@openwop/spec-artifacts 2.0.0-rc.0

package/schemas/ai-envelope.schema.json

@@ -0,0 +1,134 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/ai-envelope.schema.json",
+  "title": "AIEnvelope",
+  "description": "Canonical inbound wire format for a typed, structured emission produced by an LLM during workflow execution. Distinct from `RunEventDoc` (which is the outbound run event log envelope). Per `spec/v1/ai-envelope.md`. The top-level shape is closed (`additionalProperties: false`); the `payload` shape is selected by the `type` discriminator and validated against a per-kind schema at `schemas/envelopes/{type}.schema.json` (universals) or a host-published vendor location. Hosts advertise the kind catalog via `Capabilities.supportedEnvelopes` and the per-kind active version via `Capabilities.schemaVersions`. Status: FINAL v1.1 (promoted 2026-05-18 via RFC 0021).",
+  "type": "object",
+  "required": ["type", "envelopeId", "correlationId", "payload", "meta"],
+  "properties": {
+    "type": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Discriminator for payload shape, kind routing, and Envelope Contract gate. Universal kinds (always allowed): `clarification.request`, `schema.request`, `schema.response`, `error`. Vendor kinds MUST be namespaced per `spec/v1/host-extensions.md` (e.g., `vendor.myndhyve.prd.create`). Pre-v1.x unnamespaced kinds (`prd.create`, `theme.create`, `tasks.create`) MAY appear in `Capabilities.supportedEnvelopes` for backward compatibility; v1.x hosts SHOULD prefer the namespaced form."
+    },
+    "schemaVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Per-kind schema version. Absent → treat as 0. Matched against `Capabilities.schemaVersions[type]`. When the emitted version is lower than the advertised floor, engines under `envelopeStrictness: 'warn'` (default) MUST attempt validation against the advertised version and log `envelope_schema_version_drift`; engines under `envelopeStrictness: 'strict'` MUST refuse with `unknown_schema_version`. When higher than advertised, engines MUST refuse regardless of strictness."
+    },
+    "envelopeId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Globally unique envelope id. Generated by the engine if absent on receipt; consumers MUST treat as opaque. Distinct from `correlationId` (which is the dedup/replay key)."
+    },
+    "correlationId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Caller-stable identifier for dedup, replay short-circuit, and causal chaining. Two envelopes in the same run with the same `correlationId` MUST be treated as a re-emission (engine returns the cached outcome). Same-`correlationId` envelopes with different `type` values MUST be refused with `envelope_correlation_conflict`. The engine propagates `correlationId` onto resulting `RunEventDoc.causationId`. Recommended construction: `${runId}:${nodeId}:${turnIndex}:${kindHash}`."
+    },
+    "nodeId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Set when the emitting node is identifiable. Lifted to top-level for per-node projection without payload coercion (mirrors `RunEventDoc.nodeId`). Engines MAY populate from execution context when absent."
+    },
+    "payload": {
+      "description": "Discriminated payload. Shape selected by `type`. Validated against the per-kind schema at `schemas/envelopes/{type}.schema.json` (universals) or a host-published vendor schema. Top-level accepts any JSON value because per-kind schemas vary; strict validation is per-kind, not at this layer.",
+      "type": ["object", "array", "string", "number", "boolean", "null"]
+    },
+    "meta": {
+      "$ref": "#/$defs/EnvelopeMeta"
+    },
+    "partial": {
+      "$ref": "#/$defs/PartialInfo"
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "EnvelopeMeta": {
+      "type": "object",
+      "required": ["source", "ts"],
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": ["ai-generation", "user", "system"],
+          "description": "Provenance of this emission. `ai-generation` — LLM emitted this in a node turn. `user` — relayed from a user action (form fill, approval gate). `system` — engine-synthesized (e.g., resume value normalization). Gates approval-flow re-routing per `ai-envelope.md` §\"Source attribution\" (LLM-generated mutations route through approval gates; user-supplied mutations bypass them when the user is already authenticated)."
+        },
+        "contentTrust": {
+          "type": "string",
+          "enum": ["trusted", "untrusted"],
+          "description": "Trust tag mirroring `RunEventDoc.contentTrust`. Hosts MUST set `untrusted` when the payload origin is an MCP tool result per `mcp-integration.md` or an A2A inbound message per `a2a-integration.md`. The engine MUST propagate this onto any `RunEventDoc` emitted as a consequence of the envelope. Approval gates MUST refuse to advance on `untrusted` envelopes (refusal code `untrusted_content_blocks_approval`)."
+        },
+        "ts": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 UTC timestamp of emission."
+        },
+        "traceparent": {
+          "type": "string",
+          "description": "Optional W3C trace-context value (`traceparent` header format) for distributed tracing propagation. Engines that export OTel spans for envelope acceptance SHOULD honor this value as the parent span when present."
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "Optional human-readable label for ops dashboards (e.g., `\"Draft PRD #2\"`). Never used for routing; never persisted into event payloads in a security-relevant way. (in-flight)"
+        },
+        "rendering": {
+          "type": "object",
+          "description": "RFC 0055. Optional hint for how a consumer SHOULD render this envelope's payload. Non-normative w.r.t. payload validation; a consumer that doesn't recognize the hint (or a `display` value) MUST fall back to its default rendering (text / raw JSON). Carries no secret material (SR-1 applies as for the rest of `meta`).",
+          "properties": {
+            "display": {
+              "type": "string",
+              "enum": ["markdown", "code", "card", "image", "audio", "file"],
+              "description": "Renderer family the producer suggests."
+            },
+            "mimeType": {
+              "type": "string",
+              "description": "IANA media type when `display` is `image`/`audio`/`file`."
+            },
+            "lang": {
+              "type": "string",
+              "description": "Language tag when `display` is `code` (e.g. `ts`, `python`)."
+            },
+            "alt": {
+              "type": "string",
+              "description": "Text alternative for accessibility when `display` is `image`/`audio`/`file`. SHOULD be present for those families."
+            },
+            "title": {
+              "type": "string",
+              "description": "Optional caption / card header."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false,
+      "description": "Wire metadata. See `spec/v1/ai-envelope.md` §EnvelopeMeta."
+    },
+    "PartialInfo": {
+      "type": "object",
+      "required": ["isPartial", "index", "total"],
+      "properties": {
+        "isPartial": {
+          "type": "boolean",
+          "description": "True for all chunks of a partial emission EXCEPT the final one. The final chunk carries `isPartial: false` and signals reassembly completion. (in-flight)"
+        },
+        "index": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "0-indexed chunk position. (in-flight)"
+        },
+        "total": {
+          "type": "integer",
+          "minimum": -1,
+          "description": "Total expected chunks. -1 when unknown (streaming without precount). (in-flight)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Present when the envelope is one fragment of a streamed emission. Cross-transport reassembly is open (see gap E1 in `ai-envelope.md`)."
+    }
+  }
+}

package/schemas/annotation-create.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/annotation-create.schema.json",
+  "title": "AnnotationCreate",
+  "description": "RFC 0056. Request body for `POST /v1/runs/{runId}/annotations`. The host assigns `annotationId` + `createdAt`, derives `actor.principalRef` from the authenticated principal, and binds `target.runId` to the path `runId` — so the client supplies only the target anchor (event/node), the signal, and an optional note. The response is a full `annotation.schema.json`.",
+  "type": "object",
+  "required": ["signal"],
+  "properties": {
+    "target": {
+      "type": "object",
+      "description": "Optional finer-grained anchor within the run. `runId` is taken from the path and MUST NOT be supplied here.",
+      "properties": {
+        "eventId": { "type": "string", "description": "Anchor the annotation to one RunEvent." },
+        "nodeId": { "type": "string", "description": "Anchor the annotation to one node." }
+      },
+      "additionalProperties": false
+    },
+    "signal": {
+      "type": "object",
+      "required": ["kind"],
+      "properties": {
+        "kind": { "type": "string", "enum": ["rating", "correction", "label", "flag"] },
+        "rating": { "type": "integer", "minimum": 1, "maximum": 5, "description": "Required iff `kind` is `rating`." },
+        "label": { "type": "string", "description": "Required iff `kind` is `label`." },
+        "correction": { "type": "string", "description": "Corrected text/value iff `kind` is `correction`. Untrusted user content." }
+      },
+      "additionalProperties": false,
+      "allOf": [
+        { "if": { "properties": { "kind": { "const": "rating" } } }, "then": { "required": ["rating"] } },
+        { "if": { "properties": { "kind": { "const": "label" } } }, "then": { "required": ["label"] } },
+        { "if": { "properties": { "kind": { "const": "correction" } } }, "then": { "required": ["correction"] } }
+      ]
+    },
+    "note": { "type": "string", "description": "Optional free-text reviewer note. Untrusted user content." }
+  },
+  "additionalProperties": false
+}

package/schemas/annotation.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/annotation.schema.json",
+  "title": "Annotation",
+  "description": "RFC 0056. A non-blocking human/agent quality signal attached to a run, event, or node — a side-resource, NOT a replayable run-event-log entry. Recorded via `POST /v1/runs/{runId}/annotations`, listed via `GET`, and surfaced live via the `run.annotated` SSE notification. `signal.correction` and `note` are untrusted user content (SECURITY invariant `annotation-content-redaction`).",
+  "type": "object",
+  "required": ["annotationId", "target", "signal", "actor", "createdAt"],
+  "properties": {
+    "annotationId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Host-assigned unique identifier for this annotation."
+    },
+    "target": {
+      "type": "object",
+      "required": ["runId"],
+      "properties": {
+        "runId": { "type": "string", "minLength": 1 },
+        "eventId": { "type": "string", "description": "Optional — anchors the annotation to one RunEvent." },
+        "nodeId": { "type": "string", "description": "Optional — anchors the annotation to one node." }
+      },
+      "additionalProperties": false
+    },
+    "signal": {
+      "type": "object",
+      "required": ["kind"],
+      "properties": {
+        "kind": { "type": "string", "enum": ["rating", "correction", "label", "flag"] },
+        "rating": { "type": "integer", "minimum": 1, "maximum": 5, "description": "Required iff `kind` is `rating`." },
+        "label": { "type": "string", "description": "Required iff `kind` is `label`." },
+        "correction": { "type": "string", "description": "Corrected text/value iff `kind` is `correction`. Untrusted user content." }
+      },
+      "additionalProperties": false,
+      "allOf": [
+        { "if": { "properties": { "kind": { "const": "rating" } } }, "then": { "required": ["rating"] } },
+        { "if": { "properties": { "kind": { "const": "label" } } }, "then": { "required": ["label"] } },
+        { "if": { "properties": { "kind": { "const": "correction" } } }, "then": { "required": ["correction"] } }
+      ]
+    },
+    "actor": {
+      "type": "object",
+      "required": ["principalRef"],
+      "properties": {
+        "principalRef": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque principal identifier — a principal per RFC 0048 (Draft, referenced non-normatively) or an AgentRef per RFC 0002 when a supervisor agent annotates. String-typed so RFC 0056 does not depend on RFC 0048 reaching Accepted."
+        }
+      },
+      "additionalProperties": false
+    },
+    "note": { "type": "string", "description": "Optional free-text reviewer note. Untrusted user content." },
+    "createdAt": { "type": "string", "format": "date-time", "description": "ISO 8601 timestamp the host recorded the annotation." }
+  },
+  "additionalProperties": false
+}

package/schemas/artifact-type-pack-manifest.schema.json

@@ -0,0 +1,244 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/artifact-type-pack-manifest.schema.json",
+  "title": "ArtifactTypePackManifest",
+  "description": "Manifest for a published OpenWOP artifact-type pack — `pack.json` at the pack root with `kind: \"artifact-type\"`. Peer to `node-pack-manifest.schema.json` (RFC 0003), `workflow-chain-pack-manifest.schema.json` (RFC 0013), and `prompt-pack-manifest.schema.json` (RFC 0028); disjoint from all three via the `kind` discriminator. See `spec/v1/artifact-type-packs.md` for the canonical contract and RFC 0071 for the rationale.\n\nArtifact-type packs distribute typed artifact definitions — the JSON Schema, rendering hint, lifecycle, and export-format hints for the rich outputs workflow nodes produce — via the same signed-tarball + Ed25519 + SRI pipeline that already serves node, workflow-chain, and prompt packs. When a host installs an artifact-type pack and advertises `host.artifactTypes: { supported: true }`, it validates produced artifacts of the declared `artifactTypeId`s against their `schemaRef` before emitting `artifact.created`.",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "kind",
+    "engines",
+    "artifactTypes"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "kind": {
+      "type": "string",
+      "const": "artifact-type",
+      "description": "Pack kind discriminator. MUST be the literal string `\"artifact-type\"`. Manifests carrying any other `kind` value validate against a different pack-manifest schema."
+    },
+    "name": {
+      "type": "string",
+      "description": "Reverse-DNS pack name per `node-packs.md` §Naming. Reserved scopes are identical (`core.*` / `vendor.<org>.*` / `community.<author>.*` / `private.<host>.*`). Mirror of `prompt-pack-manifest.schema.json#/properties/name`.",
+      "pattern": "^(core|vendor|community|private)\\.[a-z][a-z0-9_-]*(\\.[a-z][a-zA-Z0-9_-]*)+$",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "version": {
+      "type": "string",
+      "description": "Pack-level SemVer 2.0.0.",
+      "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$"
+    },
+    "description": {
+      "type": "string",
+      "maxLength": 1024
+    },
+    "author": {
+      "type": "string"
+    },
+    "license": {
+      "type": "string",
+      "description": "SPDX license identifier (e.g., `Apache-2.0`, `MIT`)."
+    },
+    "homepage": {
+      "type": "string",
+      "format": "uri"
+    },
+    "repository": {
+      "type": "string",
+      "format": "uri"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "maxLength": 64
+      },
+      "maxItems": 50
+    },
+    "engines": {
+      "type": "object",
+      "required": [
+        "openwop"
+      ],
+      "properties": {
+        "openwop": {
+          "type": "string",
+          "description": "Semver range — which openwop protocol versions this pack works against. Example: `>=1.1 <2.0.0`."
+        }
+      },
+      "additionalProperties": true
+    },
+    "dependencies": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Other packs this pack depends on. Map of pack name → semver range. Resolved transitively at workflow-register time."
+    },
+    "peerDependencies": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Engine-supplied capabilities the pack consumes (e.g., `{ \"host.artifactTypes\": \"supported\" }`). Resolved against the host's advertised capabilities at register time."
+    },
+    "artifactTypes": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/ArtifactType"
+      },
+      "description": "Typed artifact definitions this pack contributes. Each MUST have a unique `artifactTypeId` within the pack."
+    },
+    "signing": {
+      "$ref": "#/$defs/Signing"
+    }
+  },
+  "$defs": {
+    "ArtifactType": {
+      "type": "object",
+      "required": [
+        "artifactTypeId",
+        "schemaRef"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "artifactTypeId": {
+          "type": "string",
+          "description": "Reverse-DNS artifact-type identifier. Same pattern and reserved scopes as a pack `name`. This is the value `WorkflowNode.artifactType`, `nodes[].artifact.typeId`, and `artifact.created.artifactType` reference. Third parties MUST NOT publish under `core.*`.",
+          "pattern": "^(core|vendor|community|private)\\.[a-z][a-z0-9_-]*(\\.[a-z][a-zA-Z0-9_-]*)+$",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "schemaRef": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Path inside the pack tarball to the artifact's JSON Schema (Draft 2020-12). The target schema MUST set `additionalProperties: false` at its top level and declare an `$id` under `{HostBase}/schemas/artifacts/{artifactTypeId}.schema.json`, mirroring the envelope convention in `ai-envelope.md` §\"Canonical schema location\"."
+        },
+        "schemaVersion": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Non-negative integer artifact-schema version, parallel to the per-kind integer in `capabilities.schemaVersions`. Absent ⇒ treated as 0. Bumped when the artifact schema changes shape. A version *declaration*, not a validation guarantee (RFC 0075 / P1-2)."
+        },
+        "validation": {
+          "type": "string",
+          "enum": [
+            "open",
+            "closed"
+          ],
+          "description": "RFC 0075. Strictness contract of the artifact's `schemaRef` schema. `closed` ⇒ closed-world (`additionalProperties: false`); a consumer MAY rely on the absence of unknown fields. `open` (recommended for AI/LLM-produced artifacts) ⇒ the schema tolerates extra fields to absorb model drift; consumers MUST ignore unknown fields per COMPATIBILITY.md §2.1. Absent ⇒ `open` (the forward-compatible default). The `additionalProperties:false` requirement on `schemaRef` was relaxed MUST → SHOULD by RFC 0075: a closed-world artifact contract contradicts the protocol's own forward-compat mandate and the first AI-native adopter cannot meet it."
+        },
+        "displayName": {
+          "type": "string",
+          "description": "Human-readable label for artifact-management UIs. Non-normative."
+        },
+        "rendering": {
+          "$ref": "#/$defs/RenderingHint"
+        },
+        "exportFormats": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^([a-z][a-z0-9]*|vendor\\.[a-z][a-z0-9-]*\\.[a-z][a-z0-9-]*|x-[a-z][a-z0-9-]*)$"
+          },
+          "uniqueItems": true,
+          "description": "Export-format identifiers (hints) a renderer MAY offer. Spec-reserved core identifiers carry interoperable meaning (the lowercase file-extension / common name): `pdf`, `pptx`, `docx`, `xlsx`, `md`, `html`, `txt`, `csv`, `json`, `png`, `svg`, `jpeg`, `step`, `stl`, `dxf`. Domain-specific formats outside the core set MUST be `vendor.<org>.<format>`- or `x-<format>`-prefixed (mirrors the `requiredModelCapabilities` reserved-core + extension idiom). Advisory: this spec assigns no byte-level production semantics to any identifier — it standardizes the identifier so two hosts agree what `pptx` names, not how the bytes are produced."
+        },
+        "syncOn": {
+          "type": "string",
+          "enum": [
+            "completion",
+            "approval",
+            "manual"
+          ],
+          "description": "When the host registers the artifact as durable. Mirrors `node-pack-manifest.schema.json#/$defs/PackNode/properties/artifact/properties/syncOn`. Default `completion`."
+        },
+        "supportsCheckpoint": {
+          "type": "boolean",
+          "description": "True if the artifact participates in checkpoint/resume. Mirrors the `PackNode.artifact.supportsCheckpoint` field."
+        },
+        "versionable": {
+          "type": "boolean",
+          "description": "True if the host SHOULD retain prior versions of the artifact. Non-normative storage hint."
+        },
+        "diffable": {
+          "type": "boolean",
+          "description": "True if the artifact's schema supports structural diffing (informs run-diff tooling per rest-endpoints.md §:diff). Non-normative."
+        }
+      },
+      "patternProperties": {
+        "^(x-|vendor\\.)": {
+          "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
+        }
+      }
+    },
+    "RenderingHint": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Advisory rendering hint. Reuses the closed vocabulary defined in ai-envelope.md §\"Rendering hints\" (RFC 0055). Advisory only — consumers MUST degrade gracefully and MUST NOT treat this as a validation input. The `card` display value is reserved for envelopes and is excluded here (durable artifacts are not transient chat cards).",
+      "properties": {
+        "display": {
+          "type": "string",
+          "enum": [
+            "markdown",
+            "code",
+            "image",
+            "audio",
+            "file"
+          ],
+          "description": "How a consumer SHOULD render the artifact when it recognizes the value."
+        },
+        "mimeType": {
+          "type": "string",
+          "maxLength": 255
+        },
+        "lang": {
+          "type": "string",
+          "maxLength": 64,
+          "description": "Language hint for `display: code`."
+        },
+        "alt": {
+          "type": "string",
+          "maxLength": 1024,
+          "description": "Accessibility text for image/audio/file."
+        },
+        "title": {
+          "type": "string",
+          "maxLength": 255
+        }
+      }
+    },
+    "Signing": {
+      "type": "object",
+      "description": "Optional signing metadata. See node-packs.md §signing.",
+      "additionalProperties": false,
+      "properties": {
+        "publicKeyRef": {
+          "type": "string",
+          "description": "Path inside the tarball to the Ed25519 public key (PEM-encoded)."
+        },
+        "signatureRef": {
+          "type": "string",
+          "description": "Path to the detached signature over `pack.json`."
+        },
+        "method": {
+          "type": "string",
+          "enum": [
+            "manual",
+            "sigstore"
+          ],
+          "description": "Signing method. `manual` uses publicKeyRef + signatureRef; `sigstore` uses a Sigstore bundle at `pack.json.sigstore`."
+        }
+      }
+    }
+  },
+  "patternProperties": {
+    "^(x-|vendor\\.)": {
+      "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
+    }
+  }
+}

package/schemas/audit-verify-result.schema.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/audit-verify-result.schema.json",
+  "title": "AuditVerifyResult",
+  "description": "Response payload from `GET /v1/audit/verify` per spec/v1/auth-profiles.md §`openwop-audit-log-integrity` §4 'Verification endpoint'. Hosts advertising the audit-log-integrity profile MUST return this shape on the verify endpoint when called with a valid `audit:read`-scoped credential. The shape carries the verifier's chain-validity verdict, the in-range signed checkpoints, and any anomaly records the verifier detected while re-walking the hash chain.",
+  "type": "object",
+  "required": ["fromSeq", "toSeq", "chainValid", "checkpoints", "anomalies"],
+  "properties": {
+    "fromSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Echo of the caller's `fromSeq` query parameter. The verifier MUST re-walk entries [fromSeq, toSeq] inclusive."
+    },
+    "toSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Echo of the caller's `toSeq` query parameter. MUST be >= fromSeq."
+    },
+    "chainValid": {
+      "type": "boolean",
+      "description": "True when every entry's `prevHash` matches the SHA-256 of the prior entry's RFC 8785 JCS canonicalization AND every signed checkpoint in `checkpoints[]` verifies against the host's advertised `auditLogIntegrity.checkpointPublicKey`. False when ANY break or invalid signature is detected; `anomalies[]` enumerates the breaks."
+    },
+    "checkpointsValid": {
+      "type": "boolean",
+      "description": "OPTIONAL companion bit: true when every checkpoint signature in `checkpoints[]` verifies. Distinguishes 'chain broken but checkpoints OK' from 'checkpoints forged but chain intact'. Hosts MAY omit when `chainValid` already conveys the verdict; clients that distinguish the two failure modes SHOULD prefer hosts that surface this bit explicitly."
+    },
+    "checkpoints": {
+      "type": "array",
+      "description": "Signed checkpoints emitted within [fromSeq, toSeq]. Order: ascending by `atSequence`. Empty array MUST appear when no checkpoint was emitted in the window (not omitted).",
+      "items": { "$ref": "#/$defs/Checkpoint" }
+    },
+    "anomalies": {
+      "type": "array",
+      "description": "One entry per detected hash-chain break in [fromSeq, toSeq]. Empty array MUST appear when chainValid is true (not omitted).",
+      "items": { "$ref": "#/$defs/Anomaly" }
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "Checkpoint": {
+      "type": "object",
+      "required": ["checkpoint", "atSequence", "merkleRoot", "signature"],
+      "properties": {
+        "checkpoint": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "Host-issued checkpoint id. Globally unique within the host's audit log."
+        },
+        "atSequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Audit-log sequence number at which the checkpoint was minted. Inclusive — the entry at this sequence is covered by the checkpoint's merkleRoot."
+        },
+        "merkleRoot": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Hex-encoded SHA-256 Merkle root over the canonicalized entries 0..atSequence inclusive. Verifiers re-compute and compare; mismatch implies chain mutation between two checkpoints."
+        },
+        "signature": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Base64-encoded Ed25519 signature over the checkpoint's canonical JSON (excluding the `signature` field itself), produced with the host's advertised `auditLogIntegrity.checkpointPublicKey`."
+        }
+      },
+      "additionalProperties": false
+    },
+    "Anomaly": {
+      "type": "object",
+      "required": ["atSeq", "expectedPrevHash", "actualPrevHash"],
+      "properties": {
+        "atSeq": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Sequence number of the entry whose `prevHash` failed verification."
+        },
+        "expectedPrevHash": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Hex-encoded SHA-256 the verifier computed from the prior entry's RFC 8785 JCS canonicalization."
+        },
+        "actualPrevHash": {
+          "type": "string",
+          "description": "The `prevHash` value the audit-log entry actually carries. Empty string when the field is missing (a structural anomaly distinct from a hash mismatch)."
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/schemas/budget-policy.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v1/budget-policy.schema.json",
+  "title": "BudgetPolicy",
+  "description": "RFC 0084 §A. The reserved `budget` run-options key (on `RunOptions.configurable`) — an enforceable per-run SPEND policy. Wall-time + loop-iterations are deliberately NOT here: those are RFC 0058's `runTimeoutMs` / `maxLoopIterations` (the §E orthogonality seam). 0084 governs spend; 0058 governs execution bounds; they share only the `cap.breached` overflow event. Every dimension is optional; an absent dimension is unbounded (host default).",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "maxTokens": { "type": "integer", "minimum": 1, "description": "Total input+output tokens across all `provider.usage` (RFC 0026) in the run." },
+    "maxCostUsd": { "type": "number", "minimum": 0, "description": "Total cost summed from `provider.usage` `costEstimateUsd` (host-defined pricing per RFC 0026)." },
+    "maxToolCalls": { "type": "integer", "minimum": 1, "description": "Total `agent.toolCalled` events in the run." },
+    "maxRetries": { "type": "integer", "minimum": 0, "description": "Ceiling over the cumulative RFC 0009 retry count (node + envelope retries); the run fails when cumulative retries hit it. NOT a separate retry mechanism (RFC 0084 §UQ4)." },
+    "modelAllow": { "type": "array", "items": { "type": "string" }, "uniqueItems": true, "description": "Optional allowlist (glob over provider model ids, e.g. `claude-*`). A run resolving to a model outside the allowlist is refused with `budget_model_denied` before the call." },
+    "modelDeny": { "type": "array", "items": { "type": "string" }, "uniqueItems": true, "description": "Optional denylist. `modelDeny` wins on conflict with `modelAllow` (fail-closed)." },
+    "thresholdPercent": { "type": "number", "minimum": 0, "maximum": 100, "description": "Emit `budget.threshold.crossed` once per dimension at this percent of the dimension's limit." },
+    "onExhaustion": { "type": "string", "enum": ["fail", "interrupt"], "description": "`fail` (default): `cap.breached{kind:\"budget-*\"}` → `run.failed{budget_exhausted}`. `interrupt`: raise an RFC 0051 approval interrupt so a human MAY extend the budget." }
+  }
+}