@openwop/spec-artifacts 2.20.0 → 2.22.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.20.0",
-  "corpusTag": "v2.20.0",
+  "version": "2.22.0",
+  "corpusTag": "v2.22.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "2132964437fde6f1d28d1fa9b8e1c37cab4e6a61c2630807c2df1d19313864fb",
-    "api/v2/asyncapi.yaml": "60b992b381d2b63dde4085664190979e77cfe6082f6c63d1149fa90e4b78cca9",
-    "api/v2/openapi.yaml": "22a4249b402fac7498de47f1b8615d68b6ee3090b10a8afcfbbccf8959fb0f68",
+    "api/seams-v2.yaml": "edcec24d0875b3f1abc747ffc1abbcda264e615c56f4608b0658b537b644dbb8",
+    "api/v2/asyncapi.yaml": "dfed346a511018f2bd25a66292668df1146736ffe1dffe59dae8a0a8d0ec83cd",
+    "api/v2/openapi.yaml": "bc9f1eb0fc6551129f54a67fffdd716b1ec1d1f8816263749abc7595cca63643",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -201,13 +201,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "7a9f26072759124fd30685994d120043eee7abb1501d507a9f11a26f558f9951",
+    "spec/v1/core-standard-manifest.json": "9bfa7448d3d2d04421bd872c4e64f619fb00d0609a922b4c61b98cf4473a63c3",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "348f3d5b93057f614b44ce24cc2f96f7675583dee4cea015943ba02d64f840ee",
+    "spec/v1/gaps.json": "f0a99073fac443dade386fb06a9fbe888d24861babde4908551ad96f9cb6596f",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -218,7 +218,7 @@
     "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
     "spec/v2/core/connection-packs.md": "466bdb9dde79d85615ad8281dacfb7bf923ca22d7fb3ed219749e59574c753ed",
     "spec/v2/core/errors.md": "6b6a1480ed889013172d8ce8c6985e321d2f4f73e1d9fae0bac9b961d0dd1a8c",
-    "spec/v2/core/events.md": "2fbf98662a72035afd7a3f811c30d4fe5f0ac823488a2cc9198a61cf6d27a049",
+    "spec/v2/core/events.md": "2138f148be2d63f8530d2ad21ddff9acf166763c21c505bbb42deeab749b6476",
     "spec/v2/core/form-content-packs.md": "af3517dd7125106088249c0e32220b0b9fc3e9304c10378a6327cc8ad84b6bf1",
     "spec/v2/core/headers.md": "14cdf4ae9ee7d80eebfd426d7c3552e577baea0300915cd4bb3a68e8588195a8",
     "spec/v2/core/idempotency.md": "e4edae1834101fd331379d84de77eaa9cead49383529c31f8bcd18322f67c965",
@@ -234,7 +234,7 @@
     "spec/v2/core/versioning.md": "27b88cde88f9060567ef7e46f4897b6be8892ade9f4a46c2ab16e314c515eabd",
     "spec/v2/core/webhooks.md": "46c1311c1897236f9bf9db5025c8af31dd84cd19208da3e5e9ff69eec9436965",
     "spec/v2/core/workflow-chain-packs.md": "df78b76dd79f2267fb6b72c08e0911e5f9d5bb1925c6efdd6deda62fe8a51dc8",
-    "spec/v2/declaration.json": "6182a370811133d9033591fd357cf6973a9c4e5b01cf25988922d6c621db5d0d",
+    "spec/v2/declaration.json": "332ae3db4e241c98598c0d096e5216fde80122a250c57dc507a02e6aeab52202",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
     "spec/v2/errors.json": "aac91b12f954cc90574d310070ae3c651b131055d4389d2c6155242763765195",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
@@ -274,8 +274,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "e8d93bad6d3acf1a9ba6b6ff121caeb73bef1371ab930f7adfa9fc29f35f67ef",
+    "spec/v2/release.json": "c5f2fcf9cb2fdc3755b5828e75d02758ded5b73b64e2f31fdcbb775ad956fa7b",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "766736268b7b82871bda8f4e27a358d6dcdf5888"
+  "corpusCommit": "01b730108f674de0c568943837ffe8e505a4b46b"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.20.0
+  version: 2.22.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.20.0
+  version: 2.22.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.20.0
+  version: 2.22.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.20.0",
+  "version": "2.22.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.20.0"
+      "version": "2.22.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "7019097f2a52113af625c5ae7092147d238e402a93ba12e6f2d67bcc43f48e18"
+  "digest": "9466034adb41afc146cf6d8992ab9e52ff13e1da6ca4036517edfb75db5221f1"
 }

package/spec/v1/gaps.json

@@ -10467,6 +10467,108 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0189.11",
+      "rfc": "0189",
+      "local": "G11",
+      "section": "§B(b)",
+      "surface": "G5's preceding-dot rule is right that `owner.workspace` does not name `workspace`, and wrong that `capabilities.prompts` does not name `prompts` — the `capabilities.<key>` and `host.<key>` forms are the CANONICAL way v1 prose names a capability family. Measured: admitting those two closed namespaces unlocks true homes for `prompts` (`spec/v1/prompts.md`, two protocol-tier invariants), `feedback` (`observability.md`), `nodePackRuntimes` (`node-packs.md` — a textbook home I had classified as \"no candidate anywhere\") and `aiEnvelope`. G10 already admits `(?:host\\.)?` in `titledFor` for exactly this reason; it fixed headings and left body prose behind.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "scripts/check-v2-normative-home.mjs",
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G11"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.12",
+      "rfc": "0189",
+      "local": "G12",
+      "section": "§B(c)",
+      "surface": "G10 made the HEADING supply the family name, which removed an accidental defence: a fenced code block under `## §host.<key>` spells the family `ctx.<key>.…` and was preceding-dot-dead before G10. After it, any such block containing a stray MUST/SHOULD/MAY **in a comment** satisfies §B(c). Live instance: §host.secrets' TypeScript sketch matched on `// pack SHOULD treat as advisory`. A fenced block is an illustrative shape, not an obligation.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G12"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.13",
+      "rfc": "0189",
+      "local": "G13",
+      "section": "§A",
+      "surface": "A document that declares itself NON-NORMATIVE could be a normative home. `spec/v1/structured-output-subset.md` is titled \"(informative)\" and banners \"Non-normative snapshot\" — and it is the ONLY prose site of `envelopes.tierOneSubsetCompliance` corpus-wide, so declaring it was the cheapest way to resolve `envelopes`. The gate checked only that a Status banner EXISTS. At end-of-support the §D fallback would then have asserted that an informative document is operative prose.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G13"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.14",
+      "rfc": "0189",
+      "local": "G14",
+      "section": "§B(c)",
+      "surface": "A BULLET LIST is not one paragraph either. G4 split tables so a MUST in row 15 could not satisfy a family named in row 6; it left bullet lists fused, and the same exploit lives one syntax down. `spec/v1/ai-envelope.md`'s `envelopeContracts.advertised` bullet carries NO 2119 keyword and passed §B(c) only because the ADJACENT `envelopeStrictness` bullet says \"MUST cause refusal\". That declaration SHIPPED in 2.21.0 — hand-read, right about the family, wrong about the anchor — and the §D fallback would have asserted it at end-of-support.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G14"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.15",
+      "rfc": "0189",
+      "local": "G15",
+      "section": "§B(d)",
+      "surface": "PROPOSED AND REJECTED ON MEASUREMENT. The proposal was to strip fenced code blocks from the facet arm as G12 does for the obligation arm, on the claim it costs zero declared families. Measured: it breaks SIXTEEN facets — `credentials.encryptionAtRest`, `oauth.grants`, `kvStorage.maxTtlSeconds` and thirteen more — every one named in a JSON ADVERTISEMENT EXAMPLE, which is precisely how a facet is legitimately named.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G15"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0189.16",
+      "rfc": "0189",
+      "local": "G16",
+      "section": "§A",
+      "surface": "A conformance-seam catalog could be a normative home. `spec/v1/host-sample-test-seams.md` banners \"observation seams, not application endpoints\", and its `multiPartyConversation` bullet says in its own matched text that RFC 0101 \"mints no normative client wire-route\" — so the paragraph that would have satisfied §B(c) is the paragraph disclaiming the contract. G13's informative-banner refusal does not catch it, because the document is genuinely `Stable` and genuinely normative ABOUT SEAMS.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0189-normative-home.gaps.md",
+          "token": "G16"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0190.1",
       "rfc": "0190",

package/spec/v2/core/events.md

@@ -1,7 +1,7 @@
 # Events
 
 > **Status: Stable · RFC 0171 §A, §E; RFC 0176 §A.**
-> **Normative home:** `heartbeat`.
+> **Normative home:** `heartbeat`, `envelopeContracts`.
 
 ## Why this exists
 
@@ -113,3 +113,12 @@ The response is `{ runId, events, lastSequence, status, isTerminal }` (closed):
 ## Era-2 logs
 
 An `eventLogSchemaVersion` of `2` means v1-written. Every reader (poll, stream, fork, diff, debug bundle) MUST translate each event through `spec/v2/event-codemap.json` at storage — `type` is mapped, the payload projected; `sequence` (including `0`), `eventId`, `timestamp`, `causationId` pass through. A type the codemap does not name, carrying no vendor org, MUST fail the read `500 event_type_unmapped`. A host MUST NOT carry a private mapping, nor rewrite era-2 rows in place. **A projection MUST NOT silently drop a property**: carry or fail `500 payload_unprojectable` (hatch `^(openwop-|x-|vendor\.)`; RFC 0185). Fork and replay over an era-2 parent: replay.md.
+
+## Envelope contracts
+
+`envelopeContracts` advertises that a host enforces per-node envelope permission
+sets. A host advertising `envelopeContracts.advertised` MUST refuse a node whose
+emitted envelope `type` is neither universal nor listed in that node's accepted
+set, and MUST refuse it distinctly from the capability-gated `typeId` refusal —
+the two stack rather than substitute.
+

package/spec/v2/declaration.json

@@ -250,6 +250,7 @@
     {
       "key": "envelopeContracts",
       "kind": "family",
+      "normativeText": ["spec/v2/core/events.md"],
       "anchor": "core",
       "section": "core/capabilities.md#envelopeContracts",
       "peerDependencyId": "envelopeContracts",
@@ -339,6 +340,7 @@
     {
       "key": "secrets",
       "kind": "family",
+      "normativeText": ["spec/v1/host-capabilities.md"],
       "anchor": "core",
       "section": "core/capabilities.md#secrets",
       "peerDependencyId": "secrets",
@@ -634,6 +636,7 @@
     {
       "key": "modelCapabilities",
       "kind": "family",
+      "normativeText": ["spec/v1/host-capabilities.md"],
       "anchor": "core",
       "section": "core/capabilities.md#modelCapabilities",
       "peerDependencyId": "modelCapabilities",
@@ -672,6 +675,7 @@
     {
       "key": "aiProviders",
       "kind": "family",
+      "normativeText": ["spec/v1/host-capabilities.md", "spec/v1/capabilities.md", "spec/v1/ai-envelope.md"],
       "anchor": "core",
       "section": "core/capabilities.md#aiProviders",
       "peerDependencyId": "aiProviders",
@@ -703,6 +707,7 @@
     {
       "key": "agents",
       "kind": "family",
+      "normativeText": ["spec/v1/multi-agent-execution.md", "spec/v1/agent-memory.md", "spec/v1/agent-runtime.md", "spec/v1/agent-org-chart.md", "spec/v1/agent-evaluation.md", "spec/v1/capabilities.md"],
       "anchor": "core",
       "section": "core/capabilities.md#agents",
       "peerDependencyId": "agents",
@@ -740,6 +745,7 @@
     {
       "key": "memory",
       "kind": "family",
+      "normativeText": ["spec/v1/agent-memory.md", "spec/v1/capabilities.md"],
       "anchor": "core",
       "section": "core/capabilities.md#memory",
       "peerDependencyId": "memory",
@@ -1006,6 +1012,7 @@
     {
       "key": "artifactTypes",
       "kind": "family",
+      "normativeText": ["spec/v1/artifact-type-packs.md"],
       "anchor": "core",
       "section": "core/capabilities.md#artifactTypes",
       "peerDependencyId": "artifactTypes",
@@ -1253,6 +1260,7 @@
     {
       "key": "uiPlugins",
       "kind": "family",
+      "normativeText": ["spec/v1/frontend-plugin-packs.md"],
       "anchor": "core",
       "section": "core/capabilities.md#uiPlugins",
       "peerDependencyId": "uiPlugins",
@@ -1557,6 +1565,7 @@
     {
       "key": "production",
       "kind": "family",
+      "normativeText": ["spec/v1/production-profile.md"],
       "anchor": "core",
       "section": "core/capabilities.md#production",
       "peerDependencyId": "production",

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.20.0",
-  "corpusTag": "v2.20.0",
+  "version": "2.22.0",
+  "corpusTag": "v2.22.0",
   "updated": "2026-09-18"
 }