@openwop/spec-artifacts 2.45.21 → 2.45.23

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.21",
-  "corpusTag": "v2.45.21",
+  "version": "2.45.23",
+  "corpusTag": "v2.45.23",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "b589c75cf872617be98ffe553cd4e738b03469d26ee1e8a139d07cb185e61be1",
-    "api/v2/asyncapi.yaml": "a0af325b50f06b2c493d5e7e6cab81cc7af3928065d9c12560a32029b1983a78",
-    "api/v2/openapi.yaml": "173a39da5f735c10b9e24c3582d7aeb05c42e4c221761dfc940e894d9f0728fd",
+    "api/seams-v2.yaml": "97c463b975fb6831ef19f415cf66abc4693f834bb2940b6d299d5cd30181ae9d",
+    "api/v2/asyncapi.yaml": "f5b14bc6edc7a7ad798cb280b1824aa46582a4cce450fb5ef079d84349b6e58e",
+    "api/v2/openapi.yaml": "391814e12addeb810f20a4818b2f49a103a6b3d6262679e696bb14c4699d6402",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "a829e3208413062388e52ab6ba714d35889c9c7645db38a290b0c4f4992cd3da",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,8 +117,8 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "a24c99d07971dde0e4596eba0bf5616e3df4459dc2174e8aebb2c544f964337c",
-    "schemas/v2/certification-bundle.schema.json": "9a3c67860f3b0867ff4733d3f8ae0f5d5d747b815ab39b6c255589f103119fa6",
+    "schemas/v2/capabilities.schema.json": "d859a413ff463ec39acc32a9cb76f2e8c7419e45683d6b7f886861765a9c36c7",
+    "schemas/v2/certification-bundle.schema.json": "ee3b10966458a10568a32b8a7eb4ab7bdb2f2d00da3ef6b698cd06462d52de40",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -144,7 +144,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "fb85e2020a91e0c1590a78f57bbf3bbf1cffbc1bc60e1ae692265a77e9d937ff",
+    "schemas/v2/error-envelope.schema.json": "fd561987db4d277d007666f533b53d6cf0e7eacb57f930f3ce7e431573120890",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -192,7 +192,7 @@
     "schemas/v2/trigger-event.schema.json": "710ecca8b3ecdad3a532a96768177f062192b24a589a4f798c7eb24bab64b30a",
     "schemas/v2/trigger-subscription-registration.schema.json": "5f7959f3e13f49399783e47f73101d6af95e5abccea1af2f0014ccbe3e51006c",
     "schemas/v2/trigger-subscription.schema.json": "06abe021712a4bfc5a107a067053cd3cc9704f47ae7066d8449a508c368a0ab2",
-    "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
+    "schemas/v2/ui-plugin-message.schema.json": "2211d58ddc3c42586586a61f03e637212465aff6c922755131f0beab58823435",
     "schemas/v2/webhook-dead-letter-page.schema.json": "78f3284722c2b42d52ff8a1e6d9b9092ba1ac35c2dbe036f3ff2470b34086d1e",
     "schemas/v2/webhook-delivery.schema.json": "5f5361ede12098b5c2d685f0aa70fcb07219fd6b68c6ad6af393ca8dd266d56a",
     "schemas/v2/webhook-verification.schema.json": "76e4e0d81143ffd2649bc7adba2aa34f2525e2c4e9f0300a425d908b3163196b",
@@ -206,16 +206,16 @@
     "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
     "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
-    "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
+    "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "9aa532383ef7f21117d806a74796680a296c8963f5dae666600f318d560ec25c",
-    "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
+    "spec/v1/core-standard-manifest.json": "c4f11f11dffb4b2492fa9f1870c3fb6c0cf66b4cd0f232c8e2b860ee931adb8b",
+    "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "b745aa2620ae8c9f79e7df7bd7c81559b8929f0bdfae62a7ea15debc29e8f19a",
+    "spec/v1/gaps.json": "8b4da733ecec873f0e5d060e83cbe044fe168e57940a8d3fc9ea7c3cc0de7240",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -223,15 +223,15 @@
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
     "spec/v2/README.md": "ddea90d7cf14aefffe1a43eeeecd4222dadad1d1e5ac64dceb073990eb93d9ef",
     "spec/v2/core/artifact-type-packs.md": "f734740cc3963f86c9f273a7dace26291bba2855161ddd3540618131a2c8d13e",
-    "spec/v2/core/capabilities.md": "503fd78ce55aca2cf83b872a5d6086f016470df2d9bcd7fb427b8f16fb9d044a",
+    "spec/v2/core/capabilities.md": "8218c44f90782df9630dd276e004def162dad989464cba85e7fc42d987bb61f8",
     "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
-    "spec/v2/core/conversation.md": "e0351883a57e90f13d2e9f6f5d3e80080b46be4988617448cb7a0e0c7c0bfbad",
-    "spec/v2/core/errors.md": "91f46acc9c9a5532a98cf62c69285d68575c100ff6064f0b1bf94731a087e34a",
-    "spec/v2/core/events.md": "00746062621ec98052ee323755fbdb10f4fb070439058039e44feb6bb19b073a",
+    "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
+    "spec/v2/core/errors.md": "e48838701b86bbfe0ffee77b18a8ffc4e5f04724b4318507d9771da653f8da0f",
+    "spec/v2/core/events.md": "3eb297c1ca8a4c20017248051fbe9c5319bb51ef1ba4cb476e29840cbbe141a6",
     "spec/v2/core/execution.md": "8a0c9db1bbfb97c008ab9328b7333c1cc3318196e78bfbefb49e781bdf4f9d44",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
-    "spec/v2/core/headers.md": "24b0d84ab5521e20f2669fca8006a11f9faf5c2311199e57375b8fa64ce763ed",
+    "spec/v2/core/headers.md": "18e52477898e67b0b3778d1fdd22e07bc43d561c03b501573404cd53245edef6",
     "spec/v2/core/host-services.md": "73f26ea32891044131d63f9861d2cbddccb5d08bf76e29e47afef9bb5b646791",
     "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
@@ -241,10 +241,10 @@
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
     "spec/v2/core/oauth.md": "c069ae4f9aae2eafe14c07c0bf709aa7ade0dcc821973d740400d49d901f7061",
     "spec/v2/core/overview.md": "999cb657711d6c28e62032fc31a013cc175f7a981a3b012e4bf4a90a2b84344c",
-    "spec/v2/core/packs.md": "0d1516c4b08fe67b85759feb9ccbafdd766216435a4a0a7e58e27e6f9fe6b6cc",
+    "spec/v2/core/packs.md": "74d9c804a71e0e0400e7a5667a918670bcb435be0702b4625ec774ef0f1aa359",
     "spec/v2/core/persistence.md": "249a1de353f421cdf92b9006a13a10afdb002f4029eb6a13520cc95252edb2ec",
     "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
-    "spec/v2/core/replay.md": "4a8b53325e18aa53400ece81168c76b4402b932e5e304a391754f293b126eabf",
+    "spec/v2/core/replay.md": "9e66e2029b65866187c0920428a8c5bf8ad1c2b39feefbd5c02f0e59909afc7d",
     "spec/v2/core/runs.md": "1c292c0ab4a3119aeff3a6e9b6e99cff69782df78c3872179f9f0661b6204f23",
     "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
@@ -254,10 +254,10 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "5ae9b7c84ab841930dd2885f048d99342ee81ba08cf6a6c07015070f8e17b9d1",
+    "spec/v2/declaration.json": "396ac924068f25d4a178062a54e244f870c556c3db9fe7a98fcc933fb318ed30",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
-    "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
+    "spec/v2/errors.json": "c3456c8cb1f36f4b6252bbc1fa3a643eabf28cdb7088e3743e50bd51a10c4936",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -291,6 +291,7 @@
     "spec/v2/facets/hostEvents.schema.json": "973ff452cb91356b4c625d0b06c8d2ef335e18183de09e1afde8acead22290b3",
     "spec/v2/facets/interrupt.schema.json": "2110ef32c3f880bf706475ef4cf8ddf97ff06871b8e6003a5edbcf4439f1fb70",
     "spec/v2/facets/mcp.schema.json": "7060657dfcff170f079beed160e3db7c1d3cc4410cd3cf64863baf6459f781cd",
+    "spec/v2/facets/nondeterminismPolicy.schema.json": "e9dfaa32e0778a1a837fdad3b8a0673fccda9579ab08c8bfe9777362dd15e989",
     "spec/v2/facets/oauth.schema.json": "3a0cbe249d3bd5a5982349ae7ba2534776cc958e4a57e0fbeabf2bdab6e99e69",
     "spec/v2/facets/packs.schema.json": "d544a280419c0052ce0f3c3b378f7aa04085cadc31df52a3c8f43da600b131b1",
     "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
@@ -298,9 +299,10 @@
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
+    "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
-    "spec/v2/generated/error-codes.md": "f171c0ca1be40221f9b4fbfcbce73c728c315a1e8feb8dd6bf738d6ca9e29526",
+    "spec/v2/generated/error-codes.md": "eafb66f1632da783c9a0347a416ae32bcf322f41b9f8783375f579791e9cdcf0",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "aa3e7c3590a490a77286e3ae60c1ab7407e7d627e05f981c3e08f221af4bd5dc",
@@ -308,12 +310,12 @@
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "b84c7561f50c7df0cb61b202bd6595acad3ee7edca7a45f711949bea3c69bd27",
+    "spec/v2/path-manifest.json": "50fc251f296b06ec5fad35724f5c63b1a32e0e8fc222a85cd29b785cebdb9c98",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "839927946b61bb164d5b55121ccf51c7e109b8f444dcb09a5de0412ebfb4031e",
+    "spec/v2/release.json": "f24ac113647fb96986e03c1355ae9b741ba447e6e1ef5653f955f07e777c93dd",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "0b284b59b87c69acbaf06caff0da67bee0e4221ac8de1f3fd21cc9c5e5922f0f"
+    "spec/v2/surface-baseline.json": "a2f690b3222532cc625d94f195d84d4b62a5b3e2b7ab02c164297e0483c32a9d"
   },
-  "corpusCommit": "7a395e42ec42b03017af5cadc2ef9006a606cef8"
+  "corpusCommit": "cc5dd653ba3aba746ed1b3fc8086df84803dbf46"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.45.21
+  version: 2.45.23
   description: 'The OpenWOP conformance seams profile (`openwop-conformance-seams-v2`): test-only operations in their own
     path space, `/conformance/seams/…`. The profile is versioned and validated against the canonical v2 schemas with no tolerance
     path. It is not a capability: a host advertises the profile, never a `testSeams` flag.
@@ -1423,6 +1423,71 @@ paths:
           $ref: '#/components/responses/Unauthenticated'
         '404':
           $ref: '#/components/responses/NotFound'
+  /conformance/seams/sample/a2a/invoke:
+    post:
+      tags:
+      - Seams
+      operationId: invokeA2aPeer
+      summary: Make the host's real A2A client call a peer once
+      description: 'Makes the host''s production A2A client send one message to `peerUrl` (any operation; the suite reads
+        what the peer received). It MUST drive the same client the production path uses, and MUST NOT hand-write headers or
+        metadata.
+
+
+        `permittedPurposes`, when present, is the purpose label the host received for the data it forwards. A host advertising
+        `purposePropagation` MUST re-emit it on the onward message as `metadata.openwop.permittedPurposes`, narrowing and
+        never widening, and for `[]` MUST NOT make the onward call at all; it then answers `200` with `forwarded: false`.
+        An unwired seam answers `404`/`405`.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - peerUrl
+              properties:
+                peerUrl:
+                  type: string
+                  format: uri
+                authenticated:
+                  type: boolean
+                peerOffersOnly:
+                  type: string
+                  pattern: ^[0-9]+\.[0-9]+$
+                requestVersion:
+                  type: string
+                  pattern: ^[0-9]+\.[0-9]+$
+                scenario:
+                  type: string
+                  enum:
+                  - peer-asserts-authority
+                permittedPurposes:
+                  type: array
+                  items:
+                    type: string
+                    minLength: 1
+                  uniqueItems: true
+      responses:
+        '200':
+          description: The call was made (or, for an empty label, deliberately not made).
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+                properties:
+                  negotiatedVersion:
+                    type: string
+                  forwarded:
+                    type: boolean
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '404':
+          $ref: '#/components/responses/NotFound'
 components:
   securitySchemes:
     ApiKeyAuth:

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.45.21
+  version: 2.45.23
   description: 'OpenWOP v2 event streams over SSE. The run-events channel''s address is the OpenAPI path key, and the server
     pathname is empty (bare origin). `streamMode` is a stream mode from the closed set, or a comma-separated combination of
     them; `values` never combines. `hostEvents` has a default address, `/host/events`; a host MAY declare another under `heartbeat.deliveryChannel`.

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.45.21
+  version: 2.45.23
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: 'The OpenWOP v2 REST API. Paths are unversioned and served at the bare origin; a client selects a version with
     the `OpenWOP-Version` header from the host''s `protocolVersions[]`. Conformance seams and test-mode operations are not
@@ -3320,6 +3320,129 @@ paths:
         - webhooks:manage
       - OpenIdConnect:
         - webhooks:manage
+  /host/ui-plugins/{packName}/{pluginId}/frame:
+    get:
+      tags:
+      - host
+      operationId: getUiPluginFrame
+      summary: The frame document a front-end plugin runs in
+      description: 'The HTML document the host mounts the plugin in, and the only way it mounts it. With `uiPlugins.isolation`
+        `cross-origin-iframe`, its `Content-Security-Policy` MUST carry a `sandbox` directive admitting `allow-scripts` and
+        never `allow-same-origin`, and MUST set `default-src ''none''` with no `connect-src` source beyond the plugin''s declared
+        `connectSrc` (`packs.md` §Front-end plugin packs). Gated on `uiPlugins.served`: a host that does not advertise it,
+        or a plugin that is not installed, answers `404 not_found`.'
+      parameters:
+      - name: packName
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 214
+        description: The installed frontend-plugin pack.
+      - name: pluginId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 128
+        description: The plugin's `uiPlugins[].id` in that pack.
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      responses:
+        '200':
+          description: The frame document.
+          headers:
+            Content-Security-Policy:
+              schema:
+                type: string
+              description: The plugin frame's isolation and egress policy.
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+          content:
+            text/html:
+              schema:
+                type: string
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+      security:
+      - ApiKeyAuth:
+        - manifest:read
+      - OAuth2:
+        - manifest:read
+      - OpenIdConnect:
+        - manifest:read
+  /host/ui-plugins/{packName}/{pluginId}/rpc:
+    post:
+      tags:
+      - host
+      operationId: dispatchUiPluginRequest
+      summary: Dispatch one ui-plugin/1 request as the named plugin
+      description: 'Runs one `ui-plugin/1` request through the dispatcher the plugin boundary uses, as the caller and as the
+        named plugin. A method outside the plugin''s declared `hostApi` or the advertised `uiPlugins.hostApi` MUST return
+        `ok: false` with `method_not_allowed` and MUST NOT execute. A refused call is `ok: false` inside a `200`, never an
+        HTTP error. A response MUST NOT carry credential material. Gated on `uiPlugins.served`.'
+      parameters:
+      - name: packName
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 214
+        description: The installed frontend-plugin pack.
+      - name: pluginId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 128
+        description: The plugin's `uiPlugins[].id` in that pack.
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - message
+              properties:
+                message:
+                  $ref: ../../schemas/v2/ui-plugin-message.schema.json#/$defs/request
+      responses:
+        '200':
+          description: The `ui-plugin/1` response.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/ui-plugin-message.schema.json#/$defs/response
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+      security:
+      - ApiKeyAuth:
+        - artifacts:read
+      - OAuth2:
+        - artifacts:read
+      - OpenIdConnect:
+        - artifacts:read
   /connection-providers:
     get:
       tags:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.45.21",
+  "version": "2.45.23",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/capabilities.schema.json

@@ -6044,6 +6044,16 @@
         "declared": {
           "type": "boolean",
           "description": "When `true`, the host documents its nondeterminism (it does not guarantee deterministic replay). A bare flag for v1.x (RFC 0085 §UQ2); a structured per-source policy is a future refinement."
+        },
+        "sources": {
+          "type": "array",
+          "uniqueItems": true,
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^(clock|random|id|env|x-[a-z0-9][a-z0-9-]*)$"
+          },
+          "description": "RFC 0237 §A. The nondeterministic sources the host declares rather than suppresses: `clock`, `random`, `id` (identifiers minted during a run), `env` (host configuration read during a run), or a vendor `x-*`. Each value drawn from a listed source is recorded where it is read, and a `replay` fork reproduces it (replay.md §Declared nondeterminism)."
         }
       },
       "allOf": [
@@ -6081,8 +6091,8 @@
           }
         }
       ],
-      "description": "core/capabilities.md#nondeterminismPolicy — witness: claims-check; maturity experimental/none; RFC 0085",
-      "x-openwop-seeded-from": "v1"
+      "description": "core/capabilities.md#nondeterminismPolicy — witness: witnessable-gated; maturity experimental/none; RFC 0085",
+      "x-openwop-facets-from": "spec/v2/facets/nondeterminismPolicy.schema.json"
     },
     "workspace": {
       "type": "object",
@@ -6262,6 +6272,10 @@
           "type": "integer",
           "minimum": 1,
           "description": "Per-plugin entry-bundle byte ceiling the host will load."
+        },
+        "served": {
+          "type": "boolean",
+          "description": "RFC 0238 §A — `true` means the host serves `GET /host/ui-plugins/{packName}/{pluginId}/frame` (the frame document, isolation and egress in its `Content-Security-Policy`) and `POST /host/ui-plugins/{packName}/{pluginId}/rpc` (the `ui-plugin/1` dispatch) for every plugin it has installed (`packs.md` §Front-end plugin packs). A host advertising `uiPlugins` SHOULD advertise it."
         }
       },
       "allOf": [
@@ -6300,7 +6314,7 @@
         }
       ],
       "description": "core/capabilities.md#uiPlugins — witness: witnessable-gated; maturity experimental/none; RFC 0117",
-      "x-openwop-seeded-from": "v1"
+      "x-openwop-facets-from": "spec/v2/facets/uiPlugins.schema.json"
     },
     "sql": {
       "type": "object",

package/schemas/v2/certification-bundle.schema.json

@@ -266,7 +266,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-ai-envelope-shape-static|v2-alias-covers-reword|v2-artifact-created-static|v2-bundle-signature-attributable|v2-bundle-witness-preimage|v2-colocated-companion|v2-conversation-payload-mirrors|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-envelope-tier-one-universal-static|v2-envelope-variant-discriminator-static|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-export-bundle-static|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-media-inline-cap-static|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-provider-usage-payload-static|v2-push-credential-coherent|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-self-hosted-runner-frames-static|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
+                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|ui-plugin-fixtures|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-ai-envelope-shape-static|v2-alias-covers-reword|v2-artifact-created-static|v2-bundle-signature-attributable|v2-bundle-witness-preimage|v2-colocated-companion|v2-conversation-payload-mirrors|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-envelope-tier-one-universal-static|v2-envelope-variant-discriminator-static|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-export-bundle-static|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-media-inline-cap-static|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-provider-usage-payload-static|v2-push-credential-coherent|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-self-hosted-runner-frames-static|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|wasm-fixture-packs|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
                 "description": "RFC 0168 §A.1 — `openwop.<area>.<slug>`. The suite mints six areas: `requirement` (an explicit `req()` id), `it` (a per-test id from the scenario file and title), `scenario` and `floor` (per-file rows), `profile` (a claimed-profile row) and `family` (a capability gate). The lookahead refuses every id minted from a corpus-coherence file: those run in the spec repo’s CI and MUST NOT appear in a host bundle (conformance.md §\"Two products, two ledgers\"; RFC 0168 §D.1). `scripts/check-req-only.mjs` fails when the list drifts from `conformance/src/coherence/`."
               },
               "scenario": {

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 120 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 122 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -134,7 +134,9 @@
             "service_unavailable",
             "run_expired",
             "provider_policy_denied",
-            "eval_gate_unmet"
+            "eval_gate_unmet",
+            "conversation_speaker_not_participant",
+            "conversation_roster_exceeded"
           ]
         },
         {
@@ -555,6 +557,67 @@
           }
         }
       }
+    },
+    {
+      "if": {
+        "properties": {
+          "error": {
+            "const": "conversation_speaker_not_participant"
+          }
+        },
+        "required": [
+          "error"
+        ]
+      },
+      "then": {
+        "properties": {
+          "details": {
+            "type": "object",
+            "required": [
+              "speakerId"
+            ],
+            "properties": {
+              "speakerId": {
+                "type": "string",
+                "description": "The refused turn's speakerId (conversation.md §multiPartyConversation)."
+              }
+            },
+            "additionalProperties": true,
+            "x-openwop-error": "conversation_speaker_not_participant"
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "error": {
+            "const": "conversation_roster_exceeded"
+          }
+        },
+        "required": [
+          "error"
+        ]
+      },
+      "then": {
+        "properties": {
+          "details": {
+            "type": "object",
+            "required": [
+              "maxParticipants"
+            ],
+            "properties": {
+              "maxParticipants": {
+                "type": "integer",
+                "minimum": 2,
+                "description": "The host's advertised ceiling (conversation.md §multiPartyConversation)."
+              }
+            },
+            "additionalProperties": true,
+            "x-openwop-error": "conversation_roster_exceeded"
+          }
+        }
+      }
     }
   ],
   "x-openwop-http-status": {
@@ -677,7 +740,9 @@
     "service_unavailable": 503,
     "run_expired": 410,
     "provider_policy_denied": 422,
-    "eval_gate_unmet": 422
+    "eval_gate_unmet": 422,
+    "conversation_speaker_not_participant": 422,
+    "conversation_roster_exceeded": 422
   },
   "x-openwop-retriable": [
     "residency_unavailable",

package/schemas/v2/ui-plugin-message.schema.json

@@ -44,8 +44,10 @@
             "artifact.read",
             "artifact.write",
             "host.toast",
-            "host.navigate"
-          ]
+            "host.navigate",
+            "host.announce"
+          ],
+          "description": "The closed host-API method set. `host.announce` (RFC 0130) is in it, matching the manifest and `uiPlugins.hostApi` enums (RFC 0238 erratum)."
         },
         "params": {
           "type": "object",
@@ -144,6 +146,5 @@
         }
       }
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/spec/v1/alias-detectors.json

@@ -338,6 +338,18 @@
       "file": "spec/v1/node-packs.md",
       "token": "`RunSnapshot.parentNodeId`",
       "deprecation": "openwop.deprecation.subworkflow-parent-link-fields"
+    },
+    {
+      "alias": "nondeterminismPolicy.declared required boolean",
+      "file": "schemas/v2/capabilities.schema.json",
+      "token": "\"declared\": {",
+      "deprecation": "openwop.deprecation.v2-family-false-booleans"
+    },
+    {
+      "alias": "envelopeContracts.advertised required boolean",
+      "file": "schemas/v2/capabilities.schema.json",
+      "token": "Host's node-pack manifests carry `EnvelopeContract` blocks.",
+      "deprecation": "openwop.deprecation.v2-family-false-booleans"
     }
   ]
 }

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.45.21"
+      "version": "2.45.23"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -426,5 +426,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "78c6764fb80f4b92dd48eacddd418716606f58f5f580fcc0d953f282451ace2e"
+  "digest": "96bc91f0c4def3afff3326a7cd63fa06777f1253b8354fcde01221bbe4931f69"
 }