@openwop/spec-artifacts 2.16.0 → 2.17.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.16.0",
-  "corpusTag": "v2.16.0",
+  "version": "2.17.0",
+  "corpusTag": "v2.17.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "46bc549d6de6a8fa0a53f43e09249cd3e18936eecb114e1836e93e3ea8f1f5ea",
-    "api/v2/asyncapi.yaml": "c2e3abf4ee265d494fe38bca4b2148bc86e2a9520d61f8aec4b771cec08a699e",
-    "api/v2/openapi.yaml": "719478209c8a296f5d756010da2b5eeb1d058635253427148ca3f02598cb413c",
+    "api/seams-v2.yaml": "45eaa133676a8d64ebfee48255289d78e2ba16505be074147b73226fa93a4dbe",
+    "api/v2/asyncapi.yaml": "d0c1c7f13b0a9b440c911c8db029fa4e6c58083381970ac80978b2858ebd4262",
+    "api/v2/openapi.yaml": "3ee8a933a3718fa3937053f8e7cc1f43ffd3d4e76b138938f3aac8f5d8362471",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -201,13 +201,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "e0cdcba53adf7cecf24fc64b69a58306fdea74b2830338a292927315ad4c355c",
+    "spec/v1/core-standard-manifest.json": "75529e5e4421d4830fddab55b675638cda1603e8aee87c8ba6d6d36164bd213b",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "9d56a0eb3edde8daea94220343d8a784beebebf324ff3664163a56aa68a29876",
+    "spec/v1/gaps.json": "ac54bdfcfdcbf96ddc5ae13c7e8e94a88f3c60c785be760d8a3d1fa902ef82ce",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -229,12 +229,12 @@
     "spec/v2/core/packs.md": "cc06de2d49dd08410eececd5c279996ec839680553b332b4f33d6b31989b5757",
     "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
     "spec/v2/core/replay.md": "10cc01bf9e4e921fcfac740f3174b2e95cda7ba9a1e13e85cf371c8c2d0fa46a",
-    "spec/v2/core/runs.md": "f7641c111a3d6ce225656732515cf2fbd38f1c1455b39ee744a4fd2ad09ba379",
+    "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
     "spec/v2/core/security-defaults.md": "5c32c0bf4b47975c1428361b225a066cd3966cb37b023ca70bc30152fcbec33b",
     "spec/v2/core/versioning.md": "27b88cde88f9060567ef7e46f4897b6be8892ade9f4a46c2ab16e314c515eabd",
     "spec/v2/core/webhooks.md": "46c1311c1897236f9bf9db5025c8af31dd84cd19208da3e5e9ff69eec9436965",
     "spec/v2/core/workflow-chain-packs.md": "df78b76dd79f2267fb6b72c08e0911e5f9d5bb1925c6efdd6deda62fe8a51dc8",
-    "spec/v2/declaration.json": "1e47c155ab36bf0520c759c3aa3e67d2e3737d28a6c6a538cd281bb5a9930b13",
+    "spec/v2/declaration.json": "2a2e582bb9523c94f14463d3fabd369b791ffb288911a6205b4f2b44cbe4b4b8",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
     "spec/v2/errors.json": "aac91b12f954cc90574d310070ae3c651b131055d4389d2c6155242763765195",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -274,8 +274,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "c7d72623c4045035f3a700b45e4ab7e0f41f2828135a0ea4de597c9a92efc219",
+    "spec/v2/release.json": "af025f8d1d54eac3f58de237afa51c1abba9362ce42cad07ea1818719724046e",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "3ec0076d1f6f317f24bd204c89a03bb1920818d0"
+  "corpusCommit": "51de3f8c51f257a61ecd4eb0723d471f3040e221"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.16.0
+  version: 2.17.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.16.0
+  version: 2.17.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.16.0
+  version: 2.17.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.16.0"
+      "version": "2.17.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "c0f1590f583e543666dbff52208450cee734e7d602f72832f65dcd6a7feda0c2"
+  "digest": "f61ce1740b9c6c9d6c99d00a32bf247a2555cfe3282b6a3eacfad7e869e2453a"
 }

package/spec/v1/gaps.json

@@ -10416,6 +10416,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0189.8",
+      "rfc": "0189",
+      "local": "G8",
+      "section": "§B(b)",
+      "surface": "G5 closed a PRECEDING dot but not a FOLLOWING one, and this register's own G5 row plus the gate's docblock CLAIMED otherwise — naming `i18n` ← \"see i18n.md\" as closed when it is not. The trailing boundary class excludes `-`, `_` and `/` but must leave `.` open for the `key.facet` arm, so `see i18n.md` still names `i18n` and `` `channelPresence.supported` `` still names `channelPresence`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "carried",
+      "target": "openwop.gap.0189.8",
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.9",
+      "rfc": "0189",
+      "local": "G9",
+      "section": "§D",
+      "surface": "The burn-down denominator (`open = v1Dependent + undeclared`) is STRICTER than the terminal predicate it schedules (`fatal = undeclared + uncarried + broken`) — at end-of-support a carried v1-dependent family is acceptable, but before it every such family still counts against the daily clock. A review recommended aligning them by changing the denominator to `undeclared`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G9"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0190.1",
       "rfc": "0190",

package/spec/v2/core/runs.md

@@ -1,7 +1,7 @@
 # Runs
 
 > **Status: Stable · RFC 0170 §A, §D.1; RFC 0171 §D; RFC 0176 §B.1.**
-> **Normative home:** `runList`, `limits`.
+> **Normative home:** `runList`, `limits`, `conversationPrimitive`, `dataResidency`.
 
 ## Why this exists
 
@@ -58,7 +58,7 @@ The `201` response is `{ runId, status, eventsUrl, statusUrl? }`, `status` one o
 | Section | Keys | Rule |
 | --- | --- | --- |
 | `run` | `recursionLimit`, `runTimeoutMs`, `maxLoopIterations`, `escalationThreshold` | `recursionLimit` is clamped to `limits.maxNodeExecutions`. `runTimeoutMs` resolves to `min(runTimeoutMs, limits.maxRunDurationMs)`; an out-of-range value MUST return `400 validation_error` at create, and a breach MUST emit `cap.breached { kind: 'run-duration' }` and terminate the run `failed` with `run_timeout`. `maxLoopIterations` resolves against `limits.maxLoopIterations`; a breach MUST emit `cap.breached { kind: 'loop-iterations' }` and fail with `loop_limit_exceeded`. `escalationThreshold` is the `low-confidence` threshold (interrupt.md). |
-| `ai` | `provider`, `model`, `temperature` (0..2), `maxTokens`, `credentialRef`, `promptOverrides`, `mockProvider`, `reasoningVerbosity` (`none` \| `summary` \| `full`), `maxRefusals` | `provider` MUST be in `aiProviders.supported`, else `400 validation_error`. `credentialRef` MUST reference a provider in `aiProviders.byok`, else `403 credential_forbidden`; it never carries key material. `mockProvider` is test-keys-only: a host MUST refuse it on a production credential with `403`. `maxRefusals` is the refusal ceiling (events.md E5). |
+| `ai` | `provider`, `model`, `temperature` (0..2), `maxTokens`, `credentialRef`, `promptOverrides`, `mockProvider`, `reasoningVerbosity` (`none` \| `summary` \| `full`), `maxRefusals` | `provider` MUST be in `aiProviders.providers`, else `400 validation_error`. `credentialRef` MUST reference a provider in `aiProviders.byok`, else `403 credential_forbidden`; it never carries key material. `mockProvider` is test-keys-only: a host MUST refuse it on a production credential with `403`. `maxRefusals` is the refusal ceiling (events.md E5). |
 | `distillation` | `tokenBudget` | Resolves to `min(tokenBudget, memory.distillation.maxTokenBudget)`; a run that cannot distill within it MUST fail atomically with `token_budget_exceeded`. |
 | `budget` | `schemas/v2/budget-policy.schema.json` | The run's budget policy. |
 | `extensions` | `<org>: {…}` | A vendor key lives under its registered org and nowhere else. |
@@ -113,3 +113,16 @@ A non-terminal run a v2 host inherits from v1 whose `version.pinned` change ids
 ## Annotations, artifacts, eval summary
 
 `createAnnotation` accepts `schemas/v2/annotation-create.schema.json` and returns `201` with `schemas/v2/annotation.schema.json`; `listAnnotations` returns `{ annotations[] }`. An annotation is a live notification (`run.annotated`), never a run event: it MUST NOT enter the event log and MUST be excluded from fork, replay and diff. `getArtifact` returns the artifact as an implementation-defined JSON object. `getEvalSummary` returns `schemas/v2/eval-summary.schema.json` for a terminal eval run, `409` while it is running, `404` when the run is not an eval run; the summary MUST be content-free of task output, rubric prose and credentials.
+
+## Conversation and residency capabilities
+
+`conversationPrimitive` carries no payload: its presence is the claim (capabilities.md §2). A
+workflow whose `nodes[].typeId` references `core.conversationGate` MUST be refused by a host that
+does not advertise `conversationPrimitive`, at registration or at run creation, with `422
+capability_required` naming the family in `details.requiredCapability`.
+
+A host advertising `dataResidency` MUST honor-or-reject: accept a `residency` constraint naming a
+region in `dataResidency.regions`, refuse one it does not advertise with `residency_unavailable`,
+and MUST NOT silently accept-and-ignore. Advertising `regions` while accepting an unadvertised
+region is a hollow advertisement. A host that does not advertise `dataResidency` MAY ignore or
+reject a `residency` constraint but MUST NOT claim to honor it.

package/spec/v2/declaration.json

@@ -415,6 +415,7 @@
     {
       "key": "dataResidency",
       "kind": "family",
+      "normativeText": ["spec/v2/core/runs.md"],
       "anchor": "core",
       "section": "core/capabilities.md#dataResidency",
       "peerDependencyId": "dataResidency",
@@ -760,6 +761,7 @@
     {
       "key": "conversationPrimitive",
       "kind": "family",
+      "normativeText": ["spec/v2/core/runs.md"],
       "anchor": "core",
       "section": "core/capabilities.md#conversationPrimitive",
       "peerDependencyId": "conversationPrimitive",

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.16.0",
-  "corpusTag": "v2.16.0",
+  "version": "2.17.0",
+  "corpusTag": "v2.17.0",
   "updated": "2026-09-18"
 }