@openwop/spec-artifacts 2.44.4 → 2.44.6

package/spec/v2/core/webhooks.md

@@ -89,7 +89,7 @@ Best-effort delivery is not a conforming mode. A `3xx` response is a delivery fa
 
 ### Delivery isolation
 
-One subscription's slow or dead receiver MUST NOT delay another subscription's deliveries (invariant `webhook-delivery-isolation`). The rule is about when an attempt starts, not how soon after an event it must start, and it names no mechanism: a lane per subscription, a concurrent pool or asynchronous I/O all meet it; a sequential loop over a batch does not.
+One subscription's slow or dead receiver MUST NOT delay another subscription's deliveries (invariant `webhook-delivery-isolation`). The rule constrains when an attempt starts, not how soon after its event, and names no mechanism; a sequential loop over a batch does not meet it.
 
 A host MAY bound concurrent attempts beyond the floor of 8, and SHOULD NOT let one tenant's unanswered attempts occupy capacity another tenant's deliveries need.
 
@@ -99,10 +99,10 @@ An attempt whose request the host had begun sending before `unregisterWebhook` a
 
 ### Dead letters
 
-This sink is the delivery sink; the `deadLetter` family is the run sink ([runs.md](runs.md) §Dead letters) and is a different thing.
+This is the delivery sink, not the run sink of the `deadLetter` family ([runs.md](runs.md) §Dead letters).
 
 - A host advertising `webhooks.deadLetter` MUST serve `GET /webhooks/{webhookId}/dead-letters`.
-- A record MUST NOT carry the delivered body, the delivery headers, or the subscription secret — a dead-letter read names a delivery, it does not replay one.
+- A record names a delivery and MUST NOT carry the delivered body, the delivery headers, or the subscription secret.
 - The read belongs to a live subscription: after `unregisterWebhook` answers `204`, `GET /webhooks/{webhookId}/dead-letters` for that id MUST answer `404 not_found`, exactly as for a same-tenant id the host never minted. The host MAY discard that subscription's records at the unregister.
 - `expiresAt` bounds a record's retention only while its subscription exists.
 
@@ -124,13 +124,20 @@ At delivery time a host MUST re-resolve the hostname, validate every resolved ad
 
 ## Inbound triggers
 
-A host advertising `triggerBridge` runs inbound work through subscriptions (`schemas/v2/trigger-subscription.schema.json`) that are `active`, `paused` (not delivering; a schedule skips ticks), `failed`, or `dead-lettered` (deliveries in the `deadLetter` sink); `subscriptionStates` lists those it implements. On an `active` subscription the host:
+A host advertising `triggerBridge` runs inbound work through subscriptions (`schemas/v2/trigger-subscription.schema.json`), and `subscriptionStates` lists the states it implements:
+
+- `active`;
+- `paused` — not delivering; a schedule skips ticks;
+- `failed`;
+- `dead-lettered` — deliveries are in the `deadLetter` sink.
+
+On an `active` subscription the host:
 
 - with `dedup`, MUST answer a `dedupKey` repeated within retention (at least 24 hours) with the prior `runId`;
-- retries per `retryPolicy`, then dead-letters, starting no run;
+- retries a failed delivery per `retryPolicy`, then dead-letters it without starting a run;
 - MUST set the delivery id as `causationId` on `run.started`.
 
-A source in `triggerBridge.sources` MUST run through these states and emit `trigger.subscription-state-changed` and `trigger.delivery-attempted`, which MUST NOT carry inbound content or credentials (`schemas/v2/run-event-payloads.schema.json`).
+A source in `triggerBridge.sources` MUST move through these states and emit `trigger.subscription-state-changed` and `trigger.delivery-attempted`. These events MUST NOT carry inbound content or credentials (`schemas/v2/run-event-payloads.schema.json`).
 
 With `triggerBridge.ingestion`, each `externalSources` entry MUST turn an external event into a `TriggerEvent` (`schemas/v2/trigger-event.schema.json`, whose rules bind) and start a run. The host:
 
@@ -140,6 +147,4 @@ With `triggerBridge.ingestion`, each `externalSources` entry MUST turn an extern
 - MUST refuse private, link-local and loopback targets and cap the body on any ingestion fetch, and never hand the run a URL (invariant `trigger-ingestion-ssrf`);
 - SHOULD key `stream` by topic, partition and offset, `change` by table and changelog id; a key MUST survive broker redelivery.
 
-See also: events.md, replay.md, persistence.md, security-defaults.md.
-
 *Sources: RFCs 0053, 0083, 0099, 0127, 0165, 0171, 0173, 0176, 0188, 0196, 0201, 0215, 0217.*

package/spec/v2/declaration.json

@@ -717,7 +717,7 @@
     {
       "key": "agents",
       "kind": "family",
-      "normativeText": ["spec/v1/multi-agent-execution.md", "spec/v1/agent-memory.md", "spec/v1/agent-runtime.md", "spec/v1/agent-org-chart.md", "spec/v1/agent-evaluation.md", "spec/v1/capabilities.md"],
+      "normativeText": ["spec/v2/core/execution.md", "spec/v2/facets/agents.schema.json", "schemas/v2/run-event-payloads.schema.json"],
       "anchor": "core",
       "section": "core/capabilities.md#agents",
       "peerDependencyId": "agents",
@@ -1214,7 +1214,7 @@
     {
       "key": "budget",
       "kind": "family",
-      "normativeText": ["spec/v1/budget-policy.md"],
+      "normativeText": ["spec/v2/core/runs.md", "schemas/v2/budget-policy.schema.json"],
       "anchor": "core",
       "section": "core/capabilities.md#budget",
       "peerDependencyId": "budget",
@@ -1582,7 +1582,7 @@
     {
       "key": "production",
       "kind": "family",
-      "normativeText": ["spec/v1/production-profile.md"],
+      "normativeText": ["spec/v2/core/conformance.md"],
       "anchor": "core",
       "section": "core/capabilities.md#production",
       "peerDependencyId": "production",

package/spec/v2/errors.json

@@ -1031,13 +1031,13 @@
     },
     {
       "code": "token_budget_exceeded",
-      "meaning": "The run could not stay within its token budget.",
+      "meaning": "A memory distillation could not be completed within its effective token budget, so the run failed and wrote no partial archive.",
       "httpStatus": 422,
       "statusSource": "v1 convention",
       "retriable": false,
       "details": null,
       "since": "1.0",
-      "source": "spec/v1/rest-endpoints.md §Error response shape"
+      "source": "spec/v1/rest-endpoints.md §Error response shape; meaning narrowed to v1's (RFC 0062) by RFC 0228 §E"
     },
     {
       "code": "client_version_unsupported",
@@ -1186,6 +1186,210 @@
       "details": null,
       "since": "1.0",
       "source": "spec/v1/ai-envelope.md §\"Schema version advertisement\" (emitted schemaVersion above the advertised floor)"
+    },
+    {
+      "code": "storage_limit_exceeded",
+      "meaning": "A storage call was refused because it would exceed an advertised limit or the tenant's quota.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": [
+          "service",
+          "limit"
+        ],
+        "properties": {
+          "service": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The host-service family key (`fs`, `kvStorage`, `secrets`, `queueBus`, …)."
+          },
+          "limit": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The advertised field that was exceeded (`maxValueBytes`, `maxTtlSeconds`, `maxRowsPerTable`, …), or `quota`."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C (replaces v1's nine per-service size, TTL, row and quota codes)"
+    },
+    {
+      "code": "egress_denied",
+      "meaning": "The host refused an outbound request a pack asked it to make: the address guard or the egress policy denied it.",
+      "httpStatus": 403,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": [
+          "reason"
+        ],
+        "properties": {
+          "reason": {
+            "enum": [
+              "out-of-audience",
+              "expired",
+              "ssrf-blocked",
+              "provenance-unevaluable",
+              "scope-denied",
+              "policy-denied"
+            ],
+            "description": "The `egress.decided` reason, from its closed set minus `ok`."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C (v1 `ssrf_blocked` and the `egressPolicy` denial; measured: MyndHyve `ssrf_blocked`)"
+    },
+    {
+      "code": "upstream_unavailable",
+      "meaning": "A host service could not reach the upstream it depends on (a fetch target, an MCP server, a queue backend), so the call failed.",
+      "httpStatus": 502,
+      "statusSource": "v2 decision",
+      "retriable": true,
+      "details": {
+        "type": "object",
+        "required": [
+          "service"
+        ],
+        "properties": {
+          "service": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The host-service family key (`fs`, `kvStorage`, `secrets`, `queueBus`, …)."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C (measured: MyndHyve `fetch_failed`, the v2 reference host's `example.mcp_unreachable` and `example.http_fetch_failed`)"
+    },
+    {
+      "code": "budget_exhausted",
+      "meaning": "A hard budget dimension was exhausted and the run failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": [
+          "dimension"
+        ],
+        "properties": {
+          "dimension": {
+            "enum": [
+              "tokens",
+              "costUsd",
+              "toolCalls",
+              "retries"
+            ],
+            "description": "The budget dimension that was exhausted."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C; spec/v1/budget-policy.md §D (measured: MyndHyve `host/budgetPolicy.ts`)"
+    },
+    {
+      "code": "budget_model_denied",
+      "meaning": "The run's resolved model is outside its budget's `modelAllow`, or inside its `modelDeny`, so it was refused before the call.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "properties": {
+          "model": {
+            "type": "string",
+            "minLength": 1,
+            "description": "OPTIONAL. The refused model."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C; spec/v1/budget-policy.md §D (measured: MyndHyve `host/budgetPolicy.ts`)"
+    },
+    {
+      "code": "service_unavailable",
+      "meaning": "The host is at capacity. Retry after the `Retry-After` header when present.",
+      "httpStatus": 503,
+      "statusSource": "v1 prose (production-profile.md §Backpressure)",
+      "retriable": true,
+      "details": null,
+      "since": "2.45",
+      "source": "RFC 0228 §C (measured: MyndHyve `middleware/backpressureGate.ts`)"
+    },
+    {
+      "code": "run_expired",
+      "meaning": "The run, or the part of its event log the request needs, was purged under the host's documented retention.",
+      "httpStatus": 410,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "properties": {
+          "runId": {
+            "$ref": "ids.schema.json#/$defs/runId",
+            "description": "OPTIONAL. The expired run."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C (replay.md's `410` for a fork past retention; spec-authored, no measured host)"
+    },
+    {
+      "code": "provider_policy_denied",
+      "meaning": "Host provider policy refused the model or provider before the call, so the node failed.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": [
+          "provider"
+        ],
+        "properties": {
+          "provider": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The refused provider."
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1,
+            "description": "OPTIONAL. The policy cause (`provider-disabled`, `model-not-allowed`, …)."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C; the default of `aiProviders.policies[].errorCode` (measured: openwop-app and MyndHyve)"
+    },
+    {
+      "code": "eval_gate_unmet",
+      "meaning": "A deployment transition was refused because the eval run its gate requires is not terminal and passing.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision (the status MyndHyve answers)",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "properties": {
+          "evalRunId": {
+            "$ref": "ids.schema.json#/$defs/runId",
+            "description": "OPTIONAL. The eval run the gate requires."
+          }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "RFC 0228 §C (measured: MyndHyve `host/agentDeployment.ts`, answered at 422)"
     }
   ]
 }