@openwop/spec-artifacts 2.3.0 → 2.3.2

package/spec/v2/ext/README.md

@@ -0,0 +1,28 @@
+# `spec/v2/ext/` — extension families
+
+> **Status: Stable · 2026-09-17 · RFC 0177 §E (this file), RFC 0174 §E.2.** This README is the one place the extension tail's *maturity* rule lives. It is not counted against the `spec/v2/core/` word budget.
+
+## Why this exists
+
+Seventeen extension documents shipped `Status: Draft` on the day v2 was tagged, and nothing in the corpus said what moves one. RFC 0177 owns *declaring* an extension family; the step after "declared" was unwritten, so every family stayed Draft by default rather than by decision. A status that can only go one way is not a status.
+
+## The rule
+
+An extension document under `spec/v2/ext/<name>/` carries a `Status:` header with one of three values. Movement between them is a **predicate over evidence**, checked by `scripts/check-ext-status-coherence.mjs` in the corpus gate:
+
+| Status | Meaning | Predicate |
+| --- | --- | --- |
+| `Draft` | Declared. A host MAY advertise it; the corpus makes no claim about it. | The family is declared in `spec/v2/declaration.json` with `anchor: ext`. |
+| `Stable` | Witnessed. At least one host at evidence tier 2 or better serves it, and a **certified** bundle in `evidence/v2-host-bundles/` records the family's declared witness class satisfied. | Every `Stable` doc's family has ≥ 1 `executed-pass` row under its witness id in a bundle whose relevant profile claim is `certified: true`, **and** the 7-day comment window has run since the promotion PR. |
+| `Retired` | Withdrawn. The family is removed from the declaration and the document names its replacement or the RFC that retired it. | The family is absent from the declaration; the doc carries a `Superseded by:` or `Retired by:` line. |
+
+Two consequences the gate enforces, both directions:
+
+- A `Stable` document whose family **no longer** has a certified passing row is a defect — the gate goes red, and the honest move is to demote to `Draft` with the date, not to find a bundle.
+- A `Draft` document whose family **does** have a certified passing row is reported as **graduable** (a warning, not a failure): the evidence exists and the steward has not acted on it. That is the state this README was written to end.
+
+A family with no directory here (the four `ext/` directories with no declared family — `grpc-transport`, `portability`, `provider-idempotency`, `sandbox-runtime-notes` — are notes, not families) is outside this rule and MUST say so in its own header.
+
+## What this does not decide
+
+Whether an `ext` family should ever become `core`. That is an RFC 0167-family question (a core family costs budget and needs a codemap row); this file only governs the tail.

package/spec/v2/ext/grpc-transport/README.md

@@ -8,6 +8,6 @@
 | **advertised as** | not advertisable — no `grpc` block exists at the v2 root (RFC 0175 §A.1; RFC 0169 §A.1) |
 | **owning RFC** | RFC 0175 (demotion); RFC 0094 §H (v1 text) |
 
-> **Status: Draft · v2.0.0-rc (2026-09-03).** RFC 0175 §A.1: `grpc-transport.md` leaves `core/`; the suite ships no gRPC client and no host advertises the block, so the transport is `unwitnessable`. Its six v1 MUSTs are SHOULDs of this extension. `openwop.proto` beside this file is a NON-NORMATIVE sketch (the v1 proto, unchanged; `package openwop.v1`). The door back into core is named: a v2.x additive RFC that generates the proto from `spec/v2/declaration.json` and lands a suite client.
+> **Status: Draft · v2.0.0-rc (2026-09-03).** RFC 0175 §A.1: `grpc-transport.md` leaves `core/`; the suite ships no gRPC client and no host advertises the block, so the transport is `unwitnessable`. Its six v1 MUSTs are SHOULDs of this extension. `openwop.proto` beside this file is a NON-NORMATIVE sketch (the v1 proto, unchanged; `package openwop.v1`). The door back into core is named: a v2.x additive RFC that generates the proto from `spec/v2/declaration.json` and lands a suite client. **Not a declared family — notes, outside the `ext/README.md` maturity rule; `Draft` here means unfrozen prose, not an unwitnessed family.**
 
 The v1 definition stands at `spec/v1/grpc-transport.md` for v1.x hosts.

package/spec/v2/ext/portability/README.md

@@ -8,4 +8,4 @@
 | **advertised as** | `extensions.<org>.portability` |
 | **owning RFC** | RFC 0168 (decided in C.1 per RFC 0174 §E.2), RFC 0086/0087 (v1 text) |
 
-> **Status: Draft · v2.0.0-rc (2026-09-03).** `/v1/goals`, `/v1/export`, `/v1/import` were absent from the v1 OpenAPI while `spec/v1/portability.md` and the goals prose described them (RFC 0174 §E.2 noted the decision belongs to C.1). Decided (Phase 3 plan §11): they do not enter `api/v2/openapi.yaml`; the export/import bundle (`schemas/v2/export-bundle.schema.json`, `bundleVersion` "2") and the goals surface are this extension, advertised under `extensions.<org>.portability`, with `spec/v1/portability.md` as the definition until a v2.x additive RFC lands their operations with a witness.
+> **Status: Draft · v2.0.0-rc (2026-09-03).** `/v1/goals`, `/v1/export`, `/v1/import` were absent from the v1 OpenAPI while `spec/v1/portability.md` and the goals prose described them (RFC 0174 §E.2 noted the decision belongs to C.1). Decided (Phase 3 plan §11): they do not enter `api/v2/openapi.yaml`; the export/import bundle (`schemas/v2/export-bundle.schema.json`, `bundleVersion` "2") and the goals surface are this extension, advertised under `extensions.<org>.portability`, with `spec/v1/portability.md` as the definition until a v2.x additive RFC lands their operations with a witness. **Not a declared family — notes, outside the `ext/README.md` maturity rule; `Draft` here means unfrozen prose, not an unwitnessed family.**

package/spec/v2/ext/provider-idempotency/README.md

@@ -8,4 +8,4 @@
 | **advertised as** | not a discovery family — a data registry (`registry.json`) the Layer-2 obligation reads |
 | **owning RFC** | RFC 0173 §C.2, RFC 0150 G3 |
 
-> **Status: Draft · v2.0.0-rc (2026-09-03).** `registry.json` records which providers have a natural business-identity key (RFC 0173 §C.2: business-identity keying is the core obligation; the activity recipe is the documented fallback). Rows are measured by the Phase 4 host legs. The witness is `GET /runs/{runId}/effects` (`effect-ledger-projection.schema.json` `keying`).
+> **Status: Draft · v2.0.0-rc (2026-09-03).** `registry.json` records which providers have a natural business-identity key (RFC 0173 §C.2: business-identity keying is the core obligation; the activity recipe is the documented fallback). Rows are measured by the Phase 4 host legs. The witness is `GET /runs/{runId}/effects` (`effect-ledger-projection.schema.json` `keying`). **Not a declared family — notes, outside the `ext/README.md` maturity rule; `Draft` here means unfrozen prose, not an unwitnessed family.**

package/spec/v2/ext/sandbox-runtime-notes/README.md

@@ -8,4 +8,4 @@
 | **advertised as** | not advertisable (notes, not a surface) |
 | **owning RFC** | RFC 0173 §D (RFC 0035 superseded by the `packs` obligation at the cut) |
 
-> **Status: Draft · v2.0.0-rc (2026-09-03).** RFC 0035's `node:vm` demonstrator and its runtime notes are kept here as implementation history. In v2 isolation binds with pack execution (`security-defaults.md`): `sandbox.isolationModel` names `wasm | process | container | vm`; `node:vm` is not a value (RFC 0035 §20, `:130`: escapable by design). A host MAY register and validate packs without executing them. RFC 0035 flips `Superseded` at the RC.
+> **Status: Draft · v2.0.0-rc (2026-09-03).** RFC 0035's `node:vm` demonstrator and its runtime notes are kept here as implementation history. In v2 isolation binds with pack execution (`security-defaults.md`): `sandbox.isolationModel` names `wasm | process | container | vm`; `node:vm` is not a value (RFC 0035 §20, `:130`: escapable by design). A host MAY register and validate packs without executing them. RFC 0035 flips `Superseded` at the RC. **Not a declared family — notes, outside the `ext/README.md` maturity rule; `Draft` here means unfrozen prose, not an unwitnessed family.**

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.3.0",
-  "corpusTag": "v2.3.0",
+  "version": "2.3.2",
+  "corpusTag": "v2.3.2",
   "updated": "2026-09-16"
 }