via `limits.maxRunDurationMs`/`maxLoopIterations`); they share only the `cap.breached` overflow event. Hosts that omit it perform no spend enforcement (today's behavior); the conformance behavioral scenarios skip cleanly.",
-      "required": ["supported"],
+      "description": "RFC 0084 (`Active`). Enforceable per-run SPEND governance \u2014 the reserved `budget` run-options key (`budget-policy.schema.json`), the content-free `budget.{reserved,consumed,threshold.crossed,exhausted}` events, and hard-stop enforcement via `cap.breached{kind:\"budget-*\"}`. Orthogonal to RFC 0058 (which owns wall-time + loop-iterations via `limits.maxRunDurationMs`/`maxLoopIterations`); they share only the `cap.breached` overflow event. Hosts that omit it perform no spend enforcement (today's behavior); the conformance behavioral scenarios skip cleanly.",
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false,
       "properties": {
-        "supported": { "type": "boolean", "description": "REQUIRED when present. `true` ⇒ the host resolves the `budget` policy, emits the `budget.*` events, and (when `enforce: \"hard\"`) stops the run on exhaustion." },
-        "dimensions": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["tokens", "cost", "toolCalls", "retries", "model"] }, "description": "Which budget dimensions the host actually enforces (truthful — advertise only what it honors). A consumer MUST tolerate any subset." },
-        "enforce": { "type": "string", "enum": ["hard", "advisory"], "description": "`hard`: exhaustion emits `cap.breached` + stops the run. `advisory`: emits the events but MUST NOT stop the run (honest advertisement of observe-only)." },
-        "scopes": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["run", "workflow", "agent", "project"] }, "description": "Which budget scopes the host honors (§B). Absent ⇒ at least `run`." }
+        "supported": {
+          "type": "boolean",
+          "description": "REQUIRED when present. `true` \u21d2 the host resolves the `budget` policy, emits the `budget.*` events, and (when `enforce: \"hard\"`) stops the run on exhaustion."
+        },
+        "dimensions": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": [
+              "tokens",
+              "cost",
+              "toolCalls",
+              "retries",
+              "model"
+            ]
+          },
+          "description": "Which budget dimensions the host actually enforces (truthful \u2014 advertise only what it honors). A consumer MUST tolerate any subset."
+        },
+        "enforce": {
+          "type": "string",
+          "enum": [
+            "hard",
+            "advisory"
+          ],
+          "description": "`hard`: exhaustion emits `cap.breached` + stops the run. `advisory`: emits the events but MUST NOT stop the run (honest advertisement of observe-only)."
+        },
+        "scopes": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": [
+              "run",
+              "workflow",
+              "agent",
+              "project"
+            ]
+          },
+          "description": "Which budget scopes the host honors (\u00a7B). Absent \u21d2 at least `run`."
+        }
       }
     },
     "nondeterminismPolicy": {
       "type": "object",
-      "description": "RFC 0085. A host that does NOT support replay/fork (`replay.supported`) MAY instead DECLARE that it is honestly nondeterministic — satisfying the `openwop-agent-platform` floor's replay-OR-policy term (`agent-platform-profile.md` §B) without claiming a replay capability it lacks. Absent ⇒ the floor's replay term must be met by `replay.supported`.",
-      "required": ["declared"],
+      "description": "RFC 0085. A host that does NOT support replay/fork (`replay.supported`) MAY instead DECLARE that it is honestly nondeterministic \u2014 satisfying the `openwop-agent-platform` floor's replay-OR-policy term (`agent-platform-profile.md` \u00a7B) without claiming a replay capability it lacks. Absent \u21d2 the floor's replay term must be met by `replay.supported`.",
+      "required": [
+        "declared"
+      ],
       "additionalProperties": false,
       "properties": {
-        "declared": { "type": "boolean", "description": "When `true`, the host documents its nondeterminism (it does not guarantee deterministic replay). A bare flag for v1.x (RFC 0085 §UQ2); a structured per-source policy is a future refinement." }
+        "declared": {
+          "type": "boolean",
+          "description": "When `true`, the host documents its nondeterminism (it does not guarantee deterministic replay). A bare flag for v1.x (RFC 0085 \u00a7UQ2); a structured per-source policy is a future refinement."
+        }
       }
     },
     "workspace": {
       "type": "object",
-      "description": "RFC 0059 (`Active`). Versioned, tenant·workspace-scoped ground-truth file store (the `host.workspace` capability). Scopes to the RFC 0048 owner triple. Atomic, optimistically-concurrent writes (`If-Match` ETag); a read snapshot is exposed to every run at `run.started` (deterministic for replay). Complements the transactional `MemoryAdapter` (RFC 0004) with a durable, path-addressable file layer. Endpoints (`/v1/host/workspace/files[/{path}]`) are gated on `supported: true`; unsupported hosts return `501 capability_not_provided`. SECURITY invariants `workspace-cross-tenant-isolation` (WCT-1) + the WSR-1 secret-redaction MUST land with their conformance tests at implementation (RFC 0059 §E).",
-      "required": ["supported"],
+      "description": "RFC 0059 (`Active`). Versioned, tenant\u00b7workspace-scoped ground-truth file store (the `host.workspace` capability). Scopes to the RFC 0048 owner triple. Atomic, optimistically-concurrent writes (`If-Match` ETag); a read snapshot is exposed to every run at `run.started` (deterministic for replay). Complements the transactional `MemoryAdapter` (RFC 0004) with a durable, path-addressable file layer. Endpoints (`/v1/host/workspace/files[/{path}]`) are gated on `supported: true`; unsupported hosts return `501 capability_not_provided`. SECURITY invariants `workspace-cross-tenant-isolation` (WCT-1) + the WSR-1 secret-redaction MUST land with their conformance tests at implementation (RFC 0059 \u00a7E).",
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean", "description": "Host implements the RFC 0059 workspace file store + endpoints + `workspace.updated` event." },
-        "versioned": { "type": "boolean", "description": "Each write bumps a monotonic `version`; prior versions are retrievable via `GET …/files/{path}?version=N`. Latest-version retrieval is the MUST regardless; history is best-effort up to `maxVersions`." },
-        "maxFileBytes": { "type": "integer", "minimum": 1, "description": "Per-file byte ceiling; writes beyond it return `workspace_too_large`." },
-        "maxFiles": { "type": "integer", "minimum": 1, "description": "Per-workspace file-count ceiling." },
-        "maxVersions": { "type": "integer", "minimum": 1, "description": "When `versioned: true`, the number of historical versions a host advertises it will retain (history best-effort beyond the mandatory latest)." }
+        "supported": {
+          "type": "boolean",
+          "description": "Host implements the RFC 0059 workspace file store + endpoints + `workspace.updated` event."
+        },
+        "versioned": {
+          "type": "boolean",
+          "description": "Each write bumps a monotonic `version`; prior versions are retrievable via `GET \u2026/files/{path}?version=N`. Latest-version retrieval is the MUST regardless; history is best-effort up to `maxVersions`."
+        },
+        "maxFileBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Per-file byte ceiling; writes beyond it return `workspace_too_large`."
+        },
+        "maxFiles": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Per-workspace file-count ceiling."
+        },
+        "maxVersions": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "When `versioned: true`, the number of historical versions a host advertises it will retain (history best-effort beyond the mandatory latest)."
+        }
       },
       "additionalProperties": false
     },
     "uiPlugins": {
       "type": "object",
-      "description": "RFC 0117 (`Active`; amended by RFC 0119). Host loads SIGNED, SANDBOXED front-end plugin packs (`kind: \"frontend-plugin\"`) — canvas editors, custom artifact viewers, settings panels — in an ORIGIN/EXECUTION-ISOLATED sandbox (mechanism named by `isolation`: cross-origin iframe by default, or wasm/process/container/vm) and talks to them over the closed `ui-plugin/1` host-RPC boundary. The wire owns the boundary (isolation + RPC allowlist + manifest), NOT a renderer. Gated on `supported: true`; a host that does not advertise it rejects `kind: \"frontend-plugin\"` packs at registration and renders no plugin surface (graceful degradation to RFC 0071 host rendering). SECURITY invariants `frontend-plugin-isolation` / `frontend-plugin-egress` / `frontend-plugin-rpc-allowlist` / `frontend-plugin-no-byok` (RFC 0117 §Security).",
-      "required": ["supported"],
+      "description": "RFC 0117 (`Active`; amended by RFC 0119). Host loads SIGNED, SANDBOXED front-end plugin packs (`kind: \"frontend-plugin\"`) \u2014 canvas editors, custom artifact viewers, settings panels \u2014 in an ORIGIN/EXECUTION-ISOLATED sandbox (mechanism named by `isolation`: cross-origin iframe by default, or wasm/process/container/vm) and talks to them over the closed `ui-plugin/1` host-RPC boundary. The wire owns the boundary (isolation + RPC allowlist + manifest), NOT a renderer. Gated on `supported: true`; a host that does not advertise it rejects `kind: \"frontend-plugin\"` packs at registration and renders no plugin surface (graceful degradation to RFC 0071 host rendering). SECURITY invariants `frontend-plugin-isolation` / `frontend-plugin-egress` / `frontend-plugin-rpc-allowlist` / `frontend-plugin-no-byok` (RFC 0117 \u00a7Security).",
+      "required": [
+        "supported"
+      ],
       "properties": {
-        "supported": { "type": "boolean", "description": "Host loads `kind: \"frontend-plugin\"` packs in an origin/execution-isolated sandbox (mechanism per `isolation`) and serves the `ui-plugin/1` host-RPC boundary." },
+        "supported": {
+          "type": "boolean",
+          "description": "Host loads `kind: \"frontend-plugin\"` packs in an origin/execution-isolated sandbox (mechanism per `isolation`) and serves the `ui-plugin/1` host-RPC boundary."
+        },
         "isolation": {
           "type": "string",
           "anyOf": [
-            { "enum": ["cross-origin-iframe", "wasm", "process", "container", "vm"] },
-            { "pattern": "^x-host-[a-z0-9-]+-[a-z0-9-]+$" }
+            {
+              "enum": [
+                "cross-origin-iframe",
+                "wasm",
+                "process",
+                "container",
+                "vm"
+              ]
+            },
+            {
+              "pattern": "^x-host-[a-z0-9-]+-[a-z0-9-]+$"
+            }
           ],
           "default": "cross-origin-iframe",
-          "description": "RFC 0117 (amended by RFC 0119). The categorical isolation model the host enforces for plugin bytes. `cross-origin-iframe` = a distinct-origin sandboxed browser frame (the browser default; §Isolation). `wasm`/`process`/`container`/`vm` mirror `sandbox.isolationModel` (RFC 0035) for non-browser hosts that enforce the SAME isolation property. Vendor-specific models advertise `^x-host-<host>-<key>$` per `host-extensions.md`. ALL values denote the SAME mandatory property (`frontend-plugin-isolation`): plugin bytes execute in a boundary with no access to the host's execution context / DOM / origin-storage / credentials, deny-egress by default, and all host interaction mediated by the closed `ui-plugin/1` RPC. The field names the MECHANISM, never relaxes the property. In-process / same-origin / module-federation loading is a protocol-tier MUST NOT regardless of the advertised value."
+          "description": "RFC 0117 (amended by RFC 0119). The categorical isolation model the host enforces for plugin bytes. `cross-origin-iframe` = a distinct-origin sandboxed browser frame (the browser default; \u00a7Isolation). `wasm`/`process`/`container`/`vm` mirror `sandbox.isolationModel` (RFC 0035) for non-browser hosts that enforce the SAME isolation property. Vendor-specific models advertise `^x-host-<host>-<key>$` per `host-extensions.md`. ALL values denote the SAME mandatory property (`frontend-plugin-isolation`): plugin bytes execute in a boundary with no access to the host's execution context / DOM / origin-storage / credentials, deny-egress by default, and all host interaction mediated by the closed `ui-plugin/1` RPC. The field names the MECHANISM, never relaxes the property. In-process / same-origin / module-federation loading is a protocol-tier MUST NOT regardless of the advertised value."
         },
         "surfaces": {
           "type": "array",
-          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation). `canvas-preview` (RFC 0130) mounts inside a host-owned canvas editor.",
-          "items": { "type": "string", "enum": ["artifact-viewer", "route", "settings-panel", "canvas-preview"] },
+          "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (\u00a7Degradation). `canvas-preview` (RFC 0130) mounts inside a host-owned canvas editor.",
+          "items": {
+            "type": "string",
+            "enum": [
+              "artifact-viewer",
+              "route",
+              "settings-panel",
+              "canvas-preview"
+            ]
+          },
           "uniqueItems": true
         },
         "hostApi": {
           "type": "array",
-          "description": "The `ui-plugin/1` host-RPC methods this host honors. A plugin call to a method not in this set (regardless of the plugin's declared `hostApi`) MUST be rejected with `method_not_allowed` (`frontend-plugin-rpc-allowlist`). A host advertising `artifact.write` MUST enforce the `version`-token optimistic concurrency (RFC 0117 §Concurrency).",
-          "items": { "type": "string", "enum": ["artifact.read", "artifact.write", "host.toast", "host.navigate", "host.announce"] },
+          "description": "The `ui-plugin/1` host-RPC methods this host honors. A plugin call to a method not in this set (regardless of the plugin's declared `hostApi`) MUST be rejected with `method_not_allowed` (`frontend-plugin-rpc-allowlist`). A host advertising `artifact.write` MUST enforce the `version`-token optimistic concurrency (RFC 0117 \u00a7Concurrency).",
+          "items": {
+            "type": "string",
+            "enum": [
+              "artifact.read",
+              "artifact.write",
+              "host.toast",
+              "host.navigate",
+              "host.announce"
+            ]
+          },
           "uniqueItems": true
         },
-        "maxEntryBytes": { "type": "integer", "minimum": 1, "description": "Per-plugin entry-bundle byte ceiling the host will load." }
+        "maxEntryBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Per-plugin entry-bundle byte ceiling the host will load."
+        }
       },
       "additionalProperties": false
     },
     "sql": {
       "type": "object",
-      "description": "RFC 0018 (`Active`). SQL database adapter with parametric-only enforcement. Hosts MUST reject non-parametric queries that inline user input (`sql-parametric-only` invariant — guards against SQL injection across every workflow).",
+      "description": "RFC 0018 (`Active`). SQL database adapter with parametric-only enforcement. Hosts MUST reject non-parametric queries that inline user input (`sql-parametric-only` invariant \u2014 guards against SQL injection across every workflow).",
       "properties": {
-        "supported": { "type": "boolean" },
-        "datasources": { "type": "array", "items": { "type": "object", "additionalProperties": true } },
-        "transactions": { "type": "boolean" },
+        "supported": {
+          "type": "boolean"
+        },
+        "datasources": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "transactions": {
+          "type": "boolean"
+        },
         "drivers": {
           "type": "array",
-          "items": { "type": "string", "enum": ["postgres", "mysql", "mariadb", "sqlite", "mssql", "clickhouse", "snowflake", "bigquery", "duckdb"] }
+          "items": {
+            "type": "string",
+            "enum": [
+              "postgres",
+              "mysql",
+              "mariadb",
+              "sqlite",
+              "mssql",
+              "clickhouse",
+              "snowflake",
+              "bigquery",
+              "duckdb"
+            ]
+          }
         }
       },
       "additionalProperties": false
@@ -1982,9 +3110,24 @@
       "type": "object",
       "description": "RFC 0018 (`Active`). MongoDB-shape document store adapter.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "datasources": { "type": "array" },
-        "drivers": { "type": "array", "items": { "type": "string", "enum": ["mongodb", "dynamodb", "cosmosdb", "firestore"] } }
+        "supported": {
+          "type": "boolean"
+        },
+        "datasources": {
+          "type": "array"
+        },
+        "drivers": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "mongodb",
+              "dynamodb",
+              "cosmosdb",
+              "firestore"
+            ]
+          }
+        }
       },
       "additionalProperties": false
     },
@@ -1992,11 +3135,29 @@
       "type": "object",
       "description": "RFC 0018 (`Active`). Vector-DB capability for k-NN search.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "collections": { "type": "array" },
+        "supported": {
+          "type": "boolean"
+        },
+        "collections": {
+          "type": "array"
+        },
         "backends": {
           "type": "array",
-          "items": { "type": "string", "enum": ["pinecone", "qdrant", "weaviate", "milvus", "pgvector", "redis", "mongodb-atlas", "chroma", "azure-ai-search", "in-memory"] }
+          "items": {
+            "type": "string",
+            "enum": [
+              "pinecone",
+              "qdrant",
+              "weaviate",
+              "milvus",
+              "pgvector",
+              "redis",
+              "mongodb-atlas",
+              "chroma",
+              "azure-ai-search",
+              "in-memory"
+            ]
+          }
         }
       },
       "additionalProperties": false
@@ -2005,11 +3166,24 @@
       "type": "object",
       "description": "RFC 0018 (`Active`). Full-text search index adapter.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "indexes": { "type": "array" },
+        "supported": {
+          "type": "boolean"
+        },
+        "indexes": {
+          "type": "array"
+        },
         "backends": {
           "type": "array",
-          "items": { "type": "string", "enum": ["elasticsearch", "opensearch", "meilisearch", "typesense", "algolia"] }
+          "items": {
+            "type": "string",
+            "enum": [
+              "elasticsearch",
+              "opensearch",
+              "meilisearch",
+              "typesense",
+              "algolia"
+            ]
+          }
         }
       },
       "additionalProperties": false
@@ -2018,26 +3192,43 @@
       "type": "object",
       "description": "RFC 0019 (`Active`). Binary artifact store with presigned URLs. Per-bucket tenant isolation. Presigned URLs MUST expire at the advertised TTL.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "buckets": { "type": "array" },
-        "presignSupported": { "type": "boolean" },
-        "maxObjectBytes": { "type": "integer", "minimum": 0 }
+        "supported": {
+          "type": "boolean"
+        },
+        "buckets": {
+          "type": "array"
+        },
+        "presignSupported": {
+          "type": "boolean"
+        },
+        "maxObjectBytes": {
+          "type": "integer",
+          "minimum": 0
+        }
       },
       "additionalProperties": false
     },
     "cache": {
       "type": "object",
-      "description": "RFC 0019 (`Active`). TTL cache for HTTP / AI response memoization. Per-tenant scoping; TTL drift ≤ 1s.",
+      "description": "RFC 0019 (`Active`). TTL cache for HTTP / AI response memoization. Per-tenant scoping; TTL drift \u2264 1s.",
       "properties": {
-        "supported": { "type": "boolean" },
-        "maxValueBytes": { "type": "integer", "minimum": 0 },
-        "maxTtlSeconds": { "type": "integer", "minimum": 0 }
+        "supported": {
+          "type": "boolean"
+        },
+        "maxValueBytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "maxTtlSeconds": {
+          "type": "integer",
+          "minimum": 0
+        }
       },
       "additionalProperties": false
     },
     "workflowChainPacks": {
       "type": "object",
-      "description": "RFC 0013 (Phase 1, `Draft`). When `supported: true`, the host's workflow editor implements workflow-chain pack expansion per `workflow-chain-packs.md` — author drops a chain tile, host resolves the pack, prompts for `parameters`, substitutes `{{params.<name>}}` placeholders, rewrites node ids, splices the resulting DAG into the parent workflow. Hosts that don't implement expansion omit this block (or set `supported: false`); conformance scenarios under `conformance/src/scenarios/workflow-chain-*.test.ts` skip cleanly against those hosts.",
+      "description": "RFC 0013 (Phase 1, `Draft`). When `supported: true`, the host's workflow editor implements workflow-chain pack expansion per `workflow-chain-packs.md` \u2014 author drops a chain tile, host resolves the pack, prompts for `parameters`, substitutes `{{params.<name>}}` placeholders, rewrites node ids, splices the resulting DAG into the parent workflow. Hosts that don't implement expansion omit this block (or set `supported: false`); conformance scenarios under `conformance/src/scenarios/workflow-chain-*.test.ts` skip cleanly against those hosts.",
       "properties": {
         "supported": {
           "type": "boolean",
@@ -2045,23 +3236,25 @@
         },
         "deferredParameters": {
           "type": "object",
-          "description": "RFC 0124 (WCP4, `Active`). OPTIONAL. When `supported: true`, the host offers a capability-gated deferred-parameter expansion mode in ADDITION to expansion-time substitution (which remains the default and floor): at drop time it materializes the chain's `parameters` into top-level workflow `variables[]` (author value as `defaultValue`) and rewrites `{{params.<name>}}` into a spec'd runtime binding (PromptTemplate `{{varName}}` with `source:\"variable\"`, or a variable-sourced PortValue), so chain parameters stay overridable per run via `configurable` while the persisted definition keeps ZERO `{{params.*}}` tokens. A parameter marked `x-openwop-sensitive` MUST be deferred or the expansion fail-closed (`sensitive_param_not_deferrable`, 422) — never frozen into persisted `config`. Omission (or `supported:false`) signals the host does NOT offer deferred mode. No host may advertise `supported:true` until RFC 0124 is `Accepted`. See `workflow-chain-packs.md` §\"Deferred-parameter expansion\".",
+          "description": "RFC 0124 (WCP4, `Active`). OPTIONAL. When `supported: true`, the host offers a capability-gated deferred-parameter expansion mode in ADDITION to expansion-time substitution (which remains the default and floor): at drop time it materializes the chain's `parameters` into top-level workflow `variables[]` (author value as `defaultValue`) and rewrites `{{params.<name>}}` into a spec'd runtime binding (PromptTemplate `{{varName}}` with `source:\"variable\"`, or a variable-sourced PortValue), so chain parameters stay overridable per run via `configurable` while the persisted definition keeps ZERO `{{params.*}}` tokens. A parameter marked `x-openwop-sensitive` MUST be deferred or the expansion fail-closed (`sensitive_param_not_deferrable`, 422) \u2014 never frozen into persisted `config`. Omission (or `supported:false`) signals the host does NOT offer deferred mode. No host may advertise `supported:true` until RFC 0124 is `Accepted`. See `workflow-chain-packs.md` \u00a7\"Deferred-parameter expansion\".",
           "properties": {
             "supported": {
               "type": "boolean",
               "description": "Whether the host offers the deferred-parameter expansion mode. Requires `capabilities.prompts.supported: true` with `variable` in `prompts.variableSources` for the prompt-bearing rewrite path."
             }
           },
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false
         },
         "hostExpansionSeam": {
           "type": "boolean",
-          "description": "RFC 0013 erratum (2026-07-05). OPTIONAL. A **conformance-only test seam** advertisement (category: test harness, cf. `observability.testSeams` — NOT a product capability): when `true`, the host serves `POST /v1/host/sample/workflow-chain:expand` returning the `vendor.openwop.workflow-chain-sample` v1.0.0 expansion that `conformance/src/scenarios/workflow-chain-host-expansion.test.ts` asserts against. Absent/`false` ⇒ that live-host expansion scenario soft-skips; the semantic `workflowChainPacks.supported` claim is witnessed by the server-free `workflow-chain-expansion.test.ts` legs. This flag is DISTINCT from `deferredParameters` (RFC 0124), which is witnessed through its own `POST /v1/host/sample/chain/deferred-expand` seam — so a host MAY advertise `supported` / `deferredParameters.supported` without standing up the RFC 0013 sample-pack seam it was never handed a published fixture for. Advertising `supported:true` no longer conscripts a host into the RFC 0013 host-expansion scenario."
+          "description": "RFC 0013 erratum (2026-07-05). OPTIONAL. A **conformance-only test seam** advertisement (category: test harness, cf. `observability.testSeams` \u2014 NOT a product capability): when `true`, the host serves `POST /v1/host/sample/workflow-chain:expand` returning the `vendor.openwop.workflow-chain-sample` v1.0.0 expansion that `conformance/src/scenarios/workflow-chain-host-expansion.test.ts` asserts against. Absent/`false` \u21d2 that live-host expansion scenario soft-skips; the semantic `workflowChainPacks.supported` claim is witnessed by the server-free `workflow-chain-expansion.test.ts` legs. This flag is DISTINCT from `deferredParameters` (RFC 0124), which is witnessed through its own `POST /v1/host/sample/chain/deferred-expand` seam \u2014 so a host MAY advertise `supported` / `deferredParameters.supported` without standing up the RFC 0013 sample-pack seam it was never handed a published fixture for. Advertising `supported:true` no longer conscripts a host into the RFC 0013 host-expansion scenario."
         },
         "subChains": {
           "type": "object",
-          "description": "RFC 0133 (workflow-chain composition, `Accepted`). OPTIONAL. When `supported: true`, the host's `POST …/workflows/from-chain` implements RUNTIME sub-chain composition per `workflow-chain-packs.md` §\"Sub-chain composition (RFC 0133)\": for each `config.subChainRef` reachable from a parent chain, it resolves the referenced chain (sibling or external), recursively expands + co-registers it as its own owned workflow (deterministic TENANT-SCOPED id from `(tenantId, childChainId, version)` — two tenants never collide on the global registry, a shared child registers once across parents in a tenant, a repeat instantiation converges), rewrites the referencing node's `subChainRef` → the minted child `config.workflowId`, and dispatches the child as a child run (`core.subWorkflow` / `core.dispatch` child-run); the `from-chain` response carries `{ workflowId, subChainWorkflowIds[], nodeCount }`. Bounded by a cycle check (`sub_chain_cycle`) + a depth cap (`sub_chain_max_depth_exceeded`). A host that does NOT advertise this block MUST refuse a `subChains`-bearing chain at author/instantiate time with `sub_chain_unsupported` (422) — it never silently flattens. `producedVariables` (RFC 0133 §2) needs NO flag: it is pure variable emission under the base `workflowChainPacks.supported`. Conformance scenarios `chain-subchain-fanout.test.ts` + `chain-subchain-unsupported-refused.test.ts` gate on this flag; the server-free `chain-subchain-sibling` / `chain-subchain-cycle-rejected` / `chain-produced-var-roundtrip` legs run unconditionally against the reference library.",
+          "description": "RFC 0133 (workflow-chain composition, `Accepted`). OPTIONAL. When `supported: true`, the host's `POST \u2026/workflows/from-chain` implements RUNTIME sub-chain composition per `workflow-chain-packs.md` \u00a7\"Sub-chain composition (RFC 0133)\": for each `config.subChainRef` reachable from a parent chain, it resolves the referenced chain (sibling or external), recursively expands + co-registers it as its own owned workflow (deterministic TENANT-SCOPED id from `(tenantId, childChainId, version)` \u2014 two tenants never collide on the global registry, a shared child registers once across parents in a tenant, a repeat instantiation converges), rewrites the referencing node's `subChainRef` \u2192 the minted child `config.workflowId`, and dispatches the child as a child run (`core.subWorkflow` / `core.dispatch` child-run); the `from-chain` response carries `{ workflowId, subChainWorkflowIds[], nodeCount }`. Bounded by a cycle check (`sub_chain_cycle`) + a depth cap (`sub_chain_max_depth_exceeded`). A host that does NOT advertise this block MUST refuse a `subChains`-bearing chain at author/instantiate time with `sub_chain_unsupported` (422) \u2014 it never silently flattens. `producedVariables` (RFC 0133 \u00a72) needs NO flag: it is pure variable emission under the base `workflowChainPacks.supported`. Conformance scenarios `chain-subchain-fanout.test.ts` + `chain-subchain-unsupported-refused.test.ts` gate on this flag; the server-free `chain-subchain-sibling` / `chain-subchain-cycle-rejected` / `chain-produced-var-roundtrip` legs run unconditionally against the reference library.",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2071,49 +3264,61 @@
               "type": "integer",
               "minimum": 1,
               "default": 8,
-              "description": "RFC 0133 §1.3 (resolves UQ3). RECOMMENDED default 8. The maximum sub-chain nesting depth the host co-expands; exceeding it fails closed with the DISTINCT code `sub_chain_max_depth_exceeded` (the DoS depth backstop, alongside the `sub_chain_cycle` self-composition check — SECURITY `sub-chain-expansion-bounded`)."
+              "description": "RFC 0133 \u00a71.3 (resolves UQ3). RECOMMENDED default 8. The maximum sub-chain nesting depth the host co-expands; exceeding it fails closed with the DISTINCT code `sub_chain_max_depth_exceeded` (the DoS depth backstop, alongside the `sub_chain_cycle` self-composition check \u2014 SECURITY `sub-chain-expansion-bounded`)."
             }
           },
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false
         }
       },
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "additionalProperties": false
     },
     "packs": {
       "type": "object",
-      "description": "RFC 0025 (`Active`). Pack-registry surface advertisement. The baseline `/v1/packs/*` read surface (per `spec/v1/node-packs.md` §\"Registry HTTP API\") is unconditional for hosts that ship a pack catalog and does NOT require a capability flag; this object carries optional sub-blocks (currently the test-mode mirror namespace). Hosts that don't expose any optional pack-registry sub-block MAY omit this block entirely.",
+      "description": "RFC 0025 (`Active`). Pack-registry surface advertisement. The baseline `/v1/packs/*` read surface (per `spec/v1/node-packs.md` \u00a7\"Registry HTTP API\") is unconditional for hosts that ship a pack catalog and does NOT require a capability flag; this object carries optional sub-blocks (currently the test-mode mirror namespace). Hosts that don't expose any optional pack-registry sub-block MAY omit this block entirely.",
       "properties": {
         "testMode": {
           "type": "object",
-          "description": "RFC 0025 §A. Optional `/v1/packs-test/*` mirror surface that exposes the production publish/get/delete/sig contract against an isolated catalog. Lets the conformance suite (`pack-registry-publish.test.ts`) exercise the documented 19-code publish error catalog without `packs:publish` scope on the real registry. Hosts that advertise `supported: true` MUST honor the §C isolation guarantees and MUST surface the same error envelopes and HTTP statuses as the production `/v1/packs/*` surface.",
+          "description": "RFC 0025 \u00a7A. Optional `/v1/packs-test/*` mirror surface that exposes the production publish/get/delete/sig contract against an isolated catalog. Lets the conformance suite (`pack-registry-publish.test.ts`) exercise the documented 19-code publish error catalog without `packs:publish` scope on the real registry. Hosts that advertise `supported: true` MUST honor the \u00a7C isolation guarantees and MUST surface the same error envelopes and HTTP statuses as the production `/v1/packs/*` surface.",
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "Host exposes `/v1/packs-test/*` per RFC 0025 §B. When `true`, the conformance suite drives publish-error-catalog assertions through the test namespace; when `false` or absent, the 26 scenarios in `pack-registry-publish.test.ts` soft-skip cleanly."
+              "description": "Host exposes `/v1/packs-test/*` per RFC 0025 \u00a7B. When `true`, the conformance suite drives publish-error-catalog assertions through the test namespace; when `false` or absent, the 26 scenarios in `pack-registry-publish.test.ts` soft-skip cleanly."
             },
             "isolated": {
               "type": "boolean",
-              "description": "RFC 0025 §C point 1. MUST be `true` when `supported` is `true` — guarantees the test catalog is persisted distinctly from the production catalog and that a pack PUT'd via `/v1/packs-test/*` MUST NOT appear in `/v1/packs/*` listings."
+              "description": "RFC 0025 \u00a7C point 1. MUST be `true` when `supported` is `true` \u2014 guarantees the test catalog is persisted distinctly from the production catalog and that a pack PUT'd via `/v1/packs-test/*` MUST NOT appear in `/v1/packs/*` listings."
             },
             "catalogResetEndpoint": {
               "type": "string",
-              "description": "RFC 0025 §C point 4. Optional URL path (e.g. `/v1/packs-test/reset`) that clears the entire test catalog. When advertised, conformance-suite teardown SHOULD call it; the endpoint MUST be idempotent. Hosts MAY omit; in that case the suite leaves disposable timestamped pack names in place and relies on the next host restart to clear in-memory state.",
+              "description": "RFC 0025 \u00a7C point 4. Optional URL path (e.g. `/v1/packs-test/reset`) that clears the entire test catalog. When advertised, conformance-suite teardown SHOULD call it; the endpoint MUST be idempotent. Hosts MAY omit; in that case the suite leaves disposable timestamped pack names in place and relies on the next host restart to clear in-memory state.",
               "pattern": "^/"
             },
             "scopes": {
               "type": "array",
               "items": {
                 "type": "string",
-                "enum": ["core", "vendor", "community", "private", "local"]
+                "enum": [
+                  "core",
+                  "vendor",
+                  "community",
+                  "private",
+                  "local"
+                ]
               },
               "uniqueItems": true,
               "minItems": 1,
-              "description": "RFC 0025 §A. Which namespace scopes the test catalog accepts in pack names. Public test catalogs SHOULD refuse `private` and `local` (matching the production-registry rule for `packs.openwop.dev`); private dev catalogs MAY accept all five. When omitted, the test catalog defaults to the same scope set as the production namespace it mirrors."
+              "description": "RFC 0025 \u00a7A. Which namespace scopes the test catalog accepts in pack names. Public test catalogs SHOULD refuse `private` and `local` (matching the production-registry rule for `packs.openwop.dev`); private dev catalogs MAY accept all five. When omitted, the test catalog defaults to the same scope set as the production namespace it mirrors."
             }
           },
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "additionalProperties": false
         }
       },
@@ -2121,107 +3326,227 @@
     },
     "mcp": {
       "type": "object",
-      "description": "RFC 0020 (`Active`). MCP (Model Context Protocol) composition surface. The client half is consumed implicitly via `host.mcp` host-surface; this block adds the optional server half — workflow exposed AS an MCP server with bidirectional sampling/elicitation bridges.",
+      "description": "RFC 0020 (`Active`). MCP (Model Context Protocol) composition surface. The client half is consumed implicitly via `host.mcp` host-surface; this block adds the optional server half \u2014 workflow exposed AS an MCP server with bidirectional sampling/elicitation bridges.",
       "properties": {
-        "supported": { "type": "boolean", "description": "Host advertises a client-side MCP surface (ctx.mcp.*). See spec/v1/mcp-integration.md." },
+        "supported": {
+          "type": "boolean",
+          "description": "Host advertises a client-side MCP surface (ctx.mcp.*). See spec/v1/mcp-integration.md."
+        },
         "serverMount": {
           "type": "object",
           "description": "Server-side MCP composition (workflow IS an MCP server). When supported, the host mounts an MCP endpoint and routes inbound tools/call, resources/read, prompts/get into workflows. Inbound MUST be treated as `trustBoundary: 'untrusted'`.",
           "properties": {
-            "supported": { "type": "boolean" },
+            "supported": {
+              "type": "boolean"
+            },
             "transports": {
               "type": "array",
-              "items": { "type": "string", "enum": ["stdio", "streamable-http"] }
+              "items": {
+                "type": "string",
+                "enum": [
+                  "stdio",
+                  "streamable-http"
+                ]
+              }
             },
-            "samplingBridge": { "type": "boolean", "description": "Inbound sampling/createMessage bridges to the workflow's ctx.callAI." },
-            "elicitationBridge": { "type": "boolean", "description": "Inbound elicitation/create bridges to ctx.suspend." }
+            "samplingBridge": {
+              "type": "boolean",
+              "description": "Inbound sampling/createMessage bridges to the workflow's ctx.callAI."
+            },
+            "elicitationBridge": {
+              "type": "boolean",
+              "description": "Inbound elicitation/create bridges to ctx.suspend."
+            }
           },
           "additionalProperties": false
+        },
+        "protocolVersions": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
+          },
+          "description": "RFC 0153 \u00a7A \u2014 MCP revisions in MCP's own date form, exactly. The pattern is date-shaped rather than free string because MCP versions ARE dates: accepting `latest` or `2026-7-28` would make two hosts disagree about which revision they share while both validating."
+        },
+        "preferredVersion": {
+          "type": "string",
+          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$",
+          "description": "RFC 0153 \u00a7A \u2014 MUST be present in `protocolVersions`."
+        },
+        "profiles": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^mcp-[0-9]{4}-[0-9]{2}-[0-9]{2}(-legacy)?$"
+          },
+          "description": "RFC 0153 \u00a7A \u2014 named composition profiles. Unqualified `supported: true` is deprecated and cannot substantiate a current-MCP claim."
+        },
+        "features": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "enum": [
+              "server-discover",
+              "mrtr",
+              "cacheable-lists",
+              "extensions"
+            ]
+          },
+          "description": "RFC 0153 \u00a7A \u2014 closed feature set for the current revision. Closed rather than open because an unrecognized feature name is indistinguishable from a typo, and a peer that silently ignores one negotiates a capability neither side has."
         }
       },
       "additionalProperties": false
     },
     "sandbox": {
       "type": "object",
-      "description": "RFC 0035 — Sandbox execution contract for pack-loaded typeIds. Hosts that advertise execute pack-loaded code inside an isolation boundary meeting the 8 failure-mode invariants in spec/v1/host-capabilities.md §'Sandbox execution contract'. Absent block = host does NOT sandbox pack-loaded code and MUST refuse to load any pack whose manifest declares `peerDependencies.host.sandbox: required`.",
+      "description": "RFC 0035 \u2014 Sandbox execution contract for pack-loaded typeIds. Hosts that advertise execute pack-loaded code inside an isolation boundary meeting the 8 failure-mode invariants in spec/v1/host-capabilities.md \u00a7'Sandbox execution contract'. Absent block = host does NOT sandbox pack-loaded code and MUST refuse to load any pack whose manifest declares `peerDependencies.host.sandbox: required`.",
       "additionalProperties": false,
-      "required": ["supported", "isolationModel"],
+      "required": [
+        "supported",
+        "isolationModel"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
-          "description": "Host enforces the 8 sandbox failure-mode invariants per spec/v1/host-capabilities.md §'Sandbox execution contract'. When false, host MUST refuse to load packs declaring required sandbox isolation."
+          "description": "Host enforces the 8 sandbox failure-mode invariants per spec/v1/host-capabilities.md \u00a7'Sandbox execution contract'. When false, host MUST refuse to load packs declaring required sandbox isolation."
         },
         "isolationModel": {
           "type": "string",
           "anyOf": [
-            { "enum": ["wasm", "process", "container", "vm"] },
-            { "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$" }
+            {
+              "enum": [
+                "wasm",
+                "process",
+                "container",
+                "vm"
+              ]
+            },
+            {
+              "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$"
+            }
           ],
-          "description": "Categorical isolation model. `wasm` = WebAssembly sandbox with explicit host imports (e.g., Wasmtime, Wasmer). `process` = OS process boundary with restricted syscalls (e.g., gVisor, seccomp, Landlock). `container` = container runtime boundary (e.g., Firecracker microVM). `vm` = full VM. Vendor-specific isolation models advertise `^x-host-<host>-<key>$` per spec/v1/host-extensions.md §'Canonical prefixes'; documentation lives at the host's discovery doc."
+          "description": "Categorical isolation model. `wasm` = WebAssembly sandbox with explicit host imports (e.g., Wasmtime, Wasmer). `process` = OS process boundary with restricted syscalls (e.g., gVisor, seccomp, Landlock). `container` = container runtime boundary (e.g., Firecracker microVM). `vm` = full VM. Vendor-specific isolation models advertise `^x-host-<host>-<key>$` per spec/v1/host-extensions.md \u00a7'Canonical prefixes'; documentation lives at the host's discovery doc."
         },
         "allowedHostCalls": {
           "type": "array",
-          "items": { "type": "string" },
+          "items": {
+            "type": "string"
+          },
           "description": "Whitelist of host-call surfaces sandboxed code MAY invoke. Identifiers from the spec-reserved `host.*` capability set or `^x-host-<host>-<key>$` extension namespace. Empty array = pure compute only (no host I/O). Conformance verifies the sandbox refuses unlisted calls (`sandbox_capability_denied`)."
         },
         "memoryLimitBytes": {
           "type": "integer",
           "minimum": 1048576,
-          "description": "Per-invocation memory cap (≥ 1 MiB). Host MUST enforce; exceeding fails the node with `sandbox_memory_exceeded`."
+          "description": "Per-invocation memory cap (\u2265 1 MiB). Host MUST enforce; exceeding fails the node with `sandbox_memory_exceeded`."
         },
         "wallClockLimitMs": {
           "type": "integer",
           "minimum": 100,
-          "description": "Per-invocation wall-clock cap (≥ 100 ms). Host MUST enforce; exceeding fails the node with `sandbox_timeout`."
+          "description": "Per-invocation wall-clock cap (\u2265 100 ms). Host MUST enforce; exceeding fails the node with `sandbox_timeout`."
+        }
+      }
+    },
+    "compensation": {
+      "type": "object",
+      "description": "RFC 0151 \u00a7A \u2014 generic compensation (Saga) contract. OPTIONAL; absent means the host offers no generic compensation contract, NOT that it never compensates \u2014 a workflow can always model an inverse action as an ordinary node. What this advertises is that the HOST orders, persists, and retries the unwind, so a client can rely on it rather than hand-rolling one. Compensation is a second effect, not an undo: it can fail, can be partially applied, and can itself require approval, which is why the profile is security-tier high (RFC 0147 R9).",
+      "additionalProperties": false,
+      "required": [
+        "supported"
+      ],
+      "properties": {
+        "supported": {
+          "type": "boolean"
+        },
+        "profileVersion": {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$",
+          "description": "RFC 0151. Participates in the inverse-action identity, so a profile bump cannot silently collide with identities minted under the previous ordering rules."
+        },
+        "orderingModels": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "enum": [
+              "reverse-completion",
+              "dependency-graph"
+            ]
+          },
+          "description": "RFC 0151 \u00a7A. A host that advertises compensation MUST implement `reverse-completion` and MAY additionally implement `dependency-graph`. `dependency-graph` MUST be a DAG and preserve reverse dependency order."
+        },
+        "manualIntervention": {
+          "type": "boolean",
+          "description": "RFC 0151 \u00a7C \u2014 the host can record `manual-intervention-required` rather than silently abandoning an unwind. Cancelling the parent MUST NOT abandon an active compensation: it continues, pauses for authorized intervention, or records this state."
         }
       }
     },
     "idempotency": {
       "type": "object",
-      "description": "RFC 0036 — Multi-region idempotency contract. Optional v1 advertisement. The existing `crossRegion: 'single-region'|'best-effort'|'strict'` categorical claim lives under `capabilities.idempotency.crossRegion` per spec/v1/idempotency.md §'Multi-region idempotency (annex)'. The `multiRegion` sub-block here gives a granular advertisement that hosts SHOULD pair with the categorical `crossRegion` claim.",
+      "description": "RFC 0036 \u2014 Multi-region idempotency contract. Optional v1 advertisement. The existing `crossRegion: 'single-region'|'best-effort'|'strict'` categorical claim lives under `capabilities.idempotency.crossRegion` per spec/v1/idempotency.md \u00a7'Multi-region idempotency (annex)'. The `multiRegion` sub-block here gives a granular advertisement that hosts SHOULD pair with the categorical `crossRegion` claim.",
       "additionalProperties": true,
       "properties": {
+        "supported": {
+          "type": "boolean",
+          "description": "Whether the host implements the idempotency contract. Used in `spec/v1/idempotency.md`'s own capability example and throughout the corpus, but UNDECLARED until 2026-08-13 \u2014 it validated only because this family carries `additionalProperties: true`, which meant a typo such as `suported` was accepted silently and a consumer reading it saw nothing advertised. Declaring it does not close the family; it makes the field a contract rather than a convention."
+        },
         "multiRegion": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "Host implements cross-region idempotency reconciliation per spec/v1/idempotency.md §'Multi-region reconciliation'. When `true`, an Idempotency-Key write succeeding in region A is read-visible in region B within `replicationLagBoundMs + safetyMargin`."
+              "description": "Host implements cross-region idempotency reconciliation per spec/v1/idempotency.md \u00a7'Multi-region reconciliation'. When `true`, an Idempotency-Key write succeeding in region A is read-visible in region B within `replicationLagBoundMs + safetyMargin`."
             },
             "replicationLagBoundMs": {
               "type": "integer",
               "minimum": 0,
               "maximum": 60000,
-              "description": "Conservative upper bound on cross-region replication lag (≤ 60s ceiling chosen to keep operator advertisement honest; production cross-region deployments typically run < 10s). Conformance asserts read-visibility after the bound."
+              "description": "Conservative upper bound on cross-region replication lag (\u2264 60s ceiling chosen to keep operator advertisement honest; production cross-region deployments typically run < 10s). Conformance asserts read-visibility after the bound."
             },
             "partitionRecoveryStrategy": {
               "type": "string",
               "anyOf": [
-                { "enum": ["last-writer-wins", "first-writer-wins"] },
-                { "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$" }
+                {
+                  "enum": [
+                    "lexicographic-min-run-id"
+                  ]
+                },
+                {
+                  "pattern": "^x-host-[a-z][a-z0-9-]*-[a-z][a-z0-9-]*$"
+                }
               ],
-              "description": "Deterministic resolution rule for conflicting idempotency-key records when a partition healed. `last-writer-wins` / `first-writer-wins` are spec-reserved categorical rules; vendor strategies use `^x-host-<host>-<key>$`. Conformance asserts deterministic resolution actually applies; it does NOT prescribe which strategy a host picks."
+              "description": "RFC 0150 \u00a7D \u2014 deterministic resolution rule for conflicting idempotency-key records after a partition heals. `lexicographic-min-run-id` is the rule spec/v1/idempotency.md \u00a7'Guarantees under partition' MUSTs: the lower runId wins, deterministic without coordination. Vendor strategies use `^x-host-<host>-<key>$` and MUST still satisfy the reproducible-survivor requirement. The time-ordered `last-writer-wins` / `first-writer-wins` values were REMOVED as a safety-fix: under a partition there is no shared clock, so both regions believe they wrote last, which cannot satisfy the annex MUST that re-running the same conflict input produces the same survivor \u2014 and both select a different survivor than the lex-min rule the same document requires. Resolving a RECORD never authorizes an EFFECT; see `crossRegion`."
             }
           }
         },
         "crossRegion": {
           "type": "string",
-          "enum": ["single-region", "best-effort", "strict"],
-          "description": "RFC 0036 — categorical multi-region idempotency posture (the canonical conformance-checked surface per spec/v1/idempotency.md §'Multi-region idempotency (annex)'). `single-region`: the host runs in one region and makes no cross-region claim (it MAY still implement the convergence resolver, demonstrable via the multi-region simulator seam). `best-effort`: cross-region reconciliation converges eventually under the annex's lex-min(runId) rule. `strict`: cross-region read-visibility is bounded by `multiRegion.replicationLagBoundMs`. When `best-effort` or `strict`, the host MUST emit the `openwop.idempotency.cross_region_conflicts_total` operator metric. The `multiRegion` sub-block above is the optional granular companion."
+          "enum": [
+            "single-region",
+            "reconciled-records",
+            "fenced-effects"
+          ],
+          "description": "RFC 0036, revised by RFC 0150 \u00a7D \u2014 categorical multi-region idempotency posture (the canonical conformance-checked surface per spec/v1/idempotency.md \u00a7'Multi-region idempotency (annex)'). The ladder is about EFFECTS, not replication latency. `single-region`: the host runs in one region and makes no cross-region claim (it MAY still implement the convergence resolver, demonstrable via the multi-region simulator seam). `reconciled-records`: cross-region reconciliation converges eventually under the annex's lex-min(runId) rule, and external effects MAY remain at-least-once \u2014 converging on which RECORD survives says nothing about how many times an effect was issued. `fenced-effects`: records converge AND every external effect is either fenced by a monotonic token from a linearizable ownership service or issued to a provider that guarantees duplicate suppression. When `reconciled-records` or `fenced-effects`, the host MUST emit the `openwop.idempotency.cross_region_conflicts_total` operator metric. The `multiRegion` sub-block above is the optional granular companion. REMOVED as a safety-fix: `best-effort` (renamed to `reconciled-records`, which states the effect caveat the old name hid) and `strict`, which promised only that read-visibility was bounded by `multiRegion.replicationLagBoundMs` \u2014 a LATENCY claim occupying the top slot of a ladder implementers read as effect safety. A host replicating synchronously at 0 ms can still issue duplicate effects from two regions, because knowing what the other region wrote is not being authorized to act. That latency bound already has its own field, so no information is lost."
         }
       }
     },
     "eventLog": {
       "type": "object",
-      "description": "RFC 0036 — Event-log multi-engine advertisement. Optional v1.",
+      "description": "RFC 0036 \u2014 Event-log multi-engine advertisement. Optional v1.",
       "additionalProperties": false,
       "properties": {
         "crossEngineOrdering": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2229,7 +3554,11 @@
             },
             "orderingModel": {
               "type": "string",
-              "enum": ["lamport", "vector-clock", "global-sequencer"],
+              "enum": [
+                "lamport",
+                "vector-clock",
+                "global-sequencer"
+              ],
               "description": "Mechanism the host uses to derive the total order. `lamport` = Lamport timestamps on each append. `vector-clock` = per-engine vector counters merged at read. `global-sequencer` = single sequencer assigns monotonic seq numbers (the Postgres reference host's posture)."
             }
           }
@@ -2242,12 +3571,26 @@
       "properties": {
         "defaultMode": {
           "type": "string",
-          "enum": ["mask", "omit", "hash", "passthrough"],
-          "description": "Server's default masking mode for fields marked sensitive. `mask` (default): replace with `\"[REDACTED]\"`. `omit`: drop the field entirely. `hash`: replace with `\"sha256:<hex>\"` for audit-only equality. `passthrough`: record as-is (NOT recommended for production). Workflow authors MAY override per-workflow via `metadata.complianceConfig.maskingMode`. See observability.md §Privacy classification."
+          "enum": [
+            "mask",
+            "omit",
+            "hash",
+            "passthrough"
+          ],
+          "description": "Server's default masking mode for fields marked sensitive. `mask` (default): replace with `\"[REDACTED]\"`. `omit`: drop the field entirely. `hash`: replace with `\"sha256:<hex>\"` for audit-only equality. `passthrough`: record as-is (NOT recommended for production). Workflow authors MAY override per-workflow via `metadata.complianceConfig.maskingMode`. See observability.md \u00a7Privacy classification."
         },
         "supportedClasses": {
           "type": "array",
-          "items": { "type": "string", "enum": ["public", "pii", "phi", "pci", "regulated"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "public",
+              "pii",
+              "phi",
+              "pci",
+              "regulated"
+            ]
+          },
           "uniqueItems": true,
           "description": "Compliance classes this server applies special handling for. A server MAY accept all five classes but only enforce stricter retention on a subset; this field declares the operational reality so workflow authors can choose a server appropriately."
         }
@@ -2257,7 +3600,9 @@
     "production": {
       "type": "object",
       "description": "Production-profile advertisement (see production-profile.md). Optional in v1; absence means the host does not claim the openwop-production profile. When `supported: true`, the host claims every MUST in production-profile.md and conformance scenarios gated on this block MUST run. Landed by RFC 0009.",
-      "required": ["supported"],
+      "required": [
+        "supported"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -2265,11 +3610,11 @@
         },
         "backpressure": {
           "type": "object",
-          "description": "Backpressure envelope advertisement (production-profile.md §Backpressure).",
+          "description": "Backpressure envelope advertisement (production-profile.md \u00a7Backpressure).",
           "properties": {
             "supported": {
               "type": "boolean",
-              "description": "Host returns 503 + Retry-After + canonical envelope under load per production-profile.md §Backpressure."
+              "description": "Host returns 503 + Retry-After + canonical envelope under load per production-profile.md \u00a7Backpressure."
             },
             "inflightCap": {
               "type": "integer",
@@ -2280,14 +3625,14 @@
               "type": "integer",
               "minimum": 0,
               "maximum": 86400,
-              "description": "Optional advertised Retry-After value in seconds the host returns on 503. When present, MUST equal both the `Retry-After` header and the `details.retryAfter` body field per production-profile.md. Upper bound 86400 (24h) — values beyond that are operationally indistinguishable from 'permanently denied'. Hosts needing longer holds SHOULD omit `Retry-After` entirely (RFC 0009 Q#2)."
+              "description": "Optional advertised Retry-After value in seconds the host returns on 503. When present, MUST equal both the `Retry-After` header and the `details.retryAfter` body field per production-profile.md. Upper bound 86400 (24h) \u2014 values beyond that are operationally indistinguishable from 'permanently denied'. Hosts needing longer holds SHOULD omit `Retry-After` entirely (RFC 0009 Q#2)."
             }
           },
           "additionalProperties": false
         },
         "retention": {
           "type": "object",
-          "description": "Event-retention advertisement (production-profile.md §\"Event retention\").",
+          "description": "Event-retention advertisement (production-profile.md \u00a7\"Event retention\").",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2296,18 +3641,18 @@
             "minWindowSeconds": {
               "type": "integer",
               "minimum": 604800,
-              "description": "Documented minimum retention window in seconds. Per production-profile.md §\"Event retention\", MUST be ≥ 604800 (7 days) for public hosts; development-only hosts MAY advertise a smaller window but MUST NOT claim `supported: true` while doing so."
+              "description": "Documented minimum retention window in seconds. Per production-profile.md \u00a7\"Event retention\", MUST be \u2265 604800 (7 days) for public hosts; development-only hosts MAY advertise a smaller window but MUST NOT claim `supported: true` while doing so."
             },
             "testForceExpire": {
               "type": "boolean",
-              "description": "Host exposes a test-only force-expire hook the conformance suite can call (URL/method supplied via `OPENWOP_TEST_FORCE_EXPIRE_URL` / `OPENWOP_TEST_FORCE_EXPIRE_METHOD` env vars). When `false`, the production-retention-expiry scenario asserts only the 410/404 envelope shape on an operator-supplied already-expired run id (via `OPENWOP_TEST_EXPIRED_RUN_ID`); otherwise it soft-skips. RFC 0009 unresolved question #1 — endpoint normation is deferred."
+              "description": "Host exposes a test-only force-expire hook the conformance suite can call (URL/method supplied via `OPENWOP_TEST_FORCE_EXPIRE_URL` / `OPENWOP_TEST_FORCE_EXPIRE_METHOD` env vars). When `false`, the production-retention-expiry scenario asserts only the 410/404 envelope shape on an operator-supplied already-expired run id (via `OPENWOP_TEST_EXPIRED_RUN_ID`); otherwise it soft-skips. RFC 0009 unresolved question #1 \u2014 endpoint normation is deferred."
             }
           },
           "additionalProperties": false
         },
         "debugBundle": {
           "type": "object",
-          "description": "Debug-bundle truncation advertisement (production-profile.md §\"Debug bundle behavior\"). Stricter than the existing `capabilities.debugBundle.supported` advertised per debug-bundle.md — this block adds the production-profile MUSTs (truncation metadata, redaction).",
+          "description": "Debug-bundle truncation advertisement (production-profile.md \u00a7\"Debug bundle behavior\"). Stricter than the existing `capabilities.debugBundle.supported` advertised per debug-bundle.md \u2014 this block adds the production-profile MUSTs (truncation metadata, redaction).",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2315,7 +3660,7 @@
             },
             "truncationMetadata": {
               "type": "boolean",
-              "description": "When `true`, host surfaces `truncated: true` + non-empty `truncatedReason` per debug-bundle.md §\"Bundle size limits\" when caps are reached."
+              "description": "When `true`, host surfaces `truncated: true` + non-empty `truncatedReason` per debug-bundle.md \u00a7\"Bundle size limits\" when caps are reached."
             }
           },
           "additionalProperties": false
@@ -2329,13 +3674,16 @@
       "properties": {
         "profiles": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true,
-          "description": "Auth profiles the host claims. Canonical ids: `openwop-audit-log-integrity` (auth-profiles.md §Audit-log integrity), `openwop-auth-api-key-rotation`, `openwop-auth-oauth2-client-credentials`, `openwop-auth-oidc-user-bearer`, `openwop-auth-mtls`, `openwop-auth-saml` + `openwop-auth-scim` + `openwop-auth-ldap` (RFC 0050 enterprise identity). Clients SHOULD tolerate unknown profile ids."
+          "description": "Auth profiles the host claims. Canonical ids: `openwop-audit-log-integrity` (auth-profiles.md \u00a7Audit-log integrity), `openwop-auth-api-key-rotation`, `openwop-auth-oauth2-client-credentials`, `openwop-auth-oidc-user-bearer`, `openwop-auth-mtls`, `openwop-auth-saml` + `openwop-auth-scim` + `openwop-auth-ldap` (RFC 0050 enterprise identity). Clients SHOULD tolerate unknown profile ids."
         },
         "rotation": {
           "type": "object",
-          "description": "API-key rotation advertisement (auth-profiles.md §`openwop-auth-api-key-rotation`).",
+          "description": "API-key rotation advertisement (auth-profiles.md \u00a7`openwop-auth-api-key-rotation`).",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2344,16 +3692,18 @@
             "minGraceSeconds": {
               "type": "integer",
               "minimum": 0,
-              "description": "Minimum rotation grace window in seconds. auth-profiles.md SHOULDs production-profile hosts to ≥ 86400 (24h). The conformance scenario tolerates any non-negative value but warns in behavior mode when < 86400."
+              "description": "Minimum rotation grace window in seconds. auth-profiles.md SHOULDs production-profile hosts to \u2265 86400 (24h). The conformance scenario tolerates any non-negative value but warns in behavior mode when < 86400."
             }
           },
           "additionalProperties": false
         },
         "oauth2": {
           "type": "object",
-          "description": "OAuth2 client-credentials advertisement (auth-profiles.md §`openwop-auth-oauth2-client-credentials`).",
+          "description": "OAuth2 client-credentials advertisement (auth-profiles.md \u00a7`openwop-auth-oauth2-client-credentials`).",
           "properties": {
-            "supported": { "type": "boolean" },
+            "supported": {
+              "type": "boolean"
+            },
             "issuer": {
               "type": "string",
               "format": "uri",
@@ -2365,7 +3715,10 @@
             },
             "supportedAlgorithms": {
               "type": "array",
-              "items": { "type": "string", "minLength": 1 },
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
               "uniqueItems": true,
               "description": "JWS signing algorithms the host accepts (canonical: RS256, ES256). Hosts MUST reject tokens signed with algorithms outside this list."
             }
@@ -2374,12 +3727,17 @@
         },
         "oidc": {
           "type": "object",
-          "description": "OIDC user-bearer advertisement (auth-profiles.md §`openwop-auth-oidc-user-bearer`).",
+          "description": "OIDC user-bearer advertisement (auth-profiles.md \u00a7`openwop-auth-oidc-user-bearer`).",
           "properties": {
-            "supported": { "type": "boolean" },
+            "supported": {
+              "type": "boolean"
+            },
             "issuers": {
               "type": "array",
-              "items": { "type": "string", "format": "uri" },
+              "items": {
+                "type": "string",
+                "format": "uri"
+              },
               "minItems": 1,
               "uniqueItems": true,
               "description": "Trusted OIDC issuer URLs. The host accepts tokens whose `iss` claim matches any entry."
@@ -2390,8 +3748,12 @@
             },
             "supportedScopeMapping": {
               "type": "string",
-              "enum": ["group-claim", "scope-claim", "host-acl"],
-              "description": "How the host derives openwop scopes from the OIDC token. `group-claim`: from `groups` claim via host config. `scope-claim`: from `scope` claim directly. `host-acl`: from a host-side mapping table (sub → scope)."
+              "enum": [
+                "group-claim",
+                "scope-claim",
+                "host-acl"
+              ],
+              "description": "How the host derives openwop scopes from the OIDC token. `group-claim`: from `groups` claim via host config. `scope-claim`: from `scope` claim directly. `host-acl`: from a host-side mapping table (sub \u2192 scope)."
             },
             "introspectionIntervalSeconds": {
               "type": "integer",
@@ -2403,20 +3765,82 @@
         },
         "mtls": {
           "type": "object",
-          "description": "mTLS advertisement (auth-profiles.md §`openwop-auth-mtls`).",
+          "description": "mTLS advertisement (auth-profiles.md \u00a7`openwop-auth-mtls`).",
           "properties": {
-            "supported": { "type": "boolean" },
+            "supported": {
+              "type": "boolean"
+            },
             "required": {
               "type": "boolean",
               "description": "When `true`, the host rejects bearer-only requests (mTLS required for all authenticated calls). When `false`, mTLS is optional and complements bearer auth."
             },
             "subjectMapping": {
               "type": "string",
-              "enum": ["cn", "san-dns", "san-uri"],
+              "enum": [
+                "cn",
+                "san-dns",
+                "san-uri"
+              ],
               "description": "How the host derives the transport principal from the client certificate. `cn`: subject CN. `san-dns`: subjectAltName DNS entry. `san-uri`: subjectAltName URI entry."
             }
           },
           "additionalProperties": false
+        },
+        "workloadIdentity": {
+          "type": "object",
+          "description": "RFC 0154 \u00a7A \u2014 workload identity profile `openwop-workload-identity-v1`. A host that advertises this cryptographically verifies the presented workload identity, binds it to the request, and resolves it to an OpenWOP principal BEFORE authorization. Unresolvable identity fails closed. **Identity is not authorization** (RFC 0147 R12): proving which workload called says nothing about what it may do, and treating the two as one is the confused-deputy shape this profile exists to prevent \u2014 tenant, audience, and policy MUST still be re-evaluated at every boundary.",
+          "additionalProperties": false,
+          "required": [
+            "supported"
+          ],
+          "properties": {
+            "supported": {
+              "type": "boolean"
+            },
+            "schemes": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "enum": [
+                  "spiffe",
+                  "mtls-san",
+                  "cloud-subject",
+                  "oauth-client"
+                ]
+              },
+              "description": "RFC 0154 \u00a7A \u2014 closed set of identity schemes the host verifies. Closed because an unrecognized scheme is a verification path nobody implemented, and accepting the NAME without the verification is precisely the failure the profile prevents."
+            },
+            "senderConstraint": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "enum": [
+                  "mtls",
+                  "dpop"
+                ]
+              },
+              "description": "RFC 0154 \u00a7A \u2014 proof-of-possession mechanisms. Without a sender constraint a bearer credential is replayable by anyone who observes it, so a host advertising workload identity WITHOUT one is asserting who called, not that the caller held the key."
+            },
+            "delegation": {
+              "type": "object",
+              "description": "RFC 0154 \u00a7B \u2014 delegated actor chains, advertised SEPARATELY from \u00a7A identity resolution. A host can verify workload identity without implementing delegation, and forcing one flag to cover both would make a \u00a7A-only host choose between advertising a capability it does not have and advertising nothing at all. That is the same overclaim-or-silence bind RFC 0155 \u00a7A names for `openwop-core`, and per-section advertisement is how it is avoided: `supported` means \u00a7A resolution, `delegation.supported` means \u00a7B chain verification, and a conformance run gates each section on its own flag.",
+              "additionalProperties": false,
+              "required": [
+                "supported"
+              ],
+              "properties": {
+                "supported": {
+                  "type": "boolean"
+                },
+                "maxChainDepth": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "description": "RFC 0154 \u00a7B \u2014 bounded chain length. Unbounded delegation is unbounded authority laundering: each hop is another party the host is trusting transitively."
+                }
+              }
+            }
+          }
         }
       },
       "additionalProperties": true
@@ -2427,7 +3851,7 @@
       "properties": {
         "authScoped": {
           "type": "object",
-          "description": "Auth-scoped discovery advertisement (capabilities-change-detection.md §\"Scoped capability views\"). Hosts that return a different payload when called with Authorization than when called anonymously declare it here. The authenticated view MUST still satisfy the base capabilities.schema.json shape per the spec annex.",
+          "description": "Auth-scoped discovery advertisement (capabilities-change-detection.md \u00a7\"Scoped capability views\"). Hosts that return a different payload when called with Authorization than when called anonymously declare it here. The authenticated view MUST still satisfy the base capabilities.schema.json shape per the spec annex.",
           "properties": {
             "supported": {
               "type": "boolean",
@@ -2435,7 +3859,10 @@
             },
             "mode": {
               "type": "string",
-              "enum": ["same-endpoint", "extension-endpoint"],
+              "enum": [
+                "same-endpoint",
+                "extension-endpoint"
+              ],
               "description": "How the host exposes the auth-scoped view. `same-endpoint`: the canonical /.well-known/openwop returns a narrowed/enriched view when authenticated. `extension-endpoint`: a separate host route carries the scoped view (path advertised via `endpointPath`). Hosts using the third pattern from the spec annex (documentation pointer in the public payload) MAY omit this field."
             },
             "endpointPath": {
@@ -2477,9 +3904,13 @@
     },
     "content": {
       "type": "object",
-      "description": "RFC 0103 (spec/v1/localized-content.md). Localized authored content (pages → sections) advertisement. Reuses the i18n annex's Accept-Language/Content-Language negotiation; it does NOT redeclare negotiation. Requires `i18n.supported: true`. `baseLocale` MUST equal `capabilities.i18n.defaultLocale`; `({baseLocale} ∪ supportedLocales)` MUST be a subset of `capabilities.i18n.supportedLocales`; `baseLocale` MUST NOT appear in `supportedLocales`. Hosts that omit this block serve no content surface; the conformance scenarios skip cleanly.",
+      "description": "RFC 0103 (spec/v1/localized-content.md). Localized authored content (pages \u2192 sections) advertisement. Reuses the i18n annex's Accept-Language/Content-Language negotiation; it does NOT redeclare negotiation. Requires `i18n.supported: true`. `baseLocale` MUST equal `capabilities.i18n.defaultLocale`; `({baseLocale} \u222a supportedLocales)` MUST be a subset of `capabilities.i18n.supportedLocales`; `baseLocale` MUST NOT appear in `supportedLocales`. Hosts that omit this block serve no content surface; the conformance scenarios skip cleanly.",
       "additionalProperties": false,
-      "required": ["supported", "baseLocale", "supportedLocales"],
+      "required": [
+        "supported",
+        "baseLocale",
+        "supportedLocales"
+      ],
       "properties": {
         "supported": {
           "type": "boolean",
@@ -2497,13 +3928,13 @@
             "type": "string",
             "pattern": "^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8}){0,3}$"
           },
-          "description": "BCP 47 tags the host has authored content translations for. MUST NOT contain `baseLocale`; `({baseLocale} ∪ supportedLocales)` MUST be a subset of `i18n.supportedLocales`."
+          "description": "BCP 47 tags the host has authored content translations for. MUST NOT contain `baseLocale`; `({baseLocale} \u222a supportedLocales)` MUST be a subset of `i18n.supportedLocales`."
         }
       }
     },
     "portability": {
       "type": "object",
-      "description": "RFC 0098 (`Active`). Export/import of a tenant's reusable estate (agents 0070, packs 0003/0013, prompt templates 0027, connection *refs* 0045/0095, schedules 0052, roster/org-chart 0086/0087). An export bundle carries NO credential values — only refs to be re-bound at the destination (RFC 0046/0079). Import maps the estate onto the destination's RFC 0048 identity, MUST offer a no-write dry-run plan, MUST be idempotent, and is gated by an RFC 0049 scope. A host advertising this serves `/v1/host/sample/{export,import}` (promotable to `/v1/{export,import}`) and emits the content-free `import.applied` event. Hosts that omit this block neither export nor import; the conformance scenarios skip cleanly.",
+      "description": "RFC 0098 (`Active`). Export/import of a tenant's reusable estate (agents 0070, packs 0003/0013, prompt templates 0027, connection *refs* 0045/0095, schedules 0052, roster/org-chart 0086/0087). An export bundle carries NO credential values \u2014 only refs to be re-bound at the destination (RFC 0046/0079). Import maps the estate onto the destination's RFC 0048 identity, MUST offer a no-write dry-run plan, MUST be idempotent, and is gated by an RFC 0049 scope. A host advertising this serves `/v1/host/sample/{export,import}` (promotable to `/v1/{export,import}`) and emits the content-free `import.applied` event. Hosts that omit this block neither export nor import; the conformance scenarios skip cleanly.",
       "additionalProperties": false,
       "properties": {
         "export": {
@@ -2518,7 +3949,18 @@
         },
         "kinds": {
           "type": "array",
-          "items": { "type": "string", "enum": ["agent", "pack", "prompt-template", "connection-ref", "schedule", "roster", "org-chart"] },
+          "items": {
+            "type": "string",
+            "enum": [
+              "agent",
+              "pack",
+              "prompt-template",
+              "connection-ref",
+              "schedule",
+              "roster",
+              "org-chart"
+            ]
+          },
           "uniqueItems": true,
           "description": "Estate kinds this host can export/import."
         },
@@ -2528,8 +3970,26 @@
           "description": "Import supports a no-write plan preview (`POST /import?dryRun=true`). MUST be true if `import` is true."
         }
       },
-      "if": { "properties": { "import": { "const": true } }, "required": ["import"] },
-      "then": { "properties": { "dryRun": { "const": true } }, "required": ["dryRun"] }
+      "if": {
+        "properties": {
+          "import": {
+            "const": true
+          }
+        },
+        "required": [
+          "import"
+        ]
+      },
+      "then": {
+        "properties": {
+          "dryRun": {
+            "const": true
+          }
+        },
+        "required": [
+          "dryRun"
+        ]
+      }
     },
     "interrupt": {
       "type": "object",
@@ -2539,17 +3999,32 @@
         "approverRouting": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["supported"],
+          "required": [
+            "supported"
+          ],
           "description": "RFC 0104. When `supported: true`, the host surfaces the OPTIONAL, ADVISORY `approverGroupRefs` / `approverRoleRefs` / `audience` fields on the approval InterruptPayload unchanged, resolves the ref kinds it advertises against its own identity/RBAC, ENFORCES eligibility at resolve time (the refs stay advisory metadata for clients; enforcement is host-side), and SHOULD route notifications to the resolved union. Refs are opaque to the engine and snapshotted at decision time for deterministic replay. Hosts that omit this block (or set `supported: false`) ignore the fields and remain conformant. Advertise only what the host actually resolves (`refKinds`) and honors (`audience`).",
           "properties": {
-            "supported": { "type": "boolean", "description": "Host honors the RFC 0104 approver-routing fields." },
+            "supported": {
+              "type": "boolean",
+              "description": "Host honors the RFC 0104 approver-routing fields."
+            },
             "refKinds": {
               "type": "array",
-              "items": { "type": "string", "enum": ["group", "role"] },
+              "items": {
+                "type": "string",
+                "enum": [
+                  "group",
+                  "role"
+                ]
+              },
               "uniqueItems": true,
-              "description": "Which approver ref kinds the host actually resolves. `group` ⇒ honors `approverGroupRefs`; `role` ⇒ honors `approverRoleRefs`. Absent ⇒ the host resolves neither (advisory-only passthrough). Capability honesty: advertise only the kinds the host's resolver supports."
+              "description": "Which approver ref kinds the host actually resolves. `group` \u21d2 honors `approverGroupRefs`; `role` \u21d2 honors `approverRoleRefs`. Absent \u21d2 the host resolves neither (advisory-only passthrough). Capability honesty: advertise only the kinds the host's resolver supports."
             },
-            "audience": { "type": "boolean", "default": false, "description": "Host honors the `audience` notification-targeting override. Absent/`false` ⇒ the host notifies the resolved eligible union and ignores `audience`." }
+            "audience": {
+              "type": "boolean",
+              "default": false,
+              "description": "Host honors the `audience` notification-targeting override. Absent/`false` \u21d2 the host notifies the resolved eligible union and ignores `audience`."
+            }
           }
         }
       }
@@ -2557,7 +4032,7 @@
     "restTransport": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0115 (`Active`). Conditional-GET + Content-Encoding negotiation on run reads (`GET /v1/runs/{runId}`). Optional. Distinct from the file-egress `fileHandling.transport` (ftp/sftp/ssh) sub-capability — this advertises HTTP-layer poll economy on the run-read REST surface.",
+      "description": "RFC 0115 (`Active`). Conditional-GET + Content-Encoding negotiation on run reads (`GET /v1/runs/{runId}`). Optional. Distinct from the file-egress `fileHandling.transport` (ftp/sftp/ssh) sub-capability \u2014 this advertises HTTP-layer poll economy on the run-read REST surface.",
       "properties": {
         "conditionalRunGet": {
           "type": "boolean",
@@ -2565,15 +4040,22 @@
         },
         "contentEncodings": {
           "type": "array",
-          "items": { "type": "string", "enum": ["gzip", "br", "zstd"] },
-          "description": "RFC 0115. Content-Encoding values the host will negotiate on run reads (advertisement of standard-HTTP behavior). `gzip` is the baseline; `br`/`zstd` are OPTIONAL — the host advertises only the subset it can actually serve. For each advertised value the decoded body MUST be byte-identical to the identity body."
+          "items": {
+            "type": "string",
+            "enum": [
+              "gzip",
+              "br",
+              "zstd"
+            ]
+          },
+          "description": "RFC 0115. Content-Encoding values the host will negotiate on run reads (advertisement of standard-HTTP behavior). `gzip` is the baseline; `br`/`zstd` are OPTIONAL \u2014 the host advertises only the subset it can actually serve. For each advertised value the decoded body MUST be byte-identical to the identity body."
         }
       }
     },
     "a2uiSurface": {
       "type": "object",
       "additionalProperties": false,
-      "description": "RFC 0114 (`Active`). Host-side TRANSPORT features over the recorded `ui.a2ui-surface` envelope (RFC 0102). A transport optimization, NOT an envelope-payload kind — the recorded envelope stays the full surface. Optional.",
+      "description": "RFC 0114 (`Active`). Host-side TRANSPORT features over the recorded `ui.a2ui-surface` envelope (RFC 0102). A transport optimization, NOT an envelope-payload kind \u2014 the recorded envelope stays the full surface. Optional.",
       "properties": {
         "deltaTransport": {
           "type": "boolean",