@openwop/spec-artifacts 2.3.3 → 2.3.4

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.3.3",
-  "corpusTag": "v2.3.3",
+  "version": "2.3.4",
+  "corpusTag": "v2.3.4",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "ac5a7fdff795eeee34d61af878afd61657ade24745dc8e87b970a18148571ed5",
-    "api/v2/asyncapi.yaml": "1bb9761fc9e90b5dd5c05f208b01d597691b52792dd2a488d4382467390d55dd",
-    "api/v2/openapi.yaml": "883ac5a1e6d9056b1acdd79538341d05a005f3f58fb9751237fd6d9ba0167fc9",
+    "api/seams-v2.yaml": "d2afa447343920474ddcbcc4b329fd24d54427e124f0e9bad3f9c39cccdc5682",
+    "api/v2/asyncapi.yaml": "33b035ed9e11825c71d163c2cb48e084e5dcb78810b37a08ca48d828a93c9232",
+    "api/v2/openapi.yaml": "bd8cf3034acdfa39976edc2040450a535c3c183b85f7d93d6d846317336b76b7",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -200,13 +200,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "fee4594ef49953953ffcd0b3813300067d16b3e65ebff2aac722034ac9b3f545",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "2c9150bdde2ae37e788f947110acb2503ff33299f5cf74bc522bcf32f10bd02e",
+    "spec/v1/core-standard-manifest.json": "ba5006cf189501c807996402baeff8227fe63081a1b32ec5af32fe5a09cad2d8",
     "spec/v1/deprecations.json": "508071308e762c281807b487e8f3840a1a69b978071894593e18f2e2d3e4b5c0",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "96ca051cb20f1a669b355d67a89421c56fef28aa5e6710c9519f592f26af33a3",
+    "spec/v1/gaps.json": "cd4875bff43ee5afd210da3b50fbff6e3675b4df481c82f822146f994067230d",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -271,8 +271,8 @@
     "spec/v2/path-manifest.json": "a6f4e652e866889e8bde815874062f62929aee95dc8e58e7152c56adee262163",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "ffb0a24cba6ab87c4b99a76d51868e42eb07bd337157836cf5e59b9e13ad44e0",
+    "spec/v2/release.json": "fe7080a6557b3ee52e7e512c8bf31f77352e7e998e1d1fbb4b388b08532eca6f",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "c2e93ea53a5c87dea90697dc166d540b6fc0f945"
+  "corpusCommit": "1f99dbd8df43666450a5d94902fea8dab987fa37"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.3.3
+  version: 2.3.4
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.3.3
+  version: 2.3.4
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.3.3
+  version: 2.3.4
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.3.3"
+      "version": "2.3.4"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "3a85ec92db2a5a9f8a87e25d42863f34741f5e21f16381a28e86172e642ae4eb"
+  "digest": "40499ac118731a823f51134966a26523c42387f97e0c3b31f0e02fd01d6114f9"
 }

package/spec/v1/gaps.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./gaps.schema.json",
   "version": 1,
-  "updated": "2026-09-04",
+  "updated": "2026-09-17",
   "witnessClasses": [
     "witnessable-unaided",
     "witnessable-gated",
@@ -9370,7 +9370,7 @@
       "surface": "The C.5 header-negotiation rule has no v1 precedent: a v1 client never sends `OpenWOP-Version`, so the rule for an unversioned path with no header (default to `preferredVersion`) is asserted here and witnessed only by the Phase 3 dual-stack scenario.",
       "witness": "witnessable-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9387,7 +9387,7 @@
       "surface": "Eighteen axes were found by grep; the umbrella cannot prove the enumeration is complete. A nineteenth found later is added to the table by the child that meets it, not silently.",
       "witness": "negative-existence",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9404,7 +9404,7 @@
       "surface": "Codemods are pure transforms over persisted artifacts; nothing rewrites an SDK consumer's source. The migration guide carries that; no gate proves the guide is complete.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9421,7 +9421,7 @@
       "surface": "v2 MUST-NOTs cannot enter `SECURITY/invariants.yaml` at Draft (`check-security-invariants.sh` requires a v1 public test), so they live as child falsifiability rows in `gaps.json` until Phase 3. The witness-class gate does not see them until then.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9438,7 +9438,7 @@
       "surface": "The org question for `openwop.dev/spec/v2/`.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9455,7 +9455,7 @@
       "surface": "Whether the bundle attestation is a bare Ed25519 envelope or an in-toto statement.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9472,7 +9472,7 @@
       "surface": "`@openwop/spec-artifacts` does not exist; its publish is tag-triggered like the suite's and needs its own identity check (`check-published-suite-identity.mjs` generalized).",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9489,7 +9489,7 @@
       "surface": "23 interpolated test titles can never derive a stable id; they need explicit ids minted by hand before the lint can be total.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9506,7 +9506,7 @@
       "surface": "55 `unwitnessable` invariants exist; the protocol-tier subset must be given a path, demoted, or fail the gate at the cut. The count is measured, not decided, here.",
       "witness": "unwitnessable",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9608,7 +9608,7 @@
       "surface": "The Subject MUST on the `run.started` echo is unenforceable while `runStarted` is `additionalProperties: true` (63 of 120 payload defs open).",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9625,8 +9625,8 @@
       "surface": "mTLS revocation: CRL, OCSP, or short-lived certificates — which a host advertises is its choice, but no host has any today, and the corpus has no CRL/OCSP text at all.",
       "witness": "seam-gated",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "externally-gated",
+      "target": "non-steward-host",
       "sources": [
         {
           "file": "RFCS/registers/0170-v2-identity.gaps.md",
@@ -9642,7 +9642,7 @@
       "surface": "DPoP availability across the three SDKs is unmeasured (RFC 0154 G2).",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9659,7 +9659,7 @@
       "surface": "Whether `tenantId` itself needs a grammar beyond the opaque form (host-minted vs operator-chosen).",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9676,7 +9676,7 @@
       "surface": "Eight invariants named here enter `SECURITY/invariants.yaml` only with tests (RFC 0167 §C rule); until Phase 3 they exist as falsifiability rows.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9693,7 +9693,7 @@
       "surface": "Whether `keyClass` extends to `oidc` (a stable `sub` is `opaque-idp` by RFC 0163's argument).",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9710,7 +9710,7 @@
       "surface": "The generator folded 21 three-segment types silently; two are recorded exceptions (`envelope.nl-to-format-engaged`, `trigger.subscription-state-changed`) and the rest fold cleanly — re-verified in this PR; the corpus gate over the enum lands in Phase 3.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9727,7 +9727,7 @@
       "surface": "The poll response shape disagreed between `version-negotiation.md:300–308` (five fields, `isTerminal`) and `api/openapi.yaml:427–435` (two fields, `isComplete`) and no register recorded it; hosts implemented the OpenAPI shape.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9744,7 +9744,7 @@
       "surface": "`hostEvents` (heartbeat) needs a declared delivery address; whether a normative transport is required is undecided.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9761,7 +9761,7 @@
       "surface": "The suite's `LEGACY` tolerance for two retired idempotency spellings leaves at the cut; a host still emitting one fails `error-registry`.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9778,7 +9778,7 @@
       "surface": "E1 (partial reassembly) and E2 (multi-turn correlation) get a contract in `spec/v2/core/events.md`; the contract text is not written here.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9795,7 +9795,7 @@
       "surface": "The header-less default to `preferredVersion` has no v1 precedent on the protocol surface (the A2A lane has one); witnessed only by the dual-stack scenario on a host advertising two majors. Carried from RFC 0167 G1.",
       "witness": "witnessable-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9812,7 +9812,7 @@
       "surface": "MAINTAINERS §\"Major bump\" step 6 edits `spec/v1/auth.md`'s status legend at the cut while RFC 0167 says the v1 tree is read-only from the cut.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9829,7 +9829,7 @@
       "surface": "Whether `OpenWOP-Version` on requests accepts `major.minor`.",
       "witness": "claims-check",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9863,8 +9863,8 @@
       "surface": "The effect-seam manifest is a host self-declaration; a seam omitted from it is invisible to the suite (`negative-existence`). The RFC 0140 R5 audit class (outbound clients vs the manifest) is the only check and is not a corpus gate.",
       "witness": "negative-existence",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "externally-gated",
+      "target": "non-steward-host",
       "sources": [
         {
           "file": "RFCS/registers/0173-v2-security-defaults.gaps.md",
@@ -9880,7 +9880,7 @@
       "surface": "`approversList` enforcement on a host with no RBAC surface (`refKinds` group or role).",
       "witness": "witnessable-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9897,7 +9897,7 @@
       "surface": "Compensation and Layer 2 are core obligations *of their surfaces* with declared witnesses; either may still end in `ext/` at the cut if the witness (read projection, fixture provider) does not land.",
       "witness": "seam-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9914,7 +9914,7 @@
       "surface": "`interrupt.approverRouting` has two named advertisers in RFC 0104's header and no INTEROP-MATRIX row; `compensation.supported`'s advertiser status is recorded three ways (extensions.json, two matrix rows).",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -9999,8 +9999,8 @@
       "surface": "The 90-day refresh SLA is the shortest window both upstreams' lifecycle policies exceed; it has not been measured against an actual upstream release cadence.",
       "witness": "unwitnessable",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "transferred",
+      "target": "ROADMAP.md#implementation-ecosystem",
       "sources": [
         {
           "file": "RFCS/registers/0175-v2-transports-and-embedded-protocols.gaps.md",
@@ -10016,7 +10016,7 @@
       "surface": "Authenticated negotiation and the floor are witnessed only through the C.1 seams profile (the wire toward a peer is unobservable from the host's own API); the `negotiation.decided` event is the normative surface.",
       "witness": "seam-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10050,7 +10050,7 @@
       "surface": "Whether `negotiation.decided` carries the peer origin in clear or as a digest.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10067,7 +10067,7 @@
       "surface": "Whether the atomic per-run backfill (stamp `3`, rewrite `type` under the same key, original preserved) is allowed in v2.0 or deferred to a later RFC.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10101,7 +10101,7 @@
       "surface": "The corpus-tag pin was recorded as a done Phase 0 item; the inventory finds 1 of 3 consumers pinned (openwop-app) — openwop-sdks tracks `main`, MyndHyve has no vendored corpus and a caret range, and the registry is unpinned and drifted (RFC 0177 §C.6).",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10152,7 +10152,7 @@
       "surface": "Whether `registry/v2/` carries steward re-signs of `core.openwop.*` / `vendor.openwop*` or only author re-publications.",
       "witness": "unwitnessable",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10169,7 +10169,7 @@
       "surface": "The alias table cannot be generated until `spec/v2/declaration.json` exists (RFC 0169, Phase 3); the seven guaranteed rows are known from the inventory.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -10203,8 +10203,8 @@
       "surface": "The portable `{{params.*}}` deferral (WCP4): expansion materializes `parameters` into workflow `variables[]` and rewrites `{{params.x}}` into a PromptTemplate `{{varName}}` with `source: \"variable\"`, gated behind a capability with replay determinism for the run-scoped bag. Not in v2.0.",
       "witness": "unwitnessable",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "transferred",
+      "target": "ROADMAP.md#implementation-ecosystem",
       "sources": [
         {
           "file": "RFCS/registers/0177-v2-registry-packs-and-extension-tail.gaps.md",
@@ -10220,7 +10220,7 @@
       "surface": "The registry's vendored `node-pack-manifest.schema.json` lacks the RFC 0138 hatch (drifted, unpinned) — the registry rejects the field the protocol requires; 7 of 13 vendored schemas drift from the corpus.",
       "witness": "witnessable-unaided",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.3.3",
-  "corpusTag": "v2.3.3",
+  "version": "2.3.4",
+  "corpusTag": "v2.3.4",
   "updated": "2026-09-16"
 }