@openwop/spec-artifacts 2.0.0-rc.0 → 2.0.0-rc.10

package/CORPUS-STAMP.json

@@ -1,7 +1,7 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.0",
+  "version": "2.0.0-rc.10",
   "corpusTag": null,
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
@@ -9,9 +9,9 @@
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "b54c5a6ebd08577854d8f3f55e20ebf5aae0e57e457779e1de0937648aef4ef8",
-    "api/v2/asyncapi.yaml": "bb5468d6a2c00fbeab030ec365df2ba47c362b464b6d91162ded81064074d926",
-    "api/v2/openapi.yaml": "78b3f5a41ef1839f7628696465d3180ad2681616046918f6880575836bd20b57",
+    "api/seams-v2.yaml": "09450ae021c2230e440257875149337984f319b42a7808037130305e3c48390f",
+    "api/v2/asyncapi.yaml": "0dbb71b3832ee159e03f633cbb5464a14b565d2335b9f00ec8aee456bac950be",
+    "api/v2/openapi.yaml": "a5ad8b811af848060c62feaebc9be8450bc5ca113ba84158c3b97a3bdef66ad9",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -32,7 +32,7 @@
     "schemas/audit-verify-result.schema.json": "e8fd013fb610ba5db27ab0113ec2eb18e7da5f9310dd3de2dd3dc87a259c21fe",
     "schemas/budget-policy.schema.json": "3d4fe30ae129fe136ab9ece395f2a2a42a76360786b1b9a1d5f1cbc753eb5b39",
     "schemas/capabilities.schema.json": "e672c35d503532d8039b5552115f5ec150d60317f537f13180d830b0fe315947",
-    "schemas/certification-bundle-v2.schema.json": "3540232676086869ae78d24f3b9c2154f9c4a8a5eeb976512d6a7409f8cf19bb",
+    "schemas/certification-bundle-v2.schema.json": "2f85530dd04824a15810c94e96869362dee1e78396eca21fdd18e5501416bb7d",
     "schemas/channel-presence-payload.schema.json": "f9d0ef4219814c2b765baf3e68cbe5eea2cb42379f516a93a0459dcd5f7db47e",
     "schemas/channel-written-payload.schema.json": "54723a56bc5a35232f64544ca686ac1ac959a5fb05b32b2401facca6b3ef51a3",
     "schemas/chat-card-pack-manifest.schema.json": "402f7e9081cc39857a52e772061f4e034a957dcbc17501fe6e8e0bcb3d337e42",
@@ -115,8 +115,8 @@
     "schemas/v2/artifact-type-pack-manifest.schema.json": "c911757562e521cb4f31a47c097f562573b64087efe60c8acb81fd352367d300",
     "schemas/v2/audit-verify-result.schema.json": "cb54c4d89ba5dfb73f49aa8959a980be65c2dc2a87a12f71ba36d3e836fe85da",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "87048be5c04cd88df0bc21938f371a31f9f28a1df8560f6f811d99276fca83a4",
-    "schemas/v2/certification-bundle.schema.json": "06d450510b87fcfe22e4f3ba9dceef5f3ca9031ef65832d7b9d2f22b89028964",
+    "schemas/v2/capabilities.schema.json": "792669b2cc7b1fd44ce9a4fd3e79696ad1277734e29299a4504b39eda15913ed",
+    "schemas/v2/certification-bundle.schema.json": "d441198893c01cd14d84abe9c5bf591b69f47554db749c01899512f36cea11fa",
     "schemas/v2/channel-presence-payload.schema.json": "9475d46f358d21c19126e78204987a5633979917a2293653354ef5c5e044d54e",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "566982ce509a96d1619d58a72e383eff0773fe43fc65e4bfc85a4fe158f4eaff",
@@ -141,7 +141,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "0a06fbbdc8ba797a6818c79336a98e211ac5ba5747945b4e4098072cd3974d79",
-    "schemas/v2/error-envelope.schema.json": "6fd825be2dc71559487ea7f68c42b1503f0606dddce764ea2d14f66533b9319c",
+    "schemas/v2/error-envelope.schema.json": "d550beeab958b528c8734fd32e74c438006b99172c5c586f9e0af20ef4b2bee7",
     "schemas/v2/eval-summary.schema.json": "dfc995c8481ed212e6f3d83de982547898a7938be8c891ddb0d3efe84352908d",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "307884e57946703b6f86ec283034bf56beb68bea4a000743ebbc9eebeed31b07",
@@ -149,14 +149,14 @@
     "schemas/v2/goal.schema.json": "d202ef21ed3dbff87c25fd4b553fa978862a3200999878d25c5918f6794b3060",
     "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
     "schemas/v2/heartbeat-state-changed.schema.json": "eb68d0082aa996650e3a6b8ccf32457f959cebc7e6728cc7c331b9d171a4bef6",
-    "schemas/v2/ids.schema.json": "0ccf5eb3ec0744296b3379f7ced3b46ec51d908705a4f03dc4404d42236ebe19",
+    "schemas/v2/ids.schema.json": "dc6c99dea35a3416167b2b883ac08694794da1c7552bbfa48fc489c612d1cf97",
     "schemas/v2/localized-content-language-settings.schema.json": "92240f19a2b4b2f05ab41a797f703485a28813848035478e72f395edd04c1d35",
     "schemas/v2/localized-content-page-response.schema.json": "476b5f2775b42e35e679814a4ce846a7be1d5311d3a748c10df4275a78b0fb27",
     "schemas/v2/localized-content-page.schema.json": "717bb51fbc64d0b34eb0a4b35c8b463d08d505267bf251b4cbc67e0a016a567a",
     "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "3b7343dffbbaa4a539760e14714968ab9855d55a226f62bcb110f78a2ee47b56",
+    "schemas/v2/node-pack-manifest.schema.json": "771328fa73691e7f08fca3c628c4e8ba68fa4e43529faaf1a6358aecf26b13f2",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "ebac7d2889bfd659bcf30311efb0d6eb0c7e940b972b6b62da69c7351b5bb586",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
@@ -165,15 +165,15 @@
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "72623553611f00e87b4c7972d69ebeba73c2222b01ead75a44a0c2114b679fea",
-    "schemas/v2/registry-version-manifest.schema.json": "e704e08b11be9a5c7dc7237c8cb8b99b079d7c29615909320c2bb9bad285b8c1",
+    "schemas/v2/registry-version-manifest.schema.json": "270704ebc6bae63be949efbf9503578938b103733db9da3cb8fcbee1cd7684dd",
     "schemas/v2/residency.schema.json": "af2658a7104cbcacd0e20a91226271c4a77f91ef46ae97612768fe743e6091d8",
     "schemas/v2/run-ancestry-response.schema.json": "907e36341ba83a2147a5d76963950b6dcd47506b663ecbccae9dfa553f3724d3",
     "schemas/v2/run-diff-response.schema.json": "6ab6cd265dc7e0a2086c6659c46aa0e7b43e6302949f0adac5d7deb1c7c0ecd3",
-    "schemas/v2/run-event-payloads.schema.json": "8eb0e05e1bd3399b0e2654a1ec5a13198ac4ec8459a1fcbfd800ab2d0a0ae8c6",
-    "schemas/v2/run-event.schema.json": "6be6c366af34eea1606b92a17ebae40d3d3390f4d54c38d9fce293ab820ea118",
+    "schemas/v2/run-event-payloads.schema.json": "bd5cb6687828a86fb4411d331893ec183dce2c52cb27c22035d4cd7a8bc3c1a2",
+    "schemas/v2/run-event.schema.json": "1a9946374af9323b71635d00fed22abe02c300fa2cf3ae3e9c30f3e553e408ec",
     "schemas/v2/run-options.schema.json": "6d6052596ab0f17acfb00fdfc89907da7724f952e5ffbe1f81d94ba23d4c77cd",
     "schemas/v2/run-orchestrator-decided-event.schema.json": "bb76e15ff72e669f12938684033b55dc567470e1a378e19ffc3fa0e4034ab5a7",
-    "schemas/v2/run-snapshot.schema.json": "e77bf491d11c1414e62ed84cbf0c1d7149279b133a2101dc8f5eec89d3e45204",
+    "schemas/v2/run-snapshot.schema.json": "01408d8dac93e2d08d8db30f9cd7a4d903dce882a60bc1d48c3e6b921267f2a3",
     "schemas/v2/security-advisory.schema.json": "6a382f737730a738d634266315e9d335e5760020a0cdd9f30727c2f987a01770",
     "schemas/v2/self-hosted-runner-dispatch-frame.schema.json": "d8129f11d4e731d17ea951e66faaea2086081d13958b62ceaaa359fd6637dd7d",
     "schemas/v2/self-hosted-runner-registration.schema.json": "93d60003a668cacb0eeac37699ca2884c6b79332d9494cb9e0a1752ac8f8a16c",
@@ -198,21 +198,21 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "1d20ac568c5fc3e1e4d30bc0e4cd7e450118a447150912338f0fc3d3cf205a47",
+    "spec/v1/core-standard-manifest.json": "a9e4e6d32753d76974f1a61d5e31bd1fcde5ad0100cf3c7aae6770f3e6fca5c6",
     "spec/v1/deprecations.json": "520d79927a8ed43ccf62c207a7cf6cf7b19b16e00bbbbdf0410667e939c19d85",
     "spec/v1/deprecations.schema.json": "4cdbbb8eb9c0092913a5704c943880f0c8581bcf0f640a7df5a84105d53c8aee",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d52caf29071e3784d4c20259cdbd5a7b533986548a440bb632a80b82cadd7ea5",
     "spec/v1/extensions.json": "4d7ba68bae7c7f50cc655b94646ad25945a5dd63b703d43c1d015470141cd668",
-    "spec/v1/gaps.json": "1986d648cd1ade06823f33edd20bd00d3ccf09781aa0a9992bb5f4117687b484",
+    "spec/v1/gaps.json": "96ca051cb20f1a669b355d67a89421c56fef28aa5e6710c9519f592f26af33a3",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "6cc9962c6b969f632e07a78b52a4f61447ff579e2990cbae989866f584a86042",
-    "spec/v2/declaration.json": "91409933c089d2415254b32ade698549ed9b4caf16877fbfa7c9b578df6aaf12",
+    "spec/v2/declaration.json": "52b8c24a2dd463d44086129bf792ad108746f5102778cbbf0ff469fa534eca48",
     "spec/v2/declaration.schema.json": "b0881a76228dfbd1b85a2ec7b7259a60197f768344535cdb475db6ff719b0e54",
-    "spec/v2/errors.json": "204b2ae8029cd37becd9bf65e70a78b27fa7637818adfdd0d97677167c7d3405",
+    "spec/v2/errors.json": "ad1725dc7c11002450e8abc682858eb5c11952a0718ea8ef6bdb2fb5ae6e7e21",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "ce2d0ca085d7668d7ef745d2560b385ec6881d24a6d4b47c49931986b2ba642d",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
@@ -224,11 +224,11 @@
     "spec/v2/facets/mcp.schema.json": "f56609fe24ba6160ad29ae31aa16043354ff005e5cb6a0f3871c4d226087cc08",
     "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
-    "spec/v2/facets/webhooks.schema.json": "9b40d658af3ac7d8c26edcef275b01080607e10124a871b6adde05df686a69f1",
+    "spec/v2/facets/webhooks.schema.json": "0b766033ef4b4c6c2ac6f9979a19843ba024d3a1d1576972dcb55aaba52f1b9a",
     "spec/v2/path-manifest.json": "034152e09b1458c66810d4050e20a273b2b9b8fe2d92b66e8b819477de58a1be",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "1f0ee40491131cf561ef19a0394c47ba476b4567514fe16befb6cada4a10a5a4",
-    "spec/v2/release.json": "324675b23d36fd84e5ae0daecfc1aeacea53d12377cd40283ba2442bf57836c3"
+    "spec/v2/release.json": "7eb5cd641f6bb4d3143b3ddf8602bb2d856efc3c2db80cca2f15fe3a4f78c7f3"
   },
-  "corpusCommit": "7c81ace8312cd2e6a059a8d383534d67dccfaca7"
+  "corpusCommit": "f71d788362ba5a32f167c2c70a1e534ddebc4f31"
 }

package/api/seams-v2.yaml

@@ -1,12 +1,12 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.0.0-rc.0
+  version: 2.0.0-rc.10
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries
-    the nine operations the v1 canonical document used to carry; the remaining host-sample-test-seams.md paths enter with
-    the 2.0.0 suite driver (P3-E).'
+    the nine operations the v1 canonical document used to carry; the 2.0.0 suite driver (P3-E2) rewrites the remaining host-sample-test-seams.md
+    paths into this space, and P3-E3 adds the two RFC 0176 seams (event-log seed, inbound webhook receiver).'
 servers:
 - url: https://{host}
   description: openwop-compliant server
@@ -514,6 +514,219 @@ paths:
             application/json:
               schema:
                 $ref: ../schemas/v2/error-envelope.schema.json
+  /conformance/seams/sample/event-log/seed:
+    post:
+      tags:
+      - Seams
+      operationId: seedEra2EventLog
+      summary: Persist a run whose event log is in v1 vocabulary (era 2) — RFC 0176 §A/§B/§C witnesses
+      description: 'The host MUST persist the rows verbatim (v1 `type` strings, the given `sequence` space, no era stamp:
+        the run reads as era `2` by the absent-⇒-`2` rule of persistence.md) and MUST NOT translate at write time; the read
+        projection is what the scenarios `v2-v1-events-translated`, `v2-unmapped-type-refused`, `v2-fork-a-v1-run` and `v2-pinned-run-disposition`
+        witness. `status` is the snapshot status the seeded run holds.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - eventLogSchemaVersion
+              - status
+              - events
+              properties:
+                eventLogSchemaVersion:
+                  const: 2
+                status:
+                  type: string
+                  enum:
+                  - running
+                  - completed
+                  - failed
+                  - cancelled
+                events:
+                  type: array
+                  minItems: 1
+                  items:
+                    type: object
+                    additionalProperties: false
+                    required:
+                    - type
+                    - sequence
+                    - payload
+                    properties:
+                      type:
+                        type: string
+                      sequence:
+                        type: integer
+                        minimum: 0
+                      payload:
+                        type: object
+                      timestamp:
+                        type: string
+                        format: date-time
+                      causationId:
+                        type: string
+      responses:
+        '201':
+          description: The seeded run.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - runId
+                properties:
+                  runId:
+                    $ref: ../schemas/v2/ids.schema.json#/$defs/runId
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+  /conformance/seams/sample/effect-seams/fire:
+    post:
+      tags:
+      - Seams
+      operationId: fireEffectSeam
+      summary: Fire one named effect-seam manifest row inside a run — RFC 0173 §C no-re-fire witness
+      description: 'The host runs a workflow that drives the named seam once. The scenario then forks the run in `replay`
+        mode and reads `GET /runs/{runId}/effects` on the fork: a seam whose manifest row says `branchReFires: false` MUST
+        NOT produce a new effect attempt there. The witness is the host own Layer-2 ledger, so the leg needs no externally
+        reachable receiver. Without this seam the replay-suppression obligation is only claims-checkable.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - seam
+              properties:
+                seam:
+                  type: string
+                  minLength: 1
+                  description: The `seam` value of a row in GET /host/effect-seams.
+                receiverUrl:
+                  type: string
+                  format: uri
+                  description: Optional destination for seams whose kind needs one. Omitted, the host uses its own unreachable
+                    fixture destination — the witness is the effect ledger, not delivery.
+      responses:
+        '201':
+          description: The run that fired the seam.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - runId
+                properties:
+                  runId:
+                    $ref: ../schemas/v2/ids.schema.json#/$defs/runId
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '404':
+          $ref: '#/components/responses/NotFound'
+  /conformance/seams/sample/test/idempotency/effect-retry:
+    post:
+      tags:
+      - Seams
+      operationId: forceEffectTransportRetry
+      summary: Drive one effect through the suite fixture provider with a forced transport retry — RFC 0173 §D.2 G4 witness
+      description: 'The host issues one outbound effect to `providerUrl` and retries it at the transport layer. The suite
+        fixture provider records the idempotency key of each attempt: a Layer-2 host MUST present the SAME business-identity
+        key across both attempts, so a provider that sees a changed key fails the leg. Without this seam the effect-identity
+        obligation is only claims-checkable.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - providerUrl
+              properties:
+                providerUrl:
+                  type: string
+                  format: uri
+                  description: The suite's fixture provider; it records each attempt's idempotency key.
+      responses:
+        '201':
+          description: The run and effect that were retried.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - runId
+                - effectId
+                properties:
+                  runId:
+                    $ref: ../schemas/v2/ids.schema.json#/$defs/runId
+                  effectId:
+                    type: string
+                    minLength: 1
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+  /conformance/seams/sample/webhooks/receive:
+    post:
+      tags:
+      - Seams
+      operationId: receiveWebhookDelivery
+      summary: Run a webhook delivery through the host's inbound receiver — RFC 0176 §D.2 witness
+      description: The v2 host as a subscriber. The host verifies `headers` + `body` with its production verifier using `secret`
+        as the subscription secret and reports the verdict; an `X-openwop-*`-only scheme-`v1` delivery over `{timestamp}.{rawBody}`
+        MUST be accepted (`v2-v1-signed-webhook-accepted`), and a tampered signature MUST be refused.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - secret
+              - headers
+              - body
+              properties:
+                secret:
+                  type: string
+                  minLength: 1
+                headers:
+                  type: object
+                  additionalProperties:
+                    type: string
+                body:
+                  type: string
+      responses:
+        '200':
+          description: The verifier verdict.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - accepted
+                properties:
+                  accepted:
+                    type: boolean
+                  reason:
+                    type: string
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
 components:
   securitySchemes:
     ApiKeyAuth:

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.0.0-rc.0
+  version: 2.0.0-rc.10
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.0.0-rc.0
+  version: 2.0.0-rc.10
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,10 +1,23 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.0.0-rc.0",
-  "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
+  "version": "2.0.0-rc.10",
+  "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json \u2014 published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 \u00a7D.2).",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/openwop/openwop.git", "directory": "spec-artifacts" },
-  "files": ["api", "schemas", "spec", "CORPUS-STAMP.json", "README.md", "LICENSE"],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openwop/openwop.git",
+    "directory": "spec-artifacts"
+  },
+  "files": [
+    "api",
+    "schemas",
+    "spec",
+    "CORPUS-STAMP.json",
+    "README.md",
+    "LICENSE"
+  ],
   "sideEffects": false,
-  "publishConfig": { "access": "public" }
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/schemas/certification-bundle-v2.schema.json

@@ -5,26 +5,58 @@
   "description": "A certification bundle that records what EXECUTED, not merely what passed.\n\nThe v1 bundle carried `{passed, failed, skipped}` scenario-file lists. Those three cannot express the distinction the whole program turns on: a scenario file counted as `passed` whether its assertions ran or its runner returned early, and a `skipped` entry could mean 'the operator excluded this', 'the requirement does not apply', or 'we could not check' — three claims with different consequences flattened into one word.\n\nv2 replaces the lists with per-requirement dispositions from RFC 0148 §A, and adds the counts §A.4 requires so a reader can tell a thorough run from a thin one without re-running it. `blocked` is its own total precisely because it is the one that invalidates a claim.",
   "type": "object",
   "additionalProperties": true,
-  "required": ["bundleVersion", "suite", "host", "discovery", "claimedProfiles", "results", "scenarioManifestSha256", "targetConfigurationSha256"],
+  "required": [
+    "bundleVersion",
+    "suite",
+    "host",
+    "discovery",
+    "claimedProfiles",
+    "results",
+    "scenarioManifestSha256",
+    "targetConfigurationSha256"
+  ],
   "properties": {
-    "bundleVersion": { "const": "2" },
+    "bundleVersion": {
+      "const": "2"
+    },
     "suite": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["package", "version"],
+      "required": [
+        "package",
+        "version"
+      ],
       "properties": {
-        "package": { "type": "string", "minLength": 1 },
-        "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+$" }
+        "package": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^\\d+\\.\\d+\\.\\d+(-[0-9A-Za-z.-]+)?$",
+          "description": "The suite version that produced this bundle. A SemVer prerelease is admitted because RFC 0168 §D.3 makes the 2.x suite one package with `--target-major`: a v1 host measured by a prerelease 2.x suite legitimately emits a v2 bundle whose `suite.version` is `2.0.0-rc.N`. The original three-part-only pattern predates that decision and made such a bundle unvalidatable — found in Phase 4 when a host pinned to the RC line tried to certify."
+        }
       }
     },
     "host": {
       "type": "object",
       "additionalProperties": true,
-      "required": ["name", "version"],
+      "required": [
+        "name",
+        "version"
+      ],
       "properties": {
-        "name": { "type": "string", "minLength": 1 },
-        "version": { "type": "string", "minLength": 1 },
-        "vendor": { "type": "string" },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        },
+        "vendor": {
+          "type": "string"
+        },
         "commit": {
           "type": "string",
           "minLength": 1,
@@ -40,41 +72,80 @@
     "discovery": {
       "type": "object",
       "additionalProperties": true,
-      "required": ["sha256", "document"],
+      "required": [
+        "sha256",
+        "document"
+      ],
       "properties": {
-        "url": { "type": "string" },
-        "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
-        "document": { "type": "object" }
+        "url": {
+          "type": "string"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "document": {
+          "type": "object"
+        }
       }
     },
     "claimedProfiles": {
       "type": "array",
       "minItems": 1,
       "uniqueItems": true,
-      "items": { "type": "string", "pattern": "^openwop-[a-z0-9-]+$" },
+      "items": {
+        "type": "string",
+        "pattern": "^openwop-[a-z0-9-]+$"
+      },
       "description": "RFC 0155 §E — canonical profile IDs only. Deprecated aliases go in `aliases`, never here, so a badge cannot be substantiated by a name that no longer means what it did."
     },
     "aliases": {
       "type": "array",
       "uniqueItems": true,
-      "items": { "type": "string" }
+      "items": {
+        "type": "string"
+      }
     },
     "results": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["totals", "requirements"],
+      "required": [
+        "totals",
+        "requirements"
+      ],
       "properties": {
         "totals": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["executedPass", "executedFail", "skipped", "inapplicable", "blocked"],
+          "required": [
+            "executedPass",
+            "executedFail",
+            "skipped",
+            "inapplicable",
+            "blocked"
+          ],
           "description": "RFC 0148 §A/§C. All five are REQUIRED — an omitted total is indistinguishable from zero, and `blocked: 0` asserted is a different claim from `blocked` unstated.",
           "properties": {
-            "executedPass": { "type": "integer", "minimum": 0 },
-            "executedFail": { "type": "integer", "minimum": 0 },
-            "skipped": { "type": "integer", "minimum": 0 },
-            "inapplicable": { "type": "integer", "minimum": 0 },
-            "blocked": { "type": "integer", "minimum": 0 }
+            "executedPass": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "executedFail": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "skipped": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "inapplicable": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "blocked": {
+              "type": "integer",
+              "minimum": 0
+            }
           }
         },
         "requirements": {
@@ -84,17 +155,38 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["requirementId", "scenarioId", "disposition"],
+            "required": [
+              "requirementId",
+              "scenarioId",
+              "disposition"
+            ],
             "properties": {
-              "requirementId": { "type": "string", "minLength": 1 },
-              "scenarioId": { "type": "string", "minLength": 1 },
-              "disposition": { "enum": ["executed-pass", "executed-fail", "skipped", "inapplicable", "blocked"] },
+              "requirementId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "scenarioId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "disposition": {
+                "enum": [
+                  "executed-pass",
+                  "executed-fail",
+                  "skipped",
+                  "inapplicable",
+                  "blocked"
+                ]
+              },
               "assertionCount": {
                 "type": "integer",
                 "minimum": 0,
                 "description": "How many assertions actually ran. `executed-pass` with `assertionCount: 0` is the vacuous pass this program exists to close, and a reader can now see it."
               },
-              "witnessSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+              "witnessSha256": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$"
+              },
               "detail": {
                 "type": "string",
                 "description": "Required by RFC 0148 §A for any disposition other than `executed-pass` — an unexplained `blocked` is an outcome nobody can act on."