@openwop/spec-artifacts 2.42.9 → 2.43.1

package/spec/v2/core/interop.md

@@ -162,4 +162,4 @@ A receiver prefers the in-message value, ignores a malformed one, and MUST NOT d
 
 `SECURITY/threat-model-interop.md` is the threat model for this document; its invariants are rows of `SECURITY/invariants.yaml`. Peer identity and authorization at the boundary are governed by security-defaults.md; a peer MUST NOT gain authority the caller's Subject does not hold.
 
-*Sources: RFC 0175, RFC 0198, RFC 0207, RFC 0208, RFC 0211, RFC 0214.*
+*Sources: RFCs 0175, 0198, 0207, 0208, 0211, 0214.*

package/spec/v2/core/interrupt.md

@@ -5,7 +5,7 @@
 
 ## Why this exists
 
-`interrupt` is the one primitive by which a run waits for something outside itself: a human decision, an answer, an external event, a conversation turn. Every kind shares one payload shape, one pair of events, one resolve contract and one token scheme, so a client that can resolve an approval can resolve anything.
+`interrupt` is how a run waits for something outside itself: a decision, an answer, an event, a conversation turn. Every kind shares one payload shape, event pair, resolve contract and token scheme, so a client that resolves an approval can resolve anything.
 
 ## Payload
 
@@ -35,14 +35,17 @@ Per-kind rules:
 
 ### Re-entry and resume values
 
-`key` is the deterministic re-entry key.
+`key` is the deterministic re-entry key of one invocation. A host MUST derive it from at least the run, the node and the node's visit index: the number of that node's interrupts in this run whose resolution was consumed before this execution began. Its spelling is host-defined.
 
+- A replay or recovery of the same execution MUST re-derive the same key.
+- A later execution of the node, reached over an edge, MUST derive a different key, MUST raise a new `interrupt.requested`, and MUST NOT return an earlier visit's `resumeValue`.
+- Two interrupts raised in one execution MUST have distinct keys.
 - A host MUST invoke an interrupt with key `K` at most once for the lifetime of the run.
 - On recovery the engine MUST consult the event log, find the prior `interrupt.resolved`, and return the persisted `resumeValue` without emitting a second `interrupt.requested`.
 - An in-memory cache MAY serve in-process replays but MUST NOT replace the event log for cross-process replays.
 - A host MUST validate the resume value against `resumeSchema` when one is declared, and MUST refuse a failing value with `400 validation_error`.
 
-`timeoutMs`, when set, is the interrupt's own deadline.
+`timeoutMs`, when set, is the interrupt's own deadline. What an approval gate does when it elapses is §Rejection.
 
 ## Events
 
@@ -51,7 +54,7 @@ Every kind uses two registered types ([events.md](events.md)):
 - `interrupt.requested` — the payload is the `InterruptPayload` verbatim.
 - `interrupt.resolved` — the closed payload is `interruptResolved`. Resolving an approval-kind interrupt MUST record the applied `action` there, with the field §Approval requires.
 
-The kind-specific `approval.*` and `clarification.*` types remain registered. Their payload definitions in `schemas/v2/run-event-payloads.schema.json` are `$ref` aliases of `interruptRequested` and `interruptResolved`, so there is one shape per direction. A host emitting `interrupt.requested` SHOULD also emit the kind-specific type until its consumers migrate.
+The kind-specific `approval.*` and `clarification.*` types remain registered. Their payload definitions in `schemas/v2/run-event-payloads.schema.json` are `$ref` aliases of `interruptRequested` and `interruptResolved`. A host emitting `interrupt.requested` SHOULD also emit the kind-specific type until its consumers migrate.
 
 Both events are durable and appear in the `updates` and `debug` stream modes. While suspended, `RunSnapshot.currentNodeId` names the node and `status` is `waiting-approval`, `waiting-input` or `waiting-external`.
 
@@ -113,9 +116,20 @@ The token grammar and the `interrupt.tokenAlgs[]` / `kid` check are [identity.md
 - `requiredApprovals` sets the quorum (default 1). `rejectionPolicy` is `single-veto` (default) or `majority`.
 - When `overrideBypassesQuorum` is `true`, a configured override principal MAY release the gate alone; otherwise its vote counts once.
 
+### Rejection
+
+A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and SHOULD also emit `approval.rejected`. The resume value returns to the raising node (§Re-entry and resume values).
+
+- A node that does not turn the rejection into an output MUST fail with `approval_rejected` and `retryable: false` on the `node.failed` error, and MUST NOT be retried.
+- A rejected gate is a failed source. It MUST NOT satisfy an `all_success`, `any_success` or `none_failed` edge. The run continues past it only over an edge whose `triggerRule` admits a failed source (`all_complete` or `any_failed`).
+- When no such edge exists, the run MUST terminate `failed` with `run.failed.error.code` `approval_rejected` and `failedNodeId` naming the gate.
+- The gate resolves rejected on one eligible `reject` under `single-veto`, or when rejects exceed half of `requiredApprovals` under `majority`. A vote that does not decide the gate MUST NOT emit `interrupt.resolved`.
+- When a non-zero `timeoutMs` elapses with no resolution, the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, whatever `onTimeout` holds, and MUST apply the rules above. A timeout MUST NOT grant a gate. A host MUST treat `onTimeout: "approve"` as `reject` and SHOULD NOT emit it. `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate. A host MUST NOT accept `timeout` on a resume request.
+- On replay the failure MUST be derived from the recorded `interrupt.resolved`, never re-decided.
+
 ## Approver enforcement
 
-Enforcement is an obligation of the fields, not a discovery flag. The facet `spec/v2/facets/interrupt.schema.json` carries `tokenAlgs[]` (REQUIRED) and `refKinds[]` ⊆ `principal`, `group`, `role`.
+The facet `spec/v2/facets/interrupt.schema.json` carries `tokenAlgs[]` (REQUIRED) and `refKinds[]` ⊆ `principal`, `group`, `role`.
 
 - **`approversList`** (explicit principals) binds everywhere: a host advertising `interrupt` MUST refuse a resolver not in the list.
 - **`approverGroupRefs`** binds only where `refKinds` includes `group`: the host MUST surface the field unchanged and MUST resolve and enforce its members as eligible approvers.
@@ -125,10 +139,10 @@ Enforcement is an obligation of the fields, not a discovery flag. The facet `spe
 
 Eligibility binds every writer of the suspension record, not every route. A host whose durable store is writable by a principal other than the engine MUST enforce the same eligibility at the store, or MUST NOT expose the record to that principal for write.
 
-Refs are opaque to the engine; the host resolves them against its own identity model. Membership MUST be resolved at decision time and MUST NOT be re-resolved during replay or `forkRun`: the recorded eligibility decision is fixed history ([replay.md](replay.md)).
+Refs are opaque to the engine; the host resolves them. Membership MUST be resolved at decision time and MUST NOT be re-resolved during replay or `forkRun`: the recorded eligibility decision is fixed history ([replay.md](replay.md)).
 
 ## During the v1 overlap
 
 The v1 interrupt-token drain is [identity.md](identity.md) §4.
 
-*Sources: RFC 0170, RFC 0171, RFC 0173, RFC 0187, RFC 0196.*
+*Sources: RFCs 0170, 0171, 0173, 0187, 0196, 0223.*

package/spec/v2/core/node-pack-runtimes.md

@@ -31,4 +31,4 @@ It has no `packages[]`, `headers`, `variables` or `_meta`, so it carries no inst
 - A host SHOULD NOT treat `name` as a verified identity: an inline record carries no proof of namespace ownership.
 - A host that authenticates to the server does so through the node's `requiredCredentials` or `auth`.
 
-*Sources: RFC 0008, RFC 0203.*
+*Sources: RFCs 0008, 0203.*

package/spec/v2/core/oauth.md

@@ -63,4 +63,4 @@ Then:
 - `declined` fails the node with `connector_auth_declined`.
 - A host that binds a node to one credential reference (for example, a connection) reads "resolves" as that reference resolving with the node's scopes, carries it as `credentialRef`, and still completes `connectUrl` only for the initiating Subject.
 
-*Sources: RFC 0046, RFC 0047, RFC 0199.*
+*Sources: RFCs 0046, 0047, 0199.*

package/spec/v2/core/overview.md

@@ -96,4 +96,4 @@ These rules bind any public conformance statement:
 
 Every MUST, SHOULD, and MAY in `core/` is a requirement with an id in `requirements.json` and a `witness` from `witnessable-unaided | witnessable-gated | seam-gated | claims-check | negative-existence`. A seam-gated MUST is governed by [`conformance.md`](conformance.md) §"Witness class".
 
-*Sources: RFC 0155, RFC 0167, RFC 0168, RFC 0169, RFC 0171, RFC 0174, RFC 0190, RFC 0197.*
+*Sources: RFCs 0155, 0167, 0168, 0169, 0171, 0174, 0190, 0197.*

package/spec/v2/core/packs.md

@@ -26,12 +26,12 @@ Each conjunct keeps its own refusal code. A mechanical ceiling bump is not a ver
 
 ## The `packs` capability
 
-A host advertises `packs` when it serves the registry surface above. The record is the advertisement:
+A host advertises `packs` when it serves the registry surface above:
 
 - A host MUST NOT advertise `packs` unless it resolves pack references through a registry reachable from its discovery document.
-- A client MUST treat an absent record as "this host installs no packs", not as an unknown.
+- A client MUST treat an absent record as "no registry resolution", not as an unknown. It says nothing about pack validation or execution, which `sandbox` and §"The engine range" bind.
 
-`testMode` is DEPRECATED and MUST NOT be relied on by a client (see §"During the v1 overlap"). A host mounting a test catalog SHOULD advertise the seams profile instead, and MUST NOT treat `testMode` as a second way to claim one.
+`testMode` is DEPRECATED and MUST NOT be relied on by a client (§"During the v1 overlap"). A host mounting a test catalog SHOULD advertise the seams profile instead, and MUST NOT treat `testMode` as a second way to claim one.
 
 ## The registry tree
 
@@ -90,9 +90,16 @@ The same block applies to a **bare manifest** — the `pack.json` inside the tar
 - A verifier MUST verify the signature against the issuing registry's key for `keyId`, and MUST check the pack name against that key's `permittedNamespaces`.
 - A signature over tarball bytes is not a v2 signature; such a pack MUST be re-signed, not relabeled.
 
+Only a `signingKeys[]` entry whose `status` is `active` MAY sign a new publication. A key MUST stay listed while a served version names it, and a verifier MUST NOT refuse a version because its key is not `active`.
+
 ## Version manifests
 
-`kind` is REQUIRED on every version manifest and every bare manifest. A deprecated version is flagged `versionDeprecated: true`; the registry continues to serve it, and a consumer MAY refuse to install it.
+`kind` is REQUIRED on every version manifest and every bare manifest. Lifecycle flags sit outside the signature; changing one republishes the version manifest.
+
+- `versionDeprecated: true`: still served; a consumer MAY refuse to install it.
+- `yanked: true`: its manifest, tarball and signature stay served, and the pack index MUST NOT name it `latest` while an unyanked version exists. A range MUST skip it; a pin MAY resolve it. Advisory-listed versions MUST be yanked.
+
+A registry MUST refuse a submission that breaks these rules or republishes a version, with `pack_integrity_failure`, `pack_validation_failed`, `pack_signature_invalid`, `pack_engine_unsupported`, `pack_peer_dependency_undefined` or `version_conflict`.
 
 ## The registry's own schemas
 
@@ -111,4 +118,4 @@ A registry MUST validate submissions against vendored copies of these schemas pi
 - The v1 registry tree is frozen through the overlap, behind the v2 tree.
 - `testMode` advertises the v1 `/v1/packs-test/*` mirror, a conformance seam ([conformance.md §"The seams profile"](conformance.md)). It remains advertisable through the overlap and is removed at 3.0.
 
-*Sources: RFC 0177, RFC 0212.*
+*Sources: RFCs 0177, 0212, 0222.*

package/spec/v2/core/persistence.md

@@ -143,4 +143,4 @@ A host MAY claim a qualification rung (`durable-single-instance`, `durable-multi
 
 See also: [overview.md](overview.md), [events.md](events.md), [replay.md](replay.md), [identity.md](identity.md), [webhooks.md](webhooks.md).
 
-*Sources: RFC 0041, RFC 0158, RFC 0170, RFC 0171, RFC 0172, RFC 0176, RFC 0180, RFC 0185, RFC 0186, RFC 0187.*
+*Sources: RFCs 0041, 0158, 0170, 0171, 0172, 0176, 0180, 0185, 0186, 0187.*

package/spec/v2/core/portability.md

@@ -41,4 +41,4 @@ An applied import emits `import.applied` (`schemas/v2/run-event-payloads.schema.
 
 No protocol path is defined for export or import: a host serves them on routes of its own. A host-private migration from an anonymous sandbox into a signed-in tenant fits this contract, because its response is a subset of the import outcome.
 
-*Sources: RFC 0043, RFC 0096, RFC 0098.*
+*Sources: RFCs 0043, 0096, 0098.*

package/spec/v2/core/replay.md

@@ -132,4 +132,4 @@ A host advertising `replay` MUST document retention for source snapshots, source
 
 See also: events.md, runs.md, persistence.md, security-defaults.md.
 
-*Sources: RFC 0036, RFC 0039, RFC 0041, RFC 0057, RFC 0104, RFC 0111, RFC 0140, RFC 0173, RFC 0176, RFC 0194.*
+*Sources: RFCs 0036, 0039, 0041, 0057, 0104, 0111, 0140, 0173, 0176, 0194.*

package/spec/v2/core/runs.md

@@ -264,4 +264,4 @@ A host that does not advertise `dataResidency` MAY ignore or reject a `residency
 
 A non-terminal run inherited from v1 continues, or is cancelled `v1_pin_unsupported`, per [persistence.md](persistence.md) §"Runs pinned to v1".
 
-*Sources: RFC 0170, RFC 0171, RFC 0176, RFC 0182.*
+*Sources: RFCs 0170, 0171, 0176, 0182.*

package/spec/v2/core/security-defaults.md

@@ -1,7 +1,7 @@
 # Security Defaults
 
 > **Status: Stable.**
-> **Normative home:** `sandbox`, `compensation`, `purposePropagation`.
+> **Normative home:** `sandbox`, `compensation`, `purposePropagation`, `auditLogIntegrity`.
 
 ## Why this exists
 
@@ -28,6 +28,7 @@ A security-load-bearing behavior is an obligation of the surface that needs it.
 | `idempotency` | Layer-2 effect identity (§Layer-2 effect identity) | witnessable-gated (fixture provider) | `logical-effect-id-retry-stable` |
 | an `oauth2` or `oidc` lane | protected-resource metadata and challenges ([identity.md §2.5](identity.md)) | witnessable-gated | `auth-challenge-no-oracle` |
 | any outbound request | no inbound credential on an onward hop (§Onward hops) | seam-gated | `inbound-credential-no-passthrough` |
+| `auditLogIntegrity` | a chained, checkpointed, verifiable audit log (§Audit-log integrity) | witnessable-gated | `audit-checkpoint-signed-over-root` |
 
 ### Auth lanes
 
@@ -91,6 +92,16 @@ One credential is not inbound in this sense: an A2A push-config credential (`aut
 
 A host advertising `purposePropagation` MUST re-emit a `permittedPurposes` label it received (A2A `metadata.openwop.permittedPurposes`, `TriggerEvent.permittedPurposes`) on every onward hop of the same data, narrowing and never widening, and MUST treat `[]` as no onward use. `purposePropagation.propagatesOnward` is `false` only on a host with no onward hop. The family advertises propagation, not enforcement.
 
+### Audit-log integrity
+
+A host advertising `auditLogIntegrity` MUST keep an audit log a privileged insider cannot silently rewrite. It:
+
+- MUST keep the log append-only, each entry carrying `prevHash`, the lowercase-hex SHA-256 of the prior entry's canonical JSON ([conformance.md §Canonical JSON](conformance.md)), `null` for the first;
+- MUST sign a checkpoint anchoring at most `checkpointIntervalEntries` entries, and anchor an entry within `checkpointIntervalSeconds` of its append. The range, leaves, root and signature are [RFC 0218 §A](https://github.com/openwop/openwop/blob/main/RFCS/0218-audit-checkpoint-preimage.md); the signature is Ed25519 (`checkpointSignatureAlgorithm`) under `checkpointPublicKey`, a key used for no other surface;
+- MUST serve `GET /audit/verify` (scope `audit:read`), answering `schemas/v2/audit-verify-result.schema.json` with every checkpoint whose `atSequence` is in the range, ascending, and the anomalies of [RFC 0218 §C](https://github.com/openwop/openwop/blob/main/RFCS/0218-audit-checkpoint-preimage.md). A host that does not advertise the family MAY omit the operation.
+
+The `audit-log-integrity` and `audit-checkpoint-signature` scenarios witness the verify body, each signature, and the cadence. The root is not witnessable from outside, because entries are not on the wire; tamper detection is a host-internal test.
+
 ## Relaxations
 
 A relaxation, where one is legitimate — a development deployment, a single-tenant appliance — is an operator setting, never a discovery field. Every relaxation a host runs under MUST be recorded in its certification bundle as `host.relaxations[]` (`schemas/v2/certification-bundle.schema.json`): `{ obligation, durability, reason }`, `durability ∈ session | deployment | persisted`.
@@ -131,4 +142,4 @@ Rows `C6.1`–`C6.9` are `spec/v1/migrations.json` entries.
 
 See also: identity.md, replay.md, webhooks.md, capabilities.md, conformance.md.
 
-*Sources: RFC 0150, RFC 0163, RFC 0164, RFC 0170, RFC 0173, RFC 0214.*
+*Sources: RFCs 0150, 0163, 0164, 0170, 0173, 0214, 0218, 0224.*

package/spec/v2/core/tool-catalog.md

@@ -42,4 +42,4 @@ A host advertising `toolCatalog.compactView` MUST answer `?view=compact` on both
 
 A host advertising `toolCatalog.sessionLifecycle` MAY bracket calls with content-free `tool.session.opened` and `tool.session.closed`; a consumer MUST tolerate their absence.
 
-*Sources: RFC 0078, RFC 0112, RFC 0204.*
+*Sources: RFCs 0078, 0112, 0204.*

package/spec/v2/core/versioning.md

@@ -192,4 +192,4 @@ Every vendor namespace — capability records ([capabilities.md](capabilities.md
 
 Rows `C5.1`–`C5.9` are `spec/v1/migrations.json` entries (`C5.2` is owned by `events.md`). The persisted-data disposition for each is `not-persisted`, except `C5.1` (legacy-stamped) and `C5.7` (never-upgraded).
 
-*Sources: RFC 0167, RFC 0168, RFC 0172, RFC 0176, RFC 0179, RFC 0181, RFC 0193, RFC 0219.*
+*Sources: RFCs 0167, 0168, 0172, 0176, 0179, 0181, 0193, 0219.*

package/spec/v2/core/webhooks.md

@@ -124,4 +124,4 @@ At delivery time a host MUST re-resolve the hostname, validate every resolved ad
 
 See also: events.md, replay.md, persistence.md, security-defaults.md.
 
-*Sources: RFC 0053, RFC 0165, RFC 0171, RFC 0173, RFC 0176, RFC 0188, RFC 0196, RFC 0201, RFC 0215, RFC 0217.*
+*Sources: RFCs 0053, 0165, 0171, 0173, 0176, 0188, 0196, 0201, 0215, 0217.*

package/spec/v2/core/workflow-chain-packs.md

@@ -36,4 +36,4 @@ Fragment edges carry the same `condition` and `triggerRule` shapes as a top-leve
 
 A host MUST carry both fields through expansion verbatim and MUST honor them on expanded edges as on authored ones. [form-content-packs.md](form-content-packs.md) reuses this operator set for field visibility.
 
-*Sources: RFC 0133, RFC 0177.*
+*Sources: RFCs 0133, 0177.*

package/spec/v2/corrections.json

@@ -2,7 +2,7 @@
   "$schema": "./corrections.schema.json",
   "$comment": "RFC 0197 §A.4 — v2 Class-3 corrections. Seeded with P3 only. The 2.8.2 removal of `workflowChainPacks.deferredParameters` and `.hostExpansionSeam` (P1) is deliberately NOT seeded: a committed bundle carried `deferredParameters` and then failed `capabilities-root-closed`, so the row would fail R3 — which is the point. P1 is recorded as the motivating defect in COMPATIBILITY.md §3a, not laundered into this register.",
   "version": 1,
-  "updated": "2026-09-27",
+  "updated": "2026-09-28",
   "rows": [
     {
       "id": "openwop.correction.v2.1",
@@ -43,6 +43,23 @@
         "manifestsScanned": 156,
         "note": "The prior shape is any string; the corrected shape is the axis-1 `<major>.<minor>` grammar that spec/v2/core/versioning.md §1.5 and the v2-min-client-version scenario already required of an advertised value. Bundle leg: all 8 committed evidence/v2-host-bundles/*.json advertise minClientVersion, and every value conforms (seven \"1.0\", MyndHyve \"0.1\"), so 0 carry a value the pattern rejects. The one \"0.1.0\" in the corpus is a major-1 witness under evidence/rfc-witnesses/, not a v2 bundle. Registry leg: minClientVersion is a discovery field, not a manifest field; 0 of 156 pack.json documents on openwop-registry origin/main (c15d3d6) carry it. The schema added a pattern only, so no property, type or required entry moved and check-v2-surface-monotone sees no change."
       }
+    },
+    {
+      "id": "openwop.correction.v2.3",
+      "date": "2026-09-28",
+      "class": "w3c-class-3",
+      "rfc": "0218",
+      "pointers": [
+        "schemas/v2/audit-verify-result.schema.json#/chainValid",
+        "schemas/v2/audit-verify-result.schema.json#/anomalies"
+      ],
+      "compatibilityEntry": "an audit anomaly's shape, and `chainValid` as the aggregate verdict",
+      "priorShapeCensus": {
+        "bundles": 0,
+        "manifests": 0,
+        "manifestsScanned": 157,
+        "note": "The prior shape is a verify result with `chainValid: true` beside a non-empty `anomalies`, or `chainValid: false` beside an empty one; the corrected shape is the root if/then/else RFC 0218 §C.4 adds, which the schema's `chainValid` and `anomalies` descriptions already required. Bundle leg: none of the 9 committed evidence/v2-host-bundles/*.json carries a `GET /audit/verify` body (no `chainValid` member anywhere). Registry leg: a verify result is not a manifest field; 0 of 157 pack.json documents on openwop-registry origin/main (4c5de1f) carry `chainValid`. The Anomaly members RFC 0218 §C adds are OPTIONAL additions that check-v2-surface-monotone reports as additive."
+      }
     }
   ]
 }

package/spec/v2/declaration.json

@@ -1621,6 +1621,31 @@
       "owningRfc": "0154",
       "facetsFrom": "spec/v2/facets/auth.schema.json"
     },
+    {
+      "key": "auditLogIntegrity",
+      "kind": "family",
+      "normativeText": [
+        "spec/v2/core/security-defaults.md"
+      ],
+      "anchor": "core",
+      "section": "core/capabilities.md#auditLogIntegrity",
+      "peerDependencyId": "auditLogIntegrity",
+      "witness": "witnessable-gated",
+      "maturity": {
+        "technical": "experimental",
+        "adoption": "none"
+      },
+      "facets": [
+        "checkpointSignatureAlgorithm",
+        "checkpointPublicKey",
+        "checkpointIntervalEntries",
+        "checkpointIntervalSeconds"
+      ],
+      "floorScenarios": [],
+      "requirementIds": [],
+      "owningRfc": "0224",
+      "facetsFrom": "spec/v2/facets/auditLogIntegrity.schema.json"
+    },
     {
       "key": "i18n",
       "kind": "family",
@@ -1737,7 +1762,7 @@
       "extensionName": "rest-transport",
       "witness": "witnessable-gated",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [
@@ -1779,7 +1804,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1814,8 +1839,8 @@
       "extensionName": "chat",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1833,7 +1858,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1850,7 +1875,7 @@
       "extensionName": "data-integration",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1868,7 +1893,7 @@
       "extensionName": "entities",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
+        "technical": "stable",
         "adoption": "single-witness"
       },
       "facets": [],
@@ -1886,8 +1911,8 @@
       "extensionName": "kanban",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1904,8 +1929,8 @@
       "extensionName": "knowledge",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1941,7 +1966,7 @@
       "witness": "claims-check",
       "maturity": {
         "technical": "experimental",
-        "adoption": "single-witness"
+        "adoption": "none"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1958,8 +1983,8 @@
       "extensionName": "web-research",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],

package/spec/v2/errors.json

@@ -2,7 +2,7 @@
   "$schema": "https://openwop.dev/spec/v2/errors.schema.json",
   "$comment": "RFC 0171 §B.1 — the error registry: one row per code {code, meaning?, httpStatus, retriable, details, since, deprecated?}. schemas/v2/error-envelope.schema.json is GENERATED from it (scripts/generate-error-envelope.mjs). Retry timing lives in Retry-After only (§B.2). statusSource records whether the status was stated in v1 prose, a v1 convention, or decided here. details is null until a code's details schema is registered (a null row means details is an open object for that code — closure over details is the RFC 0171 Phase 3 follow-up G-row).",
   "version": "2.0",
-  "updated": "2026-09-27",
+  "updated": "2026-09-28",
   "vendorCodePattern": "^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$",
   "rows": [
     {
@@ -839,6 +839,16 @@
       "since": "2.0",
       "source": "spec/v2/core/errors.md §The envelope — a request body whose Content-Type the host does not accept (RFC 9110 §15.5.16); registered 2026-09-05 because both production hosts had to invent it"
     },
+    {
+      "code": "approval_rejected",
+      "meaning": "An approval gate resolved rejected (a decision, a quorum or a timeout) and no edge routed the failure, so the node and the run failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.43",
+      "source": "RFC 0223; spec/v2/core/interrupt.md §Rejection"
+    },
     {
       "code": "capability_not_provided",
       "meaning": "The host does not provide a capability the request or pack requires.",

package/spec/v2/ext/brand/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `none` |
 | **peer-dependency id** | `brand` |
 | **advertised as** | `extensions.<org>.brand` |
 | **declared facets** | none defined |

package/spec/v2/ext/chat/README.md

@@ -1,14 +1,14 @@
 # `chat` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `chat` names a host service that posts messages and cards into a host-established chat session. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `chat` |
 | **advertised as** | `extensions.<org>.chat` |
 | **declared facets** | none defined |

package/spec/v2/ext/coordination/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `none` |
 | **peer-dependency id** | `coordination` |
 | **advertised as** | `extensions.<org>.coordination` |
 | **declared facets** | none defined |

package/spec/v2/ext/dataIntegration/README.md

@@ -1,13 +1,13 @@
 # `dataIntegration` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `dataIntegration` names typed data-source operations: fetches from configured external sources, transforms and run-scoped variables. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
+| **technical:** | `stable` |
 | **adoption:** | `single-witness` |
 | **peer-dependency id** | `dataIntegration` |
 | **advertised as** | `extensions.<org>.data-integration` |

package/spec/v2/ext/entities/README.md

@@ -1,13 +1,13 @@
 # `entities` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `entities` names generic entity CRUD over projects and workspace assets. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
+| **technical:** | `stable` |
 | **adoption:** | `single-witness` |
 | **peer-dependency id** | `entities` |
 | **advertised as** | `extensions.<org>.entities` |

package/spec/v2/ext/kanban/README.md

@@ -1,14 +1,14 @@
 # `kanban` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `kanban` names board, task, timeline and automation operations. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `kanban` |
 | **advertised as** | `extensions.<org>.kanban` |
 | **declared facets** | none defined |

package/spec/v2/ext/knowledge/README.md

@@ -1,14 +1,14 @@
 # `knowledge` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `knowledge` names knowledge-base retrieval through the host's RAG pipeline. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `knowledge` |
 | **advertised as** | `extensions.<org>.knowledge` |
 | **declared facets** | none defined |

package/spec/v2/ext/messaging/README.md

@@ -8,7 +8,7 @@
 | --- | --- |
 | **witness:** | `claims-check` |
 | **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **adoption:** | `none` |
 | **peer-dependency id** | `messaging` |
 | **advertised as** | `extensions.<org>.messaging` |
 | **declared facets** | none defined |

package/spec/v2/ext/restTransport/README.md

@@ -1,13 +1,13 @@
 # `restTransport` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `restTransport` names conditional GET and response compression on run reads. The run-snapshot rules are in [`runs.md`](../../core/runs.md) §"Caching and encoding". This page defines the claim and what advertising it adds to those rules.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `witnessable-gated` |
-| **technical:** | `experimental` |
+| **technical:** | `stable` |
 | **adoption:** | `single-witness` |
 | **peer-dependency id** | `restTransport` |
 | **advertised as** | `extensions.<org>.rest-transport` |

package/spec/v2/ext/webResearch/README.md

@@ -1,14 +1,14 @@
 # `webResearch` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `webResearch` names search, fetch and research orchestration through the host's search adapter. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `webResearch` |
 | **advertised as** | `extensions.<org>.web-research` |
 | **declared facets** | none defined |

package/spec/v2/facets/auditLogIntegrity.schema.json

@@ -0,0 +1,30 @@
+{
+  "$comment": "RFC 0224 §A — the audit-log-integrity family's facets: the checkpoint signing key and algorithm a verifier needs, and the checkpoint cadence the host declares. The record's presence claims the hash chain, so the earlier major's `hashChain: true` has no seat.",
+  "properties": {
+    "checkpointSignatureAlgorithm": {
+      "const": "ed25519",
+      "description": "The checkpoint signature algorithm. Ed25519 over the 32 bytes `merkleRoot` hex-decodes to (RFC 0218 §A.4)."
+    },
+    "checkpointPublicKey": {
+      "type": "string",
+      "pattern": "^MCowBQYDK2VwAyEA[A-Za-z0-9+/]{43}=$",
+      "description": "The audit-signing public key: base64 (RFC 4648 §4, padded) of its DER SubjectPublicKeyInfo, 44 bytes for Ed25519. Every checkpoint `GET /audit/verify` returns MUST verify under it."
+    },
+    "checkpointIntervalEntries": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The most entries a checkpoint anchors: consecutive checkpoints' atSequence, and the first checkpoint's atSequence from 0, differ by at most this."
+    },
+    "checkpointIntervalSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The longest an appended entry waits before a checkpoint anchors it."
+    }
+  },
+  "required": [
+    "checkpointSignatureAlgorithm",
+    "checkpointPublicKey",
+    "checkpointIntervalEntries",
+    "checkpointIntervalSeconds"
+  ]
+}