@openwop/spec-artifacts 2.46.19 → 2.46.21

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.46.19",
-  "corpusTag": "v2.46.19",
+  "version": "2.46.21",
+  "corpusTag": "v2.46.21",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "ac6de5303872664b78ff419c035915593e01599e02835e777a0123de1baeb398",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "9133614d3cad4ff6ecf2758f2f986dfd257dc5a3a2b10110e7537114a2c03a65",
-    "api/v2/asyncapi.yaml": "5e44771306b5dfa1824967a177208228d12dca66a36c10de5bb0441b8bd26c72",
-    "api/v2/openapi.yaml": "2f7e4863b8ba09d77e5ae8a7c977311b6138878ba910d7a41d50546034cad7c2",
+    "api/seams-v2.yaml": "804179658b0f947c68a735eb33b652dd045b93980ab58a6f266a8de17c22daad",
+    "api/v2/asyncapi.yaml": "b881e2ca9b6d4b1de799d1be704118cb10249dbf3b1ecdf0f25a585658cfa690",
+    "api/v2/openapi.yaml": "9bd1bd491b690b3b5d0a358b0ef8235d8ded11b040e1e12ce1d4cfb41c24374d",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "276fc1d51eb08e14e9127b9fd27761d7046ee33c12000f3a64a801322db8bf58",
     "schemas/a2a-task-state.schema.json": "75d5049dea8bd873ff0e7546f1c60c8d36c219bec7084264360be54a8be30ae1",
@@ -117,7 +117,7 @@
     "schemas/v2/artifact.schema.json": "85b9dc284d39b99d2a66fa8cbf47f2dd3d8526d3bd6cc411ad315b372de38975",
     "schemas/v2/audit-verify-result.schema.json": "14af8e9283510f0a40e48a2059c929ee44e0fc9fa3cc66a95bfbe90b17c48297",
     "schemas/v2/budget-policy.schema.json": "1de68095db0beb5c7a4be629de26e79f62ebbe748a88d46f36e768edfd1f0d68",
-    "schemas/v2/capabilities.schema.json": "fe28a95bc36767b99cdf529fe7db47dce49c49c5635a724e552c728871c48b06",
+    "schemas/v2/capabilities.schema.json": "9d5b222dcd2003141b7f09e9b836744a1b63defc01bffea5d10c1da7747bc2d8",
     "schemas/v2/certification-bundle.schema.json": "5cfa7fb5247160333e33a58b60d42bcd4e5269d8391d6a112d301e14828892ed",
     "schemas/v2/channel-presence-payload.schema.json": "fc03df0c20cc12a25f7ee6a47503a4c5931d79fe3d5ff24815e8fd7c1bcb9a87",
     "schemas/v2/channel-written-payload.schema.json": "ccecff3c71a3275ad8db035ac0e04db25e6f8d23cf091ddbcd5a60d1be1cbb6b",
@@ -144,7 +144,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "e92a2548ba65454c9e0a34f72ea6768d18f59e61fa5da7668d0b2d5baddaddc8",
-    "schemas/v2/error-envelope.schema.json": "8ddb1d80330dfef17572a74dfe3a53e1a06411e4b0af6a6f1dd6e7e7461da987",
+    "schemas/v2/error-envelope.schema.json": "0b15d6a3a2baad6bf314a66a4a8da4756460574887b929b3b06cb23a6c02f0bd",
     "schemas/v2/eval-summary.schema.json": "d07f4d116c5410997a81d0bc5387545fb61933a6333c360a26ab8a71c749336b",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "a1942a124e250a6e9fbdb6b811c5a125e78fbcbcaa46dfc71d0636f24710a339",
@@ -169,7 +169,11 @@
     "schemas/v2/prompt-pack-manifest.schema.json": "752407469475396ad250085437a6cc6bd56a017ac6d3e52196aecc65dda4e51a",
     "schemas/v2/prompt-ref.schema.json": "8288495bf353fbc158cef6525d16dd1dcd9373941d15ec072044f05d143355d0",
     "schemas/v2/prompt-template.schema.json": "63825b39807e4ee85d41b9ad296ff2a0dd7bd2076d91e76a6c15a337e3e3bb84",
-    "schemas/v2/proposal.schema.json": "a5c582ce1e854e5fe10412ebed00e537961ee827bbaca506ca374b200a685992",
+    "schemas/v2/proposal-apply.schema.json": "eb187cfec8cf9a799d94463c34550fa84879e29bbc201a03b5d6ab58efb398d9",
+    "schemas/v2/proposal-list-response.schema.json": "1b5e78fc1e4256dbe6bc866487879deb8f7b9cc18f5bc875db3fde46d79bea02",
+    "schemas/v2/proposal-revise.schema.json": "065e75cccd01fcc619e63c25f2a1775adcc24b0467689dca42462ace6bfa1146",
+    "schemas/v2/proposal-submit.schema.json": "00fb91a4a76ebcee530295f5262b8b369ed024055cd29a47aa520db03a7fc6c9",
+    "schemas/v2/proposal.schema.json": "52a1e54cfce966a07e2588d5e323a4fa896470ccd3a3a21d2ed19d977d2922b7",
     "schemas/v2/registry-version-manifest.schema.json": "940cfd82511690cd6f2539e5676b185e7812628d0707c283fd7ffb33b6e54afd",
     "schemas/v2/residency.schema.json": "3fd23c9732beb140504e81560fc426eb6764d547e56da5fb92c5a5c7bf04db3a",
     "schemas/v2/run-ancestry-response.schema.json": "334c17f2062dea62726ca1d07b8be3f169cdc422af843c1def5fb317039814c9",
@@ -208,14 +212,14 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "22444c22bb88c568339ef512553f9fc38146e22b566d11ab8608f655d688d19c",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "6b5a2e873b59e22f27bd9832559382a42ad23e29cac8f9156d592bb19e168fb1",
+    "spec/v1/core-standard-manifest.json": "6e33742deb9559c5d995750c0a13c7f83446ab8e74c6f2f2d728b107f929e053",
     "spec/v1/deprecations.json": "e723bc11d7272c71789ad1303bb7f21809a8a024abf57594f9d5c35dc199ece9",
     "spec/v1/deprecations.schema.json": "3e393c405d2a41b467d8c5e3c468549078df1ce6a6d2588fc488097b95d9b55b",
     "spec/v1/end-of-support.json": "35f0bf3b70fe78b16e2a2fd81a153fc27e703f6c16376c6fe7cdf1f4f2c4e6d4",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "52777098a223e678d12751507b1ac0d02eef7465d6263c25175489734055cc3e",
+    "spec/v1/gaps.json": "9db4f2d06006cbfa55773e3a1dce2b0418a8da94ede4bf6e2992e9f18eaac4d1",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "4c50760be70cb644d02427bcaf5749606700edf4513f423903cf3b1d12f5c300",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
@@ -227,11 +231,11 @@
     "spec/v2/core/conformance.md": "3ca291e63bc70a6ef829ae8759ad0ded3741ea7aa507bbbdffc57de443ab2ae2",
     "spec/v2/core/connection-packs.md": "c80f95bd6a03698f35c72cdb2b46bd973f49203bbd786c26760e35fa86e6f23d",
     "spec/v2/core/conversation.md": "8d6abedf6af408a74577753bfca24719d318e2632e10b45ff5d63bdcf31a8aaa",
-    "spec/v2/core/errors.md": "e48838701b86bbfe0ffee77b18a8ffc4e5f04724b4318507d9771da653f8da0f",
+    "spec/v2/core/errors.md": "e932dd663ec7434480038ca9cdbe8fe37f6e422350ce95574522af4006b8a356",
     "spec/v2/core/events.md": "c3dcece6f1b1aa43e1e01c5ece23b2df075a505d5f6c2f37de0801aeaa486b62",
     "spec/v2/core/execution.md": "4218dbb397534940f83ca5d46561f02bf8f3fdf68d2ae7fefe7f2eb2ed771103",
     "spec/v2/core/form-content-packs.md": "02931227899676fd4581a27017be2a6c4953904717be9b81c29d12f87ab3917d",
-    "spec/v2/core/headers.md": "f69fe81e4a3ad21879bb85948660c16860eb05bf152928c31aa4898f6d7d1887",
+    "spec/v2/core/headers.md": "dae37c2b3980099272e5b9581107c0410d6b23aac95ea6c5a0890c34f0e51c8f",
     "spec/v2/core/host-services.md": "a6b5af882cb1e5c992dddc53c4de06feb36eee01bd566614330041213b3ce657",
     "spec/v2/core/i18n.md": "882904b7d59f992ab1e5f7346167161a54cf665b8fee47e64a3862cf9133a580",
     "spec/v2/core/idempotency.md": "adbd317a6ebb57c2759c076297b31f67def9e391576bccd0bbea787b13e85872",
@@ -246,7 +250,7 @@
     "spec/v2/core/portability.md": "ab13a6ca43544b9a6a91edfb377ec680c768d14be841c84fb79125b231426891",
     "spec/v2/core/replay.md": "9e66e2029b65866187c0920428a8c5bf8ad1c2b39feefbd5c02f0e59909afc7d",
     "spec/v2/core/runs.md": "1c292c0ab4a3119aeff3a6e9b6e99cff69782df78c3872179f9f0661b6204f23",
-    "spec/v2/core/security-defaults.md": "887d8c4bc592094e3b931c23f1c2175c18ebbd47528b074016f9d2091bc513b2",
+    "spec/v2/core/security-defaults.md": "d201fbcd964a624ab45a8bdb7ceca113c561df4c33e9017c2952dd8ef62919a4",
     "spec/v2/core/storage.md": "dc94b985847c1341c7a064f04a6010f0fdbe6c3ab3e555d4362878c81d764c18",
     "spec/v2/core/tool-catalog.md": "d16a9004418719c48301804aefa4d7ab6f41112a4ed83727f552aa1b92b418b0",
     "spec/v2/core/versioning.md": "348a6dc5bd3425efc0016bb6772d5d04ebf578b73eebcdfec6c2d82346a8577e",
@@ -257,7 +261,7 @@
     "spec/v2/declaration.json": "5ccdcf9865ca02022c01a551583e1f343a4b7c73fd228049f1be620858a60ad5",
     "spec/v2/declaration.schema.json": "ef951633e4070899f64828f5cf1b5f4870270a0360f81dbb49b5b4d6cd407550",
     "spec/v2/eos-override.json": "4c72d2f6a658943b01c1de1643cf294642091933af7832f38ee5495df684cb2d",
-    "spec/v2/errors.json": "1f0e29455edbd22e28f67f221766209c3c55ac4987beb77993b5702dd7cae131",
+    "spec/v2/errors.json": "33f9b4e450c51dfb1046bb00b327ee88163fb53360b0b43bcd204061ec966a13",
     "spec/v2/errors.schema.json": "47404ad53e6147cf9017b813483712466573e419fb33e6c4b6c12d3e7deba1bc",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
@@ -281,7 +285,7 @@
     "spec/v2/ext/sandbox-runtime-notes/README.md": "0d1290fb1e20b2e35c0b15051541ab6546e4e2a6f693b4f912cb3f7d6a65e92c",
     "spec/v2/ext/webResearch/README.md": "b675e6f6646128d781b661f754c2393eed86e5935d16c3a22df582a5ce025b9b",
     "spec/v2/facets/a2a.schema.json": "b68bf5e29e455e46c2ad7cfcccf5963730ec2310ff9db81884550d8df30fd6ef",
-    "spec/v2/facets/agents.schema.json": "88fe144572c25e1b09b99fd83e2ad12b2611d4d7366b5d53c3a50d0310faad93",
+    "spec/v2/facets/agents.schema.json": "0eb1172ea140607cb46d164af8bf405b32f5b47aa54baac7844e2c4161290025",
     "spec/v2/facets/aiProviders.schema.json": "6e4327bcd48110686cc1adfd26ddd6fbbf4ff529c476dcc74eeff8c5ae9965ce",
     "spec/v2/facets/auditLogIntegrity.schema.json": "9a7f81320c8f940c6f4129bc7dd895a4063231c5458a717a08c2cbf9bb886c46",
     "spec/v2/facets/auth.schema.json": "7d98bc81a0f7d307460d039eebfebd21388091bfe1d538762583940f94c0bd2a",
@@ -303,20 +307,20 @@
     "spec/v2/facets/uiPlugins.schema.json": "1fd3f8440cfb6e4422553a7c4b5f091eb3e10a40da0d43e8b977a18929116758",
     "spec/v2/facets/webhooks.schema.json": "54b576f1d150e28e1642693d846ce471c118e9c521bdf3924185305fbd1d0de4",
     "spec/v2/facets/workflowChainPacks.schema.json": "ea625ce818fbeb746478f00f31f96ee9613d538e4409c258c1bfb517acdeaba9",
-    "spec/v2/generated/error-codes.md": "eafb66f1632da783c9a0347a416ae32bcf322f41b9f8783375f579791e9cdcf0",
+    "spec/v2/generated/error-codes.md": "e8441e944d2a8856a9112c1de8175e5bfae8bb36b8f389dce9dfa838702c21b6",
     "spec/v2/harness-trust-anchors.json": "6007b92eae16a070fbc3777424efb0abfe865fda89d096963109b96282b91205",
     "spec/v2/harness-trust-anchors.schema.json": "372b5d92337c893d3449eff3f6bfd009ac09fdac285296d8bdbe0a08fff9e34c",
-    "spec/v2/id-field-bindings.json": "aa3e7c3590a490a77286e3ae60c1ab7407e7d627e05f981c3e08f221af4bd5dc",
+    "spec/v2/id-field-bindings.json": "97e96b6c35c405d0408b5a877c5859714dbbf4507853de9aab381163371ac098",
     "spec/v2/interop-map.json": "02255dafe7eb55f61ca7f9ae7c21f079d1848a6756991343088975ac9d184b8d",
     "spec/v2/interop-map.schema.json": "0017c882df34ee215e2e0729de051490e09d43aac3d2c949285698ed51832f12",
     "spec/v2/migrations.json": "651954938a1e154c0b6f1e3dd6e105889d30de3bb65789f21de7f77a12869e9e",
     "spec/v2/migrations.schema.json": "b91ade6320ad1b1185c9495b9424f3aa63438ed8e412c45171c227d82c0afd86",
-    "spec/v2/path-manifest.json": "7b5679a4dad98c80d855361d88a98c8a4e045af15e310862a05b285b815dc9fc",
+    "spec/v2/path-manifest.json": "20f598f56df460ad3ed50aba3d6bc2933ea16a3c96ce125da1c5dd6989d4155c",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "b382b261c7844798575f7c1b37c934f0da19846016a2337d883d4f5ef6e05479",
-    "spec/v2/release.json": "9870141128549af0cac3a0e7c4906c87a5ce65047591a3824690b9e20dcf59c1",
+    "spec/v2/release.json": "a777b332ad7a5ed3c721a42be6fd72b8cc30eaba7e1673d86f1249aca26772e0",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624",
-    "spec/v2/surface-baseline.json": "5ba73afbabe33b983c3ac74670a6aacfe32042a0d40de2faf6cdb151b055a1ae"
+    "spec/v2/surface-baseline.json": "ed538138c27c16b2d16618fe3cf96737e285f00f5b19710c61a89e33364d050d"
   },
-  "corpusCommit": "d49a2818d766f78f7c3fc9d55403ed42a404ba71"
+  "corpusCommit": "d2f718e938cc2f7e68ce050376e563749a5af995"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.46.19
+  version: 2.46.21
   description: 'The OpenWOP conformance seams profile (`openwop-conformance-seams-v2`): test-only operations in their own
     path space, `/conformance/seams/…`. The profile is versioned and validated against the canonical v2 schemas with no tolerance
     path. It is not a capability: a host advertises the profile, never a `testSeams` flag.

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.46.19
+  version: 2.46.21
   description: 'OpenWOP v2 event streams over SSE. The run-events channel''s address is the OpenAPI path key, and the server
     pathname is empty (bare origin). `streamMode` is a stream mode from the closed set, or a comma-separated combination of
     them; `values` never combines. `hostEvents` has a default address, `/host/events`; a host MAY declare another under `heartbeat.deliveryChannel`.

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.46.19
+  version: 2.46.21
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: 'The OpenWOP v2 REST API. Paths are unversioned and served at the bare origin; a client selects a version with
     the `OpenWOP-Version` header from the host''s `protocolVersions[]`. Conformance seams and test-mode operations are not
@@ -58,6 +58,8 @@ tags:
   description: 'Localized authored content: public delivery and tenant-scoped admin CRUD. Gated on `capabilities.content.supported`.'
 - name: host
   description: Host-capability resources, such as the agent workspace file store (gated on `capabilities.workspace.*`).
+- name: proposals
+  description: Reviewable-learning proposals (RFC 0096, operations RFC 0249).
 - name: connections
   description: 'Connection-pack provider registry: the definitions a host resolves against and the registrations it refused.'
 paths:
@@ -3649,6 +3651,427 @@ paths:
         - webhooks:manage
       - OpenIdConnect:
         - webhooks:manage
+  /proposals:
+    get:
+      tags:
+      - proposals
+      operationId: listProposals
+      summary: List the caller's proposals
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Scoped to the caller''s
+        tenant and workspace.'
+      parameters:
+      - name: state
+        in: query
+        required: false
+        schema:
+          type: string
+          enum:
+          - draft
+          - revised
+          - applied
+          - rejected
+          - archived
+      - name: kind
+        in: query
+        required: false
+        schema:
+          type: string
+          enum:
+          - agent-pack
+          - workflow-chain-pack
+          - prompt-template
+          - automation
+      - name: limit
+        in: query
+        required: false
+        schema:
+          type: integer
+          minimum: 1
+      - name: cursor
+        in: query
+        required: false
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 2048
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: One page of proposals.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal-list-response.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+      security:
+      - ApiKeyAuth:
+        - proposals:read
+      - OAuth2:
+        - proposals:read
+      - OpenIdConnect:
+        - proposals:read
+    post:
+      tags:
+      - proposals
+      operationId: submitProposal
+      summary: Submit a client-authored draft
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Served only when `agents.proposals.clientDrafts`
+        is `true`; otherwise `404 not_found`. The draft is held to every RFC 0096 rule, inertness first, with `provenance.sourceRunIds:
+        []`. A `kind` outside `artifactKinds` is `400 validation_error` with `details.field: kind`.'
+      parameters:
+      - $ref: '#/components/parameters/IdempotencyKey'
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: ../../schemas/v2/proposal-submit.schema.json
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '201':
+          description: 'The draft, in `state: draft`.'
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+      security:
+      - ApiKeyAuth:
+        - proposals:write
+      - OAuth2:
+        - proposals:write
+      - OpenIdConnect:
+        - proposals:write
+  /proposals/{proposalId}:
+    get:
+      tags:
+      - proposals
+      operationId: getProposal
+      summary: Read one proposal, including its inert artifact
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Carries `artifactDigest`,
+        the value `applyProposal` binds to.'
+      parameters:
+      - name: proposalId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 256
+        description: The proposal. A proposal another tenant owns MUST be answered exactly as an unknown id (`404`).
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: The proposal.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+      security:
+      - ApiKeyAuth:
+        - proposals:read
+      - OAuth2:
+        - proposals:read
+      - OpenIdConnect:
+        - proposals:read
+    patch:
+      tags:
+      - proposals
+      operationId: reviseProposal
+      summary: Revise a draft
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Sets `state: revised`
+        and MUST NOT activate. A terminal proposal (`applied`, `rejected`, `archived`) is refused `409 proposal_state_conflict`;
+        a lost concurrent update `409 proposal_stale`.'
+      parameters:
+      - name: proposalId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 256
+        description: The proposal. A proposal another tenant owns MUST be answered exactly as an unknown id (`404`).
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: ../../schemas/v2/proposal-revise.schema.json
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: The revised proposal.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '409':
+          description: '`proposal_state_conflict` (terminal) or `proposal_stale` (lost update).'
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/error-envelope.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+      security:
+      - ApiKeyAuth:
+        - proposals:write
+      - OAuth2:
+        - proposals:write
+      - OpenIdConnect:
+        - proposals:write
+    delete:
+      tags:
+      - proposals
+      operationId: archiveProposal
+      summary: Archive a proposal (soft)
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Sets `state: archived`,
+        from `draft`, `revised` or `rejected`. On `applied` or `archived` it is refused `409 proposal_state_conflict`: archiving
+        uninstalls nothing, so an applied proposal is never relabelled; remove an installed artifact through its own store.'
+      parameters:
+      - name: proposalId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 256
+        description: The proposal. A proposal another tenant owns MUST be answered exactly as an unknown id (`404`).
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: The archived proposal.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '409':
+          description: '`proposal_state_conflict`: applied or already archived.'
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/error-envelope.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+      security:
+      - ApiKeyAuth:
+        - proposals:write
+      - OAuth2:
+        - proposals:write
+      - OpenIdConnect:
+        - proposals:write
+  /proposals/{proposalId}:apply:
+    post:
+      tags:
+      - proposals
+      operationId: applyProposal
+      summary: Activate a proposal and install its artifact
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Routes through `agents.proposals.activation`.
+        Under `direct-rbac` the caller MUST hold `proposals:apply`; without it the host answers `403` with `error="insufficient_scope"`,
+        installs nothing and leaves `state` unchanged. Under `approval-gate` the host answers `202 {runId}` for a gate run
+        that suspends on an `approval` interrupt (`data.artifactType: "proposal"`), and installs only on `accept` (`interrupt.md`
+        §Approval).
+
+
+        The optional body binds the apply to the reviewed bytes: a sent `artifactDigest` that differs from the proposal''s
+        MUST be refused `409 proposal_stale`, installing nothing; a host MAY require it (`400`, `details.field: artifactDigest`).
+        On success `state` is `applied` and `activation.installedArtifact` names the v2 read that serves the installed artifact
+        in the applying tenant; its body minus the kind''s host-owned fields MUST be RFC 8785 (JCS) equal to the last-persisted
+        `artifact`. A store that refuses the install is `409 proposal_install_conflict` (`details.reason`); a terminal proposal
+        `409 proposal_state_conflict`.'
+      parameters:
+      - name: proposalId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 256
+        description: The proposal. A proposal another tenant owns MUST be answered exactly as an unknown id (`404`).
+      - $ref: '#/components/parameters/IdempotencyKey'
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: ../../schemas/v2/proposal-apply.schema.json
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: Applied; `activation.installedArtifact` is populated.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '202':
+          description: An approval-gate run was opened.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required:
+                - runId
+                properties:
+                  runId:
+                    $ref: ../../schemas/v2/ids.schema.json#/$defs/runId
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '400':
+          $ref: '#/components/responses/ValidationError'
+        '409':
+          description: '`proposal_stale`, `proposal_state_conflict` or `proposal_install_conflict`.'
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/error-envelope.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+      security:
+      - ApiKeyAuth:
+        - proposals:apply
+      - OAuth2:
+        - proposals:apply
+      - OpenIdConnect:
+        - proposals:apply
+  /proposals/{proposalId}:reject:
+    post:
+      tags:
+      - proposals
+      operationId: rejectProposal
+      summary: Reject a proposal
+      description: 'Gated on `agents.proposals`: a host that does not advertise it answers `404 not_found` (`errors.md` §Unadvertised
+        operations). A proposal another tenant owns is answered exactly as an id that does not exist. Sets `state: rejected`.
+        A terminal proposal is refused `409 proposal_state_conflict`.'
+      parameters:
+      - name: proposalId
+        in: path
+        required: true
+        schema:
+          type: string
+          minLength: 1
+          maxLength: 256
+        description: The proposal. A proposal another tenant owns MUST be answered exactly as an unknown id (`404`).
+      - $ref: '#/components/parameters/OpenWOPVersion'
+      - $ref: '#/components/parameters/OpenWOPClientVersion'
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              properties:
+                reason:
+                  type: string
+                  maxLength: 2048
+                  description: SR-1 redaction-safe.
+      responses:
+        '401':
+          $ref: '#/components/responses/Unauthenticated'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '200':
+          description: The rejected proposal.
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/proposal.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+        '409':
+          description: '`proposal_state_conflict`.'
+          content:
+            application/json:
+              schema:
+                $ref: ../../schemas/v2/error-envelope.schema.json
+          headers:
+            OpenWOP-Version:
+              $ref: '#/components/headers/OpenWOPVersion'
+      security:
+      - ApiKeyAuth:
+        - proposals:write
+      - OAuth2:
+        - proposals:write
+      - OpenIdConnect:
+        - proposals:write
 components:
   securitySchemes:
     ApiKeyAuth:
@@ -3687,6 +4110,9 @@ components:
             content:read: Read authored content pages and locale settings
             content:write: Create, publish and translate authored content pages
             deploy:*: Drive an agent deployment state transition
+            proposals:read: Read proposals (RFC 0249).
+            proposals:write: Submit, revise, reject and archive proposals (RFC 0249).
+            proposals:apply: Activate a proposal and install its artifact (RFC 0249).
         authorizationCode:
           authorizationUrl: https://issuer.example/oauth2/authorize
           tokenUrl: https://issuer.example/oauth2/token
@@ -3711,6 +4137,9 @@ components:
             content:read: Read authored content pages and locale settings
             content:write: Create, publish and translate authored content pages
             deploy:*: Drive an agent deployment state transition
+            proposals:read: Read proposals (RFC 0249).
+            proposals:write: Submit, revise, reject and archive proposals (RFC 0249).
+            proposals:apply: Activate a proposal and install its artifact (RFC 0249).
     OpenIdConnect:
       type: openIdConnect
       openIdConnectUrl: https://issuer.example/.well-known/openid-configuration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.46.19",
+  "version": "2.46.21",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {