@openwop/spec-artifacts 2.45.22 → 2.45.23

package/spec/v1/gaps.json

@@ -14292,6 +14292,142 @@
         }
       ]
     },
+    {
+      "id": "openwop.gap.0237.1",
+      "rfc": "0237",
+      "local": "G1",
+      "section": "§D",
+      "surface": "No host installs `conformance-nondeterminism` or lists `nondeterminismPolicy.sources`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "v2-reference-nondeterminism-fixture",
+      "sources": [
+        {
+          "file": "RFCS/registers/0237-nondeterminism-sources.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0237.2",
+      "rfc": "0237",
+      "local": "G2",
+      "section": "§Conformance",
+      "surface": "No host bundle records the two `openwop.requirement.0237.*` ids yet; the legs shipped in suite 2.45.23.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "carried",
+      "target": "openwop.gap.0237.2",
+      "sources": [
+        {
+          "file": "RFCS/registers/0237-nondeterminism-sources.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0237.3",
+      "rfc": "0237",
+      "local": "G3",
+      "section": "§C",
+      "surface": "The two required booleans stay in v2 (`overview.md` §0a predicate 4).",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "next-major",
+      "sources": [
+        {
+          "file": "RFCS/registers/0237-nondeterminism-sources.gaps.md",
+          "token": "G3"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0238.1",
+      "rfc": "0238",
+      "local": "G1",
+      "section": "§B, §C",
+      "surface": "No host serves the frame document or the dispatch operation at the normative paths, so none of the §F rows has a witness. openwop-app dispatches at a vendor path and mounts frames by `srcdoc`.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "openwop-app-ui-plugin-served",
+      "sources": [
+        {
+          "file": "RFCS/registers/0238-ui-plugin-observation-path.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0238.2",
+      "rfc": "0238",
+      "local": "G2",
+      "section": "Decisions 3",
+      "surface": "A non-iframe isolation mechanism has no HTTP-visible boundary, so `frontend-plugin-isolation` keeps a seam witness for such a host.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "non-iframe-ui-plugin-host",
+      "sources": [
+        {
+          "file": "RFCS/registers/0238-ui-plugin-observation-path.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0238.3",
+      "rfc": "0238",
+      "local": "G3",
+      "section": "Decisions 5",
+      "surface": "The always-on schema legs of `frontend-plugin-packs.test.ts` read only the corpus but run in a major-1 host bundle.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "TODO.md",
+      "sources": [
+        {
+          "file": "RFCS/registers/0238-ui-plugin-observation-path.gaps.md",
+          "token": "G3"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0239.1",
+      "rfc": "0239",
+      "local": "G1",
+      "section": "§F",
+      "surface": "No host advertises `multiPartyConversation` together with the §E fixture, so none of the §F rows has a witness.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "multi-party-council-host",
+      "sources": [
+        {
+          "file": "RFCS/registers/0239-council-roster-input.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0239.2",
+      "rfc": "0239",
+      "local": "G2",
+      "section": "§C, Decisions 4",
+      "surface": "A host whose `maxParticipants` is 64 or more cannot be shown an oversized roster: there is no schema ceiling and no v2 workflow registration.",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "externally-gated",
+      "target": "v2-workflow-registration",
+      "sources": [
+        {
+          "file": "RFCS/registers/0239-council-roster-input.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
     {
       "id": "openwop.gap.spec.a2a-integration.g1",
       "rfc": "0152",

package/spec/v2/core/capabilities.md

@@ -326,7 +326,7 @@ Witness `witnessable-gated`.
 
 ### § nondeterminismPolicy
 
-Witness `claims-check`.
+Witness `witnessable-gated`.
 
 ### § workspace
 

package/spec/v2/core/conversation.md

@@ -5,15 +5,15 @@
 
 ## Why this exists
 
-No client route opens a conversation. This document states the obligations a host takes on by advertising a multi-party conversation family.
+No client route opens a conversation. These are the obligations of a host advertising these families.
 
 ## `multiPartyConversation`
 
 A host advertising `multiPartyConversation`:
 
-- MUST accept an optional `participants` array of agent references on conversation creation;
-- MUST refuse a turn from a principal absent from that roster, rather than silently accepting it;
-- MUST refuse, at creation, a roster that exceeds `multiPartyConversation.maxParticipants`, rather than truncating it.
+- MUST accept optional `participants` (agent references) in `core.conversationGate` config and carry them on `conversation.opened`;
+- MUST refuse a resumed turn whose `speakerId` is off that roster with `conversation_speaker_not_participant`, leaving the interrupt open;
+- MUST refuse at run creation, never truncate, a roster over `multiPartyConversation.maxParticipants`, with `conversation_roster_exceeded`.
 
 ## `channelPresence`
 
@@ -25,4 +25,4 @@ A host MUST list it under `hostEvents` as ephemeral ([events.md](events.md) §Ho
 
 A host that stamps model provenance on an agent turn MUST advertise `conversationTurnModelProvenance`. The stamp is non-secret and non-PII (provider and model identifiers only), and a host MUST NOT place prompt or completion content in it.
 
-*Sources: RFCs 0101, 0109, 0110, 0236.*
+*Sources: RFCs 0101, 0109, 0110, 0236, 0239.*

package/spec/v2/core/errors.md

@@ -8,7 +8,7 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **120** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **122** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
 - A host MUST emit a registered code, or a vendor code, wherever it emits an error code: the `error` of every error response, and `error.code` on `run.failed`, `node.failed` and the snapshot's `error` (overview.md §0). A recorded event re-emitted by replay or `:fork` is carried as recorded ([replay.md](replay.md)).
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
@@ -59,6 +59,6 @@ An operation gated on a family or facet the host does not advertise MUST answer
 
 ## Codes by HTTP status
 
-Every registered code, by HTTP status, is listed in [error-codes.md](../generated/error-codes.md), generated from `spec/v2/errors.json` (120 codes).
+Every registered code, by HTTP status, is listed in [error-codes.md](../generated/error-codes.md), generated from `spec/v2/errors.json` (122 codes).
 
 *Sources: RFCs 0171, 0213, 0227, 0228.*

package/spec/v2/core/events.md

@@ -201,7 +201,7 @@ An absent `kinds` is not an empty catalog and is not an unrestricted one: a host
 
 ## Envelope contracts
 
-`envelopeContracts` advertises that a host enforces per-node envelope permission sets. A host advertising `envelopeContracts.advertised` MUST refuse a node whose emitted envelope `type` is neither universal nor listed in that node's accepted set. It MUST refuse it distinctly from the capability-gated `typeId` refusal: the two stack rather than substitute.
+`envelopeContracts` advertises that a host enforces per-node envelope permission sets; `advertised: false` is not a v2 state. A host advertising it MUST refuse a node whose emitted envelope `type` is neither universal nor listed in that node's accepted set. It MUST refuse it distinctly from the capability-gated `typeId` refusal: the two stack rather than substitute.
 
 ## Envelope, feedback and usage facets
 

package/spec/v2/core/headers.md

@@ -16,10 +16,10 @@ Standard headers keep their standard names: `Idempotency-Key`, `ETag`, `If-None-
 | `Idempotency-Key` | 15 | Per-mutation idempotency token (`idempotency.md` Layer 1). The server caches `(tenantId, endpoint, key)` → response for ≥24h. A duplicate request returns the cached response with `OpenWOP-Idempotent-Replay: true`. |
 | `If-None-Match` | 2 | Conditional request on the discovery document (capabilities.md §1) and the run snapshot (runs.md §Snapshot). A value that matches the current `ETag` (runs.md §Caching and encoding) MUST yield `304 Not Modified` with no body. The 304 carries `OpenWOP-Version` like every response (versioning.md §1.4). |
 | `Last-Event-ID` | 1 | Resume from sequence after this ID. |
-| `OpenWOP-Client-Version` | 58 | The protocol version the client implements (versioning.md §1.5). Compared with `minClientVersion` on major.minor. A malformed value is treated as absent and MUST NOT produce a 400. Never selects a contract. |
+| `OpenWOP-Client-Version` | 60 | The protocol version the client implements (versioning.md §1.5). Compared with `minClientVersion` on major.minor. A malformed value is treated as absent and MUST NOT produce a 400. Never selects a contract. |
 | `OpenWOP-Dedup` | 1 | When set, the host's cross-host claim system rejects a duplicate `(tenantId, scopeId)` pair with `409 Conflict`. |
 | `OpenWOP-Force-Engine-Version` | 1 | Test keys only. The server emits this run's events as if it ran the given engine version, which must be within `Capabilities.testing.forceEngineVersionRange`. Servers MUST reject it on production API keys with `403 force_engine_version_forbidden`. |
-| `OpenWOP-Version` | 58 | Selects one of the host's listed major.minor versions. Absent, `/.well-known/openwop` uses `preferredVersion` and every other unversioned path is v2; an unlisted value is 406 protocol_version_unsupported. |
+| `OpenWOP-Version` | 60 | Selects one of the host's listed major.minor versions. Absent, `/.well-known/openwop` uses `preferredVersion` and every other unversioned path is v2; an unlisted value is 406 protocol_version_unsupported. |
 
 ## Cross-origin preflight
 
@@ -32,12 +32,13 @@ A host that answers a CORS preflight for an operation by granting the requesting
 | `Cache-Control` | 2 | Standard HTTP caching directive (RFC 9111), set per operation: public content-page delivery, and prompt templates (immutable semantics when the version was pinned); see each operation. |
 | `Content-Encoding` | 1 | Present only when the host negotiated compression from `Accept-Encoding`; pairs with `Vary: Accept-Encoding`. The decoded body is byte-identical to the identity body. |
 | `Content-Language` | 1 | The BCP-47 locale actually used (equals the response `locale`). |
+| `Content-Security-Policy` | 1 | The plugin frame's isolation and egress policy. |
 | `ETag` | 3 | Standard HTTP validator (RFC 9110 §8.8.3). The obligation is per operation: MUST on the discovery document (capabilities.md §1), SHOULD on the run snapshot (runs.md §Snapshot), a content hash on a prompt template (getPromptTemplate); see each operation. |
 | `Location` | 1 | Canonical URI of the new template. |
 | `OpenWOP-Idempotent-Replay` | 1 | Set when the response was served from the idempotency cache. |
-| `OpenWOP-Version` | 58 | The contract that produced this response. It MUST equal the one used. |
+| `OpenWOP-Version` | 60 | The contract that produced this response. It MUST equal the one used. |
 | `Retry-After` | 1 | Seconds until the active claim is stale-eligible. |
-| `WWW-Authenticate` | 51 | A `Bearer` challenge. On a host with an oauth2 or oidc lane it carries `resource_metadata` and `error="invalid_token"`. Never sent on a non-disclosure 404. |
+| `WWW-Authenticate` | 53 | A `Bearer` challenge. On a host with an oauth2 or oidc lane it carries `resource_metadata` and `error="invalid_token"`. Never sent on a non-disclosure 404. |
 
 ## Webhook delivery headers
 

package/spec/v2/core/packs.md

@@ -5,7 +5,7 @@
 
 ## Why this exists
 
-The v2 contract for pack manifests, the registry tree, peer-dependency identifiers, and signing. The per-kind rules live in [connection-packs.md](connection-packs.md), [form-content-packs.md](form-content-packs.md), [workflow-chain-packs.md](workflow-chain-packs.md), and [artifact-type-packs.md](artifact-type-packs.md); the capability vocabulary a pack requires is [capabilities.md](capabilities.md).
+Pack manifests, the registry tree, peer-dependency identifiers, and signing. Per-kind rules live in [connection-packs.md](connection-packs.md), [form-content-packs.md](form-content-packs.md), [workflow-chain-packs.md](workflow-chain-packs.md), and [artifact-type-packs.md](artifact-type-packs.md); the capability vocabulary a pack requires is [capabilities.md](capabilities.md).
 
 ## The engine range
 
@@ -39,7 +39,7 @@ The registry is versioned by tree, not header. It publishes `registry/v2/packs/<
 
 - A signed compatibility overlay MUST be rejected; a mirror re-derives the signer at ingest.
 - `.well-known/openwop-registry.json` `endpoints` is the negotiation: it names both trees, and a client MUST resolve every registry path through it rather than construct one.
-- `publicKey` is unversioned: keys are not protocol-versioned.
+- `publicKey` is unversioned.
 
 ## Peer-dependency identifiers
 
@@ -59,7 +59,7 @@ Facet paths are not identifiers: a pack requires a family by its key and names f
 
 ## The alias table
 
-`spec/v2/peer-dependency-aliases.json` is generated from the declaration file and the published-manifest inventory, never hand-kept. It is how a v1-era key reaches a v2 family through the overlap. Each row is `{ alias, family, facets?, publishedUses, removalTrigger }` and covers a v1 grammar found in the wild (`host.*` dotted twins, `openwop.agents.memoryBackends`, facet paths such as `aiProviders.imageGeneration`).
+`spec/v2/peer-dependency-aliases.json` is generated from the declaration file and the published-manifest inventory, never hand-kept. It is how a v1-era key reaches a v2 family through the overlap. Each row is `{ alias, family, facets?, publishedUses, removalTrigger }`.
 
 A v2 host MAY resolve an alias through the table during the overlap, and MUST NOT resolve one after v1 end-of-support (`removalTrigger: v1-end-of-support`).
 
@@ -79,7 +79,7 @@ Every pack-authored document MUST admit `patternProperties` `^(openwop-|x-|vendo
 
 ## Signing
 
-There is one signing scheme. `signing` on a version manifest (`schemas/v2/registry-version-manifest.schema.json`) is the closed object `{ keyId, scheme }`, both REQUIRED:
+`signing` on a version manifest (`schemas/v2/registry-version-manifest.schema.json`) is the closed object `{ keyId, scheme }`, both REQUIRED:
 
 - **`scheme`** MUST be `ed25519-canonical-json`: a detached 64-byte Ed25519 signature over the RFC 8785 (JCS) bytes of `pack.json` inside a deterministic tarball. The input MUST satisfy `conformance.md` §"Canonical JSON".
 - **`keyId`** is the signing key id.
@@ -124,6 +124,8 @@ A `frontend-plugin` pack (`schemas/v2/frontend-plugin-manifest.schema.json`) shi
 - with `artifact.write`, MUST return an opaque `version` from each read and write and refuse a stale one with `artifact_conflict`, persisting nothing;
 - MUST treat a plugin needing an unadvertised `surfaces` or `hostApi` entry as inert there, not an error.
 
+With `uiPlugins.served`, a host MUST mount each plugin only from `getUiPluginFrame` and serve `dispatchUiPluginRequest`, whose rules bind.
+
 A host without `uiPlugins` MUST reject the pack and render its own way.
 
 On the message protocol:
@@ -139,4 +141,4 @@ On the message protocol:
 - The v1 registry tree is frozen through the overlap, behind the v2 tree.
 - `testMode` advertises the v1 `/v1/packs-test/*` mirror, a conformance seam ([conformance.md §"The seams profile"](conformance.md)). It remains advertisable through the overlap and is removed at 3.0.
 
-*Sources: RFCs 0117, 0119, 0130, 0177, 0212, 0222.*
+*Sources: RFCs 0117, 0119, 0130, 0177, 0212, 0222, 0238.*

package/spec/v2/core/replay.md

@@ -128,6 +128,6 @@ A host advertising `replay` MUST document retention for source snapshots, source
 
 ## Declared nondeterminism
 
-`nondeterminismPolicy` is the host's statement of which nondeterministic sources it declares rather than suppresses. A host advertising `nondeterminismPolicy.declared` MUST record every declared source in the run's event log at the point it is read, so a fork replays the recorded value rather than re-drawing it. A source the host neither declares nor suppresses is a replay defect, not a policy choice.
+`nondeterminismPolicy.sources` lists the sources a host declares rather than suppresses: `clock`, `random`, `id`, `env` or `x-*`. A host MUST record each value drawn from a listed source where it is read, and a `replay` fork MUST reproduce it. An unlisted, unsuppressed source is a replay defect. `declared: false` is not a v2 state.
 
 *Sources: RFCs 0036, 0039, 0041, 0057, 0104, 0111, 0140, 0173, 0176, 0194, 0228.*

package/spec/v2/declaration.json

@@ -1272,17 +1272,19 @@
       "anchor": "core",
       "section": "core/capabilities.md#nondeterminismPolicy",
       "peerDependencyId": "nondeterminismPolicy",
-      "witness": "claims-check",
+      "witness": "witnessable-gated",
       "maturity": {
         "technical": "experimental",
         "adoption": "none"
       },
       "facets": [
-        "declared"
+        "declared",
+        "sources"
       ],
       "floorScenarios": [],
       "requirementIds": [],
-      "owningRfc": "0085"
+      "owningRfc": "0085",
+      "facetsFrom": "spec/v2/facets/nondeterminismPolicy.schema.json"
     },
     {
       "key": "workspace",
@@ -1322,11 +1324,13 @@
         "isolation",
         "surfaces",
         "hostApi",
-        "maxEntryBytes"
+        "maxEntryBytes",
+        "served"
       ],
       "floorScenarios": [],
       "requirementIds": [],
-      "owningRfc": "0117"
+      "owningRfc": "0117",
+      "facetsFrom": "spec/v2/facets/uiPlugins.schema.json"
     },
     {
       "key": "sql",

package/spec/v2/errors.json

@@ -2,7 +2,7 @@
   "$schema": "https://openwop.dev/spec/v2/errors.schema.json",
   "$comment": "RFC 0171 §B.1 — the error registry: one row per code {code, meaning?, httpStatus, retriable, details, since, deprecated?}. schemas/v2/error-envelope.schema.json is GENERATED from it (scripts/generate-error-envelope.mjs). Retry timing lives in Retry-After only (§B.2). statusSource records whether the status was stated in v1 prose, a v1 convention, or decided here. details is null until a code's details schema is registered (a null row means details is an open object for that code — closure over details is the RFC 0171 Phase 3 follow-up G-row).",
   "version": "2.0",
-  "updated": "2026-09-28",
+  "updated": "2026-10-06",
   "vendorCodePattern": "^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$",
   "rows": [
     {
@@ -1390,6 +1390,40 @@
       },
       "since": "2.45",
       "source": "RFC 0228 §C (measured: MyndHyve `host/agentDeployment.ts`, answered at 422)"
+    },
+    {
+      "code": "conversation_speaker_not_participant",
+      "meaning": "A resumed conversation turn names a speaker absent from the conversation's roster; the interrupt stays open. details.speakerId names it.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": ["speakerId"],
+        "properties": {
+          "speakerId": { "type": "string", "description": "The refused turn's speakerId (conversation.md §multiPartyConversation)." }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "spec/v2/core/conversation.md §multiPartyConversation; RFC 0239 §B"
+    },
+    {
+      "code": "conversation_roster_exceeded",
+      "meaning": "A core.conversationGate roster exceeds the host's advertised multiPartyConversation.maxParticipants; details.maxParticipants names the ceiling.",
+      "httpStatus": 422,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": ["maxParticipants"],
+        "properties": {
+          "maxParticipants": { "type": "integer", "minimum": 2, "description": "The host's advertised ceiling (conversation.md §multiPartyConversation)." }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.45",
+      "source": "spec/v2/core/conversation.md §multiPartyConversation; RFC 0239 §C"
     }
   ]
 }

package/spec/v2/facets/nondeterminismPolicy.schema.json

@@ -0,0 +1,22 @@
+{
+  "$comment": "RFC 0237 §A — `sources` names the nondeterministic sources the host declares; `declared` stays required until 3.0 (overview.md §0a predicate 4) and MUST NOT be false (§C)",
+  "properties": {
+    "declared": {
+      "type": "boolean",
+      "description": "When `true`, the host documents its nondeterminism (it does not guarantee deterministic replay). A bare flag for v1.x (RFC 0085 §UQ2); a structured per-source policy is a future refinement."
+    },
+    "sources": {
+      "type": "array",
+      "uniqueItems": true,
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "pattern": "^(clock|random|id|env|x-[a-z0-9][a-z0-9-]*)$"
+      },
+      "description": "RFC 0237 §A. The nondeterministic sources the host declares rather than suppresses: `clock`, `random`, `id` (identifiers minted during a run), `env` (host configuration read during a run), or a vendor `x-*`. Each value drawn from a listed source is recorded where it is read, and a `replay` fork reproduces it (replay.md §Declared nondeterminism)."
+    }
+  },
+  "required": [
+    "declared"
+  ]
+}

package/spec/v2/facets/uiPlugins.schema.json

@@ -0,0 +1,62 @@
+{
+  "$comment": "RFC 0117 + RFC 0238 — the uiPlugins family's facets. isolation, surfaces, hostApi and maxEntryBytes are carried unchanged from the v1 seed; served is v2-only (RFC 0238).",
+  "properties": {
+    "isolation": {
+      "type": "string",
+      "anyOf": [
+        {
+          "enum": [
+            "cross-origin-iframe",
+            "wasm",
+            "process",
+            "container",
+            "vm"
+          ]
+        },
+        {
+          "pattern": "^x-host-[a-z0-9-]+-[a-z0-9-]+$"
+        }
+      ],
+      "default": "cross-origin-iframe",
+      "description": "RFC 0117 (amended by RFC 0119). The categorical isolation model the host enforces for plugin bytes. `cross-origin-iframe` = a distinct-origin sandboxed browser frame (the browser default; §Isolation). `wasm`/`process`/`container`/`vm` mirror `sandbox.isolationModel` (RFC 0035) for non-browser hosts that enforce the SAME isolation property. Vendor-specific models advertise `^x-host-<host>-<key>$` per `host-extensions.md`. ALL values denote the SAME mandatory property (`frontend-plugin-isolation`): plugin bytes execute in a boundary with no access to the host's execution context / DOM / origin-storage / credentials, deny-egress by default, and all host interaction mediated by the closed `ui-plugin/1` RPC. The field names the MECHANISM, never relaxes the property. In-process / same-origin / module-federation loading is a protocol-tier MUST NOT regardless of the advertised value."
+    },
+    "surfaces": {
+      "type": "array",
+      "description": "Plugin surfaces this host renders. A pack's `uiPlugins[].surface` not in this set is installable-but-inert (§Degradation). `canvas-preview` (RFC 0130) mounts inside a host-owned canvas editor.",
+      "items": {
+        "type": "string",
+        "enum": [
+          "artifact-viewer",
+          "route",
+          "settings-panel",
+          "canvas-preview"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "hostApi": {
+      "type": "array",
+      "description": "The `ui-plugin/1` host-RPC methods this host honors. A plugin call to a method not in this set (regardless of the plugin's declared `hostApi`) MUST be rejected with `method_not_allowed` (`frontend-plugin-rpc-allowlist`). A host advertising `artifact.write` MUST enforce the `version`-token optimistic concurrency (RFC 0117 §Concurrency).",
+      "items": {
+        "type": "string",
+        "enum": [
+          "artifact.read",
+          "artifact.write",
+          "host.toast",
+          "host.navigate",
+          "host.announce"
+        ]
+      },
+      "uniqueItems": true
+    },
+    "maxEntryBytes": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Per-plugin entry-bundle byte ceiling the host will load."
+    },
+    "served": {
+      "type": "boolean",
+      "description": "RFC 0238 §A — `true` means the host serves `GET /host/ui-plugins/{packName}/{pluginId}/frame` (the frame document, isolation and egress in its `Content-Security-Policy`) and `POST /host/ui-plugins/{packName}/{pluginId}/rpc` (the `ui-plugin/1` dispatch) for every plugin it has installed (`packs.md` §Front-end plugin packs). A host advertising `uiPlugins` SHOULD advertise it."
+    }
+  }
+}

package/spec/v2/generated/error-codes.md

@@ -2,7 +2,7 @@
 
 > **Status: Stable.** Generated from `spec/v2/errors.json` by `scripts/generate-error-envelope.mjs`; do not edit.
 
-Every registered code (120 codes), by HTTP status. The registry is normative; this table restates it for reading. `retriable` and `statusSource` are in the registry. The rules are in [errors.md](../core/errors.md).
+Every registered code (122 codes), by HTTP status. The registry is normative; this table restates it for reading. `retriable` and `statusSource` are in the registry. The rules are in [errors.md](../core/errors.md).
 
 Code | Status
 --- | ---
@@ -93,6 +93,8 @@ Code | Status
 `capability_not_provided` | 422
 `capability_required` | 422
 `connection_auth_metadata_mismatch` | 422
+`conversation_roster_exceeded` | 422
+`conversation_speaker_not_participant` | 422
 `credential_required` | 422
 `envelope_invalid` | 422
 `envelope_refusal` | 422

package/spec/v2/path-manifest.json

@@ -240,6 +240,28 @@
       "authenticated": true,
       "requestBody": false
     },
+    {
+      "method": "GET",
+      "path": "/host/ui-plugins/{packName}/{pluginId}/frame",
+      "operationId": "getUiPluginFrame",
+      "requestHeaders": [
+        "OpenWOP-Client-Version",
+        "OpenWOP-Version"
+      ],
+      "authenticated": true,
+      "requestBody": false
+    },
+    {
+      "method": "POST",
+      "path": "/host/ui-plugins/{packName}/{pluginId}/rpc",
+      "operationId": "dispatchUiPluginRequest",
+      "requestHeaders": [
+        "OpenWOP-Client-Version",
+        "OpenWOP-Version"
+      ],
+      "authenticated": true,
+      "requestBody": true
+    },
     {
       "method": "GET",
       "path": "/interrupts/{token}",
@@ -677,7 +699,7 @@
     }
   ],
   "counts": {
-    "operations": 58,
+    "operations": 60,
     "channels": 2
   }
 }

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.45.22",
-  "corpusTag": "v2.45.22",
+  "version": "2.45.23",
+  "corpusTag": "v2.45.23",
   "updated": "2026-10-06"
 }