@openwop/spec-artifacts 2.0.0-rc.0

package/schemas/v2/audit-verify-result.schema.json

@@ -0,0 +1,110 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/audit-verify-result.schema.json",
+  "title": "AuditVerifyResult",
+  "description": "Response payload from `GET /v1/audit/verify` per spec/v1/auth-profiles.md §`openwop-audit-log-integrity` §4 'Verification endpoint'. Hosts advertising the audit-log-integrity profile MUST return this shape on the verify endpoint when called with a valid `audit:read`-scoped credential. The shape carries the verifier's chain-validity verdict, the in-range signed checkpoints, and any anomaly records the verifier detected while re-walking the hash chain.",
+  "type": "object",
+  "required": [
+    "fromSeq",
+    "toSeq",
+    "chainValid",
+    "checkpoints",
+    "anomalies"
+  ],
+  "properties": {
+    "fromSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Echo of the caller's `fromSeq` query parameter. The verifier MUST re-walk entries [fromSeq, toSeq] inclusive."
+    },
+    "toSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Echo of the caller's `toSeq` query parameter. MUST be >= fromSeq."
+    },
+    "chainValid": {
+      "type": "boolean",
+      "description": "True when every entry's `prevHash` matches the SHA-256 of the prior entry's RFC 8785 JCS canonicalization AND every signed checkpoint in `checkpoints[]` verifies against the host's advertised `auditLogIntegrity.checkpointPublicKey`. False when ANY break or invalid signature is detected; `anomalies[]` enumerates the breaks."
+    },
+    "checkpointsValid": {
+      "type": "boolean",
+      "description": "OPTIONAL companion bit: true when every checkpoint signature in `checkpoints[]` verifies. Distinguishes 'chain broken but checkpoints OK' from 'checkpoints forged but chain intact'. Hosts MAY omit when `chainValid` already conveys the verdict; clients that distinguish the two failure modes SHOULD prefer hosts that surface this bit explicitly."
+    },
+    "checkpoints": {
+      "type": "array",
+      "description": "Signed checkpoints emitted within [fromSeq, toSeq]. Order: ascending by `atSequence`. Empty array MUST appear when no checkpoint was emitted in the window (not omitted).",
+      "items": {
+        "$ref": "#/$defs/Checkpoint"
+      }
+    },
+    "anomalies": {
+      "type": "array",
+      "description": "One entry per detected hash-chain break in [fromSeq, toSeq]. Empty array MUST appear when chainValid is true (not omitted).",
+      "items": {
+        "$ref": "#/$defs/Anomaly"
+      }
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "Checkpoint": {
+      "type": "object",
+      "required": [
+        "checkpoint",
+        "atSequence",
+        "merkleRoot",
+        "signature"
+      ],
+      "properties": {
+        "checkpoint": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "Host-issued checkpoint id. Globally unique within the host's audit log."
+        },
+        "atSequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Audit-log sequence number at which the checkpoint was minted. Inclusive — the entry at this sequence is covered by the checkpoint's merkleRoot."
+        },
+        "merkleRoot": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Hex-encoded SHA-256 Merkle root over the canonicalized entries 0..atSequence inclusive. Verifiers re-compute and compare; mismatch implies chain mutation between two checkpoints."
+        },
+        "signature": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Base64-encoded Ed25519 signature over the checkpoint's canonical JSON (excluding the `signature` field itself), produced with the host's advertised `auditLogIntegrity.checkpointPublicKey`."
+        }
+      },
+      "additionalProperties": false
+    },
+    "Anomaly": {
+      "type": "object",
+      "required": [
+        "atSeq",
+        "expectedPrevHash",
+        "actualPrevHash"
+      ],
+      "properties": {
+        "atSeq": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Sequence number of the entry whose `prevHash` failed verification."
+        },
+        "expectedPrevHash": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Hex-encoded SHA-256 the verifier computed from the prior entry's RFC 8785 JCS canonicalization."
+        },
+        "actualPrevHash": {
+          "type": "string",
+          "description": "The `prevHash` value the audit-log entry actually carries. Empty string when the field is missing (a structural anomaly distinct from a hash mismatch)."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "x-openwop-seeded-from": "v1"
+}

package/schemas/v2/budget-policy.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/budget-policy.schema.json",
+  "title": "BudgetPolicy",
+  "description": "RFC 0084 §A. The reserved `budget` run-options key (on `RunOptions.configurable`) — an enforceable per-run SPEND policy. Wall-time + loop-iterations are deliberately NOT here: those are RFC 0058's `runTimeoutMs` / `maxLoopIterations` (the §E orthogonality seam). 0084 governs spend; 0058 governs execution bounds; they share only the `cap.breached` overflow event. Every dimension is optional; an absent dimension is unbounded (host default).",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "maxTokens": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Total input+output tokens across all `provider.usage` (RFC 0026) in the run."
+    },
+    "maxCostUsd": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Total cost summed from `provider.usage` `costEstimateUsd` (host-defined pricing per RFC 0026)."
+    },
+    "maxToolCalls": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Total `agent.toolCalled` events in the run."
+    },
+    "maxRetries": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Ceiling over the cumulative RFC 0009 retry count (node + envelope retries); the run fails when cumulative retries hit it. NOT a separate retry mechanism (RFC 0084 §UQ4)."
+    },
+    "modelAllow": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "uniqueItems": true,
+      "description": "Optional allowlist (glob over provider model ids, e.g. `claude-*`). A run resolving to a model outside the allowlist is refused with `budget_model_denied` before the call."
+    },
+    "modelDeny": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "uniqueItems": true,
+      "description": "Optional denylist. `modelDeny` wins on conflict with `modelAllow` (fail-closed)."
+    },
+    "thresholdPercent": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "Emit `budget.threshold.crossed` once per dimension at this percent of the dimension's limit."
+    },
+    "onExhaustion": {
+      "type": "string",
+      "enum": [
+        "fail",
+        "interrupt"
+      ],
+      "description": "`fail` (default): `cap.breached{kind:\"budget-*\"}` → `run.failed{budget_exhausted}`. `interrupt`: raise an RFC 0051 approval interrupt so a human MAY extend the budget."
+    }
+  },
+  "x-openwop-seeded-from": "v1"
+}