@openwop/spec-artifacts 2.43.1 → 2.44.0

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.43.1",
-  "corpusTag": "v2.43.1",
+  "version": "2.44.0",
+  "corpusTag": "v2.44.0",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "69464bc0e1e71ef3b543a73d4fa4f67202343d2603c80af8033f6c3619ef1b30",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "a0a51b581511aaec7f86c67e8157988e580564f569343556dfce3c5329926ce2",
-    "api/v2/asyncapi.yaml": "0ad04a46c6985d782a7cc3645ded70fd973fcda86ef244086419274062855c09",
-    "api/v2/openapi.yaml": "95bf518a2290e614e2ba750dfe5233f8df242fafdd31dd84beafbdd512c0e810",
+    "api/seams-v2.yaml": "7efbc96aa7d5fb2d501f90585cc7fbb10da6a0ff41289b52cf6ddadf04dc852a",
+    "api/v2/asyncapi.yaml": "ac39be9e90e1daf84cb12cc268be3152c6b50f6852129ac42820db43bb26f41d",
+    "api/v2/openapi.yaml": "a8b2fdc24b017cf146985dd2360da4e794a87deb83b98fc51c54a1363fc5e391",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -116,7 +116,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "c7449daeb6e1d95e7a047b8c2814d3d54748697c27046972834874867d9b5f4c",
-    "schemas/v2/capabilities.schema.json": "ae6f60641d6ed680351b2710df945257c401f1ed83534f7e44fa2e651dc401ab",
+    "schemas/v2/capabilities.schema.json": "a76db7fbb18a98821c0ee4dfe51f615e59bb26c3d458bafd373fd3b6f7af4afe",
     "schemas/v2/certification-bundle.schema.json": "82ce31a1ed6c7e21b0ba88ff62a7b8b768fc3b176b1d06fce023203830b94725",
     "schemas/v2/channel-presence-payload.schema.json": "4eeb224910e6f7eee3ab5e7c3899559c25c83a26d0022e0ad195c4672611977a",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -142,7 +142,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "d1a6862930e7c3fbc8ec334ef17953ac7b716525c6c82769edf89d0809d0c94b",
+    "schemas/v2/error-envelope.schema.json": "34f467d5775618f740059dab0aa49bf26247101feb0cdae3403560b6baf5eda9",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -204,13 +204,13 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "29f21e0fb2c7a232a92a5c19b4cba3a86bc3b5e16f06780452f0421c66c6ec38",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "0c23e7ab67fa69cda05de86da9dee127e62d82045137fcecc1684d3201feaa97",
+    "spec/v1/core-standard-manifest.json": "5ea51250e81a3bf70637811cdb3bacfa7d35609dc49ce1a4889f0cff9fb35c85",
     "spec/v1/deprecations.json": "46df807fb4adf0aae24671c20f69975cf3496e3bc3a521cb7e6ea556bdce563c",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "dfdb7a8344316ec6b72e2e249736306cb19155f61180c5f13a44f57d51e803e8",
+    "spec/v1/gaps.json": "07b0f5a206a015336307dd343b75adec647f06a9bae59ee08dbbfac851c503d5",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "2efcd9064b2bc65a84a3b3d281aa86a91efd002690c1f4f14e8335c4a18194d1",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -221,7 +221,7 @@
     "spec/v2/core/conformance.md": "0cfceb926eed87055550a5c23e640210c795fc8cf9dd1b2544db0e2b3842c564",
     "spec/v2/core/connection-packs.md": "1ee129d792c537bfe82393ccb92555d8e6ddc342b1aa781a13f101b27ec38171",
     "spec/v2/core/conversation.md": "354fa57c73d11062e523a44aa75a6353c5c81aefaf306d30c42416a228c82c86",
-    "spec/v2/core/errors.md": "bcb62944d8a482b1b6d5ac08a692ad7e4aaadf6165746c7ba7fa39157be2a300",
+    "spec/v2/core/errors.md": "6d5a67389de84556f81e2558a30d83959c9283c8c5481ce7c759021e486d84fd",
     "spec/v2/core/events.md": "604abb6f9e2259a04103e1cb76d728712c3701c0d84dd915d4dc2949c912ee5e",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
     "spec/v2/core/headers.md": "5cb1624fa63acc81992b6a6d842ec392cf7271aaf2f65d1f83c8c4fa286e6730",
@@ -230,32 +230,32 @@
     "spec/v2/core/idempotency.md": "2084d756789c1faf5121593fb39e67ca36a4c227178e175004742e403178ea49",
     "spec/v2/core/identity.md": "2dceb1c2697015e4a4fa8a9b28f4fbd25fa44a76ca5a919c752e2a8163c819db",
     "spec/v2/core/interop.md": "e72e25dff864c83b2980d7366b34054cffa072af0225821199f260f6228d260e",
-    "spec/v2/core/interrupt.md": "b4376fbbaaa0c7b0ca5df04d40049b487753f6736f8e54ed7d75b7f8563b2f72",
+    "spec/v2/core/interrupt.md": "4c825634acac72900ebd3c5ac5941f55648fa33d2df92913ef16371dcb700a34",
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
     "spec/v2/core/oauth.md": "c96483a44b62978c596945fbb7d7c863cf6056cd980fdb4cf4e97555e3e10b72",
     "spec/v2/core/overview.md": "4087f171b00a3907551f508fec32fb9b0b3ccec8c0ac1b0c7c6d32cd2c0e3ff8",
     "spec/v2/core/packs.md": "b472a583211d466d6ab8e00c414c225b246e678043fe6283a710c899fadde913",
     "spec/v2/core/persistence.md": "711874f74cb08b03cd118d683056db10a063517762fcea73ec70feb5d983e6a4",
     "spec/v2/core/portability.md": "87c4327f674f714fda6217fd79b99d2ba219ad47dc02f9751bb56c200fb2c17a",
-    "spec/v2/core/replay.md": "22cc8dc94cd145201f1269028fb0cb2abae2d988ee748205582edd59afd1da4d",
-    "spec/v2/core/runs.md": "157600d7dd2554856bba29e231e46489b5097cc0c0a0e74073549d410897a78b",
+    "spec/v2/core/replay.md": "4d379494057746c6883f6047972e93e621863b998ed291b9a691d3aa57c1ff43",
+    "spec/v2/core/runs.md": "55e21292ae4b41d0d104199a6c2634ecb3f787c4a671f9ebc37084be38ceef03",
     "spec/v2/core/security-defaults.md": "153884da7a2d54c30c81b5e649cfdef31e151b3a2a19dee1bc5a16c35d60a3aa",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "e3b3ab6d76e51035039a32173e9b412628a52c8fe7b16687ff58a2d0d983faa0",
-    "spec/v2/core/webhooks.md": "6fc2fb7d9a993a682765ebc68e5c5bb215046ee599234ca7a660465279444eff",
+    "spec/v2/core/webhooks.md": "2fcb502be558014fd20b342687e0f078a5388fc430b2f99d883c0e73ddf7789f",
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "59f647f4d22477f6c2b06dcf913b682dde5d51dd5e607a5d0cf648ab60864d6e",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "7765c86f7a3fbdd5a80c6778fb22335f099dcc4caddf9747fb144c1f318a17f1",
+    "spec/v2/declaration.json": "aba200967c28190c6889c27dcfb01fd02919d0c023b88693e9ffc57e9488021a",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
-    "spec/v2/errors.json": "dc1a846abe3e888acb0ce4a33cf9d1fb98e41fcc8b49f42b3682fd65deca2eb2",
+    "spec/v2/errors.json": "fa650cbbdf25a140fdaf82ec5269f95b4585ac4bdde1fa6b0b3ffe48a3f7943c",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "e2731ebb5156ece1840ed3b96e7a347f6345e73071ff4e54df0f21c1585c5027",
     "spec/v2/ext/a2uiSurface/README.md": "5518c7f355262eb7cc584422f4ff8e548f066b211878f969274a3a578127622d",
-    "spec/v2/ext/brand/README.md": "4f9db1715219070fc57e06cc9b066f13aa130dd50f4869722d908e6e15720787",
-    "spec/v2/ext/canvas/README.md": "0e91b68566d2be90319feedfaebe2cd2db0bd8f72fb59c958fa723c05e38023f",
+    "spec/v2/ext/brand/README.md": "82989c018d7965bab029bcce7a67b1d76ffc433d08971a4cac91befcccc09438",
+    "spec/v2/ext/canvas/README.md": "00ca0856e3a0146f1eeaec87209d450e2900ed2748dc7520cc60250a0d3ffbeb",
     "spec/v2/ext/chat/README.md": "f59b6706162abbfff96f8bccd4c0e1aeed721047cf62e9af58c875727a38d716",
     "spec/v2/ext/coordination/README.md": "c7fe0884f52405fdd02c5f9ec309ac6b585685ee06ec5f338fff7acf03c07148",
     "spec/v2/ext/dataIntegration/README.md": "286dec8aa29e4d3225cbd8b3a361f5a438c3288e759966b9415ecbb99c576e70",
@@ -263,12 +263,12 @@
     "spec/v2/ext/grpc-transport/README.md": "6ba378e3c6d1f2e3269b392cfdf0c40565ee9bfa259d1baaa9ee1d350e38e792",
     "spec/v2/ext/kanban/README.md": "bfc386dc0f874a4afa1e3ec6a2f99084b547dcce9bd363da3b8ebd8786b9c184",
     "spec/v2/ext/knowledge/README.md": "cbe1f945a757791dedac0fd542a68c86c5b457778b831d58d9ae44a2baa270f2",
-    "spec/v2/ext/launchStudio/README.md": "c732bb855252c31ee1e971cbc2936f2ca29b234c111d548c648095634507babb",
-    "spec/v2/ext/messaging/README.md": "484cfa3091f89261dbdd48372afba441d3e6c16c3169a861b0ed7fc8c2902780",
+    "spec/v2/ext/launchStudio/README.md": "a941ef1d2401438a412eaea48d2d6ca807a032b44ea08719fea33120daf088a0",
+    "spec/v2/ext/messaging/README.md": "949f350e35294f52ad490e42699f8c560cd154549516fbaa1805f06312b7f342",
     "spec/v2/ext/portability/README.md": "c59423ee446638b748a911b9e97e803c4786157be6120f656f0a060586bc7b82",
     "spec/v2/ext/provider-idempotency/README.md": "9d1bccef0ec16a19a3370ae79c2f5a1726ce0d1d25a51352907f288a2ccb15d7",
     "spec/v2/ext/provider-idempotency/registry.json": "5b5fecad604fb4ab38da39f5abe697a4e57b05406c398f8afeb377331b2bd965",
-    "spec/v2/ext/restTransport/README.md": "acda51f1a973308841861a119def691db972f310c7b7250ab14f248e9c968585",
+    "spec/v2/ext/restTransport/README.md": "c875fd7ae4818a5d5e93ab9b21e569de8700bb07c4dafacd60a46a46e4022ddb",
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
     "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
@@ -286,7 +286,7 @@
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
-    "spec/v2/facets/webhooks.schema.json": "2fac635ee5fbc10a14a1a46cf512a11bac660bfbabe0aea79f6c7b657ecb9e4e",
+    "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
@@ -298,9 +298,9 @@
     "spec/v2/path-manifest.json": "17298a245c5da9a70aa7ab0b7f2db4277e06209d6fcdd7187a8b4cea179c08f3",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "e52aaf9f10896088b2fcca2586ab05a477043275e7a3a48b769ffb4865e37c4a",
+    "spec/v2/release.json": "a93ba35569a8a8bbc68243fbaef446363e5d5d5d0b8c1235ec68d0eed5ab6363",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "d5b4e6c55a1d4bbe54241f9d0d020e7f9857f29912bb9f2ef910087b276be7e6"
+    "spec/v2/surface-baseline.json": "0d60d3d34ddc8f1290a2fc3a6be2e5ef5cfa211cde0918d8702ec4dd299d5549"
   },
-  "corpusCommit": "a99d0e2a2fd3000cff23cade553a6a45ad8f17a9"
+  "corpusCommit": "8bb20a89a81544aaf90b3a375fc6b1f4ffef3a33"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.43.1
+  version: 2.44.0
   description: 'The OpenWOP conformance seams profile (`openwop-conformance-seams-v2`): test-only operations in their own
     path space, `/conformance/seams/…`. The profile is versioned and validated against the canonical v2 schemas with no tolerance
     path. It is not a capability: a host advertises the profile, never a `testSeams` flag.

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.43.1
+  version: 2.44.0
   description: 'OpenWOP v2 event streams over SSE. The run-events channel''s address is the OpenAPI path key, and the server
     pathname is empty (bare origin). `streamMode` is a stream mode from the closed set, or a comma-separated combination of
     them; `values` never combines. `hostEvents` has a default address, `/host/events`; a host MAY declare another under `heartbeat.deliveryChannel`.

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.43.1
+  version: 2.44.0
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: 'The OpenWOP v2 REST API. Paths are unversioned and served at the bare origin; a client selects a version with
     the `OpenWOP-Version` header from the host''s `protocolVersions[]`. Conformance seams and test-mode operations are not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.43.1",
+  "version": "2.44.0",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/capabilities.schema.json

@@ -5329,6 +5329,11 @@
                 "fixed",
                 "exponential"
               ]
+            },
+            "maxElapsedMs": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "RFC 0225 — OPTIONAL. The longest, in ms, from a delivery's first attempt starting to its routing to the dead-letter sink when every attempt fails. A host advertising it MUST dead-letter an exhausted delivery within that bound (webhooks.md §Delivery)."
             }
           },
           "description": "spec/v2/core/webhooks.md §Delivery — the policy a host retries a failed attempt under. The webhooks family carries it at v2; `triggerBridge.retryPolicy` is the v1 carrier and stays through the overlap."

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 108 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 111 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -96,6 +96,9 @@
             "workspace_too_large",
             "unsupported_media_type",
             "approval_rejected",
+            "node_config_invalid",
+            "sandbox_invocation_error",
+            "mcp_error",
             "capability_not_provided",
             "capability_required",
             "credential_required",
@@ -369,6 +372,9 @@
     "workspace_too_large": 413,
     "unsupported_media_type": 415,
     "approval_rejected": 422,
+    "node_config_invalid": 422,
+    "sandbox_invocation_error": 422,
+    "mcp_error": 502,
     "capability_not_provided": 422,
     "capability_required": 422,
     "credential_required": 422,

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.43.1"
+      "version": "2.44.0"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -421,5 +421,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "7800a051d432c1244efd10dcee93b93ddde389aa6bfa843279d0ff6b9d734658"
+  "digest": "fb25d9cf69d577e91d0c6e806546d28c8c43b8df666bb8dfef8bd8931945f9d5"
 }

package/spec/v1/gaps.json

@@ -7271,6 +7271,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0140.10",
+      "rfc": "0140",
+      "local": "G10",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.replay.suppression-execution-ordinal` (openwop#1718) has no witness on any host, positive or negative. `conformance-replay-ordinal-loop` needs a host that both runs cycles and suppresses a side-effecting node in replay. The v2 reference host does neither for this fixture: it does not loop, it does not execute `core.conformance.side-effect`, and its `effectOutcome` (`store.ts:586` at openwop-examples `f56f092`) selects the latest outcome regardless of ordinal, which would fail the row if it looped. openwop-app does not index by ordinal (`nodeAttempts` is never reset), and MyndHyve does not seed `replaySourceOutcomes` from the prefix.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-loops-with-replay-suppression",
+      "sources": [
+        {
+          "file": "RFCS/registers/0140-replay-side-effect-suppression.gaps.md",
+          "token": "G10"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0141.0",
       "rfc": "0141",
@@ -9826,11 +9843,11 @@
       "rfc": "0171",
       "local": "G7",
       "section": "§B.1",
-      "surface": "MyndHyve emits about 56 UPPER_CASE run-failure codes (normalised in `failurePayload`, measured at MyndHyve `fc3b007cf`) that are neither registered nor vendor codes.",
+      "surface": "MyndHyve emitted about 56 UPPER_CASE run-failure codes that were neither registered nor vendor codes.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "myndhyve-code-remap",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0171-v2-wire-envelope.gaps.md",
@@ -9843,7 +9860,7 @@
       "rfc": "0171",
       "local": "G8",
       "section": "§B.1",
-      "surface": "The v2 reference host emitted 3 unregistered run-failure codes (measured at openwop-examples `456dfaa`).",
+      "surface": "The v2 reference host emitted unregistered run-failure codes that were not vendor codes.",
       "witness": "unclassified",
       "requirementId": null,
       "disposition": "closed",
@@ -13059,8 +13076,8 @@
       "surface": "No v2 SDK sends the header today (`openwop-sdks`: `sdk/typescript-v2`, `sdk/python-v2`, Go).",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "transferred",
-      "target": "rfc-0219",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0219-client-version-header.gaps.md",
@@ -13068,6 +13085,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0219.7",
+      "rfc": "0219",
+      "local": "G7",
+      "section": "§Conformance",
+      "surface": "`openwop.requirement.0219.no-floor-no-refusal` has no positive witness. All three measured hosts (the v2 reference host, MyndHyve, openwop-app) advertise `minClientVersion`, so every committed bundle records the row `inapplicable` with the reason \"this leg is for a host with no floor\".",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-without-min-client-version",
+      "sources": [
+        {
+          "file": "RFCS/registers/0219-client-version-header.gaps.md",
+          "token": "G7"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0219.8",
+      "rfc": "0219",
+      "local": "G8",
+      "section": "§A / upgrade",
+      "surface": "A browser preflights the new request header. A host whose `Access-Control-Allow-Headers` is an explicit list, and which serves browsers cross-origin, fails every request from a client that sends it. Found at the SDK 2.5.0 release: openwop-app's list omitted it (as it once omitted `OpenWOP-Version`), and so did MyndHyve's public pack reads (fixed in myndhyve#549). v2 says nothing about CORS.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "openwop#1763",
+      "sources": [
+        {
+          "file": "RFCS/registers/0219-client-version-header.gaps.md",
+          "token": "G8"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0220.1",
       "rfc": "0220",
@@ -13136,6 +13187,23 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0220.5",
+      "rfc": "0220",
+      "local": "G5",
+      "section": "§B",
+      "surface": "`canvas` has no tier-2 path yet. MyndHyve serves the canvas host service (myndhyve #547), but its claim depends on the `vendor.myndhyve.canvas` pack. The only v2-admissible version (1.0.1, `registry/v2/`) is signed with `signing.scheme: ed25519-canonical-json` (RFC 0177 §A), and MyndHyve's pack publish route and resolver do not implement that scheme. The v1-tree 1.0.0 pins `engines.openwop <2.0.0`, which a v2 host MUST refuse. This is a general v2 pack-signing gap at the host, not canvas-specific.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0220-ext-families-graduate-on-evidence.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.0221.1",
       "rfc": "0221",
@@ -13243,11 +13311,11 @@
       "rfc": "0223",
       "local": "G4",
       "section": "§Implementation notes",
-      "surface": "openwop-app records no `action` on single reject or timeout, emits no `interrupt.resolved` on quorum reject, never emits `approval.rejected`, and emits no `node.failed` / `failedNodeId` on either reject path.",
+      "surface": "openwop-app recorded no `action` on single reject or timeout, emitted no `interrupt.resolved` on quorum reject, never emitted `approval.rejected`, and emitted no `node.failed` / `failedNodeId` on either reject path.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "openwop-app-followup",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13260,11 +13328,11 @@
       "rfc": "0223",
       "local": "G5",
       "section": "§Implementation notes",
-      "surface": "MyndHyve fails the gate with the unregistered `APPROVAL_REJECTED`.",
+      "surface": "MyndHyve failed the gate with the unregistered `APPROVAL_REJECTED`.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "myndhyve-next-cut",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
@@ -13341,36 +13409,36 @@
       ]
     },
     {
-      "id": "openwop.gap.0223.9",
+      "id": "openwop.gap.0223.10",
       "rfc": "0223",
-      "local": "G9",
+      "local": "G10",
       "section": "§Conformance",
-      "surface": "`openwop.requirement.0223.reject-loopback-reasks` (openwop #1697) has no positive witness on any host. The v2 reference host does not run cycles. MyndHyve runs request-changes loops over condition edges on a successful gate output, and does not route a failed node over `any_failed` (its Cloud Run executor has no `triggerRule` handling), so the row stays `inapplicable` there. openwop-app rejects cycles. The row exists and is negatively controlled: registering the fixture on a host that does not loop records `executed-fail`.",
+      "surface": "`openwop.requirement.0223.timeout-rejects` and `0223.timeout-never-grants` had no certified witness, and have no MyndHyve witness: its `core.approvalGate` has no timeout configuration.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "host-routes-failed-gate-over-cycle",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
-          "token": "G9"
+          "token": "G10"
         }
       ]
     },
     {
-      "id": "openwop.gap.0223.10",
+      "id": "openwop.gap.0223.11",
       "rfc": "0223",
-      "local": "G10",
+      "local": "G11",
       "section": "§Conformance",
-      "surface": "`openwop.requirement.0223.timeout-rejects` and `0223.timeout-never-grants` have no MyndHyve witness: its `core.approvalGate` has no timeout configuration. On the v2 reference host both rows are negatively controlled (sweep sabotaged, or the `onTimeout` exclusion present) and pass locally with the fixtures registered. They need suite 2.43.1 and a new certified cut.",
+      "surface": "*(Renumbered from a second `G9` on 2026-09-28: two rows shared the local ID, so `spec/v1/gaps.json` carried `openwop.gap.0223.9` twice.)* `openwop.requirement.0223.reject-loopback-reasks` (openwop #1697) has no positive witness on any host. The v2 reference host does not run cycles. MyndHyve runs request-changes loops over condition edges on a successful gate output, and does not route a failed node over `any_failed` (its Cloud Run executor has no `triggerRule` handling), so the row stays `inapplicable` there. openwop-app rejects cycles. The row exists and is negatively controlled: registering the fixture on a host that does not loop records `executed-fail`.",
       "witness": "unclassified",
       "requirementId": null,
       "disposition": "externally-gated",
-      "target": "certified-cut-on-2.43.1",
+      "target": "host-routes-failed-gate-over-cycle",
       "sources": [
         {
           "file": "RFCS/registers/0223-approval-reject-disposition.gaps.md",
-          "token": "G10"
+          "token": "G11"
         }
       ]
     },
@@ -13408,6 +13476,40 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0225.1",
+      "rfc": "0225",
+      "local": "G1",
+      "section": "§Implementation notes",
+      "surface": "No host advertises `retryPolicy.maxElapsedMs` yet, so the new row has no witness.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "host-advertises-max-elapsed",
+      "sources": [
+        {
+          "file": "RFCS/registers/0225-webhook-retry-max-elapsed.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0226.1",
+      "rfc": "0226",
+      "local": "G1",
+      "section": "§Unresolved questions",
+      "surface": "Whether `mcp_unreachable` (an MCP peer that cannot be reached) needs its own registered code.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0226-shared-run-failure-codes.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.spec.a2a-integration.g1",
       "rfc": "0152",

package/spec/v2/core/errors.md

@@ -4,11 +4,11 @@
 
 ## Why this exists
 
-Every error a v2 host returns is a row in one registry. A client routes on `error`, never on `message`. A code that is not registered is not a protocol error. The registry is the single source for the envelope schema, the HTTP status and retriability.
+Every error a v2 host returns is a row in one registry. A client routes on `error`, never on `message`. A code that is not registered is not a protocol error.
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **108** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **111** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
 - A host MUST emit a registered code, or a vendor code, wherever it emits an error code: the `error` of every error response, and `error.code` on `run.failed`, `node.failed` and the snapshot's `error` (overview.md §0). A recorded event re-emitted by replay or `:fork` is carried as recorded ([replay.md](replay.md)).
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
@@ -47,7 +47,7 @@ The idempotency mismatch code is `idempotency_key_mismatch` only ([idempotency.m
 
 ## Codes by HTTP status
 
-Generated from `spec/v2/errors.json` (108 codes; `retriable` and `statusSource` are in the registry).
+Generated from `spec/v2/errors.json` (111 codes; `retriable` and `statusSource` are in the registry).
 
 Code | Status
 --- | ---
@@ -141,10 +141,12 @@ Code | Status
 `fork_point_invalid` | 422
 `loop_limit_exceeded` | 422
 `mcp_mrtr_rounds_exceeded` | 422
+`node_config_invalid` | 422
 `pack_runtime_requirement_unmet` | 422
 `recursion_limit_exceeded` | 422
 `residency_unavailable` | 422
 `run_timeout` | 422
+`sandbox_invocation_error` | 422
 `sandbox_memory_exceeded` | 422
 `sandbox_timeout` | 422
 `token_budget_exceeded` | 422
@@ -157,6 +159,7 @@ Code | Status
 `pack_load_failure` | 500
 `payload_unprojectable` | 500
 `credential_unavailable` | 501
+`mcp_error` | 502
 `pack_registry_unreachable` | 503
 `runner_unavailable` | 503
 

package/spec/v2/core/interrupt.md

@@ -118,13 +118,17 @@ The token grammar and the `interrupt.tokenAlgs[]` / `kid` check are [identity.md
 
 ### Rejection
 
-A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and SHOULD also emit `approval.rejected`. The resume value returns to the raising node (§Re-entry and resume values).
+A `reject` exits the suspend. The host MUST record `action: "reject"` and `decision: "rejected"` on `interrupt.resolved`, and MAY also emit `approval.rejected`. The resume value returns to the raising node (§Re-entry and resume values).
 
 - A node that does not turn the rejection into an output MUST fail with `approval_rejected` and `retryable: false` on the `node.failed` error, and MUST NOT be retried.
 - A rejected gate is a failed source. It MUST NOT satisfy an `all_success`, `any_success` or `none_failed` edge. The run continues past it only over an edge whose `triggerRule` admits a failed source (`all_complete` or `any_failed`).
 - When no such edge exists, the run MUST terminate `failed` with `run.failed.error.code` `approval_rejected` and `failedNodeId` naming the gate.
 - The gate resolves rejected on one eligible `reject` under `single-veto`, or when rejects exceed half of `requiredApprovals` under `majority`. A vote that does not decide the gate MUST NOT emit `interrupt.resolved`.
-- When a non-zero `timeoutMs` elapses with no resolution, the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, whatever `onTimeout` holds, and MUST apply the rules above. A timeout MUST NOT grant a gate. A host MUST treat `onTimeout: "approve"` as `reject` and SHOULD NOT emit it. `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate. A host MUST NOT accept `timeout` on a resume request.
+- When a non-zero `timeoutMs` elapses with no resolution:
+  - the host MUST resolve the gate rejected, recording `action: "timeout"`, `decision: "rejected"` and `reason: "timeout"`, whatever `onTimeout` holds, and MUST apply the rules above;
+  - a timeout MUST NOT grant a gate. A host MUST treat `onTimeout: "approve"` as `reject` and SHOULD NOT emit it;
+  - `escalate` MAY notify a host-defined target but MUST NOT extend or grant the gate;
+  - a host MUST NOT accept `timeout` on a resume request.
 - On replay the failure MUST be derived from the recorded `interrupt.resolved`, never re-decided.
 
 ## Approver enforcement

package/spec/v2/core/replay.md

@@ -63,7 +63,7 @@ When a replayed node produces an event different from the source at the same seq
 Divergence codes (`spec/v2/errors.json`):
 
 - **`replay_diverged_at_refusal`** (fork fails, `409`) — the source obtained a valid envelope and the replay a refusal, or the reverse. The host MUST NOT substitute silently; it MUST emit `replay.diverged-at-refusal` naming the node and both envelope kinds and fail the replay with this code.
-- **`replay_source_missing`** (`node.failed` payload; the fork request still returns `201`) — a side-effecting node reached with no recorded source outcome for `(nodeId, attempt)` (§Suppression).
+- **`replay_source_missing`** (`node.failed` payload; the fork request still returns `201`) — a side-effecting node reached with no recorded source outcome (§Suppression).
 - **`replay_memory_snapshot_unavailable`** (fork refused, `409`) — the host cannot serve memory state as-of `fromSeq`. It MUST refuse rather than substitute current memory; `details.fromSeq` SHOULD name the index.
 - **`replay_context_summary_unavailable`** (fork refused, `409`) — the host advertises `multiAgent.executionModel.contextBudget.summarization` and cannot serve, as-of `fromSeq`, a summary artifact (`context.summarized.summaryRef`) the replay would reuse. It MUST refuse rather than re-summarize; `details.fromSeq` SHOULD name the index.
 
@@ -74,7 +74,7 @@ Suppression is an obligation of the `replay` surface: advertising `replay` binds
 For a fork with `mode: replay`:
 
 1. A node that performs an external side effect — any operation observable outside the run's own event log — MUST NOT perform it.
-2. The host MUST resolve the node's outcome from the source run's recorded terminal outcome for the same `(nodeId, attempt)`, keyed on `(sourceRunId, nodeId, attempt)` and never on the fork's own `runId` (the Layer-2 key includes `runId`, so it cannot span a fork).
+2. The host MUST resolve the node's outcome from the source run's recorded terminal outcome keyed on `(sourceRunId, nodeId, n)`, never on the fork's own `runId`, where `n` counts the node's `node.started` events through this execution, including retries, later visits and the fork's inherited prefix.
 3. Absent a recorded outcome, the host MUST fail the node closed with `replay_source_missing`, MUST NOT perform the effect, and MUST NOT substitute a synthesized or empty success.
 4. A node whose pack manifest declares `role: "side-effect"` MUST be treated as side-effecting; a host classifier MAY add nodes and MUST NOT remove any. A throwing seam satisfies rule 1 only.
 5. The guarantee is whole-run and requires both classification before execution and a default-deny guard at every effect seam.
@@ -102,7 +102,7 @@ A host advertising `replay` MUST publish `schemas/v2/effect-seam-manifest.schema
 1. Load the source run's events with `sequence < fromSeq` through the storage boundary, where an era-`2` log is translated (persistence.md).
 2. Fold them to a projected state.
 3. Initialize the new run with that state, copy-on-write into its own log.
-4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, attempt)`; LLM invocations additionally consult the invocation log via the content-addressed invocation key.
+4. For `replay`, resolve side-effecting nodes from the source run's recorded outcomes keyed on `(sourceRunId, nodeId, n)`; LLM invocations additionally consult the invocation log via the content-addressed invocation key.
 5. For `branch`, executor invocations create new invocation-log entries keyed on the new `runId`.
 
 ## Forking a v1 run

package/spec/v2/core/runs.md

@@ -63,7 +63,7 @@ The `createRun` body is closed (`unevaluatedProperties: false`). Its fields:
 The `201` response is `{ runId, status, eventsUrl, statusUrl? }`. `status` is one of `pending`, `running`, `waiting-approval`, `waiting-input`, `waiting-external`.
 
 - `eventsUrl` and `statusUrl` MUST resolve under the origin the request was made to — a relative path, or an absolute URL on the same origin — and MUST NOT downgrade the scheme. A link naming a different host, or `http://` on an `https://` origin, is non-conformant.
-- The base that minted `runId` MUST resolve it: `GET /runs/{runId}` and `GET /runs/{runId}/events/poll` at that base MUST answer `200` for the returned id, percent-encoded per [identity.md](identity.md) §5. (A front door that decodes `%2F` before routing makes every tenant-bound id unreachable.)
+- The base that minted `runId` MUST resolve it: `GET /runs/{runId}` and `GET /runs/{runId}/events/poll` at that base MUST answer `200` for the returned id, percent-encoded per [identity.md](identity.md) §5.
 
 ### Refusals
 
@@ -191,7 +191,7 @@ Per-entry errors ([errors.md](errors.md)):
 `drainPolicy` is one of:
 
 - `drain-current-node` (default) — the executing node reaches a terminal first.
-- `immediate` — the run is snapshotted between events. The executing attempt is cut: it has no terminal node event, a host MUST NOT record `node.failed` (or any terminal node event) for it, and the resumed run's `node.started` begins a fresh attempt. `run.paused` itself records the interruption; its payload MAY carry `interruptedNodeId` and `interruptedAttempt` so a `debug` consumer can see which attempt was cut.
+- `immediate` — the run is snapshotted between events. The executing attempt is cut: it has no terminal node event, a host MUST NOT record `node.failed` (or any terminal node event) for it, and the resumed run's `node.started` begins a fresh attempt. `run.paused` itself records the interruption; its payload MAY carry `interruptedNodeId` and `interruptedAttempt`.
 
 `resumeRun` accepts `{ reason? }`, answers `202 { runId, status: 'running', resumedAt? }`, and emits `run.resumed`.
 
@@ -224,6 +224,8 @@ The `201` response is `{ runId, sourceRunId, fromSeq?, mode, status, eventsUrl }
 
 `getRunAncestry` returns `schemas/v2/run-ancestry-response.schema.json` (`runId`, `hostId`, `parent` or `null`). A client walks the chain one hop at a time via `parent.wellKnownUrl`.
 
+`parent` is the dispatching run, `cause` its composition mechanism. A fork is not dispatched (its lineage is `parentRunId`): its `parent` MUST be `null`.
+
 ## Annotations, artifacts, eval summary
 
 ### Annotations

package/spec/v2/core/webhooks.md

@@ -9,7 +9,7 @@ A client registers a URL and an event filter once; the host POSTs matching event
 
 ## Surfaces
 
-A host that advertises `webhooks` ([capabilities.md](capabilities.md)) serves `registerWebhook` (`POST /webhooks`) and `unregisterWebhook` (`DELETE /webhooks/{webhookId}`) from `api/v2/openapi.yaml`. The facet (`spec/v2/facets/webhooks.schema.json`) is `{ signatureAlgorithms[] }`, which MUST list `"v1"`.
+A host that advertises `webhooks` ([capabilities.md](capabilities.md)) serves `registerWebhook` (`POST /webhooks`) and `unregisterWebhook` (`DELETE /webhooks/{webhookId}`) from `api/v2/openapi.yaml`. The facet (`spec/v2/facets/webhooks.schema.json`) carries `signatureAlgorithms[]`, which MUST list `"v1"`.
 
 | Operation | Request | Response |
 | --- | --- | --- |
@@ -77,7 +77,7 @@ A subscriber MUST reject an unrecognized `OpenWOP-Signature-Algorithm` value, an
 
 Durable delivery is an obligation of the `webhooks` surface ([security-defaults.md](security-defaults.md)). A host MUST:
 
-- retry a failed attempt per its advertised `retryPolicy` (`maxAttempts`, `backoff ∈ none | fixed | exponential`) with backoff between attempts;
+- retry a failed attempt per its advertised `retryPolicy` (`maxAttempts`, `backoff ∈ none | fixed | exponential`, optional `maxElapsedMs`) with backoff between attempts, and when it advertises `maxElapsedMs`, dead-letter an exhausted delivery within that many milliseconds of the first attempt's start;
 - route a delivery whose retries are exhausted to the dead-letter sink (§Dead letters), rather than drop it;
 - deliver each matching event at least once; a receiver MAY observe the same event more than once;
 - not make the start of an attempt to one subscription wait for an attempt to a *different* subscription to finish (answered, failed, or timed out) (§Delivery isolation);
@@ -108,7 +108,7 @@ This sink is the delivery sink; the `deadLetter` family is the run sink and is a
 
 ## Replay
 
-A host MUST NOT deliver events a `replay` fork re-emits as fixed history; replay-ness is read from the run, never from the event type (replay.md). A `branch` fork's events are new facts and are delivered.
+A `replay` fork's re-emitted history is never delivered ([replay.md](replay.md) §Suppression); a `branch` fork's events are.
 
 ## Egress
 

package/spec/v2/declaration.json

@@ -1803,8 +1803,8 @@
       "extensionName": "brand",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1821,8 +1821,8 @@
       "extensionName": "canvas",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1947,8 +1947,8 @@
       "extensionName": "launch-studio",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "single-witness"
+        "technical": "stable",
+        "adoption": "multi-witness"
       },
       "facets": [],
       "floorScenarios": [],
@@ -1965,8 +1965,8 @@
       "extensionName": "messaging",
       "witness": "claims-check",
       "maturity": {
-        "technical": "experimental",
-        "adoption": "none"
+        "technical": "stable",
+        "adoption": "single-witness"
       },
       "facets": [],
       "floorScenarios": [],

package/spec/v2/errors.json

@@ -849,9 +849,39 @@
       "since": "2.43",
       "source": "RFC 0223; spec/v2/core/interrupt.md §Rejection"
     },
+    {
+      "code": "node_config_invalid",
+      "meaning": "A node's configuration is missing a required value or holds one the node cannot use, so the node failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.44",
+      "source": "RFC 0226 §A (measured: openwop-app `invalid_config` ×13, MyndHyve `CONFIG_INVALID`)"
+    },
+    {
+      "code": "sandbox_invocation_error",
+      "meaning": "A pack node running in the sandbox threw an error outside the canonical sandbox catalog, so the node failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.44",
+      "source": "RFC 0226 §A; spec/v1/host-sample-test-seams.md:340 already names it (the suite's sandbox probe emits it)"
+    },
+    {
+      "code": "mcp_error",
+      "meaning": "An MCP server the host called answered with a JSON-RPC error, so the node failed.",
+      "httpStatus": 502,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.44",
+      "source": "RFC 0226 §A (a v2 decision: the host acted as a gateway to the MCP peer, whose answer was an error)"
+    },
     {
       "code": "capability_not_provided",
-      "meaning": "The host does not provide a capability the request or pack requires.",
+      "meaning": "The host does not provide a capability the request or pack requires, including a node type it cannot execute.",
       "httpStatus": 422,
       "statusSource": "v1 convention",
       "retriable": false,

package/spec/v2/ext/brand/README.md

@@ -1,14 +1,14 @@
 # `brand` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `brand` names a host service for brand artifacts: themes and personas. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `brand` |
 | **advertised as** | `extensions.<org>.brand` |
 | **declared facets** | none defined |

package/spec/v2/ext/canvas/README.md

@@ -1,14 +1,14 @@
 # `canvas` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `canvas` names a host service that reads and writes canvas state. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `canvas` |
 | **advertised as** | `extensions.<org>.canvas` |
 | **declared facets** | none defined |

package/spec/v2/ext/launchStudio/README.md

@@ -1,14 +1,14 @@
 # `launchStudio` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `launchStudio` names launch-studio operations for the multi-canvas launch workflow. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `single-witness` |
+| **technical:** | `stable` |
+| **adoption:** | `multi-witness` |
 | **peer-dependency id** | `launchStudio` |
 | **advertised as** | `extensions.<org>.launch-studio` |
 | **declared facets** | none defined |

package/spec/v2/ext/messaging/README.md

@@ -1,14 +1,14 @@
 # `messaging` extension
 
-> **Status: Draft.**
+> **Status: Stable.**
 
 `messaging` names outbound chat-egress dispatch through host-owned connectors. It is a discovery-only reservation: v2 defines no portable operations or payload contract for it.
 
 | Field | Value |
 | --- | --- |
 | **witness:** | `claims-check` |
-| **technical:** | `experimental` |
-| **adoption:** | `none` |
+| **technical:** | `stable` |
+| **adoption:** | `single-witness` |
 | **peer-dependency id** | `messaging` |
 | **advertised as** | `extensions.<org>.messaging` |
 | **declared facets** | none defined |

package/spec/v2/ext/restTransport/README.md

@@ -32,12 +32,14 @@ For each coding listed in `contentEncodings`, a request that names only that cod
 
 A client MUST NOT infer anything else from the record.
 
+The claim describes what a client receives at the host's advertised base URL, so a CDN or proxy in front of the host is part of it. A front that drops or rewrites a coding the origin produces makes the claim false. A host behind a front should list only the codings measured through that front.
+
 ## Conformance
 
 `conformance/src/scenarios/v2-ext-rest-transport.test.ts` (major 2) records the witness under `openwop.family.restTransport`:
 
 - **Conditional GET:** runs the `conformance-approval` fixture to `waiting-approval`. It checks for a strong `ETag`, a `304` with no body on a matching `If-None-Match`, and a changed `ETag` once the run completes.
-- **Codings:** for each advertised coding, the decoded body is byte-identical to the identity body.
+- **Codings:** for each advertised coding, the decoded body is byte-identical to the identity body. The probe goes through the base URL it is given, so it measures any front in the path.
 
 A host without the claim records `inapplicable`. A host that makes the claim but lacks the fixture records `blocked`.
 

package/spec/v2/facets/webhooks.schema.json

@@ -35,6 +35,11 @@
             "fixed",
             "exponential"
           ]
+        },
+        "maxElapsedMs": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "RFC 0225 \u2014 OPTIONAL. The longest, in ms, from a delivery's first attempt starting to its routing to the dead-letter sink when every attempt fails. A host advertising it MUST dead-letter an exhausted delivery within that bound (webhooks.md \u00a7Delivery)."
         }
       },
       "description": "spec/v2/core/webhooks.md \u00a7Delivery \u2014 the policy a host retries a failed attempt under. The webhooks family carries it at v2; `triggerBridge.retryPolicy` is the v1 carrier and stays through the overlap."

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.43.1",
-  "corpusTag": "v2.43.1",
-  "updated": "2026-09-27"
+  "version": "2.44.0",
+  "corpusTag": "v2.44.0",
+  "updated": "2026-09-28"
 }

package/spec/v2/surface-baseline.json

@@ -4,7 +4,7 @@
     "schemas/v2/**/*.json",
     "spec/v2/path-manifest.json"
   ],
-  "release": "2.43.1",
+  "release": "2.44.0",
   "kinds": {
     "union": [
       "channel",
@@ -18,7 +18,7 @@
       "type"
     ]
   },
-  "count": 8552,
+  "count": 8557,
   "surfaces": [
     "schemas/v2/a2a-task-state.schema.json#/contextId|type|string",
     "schemas/v2/a2a-task-state.schema.json#/interruptKind|enum-member|\"approval\"",
@@ -3521,9 +3521,11 @@
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy/backoff|enum-member|\"none\"",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy/backoff|type|string",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy/maxAttempts|type|integer",
+    "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy/maxElapsedMs|type|integer",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|closed|true",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|property|backoff",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|property|maxAttempts",
+    "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|property|maxElapsedMs",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|required|backoff",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|required|maxAttempts",
     "schemas/v2/capabilities.schema.json#/webhooks/retryPolicy|type|object",
@@ -5365,8 +5367,10 @@
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"interrupt_token_invalid\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"key_revoked\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"loop_limit_exceeded\"",
+    "schemas/v2/error-envelope.schema.json#/error|enum-member|\"mcp_error\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"mcp_mrtr_rounds_exceeded\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"mock_provider_forbidden\"",
+    "schemas/v2/error-envelope.schema.json#/error|enum-member|\"node_config_invalid\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"not_found\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"oauth_provider_unsupported\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"oauth_scope_unsupported\"",
@@ -5405,6 +5409,7 @@
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"runner_unavailable\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"sandbox_capability_denied\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"sandbox_escape_attempt\"",
+    "schemas/v2/error-envelope.schema.json#/error|enum-member|\"sandbox_invocation_error\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"sandbox_memory_exceeded\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"sandbox_timeout\"",
     "schemas/v2/error-envelope.schema.json#/error|enum-member|\"schedule_horizon_exceeded\"",