@openwop/spec-artifacts 2.36.1 → 2.37.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.36.1",
-  "corpusTag": "v2.36.0",
+  "version": "2.37.0",
+  "corpusTag": "v2.37.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
-    "api/openapi.yaml": "d19c3d4af7fd0e2305dd5fee3d5b984c6d0e9b1824d72d8dffc714a92b248269",
+    "api/openapi.yaml": "df108919a368e0a593f8f3dc8e2150a07d394e8971e1f91a3d6301e2e19cb132",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "591e917af3c0e79fbe831690b35383bcc6976dd2e0ef0660c5e3bce5541dc9c2",
-    "api/v2/asyncapi.yaml": "813a73c8c1e25c55cb60d92aecf2fc1361ab84894c4e15a378c49d11dd0f1984",
-    "api/v2/openapi.yaml": "e5156f2a6d241cec8bb4f5dd872400b4bc021dff61e572ab4b11c52105d18f22",
+    "api/seams-v2.yaml": "e60b9ff834b83ebe710a6960a964296186c529b67453c11c263a78dc83e76fe3",
+    "api/v2/asyncapi.yaml": "3f584bb004c0273a20cadf8a3a2fdfd219d1851734faec5c99b0d69022ada529",
+    "api/v2/openapi.yaml": "a0880db46930a58b99c860fe04f17b6b782d31a4cb4f86398446adbf36c062fe",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -116,8 +116,8 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "0b895f892c4f29317782a81dd2c6ca6f90de972d99248d65d5eb0c3ab96e1b5d",
-    "schemas/v2/certification-bundle.schema.json": "9caf701cf991644aeb3a95beedd4acdef0b3fb351c41b0eaaa804e658af75642",
+    "schemas/v2/capabilities.schema.json": "79ddbbda4686fe66ec5b0aaf9bafb2385e2f8ccbb1ee39087d75cef9fd1f1628",
+    "schemas/v2/certification-bundle.schema.json": "168a1e79097a755f6da57e4671586f4f2ddfaba26cb4ec2d5de3774517f4ac64",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
@@ -204,38 +204,38 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "99e982c47f276fd0acd7791ed80bedf815c13ec2b9ca74a4e97b53e30d77f7d7",
+    "spec/v1/core-standard-manifest.json": "d624b312258b0299906ed0ace1d6d79e6df4a0a2e5543d55aef06ff81e434da1",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "3002e1a77b9011de98e6e1178fbb934059794b0bcecd09519ea127331ae99073",
+    "spec/v1/gaps.json": "c20fe027514c8778b34c8fadde8bc7d1db5c4034638d76d297cc89a5bcae7ba2",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
-    "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
-    "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
+    "spec/v1/operation-path-manifest.json": "968c2fceb27cf76acbb14f7d250798f913bbbd3e9789dd3fb2a32c1ef536e771",
+    "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
-    "spec/v2/core/conformance.md": "4998af6d64dd6073a396715b5d91476304041dc1493a82885c6c91f098e28e81",
+    "spec/v2/core/conformance.md": "975bf95049247530d723e81051b6e64bd2a1f9d150183dec391cae48e35af7cc",
     "spec/v2/core/connection-packs.md": "7257339a4fc125011bf89961588c949cb058a0c0f7d9808ad08a5288deb3f8fc",
     "spec/v2/core/conversation.md": "c9a937e410fdb4e092cec2f05a7cab8b5232745090cfb20041c03c70ccbb5cdc",
-    "spec/v2/core/errors.md": "0210177647748efc5fe9affe29a9029152c4f983248ca88c6375601d7e636591",
-    "spec/v2/core/events.md": "ee0f7d2cff5bfa29c38b77f73269d7d755b8036cb1a5c7b08f02de92c54f3490",
+    "spec/v2/core/errors.md": "619cd74381c41acf33d012eb1afd834e148ac292663a1a6fa6744dbaff9661d9",
+    "spec/v2/core/events.md": "3df1866a89fb765c78adf79b8d51f96c59584dee9aa88d59179b88a681d827da",
     "spec/v2/core/form-content-packs.md": "55ea021b5f676f5851f420b3597262fbf6642108bddeb726922f8c5dd96c968b",
-    "spec/v2/core/headers.md": "c0e954d08e777e43816fbbabca61f303b78db09596b878d818b7a5022a1b6e7c",
+    "spec/v2/core/headers.md": "38c03524e3aeea30862432d203faffb8b0b05ec65136d223e96ab06941c3717b",
     "spec/v2/core/host-services.md": "c3ff93201d642edf835e9ae84f06a17edd207f9d351f8bfd70572be05bbfd894",
-    "spec/v2/core/idempotency.md": "a8492ec66569c00f6f559b75b80d93adbbc0e964a24e8dfedfe4057e47d69a9f",
+    "spec/v2/core/idempotency.md": "b61d4a200526485937897dd7ebca092e68424a80624e0be7a0b7db8cdbd54403",
     "spec/v2/core/identity.md": "d15667552019f64316be9b65c6e5696c10766581405f05da3907fb47f36e6459",
-    "spec/v2/core/interop.md": "5b7d2742eef309b1590b8d6690e5435b00c2ce6b395284684e3591cb9ed47bab",
-    "spec/v2/core/interrupt.md": "e0199472da7d0412721ab487a07c82fe78cbc9b60612bfcfc3cb876dc1a8c96f",
+    "spec/v2/core/interop.md": "ec8239d6d430e0d6df4db51d23bcbbbf9bc989bdb7e487e8312a104485ab6d16",
+    "spec/v2/core/interrupt.md": "1dc94f7c791dd5a547b1abafde6a8a76acd3d2993d288057f302f57911dc83bf",
     "spec/v2/core/node-pack-runtimes.md": "c435ad506f618831b6c0a9fd9150d83a5dc6caa1e3d755b949af2ff8949f1140",
     "spec/v2/core/oauth.md": "08e558a742259e75cfb2123f4c364d238dc4c57eea1a3c25d8f420ab4dff8244",
     "spec/v2/core/overview.md": "8f9d4a68b6185664e40d226cb82d9a9270a6c6630e3db59bddff300be781947d",
     "spec/v2/core/packs.md": "3107db14f68f36f5c0d8a13a6f0b3ca9ebef7ff890b8133894bfd28a63462d9b",
     "spec/v2/core/persistence.md": "d32736bd74e51df7c552565b4105a8ec801ece6d2292c8676421368ee9bffec1",
-    "spec/v2/core/replay.md": "1166ea8dc73f825b3fd1ef083085eea72cc2a2663b5939a61d1c69d8466991b3",
+    "spec/v2/core/replay.md": "c0412290c805231f5b975acc0c094465c627cd600abec34efa034cbf0a4520cf",
     "spec/v2/core/runs.md": "c7dcc5116648f42cadecdcd4c949b194272908cbc4b1fbc7321956d5b3a713af",
     "spec/v2/core/security-defaults.md": "b54c055bea0a3c5417751a7423e390ef59b5f9acd6911f1b4b754e1a4578e7e2",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
@@ -246,7 +246,7 @@
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
     "spec/v2/declaration.json": "84bd247804e625b0a5d66f2011726626e8a9b21e55c479cc9ba239e6b5c358a6",
     "spec/v2/declaration.schema.json": "881c08b455aa12c41a0a0ec43a960ab78b75ff1302188f7eaaa43074ed4cff7a",
-    "spec/v2/errors.json": "769e77369aa9bae7ba9c3728fc8ce04795d20ca4baa2a22056b70d0f5a2c4801",
+    "spec/v2/errors.json": "287a8bb487be96a2938b2101dd737ee87336440b3777a37dd44954726ed891b1",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "ff91a503e0795e1b898e37d9e445add2d5975529723f7b32b2599b60a24c1ae3",
@@ -273,7 +273,7 @@
     "spec/v2/facets/auth.schema.json": "668f183fc15a6fb058c53635d3457db5a821f551a90141d08676a7a28917b0a9",
     "spec/v2/facets/envelopeStrictness.schema.json": "28be0a27f880bd45ec1222a16155f5e9167bbca57bf0322970fe1eb2654562aa",
     "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
-    "spec/v2/facets/interrupt.schema.json": "3cc228b9bee48922b22bd6b0bee1a3244dc83d377a616cfb523435368da11ebb",
+    "spec/v2/facets/interrupt.schema.json": "2110ef32c3f880bf706475ef4cf8ddf97ff06871b8e6003a5edbcf4439f1fb70",
     "spec/v2/facets/mcp.schema.json": "7060657dfcff170f079beed160e3db7c1d3cc4410cd3cf64863baf6459f781cd",
     "spec/v2/facets/oauth.schema.json": "3a0cbe249d3bd5a5982349ae7ba2534776cc958e4a57e0fbeabf2bdab6e99e69",
     "spec/v2/facets/packs.schema.json": "d544a280419c0052ce0f3c3b378f7aa04085cadc31df52a3c8f43da600b131b1",
@@ -285,16 +285,16 @@
     "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
-    "spec/v2/interop-map.json": "245bae77503ceba332436ff48054c4de63a414dc02ada4bc3f083740615c6986",
-    "spec/v2/interop-map.schema.json": "4997f4b877495e6884c525e95b85bf0011aa1b498506a49510d8bb890594ca0d",
+    "spec/v2/interop-map.json": "a6bddce7f774f26ed178d2dd2e7268251acc9b1c9119e53dac116aa9c4fb2da0",
+    "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "39087f64480a257ee2996f153c8530e6250480bfe7d8b9d12c17156b85faa32a",
+    "spec/v2/release.json": "e6cdd54b2e2b03cc6f8ccb56c977ba94188b66d9cb0a130053429eec219f95b5",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "efdb4e5e0eb16689e20dea2be6f326971bb5707990c31896ca4cf24c6a5bbfed"
+    "spec/v2/surface-baseline.json": "c07ff8163c6aadbd8673669ce07aa798ad4c8f99d59e8c33eaf5171f17777b10"
   },
-  "corpusCommit": "21f518e4e2af1d10280fc121789bc97837a3b009"
+  "corpusCommit": "9b84226d4b9d3e81426065472016a5ef5deee933"
 }

package/api/openapi.yaml

@@ -2063,6 +2063,80 @@ paths:
         '403': { $ref: '#/components/responses/Forbidden' }
         '404': { $ref: '#/components/responses/NotFound' }
 
+  # RFC 0201 §E.18 — zero-downtime secret rotation. Gated on
+  # `capabilities.webhooks.secretRotation`; the v2 twin is
+  # `rotateWebhookSecret` in api/v2/openapi.yaml.
+  /v1/webhooks/{webhookId}/rotate-secret:
+    post:
+      tags: [webhooks]
+      summary: Rotate a Standard Webhooks subscription's secret with an overlap.
+      description: >
+        Per `spec/v1/webhooks.md` §"Standard Webhooks companion scheme" →
+        **Rotation** (RFC 0201 §E.18). Gated on
+        `capabilities.webhooks.secretRotation: { overlapSeconds }`: a host that does
+        not advertise the facet MUST answer `404`. Only for a subscription whose
+        registration listed `standard-webhooks-1`; any other subscription gets
+        `400 validation_error`, because its single `v1` signature cannot overlap.
+        `403` when the caller is not a member of the tenant; `404` when the
+        subscription is unknown. Until `previousSecretExpiresAt`,
+        `webhook-signature` MUST carry one entry under each secret and
+        `X-openwop-Signature` stays on the previous secret; afterwards only the new
+        secret signs. A second rotation inside an overlap retires the oldest secret
+        immediately. Rotation does not re-verify the endpoint, and the response
+        carries no secret.
+      operationId: rotateWebhookSecret
+      security:
+        - ApiKeyAuth: ['webhooks:manage']
+        - OAuth2: ['webhooks:manage']
+        - OpenIdConnect: ['webhooks:manage']
+      parameters:
+        - in: path
+          name: webhookId
+          required: true
+          schema: { type: string, minLength: 1 }
+        - in: query
+          name: tenantId
+          required: true
+          schema: { type: string, minLength: 1 }
+          description: >
+            Required, exactly as on `unregisterWebhook` — the route is not
+            path-nested under workspaces (`spec/v1/webhooks.md` §Unregister).
+        - $ref: '#/components/parameters/IdempotencyKey'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [secret]
+              additionalProperties: false
+              properties:
+                secret:
+                  type: string
+                  pattern: '^whsec_[A-Za-z0-9+/]+={0,2}$'
+                  description: >
+                    The new secret, `whsec_<base64>` decoding to 24–64 bytes
+                    (RFC 0201 §B.6). Never echoed in any response.
+      responses:
+        '200':
+          description: Rotated. No secret is returned.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [rotatedAt, previousSecretExpiresAt]
+                additionalProperties: false
+                properties:
+                  rotatedAt: { type: string, format: date-time }
+                  previousSecretExpiresAt:
+                    type: string
+                    format: date-time
+                    description: '`rotatedAt + overlapSeconds`.'
+        '400': { $ref: '#/components/responses/ValidationError' }
+        '401': { $ref: '#/components/responses/Unauthenticated' }
+        '403': { $ref: '#/components/responses/Forbidden' }
+        '404': { $ref: '#/components/responses/NotFound' }
+
   # ── Audit-log integrity verification (gated on profile) ────────────────
   /v1/audit/verify:
     get:

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.36.0
+  version: 2.37.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.36.0
+  version: 2.37.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented
@@ -63,16 +63,11 @@ operations:
 components:
   securitySchemes:
     ApiKeyAuth:
-      type: httpApiKey
-      in: header
-      name: Authorization
-      description: 'Bearer-style API key. Format implementation-defined; reference
-
-        impl uses `hk_`/`hk_test_` prefixes. Required scopes:
-
-        `runs:read` to subscribe. See `auth.md`.
-
-        '
+      type: http
+      scheme: bearer
+      bearerFormat: API key
+      description: 'Bearer API key, the same scheme as api/v2/openapi.yaml `ApiKeyAuth` (RFC 0200 §F). Required scope: `runs:read`
+        to subscribe.'
   parameters:
     RunId:
       description: The run to subscribe to. Format opaque; clients MUST treat as a string.
@@ -95,7 +90,7 @@ components:
     EvalCompleted:
       name: eval.completed
       title: Eval run completed (RFC 0081)
-      summary: An eval run finished. Content-free aggregate scalars; the full scorecard is the run output, read via GET /v1/runs/{runId}/eval-summary.
+      summary: An eval run finished. Content-free aggregate scalars; the full scorecard is the run output, read via GET /runs/{runId}/eval-summary.
       contentType: application/json
       payload:
         $ref: '#/components/schemas/EvalCompletedPayload'
@@ -115,14 +110,14 @@ components:
       payload:
         $ref: '#/components/schemas/DeploymentRolledBackPayload'
     DeploymentCanaryAdjusted:
-      name: deployment.canary.adjusted
+      name: deployment.canary-adjusted
       title: Deployment canary adjusted (RFC 0082)
       summary: An active version's canary traffic share changed. Content-free; recorded-fact; audit-logged.
       contentType: application/json
       payload:
         $ref: '#/components/schemas/DeploymentCanaryAdjustedPayload'
     DeploymentStateChanged:
-      name: deployment.state.changed
+      name: deployment.state-changed
       title: Deployment state changed (RFC 0082)
       summary: A non-promotion lifecycle transition (pause / resume / deprecate). Content-free; recorded-fact; audit-logged.
       contentType: application/json
@@ -233,7 +228,7 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     CompensationManualInterventionRequired:
-      name: compensation.manual_intervention_required
+      name: compensation.manual-intervention-required
       title: Compensation needs an operator (RFC 0151 §C/§E)
       summary: The host cannot proceed unaided. Recorded explicitly because an unwind that stops without saying so is indistinguishable
         from one that finished.
@@ -316,7 +311,7 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     DispatchFanOut:
-      name: core.dispatch.fanOut
+      name: dispatch.fanned-out
       title: core.dispatch began a parallel fan-out wave (RFC 0118)
       summary: Emitted when a fanOutPolicy=parallel wave begins; payload $defs.dispatchFanOut carries childCount/maxConcurrency/joinMode.
         Parallel path only.
@@ -324,7 +319,7 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     DispatchJoin:
-      name: core.dispatch.join
+      name: dispatch.joined
       title: core.dispatch parallel join satisfied (RFC 0118)
       summary: Emitted when a fanOutPolicy=parallel join is satisfied/failed; payload $defs.dispatchJoin carries joinOutcome
         + the replay-deterministic mergeOrder.
@@ -439,7 +434,7 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     VoiceSpeechStart:
-      name: voice.speech_start
+      name: voice.speech-start
       title: Inbound user speech onset detected
       contentType: application/json
       payload:
@@ -451,25 +446,25 @@ components:
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     VoiceEndpointCandidate:
-      name: voice.endpoint_candidate
+      name: voice.endpoint-candidate
       title: Likely end-of-turn boundary (semantic turn detection)
       contentType: application/json
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     VoiceTurnCommit:
-      name: voice.turn_commit
+      name: voice.turn-commit
       title: User yielded the floor (callTranscriber Promise resolves here)
       contentType: application/json
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     VoiceSynthesisChunk:
-      name: voice.synthesis_chunk
+      name: voice.synthesis-chunk
       title: Clause-boundary streaming-synthesis chunk (metadata only)
       contentType: application/json
       payload:
         $ref: '#/components/schemas/RunEventDoc'
     VoiceBargeIn:
-      name: voice.barge_in
+      name: voice.barge-in
       title: User speech overlapped active assistant playback
       contentType: application/json
       payload:

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.36.0
+  version: 2.37.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam
@@ -85,8 +85,9 @@ paths:
             ETag:
               schema:
                 type: string
-              description: Optional probe handle for mid-session capability change detection. Deprecated toward v2 (RFC 0165
-                §C.2).
+              description: 'capabilities.md §1 (RFC 0165 §C.2). Standard strong validator for the discovery document: a v2
+                host MUST send it and MUST honor `If-None-Match` with `304`; a host that changes semantics without changing
+                the bytes is non-conformant.'
             OpenWOP-Version:
               $ref: '#/components/headers/OpenWOPVersion'
           content:
@@ -2749,6 +2750,81 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+  /webhooks/{webhookId}/rotate-secret:
+    post:
+      tags:
+      - webhooks
+      operationId: rotateWebhookSecret
+      summary: Rotate a Standard Webhooks subscription's secret with an overlap (RFC 0201 §E)
+      description: 'Gated on `webhooks.secretRotation`: a host that does not advertise it MUST answer `404 not_found`. Only
+        for a subscription that opted into `standard-webhooks-1`; any other subscription gets `400 validation_error` (its
+        single `v1` signature cannot overlap). Tenant checks are exactly those of `unregisterWebhook`: `403 id_tenant_mismatch`
+        when the id''s tenant segment is not the caller''s, checked before the lookup (`identity.md` §5); `404` when unknown.
+        For `overlapSeconds` after `rotatedAt`, `webhook-signature` carries one entry under the new secret and one under the
+        previous one, and `OpenWOP-Signature` stays on the previous secret; at `previousSecretExpiresAt` only the new secret
+        signs. A second rotation inside an overlap retires the oldest secret immediately. Rotation does not re-verify the
+        endpoint. The response carries no secret.'
+      parameters:
+      - name: webhookId
+        in: path
+        required: true
+        schema:
+          $ref: ../../schemas/v2/ids.schema.json#/$defs/subscriptionId
+        description: 'Tenant-bound `<tenantId>/<opaque>` (`identity.md` §5, RFC 0187 §A.1), one path segment: `~`-projected
+          (RFC 0184) or percent-encoded.'
+      - $ref: '#/components/parameters/IdempotencyKey'
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+              - secret
+              additionalProperties: false
+              properties:
+                secret:
+                  type: string
+                  pattern: ^whsec_[A-Za-z0-9+/]+={0,2}$
+                  description: The new secret, `whsec_<base64>` decoding to 24–64 bytes (RFC 0201 §B.6).
+      responses:
+        '200':
+          description: Rotated. No secret is returned.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                - rotatedAt
+                - previousSecretExpiresAt
+                additionalProperties: false
+                properties:
+                  rotatedAt:
+                    type: string
+                    format: date-time
+                  previousSecretExpiresAt:
+                    type: string
+                    format: date-time
+                    description: '`rotatedAt + overlapSeconds`.'
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+      security:
+      - ApiKeyAuth:
+        - webhooks:manage
+      - OAuth2:
+        - webhooks:manage
+      - OpenIdConnect:
+        - webhooks:manage
   /audit/verify:
     get:
       tags:
@@ -3509,81 +3585,6 @@ paths:
         - runs:read
       - OpenIdConnect:
         - runs:read
-  /webhooks/{webhookId}/rotate-secret:
-    post:
-      tags:
-      - webhooks
-      operationId: rotateWebhookSecret
-      summary: Rotate a Standard Webhooks subscription's secret with an overlap (RFC 0201 §E)
-      description: 'Gated on `webhooks.secretRotation`: a host that does not advertise it MUST answer `404 not_found`. Only
-        for a subscription that opted into `standard-webhooks-1`; any other subscription gets `400 validation_error` (its
-        single `v1` signature cannot overlap). Tenant checks are exactly those of `unregisterWebhook`: `403 id_tenant_mismatch`
-        when the id''s tenant segment is not the caller''s, checked before the lookup (`identity.md` §5); `404` when unknown.
-        For `overlapSeconds` after `rotatedAt`, `webhook-signature` carries one entry under the new secret and one under the
-        previous one, and `OpenWOP-Signature` stays on the previous secret; at `previousSecretExpiresAt` only the new secret
-        signs. A second rotation inside an overlap retires the oldest secret immediately. Rotation does not re-verify the
-        endpoint. The response carries no secret.'
-      parameters:
-      - name: webhookId
-        in: path
-        required: true
-        schema:
-          $ref: ../../schemas/v2/ids.schema.json#/$defs/subscriptionId
-        description: 'Tenant-bound `<tenantId>/<opaque>` (`identity.md` §5, RFC 0187 §A.1), one path segment: `~`-projected
-          (RFC 0184) or percent-encoded.'
-      - $ref: '#/components/parameters/IdempotencyKey'
-      - $ref: '#/components/parameters/OpenWOPVersion'
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required:
-              - secret
-              additionalProperties: false
-              properties:
-                secret:
-                  type: string
-                  pattern: ^whsec_[A-Za-z0-9+/]+={0,2}$
-                  description: The new secret, `whsec_<base64>` decoding to 24–64 bytes (RFC 0201 §B.6).
-      responses:
-        '200':
-          description: Rotated. No secret is returned.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                - rotatedAt
-                - previousSecretExpiresAt
-                additionalProperties: false
-                properties:
-                  rotatedAt:
-                    type: string
-                    format: date-time
-                  previousSecretExpiresAt:
-                    type: string
-                    format: date-time
-                    description: '`rotatedAt + overlapSeconds`.'
-          headers:
-            OpenWOP-Version:
-              $ref: '#/components/headers/OpenWOPVersion'
-        '400':
-          $ref: '#/components/responses/ValidationError'
-        '401':
-          $ref: '#/components/responses/Unauthenticated'
-        '403':
-          $ref: '#/components/responses/Forbidden'
-        '404':
-          $ref: '#/components/responses/NotFound'
-      security:
-      - ApiKeyAuth:
-        - webhooks:manage
-      - OAuth2:
-        - webhooks:manage
-      - OpenIdConnect:
-        - webhooks:manage
 components:
   securitySchemes:
     ApiKeyAuth:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.36.1",
+  "version": "2.37.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/capabilities.schema.json

@@ -8130,7 +8130,7 @@
         },
         "callbackDelivery": {
           "type": "boolean",
-          "description": "RFC 0196 §A.1 — true only if the host delivers to createRun.callbackUrl (interrupt.md §Callback delivery). A host advertising it MUST hold callbackUrl to the webhooks.md §SSRF guard at create time and at delivery."
+          "description": "RFC 0196 §A.1 — true only if the host delivers to createRun.callbackUrl (interrupt.md §Callback delivery). A host advertising it MUST hold callbackUrl to the webhooks.md §Egress guard at create time and at delivery."
         }
       },
       "allOf": [

package/schemas/v2/certification-bundle.schema.json

@@ -259,7 +259,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v2-alias-covers-reword|v2-bundle-signature-attributable|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
+                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v1-webhook-rotation-contract|v2-alias-covers-reword|v2-bundle-signature-attributable|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
                 "description": "RFC 0168 §A.1 — `openwop.<area>.<slug>`. The suite mints six areas: `requirement` (an explicit `req()` id), `it` (a per-test id from the scenario file and title), `scenario` and `floor` (per-file rows), `profile` (a claimed-profile row) and `family` (a capability gate). The lookahead refuses every id minted from a corpus-coherence file: those run in the spec repo’s CI and MUST NOT appear in a host bundle (conformance.md §\"Two products, two ledgers\"; RFC 0168 §D.1). `scripts/check-req-only.mjs` fails when the list drifts from `conformance/src/coherence/`."
               },
               "scenario": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.36.1"
+      "version": "2.37.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -86,6 +86,7 @@
     "resolveInterruptByRun",
     "resolveInterruptByToken",
     "resumeRun",
+    "rotateWebhookSecret",
     "streamRunEvents",
     "transitionAgentDeployment",
     "unregisterWebhook",
@@ -419,5 +420,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "aea6b0b258dfdd9c3e064a6c1bba4e4982ace58a082035ee5c3ea23290e19e25"
+  "digest": "a9aa087c773fd926ea86bb5c108714f6023ff9a24768870ac07e962cb51c4531"
 }

package/spec/v1/gaps.json

@@ -10059,6 +10059,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0175.5",
+      "rfc": "0175",
+      "local": "G5",
+      "section": "§D.1",
+      "surface": "The committed reference-host bundle records `openwop.requirement.0175.negotiation-authenticated.mcp` `executed-pass` having measured the harness: the leg's own single-era MCP server is unreachable behind the shared public front, and §23 has no lever that makes a server offer only a lower revision. The bundle is owed a re-cut on the corrected suite.",
+      "witness": "seam-gated",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "v2-reference-recut",
+      "sources": [
+        {
+          "file": "RFCS/registers/0175-v2-transports-and-embedded-protocols.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0175.6",
+      "rfc": "0175",
+      "local": "G6",
+      "section": "§D.1",
+      "surface": "The unauthenticated clause is reachable only when a negotiated version can land below `preferredVersion` and at or above the floor; the only host that witnesses these ids advertises `preferredVersion` equal to its floor on both protocols, so no committed bundle has ever exercised it.",
+      "witness": "seam-gated",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-floor-below-preferred",
+      "sources": [
+        {
+          "file": "RFCS/registers/0175-v2-transports-and-embedded-protocols.gaps.md",
+          "token": "G6"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0176.1",
       "rfc": "0176",
@@ -13361,7 +13395,7 @@
       "requirementId": null,
       "disposition": "open",
       "target": null,
-      "note": "`workspace-cross-tenant-isolation` (WCT-1) + WSR-1 + CRUD/ETag/snapshot conformance land at the behavior milestone, not at this DRAFT. Shape-only conformance (`workspace-capability-shape.test.ts`) ships now.",
+      "note": "WCT-1's half has landed: `workspace-cross-tenant-isolation` is registered in `SECURITY/invariants.yaml` (protocol tier, critical) and two scenarios back it — the seam one and the black-box one that drives the normative §C endpoints with two operator credentials. Still open: WSR-1, which has neither an `invariants.yaml` entry nor a scenario of its own, plus CRUD/ETag/snapshot conformance; both land at the behavior milestone, not at this DRAFT. Shape-only conformance (`workspace-capability-shape.test.ts`) ships now.",
       "sources": [
         {
           "file": "spec/v1/spec-gaps.json",
@@ -14431,12 +14465,11 @@
       "rfc": "0117",
       "local": "r5",
       "section": "spec/v1/frontend-plugin-packs.md",
-      "surface": "`Active → Accepted`",
+      "surface": "**Closed (2026-09-23).** RFC 0117 reached `Accepted` on 2026-07-06 (steward single-witness waiver + the tier-1 reference host openwop-app advertising `uiPlugins {supported:true, isolation:\"cross-origin-iframe\"}` live), and openwop#1479 flipped `spec/v1/frontend-plugin-packs.md` to `Status: Stable` on 2026-09-22 because that predicate had fired. Original: `Active → Accepted`.",
       "witness": "witnessable-gated",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
-      "note": "Pending a host advertising `capabilities.uiPlugins.supported` + passing the gated scenarios non-vacuously (dual-witness per the graduation rule).",
       "sources": [
         {
           "file": "spec/v1/spec-gaps.json",

package/spec/v1/operation-path-manifest.json

@@ -443,6 +443,14 @@
       "tag": "webhooks",
       "class": "canonical"
     },
+    {
+      "operationId": "rotateWebhookSecret",
+      "method": "POST",
+      "pathKey": "/v1/webhooks/{webhookId}/rotate-secret",
+      "resolvedPath": "/v1/webhooks/{webhookId}/rotate-secret",
+      "tag": "webhooks",
+      "class": "canonical"
+    },
     {
       "operationId": "getWorkflow",
       "method": "GET",
@@ -453,10 +461,10 @@
     }
   ],
   "counts": {
-    "total": 56,
-    "canonical": 47,
+    "total": 57,
+    "canonical": 48,
     "hostExtension": 5,
     "testCatalog": 4
   },
-  "digest": "ef8c07388acc57ac48c30a7600d5197039cbf32cbf8117a286664dd2388b4a60"
+  "digest": "056436682c867c985d8b04c42df64d675718c46dab943a290bb275d2b07ea388"
 }

package/spec/v1/spec-gaps.json

@@ -4,8 +4,8 @@
   "tables": 43,
   "rows": 196,
   "byDisposition": {
-    "open": 107,
-    "closed": 69,
+    "open": 106,
+    "closed": 70,
     "carried": 20
   },
   "byWitness": {
@@ -981,7 +981,7 @@
       "local": "r6",
       "section": null,
       "surface": "**SECURITY invariant + conformance behavior tests**",
-      "resolutionPath": "`workspace-cross-tenant-isolation` (WCT-1) + WSR-1 + CRUD/ETag/snapshot conformance land at the behavior milestone, not at this DRAFT. Shape-only conformance (`workspace-capability-shape.test.ts`) ships now.",
+      "resolutionPath": "WCT-1's half has landed: `workspace-cross-tenant-isolation` is registered in `SECURITY/invariants.yaml` (protocol tier, critical) and two scenarios back it — the seam one and the black-box one that drives the normative §C endpoints with two operator credentials. Still open: WSR-1, which has neither an `invariants.yaml` entry nor a scenario of its own, plus CRUD/ETag/snapshot conformance; both land at the behavior milestone, not at this DRAFT. Shape-only conformance (`workspace-capability-shape.test.ts`) ships now.",
       "owningRfc": "0059",
       "disposition": "open",
       "dispositionEvidence": null,
@@ -2180,11 +2180,11 @@
       "doc": "spec/v1/frontend-plugin-packs.md",
       "local": "r5",
       "section": null,
-      "surface": "`Active → Accepted`",
-      "resolutionPath": "Pending a host advertising `capabilities.uiPlugins.supported` + passing the gated scenarios non-vacuously (dual-witness per the graduation rule).",
+      "surface": "**Closed (2026-09-23).** RFC 0117 reached `Accepted` on 2026-07-06 (steward single-witness waiver + the tier-1 reference host openwop-app advertising `uiPlugins {supported:true, isolation:\"cross-origin-iframe\"}` live), and openwop#1479 flipped `spec/v1/frontend-plugin-packs.md` to `Status: Stable` on 2026-09-22 because that predicate had fired. Original: `Active → Accepted`.",
+      "resolutionPath": null,
       "owningRfc": "0117",
-      "disposition": "open",
-      "dispositionEvidence": null,
+      "disposition": "closed",
+      "dispositionEvidence": "RFC 0117 `Status` is `Accepted` (RFCS/0117-frontend-plugin-packs.md, Updated 2026-07-06); the spec banner is `Stable` (openwop#1479)",
       "target": null,
       "witness": "witnessable-gated",
       "rowKind": "table-row",

package/spec/v2/core/conformance.md

@@ -42,7 +42,7 @@ A MUST whose only witness is `seam-gated` MUST either mint a normative observati
 
 ## The seams profile
 
-Test seams are the profile `openwop-conformance-seams-v2` (`spec/v2/profiles.json`), described by `api/seams-v2.yaml` with schemas under `schemas/v2/seams/`, in the path space `/conformance/seams/…`. The seam schemas `$ref` the canonical error and event schemas with no tolerance path. A host that mounts the seams MUST advertise the profile in `profiles[]`; a `testSeams` capability flag does not exist and MUST NOT be advertised. `api/v2/openapi.yaml` and `spec/v2/path-manifest.json` MUST contain no seam or sample-host operation; an SDK generated from the canonical document has no seam method. The profile is versioned with the suite (`seams-v2` for 2.x).
+Test seams are the profile `openwop-conformance-seams-v2` (`spec/v2/profiles.json`), described by `api/seams-v2.yaml` with schemas under `schemas/v2/seams/`, in the path space `/conformance/seams/…`. The seam schemas `$ref` the canonical error and event schemas with no tolerance path. A host that mounts the seams MUST advertise the profile as `conformance.seamsProfile: "openwop-conformance-seams-v2"` at the discovery root (RFC 0168 §C.1, erratum 2026-09-05; the closed root has no `profiles[]`, capabilities.md §3); a `testSeams` capability flag does not exist and MUST NOT be advertised. `api/v2/openapi.yaml` and `spec/v2/path-manifest.json` MUST contain no seam or sample-host operation; an SDK generated from the canonical document has no seam method. The profile is versioned with the suite (`seams-v2` for 2.x).
 
 ## Two products, two ledgers
 

package/spec/v2/core/errors.md

@@ -24,7 +24,7 @@ Retry timing lives in the `Retry-After` header only. `details.retryAfter`, `deta
 
 ## One code per state
 
-An interrupt has one code per state: a token or run-scoped resolve against an interrupt that is already resolved, or whose run is cancelled or completed, MUST return `409 interrupt_already_resolved`; a signed token past its `expiresAt` MUST return `410 interrupt_expired`; a token whose `alg` or `kid` the host does not accept MUST return `401 interrupt_token_invalid` (see interrupt.md, identity.md). The idempotency mismatch code is `idempotency_key_mismatch` only (idempotency.md).
+An interrupt has one code per state: a token or run-scoped resolve against an interrupt that is already resolved, or whose run is cancelled or completed, MUST return `409 interrupt_already_resolved`; a signed token past its `expiresAt` MUST return `410 interrupt_expired`; a token whose `alg` or `kid` the host does not accept MUST return `401 interrupt_token_invalid` (see interrupt.md, identity.md). The idempotency mismatch code is `idempotency_key_mismatch` only (idempotency.md). `interrupt_cancelled` is registered and names no state of the core resolve surfaces; a host MUST NOT emit it from `resolveInterruptByRun`, `inspectInterruptByToken` or `resolveInterruptByToken` (RFC 0213 §C).
 
 ## Codes by HTTP status
 

package/spec/v2/core/events.md

@@ -84,7 +84,7 @@ Vendor events appear in `debug` only. In a mixed mode the host emits the union o
 
 Each frame carries `id:`, `event:` and `data:`: `id:` is the `sequence`, `event:` is the v2 `type` (single mode), `data:` is the `RunEventDoc`. Three frame names are not types and are absent from the `type` enum: `state.snapshot` (`values`; `data:` a `RunSnapshot`), `batch` (`bufferMs`; `data:` an array of `RunEventDoc`) and `ai.message.chunk` (`messages`; `data:` the `outputChunk` payload, persisted type `output.chunk`). A host MUST set `Content-Type: text/event-stream`, MUST emit a keep-alive comment at least every 30 seconds, and MUST close the connection after the run's terminal event (`run.completed`, `run.failed`, `run.cancelled`).
 
-`Last-Event-ID` resumes every mode: the host MUST look up the event with that sequence, MUST begin at the next sequence, and MUST NOT re-emit the resumption point. In `values` mode resumption MUST emit a `state.snapshot` first. With `bufferMs` (0..5000) the host accumulates events into one `event: batch` frame whose `data:` is an array of `RunEventDoc`; it MUST flush on a terminal event, on `node.suspended`, and on close; the batch's `id:` SHOULD be its highest `sequence` and `Last-Event-ID` MUST honor that id. A consumer MUST tolerate both a one-element batch and an unbatched frame. A host MUST NOT limit subscribers per run except for resource protection, and then MUST answer `429 rate_limited` with `Retry-After` rather than drop silently.
+`Last-Event-ID: N` resumes every mode as an exclusive cursor with the semantics of poll's `afterSequence`: the host MUST stream the events with `sequence > N` in log order and MUST NOT re-emit `N`. When `N` is at or beyond the last persisted sequence there is no backlog: on a live run the host MUST hold the stream open for later events, and on a terminal run it MUST close the stream without a frame. A host MUST NOT refuse a well-formed non-negative integer `Last-Event-ID` because no event carries that sequence; any other value SHOULD be refused with `400 validation_error`. The header is evaluated only after the caller is authorized to read the run: for a run the caller cannot read, the response MUST be the one the host gives without the header (RFC 0213 §A). In `values` mode resumption MUST emit a `state.snapshot` first. With `bufferMs` (0..5000) the host accumulates events into one `event: batch` frame whose `data:` is an array of `RunEventDoc`; it MUST flush on a terminal event, on `node.suspended`, and on close; the batch's `id:` SHOULD be its highest `sequence` and `Last-Event-ID` MUST honor that id. A consumer MUST tolerate both a one-element batch and an unbatched frame. A host MUST NOT limit subscribers per run except for resource protection, and then MUST answer `429 rate_limited` with `Retry-After` rather than drop silently.
 
 ### Host events
 

package/spec/v2/core/headers.md

@@ -25,7 +25,7 @@ RFC 0171 §C.1: every non-standard header is `OpenWOP-<Name>` and every header i
 | `Cache-Control` | 2 |  |
 | `Content-Encoding` | 1 | RFC 0115. Present only when the host negotiated compression |
 | `Content-Language` | 1 | The BCP-47 locale actually used (equals the response `locale`). |
-| `ETag` | 3 | Optional probe handle for mid-session capability change detection. Deprecated toward v2 (RFC 0165 §C.2). |
+| `ETag` | 3 | Standard HTTP validator (RFC 9110 §8.8.3). The obligation is per operation: MUST on the discovery document (capabilities.md §1), SHOULD on the run snapshot (runs.md §Snapshot), a content hash on a prompt template (getPromptTemplate); see each operation. |
 | `Location` | 1 | Canonical URI of the new template. |
 | `OpenWOP-Idempotent-Replay` | 1 | Set when the response was served from the idempotency cache. |
 | `OpenWOP-Version` | 54 | RFC 0172 §A.4 — the contract that produced this response; MUST equal the one used. |

package/spec/v2/core/idempotency.md

@@ -19,7 +19,7 @@ The header keeps its standard name (RFC 0171 §C.1) and applies to every mutatin
 | Retryable outcomes | `429` and `5xx` MUST NOT be replayed from cache; a same-key retry MUST re-execute, and a later final outcome replaces the record. |
 | Not cached | `400 idempotency_key_invalid`, `400 validation_error`, `401` and `403` MUST NOT be cached. |
 | Digest mismatch | A different request digest under the same record key MUST fail with `409 idempotency_key_mismatch` and MUST NOT return the cached body. This is the only mismatch code. |
-| Concurrency | Of two concurrent same-key requests a host MUST process exactly one to completion and MUST NOT process both. Retry timing travels in `Retry-After` only. |
+| Concurrency | Of two concurrent same-key requests a host MUST process exactly one to completion and MUST NOT process both. The other MAY wait, bounded by the host's request timeout, and receive the winner's response only if it is a final outcome (one this record caches), marked `OpenWOP-Idempotent-Replay: true`. Otherwise the host MUST answer `409 idempotency_in_flight` with no retry timing in `details`, and SHOULD set `Retry-After`. The code's registry `retriable: false` means not retryable without waiting (RFC 0213 §B). |
 | Replay marker | A response served from cache MUST carry `OpenWOP-Idempotent-Replay: true`. |
 | Retention | A record MUST be retained for at least 24 hours. |
 | Keyspace | Host-minted identifiers MUST NOT share the caller idempotency store. Logs and spans MUST NOT expose keys. |

package/spec/v2/core/interop.md

@@ -57,6 +57,8 @@ The event is content-free: `peer` MUST be a digest of the peer origin, never the
 
 **A2A multi-turn (A2A §3.4.3).** A message carrying `taskId` without `contextId` MUST be answered with the task's `contextId`. A message whose `contextId` is not its task's MUST be refused with its binding's invalid-parameters error and MUST NOT change the run. A message to a retained terminal task MUST be refused `UnsupportedOperationError`; `TaskNotFoundError` is for unknown, purged and unreadable tasks.
 
+**A2A error details (RFC 0211).** On a 1.0 `JSONRPC` interface, an A2A error's `error.data` MUST be an array of objects each carrying `@type`, including exactly one `type.googleapis.com/google.rpc.ErrorInfo` whose `reason` is the map row's `reason` and whose `domain` is `a2a-protocol.org` (a tightening of A2A §9.5's SHOULD). An `HTTP+JSON` interface MUST answer A2A §11.6's `google.rpc.Status`. A response on an interface URL the card lists, including a refusal before dispatch, MUST NOT be the OpenWOP error envelope. `TaskNotFoundError` details MUST NOT differ between an unknown task and an unreadable one, apart from an echo of the requested id. On `VersionNotSupportedError` a host SHOULD set `metadata.supportedVersions` to a comma-joined list; a client falls back to the card's `supportedInterfaces[].protocolVersion`. A client MUST identify an error by code or by the ErrorInfo `reason`, MUST accept `data` as an array, and SHOULD accept a `data` object carrying `reason` through 2.x.
+
 ## MCP tasks and cancellation (RFC 0198)
 
 A host MAY serve the MCP Tasks extension `io.modelcontextprotocol/tasks` (revision `2026-07-28`) on its server mount. It advertises it in its `server/discover` `capabilities.extensions` and by listing `extensions` in `mcp.features[]`, and nowhere else. A host that advertises it MUST implement the extension as published and the map's `mcp.tasks` rows, and:

package/spec/v2/core/interrupt.md

@@ -48,7 +48,7 @@ A host MUST expose the run-scoped surface and SHOULD expose the signed-token sur
 | `400` | `validation_error` | `resumeValue` fails `resumeSchema` or the approval action is not in `actions` |
 | `401` | `interrupt_token_invalid` | MAC, `alg` or `kid` not accepted |
 | `404` | `not_found` | No such run or node |
-| `409` | `interrupt_already_resolved` | Already resolved; or a token invalidated by resolution, cancellation or completion |
+| `409` | `interrupt_already_resolved` | Already resolved, or the run is cancelled or completed (both surfaces); or a token invalidated by resolution, cancellation or completion |
 | `410` | `interrupt_expired` | Token past `expiresAt` (token surface only) |
 
 ## Tokens

package/spec/v2/core/replay.md

@@ -9,7 +9,7 @@
 
 ## The surface
 
-A host that advertises `replay` (capabilities.md) serves `forkRun` (`api/v2/openapi.yaml`, `POST /runs/{runId}:fork`) and `getEffectSeamManifest` (`GET /host/effect-seams`). The `replay` facet (`spec/v2/facets/replay.schema.json`) is `{ modes[], retention?, effectSeamsManifest }`; `modes` enumerates `fork | branch | rerun`; `effectSeamsManifest` is the constant `/host/effect-seams`. There is no `sideEffectSuppression` field: suppression is the only conforming replay behavior (RFC 0173 §B, row `C6.2`) and `none` is not a value.
+A host that advertises `replay` (capabilities.md) serves `forkRun` (`api/v2/openapi.yaml`, `POST /runs/{runId}:fork`) and `getEffectSeamManifest` (`GET /host/effect-seams`). The `replay` facet (`spec/v2/facets/replay.schema.json`) is `{ modes[], retention?, effectSeamsManifest }`; `modes` enumerates `replay | branch` (the `forkRun` `mode` values); `effectSeamsManifest` is the constant `/host/effect-seams`. There is no `sideEffectSuppression` field: suppression is the only conforming replay behavior (RFC 0173 §B, row `C6.2`) and `none` is not a value.
 
 The request body, `fromSeq` defaults and `201` response are runs.md §Fork. Events with `sequence < fromSeq` are fixed history; events `>= fromSeq` are re-executed.
 

package/spec/v2/errors.json

@@ -708,11 +708,11 @@
     {
       "code": "interrupt_cancelled",
       "httpStatus": 410,
-      "statusSource": "v1 prose",
+      "statusSource": "registry (v1 prose said 422, run-scoped; RFC 0213 §C)",
       "retriable": false,
       "details": null,
       "since": "1.0",
-      "source": "spec/v1/interrupt.md (the run was cancelled while suspended)"
+      "source": "spec/v1/interrupt.md:434 (422, run-scoped). The v2 core resolve surfaces do not emit it — RFC 0171 C4.6 one code per state; RFC 0213 §C."
     },
     {
       "code": "interrupt_expired",

package/spec/v2/facets/interrupt.schema.json

@@ -24,7 +24,7 @@
     },
     "callbackDelivery": {
       "type": "boolean",
-      "description": "RFC 0196 \u00a7A.1 \u2014 true only if the host delivers to createRun.callbackUrl (interrupt.md \u00a7Callback delivery). A host advertising it MUST hold callbackUrl to the webhooks.md \u00a7SSRF guard at create time and at delivery."
+      "description": "RFC 0196 \u00a7A.1 \u2014 true only if the host delivers to createRun.callbackUrl (interrupt.md \u00a7Callback delivery). A host advertising it MUST hold callbackUrl to the webhooks.md \u00a7Egress guard at create time and at delivery."
     }
   },
   "required": [

package/spec/v2/interop-map.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./interop-map.schema.json",
-  "$comment": "RFC 0208 (RFC 0198 adds mcp.tasks). Normative: spec/v2/core/interop.md §\"The operation mappings\" incorporates every row. Hand-maintained; checked by scripts/check-interop-map.mjs against api/v2/openapi.yaml operationIds, spec/v2/errors.json codes, the RunSnapshot.status enum and the spec/v2/facets/ schemas. Upstream names are verbatim; `v2Operation` is an operationId in api/v2/openapi.yaml or null when no v2 operation serves the row. Ships in @openwop/spec-artifacts.",
+  "$comment": "RFC 0208 (RFC 0198 adds mcp.tasks; RFC 0211 adds a2a.errors[].reason). Normative: spec/v2/core/interop.md §\"The operation mappings\" incorporates every row. Hand-maintained; checked by scripts/check-interop-map.mjs against api/v2/openapi.yaml operationIds, spec/v2/errors.json codes, the RunSnapshot.status enum and the spec/v2/facets/ schemas. Upstream names are verbatim; `v2Operation` is an operationId in api/v2/openapi.yaml or null when no v2 operation serves the row. Ships in @openwop/spec-artifacts.",
   "version": 1,
-  "updated": "2026-09-22",
+  "updated": "2026-09-23",
   "pins": {
     "a2a": {
       "release": "1.0.1",
@@ -99,7 +99,7 @@
           "a2a.streaming",
           "a2a.durableTasks"
         ],
-        "rule": "First event is the current Task; read-only re-attachment that MUST NOT re-execute or re-accept a message; a terminal task is UnsupportedOperationError."
+        "rule": "First event is the current Task; read-only re-attachment that MUST NOT re-execute or re-accept a message; a terminal task is UnsupportedOperationError. The HTTP+JSON verb is an upstream conflict: the A2A v1.0.1 proto binds `GET /tasks/{id=*}:subscribe` while the specification prose (§5.3, §11.3.2) and the a2a-js and a2a-python REST clients send POST; a host that lists an HTTP+JSON interface SHOULD accept both."
       },
       {
         "upstream": "CreateTaskPushNotificationConfig",
@@ -270,7 +270,8 @@
         "grpc": "NOT_FOUND",
         "http": 404,
         "serverWhen": "unknown, purged, or not readable by the caller (identically, including a tenant mismatch)",
-        "clientProjection": "not_found"
+        "clientProjection": "not_found",
+        "reason": "TASK_NOT_FOUND"
       },
       {
         "upstream": "TaskNotCancelableError",
@@ -278,7 +279,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "CancelTask on a terminal run",
-        "clientProjection": "run_terminal"
+        "clientProjection": "run_terminal",
+        "reason": "TASK_NOT_CANCELABLE"
       },
       {
         "upstream": "PushNotificationNotSupportedError",
@@ -286,7 +288,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "push config without a2a.pushNotifications",
-        "clientProjection": "capability_required"
+        "clientProjection": "capability_required",
+        "reason": "PUSH_NOTIFICATION_NOT_SUPPORTED"
       },
       {
         "upstream": "UnsupportedOperationError",
@@ -294,7 +297,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "an unimplemented operation or option; a message to a retained terminal task; SubscribeToTask on a terminal task",
-        "clientProjection": "capability_required"
+        "clientProjection": "capability_required",
+        "reason": "UNSUPPORTED_OPERATION"
       },
       {
         "upstream": "ContentTypeNotSupportedError",
@@ -302,7 +306,8 @@
         "grpc": "INVALID_ARGUMENT",
         "http": 400,
         "serverWhen": "a part mediaType or acceptedOutputModes entry the skill cannot handle, at request time",
-        "clientProjection": "validation_error"
+        "clientProjection": "validation_error",
+        "reason": "CONTENT_TYPE_NOT_SUPPORTED"
       },
       {
         "upstream": "InvalidAgentResponseError",
@@ -311,6 +316,7 @@
         "http": 500,
         "serverWhen": null,
         "clientProjection": "validation_error",
+        "reason": "INVALID_AGENT_RESPONSE",
         "note": "the malformed body MUST NOT enter run state"
       },
       {
@@ -319,7 +325,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "GetExtendedAgentCard with capabilities.extendedAgentCard not true",
-        "clientProjection": "not_found"
+        "clientProjection": "not_found",
+        "reason": "EXTENDED_AGENT_CARD_NOT_CONFIGURED"
       },
       {
         "upstream": "ExtensionSupportRequiredError",
@@ -327,7 +334,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "only for a required:true extension the client did not declare",
-        "clientProjection": "validation_error"
+        "clientProjection": "validation_error",
+        "reason": "EXTENSION_SUPPORT_REQUIRED"
       },
       {
         "upstream": "VersionNotSupportedError",
@@ -335,7 +343,8 @@
         "grpc": "FAILED_PRECONDITION",
         "http": 400,
         "serverWhen": "an A2A-Version the interface does not serve",
-        "clientProjection": "interop_version_unsupported"
+        "clientProjection": "interop_version_unsupported",
+        "reason": "VERSION_NOT_SUPPORTED"
       },
       {
         "upstream": "(invalid parameters)",
@@ -343,7 +352,8 @@
         "grpc": "INVALID_ARGUMENT",
         "http": 400,
         "serverWhen": "a message whose contextId is not its task's (A2A §3.4.3); no run state changes",
-        "clientProjection": "validation_error"
+        "clientProjection": "validation_error",
+        "note": "No A2A reason; the error SHOULD carry a google.rpc.BadRequest (RFC 0211 §A)."
       }
     ],
     "fields": [

package/spec/v2/interop-map.schema.json

@@ -424,6 +424,11 @@
           "type": "string",
           "description": "A code in spec/v2/errors.json (gate-checked)."
         },
+        "reason": {
+          "type": "string",
+          "pattern": "^[A-Z][A-Z0-9_]*$",
+          "description": "RFC 0211 §A. The google.rpc.ErrorInfo reason: the upstream error name in UPPER_SNAKE_CASE without the `Error` suffix (A2A §10.6). Absent on a parenthesized non-A2A row, which has no A2A name. Gate-checked against `upstream`."
+        },
         "note": {
           "type": "string"
         }

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.36.0",
-  "corpusTag": "v2.36.0",
+  "version": "2.37.0",
+  "corpusTag": "v2.37.0",
   "updated": "2026-09-23"
 }

package/spec/v2/surface-baseline.json

@@ -4,7 +4,7 @@
     "schemas/v2/**/*.json",
     "spec/v2/path-manifest.json"
   ],
-  "release": "2.36.0",
+  "release": "2.37.0",
   "kinds": {
     "union": [
       "channel",