@openwop/spec-artifacts 2.45.22 → 2.45.24

package/CORPUS-STAMP.json

@@ -1,19 +1,19 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.45.22",
-  "corpusTag": "v2.45.22",
+  "version": "2.45.24",
+  "corpusTag": "v2.45.24",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "a3a2dd8f2691fe7fa831af534f41789abaea6e5a03ededf88dd4bc96803cdaea",
-    "api/v2/asyncapi.yaml": "587bab6ff008b0bb1d3144029bc7ed4c3badc52ac916a0afd49d6c85923bbe1b",
-    "api/v2/openapi.yaml": "33a60f1454fb0efeb22c667ecf505447775a0de84772b1003c3226a6e419685b",
+    "api/seams-v2.yaml": "139cd5f7411c714ef1f207ee3284dc75633be3817d9946c1bdd998220fa79eec",
+    "api/v2/asyncapi.yaml": "e9cc564d30c8ff03da39e2c1b64fa33f2f2e627dc6afebf2fddc4262e3b0a7c5",
+    "api/v2/openapi.yaml": "15fb4ae5e02a5366b9bb60a3c9eb05f79695d1ae3669c0746bcae34cc04c77a2",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
-    "schemas/README.md": "a829e3208413062388e52ab6ba714d35889c9c7645db38a290b0c4f4992cd3da",
+    "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
     "schemas/a2ui-surface-delta-frame.schema.json": "970d434e4fdcb925de64aaace91eb83bfbcfd8f76757a9ce9f339eda5fb3f4e8",
     "schemas/agent-deployment-transition.schema.json": "1ac987fed0f380fa5b4e9a40e8e13316e5ae42d03a0ff42db4be6273e1bfe9f4",
@@ -117,8 +117,8 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "a24c99d07971dde0e4596eba0bf5616e3df4459dc2174e8aebb2c544f964337c",
-    "schemas/v2/certification-bundle.schema.json": "9a3c67860f3b0867ff4733d3f8ae0f5d5d747b815ab39b6c255589f103119fa6",
+    "schemas/v2/capabilities.schema.json": "d859a413ff463ec39acc32a9cb76f2e8c7419e45683d6b7f886861765a9c36c7",
+    "schemas/v2/certification-bundle.schema.json": "ee3b10966458a10568a32b8a7eb4ab7bdb2f2d00da3ef6b698cd06462d52de40",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
     "schemas/v2/chat-card-pack-manifest.schema.json": "92a57db2fd4b2463f14ef155fef8e3f18afc78960b646459dcf32efc79ff6bf5",
@@ -144,7 +144,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "fb85e2020a91e0c1590a78f57bbf3bbf1cffbc1bc60e1ae692265a77e9d937ff",
+    "schemas/v2/error-envelope.schema.json": "8ddb1d80330dfef17572a74dfe3a53e1a06411e4b0af6a6f1dd6e7e7461da987",
     "schemas/v2/eval-summary.schema.json": "2f384daf05b8f3b4f604688cae504d6d9971ba41b8c771e55fe9a17e09e86b7a",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -192,7 +192,7 @@
     "schemas/v2/trigger-event.schema.json": "710ecca8b3ecdad3a532a96768177f062192b24a589a4f798c7eb24bab64b30a",
     "schemas/v2/trigger-subscription-registration.schema.json": "5f7959f3e13f49399783e47f73101d6af95e5abccea1af2f0014ccbe3e51006c",
     "schemas/v2/trigger-subscription.schema.json": "06abe021712a4bfc5a107a067053cd3cc9704f47ae7066d8449a508c368a0ab2",
-    "schemas/v2/ui-plugin-message.schema.json": "879d65867c01656b3962d64283e66364dcb8f626ad26c5fcf2d2d55a79ae0ce9",
+    "schemas/v2/ui-plugin-message.schema.json": "2211d58ddc3c42586586a61f03e637212465aff6c922755131f0beab58823435",
     "schemas/v2/webhook-dead-letter-page.schema.json": "78f3284722c2b42d52ff8a1e6d9b9092ba1ac35c2dbe036f3ff2470b34086d1e",
     "schemas/v2/webhook-delivery.schema.json": "5f5361ede12098b5c2d685f0aa70fcb07219fd6b68c6ad6af393ca8dd266d56a",
     "schemas/v2/webhook-verification.schema.json": "76e4e0d81143ffd2649bc7adba2aa34f2525e2c4e9f0300a425d908b3163196b",
@@ -206,33 +206,33 @@
     "schemas/workload-identity.schema.json": "64ed93e12cc9f0657e56ff9b8f045e5d68d397df5276d103c07f42c7f34f0579",
     "schemas/workspace-file-create.schema.json": "70a23b92c2958c0165d7d29aea9020a045dc7816af82c80c5f50d0aac19c4856",
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
-    "spec/v1/alias-detectors.json": "0b2f28808ffe0b9d98a187775038c3406bb70919747a788a6e4f866e293ae6d3",
+    "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "b1d45d8fc106392a46ea67fd227bcdf623454ec0499e115487ed4e8dc5647d7f",
-    "spec/v1/deprecations.json": "a3293072ea951857395d05f0437264e88965f1e9019ff61c55bacfa9c1aaa17c",
+    "spec/v1/core-standard-manifest.json": "b1d32d221b43e1897cd65fc22bdac4384376fa720733be1a736dea31141eeee9",
+    "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "335186074848531561262525967bd85b379b3137a2233dd4c8b63914222dfa71",
+    "spec/v1/gaps.json": "ab22f506255eef90fba09585776dce09faa803207807eccbb3ea1c1a6cc80480",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "f988f7ebf58ff192e999e2a71192066052f837acc03c91d047d6050ca21a83b0",
     "spec/v1/spec-gaps.json": "ea9612af55bea9dae3e82223d4f714243f8f590b0193f1188257b13491a38afc",
-    "spec/v2/README.md": "ddea90d7cf14aefffe1a43eeeecd4222dadad1d1e5ac64dceb073990eb93d9ef",
+    "spec/v2/README.md": "c58acd84bb67c69043d9f777cbaa16d03e4f0f0a8158d2984526b69981067a14",
     "spec/v2/core/artifact-type-packs.md": "f734740cc3963f86c9f273a7dace26291bba2855161ddd3540618131a2c8d13e",
-    "spec/v2/core/capabilities.md": "503fd78ce55aca2cf83b872a5d6086f016470df2d9bcd7fb427b8f16fb9d044a",
+    "spec/v2/core/capabilities.md": "8218c44f90782df9630dd276e004def162dad989464cba85e7fc42d987bb61f8",
     "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
-    "spec/v2/core/conversation.md": "e0351883a57e90f13d2e9f6f5d3e80080b46be4988617448cb7a0e0c7c0bfbad",
-    "spec/v2/core/errors.md": "91f46acc9c9a5532a98cf62c69285d68575c100ff6064f0b1bf94731a087e34a",
-    "spec/v2/core/events.md": "00746062621ec98052ee323755fbdb10f4fb070439058039e44feb6bb19b073a",
+    "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
+    "spec/v2/core/errors.md": "e48838701b86bbfe0ffee77b18a8ffc4e5f04724b4318507d9771da653f8da0f",
+    "spec/v2/core/events.md": "3eb297c1ca8a4c20017248051fbe9c5319bb51ef1ba4cb476e29840cbbe141a6",
     "spec/v2/core/execution.md": "8a0c9db1bbfb97c008ab9328b7333c1cc3318196e78bfbefb49e781bdf4f9d44",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
-    "spec/v2/core/headers.md": "24b0d84ab5521e20f2669fca8006a11f9faf5c2311199e57375b8fa64ce763ed",
-    "spec/v2/core/host-services.md": "73f26ea32891044131d63f9861d2cbddccb5d08bf76e29e47afef9bb5b646791",
+    "spec/v2/core/headers.md": "18e52477898e67b0b3778d1fdd22e07bc43d561c03b501573404cd53245edef6",
+    "spec/v2/core/host-services.md": "168a40935a03867ee82461b5d83d05578be25ee3e5af4eb080587b891231e242",
     "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
     "spec/v2/core/identity.md": "02656ffa413b5546342b8580ae928a74e621460746df74d7db50ff4df41d2310",
@@ -241,10 +241,10 @@
     "spec/v2/core/node-pack-runtimes.md": "e1088cb69b8c3c67256c494063328916c2980ab1aa97a7063de25bab82fdb1e5",
     "spec/v2/core/oauth.md": "c069ae4f9aae2eafe14c07c0bf709aa7ade0dcc821973d740400d49d901f7061",
     "spec/v2/core/overview.md": "999cb657711d6c28e62032fc31a013cc175f7a981a3b012e4bf4a90a2b84344c",
-    "spec/v2/core/packs.md": "0d1516c4b08fe67b85759feb9ccbafdd766216435a4a0a7e58e27e6f9fe6b6cc",
+    "spec/v2/core/packs.md": "74d9c804a71e0e0400e7a5667a918670bcb435be0702b4625ec774ef0f1aa359",
     "spec/v2/core/persistence.md": "249a1de353f421cdf92b9006a13a10afdb002f4029eb6a13520cc95252edb2ec",
     "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
-    "spec/v2/core/replay.md": "4a8b53325e18aa53400ece81168c76b4402b932e5e304a391754f293b126eabf",
+    "spec/v2/core/replay.md": "9e66e2029b65866187c0920428a8c5bf8ad1c2b39feefbd5c02f0e59909afc7d",
     "spec/v2/core/runs.md": "1c292c0ab4a3119aeff3a6e9b6e99cff69782df78c3872179f9f0661b6204f23",
     "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
@@ -254,10 +254,10 @@
     "spec/v2/core/workflow-chain-packs.md": "fdce7a8477e269950a2bac05ee6eddbd66eb0b670b464d00054f7196ec05d29c",
     "spec/v2/corrections.json": "3a8d93e33865b692d26a3b6bfd3819766e206b2e0c2a69669baa4bf833d05a49",
     "spec/v2/corrections.schema.json": "46bbffb954d13bd9995aebc912ceeb2544f7064331abf25fd6ab85c81a5cec94",
-    "spec/v2/declaration.json": "5ae9b7c84ab841930dd2885f048d99342ee81ba08cf6a6c07015070f8e17b9d1",
+    "spec/v2/declaration.json": "396ac924068f25d4a178062a54e244f870c556c3db9fe7a98fcc933fb318ed30",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
-    "spec/v2/errors.json": "83f048b0a06952b4af6f125fb66c4212acab51056b411390f1010acd6ab9cdc0",
+    "spec/v2/errors.json": "1f0e29455edbd22e28f67f221766209c3c55ac4987beb77993b5702dd7cae131",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -291,6 +291,7 @@
     "spec/v2/facets/hostEvents.schema.json": "973ff452cb91356b4c625d0b06c8d2ef335e18183de09e1afde8acead22290b3",
     "spec/v2/facets/interrupt.schema.json": "2110ef32c3f880bf706475ef4cf8ddf97ff06871b8e6003a5edbcf4439f1fb70",
     "spec/v2/facets/mcp.schema.json": "7060657dfcff170f079beed160e3db7c1d3cc4410cd3cf64863baf6459f781cd",
+    "spec/v2/facets/nondeterminismPolicy.schema.json": "e9dfaa32e0778a1a837fdad3b8a0673fccda9579ab08c8bfe9777362dd15e989",
     "spec/v2/facets/oauth.schema.json": "3a0cbe249d3bd5a5982349ae7ba2534776cc958e4a57e0fbeabf2bdab6e99e69",
     "spec/v2/facets/packs.schema.json": "d544a280419c0052ce0f3c3b378f7aa04085cadc31df52a3c8f43da600b131b1",
     "spec/v2/facets/replay.schema.json": "0a5aefb0108c708c6794fadd533cf256709704c4f16dbf44cd63fa8980c78018",
@@ -298,9 +299,10 @@
     "spec/v2/facets/sandbox.schema.json": "e75f54486d387b2d089791aa93b5093cd1450f1920753a0f97fc23acdfe978ed",
     "spec/v2/facets/schemaVersions.schema.json": "890d3416c4b66511d51f329abc68e6f467f4338f16807e489fe682999b2b56b9",
     "spec/v2/facets/supportedEnvelopes.schema.json": "644f22cc2236e30a611b5b7f1ba0458ff1925d68b94c514d9672583224e126bd",
+    "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
-    "spec/v2/generated/error-codes.md": "f171c0ca1be40221f9b4fbfcbce73c728c315a1e8feb8dd6bf738d6ca9e29526",
+    "spec/v2/generated/error-codes.md": "eafb66f1632da783c9a0347a416ae32bcf322f41b9f8783375f579791e9cdcf0",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
     "spec/v2/id-field-bindings.json": "aa3e7c3590a490a77286e3ae60c1ab7407e7d627e05f981c3e08f221af4bd5dc",
@@ -308,12 +310,12 @@
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "b84c7561f50c7df0cb61b202bd6595acad3ee7edca7a45f711949bea3c69bd27",
+    "spec/v2/path-manifest.json": "50fc251f296b06ec5fad35724f5c63b1a32e0e8fc222a85cd29b785cebdb9c98",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "180beb9ef2d161766fa23b2987e7e829851e3d316273147cf6a4a3f324befd6b",
-    "spec/v2/release.json": "72fec975046a00db77ff1666dc76ada8663cbd18366104e451091e3f82c02455",
+    "spec/v2/release.json": "013b562cc396f4c6f000ed977be781f6f3ace49f609ee5fae045ff57aacb53a1",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "12f193f56af68402c747503b465f8d7e18580ef832ac7b95c218ab06286478ea"
+    "spec/v2/surface-baseline.json": "1bc7b1cbf33591b9e9f406d2ce2de08b306dc6986e365a29d20a78331bce7344"
   },
-  "corpusCommit": "b768269329be09d06da2de25b668ce27d5cc51df"
+  "corpusCommit": "2941c09ee028be32e129b96dde8b269e2a098854"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.45.22
+  version: 2.45.24
   description: 'The OpenWOP conformance seams profile (`openwop-conformance-seams-v2`): test-only operations in their own
     path space, `/conformance/seams/…`. The profile is versioned and validated against the canonical v2 schemas with no tolerance
     path. It is not a capability: a host advertises the profile, never a `testSeams` flag.
@@ -1423,6 +1423,71 @@ paths:
           $ref: '#/components/responses/Unauthenticated'
         '404':
           $ref: '#/components/responses/NotFound'
+  /conformance/seams/sample/a2a/invoke:
+    post:
+      tags:
+      - Seams
+      operationId: invokeA2aPeer
+      summary: Make the host's real A2A client call a peer once
+      description: 'Makes the host''s production A2A client send one message to `peerUrl` (any operation; the suite reads
+        what the peer received). It MUST drive the same client the production path uses, and MUST NOT hand-write headers or
+        metadata.
+
+
+        `permittedPurposes`, when present, is the purpose label the host received for the data it forwards. A host advertising
+        `purposePropagation` MUST re-emit it on the onward message as `metadata.openwop.permittedPurposes`, narrowing and
+        never widening, and for `[]` MUST NOT make the onward call at all; it then answers `200` with `forwarded: false`.
+        An unwired seam answers `404`/`405`.'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - peerUrl
+              properties:
+                peerUrl:
+                  type: string
+                  format: uri
+                authenticated:
+                  type: boolean
+                peerOffersOnly:
+                  type: string
+                  pattern: ^[0-9]+\.[0-9]+$
+                requestVersion:
+                  type: string
+                  pattern: ^[0-9]+\.[0-9]+$
+                scenario:
+                  type: string
+                  enum:
+                  - peer-asserts-authority
+                permittedPurposes:
+                  type: array
+                  items:
+                    type: string
+                    minLength: 1
+                  uniqueItems: true
+      responses:
+        '200':
+          description: The call was made (or, for an empty label, deliberately not made).
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+                properties:
+                  negotiatedVersion:
+                    type: string
+                  forwarded:
+                    type: boolean
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '404':
+          $ref: '#/components/responses/NotFound'
 components:
   securitySchemes:
     ApiKeyAuth:

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.45.22
+  version: 2.45.24
   description: 'OpenWOP v2 event streams over SSE. The run-events channel''s address is the OpenAPI path key, and the server
     pathname is empty (bare origin). `streamMode` is a stream mode from the closed set, or a comma-separated combination of
     them; `values` never combines. `hostEvents` has a default address, `/host/events`; a host MAY declare another under `heartbeat.deliveryChannel`.

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.45.22
+  version: 2.45.24
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: 'The OpenWOP v2 REST API. Paths are unversioned and served at the bare origin; a client selects a version with
     the `OpenWOP-Version` header from the host''s `protocolVersions[]`. Conformance seams and test-mode operations are not
@@ -3320,6 +3320,129 @@ paths:
         - webhooks:manage
       - OpenIdConnect:
         - webhooks:manage
+  /host/ui-plugins/{packName}/{pluginId}/frame:
+    get:
+      tags:
+      - host
+      operationId: getUiPluginFrame
+      summary: The frame document a front-end plugin runs in
+      description: 'The HTML document the host mounts the plugin in, and the only way it mounts it. With `uiPlugins.isolation`
+        `cross-origin-iframe`, its `Content-Security-Policy` MUST carry a `sandbox` directive admitting `allow-scripts` and
+        never `allow-same-origin`, and MUST set `default-src ''none''` with no `connect-src` source beyond the plugin''s declared
+        `connectSrc` (`packs.md` §Front-end plugin packs). Gated on `uiPlugins.served`: a host that does not advertise it,
+        or a plugin that is not installed, answers `404 not_found`.'
+      parameters:
+      - name: packName
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 214
+        description: The installed frontend-plugin pack.
+      - name: pluginId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 128
+        description: The plugin's `uiPlugins[].id` in that pack.
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      responses:
+        '200':
+          description: The frame document.
+          headers:
+            Content-Security-Policy:
+              schema:
+                type: string
+              description: The plugin frame's isolation and egress policy.
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+          content:
+            text/html:
+              schema:
+                type: string
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+      security:
+      - ApiKeyAuth:
+        - manifest:read
+      - OAuth2:
+        - manifest:read
+      - OpenIdConnect:
+        - manifest:read
+  /host/ui-plugins/{packName}/{pluginId}/rpc:
+    post:
+      tags:
+      - host
+      operationId: dispatchUiPluginRequest
+      summary: Dispatch one ui-plugin/1 request as the named plugin
+      description: 'Runs one `ui-plugin/1` request through the dispatcher the plugin boundary uses, as the caller and as the
+        named plugin. A method outside the plugin''s declared `hostApi` or the advertised `uiPlugins.hostApi` MUST return
+        `ok: false` with `method_not_allowed` and MUST NOT execute. A refused call is `ok: false` inside a `200`, never an
+        HTTP error. A response MUST NOT carry credential material. Gated on `uiPlugins.served`.'
+      parameters:
+      - name: packName
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 214
+        description: The installed frontend-plugin pack.
+      - name: pluginId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 128
+        description: The plugin's `uiPlugins[].id` in that pack.
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+              - message
+              properties:
+                message:
+                  $ref: ../../schemas/v2/ui-plugin-message.schema.json#/$defs/request
+      responses:
+        '200':
+          description: The `ui-plugin/1` response.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/ui-plugin-message.schema.json#/$defs/response
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+      security:
+      - ApiKeyAuth:
+        - artifacts:read
+      - OAuth2:
+        - artifacts:read
+      - OpenIdConnect:
+        - artifacts:read
   /connection-providers:
     get:
       tags:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.45.22",
+  "version": "2.45.24",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/README.md

@@ -1,6 +1,8 @@
-# OpenWOP Spec v1 — JSON Schemas
+# OpenWOP v1 JSON Schemas (frozen)
 
-> **Status: FINAL v1 (2026-05-10).** Per-row RFC status words are checked against `RFCS/` by `scripts/check-rfc-status-coherence.mjs` (RFC 0178 §E.1); the column is generated in Phase 3. Hand-authored from prose specs. JSON Schema 2020-12. Validate with Ajv2020 (`require('ajv/dist/2020')`), `python-jsonschema`, or any other 2020-12 implementation. Implementations MAY pin to these schemas; servers MUST accept any JSON document that validates against them.
+> **Status: FINAL v1, frozen.** These flat `schemas/*.schema.json` files are the v1 wire contract. v1 reached end of support on 2026-10-04 ([RFC 0234](https://github.com/openwop/openwop/blob/main/RFCS/0234-maintainer-set-v1-end-of-support.md)), and this tree is kept as history: it is not edited. **For v2, the current major, use [`schemas/v2/`](./v2/)**, with `$id`s under `https://openwop.dev/spec/v2/`.
+
+The index below describes each v1 schema and the v1 prose document it came from. Per-row RFC status words are checked against `RFCS/` by `scripts/check-rfc-status-coherence.mjs` (RFC 0178 §E.1). The schemas use JSON Schema 2020-12; validate with Ajv2020 (`require('ajv/dist/2020')`), `python-jsonschema`, or any other 2020-12 implementation.
 
 | Schema | Source spec | Coverage |
 |---|---|---|
@@ -46,7 +48,7 @@
 | `connection-pack-manifest.schema.json` | `connection-packs.md` + RFC 0095 | DRAFT — manifest for `kind: "connection"` registry packs (RFC 0095). Peer to the node/workflow-chain/prompt/artifact-type/chat-card pack manifests; disjoint via the `kind` discriminator. Distributes a portable provider definition — auth endpoints, read/write scope groups, exactly-one reach (`mcp`/`openapi`/`integration`) — that the RFC 0045/0047 `provider` string resolves against. Carries NO credential material (`connection-pack-no-credential-material`). |
 | `frontend-plugin-manifest.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — manifest for `kind: "frontend-plugin"` registry packs (RFC 0117). Peer to the other pack manifests; disjoint via the `kind` discriminator. Distributes a signed, SANDBOXED UI extension — one or more `uiPlugins[]` (a `pluginId`, a `surface`, an opaque `entry` bundle, a closed `hostApi` allowlist). A backend `runtime` member is FORBIDDEN (`not: {}`). Loaded only in a cross-origin sandbox (`frontend-plugin-isolation`). |
 | `ui-plugin-message.schema.json` | `frontend-plugin-packs.md` + RFC 0117 | DRAFT — the `ui-plugin/1` `postMessage` host-RPC envelope (RFC 0117) between a sandboxed front-end plugin and its host: a plugin→host `request` (closed `method` allowlist), a host→plugin `response` (`ok`+`result` or `ok:false`+`error`), or a host→plugin `event`. Carries the optimistic-concurrency `version` token and the `artifact_conflict` + `currentVersion` shape (`frontend-plugin-rpc-allowlist` / `frontend-plugin-no-byok`). |
-| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | **DEPRECATED** (RFC 0148; `--certify` defaults to bundle v2 since suite 1.152.0; v1 ceases to substantiate a new certification after 2026-11-10; removal scheduled for v2.0 per `spec/v1/deprecations.json`) — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
+| `conformance-certification-bundle.schema.json` | `conformance-certification.md` + RFC 0089 | **DEPRECATED** (RFC 0148; `--certify` defaults to bundle v2 since suite 1.152.0; v1 ceases to substantiate a new certification after 2026-11-10; it has no `schemas/v2/` counterpart, per `spec/v1/deprecations.json`) — machine-readable attestation binding a host's claimed profiles to the reproducible run that substantiates them (suite version + per-scenario pass list + host identity/commit + captured discovery document). Out-of-band; a consumer re-derives each claim via the §B binding rule. |
 | `conversation-event.schema.json` | `channels-and-reducers.md` + conversation RFC | Multi-turn conversation event shape for orchestrator-driven HITL flows |
 | `conversation-turn.schema.json` | `channels-and-reducers.md` + conversation RFC | Conversation turn shape for user/agent/system messages |
 | `core-conformance-mock-agent-config.schema.json` | `node-packs.md` + RFC 0023 | Config shape for the conformance-only `core.conformance.mock-agent` typeId — drives `agent.*` event emission on cue (`mockReasoning` / `mockToolCalls` / `mockHandoff` / `mockDecision` / `mockConfidence`). Hosts MUST refuse this typeId for production tenants unless `capabilities.conformance.mockAgent` is advertised. |
@@ -62,7 +64,7 @@
 | `prompt-pack-manifest.schema.json` | `prompts.md` §"Discovery & distribution" + RFC 0028 | Manifest for `kind: "prompt"` registry packs. Peer to `node-pack-manifest.schema.json` (RFC 0003) and `workflow-chain-pack-manifest.schema.json` (RFC 0013); disjoint via the `kind` discriminator. Distributes curated PromptTemplate collections via the same signed-tarball + Ed25519 + SRI pipeline. |
 | `prompt-ref.schema.json` | `prompts.md` + RFC 0027 | Reference to a PromptTemplate. `oneOf` accepts the stringy form (`prompt:templateId@version`) or a structured object with `libraryId` / `templateId` / `version` / `variableOverrides`. |
 | `prompt-template.schema.json` | `prompts.md` + RFC 0027 | Named, versioned, variable-bound prompt body. Carries `templateId` + SemVer `version` + `kind` (via `prompt-kind.schema.json`) + Mustache `text` + typed `variables[]` + optional `modelHints` + `meta` provenance (incl. RFC 0028 `packName` + `packVersion` when pack-sourced). |
-| `registry-version-manifest.schema.json` | `registry-operations.md` | Registry-augmented version manifest served at `GET /v1/packs/{name}/-/{version}.json`. Extends the bare pack-manifest contract with registry-side metadata (integrity hash, signing-block polymorphism, lifecycle flags). Enforced by the `Validate version manifests against registry-version-manifest schema` step in `.github/workflows/registry-publish.yml`. |
+| `registry-version-manifest.schema.json` | `registry-operations.md` | Registry-augmented version manifest served at `GET /v1/packs/{name}/-/{version}.json`. Extends the bare pack-manifest contract with registry-side metadata (integrity hash, signing-block polymorphism, lifecycle flags). Enforced by the registry's publish workflow in [`openwop/openwop-registry`](https://github.com/openwop/openwop-registry). |
 | `orchestrator-decision.schema.json` | `node-packs.md` + orchestrator RFC | Decision output shape for orchestrator routing nodes |
 | `run-ancestry-response.schema.json` | `multi-agent-execution.md` + RFC 0040 | Response body for `GET /v1/runs/{runId}/ancestry` — names the run's immediate parent in the cross-host composition chain (or `parent: null` for top-level runs). Capability-gated on `capabilities.multiAgent.executionModel.crossHostCausation.ancestryEndpointSupported`. |
 | `run-diff-response.schema.json` | `rest-endpoints.md` + RFC 0054 | Response body for `GET /v1/runs/{runId}:diff?against={otherRunId}` — deterministic, replay-aware structured diff of two runs (`divergedAtSeq` + `eventDiffs[]` + `stateDiff`). |
@@ -74,7 +76,7 @@
 | `subject.schema.json` | `auth.md` §"The Subject record" + RFC 0165 | DRAFT — issuer-scoped, lane-typed identity record carried as `owner.subject` on `RunSnapshot` and the `run.started` echo; opaque `subjectId` (no `@`/whitespace), `keyClass` iff saml/scim, optional bounded `actor` chain. Optional in v1.x; the v2 major requires it. |
 | `residency.schema.json` | RFC 0129 + `capabilities.md` §dataResidency | OPTIONAL data-residency `{region}` constraint on `POST /v1/runs` (honor-or-reject admission) |
 | `credential-provenance.schema.json` | `host-capabilities.md` §"Credential provenance + egress policy" (RFC 0079) | Metadata about a host-issued credential at the tool/egress boundary — `credentialId`/`issuer`/`audiences`(+scopes/expiry/redaction/audit-correlation). Secret-free (SR-1); the §C audience-binding MUST is evaluated against `audiences`. |
-| `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record at `registry/security/advisories.json`. One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by `check-advisories.mjs` in `.github/workflows/registry-publish.yml`. |
+| `security-advisory.schema.json` | `registry-operations.md` + INCIDENT-RESPONSE runbook | Registry-owned CVE advisory record, kept in [`openwop/openwop-registry`](https://github.com/openwop/openwop-registry). One entry per disclosed vulnerability — id, severity, affected pack-name + SemVer range, optional fixedIn/advisoryUrl/credits. Enforced by that repository's publish checks. |
 | `trigger-subscription.schema.json` | `trigger-bridge.md` (RFC 0083) | Durable inbound-trigger subscription record — `subscriptionId`/`source`/`state` (active/paused/failed/dead-lettered) + `dedupEnabled`/`retryPolicy` + the webhooks.md register keys. Backs the `openwop-trigger-bridge` profile; content-free of inbound payloads (SR-1). |
 | `trigger-event.schema.json` | `trigger-bridge.md` §F (RFC 0099) | The normalized external-event envelope handed to a started run as `ctx.triggerData` (webhook/email/form). In-run only — never event-logged; `trigger.delivery.attempted` stays content-free. Per-source one-of; `contentTrust: "untrusted"`; `AttachmentRef.ref` is a host-internal handle, never a fetchable URL (`trigger-ingestion-ssrf` / `trigger-ingestion-content-redaction`). |
 | `trigger-subscription-registration.schema.json` | `trigger-bridge.md` §F (RFC 0099) | The `POST /v1/trigger-subscriptions` create request — binds an external `source` to a `workflowId` with a dedup config + a source-authenticity `verification` policy. The portable create surface RFC 0083 UQ1 left per-source. |
@@ -122,24 +124,3 @@ import jsonschema
 schema = json.load(open('run-event.schema.json'))
 jsonschema.validate(my_event, schema)  # raises ValidationError on failure
 ```
-
-## Cross-reference
-
-- **Conformance test suite (P2-F4)** — black-box tests that fixture-validate against these schemas.
-- **Reference SDKs (P2-F3)** — generate types via `quicktype` or `json-schema-to-typescript`.
-- **OpenAPI 3.1 YAML** — references these schemas via `$ref` instead of inlining.
-
-## Open gaps
-
-| # | Gap | Owner |
-|---|---|---|
-| JS1 | Per-`RunEventType` payload schemas — done (2026-04-26: `run-event-payloads.schema.json` covers all 38 variants in ~15 shape families). Top-level `run-event.schema.json` `payload` stays permissive for forward-compat; consumers MAY pin strict validation via `$defs.<typeId>`. | ✅ |
-| JS2 | `Capabilities` schema — done (2026-04-26: `capabilities.schema.json` lifted from `Capabilities.ts`) | ✅ |
-| JS3 | `RunOptions` schema (configurable + tags + metadata) — done (2026-04-26: `run-options.schema.json` lifted from `run-options.md`) | ✅ |
-| JS4 | Channel-write event payload schema — done (2026-04-26: `channel-written-payload.schema.json` lifted from channels-and-reducers.md §Channel write event) | ✅ |
-| JS5 | Error-envelope schema — done (2026-04-26: `error-envelope.schema.json` hoisted from inline OpenAPI) | ✅ |
-| JS6 | `RunSnapshot` schema — done (2026-04-26: `run-snapshot.schema.json` hoisted from inline OpenAPI) | ✅ |
-
-## Versioning
-
-Schemas are versioned via `$id` URL (`/spec/v1/`). Breaking changes go to `/spec/v2/`. Non-breaking additions stay on v1 with `$comment` notes documenting added fields.

package/schemas/v2/capabilities.schema.json

@@ -6044,6 +6044,16 @@
         "declared": {
           "type": "boolean",
           "description": "When `true`, the host documents its nondeterminism (it does not guarantee deterministic replay). A bare flag for v1.x (RFC 0085 §UQ2); a structured per-source policy is a future refinement."
+        },
+        "sources": {
+          "type": "array",
+          "uniqueItems": true,
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^(clock|random|id|env|x-[a-z0-9][a-z0-9-]*)$"
+          },
+          "description": "RFC 0237 §A. The nondeterministic sources the host declares rather than suppresses: `clock`, `random`, `id` (identifiers minted during a run), `env` (host configuration read during a run), or a vendor `x-*`. Each value drawn from a listed source is recorded where it is read, and a `replay` fork reproduces it (replay.md §Declared nondeterminism)."
         }
       },
       "allOf": [
@@ -6081,8 +6091,8 @@
           }
         }
       ],
-      "description": "core/capabilities.md#nondeterminismPolicy — witness: claims-check; maturity experimental/none; RFC 0085",
-      "x-openwop-seeded-from": "v1"
+      "description": "core/capabilities.md#nondeterminismPolicy — witness: witnessable-gated; maturity experimental/none; RFC 0085",
+      "x-openwop-facets-from": "spec/v2/facets/nondeterminismPolicy.schema.json"
     },
     "workspace": {
       "type": "object",
@@ -6262,6 +6272,10 @@
           "type": "integer",
           "minimum": 1,
           "description": "Per-plugin entry-bundle byte ceiling the host will load."
+        },
+        "served": {
+          "type": "boolean",
+          "description": "RFC 0238 §A — `true` means the host serves `GET /host/ui-plugins/{packName}/{pluginId}/frame` (the frame document, isolation and egress in its `Content-Security-Policy`) and `POST /host/ui-plugins/{packName}/{pluginId}/rpc` (the `ui-plugin/1` dispatch) for every plugin it has installed (`packs.md` §Front-end plugin packs). A host advertising `uiPlugins` SHOULD advertise it."
         }
       },
       "allOf": [
@@ -6300,7 +6314,7 @@
         }
       ],
       "description": "core/capabilities.md#uiPlugins — witness: witnessable-gated; maturity experimental/none; RFC 0117",
-      "x-openwop-seeded-from": "v1"
+      "x-openwop-facets-from": "spec/v2/facets/uiPlugins.schema.json"
     },
     "sql": {
       "type": "object",

package/schemas/v2/certification-bundle.schema.json

@@ -266,7 +266,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-ai-envelope-shape-static|v2-alias-covers-reword|v2-artifact-created-static|v2-bundle-signature-attributable|v2-bundle-witness-preimage|v2-colocated-companion|v2-conversation-payload-mirrors|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-envelope-tier-one-universal-static|v2-envelope-variant-discriminator-static|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-export-bundle-static|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-media-inline-cap-static|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-provider-usage-payload-static|v2-push-credential-coherent|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-self-hosted-runner-frames-static|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
+                "pattern": "^openwop\\.(?!it\\.(?:a2a-parts-schemas|a2ui-v09-profile|artifact-schema-compile-bounded|artifact-type-legacy-ids|bundle-maturity-gate|capability-example-root-layout|certification-floor-enforcement|chain-subchain-unsupported-refused|compensation-profile|core-manifest-and-extension-registry|discovery-canonical-family-no-shadow|edge-condition-truthy-falsy|effect-identity-composition|effect-identity-cross-scope|error-envelope-canonical-shape|event-codemap-complete|form-content-packs|locale-key-grammar|multi-region-effect-vocabulary|node-pack-mcp-server-record|normative-example-extraction|openapi-asyncapi-sdk-parity|openapi-security-declared|pack-manifest-extensions|protocol-version-grammar|registry-declarative-kinds|removal-dates-minor|rfc-0147-self-audit|rfc-lifecycle-coherence|semantic-digest-v2|spec-corpus-validity|spec-section-citations|tool-descriptor-annotations|tool-result-trust-monotone|ui-plugin-fixtures|v1-webhook-rotation-contract|v1-webhook-unregister-contract|v2-ai-envelope-shape-static|v2-alias-covers-reword|v2-artifact-created-static|v2-bundle-signature-attributable|v2-bundle-witness-preimage|v2-colocated-companion|v2-conversation-payload-mirrors|v2-corpus-tag-pinned|v2-declaration-parity|v2-envelope-catalog|v2-envelope-tier-one-universal-static|v2-envelope-variant-discriminator-static|v2-eos-clock|v2-error-registry-prose-parity|v2-event-naming-rule|v2-events-channel-parity|v2-export-bundle-static|v2-externally-gated-never-stable|v2-facet-advertisement|v2-front-door-counts|v2-id-kinds-bound|v2-interop-map-coherent|v2-lane-exp-only-schema|v2-media-inline-cap-static|v2-normative-home-gate|v2-one-signing-scheme|v2-path-parity|v2-provider-usage-payload-static|v2-push-credential-coherent|v2-release-identity|v2-req-only-assertions|v2-retention-floors|v2-retirement-gate|v2-seams-not-in-canonical|v2-security-defaults-table|v2-self-hosted-runner-frames-static|v2-spec-artifacts-digest|v2-surface-monotone-gate|v2-threat-model-template|v2-umbrella-alias-covered|v2-umbrella-child-parts|v2-umbrella-codemod-at-active|v2-umbrella-codemod-legs|v2-umbrella-migration-deprecation|v2-witness-required|versioned-composition-profiles|wasm-fixture-packs|workflow-chain-internal-flag|workload-identity-profile)\\.)(requirement|it|scenario|floor|profile|family)\\.[a-z0-9]",
                 "description": "RFC 0168 §A.1 — `openwop.<area>.<slug>`. The suite mints six areas: `requirement` (an explicit `req()` id), `it` (a per-test id from the scenario file and title), `scenario` and `floor` (per-file rows), `profile` (a claimed-profile row) and `family` (a capability gate). The lookahead refuses every id minted from a corpus-coherence file: those run in the spec repo’s CI and MUST NOT appear in a host bundle (conformance.md §\"Two products, two ledgers\"; RFC 0168 §D.1). `scripts/check-req-only.mjs` fails when the list drifts from `conformance/src/coherence/`."
               },
               "scenario": {