@openwop/spec-artifacts 2.35.1 → 2.36.1

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 101 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 106 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -33,6 +33,7 @@
             "pack_peer_dependency_undefined",
             "pack_signature_invalid",
             "pack_validation_failed",
+            "unsupported_runtime",
             "protocol_version_mismatch",
             "schedule_horizon_exceeded",
             "sub_chain_cycle",
@@ -41,9 +42,13 @@
             "until_in_past",
             "validation_error",
             "webhook_url_rejected",
+            "webhook_endpoint_unverified",
+            "connector_auth_declined",
+            "connection_auth_metadata_mismatch",
             "audience_mismatch",
             "connector_auth_expired",
             "credential_revoked",
+            "credential_lifetime_exceeded",
             "delegation_expired",
             "identity_unresolvable",
             "identity_unverified",
@@ -224,6 +229,7 @@
     "pack_peer_dependency_undefined": 400,
     "pack_signature_invalid": 400,
     "pack_validation_failed": 400,
+    "unsupported_runtime": 400,
     "protocol_version_mismatch": 400,
     "schedule_horizon_exceeded": 400,
     "sub_chain_cycle": 400,
@@ -232,9 +238,13 @@
     "until_in_past": 400,
     "validation_error": 400,
     "webhook_url_rejected": 400,
+    "webhook_endpoint_unverified": 400,
+    "connector_auth_declined": 401,
+    "connection_auth_metadata_mismatch": 422,
     "audience_mismatch": 401,
     "connector_auth_expired": 401,
     "credential_revoked": 401,
+    "credential_lifetime_exceeded": 401,
     "delegation_expired": 401,
     "identity_unresolvable": 401,
     "identity_unverified": 401,

package/schemas/v2/eval-summary.schema.json

@@ -168,6 +168,5 @@
         }
       }
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/schemas/v2/goal.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/goal.schema.json",
   "title": "Goal",
-  "description": "RFC 0097 \u00a7B. A standing goal \u2014 a durable objective with explicit completion criteria, evaluated by a host-side judge (RFC 0090 verifier verdict or an opaque host evaluator), that keeps an agent working across turns and runs until the judge is satisfied, a declared RFC 0058 bound is crossed, or the agent escalates (RFC 0044). Completion MUST be the judge's verdict \u2014 a client MUST NOT set `state: satisfied` directly. Continuation MUST be bounded. `objective` and any verdict payload are SR-1 redaction-safe. Gated on the `agents.goals` capability.",
+  "description": "RFC 0097 §B. A standing goal — a durable objective with explicit completion criteria, evaluated by a host-side judge (RFC 0090 verifier verdict or an opaque host evaluator), that keeps an agent working across turns and runs until the judge is satisfied, a declared RFC 0058 bound is crossed, or the agent escalates (RFC 0044). Completion MUST be the judge's verdict — a client MUST NOT set `state: satisfied` directly. Continuation MUST be bounded. `objective` and any verdict payload are SR-1 redaction-safe. Gated on the `agents.goals` capability.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -23,7 +23,7 @@
     },
     "objective": {
       "type": "string",
-      "description": "The standing objective. SR-1 redaction-safe \u2014 no secrets/PII."
+      "description": "The standing objective. SR-1 redaction-safe — no secrets/PII."
     },
     "state": {
       "type": "string",
@@ -67,7 +67,7 @@
           ],
           "default": null,
           "additionalProperties": false,
-          "description": "Most recent judge verdict. Content-free re: objective text. Non-deterministic judge output \u2014 MUST be persisted (carried in the `goal.evaluated` event / checkpoint) and never recomputed on replay/fork.",
+          "description": "Most recent judge verdict. Content-free re: objective text. Non-deterministic judge output — MUST be persisted (carried in the `goal.evaluated` event / checkpoint) and never recomputed on replay/fork.",
           "properties": {
             "satisfied": {
               "type": "boolean"
@@ -159,7 +159,7 @@
       "required": [
         "tenant"
       ],
-      "description": "RFC 0048 identity triple. Redaction-safe \u2014 `principal` is an opaque id, never PII or credential material.",
+      "description": "RFC 0048 identity triple. Redaction-safe — `principal` is an opaque id, never PII or credential material.",
       "properties": {
         "tenant": {
           "type": "string",

package/schemas/v2/localized-content-language-settings.schema.json

@@ -13,15 +13,15 @@
   "properties": {
     "baseLocale": {
       "type": "string",
-      "pattern": "^[a-z]{2}(-[A-Z]{2})?$",
+      "pattern": "^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$",
       "description": "The locale section `data` is authored in. MUST equal `capabilities.i18n.defaultLocale`."
     },
     "supportedLocales": {
       "type": "array",
-      "description": "BCP-47 tags the tenant authors content translations for. MUST NOT contain `baseLocale`.",
+      "description": "Case-canonical BCP 47 tags (RFC 0206 §A) the tenant authors content translations for. MUST NOT contain `baseLocale`.",
       "items": {
         "type": "string",
-        "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
+        "pattern": "^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$"
       },
       "uniqueItems": true
     },

package/schemas/v2/localized-content-page.schema.json

@@ -62,7 +62,7 @@
             "properties": {
               "locale": {
                 "type": "string",
-                "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
+                "pattern": "^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$"
               },
               "href": {
                 "type": "string",
@@ -76,7 +76,7 @@
           "description": "og:locale:alternate values.",
           "items": {
             "type": "string",
-            "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
+            "pattern": "^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$"
           },
           "uniqueItems": true
         }

package/schemas/v2/localized-content-section.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/localized-content-section.schema.json",
   "title": "LocalizedContentSection",
-  "description": "RFC 0103 (spec/v1/localized-content.md §B). One section record of an authored content page. A section is ONE record carrying a base `data` payload (authored in the host's `content.baseLocale`) plus a sparse `localizations` map of partial per-locale field overrides — never one record per locale. The negotiated locale's resolved body is computed by the normative per-section field merge (exact-locale → language-family → base `data`, shallow overlay; §C). Body field shapes inside `data`/`localizations` are open and host/section-type-defined; this schema closes the envelope, not the body.",
+  "description": "RFC 0103 (spec/v1/localized-content.md §B). One section record of an authored content page. A section is ONE record carrying a base `data` payload (authored in the host's `content.baseLocale`) plus a sparse `localizations` map of partial per-locale field overrides — never one record per locale. The negotiated locale's resolved body is computed by the normative per-section field merge (exact-locale → script-family (RFC 0206) → language-family → base `data`, shallow overlay; §C). Body field shapes inside `data`/`localizations` are open and host/section-type-defined; this schema closes the envelope, not the body.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -32,9 +32,9 @@
     },
     "localizations": {
       "type": "object",
-      "description": "Sparse map of per-locale partial field overrides. MAY be empty (`{}`). Each key is a BCP-47 tag matching `^[a-z]{2}(-[A-Z]{2})?$` and MUST NOT equal `content.baseLocale` (the base locale is carried by `data`). Each value is a partial overlay of `data` fields; missing fields fall through to `data` (per-section merge §C).",
+      "description": "Sparse map of per-locale partial field overrides. MAY be empty (`{}`). Each key is a case-canonical BCP 47 tag (language, optional script, optional region; RFC 0206 §A) matching `^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$` and MUST NOT equal `content.baseLocale` (the base locale is carried by `data`). Each value is a partial overlay of `data` fields; missing fields fall through to `data` (per-section merge §C).",
       "propertyNames": {
-        "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
+        "pattern": "^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$"
       },
       "additionalProperties": {
         "type": "object",

package/schemas/v2/node-pack-manifest.schema.json

@@ -626,10 +626,115 @@
               }
             ]
           }
+        },
+        "mcpServer": {
+          "$ref": "#/$defs/McpServerRecord",
+          "description": "RFC 0203. Inline subset of the MCP Registry server.json (2025-12-11) naming the MCP server a `remote` pack runs on. By value: the host resolves nothing from a registry. `entry` MUST equal `remotes[0].url` (node-pack-runtimes.md)."
+        }
+      },
+      "if": {
+        "properties": {
+          "language": {
+            "const": "remote"
+          }
+        }
+      },
+      "else": {
+        "not": {
+          "required": [
+            "mcpServer"
+          ]
         }
       },
       "additionalProperties": false
     },
+    "McpServerRecord": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name",
+        "description",
+        "version",
+        "remotes"
+      ],
+      "description": "RFC 0203. Every valid instance validates against https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json. Excludes packages[] (install instructions), icons, _meta, and every header or variable slot, so a signed manifest carries no install surface and no credential.",
+      "properties": {
+        "$schema": {
+          "const": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 3,
+          "maxLength": 200,
+          "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$"
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100
+        },
+        "version": {
+          "type": "string",
+          "maxLength": 255,
+          "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?$"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100
+        },
+        "websiteUrl": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://"
+        },
+        "repository": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url",
+            "source"
+          ],
+          "properties": {
+            "url": {
+              "type": "string",
+              "format": "uri"
+            },
+            "source": {
+              "type": "string"
+            },
+            "id": {
+              "type": "string"
+            },
+            "subfolder": {
+              "type": "string"
+            }
+          }
+        },
+        "remotes": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "type",
+              "url"
+            ],
+            "properties": {
+              "type": {
+                "const": "streamable-http"
+              },
+              "url": {
+                "type": "string",
+                "pattern": "^https://[^\\s{}]+$"
+              }
+            }
+          }
+        }
+      }
+    },
     "Signing": {
       "type": "object",
       "additionalProperties": false,

package/schemas/v2/part.schema.json

@@ -0,0 +1,81 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/part.schema.json",
+  "title": "Part",
+  "description": "RFC 0205 §D. An A2A v1.0.1 `Part`, transcribed from `specification/a2a.proto` `message Part` at tag v1.0.1 with the JSON member names A2A spec §5.5 requires (camelCase). Exactly one of `text`, `raw`, `url`, `data` is present: member presence is the discriminator (A2A spec §14 \"Current Pattern (v1.0)\"), and the v0.3 `kind` member is not part of the shape. A2A commits no JSON Schema of its own (`specification/json/README.md`: `a2a.json` is a non-normative build artifact), so this file is the corpus's transcription. `oneOf` is deliberate: this schema describes a host-emitted wire object, not an LLM-emitted envelope payload (ai-envelope.md §\"Schema discipline\" scopes its `oneOf` ban to the latter).",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "text": {
+      "type": "string",
+      "description": "a2a.proto: \"The string content of the `text` part.\""
+    },
+    "raw": {
+      "type": "string",
+      "contentEncoding": "base64",
+      "description": "a2a.proto: \"The `raw` byte content of a file. In JSON serialization, this is encoded as a base64 string.\" Bounded by host policy (a2a-integration.md D.3)."
+    },
+    "url": {
+      "type": "string",
+      "format": "uri",
+      "description": "a2a.proto: \"A `url` pointing to the file's content.\" On an OpenWOP read it MUST NOT resolve beyond the caller's authorization (RFC 0205 §A.3; a2a-integration.md D.3); a consumer MUST NOT auto-fetch it without an egress decision (a2a-integration.md D.3 inbound)."
+    },
+    "data": {
+      "description": "a2a.proto: \"Arbitrary structured `data` as a JSON value (object, array, string, number, boolean, or null).\""
+    },
+    "metadata": {
+      "type": "object",
+      "description": "a2a.proto: \"Optional. metadata associated with this part.\" OpenWOP fields live under `metadata.openwop.*` (a2a-integration.md).",
+      "additionalProperties": {}
+    },
+    "filename": {
+      "type": "string",
+      "maxLength": 1024,
+      "description": "a2a.proto: \"An optional `filename` for the file (e.g., \\\"document.pdf\\\").\""
+    },
+    "mediaType": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 255,
+      "description": "a2a.proto: \"The `media_type` (MIME type) of the part content … available for all part types.\" Any RFC 6838 spelling is accepted on input; a host SHOULD emit lowercase."
+    }
+  },
+  "oneOf": [
+    {
+      "required": [
+        "text"
+      ]
+    },
+    {
+      "required": [
+        "raw"
+      ]
+    },
+    {
+      "required": [
+        "url"
+      ]
+    },
+    {
+      "required": [
+        "data"
+      ]
+    }
+  ],
+  "examples": [
+    {
+      "text": "Hello, world!"
+    },
+    {
+      "raw": "iVBORw0KGgo=",
+      "filename": "diagram.png",
+      "mediaType": "image/png"
+    },
+    {
+      "data": {
+        "approve": true
+      },
+      "mediaType": "application/json"
+    }
+  ]
+}

package/schemas/v2/proposal.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/proposal.schema.json",
   "title": "Proposal",
-  "description": "RFC 0096 \u00a7B. A reviewable-learning proposal \u2014 an INERT, draft-state reusable artifact (skill/pack/template/automation) the host synthesized from run/tool traces, that MUST NOT influence the resolution, planning, or execution of any run while in any state other than `applied`. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC (no new authorization path). On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). `rationale` and `provenance.sourceRunIds` are SR-1 redaction-safe (no secrets/PII). Gated on the `agents.proposals` capability.",
+  "description": "RFC 0096 §B. A reviewable-learning proposal — an INERT, draft-state reusable artifact (skill/pack/template/automation) the host synthesized from run/tool traces, that MUST NOT influence the resolution, planning, or execution of any run while in any state other than `applied`. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC (no new authorization path). On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). `rationale` and `provenance.sourceRunIds` are SR-1 redaction-safe (no secrets/PII). Gated on the `agents.proposals` capability.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -47,12 +47,12 @@
     },
     "rationale": {
       "type": "string",
-      "description": "Plain-language justification. SR-1 redaction-safe \u2014 no secrets/PII."
+      "description": "Plain-language justification. SR-1 redaction-safe — no secrets/PII."
     },
     "artifact": {
       "type": "object",
-      "description": "The proposed artifact, shaped by `kind` (an RFC 0003 pack manifest, an RFC 0013 chain pack, an RFC 0027 template, an RFC 0052 job spec). Inert until applied. Deliberately open (`additionalProperties` not constrained here) because the payload conforms to the kind's own existing schema, validated by the host at `apply` (malformed-for-kind \u21d2 422).",
-      "$comment": "Intentionally open object \u2014 the artifact body is validated against the kind's own schema, not this envelope.",
+      "description": "The proposed artifact, shaped by `kind` (an RFC 0003 pack manifest, an RFC 0013 chain pack, an RFC 0027 template, an RFC 0052 job spec). Inert until applied. Deliberately open (`additionalProperties` not constrained here) because the payload conforms to the kind's own existing schema, validated by the host at `apply` (malformed-for-kind ⇒ 422).",
+      "$comment": "Intentionally open object — the artifact body is validated against the kind's own schema, not this envelope.",
       "additionalProperties": true
     },
     "provenance": {
@@ -90,7 +90,7 @@
       "required": [
         "tenant"
       ],
-      "description": "RFC 0048 identity triple that owns this proposal. Redaction-safe \u2014 `principal` is an opaque id, never PII or credential material. Single-tenant hosts populate at least `tenant`.",
+      "description": "RFC 0048 identity triple that owns this proposal. Redaction-safe — `principal` is an opaque id, never PII or credential material. Single-tenant hosts populate at least `tenant`.",
       "properties": {
         "tenant": {
           "type": "string",
@@ -105,7 +105,7 @@
         "principal": {
           "type": "string",
           "minLength": 1,
-          "description": "Acting identity (user or agent) \u2014 opaque id, never PII."
+          "description": "Acting identity (user or agent) — opaque id, never PII."
         }
       }
     },

package/schemas/v2/run-event-payloads.schema.json

@@ -1081,7 +1081,7 @@
       "properties": {
         "reason": {
           "type": "string",
-          "description": "`v1_pin_unsupported` (RFC 0176 \u00a7B.1) is a registered reason."
+          "description": "Registered reasons: `v1_pin_unsupported` (RFC 0176 \u00a7B.1); `mcp-request-cancelled` (RFC 0198 \u2014 the MCP request that owned the run was cancelled or disconnected before the host answered it)."
         },
         "cancelledBy": {
           "type": "string",
@@ -1279,7 +1279,8 @@
             "conversation.start",
             "conversation.exchange",
             "conversation.close",
-            "low-confidence"
+            "low-confidence",
+            "credential"
           ],
           "description": "RFC 0094 \u00a7E \u2014 the full kind union `interrupt.md` defines (mirrors suspend-request.schema.json). Conversation kinds are gated on the conversation capability per capabilities.md."
         },
@@ -1421,7 +1422,8 @@
             "conversation.start",
             "conversation.exchange",
             "conversation.close",
-            "low-confidence"
+            "low-confidence",
+            "credential"
           ],
           "description": "RFC 0094 \u00a7E \u2014 the full kind union `interrupt.md` defines (mirrors suspend-request.schema.json). Conversation kinds are gated on the conversation capability per capabilities.md."
         },

package/schemas/v2/self-hosted-runner-dispatch-frame.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/self-hosted-runner-dispatch-frame.schema.json",
   "title": "SelfHostedRunnerDispatchFrame",
-  "description": "RFC 0122 \u00a7Registration + channel. A single model/tool DISPATCH STEP the host routes to a registered runner over the runner\u2194host channel (`self-hosted-runner.md`). The host is the sole orchestration/persistence/replay authority; this frame carries ONE step's inputs, never a whole run. `inputs` is opaque model/tool input (messages, tool arguments) and MUST NOT contain runner-credential material \u2014 the runner holds its own credential locally (SECURITY invariant `runner-credential-non-transit`). `seq` is the per-runner monotonic DISPATCH cursor, a DISTINCT sequence from the run event-log `sequence` (they MUST NOT be conflated); a reconnecting runner resumes via `Last-Event-ID` at this cursor and the host drops any redelivered `{runId, stepId}` whose result is already persisted (at-most-once).",
+  "description": "RFC 0122 §Registration + channel. A single model/tool DISPATCH STEP the host routes to a registered runner over the runner↔host channel (`self-hosted-runner.md`). The host is the sole orchestration/persistence/replay authority; this frame carries ONE step's inputs, never a whole run. `inputs` is opaque model/tool input (messages, tool arguments) and MUST NOT contain runner-credential material — the runner holds its own credential locally (SECURITY invariant `runner-credential-non-transit`). `seq` is the per-runner monotonic DISPATCH cursor, a DISTINCT sequence from the run event-log `sequence` (they MUST NOT be conflated); a reconnecting runner resumes via `Last-Event-ID` at this cursor and the host drops any redelivered `{runId, stepId}` whose result is already persisted (at-most-once).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -25,7 +25,7 @@
     "seq": {
       "type": "integer",
       "minimum": 0,
-      "description": "The per-runner monotonic dispatch cursor for the channel. DISTINCT from the run event-log `sequence` (MUST NOT be conflated \u2014 conflating them breaks resume dedup). A reconnecting runner resumes via the SSE `Last-Event-ID` at this cursor so a dispatch is never redelivered past it (`stream-modes.md \u00a7Resumption`)."
+      "description": "The per-runner monotonic dispatch cursor for the channel. DISTINCT from the run event-log `sequence` (MUST NOT be conflated — conflating them breaks resume dedup). A reconnecting runner resumes via the SSE `Last-Event-ID` at this cursor so a dispatch is never redelivered past it (`stream-modes.md §Resumption`)."
     },
     "kind": {
       "type": "string",

package/schemas/v2/self-hosted-runner-result-frame.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/self-hosted-runner-result-frame.schema.json",
   "title": "SelfHostedRunnerResultFrame",
-  "description": "RFC 0122 \u00a7Registration + channel. The runner's answer to one `SelfHostedRunnerDispatchFrame`, POSTed back to the host over ordinary HTTP. The `{runId, stepId}` pair MUST equal the dispatch it answers (the at-most-once idempotency key); `seq` echoes the dispatch cursor. `output` is the opaque model/tool output the host persists as a normal step record \u2014 replay reads from persistence and NEVER re-dispatches. `output` MUST NOT contain runner-credential material (`runner-credential-non-transit`), and the host MUST treat it as UNTRUSTED transport: content re-entering an agent loop is fenced `<UNTRUSTED>` (`runner-output-untrusted-transport`). A provider-side error is carried inside `output` (it is still a model/tool output); host-side liveness failure is signalled out-of-band as the retriable `runner_unavailable` error, NOT as a result frame.",
+  "description": "RFC 0122 §Registration + channel. The runner's answer to one `SelfHostedRunnerDispatchFrame`, POSTed back to the host over ordinary HTTP. The `{runId, stepId}` pair MUST equal the dispatch it answers (the at-most-once idempotency key); `seq` echoes the dispatch cursor. `output` is the opaque model/tool output the host persists as a normal step record — replay reads from persistence and NEVER re-dispatches. `output` MUST NOT contain runner-credential material (`runner-credential-non-transit`), and the host MUST treat it as UNTRUSTED transport: content re-entering an agent loop is fenced `<UNTRUSTED>` (`runner-output-untrusted-transport`). A provider-side error is carried inside `output` (it is still a model/tool output); host-side liveness failure is signalled out-of-band as the retriable `runner_unavailable` error, NOT as a result frame.",
   "type": "object",
   "additionalProperties": false,
   "required": [