@openwop/spec-artifacts 2.19.0 → 2.20.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.19.0",
-  "corpusTag": "v2.19.0",
+  "version": "2.20.0",
+  "corpusTag": "v2.20.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "19e5318553a410b01d9e3a72ba5ea91807272049ca7b2a47f0fd216f745f49f2",
-    "api/v2/asyncapi.yaml": "08960013da4dbc236f5ed55eb354385fc8064f225db2866d8e27f1ada08d87ec",
-    "api/v2/openapi.yaml": "0bc364b20a7cfda9187bc737436052c5a14aa695a5aef4ef699755126501848c",
+    "api/seams-v2.yaml": "2132964437fde6f1d28d1fa9b8e1c37cab4e6a61c2630807c2df1d19313864fb",
+    "api/v2/asyncapi.yaml": "60b992b381d2b63dde4085664190979e77cfe6082f6c63d1149fa90e4b78cca9",
+    "api/v2/openapi.yaml": "22a4249b402fac7498de47f1b8615d68b6ee3090b10a8afcfbbccf8959fb0f68",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -116,7 +116,7 @@
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "213c5cbe7ae7a337418c9183ed8ec39f1bc4dc39650a9b3c06cea9780dca3f24",
-    "schemas/v2/certification-bundle.schema.json": "0bcf8f297266505ca39d30eea8100e3c0fb048f2651717fd746da8129fcb7920",
+    "schemas/v2/certification-bundle.schema.json": "9afcd16cf018d9b0d3b31e3b7e2e844d9289fe7b912a363d0df5a78e4fdfc054",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
@@ -201,13 +201,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "e4ec317bdab5ba50c20b4d3d56437f6d8fc9f031461ac1359502d0176dac95fd",
+    "spec/v1/core-standard-manifest.json": "7a9f26072759124fd30685994d120043eee7abb1501d507a9f11a26f558f9951",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "bf0bf89f20a856c49aad85828e77e15a80073005b067fbcf672bbf2604770273",
+    "spec/v1/gaps.json": "348f3d5b93057f614b44ce24cc2f96f7675583dee4cea015943ba02d64f840ee",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -230,7 +230,7 @@
     "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
     "spec/v2/core/replay.md": "10cc01bf9e4e921fcfac740f3174b2e95cda7ba9a1e13e85cf371c8c2d0fa46a",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
-    "spec/v2/core/security-defaults.md": "5c32c0bf4b47975c1428361b225a066cd3966cb37b023ca70bc30152fcbec33b",
+    "spec/v2/core/security-defaults.md": "2a54ceaa4cef02c26ee0fbcf44f822ceeea79537c7d5a51ed300f21aa4fea576",
     "spec/v2/core/versioning.md": "27b88cde88f9060567ef7e46f4897b6be8892ade9f4a46c2ab16e314c515eabd",
     "spec/v2/core/webhooks.md": "46c1311c1897236f9bf9db5025c8af31dd84cd19208da3e5e9ff69eec9436965",
     "spec/v2/core/workflow-chain-packs.md": "df78b76dd79f2267fb6b72c08e0911e5f9d5bb1925c6efdd6deda62fe8a51dc8",
@@ -274,8 +274,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "d791fcb236173a8a074d3874f072fa1f753a6369279ed0ba19e318603375efc4",
+    "spec/v2/release.json": "e8d93bad6d3acf1a9ba6b6ff121caeb73bef1371ab930f7adfa9fc29f35f67ef",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "0a845654ef20fb40204e2d88df2f450fe3c8db84"
+  "corpusCommit": "766736268b7b82871bda8f4e27a358d6dcdf5888"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.19.0
+  version: 2.20.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.19.0
+  version: 2.20.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.19.0
+  version: 2.20.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.19.0",
+  "version": "2.20.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/certification-bundle.schema.json

@@ -259,7 +259,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "pattern": "^openwop\\.(?!it\\.(?:artifact-schema-compile-bounded|artifact-type-legacy-ids|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|multi-region-effect-vocabulary|normative-example-extraction|openapi-asyncapi-sdk-parity|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-result-trust-monotone|v2-alias-covers-reword|v2-corpus-tag-pinned|v2-bundle-signature-attributable|v2-declaration-parity|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-id-kinds-bound|v2-one-signing-scheme|v2-path-parity|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
+                "pattern": "^openwop\\.(?!it\\.(?:artifact-schema-compile-bounded|artifact-type-legacy-ids|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|multi-region-effect-vocabulary|normative-example-extraction|openapi-asyncapi-sdk-parity|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-result-trust-monotone|v2-alias-covers-reword|v2-bundle-signature-attributable|v2-corpus-tag-pinned|v2-declaration-parity|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-facet-advertisement|v2-id-kinds-bound|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
                 "description": "RFC 0168 §A.1 — `openwop.<area>.<slug>`. The suite mints six areas: `requirement` (an explicit `req()` id), `it` (a per-test id from the scenario file and title), `scenario` and `floor` (per-file rows), `profile` (a claimed-profile row) and `family` (a capability gate). The lookahead refuses every id minted from a corpus-coherence file: those run in the spec repo’s CI and MUST NOT appear in a host bundle (conformance.md §\"Two products, two ledgers\"; RFC 0168 §D.1). `scripts/check-req-only.mjs` fails when the list drifts from `conformance/src/coherence/`."
               },
               "scenario": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.19.0"
+      "version": "2.20.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "ee299f91a90600b02a7e4456f380b71df8f3080f8b6e163f2e02cd11f1c3350e"
+  "digest": "7019097f2a52113af625c5ae7092147d238e402a93ba12e6f2d67bcc43f48e18"
 }

package/spec/v1/gaps.json

@@ -10424,8 +10424,8 @@
       "surface": "G5 closed a PRECEDING dot but not a FOLLOWING one, and this register's own G5 row plus the gate's docblock CLAIMED otherwise — naming `i18n` ← \"see i18n.md\" as closed when it is not. The trailing boundary class excludes `-`, `_` and `/` but must leave `.` open for the `key.facet` arm, so `see i18n.md` still names `i18n` and `` `channelPresence.supported` `` still names `channelPresence`.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0189.8",
+      "disposition": "transferred",
+      "target": "scripts/check-v2-normative-home.mjs",
       "sources": [
         {
           "file": "RFCS/registers/0189-normative-home.gaps.md",
@@ -10475,8 +10475,8 @@
       "surface": "The per-family grant is **200 words** against a measured mean of **140.75** (four families, 563 words, five sections). That mean is drawn entirely from families with one or two facets. The remaining set includes `agents` (19 facets) and `aiProviders` (12), and a grounded model — ~110 base + ~20 per facet beyond the first — puts the remainder near 9,170 against 12,600 granted. If the real per-facet cost is higher than 20 words, the grant is too thin for the wide families even though the aggregate holds, and the self-funding property forces them to land LAST, when the cheap families have funded them.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0190.1",
+      "disposition": "transferred",
+      "target": "scripts/check-core-budget.mjs",
       "sources": [
         {
           "file": "RFCS/registers/0190-kernel-budget-denominator.gaps.md",
@@ -10509,8 +10509,8 @@
       "surface": "`spec/v2/ext/` is now a co-pointer that contributes facet coverage only. Nothing checks that an ext document cited as a co-pointer is *about* the family citing it — the same bare-token weakness as RFC 0189 G1, one directory over. The `authorization`-against-thirteen-READMEs case is closed for the OBLIGATION predicate but not for facet coverage: a facet name appearing incidentally in an unrelated ext page still counts as covered.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0190.3",
+      "disposition": "transferred",
+      "target": "scripts/check-core-budget.mjs",
       "sources": [
         {
           "file": "RFCS/registers/0190-kernel-budget-denominator.gaps.md",
@@ -10526,8 +10526,8 @@
       "surface": "A host has no way to advertise a facet NEGATIVELY — \"I know about this and do not offer it\". Presence-semantics makes omission the only spelling, which cannot distinguish *unsupported* from *not yet considered*. MyndHyve expresses exactly this today as `extensions.myndhyve.runs.pauseResume.supported = false`, fleeing to the vendor namespace because the core root cannot say it. That is a production host routing around a missing surface, which is evidence the gap is real rather than theoretical.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0192.1",
+      "disposition": "transferred",
+      "target": "schemas/v2/capabilities.schema.json",
       "sources": [
         {
           "file": "RFCS/registers/0192-facet-advertisement.gaps.md",
@@ -10543,8 +10543,8 @@
       "surface": "The rewrite table is keyed on the exact v1 sentence, so a reworded v1 seed silently stops matching and the ghost returns — caught by §C's gate, but as a new failure rather than as a diff on the table.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0192.2",
+      "disposition": "transferred",
+      "target": "schemas/v2/capabilities.schema.json",
       "sources": [
         {
           "file": "RFCS/registers/0192-facet-advertisement.gaps.md",
@@ -10560,8 +10560,8 @@
       "surface": "Eight core families carry zero facets, so the facet rule is vacuous for them, and `facetsUncovered` gives them no backstop either (RFC 0190 §B). Nothing in the corpus distinguishes \"this family genuinely has no sub-capabilities\" from \"its facets were never modelled\".",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "carried",
-      "target": "openwop.gap.0192.3",
+      "disposition": "transferred",
+      "target": "schemas/v2/capabilities.schema.json",
       "sources": [
         {
           "file": "RFCS/registers/0192-facet-advertisement.gaps.md",

package/spec/v2/core/security-defaults.md

@@ -60,7 +60,7 @@ A host that advertises `idempotency` MUST assign a logical effect id once per ef
 
 ## Relaxations
 
-A relaxation, where one is legitimate — a development deployment, a single-tenant appliance — is an operator setting, never a discovery field (RFC 0173 §A.2). Every relaxation a host runs under MUST be recorded in its certification bundle as `host.relaxations[]` (`schemas/v2/certification-bundle.schema.json`): `{ obligation, durability, reason }`, `durability ∈ session | deployment | permanent`.
+A relaxation, where one is legitimate — a development deployment, a single-tenant appliance — is an operator setting, never a discovery field (RFC 0173 §A.2). Every relaxation a host runs under MUST be recorded in its certification bundle as `host.relaxations[]` (`schemas/v2/certification-bundle.schema.json`): `{ obligation, durability, reason }`, `durability ∈ session | deployment | persisted`.
 
 | Durability | Meaning |
 | --- | --- |

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.19.0",
-  "corpusTag": "v2.19.0",
+  "version": "2.20.0",
+  "corpusTag": "v2.20.0",
   "updated": "2026-09-18"
 }