@openwop/spec-artifacts 2.39.4 → 2.40.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.39.4",
-  "corpusTag": "v2.39.4",
+  "version": "2.40.0",
+  "corpusTag": "v2.40.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "6366b5514be71098e9ea41fc81ff52bc39db1a547b353c0b344cc2a2bf5370aa",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "4d94700c79e047b6cc215e6fef77fb80d0ffaabf94c23d41b30d17061f4405f6",
-    "api/v2/asyncapi.yaml": "7189ece9f1c5170d53b81b83ddb173173df3c7ddaec650b3edc696896c1aa01a",
-    "api/v2/openapi.yaml": "873705c51c0fe43bc21e88c53b21d9e7689617c7a6e77135a967f642564e7266",
+    "api/seams-v2.yaml": "acd23b627e68bee6c886f21f4b8252f0dcb49d9deb5d4abc4c19d390f56b426a",
+    "api/v2/asyncapi.yaml": "de935d89b72a1196c0f8f9731f1c3d32cee118e81b4271365e76ffdc5c9fced6",
+    "api/v2/openapi.yaml": "0d12490c1739defdb302ec384d9dd81306d1d865c7023fda040baa846ff35c8b",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "2401fcb1c18cdd688c018b3d716ae6bca85c5e356220ee2b793bd9d81872412d",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "b221f615c14c340e2a17143a75f88256b7ac1f31cf7a3aeb237a277724ff445c",
+    "spec/v1/core-standard-manifest.json": "ca5a83168c0e6a4d73d22d32acdd4ca37bfc62297ad730df6698134caa99ebbb",
     "spec/v1/deprecations.json": "2d03f4729810280147ea08c630ea65434f2dc5370567d0aac41c3595f8337d40",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "76b986a5d12be1c5dc9368bc79c6d8aa99a5e916b3cca3fc3eb6a84577f1f32a",
+    "spec/v1/gaps.json": "468d5b60f5e8b276f895833ac072c3984ab104d0ad97c4d31b757290c6077172",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -240,7 +240,7 @@
     "spec/v2/core/security-defaults.md": "500471a8db7af9b776ac40b4a9a278c9f3d45e1c1dead880114e7fadc7bee37d",
     "spec/v2/core/tool-catalog.md": "35f1a3fd509db0fc0490ddf400686fe94dc4b20c98064d5ebe776da516153e60",
     "spec/v2/core/versioning.md": "0aded71d090c8358c3ce17763c120cfc1cc42531a5eaa1b8a2a7016ed9594069",
-    "spec/v2/core/webhooks.md": "9c9169d775875f72982ed3506c1bfe27546ad05806d114af103dd7c28d4d5122",
+    "spec/v2/core/webhooks.md": "95880896e37e5b7096693a75203cf0ed70cefa09959230e17b45aa9193078eff",
     "spec/v2/core/workflow-chain-packs.md": "ee45d3fede3bb6f0cc6abcf0d6c929c7cd213a0fbe862b738a998f929c4d1102",
     "spec/v2/corrections.json": "cc74ffde74384b0f261a4f625871d922e8661d654d647a8534e21036595cb280",
     "spec/v2/corrections.schema.json": "4ac595b9a6d7f66d53de03fe0edbe0dc58de46426932387bfdc0ceb3cf949a3e",
@@ -292,9 +292,9 @@
     "spec/v2/path-manifest.json": "ae9b56d03a701061fd48ad0b73cb0373493f6a4547da92763b422295b5e19535",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "8fc2cf9fee817def51a3fc494b3bb602fc80ab270cdc5c94f682851468a65503",
+    "spec/v2/release.json": "f17a7e0066d7851adfb246c586f12199d14fee60bf7a0eda203a124116dcff9e",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "68f4a5b6b121d58be3d8baf0d3a58fa7cb4b1c0067e989f036f8f0dd129b46b7"
+    "spec/v2/surface-baseline.json": "2ba53481583261c59008da86d1db82ed9f657675dfe2f8b019ec7d82f5bdb4b4"
   },
-  "corpusCommit": "dd6d1218b745d600af9095a0a7458ba6cdeab3d1"
+  "corpusCommit": "44b89e1e50f56dd2a0834771225b8e04d2bd9e6f"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.39.4
+  version: 2.40.0
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries
@@ -747,6 +747,55 @@ paths:
           $ref: '#/components/responses/ValidationError'
         '401':
           $ref: '#/components/responses/Unauthenticated'
+  /conformance/seams/sample/test/idempotency/hold:
+    post:
+      tags:
+      - Seams
+      operationId: armIdempotencyHold
+      summary: Hold the caller's next same-key create in flight — RFC 0213 §B witness
+      description: 'Arms a single-use hold: the caller tenant''s next real `POST /runs` carrying `key` as its Idempotency-Key
+        keeps its Layer-1 claim in flight for `holdMs` after claiming, then completes normally. The seam MUST NOT answer a
+        create or emit a 409: the refusal a concurrent same-key create receives while the claim is held comes from the host''s
+        production in-flight branch (idempotency.md §Concurrency). Keyed by (tenant, key); single-use; an unarmed key is never
+        delayed.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - key
+              - holdMs
+              properties:
+                key:
+                  type: string
+                  pattern: ^[A-Za-z0-9._~-]{22,128}$
+                holdMs:
+                  type: integer
+                  minimum: 1
+                  maximum: 10000
+      responses:
+        '201':
+          description: The hold is armed.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - key
+                - holdMs
+                properties:
+                  key:
+                    type: string
+                  holdMs:
+                    type: integer
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
   /conformance/seams/sample/webhooks/receive:
     post:
       tags:
@@ -980,6 +1029,104 @@ paths:
           $ref: '#/components/responses/Unauthenticated'
         '404':
           $ref: '#/components/responses/NotFound'
+  /conformance/seams/sample/auth/credential/mint:
+    post:
+      tags:
+      - Seams
+      operationId: mintLaneCredential
+      summary: Mint a fresh credential on an advertised lane for the caller's tenant — RFC 0170 §B.3 witness
+      description: 'Issues a new credential on `lane` (an advertised `auth.lanes[].lane` whose `revocation` is `next-request`;
+        absent ⇒ `api-key`) for the AUTHENTICATED caller''s tenant, through the host''s PRODUCTION issuance path, so the credential
+        it returns authenticates on the canonical API exactly as an ordinary one does. The suite uses it only to hold a credential
+        it can then revoke: the revocation, and the refusal on the next request (`401 credential_revoked`), are production
+        behaviour the seam does not simulate. A host that has not wired the seam answers `404`, and the scenario records the
+        requirement unobserved.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              properties:
+                lane:
+                  type: string
+                  minLength: 1
+                  description: An advertised `auth.lanes[].lane`; absent ⇒ `api-key`.
+      responses:
+        '201':
+          description: The minted credential.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - lane
+                - credential
+                properties:
+                  lane:
+                    type: string
+                  credential:
+                    type: string
+                    minLength: 1
+                    description: 'The bearer credential, presented as `Authorization: Bearer <credential>`.'
+                  subjectId:
+                    type: string
+                    description: The Subject the credential authenticates as, when the host names one.
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '404':
+          $ref: '#/components/responses/NotFound'
+  /conformance/seams/sample/auth/credential/revoke:
+    post:
+      tags:
+      - Seams
+      operationId: revokeLaneCredential
+      summary: Revoke a credential the mint seam issued — RFC 0170 §B.3 witness
+      description: Revokes `credential` through the host's PRODUCTION revocation path. On a `next-request` lane the very next
+        request presenting it MUST be refused `401 credential_revoked` (identity.md §2.2); the suite observes that on the
+        canonical API, not through this seam. `404` when no active credential matches.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - credential
+              properties:
+                lane:
+                  type: string
+                  minLength: 1
+                credential:
+                  type: string
+                  minLength: 1
+      responses:
+        '200':
+          description: The credential is revoked.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - revoked
+                properties:
+                  revoked:
+                    type: boolean
+                    const: true
+                  lane:
+                    type: string
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '404':
+          $ref: '#/components/responses/NotFound'
 components:
   securitySchemes:
     ApiKeyAuth:

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.39.4
+  version: 2.40.0
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.39.4
+  version: 2.40.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.39.4",
+  "version": "2.40.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.39.4"
+      "version": "2.40.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -420,5 +420,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "269b3471e179f88b31b89aac4103cca604297034256922ff99372e3879ff7396"
+  "digest": "0b4806ae6ef9fc2e593216c486384bf915130e5b51ac879528d9362b2107ddb0"
 }

package/spec/v1/gaps.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./gaps.schema.json",
   "version": 1,
-  "updated": "2026-09-24",
+  "updated": "2026-09-26",
   "witnessClasses": [
     "witnessable-unaided",
     "witnessable-gated",
@@ -12668,8 +12668,8 @@
       "surface": "No `SECURITY/threat-model-*.md` covers availability or noisy-neighbour abuse. `webhook-delivery-isolation` has no threat model to cite, and `secret-leakage` does not fit a delay.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "SECURITY/invariants.yaml",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0215-webhook-delivery-isolation.gaps.md",
@@ -12685,8 +12685,8 @@
       "surface": "The cross-tenant leg needs tenant A to hold at least the §A.2 floor of attempts open while tenant B's delivery is observed. Its pass condition is a SHOULD, so it reports. Whether a reporting leg belongs in the certified bundle, or only in the run log, is not decided.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "conformance/src/scenarios",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0215-webhook-delivery-isolation.gaps.md",
@@ -12719,8 +12719,8 @@
       "surface": "The floor of 8 is chosen to exceed the one measured claim batch (openwop-app, 5), not derived from prior art. Hosted webhook services' published delivery designs were not surveyed.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "rfc-0215",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0215-webhook-delivery-isolation.gaps.md",

package/spec/v2/core/webhooks.md

@@ -16,6 +16,8 @@ A host that advertises `webhooks` (capabilities.md) serves `registerWebhook` (`P
 | `registerWebhook` | `{ url, events[], secret?, tags?, signatureAlgorithms? }`; `url` MUST be `https://`; `events[]` MUST be non-empty v2 event type names (events.md) | `201 { webhookId }` |
 | `unregisterWebhook` | path `webhookId` | `204`; `404` when unknown; `403` when the caller is outside the subscription's tenant |
 
+A `204` from `unregisterWebhook` ends the subscription's deliveries, including retries already scheduled (§Durability; RFC 0215 §B).
+
 A subscription MUST receive only events from runs within its tenant scope; cross-tenant delivery is a protocol violation whatever the filter says (invariant `webhook-cross-tenant-isolation`). `tags` narrows delivery to runs whose options carry an overlapping tag.
 
 ## Delivery
@@ -66,6 +68,9 @@ Durable delivery is an obligation of the `webhooks` surface (RFC 0173 §B; secur
 - retry a failed attempt per its advertised `retryPolicy` (`maxAttempts`, `backoff ∈ none | fixed | exponential`) with backoff between attempts;
 - route a delivery whose retries are exhausted to the dead-letter sink, rather than drop it. A host advertising `webhooks.deadLetter` MUST serve `GET /webhooks/{webhookId}/dead-letters` (RFC 0188), and that record MUST NOT carry the delivered body, the delivery headers, or the subscription secret — a dead-letter read names a delivery, it does not replay one. This sink is the DELIVERY sink; the `deadLetter` family (RFC 0053) is the RUN sink and is a different thing;
 - deliver each matching event at least once; a receiver MAY observe the same event more than once;
+- not make the start of an attempt to one subscription wait for an attempt to a *different* subscription to finish (answered, failed, or timed out): one subscription's slow or dead receiver MUST NOT delay another subscription's deliveries (invariant `webhook-delivery-isolation`, RFC 0215 §A.1). The rule is about when an attempt starts, not how soon after an event it must start, and it names no mechanism: a lane per subscription, a concurrent pool or asynchronous I/O all meet it, and a sequential loop over a batch does not;
+- sustain that while at least **8** subscriptions have attempts outstanding that their receivers have not answered (RFC 0215 §A.2). A host MAY bound concurrent attempts beyond that, and SHOULD NOT let one tenant's unanswered attempts occupy capacity another tenant's deliveries need (§A.3);
+- after `unregisterWebhook` answers `204`, not start any further attempt for that subscription, including attempts already scheduled for retry (invariant `webhook-unregister-stops-delivery`, RFC 0215 §B). An attempt whose request the host had begun sending before the `204` MAY complete. The unregister does not oblige the host to route that subscription's undelivered events to the dead-letter sink: the exhaustion rule above governs deliveries of a live subscription;
 - dead-letter a `payload_unprojectable` delivery (events.md §Era-2) on the first attempt, never retry it.
 
 Best-effort delivery is not a conforming mode. A `3xx` response is a delivery failure, retried under the same policy. `webhook-durable-delivery` witnesses it.

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.39.4",
-  "corpusTag": "v2.39.4",
-  "updated": "2026-09-25"
+  "version": "2.40.0",
+  "corpusTag": "v2.40.0",
+  "updated": "2026-09-26"
 }

package/spec/v2/surface-baseline.json

@@ -4,7 +4,7 @@
     "schemas/v2/**/*.json",
     "spec/v2/path-manifest.json"
   ],
-  "release": "2.39.4",
+  "release": "2.40.0",
   "kinds": {
     "union": [
       "channel",