@openwop/spec-artifacts 2.42.8 → 2.43.0

package/schemas/v2/registry-version-manifest.schema.json

@@ -238,7 +238,7 @@
     },
     "yanked": {
       "type": "boolean",
-      "description": "Hard refusal: this version was published in error. Registry MUST refuse to serve the tarball; consumers MUST refuse to dispatch nodes from yanked versions."
+      "description": "This version is yanked (spec/v2/core/packs.md §\"Version manifests\"). The registry keeps serving its manifest, tarball and signature, and its pack index never names it `latest` while an unyanked version exists. A consumer resolving a range excludes it; an exact pin MAY still resolve it."
     },
     "yankedReason": {
       "type": "string",
@@ -253,7 +253,7 @@
     "supersededBy": {
       "type": "string",
       "maxLength": 256,
-      "description": "Optional pointer to the version (or `<name>@<version>`) that replaces this one. Per spec/v1/registry-operations.md, engine consumers in `open` / `verified` mode MUST surface this value in any deprecation warning when set."
+      "description": "Optional pointer to the version (or `<name>@<version>`) that replaces this one. Display only: a consumer that refuses or warns about a deprecated version can name it (spec/v2/core/packs.md §\"Version manifests\")."
     },
     "advisoryUrl": {
       "type": "string",

package/schemas/v2/suspend-request.schema.json

@@ -299,7 +299,7 @@
             "approve",
             "escalate"
           ],
-          "description": "RFC 0186 §A.3 — the disposition applied when `timeoutMs` elapses with no resolution. Every gate with a timer needs one; two production hosts recorded it as a bare key on `approval.requested` (280 rows on one) because the seat did not exist. `escalate` pairs with a host-defined escalation target. A `timeoutMs` of `0` means no timer, and `onTimeout` is then meaningless."
+          "description": "RFC 0186 §A.3 — the disposition applied when `timeoutMs` elapses with no resolution. Every gate with a timer needs one; two production hosts recorded it as a bare key on `approval.requested` (280 rows on one) because the seat did not exist. `escalate` pairs with a host-defined escalation target. A `timeoutMs` of `0` means no timer, and `onTimeout` is then meaningless. Absent means `reject` (RFC 0223; interrupt.md §Rejection): the gate fails closed, the node and run fail with `approval_rejected` unless an edge routes the failure. No JSON-Schema `default` is declared, because a validator that fills defaults would write a value the host never recorded."
         },
         "description": {
           "type": "string"

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.42.8"
+      "version": "2.43.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -421,5 +421,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "62b69d4ef9ff05f730a2e6bc253709a13a03c336eb716c9e9752b31595751ba0"
+  "digest": "17d0bdd9a9fd20dcd7df1c5312e9e00e77ee641ca24970d4c6ec6130d0fbf4ae"
 }

package/spec/v1/gaps.json

@@ -13068,6 +13068,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0220.4",
+      "rfc": "0220",
+      "local": "G4",
+      "section": "§B",
+      "surface": "`brand`, `canvas`, `coordination` and `launchStudio` have no tier-2 host. MyndHyve's executors for them run in the browser engine or on `canvas-runtime`, which does no OpenWOP version negotiation. `coordination`'s vote/consensus nodes need server-side agent dispatch.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "tier-2-host-serves-family",
+      "sources": [
+        {
+          "file": "RFCS/registers/0220-ext-families-graduate-on-evidence.gaps.md",
+          "token": "G4"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0221.1",
       "rfc": "0221",
@@ -13085,6 +13102,227 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0222.1",
+      "rfc": "0222",
+      "local": "G1",
+      "section": "§A",
+      "surface": "The earlier major's registry write endpoints (`deprecate`, `yank`, `keychain`, `keychain/rotate`), their scopes, the `rotationProof` chain and the 72-hour unpublish window have no v2 home.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0222-v2-registry-operations.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0222.2",
+      "rfc": "0222",
+      "local": "G2",
+      "section": "§C",
+      "surface": "No corpus schema describes `.well-known/openwop-registry.json`, so the `signingKeys[]` members §C names are validated only by the conformance leg.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0222-v2-registry-operations.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.1",
+      "rfc": "0223",
+      "local": "G1",
+      "section": "§Conformance",
+      "surface": "The routed case (a rejected gate followed over an `all_complete` or `any_failed` edge) has no witness: no registered fixture has a gate with an outgoing edge, and widening `conformance-approval` would force every host to re-register it.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1700",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.2",
+      "rfc": "0223",
+      "local": "G2",
+      "section": "§Conformance",
+      "surface": "The timeout disposition has no witness: no registered fixture carries a gate with a short `timeoutMs`, and the suite cannot make a host's timer fire.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1700",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.3",
+      "rfc": "0223",
+      "local": "G3",
+      "section": "§Implementation notes",
+      "surface": "The v2 reference host does not record `action` on `interrupt.resolved`, does not emit `approval.rejected`, fails the run directly rather than through the scheduler, and has no timeout disposition.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-examples-v2-reference-followup",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G3"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.4",
+      "rfc": "0223",
+      "local": "G4",
+      "section": "§Implementation notes",
+      "surface": "openwop-app records no `action` on single reject or timeout, emits no `interrupt.resolved` on quorum reject, never emits `approval.rejected`, and emits no `node.failed` / `failedNodeId` on either reject path.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-app-followup",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G4"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.5",
+      "rfc": "0223",
+      "local": "G5",
+      "section": "§Implementation notes",
+      "surface": "MyndHyve fails the gate with the unregistered `APPROVAL_REJECTED`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "myndhyve-next-cut",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.6",
+      "rfc": "0223",
+      "local": "G6",
+      "section": "§Unresolved questions",
+      "surface": "The `majority` threshold was stated from one v1 fixture.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G6"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.7",
+      "rfc": "0223",
+      "local": "G7",
+      "section": "§Unresolved questions",
+      "surface": "`onTimeout: approve` re-legalises the fail-open timeout RFC 0093 ruled non-conformant; this RFC defines only the absent and `reject` cases.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1696",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G7"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.8",
+      "rfc": "0223",
+      "local": "G8",
+      "section": "§A",
+      "surface": "A gate re-entered over a reject loop collides with the one-interrupt-per-key rule (`interrupt.md` §Re-entry); v2 has no per-iteration key derivation.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1697",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.9",
+      "rfc": "0223",
+      "local": "G9",
+      "section": "§Motivation",
+      "surface": "Whether a run-failure code on `run.failed` / `node.failed` must be registered: `errors.md` scopes its MUST to error responses, overview §0 to every producer.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1698",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G9"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0224.1",
+      "rfc": "0224",
+      "local": "G1",
+      "section": "§Conformance",
+      "surface": "The witness is loopback only; `Accepted` needs a certified public v2 bundle from a host advertising the family.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "v2-reference-public-cut",
+      "sources": [
+        {
+          "file": "RFCS/registers/0224-v2-audit-log-integrity.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0224.2",
+      "rfc": "0224",
+      "local": "G2",
+      "section": "§Unresolved questions",
+      "surface": "A dual-signing host lists a checkpoint under a key other than `checkpointPublicKey`, which the signature row fails; v2 advertises one key.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "first-rotating-host",
+      "sources": [
+        {
+          "file": "RFCS/registers/0224-v2-audit-log-integrity.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.spec.a2a-integration.g1",
       "rfc": "0152",

package/spec/v2/core/capabilities.md

@@ -111,7 +111,7 @@ These keys are not part of the v2 root:
 
 Operation paths live in `spec/v2/path-manifest.json` ([`versioning.md`](versioning.md)). The declaration is generated from nothing and checked against everything (`scripts/check-declaration.mjs`).
 
-## 5. Core families (72)
+## 5. Core families (73)
 
 Each heading below is a `spec/v2/declaration.json` row with `anchor: core`. `scripts/check-declaration.mjs` MUST fail when a heading here, a root key in the generated schema, or a pack peer-dependency identifier names a family the declaration does not. The peer-dependency identifier is identical to the key ([`packs.md`](packs.md)).
 
@@ -394,6 +394,10 @@ Witness `witnessable-gated`.
 
 Witness `seam-gated`. Facets: `lanes`, `subjectLinkKey`.
 
+### § auditLogIntegrity
+
+Witness `witnessable-gated`. Facets: `checkpointSignatureAlgorithm`, `checkpointPublicKey`, `checkpointIntervalEntries`, `checkpointIntervalSeconds` ([security-defaults.md](security-defaults.md) §Audit-log integrity).
+
 ### § i18n
 
 Witness `witnessable-gated`.

package/spec/v2/core/errors.md

@@ -8,7 +8,7 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`, and an optional one-line `meaning`. `spec/v2/errors.schema.json` defines the row. It registers **107** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`, and an optional one-line `meaning`. `spec/v2/errors.schema.json` defines the row. It registers **108** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
 - A host MUST return a registered code, or a vendor code, in every error response.
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
@@ -47,7 +47,7 @@ The idempotency mismatch code is `idempotency_key_mismatch` only ([idempotency.m
 
 ## Codes by HTTP status
 
-Generated from `spec/v2/errors.json` (107 codes; `retriable` and `statusSource` are in the registry).
+Generated from `spec/v2/errors.json` (108 codes; `retriable` and `statusSource` are in the registry).
 
 Code | Status
 --- | ---
@@ -130,6 +130,7 @@ Code | Status
 `payload_too_large` | 413
 `workspace_too_large` | 413
 `unsupported_media_type` | 415
+`approval_rejected` | 422
 `capability_not_provided` | 422
 `capability_required` | 422
 `connection_auth_metadata_mismatch` | 422

package/spec/v2/core/interrupt.md

@@ -42,7 +42,7 @@ Per-kind rules:
 - An in-memory cache MAY serve in-process replays but MUST NOT replace the event log for cross-process replays.
 - A host MUST validate the resume value against `resumeSchema` when one is declared, and MUST refuse a failing value with `400 validation_error`.
 
-`timeoutMs`, when set, is the interrupt's own deadline.
+`timeoutMs`, when set, is the interrupt's own deadline. What an approval gate does when it elapses is §Rejection.
 
 ## Events
 
@@ -113,6 +113,17 @@ The token grammar and the `interrupt.tokenAlgs[]` / `kid` check are [identity.md
 - `requiredApprovals` sets the quorum (default 1). `rejectionPolicy` is `single-veto` (default) or `majority`.
 - When `overrideBypassesQuorum` is `true`, a configured override principal MAY release the gate alone; otherwise its vote counts once.
 
+### Rejection
+
+A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and SHOULD also emit `approval.rejected`. The resume value is returned to the node that raised the interrupt (§Re-entry and resume values).
+
+- A node that does not turn the rejection into an output MUST fail with `approval_rejected` ([errors.md](errors.md)) and `retryable: false` on the `node.failed` error, and MUST NOT be retried.
+- A rejected gate is a failed source. It MUST NOT satisfy an `all_success`, `any_success` or `none_failed` edge. The run continues past it only over an edge whose `triggerRule` admits a failed source (`all_complete` or `any_failed`).
+- When no such edge exists, the run MUST terminate `failed` with `run.failed.error.code` `approval_rejected` and `failedNodeId` naming the gate.
+- The gate resolves rejected on one eligible `reject` under `single-veto`, or when rejects exceed half of `requiredApprovals` under `majority`. A vote that does not decide the gate MUST NOT emit `interrupt.resolved`.
+- When a non-zero `timeoutMs` elapses with no resolution and `onTimeout` is absent or `reject`, the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, and MUST apply the rules above. A host MUST NOT accept `timeout` on a resume request.
+- On replay the failure MUST be derived from the recorded `interrupt.resolved`, never re-decided.
+
 ## Approver enforcement
 
 Enforcement is an obligation of the fields, not a discovery flag. The facet `spec/v2/facets/interrupt.schema.json` carries `tokenAlgs[]` (REQUIRED) and `refKinds[]` ⊆ `principal`, `group`, `role`.
@@ -131,4 +142,4 @@ Refs are opaque to the engine; the host resolves them against its own identity m
 
 The v1 interrupt-token drain is [identity.md](identity.md) §4.
 
-*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0187, RFC 0196.*
+*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0187, RFC 0196, RFC 0223.*

package/spec/v2/core/packs.md

@@ -90,9 +90,16 @@ The same block applies to a **bare manifest** — the `pack.json` inside the tar
 - A verifier MUST verify the signature against the issuing registry's key for `keyId`, and MUST check the pack name against that key's `permittedNamespaces`.
 - A signature over tarball bytes is not a v2 signature; such a pack MUST be re-signed, not relabeled.
 
+Only a `signingKeys[]` entry whose `status` is `active` MAY sign a new publication. A key MUST stay listed while a served version names it, and a verifier MUST NOT refuse a version because its key is not `active`.
+
 ## Version manifests
 
-`kind` is REQUIRED on every version manifest and every bare manifest. A deprecated version is flagged `versionDeprecated: true`; the registry continues to serve it, and a consumer MAY refuse to install it.
+`kind` is REQUIRED on every version manifest and every bare manifest. Lifecycle flags sit outside the signature; changing one republishes the version manifest.
+
+- `versionDeprecated: true`: still served; a consumer MAY refuse to install it.
+- `yanked: true`: its manifest, tarball and signature stay served, and the pack index MUST NOT name it `latest` while an unyanked version exists. A range MUST skip it; a pin MAY resolve it. Advisory-listed versions MUST be yanked.
+
+A registry MUST refuse a submission that breaks these rules or republishes a version, with `pack_integrity_failure`, `pack_validation_failed`, `pack_signature_invalid`, `pack_engine_unsupported`, `pack_peer_dependency_undefined` or `version_conflict`.
 
 ## The registry's own schemas
 
@@ -111,4 +118,4 @@ A registry MUST validate submissions against vendored copies of these schemas pi
 - The v1 registry tree is frozen through the overlap, behind the v2 tree.
 - `testMode` advertises the v1 `/v1/packs-test/*` mirror, a conformance seam ([conformance.md §"The seams profile"](conformance.md)). It remains advertisable through the overlap and is removed at 3.0.
 
-*Sources: RFC 0177, RFC 0212.*
+*Sources: RFC 0177, RFC 0212, RFC 0222.*

package/spec/v2/core/security-defaults.md

@@ -1,7 +1,7 @@
 # Security Defaults
 
 > **Status: Stable.**
-> **Normative home:** `sandbox`, `compensation`, `purposePropagation`.
+> **Normative home:** `sandbox`, `compensation`, `purposePropagation`, `auditLogIntegrity`.
 
 ## Why this exists
 
@@ -28,6 +28,7 @@ A security-load-bearing behavior is an obligation of the surface that needs it.
 | `idempotency` | Layer-2 effect identity (§Layer-2 effect identity) | witnessable-gated (fixture provider) | `logical-effect-id-retry-stable` |
 | an `oauth2` or `oidc` lane | protected-resource metadata and challenges ([identity.md §2.5](identity.md)) | witnessable-gated | `auth-challenge-no-oracle` |
 | any outbound request | no inbound credential on an onward hop (§Onward hops) | seam-gated | `inbound-credential-no-passthrough` |
+| `auditLogIntegrity` | a chained, checkpointed, verifiable audit log (§Audit-log integrity) | witnessable-gated | `audit-checkpoint-signed-over-root` |
 
 ### Auth lanes
 
@@ -91,6 +92,16 @@ One credential is not inbound in this sense: an A2A push-config credential (`aut
 
 A host advertising `purposePropagation` MUST re-emit a `permittedPurposes` label it received (A2A `metadata.openwop.permittedPurposes`, `TriggerEvent.permittedPurposes`) on every onward hop of the same data, narrowing and never widening, and MUST treat `[]` as no onward use. `purposePropagation.propagatesOnward` is `false` only on a host with no onward hop. The family advertises propagation, not enforcement.
 
+### Audit-log integrity
+
+A host advertising `auditLogIntegrity` MUST keep an audit log a privileged insider cannot silently rewrite. It:
+
+- MUST keep the log append-only, each entry carrying `prevHash`, the lowercase-hex SHA-256 of the prior entry's canonical JSON ([conformance.md §Canonical JSON](conformance.md)), `null` for the first;
+- MUST sign a checkpoint anchoring at most `checkpointIntervalEntries` entries, and anchor an entry within `checkpointIntervalSeconds` of its append. The range, leaves, root and signature are [RFC 0218 §A](https://github.com/openwop/openwop/blob/main/RFCS/0218-audit-checkpoint-preimage.md); the signature is Ed25519 (`checkpointSignatureAlgorithm`) under `checkpointPublicKey`, a key used for no other surface;
+- MUST serve `GET /audit/verify` (scope `audit:read`), answering `schemas/v2/audit-verify-result.schema.json` with every checkpoint whose `atSequence` is in the range, ascending, and the anomalies of [RFC 0218 §C](https://github.com/openwop/openwop/blob/main/RFCS/0218-audit-checkpoint-preimage.md). A host that does not advertise the family MAY omit the operation.
+
+The `audit-log-integrity` and `audit-checkpoint-signature` scenarios witness the verify body, each signature, and the cadence. The root is not witnessable from outside, because entries are not on the wire; tamper detection is a host-internal test.
+
 ## Relaxations
 
 A relaxation, where one is legitimate — a development deployment, a single-tenant appliance — is an operator setting, never a discovery field. Every relaxation a host runs under MUST be recorded in its certification bundle as `host.relaxations[]` (`schemas/v2/certification-bundle.schema.json`): `{ obligation, durability, reason }`, `durability ∈ session | deployment | persisted`.
@@ -131,4 +142,4 @@ Rows `C6.1`–`C6.9` are `spec/v1/migrations.json` entries.
 
 See also: identity.md, replay.md, webhooks.md, capabilities.md, conformance.md.
 
-*Sources: RFC 0150, RFC 0163, RFC 0164, RFC 0170, RFC 0173, RFC 0214.*
+*Sources: RFC 0150, RFC 0163, RFC 0164, RFC 0170, RFC 0173, RFC 0214, RFC 0218, RFC 0224.*

package/spec/v2/corrections.json

@@ -2,7 +2,7 @@
   "$schema": "./corrections.schema.json",
   "$comment": "RFC 0197 §A.4 — v2 Class-3 corrections. Seeded with P3 only. The 2.8.2 removal of `workflowChainPacks.deferredParameters` and `.hostExpansionSeam` (P1) is deliberately NOT seeded: a committed bundle carried `deferredParameters` and then failed `capabilities-root-closed`, so the row would fail R3 — which is the point. P1 is recorded as the motivating defect in COMPATIBILITY.md §3a, not laundered into this register.",
   "version": 1,
-  "updated": "2026-09-27",
+  "updated": "2026-09-28",
   "rows": [
     {
       "id": "openwop.correction.v2.1",
@@ -43,6 +43,23 @@
         "manifestsScanned": 156,
         "note": "The prior shape is any string; the corrected shape is the axis-1 `<major>.<minor>` grammar that spec/v2/core/versioning.md §1.5 and the v2-min-client-version scenario already required of an advertised value. Bundle leg: all 8 committed evidence/v2-host-bundles/*.json advertise minClientVersion, and every value conforms (seven \"1.0\", MyndHyve \"0.1\"), so 0 carry a value the pattern rejects. The one \"0.1.0\" in the corpus is a major-1 witness under evidence/rfc-witnesses/, not a v2 bundle. Registry leg: minClientVersion is a discovery field, not a manifest field; 0 of 156 pack.json documents on openwop-registry origin/main (c15d3d6) carry it. The schema added a pattern only, so no property, type or required entry moved and check-v2-surface-monotone sees no change."
       }
+    },
+    {
+      "id": "openwop.correction.v2.3",
+      "date": "2026-09-28",
+      "class": "w3c-class-3",
+      "rfc": "0218",
+      "pointers": [
+        "schemas/v2/audit-verify-result.schema.json#/chainValid",
+        "schemas/v2/audit-verify-result.schema.json#/anomalies"
+      ],
+      "compatibilityEntry": "an audit anomaly's shape, and `chainValid` as the aggregate verdict",
+      "priorShapeCensus": {
+        "bundles": 0,
+        "manifests": 0,
+        "manifestsScanned": 157,
+        "note": "The prior shape is a verify result with `chainValid: true` beside a non-empty `anomalies`, or `chainValid: false` beside an empty one; the corrected shape is the root if/then/else RFC 0218 §C.4 adds, which the schema's `chainValid` and `anomalies` descriptions already required. Bundle leg: none of the 9 committed evidence/v2-host-bundles/*.json carries a `GET /audit/verify` body (no `chainValid` member anywhere). Registry leg: a verify result is not a manifest field; 0 of 157 pack.json documents on openwop-registry origin/main (4c5de1f) carry `chainValid`. The Anomaly members RFC 0218 §C adds are OPTIONAL additions that check-v2-surface-monotone reports as additive."
+      }
     }
   ]
 }

package/spec/v2/declaration.json

@@ -1621,6 +1621,31 @@
       "owningRfc": "0154",
       "facetsFrom": "spec/v2/facets/auth.schema.json"
     },
+    {
+      "key": "auditLogIntegrity",
+      "kind": "family",
+      "normativeText": [
+        "spec/v2/core/security-defaults.md"
+      ],
+      "anchor": "core",
+      "section": "core/capabilities.md#auditLogIntegrity",
+      "peerDependencyId": "auditLogIntegrity",
+      "witness": "witnessable-gated",
+      "maturity": {
+        "technical": "experimental",
+        "adoption": "none"
+      },
+      "facets": [
+        "checkpointSignatureAlgorithm",
+        "checkpointPublicKey",
+        "checkpointIntervalEntries",
+        "checkpointIntervalSeconds"
+      ],
+      "floorScenarios": [],
+      "requirementIds": [],
+      "owningRfc": "0224",
+      "facetsFrom": "spec/v2/facets/auditLogIntegrity.schema.json"
+    },
     {
       "key": "i18n",
       "kind": "family",
@@ -1737,7 +1762,7 @@
       "extensionName": "rest-transport",
       "witness": "witnessable-gated",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [
@@ -1779,7 +1804,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1797,7 +1822,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1814,7 +1839,7 @@
       "extensionName": "chat",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1833,7 +1858,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1851,7 +1876,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1868,7 +1893,7 @@
       "extensionName": "entities",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1886,7 +1911,7 @@
       "extensionName": "kanban",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1904,7 +1929,7 @@
       "extensionName": "knowledge",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1923,7 +1948,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1941,7 +1966,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1958,7 +1983,7 @@
       "extensionName": "web-research",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],

package/spec/v2/errors.json

@@ -2,7 +2,7 @@
   "$schema": "https://openwop.dev/spec/v2/errors.schema.json",
   "$comment": "RFC 0171 §B.1 — the error registry: one row per code {code, meaning?, httpStatus, retriable, details, since, deprecated?}. schemas/v2/error-envelope.schema.json is GENERATED from it (scripts/generate-error-envelope.mjs). Retry timing lives in Retry-After only (§B.2). statusSource records whether the status was stated in v1 prose, a v1 convention, or decided here. details is null until a code's details schema is registered (a null row means details is an open object for that code — closure over details is the RFC 0171 Phase 3 follow-up G-row).",
   "version": "2.0",
-  "updated": "2026-09-27",
+  "updated": "2026-09-28",
   "vendorCodePattern": "^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$",
   "rows": [
     {
@@ -839,6 +839,16 @@
       "since": "2.0",
       "source": "spec/v2/core/errors.md §The envelope — a request body whose Content-Type the host does not accept (RFC 9110 §15.5.16); registered 2026-09-05 because both production hosts had to invent it"
     },
+    {
+      "code": "approval_rejected",
+      "meaning": "An approval gate resolved rejected (a decision, a quorum or a timeout) and no edge routed the failure, so the node and the run failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.43",
+      "source": "RFC 0223; spec/v2/core/interrupt.md §Rejection"
+    },
     {
       "code": "capability_not_provided",
       "meaning": "The host does not provide a capability the request or pack requires.",

package/spec/v2/ext/brand/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `none` |
 | **peer-dependency id** | `brand` |
 | **advertised as** | `extensions.<org>.brand` |
 | **declared facets** | none defined |