@openwop/spec-artifacts 2.37.1 → 2.39.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.37.1",
-  "corpusTag": "v2.37.1",
+  "version": "2.39.0",
+  "corpusTag": "v2.39.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "02711723089859b95144d788c0caabf215305570c7d48be1da5d2a5e21eff4e1",
-    "api/v2/asyncapi.yaml": "d492342046d1ec3a2dc43a28c4cf6d821d6319c30a8552cbc8fcd13806f7b2df",
-    "api/v2/openapi.yaml": "ba67b61f0e716444308ef7bc00416b8eee5829c28b67c5070358d35c3ca64d36",
+    "api/seams-v2.yaml": "fa7c00470e0e158d0d2fa84e0cf1e21168c767cd5344a83ad6849d6ab8a02649",
+    "api/v2/asyncapi.yaml": "e7569b32ffc06b52dbd4aa767086b99434e0c4ed6e366dd2dc4b0dd679e53cc6",
+    "api/v2/openapi.yaml": "f0c2cfdc20d3df1a60d46924b926d9802aac6aac3354010a255ec6f720eab5fd",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -98,7 +98,7 @@
     "schemas/trigger-subscription-registration.schema.json": "929d628bad08e1def696e47e9a148aba00fa801e28d49bbd0dc2360b08673435",
     "schemas/trigger-subscription.schema.json": "4f7b067f20032073b140c4bb15dc9a9914c4f6421a252ff1ff261cbdd8edf270",
     "schemas/ui-plugin-message.schema.json": "346638babf1f8ea7b161cde75c0038b518cd2cc5bf0631772e20a9b74c96b5dd",
-    "schemas/v2/a2a-task-state.schema.json": "38e622a7edffda4e9361af0a9f11192f6e214efbb00f508fc5382e3c068139f5",
+    "schemas/v2/a2a-task-state.schema.json": "1810363e2d9bddb5997923bdac4044cc17c6f46ec5a40515d2ff21d9c82c1ad9",
     "schemas/v2/a2ui-surface-delta-frame.schema.json": "6889c5da3fe7e76cb614038c0eea6774776fa640448558b258eb87fb50cb9b64",
     "schemas/v2/agent-deployment-transition.schema.json": "93a334ff042d51378c89fdd7134664271bf9592419bb5e3e00821ed06bc1904e",
     "schemas/v2/agent-deployment.schema.json": "d59b43fb62b522005ee22bc3bc53775a6777493e5e42d71812abc347625fa7fe",
@@ -112,20 +112,20 @@
     "schemas/v2/ai-envelope.schema.json": "0dc7dfbf032a37239ffd81fc2d67f999a40782ff5074866a56e414164cdee809",
     "schemas/v2/annotation-create.schema.json": "ec32c22a243b343eeb6956a23be2d76ba5b50c8018ec3ec9d6efa5a1d9b0c792",
     "schemas/v2/annotation.schema.json": "eb4813cdaa8e325412cfcaeeee5c8a28f3751c946dec64e546c7ba0ad3aad8d4",
-    "schemas/v2/artifact-type-pack-manifest.schema.json": "862c03bcfcae87db0c8eb9114dd5058f5bced3ec93e19c6affcfcce6e1a9ba2b",
+    "schemas/v2/artifact-type-pack-manifest.schema.json": "c8820351a2ab93855bd654ad3d8a9788f97975d09b3a7a0418e374ed6114595d",
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "a748dfadb5155adfde8a91045e76b0db6695005fe559035d71670fdd55edb3ba",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "79ddbbda4686fe66ec5b0aaf9bafb2385e2f8ccbb1ee39087d75cef9fd1f1628",
-    "schemas/v2/certification-bundle.schema.json": "cb8ddf29a008b1c2e731fd61f855bf072790b700e458c702c40434b6fd47ba73",
+    "schemas/v2/capabilities.schema.json": "740944d7f0a00c91308449f3a3f52fa7b91b16b8fd36a0171b917afe9f4b0f09",
+    "schemas/v2/certification-bundle.schema.json": "67ac56bbf5f8deeec58b32e8d7bc9ce854a6a8c3cd81693e65192e5c3b726154",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
-    "schemas/v2/chat-card-pack-manifest.schema.json": "f7cf09b30d3e1d2251620d84ea9f65541438d015ab44aec10d1dcfe68d8bd496",
+    "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
     "schemas/v2/compact-tool-descriptor.schema.json": "b5c418d72082d5b713bf318212a83397e5be98e56d25ca056302b41b8dd8273b",
     "schemas/v2/compensation-policy.schema.json": "b3c1142637f5bf980f2b0bb67adb47e8cb7abb99a0405a4b6816ccf5d9c089d6",
     "schemas/v2/compensation-projection.schema.json": "f46977c7076347b5473faa8c4bbe73d8321c33b33c98fff2f26ee7cbada4ed98",
     "schemas/v2/configurable.schema.json": "33a6884047e2490f723733bf8b74d3b9164e00374cfea6dc3eac5a70dc368861",
-    "schemas/v2/connection-pack-manifest.schema.json": "bb61e88d4dd2ad572eb84dba618f949e5276852c8be3f0259f25473ce146e59f",
+    "schemas/v2/connection-pack-manifest.schema.json": "8d019de6bd0c5b14ea3b227580734ec792521493b396a850f7f9217aa7a6a547",
     "schemas/v2/conversation-event.schema.json": "9ad4c57285818edbf38b17816de0c4162f777c835f59e68702d0367a81cbccf6",
     "schemas/v2/conversation-turn.schema.json": "75bb6a4a03072a958feb5b34e2a1f40471e9e3996a81fa430b65717f0773c9a4",
     "schemas/v2/credential-provenance.schema.json": "f86b09e94b1c524dec7d1c6353965665ae8891e9517faef6e742d639c5578c99",
@@ -145,7 +145,7 @@
     "schemas/v2/error-envelope.schema.json": "217fa41cfe5a664e49d0b4dd97d3185b9eaaec9585bc4392aaf93175812ffbee",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
-    "schemas/v2/form-content-pack-manifest.schema.json": "8ec157cf51241d4df800398e811d2c35addd076b929c58be3ce3dcd671c67641",
+    "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
     "schemas/v2/frontend-plugin-manifest.schema.json": "fed6b8ddb3056c53b1bfc91525410a4445a3c37a8bf9eb9f6f9964ffea26d993",
     "schemas/v2/goal.schema.json": "ad104ed5a3866736b8fed9d7c0b23dc82af526b5bef4afe848f01fc3af2161e9",
     "schemas/v2/heartbeat-evaluated.schema.json": "4086b1ba1d0547c08b038dfb263ac89416a3e406430db1250156fb2f9b74f8d6",
@@ -157,21 +157,21 @@
     "schemas/v2/localized-content-section.schema.json": "b52cfe36c857c2800f71c480dcd7323e1a29783ecdc9f2440bc8e75a5a034346",
     "schemas/v2/memory-entry.schema.json": "290576ae84f4fef4cdf975932b87963283b11c50ea3d2654b32cd96aa6537c3d",
     "schemas/v2/memory-list-options.schema.json": "f66703bccb68efb28391c273abb66aa117ee5b5ce475c477846ed700c336afcd",
-    "schemas/v2/node-pack-manifest.schema.json": "848f3db5867e4d13e29aabb31ea94a4d0d27d7a1db35bf79f2620f9dd98b74ec",
+    "schemas/v2/node-pack-manifest.schema.json": "d8daf0d01bb0d7a5aec16d15fc55e39daa99356e62522773a6f73d35f78ac1ef",
     "schemas/v2/orchestrator-decision.schema.json": "2da17538e84cfbe70151eb118f1ccf670cff58b8697148e394074d32ac4af6b4",
     "schemas/v2/org-chart-responsibility-view.schema.json": "8a2565e4cdc6737a3946a70799f93642808b92f9c8d56dcdff3a0782053b89a1",
     "schemas/v2/pack-lockfile.schema.json": "2685417702c105146b780cd99154296a46578fbb10d81c8c713348ee26fea898",
     "schemas/v2/part.schema.json": "08b75eaec9a0b4a8cedca7bab732dd906b52b0749eaa444ec1ac015aa43519a5",
     "schemas/v2/prompt-kind.schema.json": "67251c937a5a91fb97c0422050e808dc0c162a9b8561366814cf87b0a7f62e00",
-    "schemas/v2/prompt-pack-manifest.schema.json": "4b1e510341cc6ba167b007ecae38ce0d71d5b89c751671777c5457da926e9744",
+    "schemas/v2/prompt-pack-manifest.schema.json": "752407469475396ad250085437a6cc6bd56a017ac6d3e52196aecc65dda4e51a",
     "schemas/v2/prompt-ref.schema.json": "11538fa36a7a652c93100cac4f1857eb4130137b546e3d94890618636d44b729",
     "schemas/v2/prompt-template.schema.json": "494fc83028cb3af5dbb8a943d0e83b2348f7775e9fa02369162bcb58a6f81559",
     "schemas/v2/proposal.schema.json": "a5c582ce1e854e5fe10412ebed00e537961ee827bbaca506ca374b200a685992",
-    "schemas/v2/registry-version-manifest.schema.json": "270704ebc6bae63be949efbf9503578938b103733db9da3cb8fcbee1cd7684dd",
+    "schemas/v2/registry-version-manifest.schema.json": "f05c620db2ee8f9c60fbe33f2e385cc1bc98bc92c588de8a7170c442b1bbe068",
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
     "schemas/v2/run-diff-response.schema.json": "8bdb2045c274580038bd74781f7d062f5049839797c164a89de4ed89edc53a74",
-    "schemas/v2/run-event-payloads.schema.json": "65296730d837389ad1a4ee6d97418c2ba01c2544e2689960b50b28fc200b27af",
+    "schemas/v2/run-event-payloads.schema.json": "b7b497c0a0fa41f279750138227d3378fc83ca894fb33e4b0a4fe7c685b84bc4",
     "schemas/v2/run-event.schema.json": "2f0d7416bd376c56affe97b6b2b49981532e8e9ff45c0a162cf806c78b3e7fb7",
     "schemas/v2/run-list-response.schema.json": "c2dbc34768dcf64528914a213aa3cb55952e8e3e90a64b04a9423b2a19749d38",
     "schemas/v2/run-options.schema.json": "f0e9f494d80086c2ed2cf9fe87df54e5b4e66601699c4a1089f4edbc7ba58867",
@@ -192,7 +192,7 @@
     "schemas/v2/webhook-dead-letter-page.schema.json": "543f5ccc26d8f777684a037172ab7b9fdf70735e5394eeb42e5fa6569503f528",
     "schemas/v2/webhook-delivery.schema.json": "4e8ab3b722ad1731adf0548c1217f0de62da40de14e8abf77533aee4ace4c079",
     "schemas/v2/webhook-verification.schema.json": "76e4e0d81143ffd2649bc7adba2aa34f2525e2c4e9f0300a425d908b3163196b",
-    "schemas/v2/workflow-chain-pack-manifest.schema.json": "58fa5b67c6e3a320f77aa1eb5d5fa7c6c9b3356afe8b75ad74a7cf082496e04b",
+    "schemas/v2/workflow-chain-pack-manifest.schema.json": "0816c6c59a91452d6fa1931394b766780eaf90949c9f7cd0ced522dadd32ff81",
     "schemas/v2/workflow-definition.schema.json": "b9043e3413fc01d939e7b2892cc0fe28bdfd77d5bacc561b6ca4ae20197b985b",
     "schemas/v2/workload-identity.schema.json": "1f589debfac6d70e0908da511550ec69a27b4bcc8314551cd843b6d923605efc",
     "schemas/v2/workspace-file-create.schema.json": "b6b5260857318c3b67de0231ed15e3a746f525880a763e7b36a7854178dd10d0",
@@ -204,7 +204,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c92119aa65b12b7f670cc59e7768177d20f8f47173e7fbd15c3b0a6ef340810a",
+    "spec/v1/core-standard-manifest.json": "5fe5a056765ade4903c1c3d95b9223dc1276e6f89bc6457fb1115c958a6f6479",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -218,7 +218,7 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ccfed7d978ce7293a6d8f3c0f6045835dfb7e488f2b67a68f6b04d67c4b0cfc9",
     "spec/v2/core/capabilities.md": "e22381fed3a93376ad478fa7f07571fdad9653aefd7c05f189a2ef45a49f6c63",
-    "spec/v2/core/conformance.md": "975bf95049247530d723e81051b6e64bd2a1f9d150183dec391cae48e35af7cc",
+    "spec/v2/core/conformance.md": "38ebc9e56a830d0ee0ade429b81b0cd302c23e49a13647b1b902275262d6610d",
     "spec/v2/core/connection-packs.md": "7257339a4fc125011bf89961588c949cb058a0c0f7d9808ad08a5288deb3f8fc",
     "spec/v2/core/conversation.md": "c9a937e410fdb4e092cec2f05a7cab8b5232745090cfb20041c03c70ccbb5cdc",
     "spec/v2/core/errors.md": "619cd74381c41acf33d012eb1afd834e148ac292663a1a6fa6744dbaff9661d9",
@@ -228,19 +228,19 @@
     "spec/v2/core/host-services.md": "c3ff93201d642edf835e9ae84f06a17edd207f9d351f8bfd70572be05bbfd894",
     "spec/v2/core/idempotency.md": "b61d4a200526485937897dd7ebca092e68424a80624e0be7a0b7db8cdbd54403",
     "spec/v2/core/identity.md": "d15667552019f64316be9b65c6e5696c10766581405f05da3907fb47f36e6459",
-    "spec/v2/core/interop.md": "ec8239d6d430e0d6df4db51d23bcbbbf9bc989bdb7e487e8312a104485ab6d16",
+    "spec/v2/core/interop.md": "9a6b37e07c0235856199ace6b3a84f592fa5903fcf6c442f8a18f4d6b6aa5525",
     "spec/v2/core/interrupt.md": "1dc94f7c791dd5a547b1abafde6a8a76acd3d2993d288057f302f57911dc83bf",
     "spec/v2/core/node-pack-runtimes.md": "c435ad506f618831b6c0a9fd9150d83a5dc6caa1e3d755b949af2ff8949f1140",
     "spec/v2/core/oauth.md": "08e558a742259e75cfb2123f4c364d238dc4c57eea1a3c25d8f420ab4dff8244",
     "spec/v2/core/overview.md": "8f9d4a68b6185664e40d226cb82d9a9270a6c6630e3db59bddff300be781947d",
-    "spec/v2/core/packs.md": "3107db14f68f36f5c0d8a13a6f0b3ca9ebef7ff890b8133894bfd28a63462d9b",
+    "spec/v2/core/packs.md": "91cd577b4a636c1587ef78742e583a203244b8508b289b01a18a8ef2ef0a9b3e",
     "spec/v2/core/persistence.md": "d32736bd74e51df7c552565b4105a8ec801ece6d2292c8676421368ee9bffec1",
-    "spec/v2/core/replay.md": "c0412290c805231f5b975acc0c094465c627cd600abec34efa034cbf0a4520cf",
+    "spec/v2/core/replay.md": "9050256a417171b184122877aa395d264545bb67c20e045315f42baa539f13cd",
     "spec/v2/core/runs.md": "c7dcc5116648f42cadecdcd4c949b194272908cbc4b1fbc7321956d5b3a713af",
-    "spec/v2/core/security-defaults.md": "b54c055bea0a3c5417751a7423e390ef59b5f9acd6911f1b4b754e1a4578e7e2",
+    "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "af63fdf728d2f6fd174a61d6c711d720c64154a702c9c28fbe1ca190020a4995",
+    "spec/v2/core/webhooks.md": "9c9169d775875f72982ed3506c1bfe27546ad05806d114af103dd7c28d4d5122",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -270,7 +270,7 @@
     "spec/v2/ext/webResearch/README.md": "e74fbe55a8c00040f1f87b5448259ee4eb3a26769d607f7d2dd9a671a2e2832b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
     "spec/v2/facets/aiProviders.schema.json": "81fb39b6698564d9d07a0d10525ecb6360c152fe3f3a5ea0439112509ca130e2",
-    "spec/v2/facets/auth.schema.json": "668f183fc15a6fb058c53635d3457db5a821f551a90141d08676a7a28917b0a9",
+    "spec/v2/facets/auth.schema.json": "7d98bc81a0f7d307460d039eebfebd21388091bfe1d538762583940f94c0bd2a",
     "spec/v2/facets/envelopeStrictness.schema.json": "28be0a27f880bd45ec1222a16155f5e9167bbca57bf0322970fe1eb2654562aa",
     "spec/v2/facets/heartbeat.schema.json": "81d7fa1895a8b0241bd07cf00a7e7905bef0fd14eb3427325261c62eee5746a6",
     "spec/v2/facets/interrupt.schema.json": "2110ef32c3f880bf706475ef4cf8ddf97ff06871b8e6003a5edbcf4439f1fb70",
@@ -285,16 +285,16 @@
     "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/id-field-bindings.json": "9f6fd280250447e26a6704811c352bb8f2ff6c4bd242befe3da0ba38962370e9",
-    "spec/v2/interop-map.json": "a6bddce7f774f26ed178d2dd2e7268251acc9b1c9119e53dac116aa9c4fb2da0",
+    "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "9422440ed08e9d8ff3e8190c3e91e862025fa8b5b49d468a536806f5a841ac13",
+    "spec/v2/release.json": "ddc2621cd435ca2f65372a6d63757f63a5bb1a10ec81d25d4ca9607315ae1e9a",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "13cfe5c31c3727a2e36980aa3e5a42f8ce1474b35beb99c5b71f487db006e71a"
+    "spec/v2/surface-baseline.json": "ec8449a1632606e34c419cc485e1404e1f1cced46a4bda3b2ab519d7c6859490"
   },
-  "corpusCommit": "0d370019eaaa841491be58d196e6d7a6934c71f0"
+  "corpusCommit": "42388852a5ef45c7dad7575ec50ab36c81eae8f3"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.37.1
+  version: 2.39.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.37.1
+  version: 2.39.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.37.1
+  version: 2.39.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.37.1",
+  "version": "2.39.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/a2a-task-state.schema.json

@@ -69,12 +69,12 @@
         "url": {
           "type": "string",
           "format": "uri",
-          "description": "Caller-registered push target. The host MUST validate it through the RFC 0093 webhook-egress SSRF guard before any push (no private/loopback/link-local target) — SECURITY invariant `a2a-push-egress-ssrf`."
+          "description": "Caller-registered push target. The host MUST validate it through the webhooks.md egress guard in full — scheme arm (non-https:// refused) and address arm (no private/loopback/link-local/ULA/metadata target) — at registration, and again at delivery (RFC 0214) — SECURITY invariant `a2a-push-egress-ssrf`."
         },
         "tokenFingerprint": {
           "type": "string",
           "maxLength": 32,
-          "description": "MAY — a truncated/salted digest of the caller's push-auth token (NEVER the raw token; same SR-1 rule as RFC 0083's `secretFingerprint`). The A2A push HMAC details (A2A §4.3.3) stay inside the A2A layer per a2a-integration.md."
+          "description": "MAY — a truncated/salted digest of the caller's push-auth token (NEVER the raw token; same SR-1 rule as RFC 0083's `secretFingerprint`). The token itself is a destination credential held by reference (RFC 0214)."
         }
       }
     }
@@ -98,6 +98,5 @@
       "state": "completed",
       "updatedAt": "2026-06-13T19:05:00Z"
     }
-  ],
-  "x-openwop-seeded-from": "v1"
+  ]
 }

package/schemas/v2/artifact-type-pack-manifest.schema.json

@@ -229,7 +229,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/capabilities.schema.json

@@ -7541,7 +7541,6 @@
             "required": [
               "lane",
               "issuers",
-              "revocation",
               "minimumAssurance"
             ],
             "properties": {
@@ -7608,28 +7607,50 @@
               }
             },
             "$comment": "RFC 0210 §C — `exp-only` MUST NOT be advertised on `api-key` or `session`: there the host issued the credential itself, so revocation is in its own hands. The antecedent is the NEW member only, so no document that validates today can be invalidated by it. The full lane -> rule binding is deliberately NOT here (it would retroactively invalidate a committed bundle); it lives in the suite, and scripts/check-lane-revocation-rules.mjs keeps the table, this enum and the suite map in lockstep.",
-            "if": {
-              "properties": {
-                "revocation": {
-                  "const": "exp-only"
+            "allOf": [
+              {
+                "if": {
+                  "properties": {
+                    "revocation": {
+                      "const": "exp-only"
+                    }
+                  },
+                  "required": [
+                    "revocation"
+                  ]
+                },
+                "then": {
+                  "properties": {
+                    "lane": {
+                      "not": {
+                        "enum": [
+                          "api-key",
+                          "session"
+                        ]
+                      }
+                    }
+                  }
                 }
               },
-              "required": [
-                "revocation"
-              ]
-            },
-            "then": {
-              "properties": {
-                "lane": {
-                  "not": {
-                    "enum": [
-                      "api-key",
-                      "session"
-                    ]
-                  }
+              {
+                "$comment": "identity.md §2.2: every lane names a revocation rule EXCEPT `anonymous`, whose row reads \"—\" (an RFC 0132 public surface has no credential to revoke), and a host MUST NOT advertise a value its lane's row does not list. Requiring `revocation` on every lane made the anonymous lane unsatisfiable against both at once. Loosening only: every document valid before stays valid.",
+                "if": {
+                  "properties": {
+                    "lane": {
+                      "const": "anonymous"
+                    }
+                  },
+                  "required": [
+                    "lane"
+                  ]
+                },
+                "else": {
+                  "required": [
+                    "revocation"
+                  ]
                 }
               }
-            }
+            ]
           }
         },
         "subjectLinkKey": {

package/schemas/v2/certification-bundle.schema.json

@@ -259,7 +259,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-alias-covers-reword|v2-bundle-signature-attributable|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
+                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-alias-covers-reword|v2-bundle-signature-attributable|v2-bundle-witness-preimage|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-push-credential-coherent|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
                 "description": "RFC 0168 §A.1 — `openwop.<area>.<slug>`. The suite mints six areas: `requirement` (an explicit `req()` id), `it` (a per-test id from the scenario file and title), `scenario` and `floor` (per-file rows), `profile` (a claimed-profile row) and `family` (a capability gate). The lookahead refuses every id minted from a corpus-coherence file: those run in the spec repo’s CI and MUST NOT appear in a host bundle (conformance.md §\"Two products, two ledgers\"; RFC 0168 §D.1). `scripts/check-req-only.mjs` fails when the list drifts from `conformance/src/coherence/`."
               },
               "scenario": {

package/schemas/v2/chat-card-pack-manifest.schema.json

@@ -241,7 +241,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/connection-pack-manifest.schema.json

@@ -343,7 +343,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/form-content-pack-manifest.schema.json

@@ -255,7 +255,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/node-pack-manifest.schema.json

@@ -748,7 +748,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/prompt-pack-manifest.schema.json

@@ -99,7 +99,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/schemas/v2/registry-version-manifest.schema.json

@@ -191,7 +191,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4."

package/schemas/v2/run-event-payloads.schema.json

@@ -855,7 +855,7 @@
         },
         "attestation": {
           "type": "object",
-          "description": "RFC 0063 (when `capabilities.agents.subRunAttestation: true` AND the `core.subWorkflow` node sets `outputAttestation.checksum: true`). A content checksum over the child's harvested output object, computed BEFORE `outputMapping` is applied so the parent (or a downstream node) can verify integrity \u2014 host-independent because the recipe is RFC 8785 JCS canonicalization + SHA-256 (the `replay.md` recipe, RFC 0041), enabling verification of a child that ran on a different host (RFC 0040). Advisory: the host does NOT itself reject on checksum mismatch; that is parent policy.",
+          "description": "RFC 0063 (when `capabilities.agents.subRunAttestation: true` AND the `core.subWorkflow` node sets `outputAttestation.checksum: true`). A content checksum over the child's harvested output object, computed BEFORE `outputMapping` is applied so the parent (or a downstream node) can verify integrity \u2014 host-independent because the recipe is RFC 8785 JCS canonicalization + SHA-256 (the `replay.md` recipe, RFC 0041; the input MUST be I-JSON, RFC 0212), enabling verification of a child that ran on a different host (RFC 0040). Advisory: the host does NOT itself reject on checksum mismatch; that is parent policy.",
           "additionalProperties": false,
           "required": [
             "checksum",
@@ -2639,7 +2639,7 @@
         },
         "argsHash": {
           "type": "string",
-          "description": "RFC 0064 (when `capabilities.toolHooks.prePostEvents`). SHA-256 over RFC 8785 JCS-canonicalized args with resolved secrets already redacted (SR-1) \u2014 the SIEM-safe, content-free alternative to `inputs`. Raw key material MUST NOT enter the hash input."
+          "description": "RFC 0064 (when `capabilities.toolHooks.prePostEvents`). SHA-256 over RFC 8785 JCS-canonicalized args with resolved secrets already redacted (SR-1) \u2014 the SIEM-safe, content-free alternative to `inputs`. Raw key material MUST NOT enter the hash input. The args MUST be I-JSON (RFC 0212)."
         },
         "principal": {
           "type": "string",

package/schemas/v2/workflow-chain-pack-manifest.schema.json

@@ -588,7 +588,7 @@
         },
         "scheme": {
           "const": "ed25519-canonical-json",
-          "description": "RFC 0177 §C.3 — one scheme: a detached 64-byte Ed25519 signature over the canonical-JSON pack.json inside a deterministic tarball. method and publicKeyRef are gone."
+          "description": "RFC 0177 §C.3, RFC 0212 — one scheme: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of pack.json inside a deterministic tarball; the input MUST be I-JSON (spec/v2/core/conformance.md §Canonical JSON). method and publicKeyRef are gone."
         }
       },
       "description": "RFC 0177 §C.3/§C.4 — OPTIONAL on a bare manifest (an authoring-time pack.json exists before it is signed); when present it is the same closed { keyId, scheme } block a version manifest carries (registry-version-manifest.schema.json). The v1 { publicKeyRef, signatureRef, method } block does not exist in v2 (migration row openwop.migration.C10.1)."

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.37.1"
+      "version": "2.39.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -420,5 +420,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "b8e59ac3685c06d6a7599f0b1e03b52d9aff3d9fb86c8b08b0188fce8026d1c0"
+  "digest": "32e3c100f74e0b6199f84253b871fec4efd1e4718eb18e083325be540afb10f2"
 }

package/spec/v2/core/conformance.md

@@ -61,17 +61,23 @@ A certification bundle validates against `schemas/v2/certification-bundle.schema
 | `discovery` | `url`, `sha256`, `protocolVersions`, `preferredVersion` REQUIRED |
 | `claimedProfiles[]` | `id`, `evidenceTier` (`self` \| `steward` \| `independent`), `witnessCount`, `certified` REQUIRED |
 | `results` | `totals` and the per-requirement list REQUIRED |
-| `witnessSha256` | REQUIRED; covers the reporter record and, when any are declared, `host.relaxations[]` |
+| `witnessSha256` | REQUIRED; SHA-256 of the preimage in §"Canonical JSON" |
 | `assertionCount` | REQUIRED, ≥ 1 |
 | `detail.nonPass[]` | REQUIRED when any total other than `executedPass` is non-zero |
 | `results.requirements[].evidence` | OPTIONAL, closed; structured evidence on an `executed-pass` row (below) |
 | `durability.rung` | OPTIONAL; a claim the verifier re-derives (below) |
 | `signature` | REQUIRED |
 
-`signature` is an Ed25519 attestation over the canonical JSON of `{ witnessSha256, host.build, suite.version, discovery.sha256 }`; `over` MUST list exactly those four members. A host that signs bundles MUST publish the corresponding public keys as `signingKeys[]` in its discovery document, and `signature.keyId` MUST name one of them. A verifier MUST resolve `keyId` there — in the discovery document of the host the bundle is *about* — and MUST verify the attestation under the published key.
+`signature` is an Ed25519 attestation over the JCS bytes (§"Canonical JSON") of `{ witnessSha256, host.build, suite.version, discovery.sha256 }`; `over` MUST list exactly those four members. A host that signs bundles MUST publish the corresponding public keys as `signingKeys[]` in its discovery document, and `signature.keyId` MUST name one of them. A verifier MUST resolve `keyId` there — in the discovery document of the host the bundle is *about* — and MUST verify the attestation under the published key.
 
 A signature that cannot be resolved to a published key attests **integrity only**. Such a bundle MUST NOT be read as attributable evidence, and a gate MUST distinguish three outcomes that a presence check collapses into one — *no discovery document was read*, *read and the key is not published*, and *the attestation does not verify*. A retired key MUST stay listed. `evidenceTier: independent` MUST carry a `verifierKeyId` distinct from the host's signing key; the verifier MUST refuse, not warn, on a missing or self-signed independent claim. A bundle with `totals.blocked > 0` does not certify. At major 2 a requirement a test did not observe records `blocked` even when the test asserted setup facts first; an `executed-pass` carrying a `partial-witness:` detail is reserved for a leg that observed its requirement and skipped an optional extra. A verifier MUST derive the operator's opt-outs from the signed `skipped` rows and MUST reject a bundle whose captured discovery document advertises one of them (`opted-out-but-advertised`). v1 and v2 bundles are never upgraded to v3; a bundle is evidence at its own version.
 
+### Canonical JSON
+
+Every signature and digest in this corpus is over the RFC 8785 (JCS) serialization, UTF-8 encoded (RFC 0212). The value MUST be I-JSON (RFC 7493): a signer or hasher MUST refuse, not coerce, a value with duplicate member names, a lone surrogate, a non-finite number, an integer literal whose magnitude exceeds 2^53 − 1, or a non-JSON value, and a verifier that meets one in a document it must re-canonicalize MUST fail verification. `conformance/vectors/jcs-v1.json` is normative.
+
+`witnessSha256` is SHA-256 over the JCS bytes of the rows — one object per `results.requirements[]` entry with exactly `id`, `scenario`, `result` and, each only when present, `assertions`, `detail`, `evidence`, sorted by `id` in UTF-16 code-unit order — or, only when `host.relaxations[]` is non-empty, of `{ "rows": …, "relaxations": … }` with relaxations in the order carried. A locale-sensitive comparator MUST NOT be used. `discovery.sha256` is SHA-256 over the JCS bytes of the captured document.
+
 ### Recovery evidence
 
 Recovery evidence (RFC 0158 §E) rides on rows, which `witnessSha256` digests: a row's `evidence` enters the digest only when present, and a bundle without it digests as it always did.

package/spec/v2/core/interop.md

@@ -77,6 +77,12 @@ A host MAY serve the MCP Tasks extension `io.modelcontextprotocol/tasks` (revisi
 
 `auth-required` remains a member of the persisted A2A task state enum (`schemas/v2/a2a-task-state.schema.json`) for the reverse direction (consuming an external A2A agent). The forward projection MUST emit it, with `interruptKind: credential` and a status message carrying `connectUrl`, for a run suspended on a `credential` interrupt (interrupt.md), and MUST NOT emit it otherwise.
 
+## A2A push delivery (RFC 0214)
+
+A host advertising `a2a.pushNotifications` treats each push as a webhook egress: webhooks.md §Egress binds at delivery time as well as registration, a `3xx` is a failed delivery, and the push credential is bound as security-defaults.md §"Onward hops" states. It MUST attempt each push at least once; a host that retries follows `webhooks.md` `retryPolicy` semantics. The body is an A2A 1.0 `StreamResponse` sent as `application/a2a+json`, carrying `Authorization: {scheme} {credentials}` from the config; when only `token` is set a host SHOULD send it as `Authorization: Bearer <token>` (A2A v1.0.1 leaves its carriage undefined). A host MUST NOT add an OpenWOP signature. Push dead-letters are not visible to A2A clients; a client recovers with `GetTask`.
+
+A `replay` fork MUST NOT push re-emitted history, and no fork inherits a source run's push configs. A push-config read or delete on a task the caller cannot read, or naming a `configId` that is not that task's, MUST answer exactly as for an unknown id, apart from the JSON-RPC `id`; a `configId` MUST NOT encode a tenant, workspace or principal, and delete is idempotent.
+
 ## Per-agent cards
 
 A host advertising `a2a.agentCards` MUST also offer the `a2a-1.0` profile and `agents.manifestRuntime`, and MUST declare `capabilities.extendedAgentCard: true` on its public card. It publishes each entry of a caller's agent inventory (`GET /agents`) as an A2A `AgentCard`, reached through the entry's `a2aTenant`: an opaque routing value `R` the host mints, stable for the agent and host version, that MUST NOT encode a tenant, workspace, or principal.

package/spec/v2/core/packs.md

@@ -64,7 +64,7 @@ There is one signing scheme. `signing` on a version manifest (`schemas/v2/regist
 
 | Field | Rule |
 | --- | --- |
-| `scheme` | MUST be `ed25519-canonical-json`: a detached 64-byte Ed25519 signature over the canonical-JSON `pack.json` inside a deterministic tarball |
+| `scheme` | MUST be `ed25519-canonical-json`: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of `pack.json` inside a deterministic tarball; the input MUST satisfy `conformance.md` §"Canonical JSON" (RFC 0212) |
 | `keyId` | the signing key id; `publicKeyRef` does not exist |
 | `method` | does not exist; a manifest carrying it fails validation |
 

package/spec/v2/core/replay.md

@@ -68,7 +68,7 @@ For a fork with `mode: replay`:
 
 Pure nodes and LLM calls served from the invocation log MUST re-execute live; otherwise divergence detection is vacuous.
 
-**Fan-out.** A host that projects its log outward — webhook delivery, outbound streams, analytics or audit sinks — MUST NOT deliver events a replay re-emits as fixed history. Replay-ness MUST be read from the run, never from the event type; the fork's own log MUST still carry the re-emitted events (webhooks.md).
+**Fan-out.** A host that projects its log outward — webhook delivery, A2A push, outbound streams, analytics or audit sinks — MUST NOT deliver events a replay re-emits as fixed history, and a fork of either mode MUST NOT inherit its source's A2A push configs. Replay-ness MUST be read from the run, never from the event type; the fork's own log MUST still carry the re-emitted events (webhooks.md).
 
 **Branch.** A branch re-fires effects for sequences `>= fromSeq`; those are effects the operator asked for. A host MAY suppress branch effects and MUST NOT report that as replay suppression. A host SHOULD surface the re-fire in operator-facing fork UI.
 

package/spec/v2/core/security-defaults.md

@@ -62,7 +62,7 @@ A host that advertises `idempotency` MUST serve `GET /runs/{runId}/effects`; the
 
 ### Onward hops
 
-A host MUST NOT attach a credential it received inbound (an `Authorization`, `Cookie` or `Proxy-Authorization` value, a DPoP proof, an interrupt token, a peer's bearer, or credential material carried in a body) to any outbound request: A2A, MCP, webhook, callback, `httpClient` or connector. Outbound authentication uses only credentials the host holds for that destination (oauth.md). A verified delegation chain is not a passthrough: it carries provenance, never the inbound credential (identity.md §2.4).
+A host MUST NOT attach a credential it received inbound (an `Authorization`, `Cookie` or `Proxy-Authorization` value, a DPoP proof, an interrupt token, a peer's bearer, or credential material carried in a body) to any outbound request: A2A, MCP, webhook, callback, `httpClient` or connector. Outbound authentication uses only credentials the host holds for that destination (oauth.md). A verified delegation chain is not a passthrough: it carries provenance, never the inbound credential (identity.md §2.4). One credential is not inbound in this sense: an A2A push-config credential (`authentication.credentials`, `token`) is one the client gave the host for its registered push URL. A host MAY attach it only to a push delivery to that URL's origin, MUST NOT attach it after a redirect or to any other request, MUST discard it when the config is deleted or the task's final push is attempted, and MUST hold it by reference outside the event log, run state, debug bundle and every response (interop.md §"A2A push delivery", RFC 0214).
 
 A host advertising `purposePropagation` MUST re-emit a `permittedPurposes` label it received (A2A `metadata.openwop.permittedPurposes`, `TriggerEvent.permittedPurposes`) on every onward hop of the same data, narrowing and never widening, and MUST treat `[]` as no onward use; `purposePropagation.propagatesOnward` is `false` only on a host with no onward hop. The family advertises propagation, not enforcement.
 

package/spec/v2/core/webhooks.md

@@ -76,6 +76,6 @@ A host MUST NOT deliver events a `replay` fork re-emits as fixed history; replay
 
 ## Egress
 
-At registration a host MUST reject (`400 webhook_url_rejected`) non-`https://` URLs, RFC 1918 and loopback and link-local ranges, IPv6 ULA, cloud metadata hosts, and `localhost`. At delivery time a host MUST re-resolve the hostname, validate every resolved address against the same denied ranges plus its own denylist, connect to the validated address without re-resolving, and refuse to follow redirects (invariant `webhook-delivery-egress-revalidation`, reference-impl tier). An IPv4-mapped IPv6 address (`::ffff:0:0/96`) MUST be judged by the IPv4 address it embeds, whatever its spelling. An address embedding IPv4 in another standard translation form (IPv4-compatible `::/96`, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`) SHOULD be judged the same way, and those prefixes SHOULD NOT be denied wholesale. A host SHOULD refuse every destination the IANA special-purpose address registries mark not globally reachable (RFC 0196 §B).
+At registration a host MUST reject (`400 webhook_url_rejected`) non-`https://` URLs, RFC 1918 and loopback and link-local ranges, IPv6 ULA, cloud metadata hosts, and `localhost`. At delivery time a host MUST re-resolve the hostname, validate every resolved address against the same denied ranges plus its own denylist, connect to the validated address without re-resolving, and refuse to follow redirects (invariant `webhook-delivery-egress-revalidation`, reference-impl tier). An IPv4-mapped IPv6 address (`::ffff:0:0/96`) MUST be judged by the IPv4 address it embeds, whatever its spelling. An address embedding IPv4 in another standard translation form (IPv4-compatible `::/96`, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`) SHOULD be judged the same way, and those prefixes SHOULD NOT be denied wholesale. A host SHOULD refuse every destination the IANA special-purpose address registries mark not globally reachable (RFC 0196 §B). These delivery-time rules bind an A2A push identically (interop.md §"A2A push delivery").
 
 See also: events.md, replay.md, persistence.md, security-defaults.md.

package/spec/v2/facets/auth.schema.json

@@ -10,7 +10,6 @@
         "required": [
           "lane",
           "issuers",
-          "revocation",
           "minimumAssurance"
         ],
         "properties": {
@@ -77,28 +76,50 @@
           }
         },
         "$comment": "RFC 0210 §C — `exp-only` MUST NOT be advertised on `api-key` or `session`: there the host issued the credential itself, so revocation is in its own hands. The antecedent is the NEW member only, so no document that validates today can be invalidated by it. The full lane -> rule binding is deliberately NOT here (it would retroactively invalidate a committed bundle); it lives in the suite, and scripts/check-lane-revocation-rules.mjs keeps the table, this enum and the suite map in lockstep.",
-        "if": {
-          "properties": {
-            "revocation": {
-              "const": "exp-only"
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "revocation": {
+                  "const": "exp-only"
+                }
+              },
+              "required": [
+                "revocation"
+              ]
+            },
+            "then": {
+              "properties": {
+                "lane": {
+                  "not": {
+                    "enum": [
+                      "api-key",
+                      "session"
+                    ]
+                  }
+                }
+              }
             }
           },
-          "required": [
-            "revocation"
-          ]
-        },
-        "then": {
-          "properties": {
-            "lane": {
-              "not": {
-                "enum": [
-                  "api-key",
-                  "session"
-                ]
-              }
+          {
+            "$comment": "identity.md §2.2: every lane names a revocation rule EXCEPT `anonymous`, whose row reads \"—\" (an RFC 0132 public surface has no credential to revoke), and a host MUST NOT advertise a value its lane's row does not list. Requiring `revocation` on every lane made the anonymous lane unsatisfiable against both at once. Loosening only: every document valid before stays valid.",
+            "if": {
+              "properties": {
+                "lane": {
+                  "const": "anonymous"
+                }
+              },
+              "required": [
+                "lane"
+              ]
+            },
+            "else": {
+              "required": [
+                "revocation"
+              ]
             }
           }
-        }
+        ]
       }
     },
     "subjectLinkKey": {

package/spec/v2/interop-map.json

@@ -109,7 +109,7 @@
         "requires": [
           "a2a.pushNotifications"
         ],
-        "rule": "Persists A2ATaskState.pushConfig. url MUST pass the webhooks.md egress guard, scheme and address arms both; token and authentication.credentials are secrets held by reference and MUST NOT enter the event log, the persisted A2ATaskState or a debug bundle. Unadvertised: PushNotificationNotSupportedError."
+        "rule": "Persists A2ATaskState.pushConfig. url MUST pass the webhooks.md egress guard at registration (scheme and address arms both) and again at delivery (interop.md §\"A2A push delivery\"); token and authentication.credentials are a destination credential held by reference (security-defaults.md §\"Onward hops\"), MUST NOT enter the event log, the persisted A2ATaskState or a debug bundle, and are sent only to the registered origin. Unadvertised: PushNotificationNotSupportedError."
       },
       {
         "upstream": "GetTaskPushNotificationConfig | ListTaskPushNotificationConfigs | DeleteTaskPushNotificationConfig",
@@ -119,7 +119,7 @@
         "requires": [
           "a2a.pushNotifications"
         ],
-        "rule": "Reads or deletes the persisted configs of a task the caller can read; secrets are never returned."
+        "rule": "Reads or deletes the persisted configs of a task the caller can read; secrets are never returned. An unreadable task or a configId that is not the task's is answered as an unknown id; delete is idempotent. Unadvertised: PushNotificationNotSupportedError."
       },
       {
         "upstream": "GetExtendedAgentCard",

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.37.1",
-  "corpusTag": "v2.37.1",
+  "version": "2.39.0",
+  "corpusTag": "v2.39.0",
   "updated": "2026-09-24"
 }

package/spec/v2/surface-baseline.json

@@ -4,7 +4,7 @@
     "schemas/v2/**/*.json",
     "spec/v2/path-manifest.json"
   ],
-  "release": "2.37.1",
+  "release": "2.39.0",
   "kinds": {
     "union": [
       "channel",