@openwop/spec-artifacts 2.31.0 → 2.32.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.31.0",
-  "corpusTag": "v2.31.0",
+  "version": "2.32.0",
+  "corpusTag": "v2.32.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "dfecf104a518efca7b9b915578c4198c6a9e1f8965d8e84fc300bbbafc5503e7",
-    "api/v2/asyncapi.yaml": "577bd2252f10d8c3dceaac0dc7855925cc466e06fd6bf1613b8e451869fcdc54",
-    "api/v2/openapi.yaml": "82b884b23460438059a5b38b47b5f3e883d03365013ed8c2632b664417c0f699",
+    "api/seams-v2.yaml": "a1db4d5558ec828482688ad34db7a749f6f52ef102158d24036819402720a3e9",
+    "api/v2/asyncapi.yaml": "8bfff7d7d9c5ef82196d5b6da1566b36e7070d4996da731c4499fd90b8ee51a7",
+    "api/v2/openapi.yaml": "02338e18f6e0ba029dde8b6dadee126904d2ca97b10a6bdd43c7c1a423ad88d7",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -112,19 +112,19 @@
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
     "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
     "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
-    "schemas/v2/artifact-type-pack-manifest.schema.json": "85630d1b760d0b41cf5a6fad2acfada39abaf7f0befd95cc4334e1e883e9615d",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "f77d8dcc3112afec8b2a8e67e56752d5811deb2c2455b0d6d4c6489eb4c4a829",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
     "schemas/v2/capabilities.schema.json": "e62d44f23c21c8f64b273fcdb083636e801c0de976cbd1f93333f99928dd1025",
     "schemas/v2/certification-bundle.schema.json": "ab9204e37f9e0bba79857275cd38be2da98e54d26b4ecb97469829efe6ebea28",
     "schemas/v2/channel-presence-payload.schema.json": "1c20ad810cb311d47aa0b95d928490826b2468fd161f884cd29e867053e6782f",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
-    "schemas/v2/chat-card-pack-manifest.schema.json": "8df0d9d273ae22efc6876d5586833f1d4c2e551edc3ac6cf6e8f0719329f03dd",
+    "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
     "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
-    "schemas/v2/connection-pack-manifest.schema.json": "7410a3011b28829b286e3ff764bdb283854dca69ea4b71a8441f8c1c4f1cc948",
+    "schemas/v2/connection-pack-manifest.schema.json": "4300e815cf376959f8250ed25ba0545ae8bd525e449c6442326934f451070cc9",
     "schemas/v2/conversation-event.schema.json": "e87b7fb36ab4ca0afe9f77993654065b28b67e5f24b20175907f90e238942025",
     "schemas/v2/conversation-turn.schema.json": "a15b43dc15dbcc6aaf216bfab7424c540b514d7e40e661a732384aad45387006",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
@@ -144,7 +144,7 @@
     "schemas/v2/error-envelope.schema.json": "bb3e6c487dafa951a56ff224a7c029c462f0f1b754a7f51f6729609b4f43a438",
     "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
-    "schemas/v2/form-content-pack-manifest.schema.json": "461529e4287ec3b15a9fbcde57226a1c6f17ea3ae71b33b418e6f595ff0619fe",
+    "schemas/v2/form-content-pack-manifest.schema.json": "8ec157cf51241d4df800398e811d2c35addd076b929c58be3ce3dcd671c67641",
     "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
     "schemas/v2/goal.schema.json": "146c4182e36d3538778f947e668a92cdb69ec42ee0820104b00063b035e342d7",
     "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
@@ -156,12 +156,12 @@
     "schemas/v2/localized-content-section.schema.json": "29c7bad0ad9ebc6c45211282e8afb3fdb35a4ca075ce0404b6e2c29f35fa5313",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "0da826ca63a29026f7a9551748048104910e0d9962db6bad2b50b97a24a9ea30",
+    "schemas/v2/node-pack-manifest.schema.json": "47d122f7d4711eaa13464c5487c26ed36103b7c85adf1987004bf2d6842d663b",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
-    "schemas/v2/prompt-pack-manifest.schema.json": "8e77d23840250640d26f2f99c1c5902e79bf4a6974cae2d6c6637176236bddb9",
+    "schemas/v2/prompt-pack-manifest.schema.json": "4b1e510341cc6ba167b007ecae38ce0d71d5b89c751671777c5457da926e9744",
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "cb5ea4fcb54be94fd2a92cf2799357dc73335181a89f5766f432d69e21cc3a80",
@@ -189,7 +189,7 @@
     "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
     "schemas/v2/webhook-delivery.schema.json": "4e8ab3b722ad1731adf0548c1217f0de62da40de14e8abf77533aee4ace4c079",
-    "schemas/v2/workflow-chain-pack-manifest.schema.json": "b61cc945b4df1c7093a1058fa71ee59ef10bacb3433ae4d7ae7536136e616cc2",
+    "schemas/v2/workflow-chain-pack-manifest.schema.json": "58fa5b67c6e3a320f77aa1eb5d5fa7c6c9b3356afe8b75ad74a7cf082496e04b",
     "schemas/v2/workflow-definition.schema.json": "9aafddec32b84eb6aec3185be024850f1b9444c6193568771b0b636595fef136",
     "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
     "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "40069d5976eeb6ba1384a648e57e5cfd673db3fce36175115fb8293bee9664d4",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c8cc668bd5c1e504e8b0171e3c078f770f9d9e5765938750f600defb2fcb986f",
+    "spec/v1/core-standard-manifest.json": "01ed93af96a8ca6c562b8fa25658ff2e33a793970133c50838d50ac5e362819e",
     "spec/v1/deprecations.json": "307083ce29c23fd406015951f99a30d78d6187ff061d38dc9732f62191b40f3f",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -228,7 +228,7 @@
     "spec/v2/core/interop.md": "6bd581556b9ab1a1509c01b9a1ec2bcb9e4a8300e68fb01570704417e70f20b9",
     "spec/v2/core/interrupt.md": "3a926d84b942d4ee7daccc4443c93dc29f6a69f2936ba813182f2c1336db2cbb",
     "spec/v2/core/overview.md": "7dc00ace32d4e4ce929a383651f0029fc4b7091ec87487b1bf26ead1be209e0e",
-    "spec/v2/core/packs.md": "cc06de2d49dd08410eececd5c279996ec839680553b332b4f33d6b31989b5757",
+    "spec/v2/core/packs.md": "1c0919059760f9a3940a93264a76b7e30f9a0f6f27ff19753cc88f15753d8088",
     "spec/v2/core/persistence.md": "9e241f84259e38848f4a2ad1c21debb0dffd5f8aafbad26408aa6cc8969bf93b",
     "spec/v2/core/replay.md": "b980a66e2543107240e3dc4f58131b9f4ff52478737e79ade6d5777b26ad1119",
     "spec/v2/core/runs.md": "136319842bacbbb300178980e4b83444917d5b193cc5fdd92e39a4902ba8d3c0",
@@ -274,13 +274,13 @@
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
     "spec/v2/facets/webhooks.schema.json": "4bf3f8eb3161a43910efac4c44ccaf9567060c9da52d4cf09bcf3888d1b92192",
-    "spec/v2/facets/workflowChainPacks.schema.json": "cd30907ac92396866a524e4db8d8c1537e3818cfff455d780efd72bcd0ebdac1",
+    "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/id-field-bindings.json": "e73c06f3055ad30173507ac817a458b96362c8f26209ba105c53653292cf63d3",
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "92131d62a7fcd12445d7e04eb588e2297f839b7e5e2a87f89ae9e61593f837cd",
+    "spec/v2/release.json": "df06e652e6f851338df9b4e0f230bb176511e62691e867f7228d05c4263b1bec",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "cb0aa58bb79366383a13b4b2843f47662888a189"
+  "corpusCommit": "7091dae28be398d49c446f779b4c91755a80a5ff"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.31.0
+  version: 2.32.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.31.0
+  version: 2.32.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.31.0
+  version: 2.32.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.31.0",
+  "version": "2.32.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/artifact-type-pack-manifest.schema.json

@@ -218,32 +218,26 @@
     },
     "Signing": {
       "type": "object",
-      "description": "Optional signing metadata. See node-packs.md \u00a7signing.",
       "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string",
-          "description": "Path inside the tarball to the Ed25519 public key (PEM-encoded)."
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "signatureRef": {
-          "type": "string",
-          "description": "Path to the detached signature over `pack.json`."
-        },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ],
-          "description": "Signing method. `manual` uses publicKeyRef + signatureRef; `sigstore` uses a Sigstore bundle at `pack.json.sigstore`."
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
-      }
+      },
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` \u00a7\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque \u2014 a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` \u00a7\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/chat-card-pack-manifest.schema.json

@@ -230,29 +230,26 @@
     },
     "Signing": {
       "type": "object",
-      "description": "Optional signing metadata. See node-packs.md \u00a7signing.",
       "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string"
-        },
-        "signatureRef": {
-          "type": "string"
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ]
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
-      }
+      },
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` \u00a7\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque \u2014 a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` \u00a7\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/connection-pack-manifest.schema.json

@@ -315,6 +315,24 @@
           "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
         }
       }
+    },
+    "signing": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
+      "properties": {
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
+        },
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+        }
+      },
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "$defs": {
@@ -349,6 +367,5 @@
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/form-content-pack-manifest.schema.json

@@ -244,29 +244,26 @@
     },
     "Signing": {
       "type": "object",
-      "description": "Optional signing metadata. See node-packs.md §signing.",
       "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string"
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "signatureRef": {
-          "type": "string"
-        },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ]
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
-      }
+      },
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/node-pack-manifest.schema.json

@@ -632,26 +632,21 @@
     },
     "Signing": {
       "type": "object",
-      "description": "Optional signing metadata. See node-packs.md \u00a7signing.",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string",
-          "description": "Path inside the tarball to the Ed25519 public key (PEM-encoded)."
-        },
-        "signatureRef": {
-          "type": "string",
-          "description": "Path to the detached signature over `pack.json`."
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ],
-          "description": "Signing method. `manual` uses publicKeyRef + signatureRef; `sigstore` uses a Sigstore bundle at `pack.json.sigstore`."
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
       },
-      "additionalProperties": false
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {

package/schemas/v2/prompt-pack-manifest.schema.json

@@ -89,30 +89,25 @@
     "signing": {
       "type": "object",
       "additionalProperties": false,
-      "description": "Optional signing metadata. Reuses the Ed25519 + SRI flow from `node-packs.md §Signing` unchanged. Hosts installing this pack MUST verify the signature before accepting any of `prompts[]` per `registry-operations.md §\"Signature verification\"`.",
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string",
-          "description": "Path inside the tarball to the Ed25519 public key (PEM-encoded)."
-        },
-        "signatureRef": {
-          "type": "string",
-          "description": "Path to the detached signature over `pack.json`."
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ]
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
-      }
+      },
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/workflow-chain-pack-manifest.schema.json

@@ -424,7 +424,7 @@
         "config": {
           "type": "object",
           "description": "Node config — host-validated against the referenced typeId's config schema. String fields MAY contain `{{params.<name>}}` placeholders that the host MUST substitute at expansion time. RFC 0133: a `core.subWorkflow` / `core.dispatch` (child-run) node MAY carry `subChainRef: string` — a declared `subChains[].ref` (sibling `chainId` or external ref) the host rewrites to the minted child `workflowId` at co-expansion time (§1.3 step 3). A concrete `config.workflowId` inside a fragment remains INVALID — a chain MUST NOT pin a host-specific workflow id (the `not` guard below enforces it).",
-          "additionalProperties": false,
+          "additionalProperties": true,
           "not": {
             "required": [
               "workflowId"
@@ -577,31 +577,26 @@
     },
     "Signing": {
       "type": "object",
-      "description": "Optional signing metadata. Reuses node-packs.md §signing unchanged.",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "scheme"
+      ],
       "properties": {
-        "publicKeyRef": {
-          "type": "string",
-          "description": "Path inside the tarball to the Ed25519 public key (PEM-encoded)."
+        "keyId": {
+          "$ref": "ids.schema.json#/$defs/keyId"
         },
-        "signatureRef": {
-          "type": "string",
-          "description": "Path to the detached signature over `pack.json`."
-        },
-        "method": {
-          "type": "string",
-          "enum": [
-            "manual",
-            "sigstore"
-          ]
+        "scheme": {
+          "const": "ed25519-canonical-json",
+          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
         }
       },
-      "additionalProperties": false
+      "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."
     }
   },
   "patternProperties": {
     "^(openwop-|x-|vendor\\.)": {
       "description": "Vendor / host extension escape hatch (RFC 0138). A property matching `^(x-|vendor\\.)` is a HOST EXTENSION: its semantics are unspecified by this protocol, and a consumer that does not recognize one MUST ignore it rather than reject the pack. Resolves the contradiction in `host-extensions.md` §\"Vendor-prefixed namespaces\", which requires a client receiving an unknown vendor-prefixed field to treat it as opaque — a field that `additionalProperties: false` previously made impossible to carry. SECURITY: an extension value is PACK-AUTHORED, therefore untrusted; \"ignore\" means ignore. See `node-packs.md` §\"Vendor extensions on pack manifests\" and the `pack-manifest-extension-opaque` invariant."
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.31.0"
+      "version": "2.32.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "5755648de17bbe3bf0f696a370d0cb14370c78b8ab258f24a581246ce0e40d70"
+  "digest": "d8daed491110e4a1d83ccd5b12c4f81dc59edd9deffcf79122c4f2cab033bfd0"
 }

package/spec/v2/core/packs.md

@@ -70,6 +70,8 @@ There is one signing scheme. `signing` on a version manifest (`schemas/v2/regist
 | `keyId` | the signing key id; `publicKeyRef` does not exist |
 | `method` | does not exist; a manifest carrying it fails validation |
 
+The same block applies to a **bare manifest** — the `pack.json` inside the tarball, which is the document the signature covers. `signing` is OPTIONAL there, because an authoring-time `pack.json` exists before it is signed; when present it MUST be the identical closed `{ keyId, scheme }` object, and the v1 `{ publicKeyRef, signatureRef, method }` block fails validation on every bare manifest kind (migration row `openwop.migration.C10.1`).
+
 A verifier MUST verify the signature against the issuing registry's key for `keyId` and MUST check the pack name against that key's `permittedNamespaces`. A signature over tarball bytes is not a v2 signature; such a pack MUST be re-signed, not relabeled.
 
 ## Version manifests

package/spec/v2/facets/workflowChainPacks.schema.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "RFC 0013 §Composition depth — the v2 facet set for workflowChainPacks. Two v1-seeded facets are NOT carried into v2: `deferredParameters` (RFC 0124, still `Active`; spec/v2/core/workflow-chain-packs.md §Parameter substitution states the portable per-run deferral \"is a named v2.x additive RFC and is not part of v2.0\", so binding it as an advertisable v2 facet let a host truthfully advertise a capability v2.0 does not define) and `hostExpansionSeam` (a self-described conformance-only test seam on POST /v1/host/sample/workflow-chain:expand — spec/v2/core/conformance.md §The seams profile forbids a test-seam capability flag: seams are the profile openwop-conformance-seams-v2 in the /conformance/seams/ path space, and the v1 path is removeIn 2.0 per spec/v1/deprecations.json). No v2 host bundle advertises either.",
+  "$comment": "RFC 0013 §Composition depth — the v2 facet set for workflowChainPacks. Two v1-seeded facets are NOT carried into v2: `deferredParameters` (RFC 0124 — `Accepted` at v1; spec/v2/core/workflow-chain-packs.md §Parameter substitution states the portable per-run deferral \"is a named v2.x additive RFC and is not part of v2.0\", so binding it as an advertisable v2 facet let a host truthfully advertise a capability v2.0 does not define) and `hostExpansionSeam` (a self-described conformance-only test seam on POST /v1/host/sample/workflow-chain:expand — spec/v2/core/conformance.md §The seams profile forbids a test-seam capability flag: seams are the profile openwop-conformance-seams-v2 in the /conformance/seams/ path space, and the v1 path is removeIn 2.0 per spec/v1/deprecations.json). A v2 document that carries either fails `capabilities-root-closed`.",
   "properties": {
     "subChains": {
       "type": "object",

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.31.0",
-  "corpusTag": "v2.31.0",
-  "updated": "2026-09-18"
+  "version": "2.32.0",
+  "corpusTag": "v2.32.0",
+  "updated": "2026-09-20"
 }