@openwop/spec-artifacts 2.42.9 → 2.43.1

package/schemas/v2/capabilities.schema.json

@@ -7696,6 +7696,102 @@
       "description": "core/capabilities.md#auth — witness: seam-gated; maturity experimental/none; RFC 0154",
       "x-openwop-facets-from": "spec/v2/facets/auth.schema.json"
     },
+    "auditLogIntegrity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "since",
+        "witness",
+        "checkpointSignatureAlgorithm",
+        "checkpointPublicKey",
+        "checkpointIntervalEntries",
+        "checkpointIntervalSeconds"
+      ],
+      "properties": {
+        "status": {
+          "enum": [
+            "stable",
+            "experimental",
+            "deprecated"
+          ]
+        },
+        "since": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$",
+          "description": "The minor of THIS HOST's own contract at which it began serving the family — a point on its protocolVersions[] timeline, not the corpus minor that introduced the family. The corpus states no per-family since (spec/v2/declaration.json carries witness and maturity and no since), and `status`/`until` are the host's stability claim absorbed from v1 tier/experimentalUntil, so all three describe the host's offering and `witness` is the record's one corpus-derived field. A since naming a minor absent from protocolVersions[] puts adjacent same-grammar fields on two different timelines and is a defect. Ruled 2026-09-11."
+        },
+        "until": {
+          "type": "string",
+          "pattern": "^((0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)|\\d{4}-\\d{2}-\\d{2})$"
+        },
+        "witness": {
+          "enum": [
+            "witnessable-unaided",
+            "witnessable-gated",
+            "seam-gated",
+            "claims-check",
+            "negative-existence"
+          ]
+        },
+        "checkpointSignatureAlgorithm": {
+          "const": "ed25519",
+          "description": "The checkpoint signature algorithm. Ed25519 over the 32 bytes `merkleRoot` hex-decodes to (RFC 0218 §A.4)."
+        },
+        "checkpointPublicKey": {
+          "type": "string",
+          "pattern": "^MCowBQYDK2VwAyEA[A-Za-z0-9+/]{43}=$",
+          "description": "The audit-signing public key: base64 (RFC 4648 §4, padded) of its DER SubjectPublicKeyInfo, 44 bytes for Ed25519. Every checkpoint `GET /audit/verify` returns MUST verify under it."
+        },
+        "checkpointIntervalEntries": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The most entries a checkpoint anchors: consecutive checkpoints' atSequence, and the first checkpoint's atSequence from 0, differ by at most this."
+        },
+        "checkpointIntervalSeconds": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The longest an appended entry waits before a checkpoint anchors it."
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "stable"
+              }
+            }
+          },
+          "then": {
+            "not": {
+              "required": [
+                "until"
+              ]
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "enum": [
+                  "experimental",
+                  "deprecated"
+                ]
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "until"
+            ]
+          }
+        }
+      ],
+      "description": "core/capabilities.md#auditLogIntegrity — witness: witnessable-gated; maturity experimental/none; RFC 0224",
+      "x-openwop-facets-from": "spec/v2/facets/auditLogIntegrity.schema.json"
+    },
     "i18n": {
       "type": "object",
       "additionalProperties": false,

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 107 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 108 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -95,6 +95,7 @@
             "payload_too_large",
             "workspace_too_large",
             "unsupported_media_type",
+            "approval_rejected",
             "capability_not_provided",
             "capability_required",
             "credential_required",
@@ -367,6 +368,7 @@
     "payload_too_large": 413,
     "workspace_too_large": 413,
     "unsupported_media_type": 415,
+    "approval_rejected": 422,
     "capability_not_provided": 422,
     "capability_required": 422,
     "credential_required": 422,

package/schemas/v2/registry-version-manifest.schema.json

@@ -238,7 +238,7 @@
     },
     "yanked": {
       "type": "boolean",
-      "description": "Hard refusal: this version was published in error. Registry MUST refuse to serve the tarball; consumers MUST refuse to dispatch nodes from yanked versions."
+      "description": "This version is yanked (spec/v2/core/packs.md §\"Version manifests\"). The registry keeps serving its manifest, tarball and signature, and its pack index never names it `latest` while an unyanked version exists. A consumer resolving a range excludes it; an exact pin MAY still resolve it."
     },
     "yankedReason": {
       "type": "string",
@@ -253,7 +253,7 @@
     "supersededBy": {
       "type": "string",
       "maxLength": 256,
-      "description": "Optional pointer to the version (or `<name>@<version>`) that replaces this one. Per spec/v1/registry-operations.md, engine consumers in `open` / `verified` mode MUST surface this value in any deprecation warning when set."
+      "description": "Optional pointer to the version (or `<name>@<version>`) that replaces this one. Display only: a consumer that refuses or warns about a deprecated version can name it (spec/v2/core/packs.md §\"Version manifests\")."
     },
     "advisoryUrl": {
       "type": "string",

package/schemas/v2/run-event-payloads.schema.json

@@ -948,7 +948,8 @@
       "properties": {
         "code": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "A registered code from spec/v2/errors.json or a vendor code (errors.md §The registry, corrected by openwop#1698): the producer rule binds run.failed, node.failed and the snapshot error exactly as it binds an error response. Kept an open string on purpose — a consumer MUST accept an unknown code (overview.md §0) — so this schema does not enforce the rule; the suite's event-code-registered leg does."
         },
         "message": {
           "type": "string",

package/schemas/v2/suspend-request.schema.json

@@ -27,7 +27,7 @@
     },
     "key": {
       "type": "string",
-      "description": "Deterministic key used to short-circuit on re-entry after process death. If two interrupt() calls in the same run emit the same key, the second returns the cached result of the first. Recommended: ${runId}:${nodeId}:${interruptCount}.",
+      "description": "The deterministic re-entry key of ONE invocation of an interrupt (interrupt.md §Re-entry and resume values; corrected 2026-09-28 by openwop#1697). A host MUST derive it from at least the run, the node and the node's visit index; the spelling is host-defined. Recommended: ${runId}:${nodeId}:${interruptCount}, where interruptCount is the visit index — the number of interrupts this node raised in this run whose resolution was consumed before the current execution of the node began (plus an ordinal when one execution raises several). A replay or recovery of the same execution re-derives the same key and returns the recorded resume value; a later execution of the node (a loop back over an edge) derives a new key and raises a new interrupt.requested.",
       "minLength": 1,
       "maxLength": 256
     },
@@ -299,7 +299,7 @@
             "approve",
             "escalate"
           ],
-          "description": "RFC 0186 §A.3 — the disposition applied when `timeoutMs` elapses with no resolution. Every gate with a timer needs one; two production hosts recorded it as a bare key on `approval.requested` (280 rows on one) because the seat did not exist. `escalate` pairs with a host-defined escalation target. A `timeoutMs` of `0` means no timer, and `onTimeout` is then meaningless."
+          "description": "RFC 0186 §A.3, corrected by RFC 0223 (openwop#1696) — a hint recorded with the gate; it does not choose the outcome. Whatever it holds, when a non-zero `timeoutMs` elapses with no resolution the host MUST resolve the gate rejected (`action: timeout`, `decision: rejected`, `reason: timeout`) and the node and run fail with `approval_rejected` unless an edge routes the failure (interrupt.md §Rejection). A timeout never grants a gate: a host MUST treat `approve` as `reject` and SHOULD NOT emit it (RFC 0093 ruled fail-open non-conformant; the value stays in the enum only so recorded payloads validate). `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate. Absent means `reject`. A `timeoutMs` of `0` means no timer. Two production hosts recorded this as a bare key on `approval.requested` (280 rows on one) before the seat existed. No JSON-Schema `default` is declared, because a validator that fills defaults would write a value the host never recorded."
         },
         "description": {
           "type": "string"

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.42.9"
+      "version": "2.43.1"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -421,5 +421,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "fb4145362ce7b57ba7e06e742acac2800106bb12e863f6eb6d2dc9dd2f50cb6c"
+  "digest": "7800a051d432c1244efd10dcee93b93ddde389aa6bfa843279d0ff6b9d734658"
 }

package/spec/v1/gaps.json

@@ -9804,6 +9804,57 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0171.6",
+      "rfc": "0171",
+      "local": "G6",
+      "section": "§B.1",
+      "surface": "openwop-app emits error codes on `run.failed` / `node.failed` that are neither registered nor vendor codes (22 codes measured at openwop-app `0cfb264c9`, e.g. `invalid_config`, `host_capability_missing`); `errors.md` §The registry binds them since openwop#1698.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-app-code-remap",
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G6"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0171.7",
+      "rfc": "0171",
+      "local": "G7",
+      "section": "§B.1",
+      "surface": "MyndHyve emits about 56 UPPER_CASE run-failure codes (normalised in `failurePayload`, measured at MyndHyve `fc3b007cf`) that are neither registered nor vendor codes.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "myndhyve-code-remap",
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G7"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0171.8",
+      "rfc": "0171",
+      "local": "G8",
+      "section": "§B.1",
+      "surface": "The v2 reference host emitted 3 unregistered run-failure codes (measured at openwop-examples `456dfaa`).",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0172.1",
       "rfc": "0172",
@@ -13068,6 +13119,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0220.4",
+      "rfc": "0220",
+      "local": "G4",
+      "section": "§B",
+      "surface": "`brand`, `canvas`, `coordination` and `launchStudio` have no tier-2 host. MyndHyve's executors for them run in the browser engine or on `canvas-runtime`, which does no OpenWOP version negotiation. `coordination`'s vote/consensus nodes need server-side agent dispatch.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "tier-2-host-serves-family",
+      "sources": [
+        {
+          "file": "RFCS/registers/0220-ext-families-graduate-on-evidence.gaps.md",
+          "token": "G4"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0221.1",
       "rfc": "0221",
@@ -13085,6 +13153,261 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0222.1",
+      "rfc": "0222",
+      "local": "G1",
+      "section": "§A",
+      "surface": "The earlier major's registry write endpoints (`deprecate`, `yank`, `keychain`, `keychain/rotate`), their scopes, the `rotationProof` chain and the 72-hour unpublish window have no v2 home.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0222-v2-registry-operations.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0222.2",
+      "rfc": "0222",
+      "local": "G2",
+      "section": "§C",
+      "surface": "No corpus schema describes `.well-known/openwop-registry.json`, so the `signingKeys[]` members §C names are validated only by the conformance leg.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0222-v2-registry-operations.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.1",
+      "rfc": "0223",
+      "local": "G1",
+      "section": "§Conformance",
+      "surface": "The routed case (a rejected gate followed over an `all_complete` or `any_failed` edge) had no witness.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.2",
+      "rfc": "0223",
+      "local": "G2",
+      "section": "§Conformance",
+      "surface": "The timeout disposition had no witness.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.3",
+      "rfc": "0223",
+      "local": "G3",
+      "section": "§Implementation notes",
+      "surface": "The v2 reference host did not record `action` on `interrupt.resolved`, did not emit `approval.rejected`, failed the run directly rather than through the scheduler, and had no timeout disposition.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G3"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.4",
+      "rfc": "0223",
+      "local": "G4",
+      "section": "§Implementation notes",
+      "surface": "openwop-app records no `action` on single reject or timeout, emits no `interrupt.resolved` on quorum reject, never emits `approval.rejected`, and emits no `node.failed` / `failedNodeId` on either reject path.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-app-followup",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G4"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.5",
+      "rfc": "0223",
+      "local": "G5",
+      "section": "§Implementation notes",
+      "surface": "MyndHyve fails the gate with the unregistered `APPROVAL_REJECTED`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "myndhyve-next-cut",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.6",
+      "rfc": "0223",
+      "local": "G6",
+      "section": "§Unresolved questions",
+      "surface": "The `majority` threshold was stated from one v1 fixture.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G6"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.7",
+      "rfc": "0223",
+      "local": "G7",
+      "section": "§Unresolved questions",
+      "surface": "`onTimeout: approve` re-legalised the fail-open timeout RFC 0093 ruled non-conformant.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G7"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.8",
+      "rfc": "0223",
+      "local": "G8",
+      "section": "§A",
+      "surface": "A gate re-entered over a reject loop collided with the one-interrupt-per-key rule (`interrupt.md` §Re-entry); v2 had no per-iteration key derivation.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.9",
+      "rfc": "0223",
+      "local": "G9",
+      "section": "§Motivation",
+      "surface": "Whether a run-failure code on `run.failed` / `node.failed` must be registered: `errors.md` scopes its MUST to error responses, overview §0 to every producer.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1698",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G9"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.9",
+      "rfc": "0223",
+      "local": "G9",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.0223.reject-loopback-reasks` (openwop #1697) has no positive witness on any host. The v2 reference host does not run cycles. MyndHyve runs request-changes loops over condition edges on a successful gate output, and does not route a failed node over `any_failed` (its Cloud Run executor has no `triggerRule` handling), so the row stays `inapplicable` there. openwop-app rejects cycles. The row exists and is negatively controlled: registering the fixture on a host that does not loop records `executed-fail`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-routes-failed-gate-over-cycle",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G9"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0223.10",
+      "rfc": "0223",
+      "local": "G10",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.0223.timeout-rejects` and `0223.timeout-never-grants` have no MyndHyve witness: its `core.approvalGate` has no timeout configuration. On the v2 reference host both rows are negatively controlled (sweep sabotaged, or the `onTimeout` exclusion present) and pass locally with the fixtures registered. They need suite 2.43.1 and a new certified cut.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "certified-cut-on-2.43.1",
+      "sources": [
+        {
+          "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
+          "token": "G10"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0224.1",
+      "rfc": "0224",
+      "local": "G1",
+      "section": "§Conformance",
+      "surface": "The witness is loopback only; `Accepted` needs a certified public v2 bundle from a host advertising the family.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "v2-reference-public-cut",
+      "sources": [
+        {
+          "file": "RFCS/registers/0224-v2-audit-log-integrity.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0224.2",
+      "rfc": "0224",
+      "local": "G2",
+      "section": "§Unresolved questions",
+      "surface": "A dual-signing host lists a checkpoint under a key other than `checkpointPublicKey`, which the signature row fails; v2 advertises one key.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "first-rotating-host",
+      "sources": [
+        {
+          "file": "RFCS/registers/0224-v2-audit-log-integrity.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.spec.a2a-integration.g1",
       "rfc": "0152",

package/spec/v2/core/capabilities.md

@@ -111,7 +111,7 @@ These keys are not part of the v2 root:
 
 Operation paths live in `spec/v2/path-manifest.json` ([`versioning.md`](versioning.md)). The declaration is generated from nothing and checked against everything (`scripts/check-declaration.mjs`).
 
-## 5. Core families (72)
+## 5. Core families (73)
 
 Each heading below is a `spec/v2/declaration.json` row with `anchor: core`. `scripts/check-declaration.mjs` MUST fail when a heading here, a root key in the generated schema, or a pack peer-dependency identifier names a family the declaration does not. The peer-dependency identifier is identical to the key ([`packs.md`](packs.md)).
 
@@ -394,6 +394,10 @@ Witness `witnessable-gated`.
 
 Witness `seam-gated`. Facets: `lanes`, `subjectLinkKey`.
 
+### § auditLogIntegrity
+
+Witness `witnessable-gated`. Facets: `checkpointSignatureAlgorithm`, `checkpointPublicKey`, `checkpointIntervalEntries`, `checkpointIntervalSeconds` ([security-defaults.md](security-defaults.md) §Audit-log integrity).
+
 ### § i18n
 
 Witness `witnessable-gated`.
@@ -463,4 +467,4 @@ A profile is a predicate over the declaration file, published in `spec/v2/profil
 
 Rows `C2.1`–`C2.10` are `spec/v1/migrations.json` entries. `openwop.codemod.discovery-document-v2` transforms `C2.2`–`C2.8`: it drops a family with `supported: false` and promotes a dotted-only declared family to its plain key. Certification bundles naming `openwop-core` are never upgraded; they remain valid v1 evidence at their version.
 
-*Sources: RFC 0144, RFC 0169, RFC 0175, RFC 0176, RFC 0179, RFC 0197. Each family's owning RFC is its `owningRfc` in [`declaration.json`](../declaration.json).*
+*Sources: RFCs 0144, 0169, 0175, 0176, 0179, 0197. Each family's owning RFC is its `owningRfc` in [`declaration.json`](../declaration.json).*

package/spec/v2/core/conformance.md

@@ -145,4 +145,4 @@ This proves the arithmetic and that recovery ran once inside the bound. It does
 
 An RFC whose acceptance criteria are corpus gates rather than host scenarios records the evidence label **corpus gate — no host tier** in its `Updated` line. For such an RFC the accepted-predicate check reads `(corpus)` rows from `evidence/corpus-ledger.json` and MUST NOT require a host bundle.
 
-*Sources: RFC 0158, RFC 0168, RFC 0212, RFC 0216.*
+*Sources: RFCs 0158, 0168, 0212, 0216.*

package/spec/v2/core/connection-packs.md

@@ -35,4 +35,4 @@ A host advertising `connections.packsSupported` MUST resolve a connector's `auth
 
 Both codes are in `spec/v2/errors.json`: `connection_provider_conflict` (two claimants for one bare id) and `connection_provider_unresolved` (no definition for the referenced id).
 
-*Sources: RFC 0095, RFC 0177.*
+*Sources: RFCs 0095, 0177.*

package/spec/v2/core/conversation.md

@@ -23,4 +23,4 @@ A host advertising `channelPresence` MUST report present members as a subset of
 
 A host that stamps model provenance on an agent turn MUST advertise `conversationTurnModelProvenance`. The stamp is non-secret and non-PII (provider and model identifiers only), and a host MUST NOT place prompt or completion content in it.
 
-*Sources: RFC 0101, RFC 0109, RFC 0110.*
+*Sources: RFCs 0101, 0109, 0110.*

package/spec/v2/core/errors.md

@@ -8,9 +8,9 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`, and an optional one-line `meaning`. `spec/v2/errors.schema.json` defines the row. It registers **107** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **108** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
-- A host MUST return a registered code, or a vendor code, in every error response.
+- A host MUST emit a registered code, or a vendor code, wherever it emits an error code: the `error` of every error response, and `error.code` on `run.failed`, `node.failed` and the snapshot's `error` (overview.md §0). A recorded event re-emitted by replay or `:fork` is carried as recorded ([replay.md](replay.md)).
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
 - The registry grows by [overview.md](overview.md) §0.
 
@@ -47,7 +47,7 @@ The idempotency mismatch code is `idempotency_key_mismatch` only ([idempotency.m
 
 ## Codes by HTTP status
 
-Generated from `spec/v2/errors.json` (107 codes; `retriable` and `statusSource` are in the registry).
+Generated from `spec/v2/errors.json` (108 codes; `retriable` and `statusSource` are in the registry).
 
 Code | Status
 --- | ---
@@ -130,6 +130,7 @@ Code | Status
 `payload_too_large` | 413
 `workspace_too_large` | 413
 `unsupported_media_type` | 415
+`approval_rejected` | 422
 `capability_not_provided` | 422
 `capability_required` | 422
 `connection_auth_metadata_mismatch` | 422
@@ -159,4 +160,4 @@ Code | Status
 `pack_registry_unreachable` | 503
 `runner_unavailable` | 503
 
-*Sources: RFC 0171, RFC 0213.*
+*Sources: RFCs 0171, 0213.*

package/spec/v2/core/events.md

@@ -188,4 +188,4 @@ An absent `kinds` is not an empty catalog and is not an unrestricted one: a host
 - **`feedback.targets`** names the resources an annotation may be attached to. A host MUST refuse an annotation whose target is outside the advertised set, and MUST NOT write it to the replayable run event log.
 - **`providerUsage.costEstimates`** advertises that the host stamps a derived cost on the `provider.usage` event. That figure is an estimate from the host's own rate table; a consumer MUST NOT treat it as a billed amount.
 
-*Sources: RFC 0171, RFC 0172, RFC 0176, RFC 0185, RFC 0194, RFC 0213.*
+*Sources: RFCs 0171, 0172, 0176, 0185, 0194, 0213.*

package/spec/v2/core/form-content-packs.md

@@ -40,4 +40,4 @@ A form instantiated from a pack advertised through `forms.contentPacks` MUST be
 
 The five spec-reserved `format` values are the core set. A host that recognizes a format SHOULD apply it; one that does not MUST ignore it and accept plain text. A host MUST ignore `format` on any type other than `text` or `longtext`.
 
-*Sources: RFC 0137, RFC 0177.*
+*Sources: RFCs 0137, 0177.*

package/spec/v2/core/idempotency.md

@@ -68,4 +68,4 @@ Layer 1 deduplicates the caller's request; Layer 2 deduplicates the run's effect
 - `multiRegion` is the behavioural claim. When a host advertises it, both layers MUST hold across regions: an `Idempotency-Key` replayed into a second region MUST resolve to the first region's response rather than starting new work, and effect identity MUST collapse a duplicate effect wherever it is observed.
 - A host that does not advertise `multiRegion` makes no cross-region promise, and a client MUST NOT infer one from `crossRegion` alone.
 
-*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0213.*
+*Sources: RFCs 0170, 0171, 0173, 0213.*

package/spec/v2/core/identity.md

@@ -222,4 +222,4 @@ Every code below is a row with `retriable: false` and no `details` contract; the
 
 The identity invariants are registered in `SECURITY/invariants.yaml` with their scenarios. An invariant without a witness is demoted from `protocol` tier.
 
-*Sources: RFC 0132, RFC 0165, RFC 0170, RFC 0176, RFC 0184, RFC 0200, RFC 0210.*
+*Sources: RFCs 0132, 0165, 0170, 0176, 0184, 0200, 0210.*