@openwop/spec-artifacts 2.42.5 → 2.42.7

package/spec/v2/core/webhooks.md

@@ -1,33 +1,34 @@
 # Webhooks
 
-> **Status: Stable · RFC 0165 §C.1, 0173 §B, 0176 §D.2, 0171 §A.4, 0215, 0217.**
+> **Status: Stable.**
 > **Normative home:** `webhooks`.
 
 ## Why this exists
 
-A client registers a URL and an event filter once; the host POSTs matching events, signed, as they happen. In v2 durable delivery binds with the surface — a signed event that may be dropped is not a delivery contract.
+A client registers a URL and an event filter once; the host POSTs matching events, signed, as they happen. Durable delivery binds with the surface — a signed event that may be dropped is not a delivery contract.
 
 ## Surfaces
 
-A host that advertises `webhooks` (capabilities.md) serves `registerWebhook` (`POST /webhooks`) and `unregisterWebhook` (`DELETE /webhooks/{webhookId}`) from `api/v2/openapi.yaml`. The facet (`spec/v2/facets/webhooks.schema.json`) is `{ signatureAlgorithms[] }`, which MUST list `"v1"`; there is no `durable` field.
+A host that advertises `webhooks` ([capabilities.md](capabilities.md)) serves `registerWebhook` (`POST /webhooks`) and `unregisterWebhook` (`DELETE /webhooks/{webhookId}`) from `api/v2/openapi.yaml`. The facet (`spec/v2/facets/webhooks.schema.json`) is `{ signatureAlgorithms[] }`, which MUST list `"v1"`.
 
 | Operation | Request | Response |
 | --- | --- | --- |
-| `registerWebhook` | `{ url, events[], secret?, tags?, signatureAlgorithms? }`; `url` MUST be `https://`; `events[]` MUST be non-empty v2 event type names (events.md) | `201 { webhookId }` |
+| `registerWebhook` | `{ url, events[], secret?, tags?, signatureAlgorithms? }` | `201 { webhookId }` |
 | `unregisterWebhook` | path `webhookId` | `204`; `404` when unknown; `403` when the caller is outside the subscription's tenant |
 
-A `204` from `unregisterWebhook` ends the subscription's deliveries, including retries already scheduled (§Durability; RFC 0215 §B).
+On `registerWebhook`, `url` MUST be `https://` and `events[]` MUST be non-empty v2 event type names ([events.md](events.md)).
+
+A `204` from `unregisterWebhook` ends the subscription's deliveries, including retries already scheduled (§Durability).
 
 A subscription MUST receive only events from runs within its tenant scope; cross-tenant delivery is a protocol violation whatever the filter says (invariant `webhook-cross-tenant-isolation`). `tags` narrows delivery to runs whose options carry an overlapping tag.
 
 ## Delivery
 
-The delivery envelope is generated from the event's payload definition (events.md §Payloads). The body is `{ runId, workspaceId?, event }` where `event` is the verbatim run event (events.md), and it MUST validate against `schemas/v2/webhook-delivery.schema.json`. `workspaceId` is present exactly when `RunSnapshot.owner.workspace` is (`identity.md` §1) — a host MUST NOT substitute its tenant id for an absent workspace.
+The delivery envelope is generated from the event's payload definition (events.md §Payloads). The body is `{ runId, workspaceId?, event }`, where `event` is the verbatim run event.
 
-The envelope's `runId` MUST use the tenant-bound v2 form defined by
-`identity.md` §5, matching the nested event and every response representation.
-This requirement applies to outbound delivery even though no versioned request
-exists at delivery time.
+- The body MUST validate against `schemas/v2/webhook-delivery.schema.json`.
+- `workspaceId` is present exactly when `RunSnapshot.owner.workspace` is ([identity.md §1](identity.md)); a host MUST NOT substitute its tenant id for an absent workspace.
+- The envelope's `runId` MUST use the tenant-bound form of [identity.md §5](identity.md), matching the nested event and every response representation, even though no versioned request exists at delivery time.
 
 ### Headers
 
@@ -43,15 +44,21 @@ A host MUST send all five on every delivery. The signed bytes are `{timestamp}.{
 
 ### Verification
 
-A subscriber MUST verify before acting: reject a timestamp more than ±5 minutes from its clock; compute `HMAC-SHA256({timestamp}.{rawBody}, secret)`; compare in constant time. A subscriber MUST reject an unrecognized `OpenWOP-Signature-Algorithm` value. Subscribers SHOULD track `(OpenWOP-Webhook-Id, runId, sequence)` for at-least-once deduplication. A host MUST NOT log the secret.
+A subscriber MUST verify before acting:
+
+1. Reject a timestamp more than ±5 minutes from its clock.
+2. Compute `HMAC-SHA256({timestamp}.{rawBody}, secret)`.
+3. Compare in constant time.
+
+A subscriber MUST reject an unrecognized `OpenWOP-Signature-Algorithm` value, and SHOULD track `(OpenWOP-Webhook-Id, runId, sequence)` for at-least-once deduplication. A host MUST NOT log the secret.
 
 ### Standard Webhooks
 
-`standard-webhooks-1` names the symmetric scheme of Standard Webhooks 1.0.0 (RFC 0201). Its in-header `v1,` token is that standard's, not the OpenWOP scheme id `v1`; neither is read as the other, and `OpenWOP-Signature-Algorithm` stays `v1`.
+`standard-webhooks-1` names the symmetric scheme of Standard Webhooks 1.0.0. Its in-header `v1,` token is that standard's, not the OpenWOP scheme id `v1`; neither is read as the other, and `OpenWOP-Signature-Algorithm` stays `v1`.
 
 **Opt-in.** A subscription carries the scheme only when `registerWebhook` sends `signatureAlgorithms` listing it and `v1`, with a `secret` of the form `whsec_<base64 of 24–64 bytes>`; otherwise, or when the host does not advertise the id, `400 validation_error`. The `201` echoes the applied list. Every other subscription is unchanged.
 
-**Endpoint verification.** Before answering `201`, the host MUST send the request of `schemas/v2/webhook-verification.schema.json` to `url` under §Egress, signed as below, and MUST refuse `400 webhook_endpoint_unverified`, persisting nothing, unless a `2xx` arrives within 10 s whose JSON `challenge` equals the one sent. A host MUST NOT verify a subscription that did not opt in.
+**Endpoint verification.** Before answering `201`, a host MUST send the request of `schemas/v2/webhook-verification.schema.json` to `url` under §Egress, signed as below. Unless a `2xx` arrives within 10 s whose JSON `challenge` equals the one sent, it MUST refuse `400 webhook_endpoint_unverified`, persisting nothing. A host MUST NOT verify a subscription that did not opt in.
 
 **Delivery.** Each delivery to an opted-in subscription adds `webhook-id`, `webhook-timestamp` (equal to `OpenWOP-Timestamp`) and `webhook-signature`: space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{rawBody}`, keyed by the decoded secret. `webhook-id` matches `^[A-Za-z0-9_-]{16,128}$`, MUST be identical on every attempt of one `(webhookId, runId, sequence)` and MUST differ across them.
 
@@ -59,28 +66,60 @@ A subscriber MUST verify before acting: reject a timestamp more than ±5 minutes
 
 ### Dual emission through the overlap
 
-A host advertising both majors MUST send, on every delivery, the `X-openwop-*` family alongside the `OpenWOP-*` family with identical values (RFC 0165 §C.1, RFC 0176 §D.2). A v2 receiver MUST accept a delivery carrying only the `X-openwop-*` family under scheme `v1`, verifying the same bytes. This adds no signature scheme. Per-subscription secrets are unchanged across the cut; deliveries queued before the cut are drained under their own retry policy with the payload they were serialized with (persistence.md). The `X-openwop-*` family is removed on its register date.
+- A host advertising both majors MUST send, on every delivery, the `X-openwop-*` family alongside the `OpenWOP-*` family with identical values. This adds no signature scheme.
+- A v2 receiver MUST accept a delivery carrying only the `X-openwop-*` family under scheme `v1`, verifying the same bytes.
+- Per-subscription secrets are unchanged across the cut. Deliveries queued before the cut drain under their own retry policy with the payload they were serialized with ([persistence.md](persistence.md)).
+- The `X-openwop-*` family is removed on its register date.
 
 ## Durability
 
-Durable delivery is an obligation of the `webhooks` surface (RFC 0173 §B; security-defaults.md). A host MUST:
+Durable delivery is an obligation of the `webhooks` surface ([security-defaults.md](security-defaults.md)). A host MUST:
 
 - retry a failed attempt per its advertised `retryPolicy` (`maxAttempts`, `backoff ∈ none | fixed | exponential`) with backoff between attempts;
-- route a delivery whose retries are exhausted to the dead-letter sink, rather than drop it. A host advertising `webhooks.deadLetter` MUST serve `GET /webhooks/{webhookId}/dead-letters` (RFC 0188), and that record MUST NOT carry the delivered body, the delivery headers, or the subscription secret — a dead-letter read names a delivery, it does not replay one. The read belongs to a live subscription: after `unregisterWebhook` answers `204`, `GET /webhooks/{webhookId}/dead-letters` for that id MUST answer `404 not_found`, exactly as for a same-tenant id the host never minted, and the host MAY discard that subscription's records at the unregister. `expiresAt` bounds a record's retention only while its subscription exists (RFC 0217). This sink is the DELIVERY sink; the `deadLetter` family (RFC 0053) is the RUN sink and is a different thing;
+- route a delivery whose retries are exhausted to the dead-letter sink (§Dead letters), rather than drop it;
 - deliver each matching event at least once; a receiver MAY observe the same event more than once;
-- not make the start of an attempt to one subscription wait for an attempt to a *different* subscription to finish (answered, failed, or timed out): one subscription's slow or dead receiver MUST NOT delay another subscription's deliveries (invariant `webhook-delivery-isolation`, RFC 0215 §A.1). The rule is about when an attempt starts, not how soon after an event it must start, and it names no mechanism: a lane per subscription, a concurrent pool or asynchronous I/O all meet it, and a sequential loop over a batch does not;
-- sustain that while at least **8** subscriptions have attempts outstanding that their receivers have not answered (RFC 0215 §A.2). A host MAY bound concurrent attempts beyond that, and SHOULD NOT let one tenant's unanswered attempts occupy capacity another tenant's deliveries need (§A.3);
-- after `unregisterWebhook` answers `204`, not start any further attempt for that subscription, including attempts already scheduled for retry (invariant `webhook-unregister-stops-delivery`, RFC 0215 §B). An attempt whose request the host had begun sending before the `204` MAY complete. The unregister does not oblige the host to route that subscription's undelivered events to the dead-letter sink: the exhaustion rule above governs deliveries of a live subscription;
+- not make the start of an attempt to one subscription wait for an attempt to a *different* subscription to finish (answered, failed, or timed out) (§Delivery isolation);
+- sustain that while at least **8** subscriptions have attempts outstanding that their receivers have not answered;
+- after `unregisterWebhook` answers `204`, not start any further attempt for that subscription, including attempts already scheduled for retry (invariant `webhook-unregister-stops-delivery`);
 - dead-letter a `payload_unprojectable` delivery (events.md §Era-2) on the first attempt, never retry it.
 
 Best-effort delivery is not a conforming mode. A `3xx` response is a delivery failure, retried under the same policy. `webhook-durable-delivery` witnesses it.
 
+### Delivery isolation
+
+One subscription's slow or dead receiver MUST NOT delay another subscription's deliveries (invariant `webhook-delivery-isolation`). The rule is about when an attempt starts, not how soon after an event it must start, and it names no mechanism: a lane per subscription, a concurrent pool or asynchronous I/O all meet it; a sequential loop over a batch does not.
+
+A host MAY bound concurrent attempts beyond the floor of 8, and SHOULD NOT let one tenant's unanswered attempts occupy capacity another tenant's deliveries need.
+
+### Unregister
+
+An attempt whose request the host had begun sending before `unregisterWebhook` answered `204` MAY complete. The unregister does not oblige the host to route that subscription's undelivered events to the dead-letter sink: the exhaustion rule governs deliveries of a live subscription.
+
+### Dead letters
+
+This sink is the delivery sink; the `deadLetter` family is the run sink and is a different thing.
+
+- A host advertising `webhooks.deadLetter` MUST serve `GET /webhooks/{webhookId}/dead-letters`.
+- A record MUST NOT carry the delivered body, the delivery headers, or the subscription secret — a dead-letter read names a delivery, it does not replay one.
+- The read belongs to a live subscription: after `unregisterWebhook` answers `204`, `GET /webhooks/{webhookId}/dead-letters` for that id MUST answer `404 not_found`, exactly as for a same-tenant id the host never minted. The host MAY discard that subscription's records at the unregister.
+- `expiresAt` bounds a record's retention only while its subscription exists.
+
 ## Replay
 
 A host MUST NOT deliver events a `replay` fork re-emits as fixed history; replay-ness is read from the run, never from the event type (replay.md). A `branch` fork's events are new facts and are delivered.
 
 ## Egress
 
-At registration a host MUST reject (`400 webhook_url_rejected`) non-`https://` URLs, RFC 1918 and loopback and link-local ranges, IPv6 ULA, cloud metadata hosts, and `localhost`. At delivery time a host MUST re-resolve the hostname, validate every resolved address against the same denied ranges plus its own denylist, connect to the validated address without re-resolving, and refuse to follow redirects (invariant `webhook-delivery-egress-revalidation`, reference-impl tier). An IPv4-mapped IPv6 address (`::ffff:0:0/96`) MUST be judged by the IPv4 address it embeds, whatever its spelling. An address embedding IPv4 in another standard translation form (IPv4-compatible `::/96`, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`) SHOULD be judged the same way, and those prefixes SHOULD NOT be denied wholesale. A host SHOULD refuse every destination the IANA special-purpose address registries mark not globally reachable (RFC 0196 §B). These delivery-time rules bind an A2A push identically (interop.md §"A2A push delivery").
+At registration a host MUST reject (`400 webhook_url_rejected`) non-`https://` URLs, RFC 1918 and loopback and link-local ranges, IPv6 ULA, cloud metadata hosts, and `localhost`.
+
+Address classification:
+
+- An IPv4-mapped IPv6 address (`::ffff:0:0/96`) MUST be judged by the IPv4 address it embeds, whatever its spelling.
+- An address embedding IPv4 in another standard translation form (IPv4-compatible `::/96`, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`) SHOULD be judged the same way, and those prefixes SHOULD NOT be denied wholesale.
+- A host SHOULD refuse every destination the IANA special-purpose address registries mark not globally reachable.
+
+At delivery time a host MUST re-resolve the hostname, validate every resolved address against the same denied ranges plus its own denylist, connect to the validated address without re-resolving, and refuse to follow redirects (invariant `webhook-delivery-egress-revalidation`, reference-impl tier). These delivery-time rules bind an A2A push identically (interop.md §"A2A push delivery").
 
 See also: events.md, replay.md, persistence.md, security-defaults.md.
+
+*Sources: RFC 0053, RFC 0165, RFC 0171, RFC 0173, RFC 0176, RFC 0188, RFC 0196, RFC 0201, RFC 0215, RFC 0217.*

package/spec/v2/core/workflow-chain-packs.md

@@ -1,37 +1,39 @@
 # Workflow Chain Packs
 
-> **Status: Stable · RFC 0177, RFC 0133.**
+> **Status: Stable.**
 > **Normative home:** `workflowChainPacks`.
 
 ## Why this exists
 
-A workflow-chain pack ships a reusable fragment a host expands into a concrete definition, and may compose other chains as co-registered children. The manifest is `schemas/v2/workflow-chain-pack-manifest.schema.json`; installation and signing follow packs.md.
+A workflow-chain pack ships a reusable fragment a host expands into a concrete definition, and may compose other chains as co-registered children. The manifest is `schemas/v2/workflow-chain-pack-manifest.schema.json`; installation and signing follow [packs.md](packs.md).
 
 ## Exact pins
 
-Every reference a chain makes to a node type or an external chain MUST pin an exact version per referenced `typeId` (`core.ai.callPrompt@1.0.0`). A host MUST refuse to register a chain whose reference carries a range or no version. Ranges are a v2.x additive follow-up and do not exist in v2.0.
+Every reference a chain makes to a node type or an external chain MUST pin an exact version per referenced `typeId` (`core.ai.callPrompt@1.0.0`). A host MUST refuse to register a chain whose reference carries a range or no version.
 
 ## Co-registered children
 
-When a parent chain expands a `subChainRef`, the child is registered as its own workflow under a deterministic child id. A host MUST:
+When a parent chain expands a `subChainRef`, the child is registered as its own workflow. A host MUST:
 
-| Rule | Behavior |
-| --- | --- |
-| Identity | register the child under a deterministic id, so two parents composing the same child share one registration |
-| Reference count | count each parent that references the child; deleting a parent decrements the count |
-| Deletion | delete the child only when its last parent is deleted |
-| Ownership record | persist the resolved child version in the parent's ownership record, so a re-instantiation or `:fork` reproduces the same child |
+- **Identity** — register the child under a deterministic id, so two parents composing the same child share one registration.
+- **Reference count** — count each parent that references the child; deleting a parent decrements the count.
+- **Deletion** — delete the child only when its last parent is deleted.
+- **Ownership record** — persist the resolved child version in the parent's ownership record, so a re-instantiation or `:fork` reproduces the same child.
 
-The ownership record is a persistence.md store.
+The ownership record is a [persistence.md](persistence.md) store.
 
 ## Parameter substitution
 
-`{{params.<name>}}` tokens are substituted at expansion time, when the author drops the tile. A persisted definition MUST NOT contain a `{{params.*}}` token, and a host MUST NOT defer substitution to dispatch time. A portable per-run deferral — materializing chain parameters into workflow variables bound through PromptTemplate `{{varName}}` slots and variable-sourced PortValues — is a named v2.x additive RFC and is not part of v2.0.
+`{{params.<name>}}` tokens are substituted at expansion time, when the author drops the tile. A persisted definition MUST NOT contain a `{{params.*}}` token, and a host MUST NOT defer substitution to dispatch time.
 
 ## Composition depth
 
-A host MUST bound sub-chain nesting by `workflowChainPacks.subChains.maxDepth` (capabilities.md), default 8. A composition that exceeds the depth, or that transitively composes itself, MUST fail closed with `sub_chain_cycle`; the depth check and the cycle check compose as one guard.
+A host MUST bound sub-chain nesting by `workflowChainPacks.subChains.maxDepth` ([capabilities.md](capabilities.md)), default 8. A composition that exceeds the depth, or that transitively composes itself, MUST fail closed with `sub_chain_cycle`; the depth check and the cycle check compose as one guard.
 
 ## Edge conditions
 
-Fragment edges carry the same `condition` and `triggerRule` shapes as a top-level definition (`schemas/v2/workflow-definition.schema.json`). `EdgeCondition.type` is one of `expression`, `equals`, `notEquals`, `contains`, `regex`, `truthy`, `falsy`; `truthy` and `falsy` take `left` and no `right`. A host MUST carry both fields through expansion verbatim and MUST honor them on expanded edges as on authored ones. form-content-packs.md reuses this operator set for field visibility.
+Fragment edges carry the same `condition` and `triggerRule` shapes as a top-level definition (`schemas/v2/workflow-definition.schema.json`). `EdgeCondition.type` is one of `expression`, `equals`, `notEquals`, `contains`, `regex`, `truthy`, `falsy`; `truthy` and `falsy` take `left` and no `right`.
+
+A host MUST carry both fields through expansion verbatim and MUST honor them on expanded edges as on authored ones. [form-content-packs.md](form-content-packs.md) reuses this operator set for field visibility.
+
+*Sources: RFC 0133, RFC 0177.*

package/spec/v2/corrections.json

@@ -2,7 +2,7 @@
   "$schema": "./corrections.schema.json",
   "$comment": "RFC 0197 §A.4 — v2 Class-3 corrections. Seeded with P3 only. The 2.8.2 removal of `workflowChainPacks.deferredParameters` and `.hostExpansionSeam` (P1) is deliberately NOT seeded: a committed bundle carried `deferredParameters` and then failed `capabilities-root-closed`, so the row would fail R3 — which is the point. P1 is recorded as the motivating defect in COMPATIBILITY.md §3a, not laundered into this register.",
   "version": 1,
-  "updated": "2026-09-22",
+  "updated": "2026-09-27",
   "rows": [
     {
       "id": "openwop.correction.v2.1",
@@ -27,6 +27,22 @@
         "manifestsScanned": 190,
         "note": "The prior shape is a manifest shape, not a discovery shape, so no bundle could carry it and the bundle leg is 0 by construction. The registry leg was measured at the correction: 0 of 190 published v2 pack.json documents validated against the schemas BEFORE the change and 185 of 190 after, so no published document carried the `{ publicKeyRef, signatureRef, method }` block the schemas described. `spec/v2/core/packs.md` §Signing, RFC 0177 §C.3 and migration row openwop.migration.C10.1 had already replaced it with `{ keyId, scheme }`; the schemas were the outlier against the prose, the Accepted RFC and the registry at once. `signing` stays OPTIONAL on a bare manifest, so no previously-valid unsigned document is invalidated. FragmentNode.config was closed by the v1→v2 seed against its own description, failing 73 of 81 published chain packs; reopening it narrows nothing."
       }
+    },
+    {
+      "id": "openwop.correction.v2.2",
+      "date": "2026-09-27",
+      "class": "w3c-class-3",
+      "rfc": "0172",
+      "pointers": [
+        "schemas/v2/capabilities.schema.json#/minClientVersion"
+      ],
+      "compatibilityEntry": "the v2 `minClientVersion` grammar",
+      "priorShapeCensus": {
+        "bundles": 0,
+        "manifests": 0,
+        "manifestsScanned": 156,
+        "note": "The prior shape is any string; the corrected shape is the axis-1 `<major>.<minor>` grammar that spec/v2/core/versioning.md §1.5 and the v2-min-client-version scenario already required of an advertised value. Bundle leg: all 8 committed evidence/v2-host-bundles/*.json advertise minClientVersion, and every value conforms (seven \"1.0\", MyndHyve \"0.1\"), so 0 carry a value the pattern rejects. The one \"0.1.0\" in the corpus is a major-1 witness under evidence/rfc-witnesses/, not a v2 bundle. Registry leg: minClientVersion is a discovery field, not a manifest field; 0 of 156 pack.json documents on openwop-registry origin/main (c15d3d6) carry it. The schema added a pattern only, so no property, type or required entry moved and check-v2-surface-monotone sees no change."
+      }
     }
   ]
 }

package/spec/v2/corrections.schema.json

@@ -30,7 +30,7 @@
           "description": "Every schema pointer the correction moved, as `<repo-relative file>#<INSTANCE pointer>` \u2014 the document-shaped path scripts/generate-v2-surface-baseline.mjs prints (`#/signing`, `#/chains/[]/dag/nodes/[]/config`), never the schema-shaped one (`#/properties/signing`), because a `$defs` name is not a surface. scripts/check-v2-surface-monotone.mjs matches a baseline removal against this list, so a pointer left out is a removal the monotone gate refuses.",
           "items": { "type": "string", "pattern": "^[A-Za-z0-9_./-]+#(/[^#|]*)?$" }
         },
-        "compatibilityEntry": { "type": "string", "minLength": 1, "description": "A literal substring of the COMPATIBILITY.md §3 \"correction on record\" entry. The gate fails when it drifts — a register row whose prose entry has been reworded away is an unrecorded shape change." },
+        "compatibilityEntry": { "type": "string", "minLength": 1, "description": "A literal substring of the COMPATIBILITY.md §3 \"correction on record\" entry, which is kept in docs/COMPATIBILITY-CORRECTIONS-LOG.md. The gate fails when it drifts — a register row whose prose entry has been reworded away is an unrecorded shape change." },
         "priorShapeCensus": {
           "type": "object",
           "additionalProperties": false,

package/spec/v2/declaration.json

@@ -1734,10 +1734,11 @@
       "anchor": "ext",
       "section": "ext/restTransport/",
       "peerDependencyId": "restTransport",
-      "witness": "claims-check",
+      "extensionName": "rest-transport",
+      "witness": "witnessable-gated",
       "maturity": {
         "technical": "experimental",
-        "adoption": "none"
+        "adoption": "single-witness"
       },
       "facets": [
         "conditionalRunGet",
@@ -1746,7 +1747,7 @@
       "floorScenarios": [],
       "requirementIds": [],
       "owningRfc": "0115",
-      "reason": "RFC 0169 \u00a7C.5 (claims-check; ext/ unless a behavioral witness lands)"
+      "reason": "RFC 0169 \u00a7C.5 moved it to ext/ as claims-check; RFC 0220 \u00a7C lands the behavioral witness (v2-ext-rest-transport), so the witness is witnessable-gated on the extensions.<org>.rest-transport claim. It stays ext/: becoming core takes its own RFC (ext/README.md)."
     },
     {
       "key": "a2uiSurface",
@@ -1754,7 +1755,8 @@
       "anchor": "ext",
       "section": "ext/a2uiSurface/",
       "peerDependencyId": "a2uiSurface",
-      "witness": "claims-check",
+      "extensionName": "a2ui-surface",
+      "witness": "seam-gated",
       "maturity": {
         "technical": "experimental",
         "adoption": "none"
@@ -1765,7 +1767,7 @@
       "floorScenarios": [],
       "requirementIds": [],
       "owningRfc": "0209",
-      "reason": "RFC 0169 \u00a7C.5 (claims-check; ext/); RFC 0209: the ext README is the v2 contract for `ui.a2ui-surface` schema version 2; facet `deltaTransport` deprecated for v2 (RFC 0197 retirement path)"
+      "reason": "RFC 0169 \u00a7C.5 (ext/); RFC 0220 \u00a7C: the witness is seam-gated (v2-a2ui-v09-surface drives the emit-surface seam; the family row is its family-witness leg); RFC 0209: the ext README is the v2 contract for `ui.a2ui-surface` schema version 2; facet `deltaTransport` deprecated for v2 (RFC 0197 retirement path)"
     },
     {
       "key": "brand",
@@ -1773,6 +1775,7 @@
       "anchor": "ext",
       "section": "ext/brand/",
       "peerDependencyId": "brand",
+      "extensionName": "brand",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1790,6 +1793,7 @@
       "anchor": "ext",
       "section": "ext/canvas/",
       "peerDependencyId": "canvas",
+      "extensionName": "canvas",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1807,6 +1811,7 @@
       "anchor": "ext",
       "section": "ext/chat/",
       "peerDependencyId": "chat",
+      "extensionName": "chat",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1824,6 +1829,7 @@
       "anchor": "ext",
       "section": "ext/coordination/",
       "peerDependencyId": "coordination",
+      "extensionName": "coordination",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1841,6 +1847,7 @@
       "anchor": "ext",
       "section": "ext/dataIntegration/",
       "peerDependencyId": "dataIntegration",
+      "extensionName": "data-integration",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1858,6 +1865,7 @@
       "anchor": "ext",
       "section": "ext/entities/",
       "peerDependencyId": "entities",
+      "extensionName": "entities",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1875,6 +1883,7 @@
       "anchor": "ext",
       "section": "ext/kanban/",
       "peerDependencyId": "kanban",
+      "extensionName": "kanban",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1892,6 +1901,7 @@
       "anchor": "ext",
       "section": "ext/knowledge/",
       "peerDependencyId": "knowledge",
+      "extensionName": "knowledge",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1909,6 +1919,7 @@
       "anchor": "ext",
       "section": "ext/launchStudio/",
       "peerDependencyId": "launchStudio",
+      "extensionName": "launch-studio",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1926,6 +1937,7 @@
       "anchor": "ext",
       "section": "ext/messaging/",
       "peerDependencyId": "messaging",
+      "extensionName": "messaging",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1943,6 +1955,7 @@
       "anchor": "ext",
       "section": "ext/webResearch/",
       "peerDependencyId": "webResearch",
+      "extensionName": "web-research",
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
@@ -1958,6 +1971,7 @@
   "profiles": [
     {
       "id": "openwop-discovery-core",
+      "summary": "The host publishes a valid v2 discovery document and negotiates the protocol version; it makes no claim about running workflows.",
       "predicate": {
         "families": [],
         "metadata": [
@@ -1974,6 +1988,7 @@
     },
     {
       "id": "openwop-core-standard",
+      "summary": "The host runs workflows to the executable floor: interrupts, replay, webhooks, idempotency and the event log. This is what an unqualified \"OpenWOP conformant\" claim means.",
       "predicate": {
         "families": [
           "interrupt",
@@ -1996,13 +2011,15 @@
         "v2-run-bulk-cancel",
         "v2-run-pause-resume",
         "v2-run-options-limits",
-        "v2-sse-last-event-id"
+        "v2-sse-last-event-id",
+        "v2-sse-last-event-id-cursor"
       ],
       "requirementIds": [],
-      "note": "rc.59: five unaided run-surface witnesses joined the floor \u2014 v2-run-cancel (runs.md \u00a7Cancel: 409 run_terminal on a terminal run), v2-run-bulk-cancel (\u00a7Cancel: per-entry envelopes, id_tenant_mismatch / not_found, details.maxRunIds), v2-run-pause-resume (\u00a7Pause and resume: 409 run_terminal / run_state_conflict, the literal drainPolicy echo, the immediate cut), v2-run-options-limits (capabilities.md limits metadata honoured on create), v2-sse-last-event-id (events.md \u00a7SSE frames: Last-Event-ID resumes at the next sequence, never re-emits the resumption point). cancelRun, bulkCancelRuns and pauseRun are core operations by the runs.md surface table (only ancestry, annotations and eval-summary are 404-when-unadvertised), so a host that omits one is blocked, not inapplicable, and the floor refuses it \u2014 the prose's outcome. Their optional legs (values mode, the conformance-delay / conformance-cancellable fixtures) record inapplicable with the reason and the file row stays a witnessed pass. Measured before the change: the reference host passes all five (rc.58, 179 / 0 / 0 / 42); neither production host satisfies this predicate, so no existing claim moves. seeded from spec/v1/core-standard-manifest.json at P3-B; floor minted rc.45, one or more unaided witnesses per predicate family: interrupt (token scheme), replay (the effect-seam manifest \u2014 its seam-driven no-re-fire leg lives in v2-effect-seam-no-refire on the seams floor), webhooks (durable delivery), idempotency (Layer-1 key grammar), eventLog (era key, era stamp, closed event type, poll cursor). Deliberately absent: v2-pinned-run-disposition (seam-gated and opt-in), v2-v1-signed-webhook-accepted (a coexistence scenario, driven through the seam; the cut gate is its home), v2-effect-identity-business-key (retry leg seam-driven), v2-approver-enforced (conditional on the refKinds facet)."
+      "note": "2.42.7: v2-sse-last-event-id-cursor joined the floor (events.md \u00a7SSE frames, RFC 0213 \u00a7A: Last-Event-ID is an exclusive cursor, a well-formed id past the log is not refused, and the header is read only after authorization). It was held off the floor until the three bundle hosts were measured. Measured on committed bundles, it is executed-pass on the v2 reference host (2.42.2), MyndHyve (2.42.0) and openwop-app (2.42.2 side revision); the first two carry partial-witness only for the SHOULD leg (a malformed id accepted, recorded not failed), so no existing claim moves. rc.59: five unaided run-surface witnesses joined the floor \u2014 v2-run-cancel (runs.md \u00a7Cancel: 409 run_terminal on a terminal run), v2-run-bulk-cancel (\u00a7Cancel: per-entry envelopes, id_tenant_mismatch / not_found, details.maxRunIds), v2-run-pause-resume (\u00a7Pause and resume: 409 run_terminal / run_state_conflict, the literal drainPolicy echo, the immediate cut), v2-run-options-limits (capabilities.md limits metadata honoured on create), v2-sse-last-event-id (events.md \u00a7SSE frames: Last-Event-ID resumes at the next sequence, never re-emits the resumption point). cancelRun, bulkCancelRuns and pauseRun are core operations by the runs.md surface table (only ancestry, annotations and eval-summary are 404-when-unadvertised), so a host that omits one is blocked, not inapplicable, and the floor refuses it \u2014 the prose's outcome. Their optional legs (values mode, the conformance-delay / conformance-cancellable fixtures) record inapplicable with the reason and the file row stays a witnessed pass. Measured before the change: the reference host passes all five (rc.58, 179 / 0 / 0 / 42); neither production host satisfies this predicate, so no existing claim moves. seeded from spec/v1/core-standard-manifest.json at P3-B; floor minted rc.45, one or more unaided witnesses per predicate family: interrupt (token scheme), replay (the effect-seam manifest \u2014 its seam-driven no-re-fire leg lives in v2-effect-seam-no-refire on the seams floor), webhooks (durable delivery), idempotency (Layer-1 key grammar), eventLog (era key, era stamp, closed event type, poll cursor). Deliberately absent: v2-pinned-run-disposition (seam-gated and opt-in), v2-v1-signed-webhook-accepted (a coexistence scenario, driven through the seam; the cut gate is its home), v2-effect-identity-business-key (retry leg seam-driven), v2-approver-enforced (conditional on the refKinds facet)."
     },
     {
       "id": "openwop-conformance-seams-v2",
+      "summary": "The host mounts the conformance test seams under /conformance/seams/ so the suite can drive seam-based scenarios; it is a testing surface, not a production feature.",
       "predicate": {
         "families": [],
         "metadata": [

package/spec/v2/declaration.schema.json

@@ -179,6 +179,11 @@
               "peerDependencyId": {
                 "type": "string"
               },
+              "extensionName": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+                "description": "RFC 0220 \u00a7A \u2014 ext families only (scripts/check-declaration.mjs requires it on every anchor: ext row and forbids it on core rows). The <name> half of the extensions key the family is advertised under, extensions[\"<org>.<extensionName>\"] (core/capabilities.md \u00a73.2). It is the kebab-case form of `key`: the family key is camelCase and cannot match extensionsKeyPattern, so a README that said `extensions.<org>.<key>` named a key no host could emit."
+              },
               "witness": {
                 "enum": [
                   "witnessable-unaided",
@@ -283,6 +288,11 @@
           "id": {
             "type": "string"
           },
+          "summary": {
+            "type": "string",
+            "minLength": 1,
+            "description": "One plain-English line: what claiming this profile means to an adopter. Carried into spec/v2/profiles.json."
+          },
           "predicate": {
             "type": "object",
             "additionalProperties": false,