@openwop/spec-artifacts 2.46.20 → 2.46.22

package/schemas/v2/capabilities.schema.json

@@ -3532,7 +3532,7 @@
         },
         "proposals": {
           "type": "object",
-          "description": "RFC 0096 (`Active`). Reviewable learning — the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. v2 defines no protocol path for the proposal surface. A host advertising this emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC — no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). Hosts that omit this block do not synthesize proposals; the conformance scenarios skip cleanly. The redaction-safety of `rationale` and `provenance.sourceRunIds` and the lifecycle are in `proposal.schema.json`.",
+          "description": "RFC 0096 (`Active`), operations by RFC 0249. Reviewable learning — the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. The surface is the seven `proposals` operations (`listProposals`, `getProposal`, `submitProposal`, `reviseProposal`, `applyProposal`, `rejectProposal`, `archiveProposal`; scopes `proposals:read`, `proposals:write`, `proposals:apply`); a host that omits this block answers each as `errors.md` §Unadvertised operations requires. A proposal another tenant owns MUST be answered exactly as an unknown id. `applied`, `rejected` and `archived` are terminal: revise, apply or reject on one, and archive on `applied` or `archived`, is refused `409 proposal_state_conflict`. A host advertising this emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate (apply opens a gate run that suspends on an `approval` interrupt) or RFC 0049 RBAC (`proposals:apply`) — no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis); `activation.installedArtifact` names the read that shows it. The redaction-safety of `rationale` and `provenance.sourceRunIds` and the lifecycle are in `proposal.schema.json`.",
           "additionalProperties": false,
           "required": [
             "artifactKinds",
@@ -3565,6 +3565,25 @@
                 "direct-rbac"
               ],
               "description": "`approval-gate`: `apply` MUST drive an RFC 0051 gate (role/scope/quorum, audited override) and MUST NOT install unless granted/overridden. `direct-rbac`: `apply` requires only the RFC 0049 scope the host advertises for activation. An `overridden` gate MUST be audited."
+            },
+            "clientDrafts": {
+              "type": "boolean",
+              "default": false,
+              "description": "RFC 0249 §B. When `true`, `submitProposal` accepts a client-authored draft. A submitted draft MUST be held to every rule a synthesized one is, inertness first, with `provenance.sourceRunIds: []`. Absent or `false`, `submitProposal` answers `404 not_found`."
+            },
+            "readback": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "enum": [
+                  "agent-pack",
+                  "workflow-chain-pack",
+                  "prompt-template",
+                  "automation"
+                ]
+              },
+              "description": "RFC 0249 §D. The kinds whose installed artifact resolves through `activation.installedArtifact`; a subset of `artifactKinds`. For `prompt-template` the read is `getPromptTemplate`, only `meta` is host-owned, and while a proposal is unapplied `getPromptTemplate` / `listPromptTemplates` MUST NOT serve a template carrying its `(templateId, version)` and `POST /prompts:render` naming it MUST fail as for an unknown template. Install follows the prompts write in the applying tenant, and a refused install is `409 proposal_install_conflict`. A kind proposed but absent here has no outside read-back: its RFC 0096 rules bind but are not checkable from the wire (`workflow-chain-pack`, `agent-pack` and `automation` have no read-back at v2 today)."
             }
           }
         },

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 122 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 125 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -136,7 +136,10 @@
             "provider_policy_denied",
             "eval_gate_unmet",
             "conversation_speaker_not_participant",
-            "conversation_roster_exceeded"
+            "conversation_roster_exceeded",
+            "proposal_state_conflict",
+            "proposal_stale",
+            "proposal_install_conflict"
           ]
         },
         {
@@ -618,6 +621,75 @@
           }
         }
       }
+    },
+    {
+      "if": {
+        "properties": {
+          "error": {
+            "const": "proposal_state_conflict"
+          }
+        },
+        "required": [
+          "error"
+        ]
+      },
+      "then": {
+        "properties": {
+          "details": {
+            "type": "object",
+            "required": [
+              "state",
+              "action"
+            ],
+            "properties": {
+              "state": {
+                "type": "string",
+                "description": "The proposal's current state."
+              },
+              "action": {
+                "type": "string",
+                "description": "The refused action: revise, apply or reject."
+              }
+            },
+            "additionalProperties": true,
+            "x-openwop-error": "proposal_state_conflict"
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "error": {
+            "const": "proposal_install_conflict"
+          }
+        },
+        "required": [
+          "error"
+        ]
+      },
+      "then": {
+        "properties": {
+          "details": {
+            "type": "object",
+            "required": [
+              "reason"
+            ],
+            "properties": {
+              "reason": {
+                "type": "string",
+                "enum": [
+                  "version-not-greater",
+                  "read-only"
+                ],
+                "description": "Why the store refused (RFC 0249 §D)."
+              }
+            },
+            "additionalProperties": true,
+            "x-openwop-error": "proposal_install_conflict"
+          }
+        }
+      }
     }
   ],
   "x-openwop-http-status": {
@@ -742,7 +814,10 @@
     "provider_policy_denied": 422,
     "eval_gate_unmet": 422,
     "conversation_speaker_not_participant": 422,
-    "conversation_roster_exceeded": 422
+    "conversation_roster_exceeded": 422,
+    "proposal_state_conflict": 409,
+    "proposal_stale": 409,
+    "proposal_install_conflict": 409
   },
   "x-openwop-retriable": [
     "residency_unavailable",

package/schemas/v2/proposal-apply.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/proposal-apply.schema.json",
+  "title": "ProposalApply",
+  "description": "RFC 0249 §C. The optional `applyProposal` body binding the apply to the bytes the reviewer read. A host MAY require it (`400 validation_error`, `details.field: artifactDigest`). A digest that differs from the proposal's current `artifactDigest` MUST be refused `409 proposal_stale`, installing nothing.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "artifactDigest": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$",
+      "description": "`sha256:` + lowercase hex SHA-256 of the RFC 8785 (JCS) serialization of the reviewed `artifact`."
+    }
+  }
+}

package/schemas/v2/proposal-list-response.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/proposal-list-response.schema.json",
+  "title": "ProposalListResponse",
+  "description": "RFC 0249 §A. One page of `listProposals`, scoped to the caller's tenant and workspace; a proposal another tenant owns never appears.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "items"
+  ],
+  "properties": {
+    "items": {
+      "type": "array",
+      "items": {
+        "$ref": "proposal.schema.json"
+      }
+    },
+    "nextCursor": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Opaque cursor for the next page; absent on the last."
+    }
+  }
+}

package/schemas/v2/proposal-revise.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/proposal-revise.schema.json",
+  "title": "ProposalRevise",
+  "description": "RFC 0249 §A. The `reviseProposal` body. Sets `state: revised` and MUST NOT activate. Refused `409 proposal_state_conflict` on a terminal proposal (`applied`, `rejected`, `archived`) and `409 proposal_stale` on a lost concurrent update.",
+  "type": "object",
+  "additionalProperties": false,
+  "minProperties": 1,
+  "properties": {
+    "artifact": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "The revised artifact, shaped by the proposal's `kind`."
+    },
+    "title": {
+      "type": "string",
+      "description": "Human-facing label. SR-1 redaction-safe."
+    },
+    "rationale": {
+      "type": "string",
+      "description": "Plain-language justification. SR-1 redaction-safe."
+    }
+  }
+}

package/schemas/v2/proposal-submit.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openwop.dev/spec/v2/proposal-submit.schema.json",
+  "title": "ProposalSubmit",
+  "description": "RFC 0249 §B. The `submitProposal` body: a client-authored draft, accepted only when `agents.proposals.clientDrafts` is `true`. The host MUST refuse a `kind` outside `artifactKinds` with `400 validation_error` (`details.field: kind`), MUST set `provenance.sourceRunIds: []`, and MUST hold the draft to every RFC 0096 rule, inertness first.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind",
+    "artifact"
+  ],
+  "properties": {
+    "kind": {
+      "type": "string",
+      "enum": [
+        "agent-pack",
+        "workflow-chain-pack",
+        "prompt-template",
+        "automation"
+      ],
+      "description": "The artifact kind; MUST be one the host advertises in `artifactKinds`."
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "The proposed artifact, shaped by `kind`'s own schema. Inert until applied; validated against that schema at apply (`422` on mismatch)."
+    },
+    "title": {
+      "type": "string",
+      "description": "Human-facing label. SR-1 redaction-safe."
+    },
+    "rationale": {
+      "type": "string",
+      "description": "Plain-language justification. SR-1 redaction-safe."
+    }
+  }
+}

package/schemas/v2/proposal.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/proposal.schema.json",
   "title": "Proposal",
-  "description": "RFC 0096 §B. A reviewable-learning proposal — an INERT, draft-state reusable artifact (skill/pack/template/automation) the host synthesized from run/tool traces, that MUST NOT influence the resolution, planning, or execution of any run while in any state other than `applied`. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC (no new authorization path). On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). `rationale` and `provenance.sourceRunIds` are SR-1 redaction-safe (no secrets/PII). Gated on the `agents.proposals` capability.",
+  "description": "RFC 0096 §B. A reviewable-learning proposal — an INERT, draft-state reusable artifact (skill/pack/template/automation) the host synthesized from run/tool traces, that MUST NOT influence the resolution, planning, or execution of any run while in any state other than `applied`. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC (no new authorization path). On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). `rationale` and `provenance.sourceRunIds` are SR-1 redaction-safe (no secrets/PII). Gated on the `agents.proposals` capability. RFC 0249: served by `getProposal` / `listProposals`; on apply, `activation.installedArtifact` names the v2 read that serves the installed bytes, and those bytes minus the kind's host-owned fields MUST be RFC 8785 (JCS) equal to the last-persisted `artifact`.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -55,6 +55,11 @@
       "$comment": "Intentionally open object — the artifact body is validated against the kind's own schema, not this envelope.",
       "additionalProperties": true
     },
+    "artifactDigest": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$",
+      "description": "RFC 0249 §C. `sha256:` followed by the lowercase hex SHA-256 of the RFC 8785 (JCS) serialization of `artifact`, recomputed on every revision. `applyProposal` binds to it: a sent digest that differs from this value is refused `409 proposal_stale`."
+    },
     "provenance": {
       "type": "object",
       "additionalProperties": false,
@@ -127,7 +132,44 @@
         },
         "installedArtifactRef": {
           "type": "string",
-          "description": "Ref of the artifact installed on `apply` (RFC 0043 install path)."
+          "description": "Opaque ref of the artifact installed on `apply` (RFC 0043 install path). A client MUST NOT treat it as resolvable; `installedArtifact` is the resolvable form (RFC 0249)."
+        },
+        "installedArtifact": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "operationId",
+            "id"
+          ],
+          "description": "RFC 0249 §C. The v2 read that serves the installed artifact. `operationId` names a GET operation in `spec/v2/path-manifest.json`, evaluated in the applying tenant's scope; for any other tenant the installed artifact answers as an unknown id. The body that operation returns, with the kind's host-owned fields removed from both sides (`meta` for `prompt-template`), MUST be RFC 8785 (JCS) equal to the `artifact` last persisted before apply.",
+          "properties": {
+            "kind": {
+              "type": "string",
+              "enum": [
+                "agent-pack",
+                "workflow-chain-pack",
+                "prompt-template",
+                "automation"
+              ],
+              "description": "The installed artifact's kind; equals the proposal's `kind`."
+            },
+            "operationId": {
+              "type": "string",
+              "minLength": 1,
+              "description": "A GET operation in `spec/v2/path-manifest.json` (for `prompt-template`, `getPromptTemplate`)."
+            },
+            "id": {
+              "type": "string",
+              "minLength": 1,
+              "description": "The path parameter that operation takes. It MUST be the artifact's own identifier (for `prompt-template`, `artifact.templateId`); a host MUST NOT mint one."
+            },
+            "version": {
+              "type": "string",
+              "minLength": 1,
+              "description": "The installed version, when the read surface is versioned."
+            }
+          }
         }
       }
     },
@@ -139,6 +181,5 @@
       "type": "string",
       "format": "date-time"
     }
-  },
-  "x-openwop-seeded-from": "v1"
+  }
 }

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.46.20"
+      "version": "2.46.22"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -426,5 +426,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "31122d3b6adb1eb88683754eeb2284bc46437c1b51e34fd90bcdf64bd56fb426"
+  "digest": "0e1987ad303a3834d8466302554886144025df13513c74d1e6ba9b4728e4c155"
 }

package/spec/v1/gaps.json

@@ -14858,11 +14858,11 @@
       "rfc": "0249",
       "local": "G1",
       "section": "§Conformance",
-      "surface": "No host implements the seven operations. openwop-app does not advertise `agents.proposals`; MyndHyve advertises it at v1 only. Whether openwop-app builds phase 1 is with the user (relayed by the openwop-app release manager 2026-10-24).",
+      "surface": "No host implements the seven operations. openwop-app does not advertise `agents.proposals`; MyndHyve advertises it at v1 only. openwop-app builds phase 1 (ADR 0970, user-directed 2026-10-24).",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "externally-gated",
-      "target": "a",
+      "disposition": "closed",
+      "target": null,
       "sources": [
         {
           "file": "RFCS/registers/0249-proposal-operations-and-install-readback.gaps.md",
@@ -14929,11 +14929,96 @@
       "surface": "Submit scope, approval-gate shape, `readback` vs implied, the terminal-state error code, and the complete host-owned field set for `prompt-template`.",
       "witness": "unclassified",
       "requirementId": null,
+      "disposition": "closed",
+      "target": null,
+      "sources": [
+        {
+          "file": "RFCS/registers/0249-proposal-operations-and-install-readback.gaps.md",
+          "token": "G5"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0250.1",
+      "rfc": "0250",
+      "local": "G1",
+      "section": "A/C",
+      "surface": "Facet/query/error names and status",
+      "witness": "unclassified",
+      "requirementId": null,
       "disposition": "transferred",
       "target": "TODO.md",
       "sources": [
         {
-          "file": "RFCS/registers/0249-proposal-operations-and-install-readback.gaps.md",
+          "file": "RFCS/registers/0250-opt-in-host-event-replay-and-resync.gaps.md",
+          "token": "G1"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0250.2",
+      "rfc": "0250",
+      "local": "G2",
+      "section": "A/D",
+      "surface": "Retention and lawful deletion/revocation exceptions",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "TODO.md",
+      "sources": [
+        {
+          "file": "RFCS/registers/0250-opt-in-host-event-replay-and-resync.gaps.md",
+          "token": "G2"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0250.3",
+      "rfc": "0250",
+      "local": "G3",
+      "section": "B",
+      "surface": "Stable replay order and atomic live handoff",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "TODO.md",
+      "sources": [
+        {
+          "file": "RFCS/registers/0250-opt-in-host-event-replay-and-resync.gaps.md",
+          "token": "G3"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0250.4",
+      "rfc": "0250",
+      "local": "G4",
+      "section": "Conformance",
+      "surface": "Causable restart/trim/oversize tests without public backdoor",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "TODO.md",
+      "sources": [
+        {
+          "file": "RFCS/registers/0250-opt-in-host-event-replay-and-resync.gaps.md",
+          "token": "G4"
+        }
+      ]
+    },
+    {
+      "id": "openwop.gap.0250.5",
+      "rfc": "0250",
+      "local": "G5",
+      "section": "E",
+      "surface": "SDK owners/minors and application baseline reconciliation",
+      "witness": "unclassified",
+      "requirementId": null,
+      "disposition": "transferred",
+      "target": "TODO.md",
+      "sources": [
+        {
+          "file": "RFCS/registers/0250-opt-in-host-event-replay-and-resync.gaps.md",
           "token": "G5"
         }
       ]

package/spec/v2/core/errors.md

@@ -8,7 +8,7 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **122** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code, defined by `spec/v2/errors.schema.json`. It registers **125** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
 - A host MUST emit a registered code, or a vendor code, wherever it emits an error code: the `error` of every error response, and `error.code` on `run.failed`, `node.failed` and the snapshot's `error` (overview.md §0). A recorded event re-emitted by replay or `:fork` is carried as recorded ([replay.md](replay.md)).
 - A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$`, with its first segment an org registered in `spec/v2/declaration.json`. `openwop.` is reserved.
@@ -59,6 +59,6 @@ An operation gated on a family or facet the host does not advertise MUST answer
 
 ## Codes by HTTP status
 
-Every registered code, by HTTP status, is listed in [error-codes.md](../generated/error-codes.md), generated from `spec/v2/errors.json` (122 codes).
+Every registered code, by HTTP status, is listed in [error-codes.md](../generated/error-codes.md), generated from `spec/v2/errors.json` (125 codes).
 
 *Sources: RFCs 0171, 0213, 0227, 0228.*

package/spec/v2/core/headers.md

@@ -13,13 +13,13 @@ Standard headers keep their standard names: `Idempotency-Key`, `ETag`, `If-None-
 | Header | Operations | Meaning |
 | --- | --- | --- |
 | `Accept-Language` | 1 | BCP-47 preference list; authoritative for locale selection (i18n.md). A malformed value MUST NOT produce a 400. |
-| `Idempotency-Key` | 16 | Per-mutation idempotency token (`idempotency.md` Layer 1). The server caches `(tenantId, endpoint, key)` → response for ≥24h. A duplicate request returns the cached response with `OpenWOP-Idempotent-Replay: true`. |
+| `Idempotency-Key` | 18 | Per-mutation idempotency token (`idempotency.md` Layer 1). The server caches `(tenantId, endpoint, key)` → response for ≥24h. A duplicate request returns the cached response with `OpenWOP-Idempotent-Replay: true`. |
 | `If-None-Match` | 2 | Conditional request on the discovery document (capabilities.md §1) and the run snapshot (runs.md §Snapshot). A value that matches the current `ETag` (runs.md §Caching and encoding) MUST yield `304 Not Modified` with no body. The 304 carries `OpenWOP-Version` like every response (versioning.md §1.4). |
 | `Last-Event-ID` | 1 | Resume from sequence after this ID. |
-| `OpenWOP-Client-Version` | 61 | The protocol version the client implements (versioning.md §1.5). Compared with `minClientVersion` on major.minor. A malformed value is treated as absent and MUST NOT produce a 400. Never selects a contract. |
+| `OpenWOP-Client-Version` | 68 | The protocol version the client implements (versioning.md §1.5). Compared with `minClientVersion` on major.minor. A malformed value is treated as absent and MUST NOT produce a 400. Never selects a contract. |
 | `OpenWOP-Dedup` | 1 | When set, the host's cross-host claim system rejects a duplicate `(tenantId, scopeId)` pair with `409 Conflict`. |
 | `OpenWOP-Force-Engine-Version` | 1 | Test keys only. The server emits this run's events as if it ran the given engine version, which must be within `Capabilities.testing.forceEngineVersionRange`. Servers MUST reject it on production API keys with `403 force_engine_version_forbidden`. |
-| `OpenWOP-Version` | 61 | Selects one of the host's listed major.minor versions. Absent, `/.well-known/openwop` uses `preferredVersion` and every other unversioned path is v2; an unlisted value is 406 protocol_version_unsupported. |
+| `OpenWOP-Version` | 68 | Selects one of the host's listed major.minor versions. Absent, `/.well-known/openwop` uses `preferredVersion` and every other unversioned path is v2; an unlisted value is 406 protocol_version_unsupported. |
 
 ## Cross-origin preflight
 
@@ -36,9 +36,9 @@ A host that answers a CORS preflight for an operation by granting the requesting
 | `ETag` | 3 | Standard HTTP validator (RFC 9110 §8.8.3). The obligation is per operation: MUST on the discovery document (capabilities.md §1), SHOULD on the run snapshot (runs.md §Snapshot), a content hash on a prompt template (getPromptTemplate); see each operation. |
 | `Location` | 1 | Canonical URI of the new template. |
 | `OpenWOP-Idempotent-Replay` | 1 | Set when the response was served from the idempotency cache. |
-| `OpenWOP-Version` | 61 | The contract that produced this response. It MUST equal the one used. |
+| `OpenWOP-Version` | 68 | The contract that produced this response. It MUST equal the one used. |
 | `Retry-After` | 2 | Seconds until the active claim is stale-eligible. |
-| `WWW-Authenticate` | 54 | A `Bearer` challenge. On a host with an oauth2 or oidc lane it carries `resource_metadata` and `error="invalid_token"`. Never sent on a non-disclosure 404. |
+| `WWW-Authenticate` | 61 | A `Bearer` challenge. On a host with an oauth2 or oidc lane it carries `resource_metadata` and `error="invalid_token"`. Never sent on a non-disclosure 404. |
 
 ## Webhook delivery headers
 

package/spec/v2/core/security-defaults.md

@@ -5,7 +5,7 @@
 
 ## Why this exists
 
-In v2 a security behavior is not an opt-in flag. This document is the obligation table: which surface binds which behavior, the invariant, and the witness.
+In v2 a security behavior is not an opt-in flag. This document maps each surface to the behavior it binds, its invariant and its witness.
 
 ## The rule
 
@@ -29,6 +29,7 @@ A security-load-bearing behavior is an obligation of the surface that needs it.
 | an `oauth2` or `oidc` lane | protected-resource metadata and challenges ([identity.md §2.5](identity.md)) | witnessable-gated | `auth-challenge-no-oracle` |
 | any outbound request | no inbound credential on an onward hop (§Onward hops) | seam-gated | `inbound-credential-no-passthrough` |
 | `auditLogIntegrity` | a chained, checkpointed, verifiable audit log (§Audit-log integrity) | witnessable-gated | `audit-checkpoint-signed-over-root` |
+| `agents.proposals` | inert drafts, byte-matched install | witnessable-gated | `proposal-inert-until-applied`, `proposal-no-resynthesis` |
 
 ### Auth lanes
 
@@ -65,7 +66,7 @@ The remaining `sandbox` facets name the bound each invariant already carries: `a
 
 ### Compensation
 
-A host that advertises `compensation` MUST serve `GET /runs/{runId}/compensation` (`schemas/v2/compensation-projection.schema.json`), keyed on the node and attempt the operator family uses. The read projection and the operator action family are the canonical wire. A host that does not advertise `compensation` has no obligation.
+A host that advertises `compensation` MUST serve `GET /runs/{runId}/compensation` (`schemas/v2/compensation-projection.schema.json`), keyed on the node and attempt the operator family uses. The read projection and the operator action family are the canonical wire.
 
 The facets bind the policy shape (`schemas/v2/compensation-policy.schema.json`):
 

package/spec/v2/errors.json

@@ -1424,6 +1424,51 @@
       },
       "since": "2.45",
       "source": "spec/v2/core/conversation.md §multiPartyConversation; RFC 0239 §C"
+    },
+    {
+      "code": "proposal_state_conflict",
+      "meaning": "The proposal is terminal (applied, rejected or archived) and the action is not allowed; details.state and details.action name it.",
+      "httpStatus": 409,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": ["state", "action"],
+        "properties": {
+          "state": { "type": "string", "description": "The proposal's current state." },
+          "action": { "type": "string", "description": "The refused action: revise, apply or reject." }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.46",
+      "source": "spec/v2/facets/agents.schema.json §proposals; RFC 0249"
+    },
+    {
+      "code": "proposal_stale",
+      "meaning": "The proposal changed since the caller read it: an apply's artifactDigest differs from the persisted artifact's, or a revise lost a concurrent update. Nothing was installed.",
+      "httpStatus": 409,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": null,
+      "since": "2.46",
+      "source": "spec/v2/facets/agents.schema.json §proposals; RFC 0249"
+    },
+    {
+      "code": "proposal_install_conflict",
+      "meaning": "The target store refused the install; details.reason is version-not-greater or read-only. Nothing was installed and the proposal's state is unchanged.",
+      "httpStatus": 409,
+      "statusSource": "v2 decision",
+      "retriable": false,
+      "details": {
+        "type": "object",
+        "required": ["reason"],
+        "properties": {
+          "reason": { "type": "string", "enum": ["version-not-greater", "read-only"], "description": "Why the store refused (RFC 0249 §D)." }
+        },
+        "additionalProperties": true
+      },
+      "since": "2.46",
+      "source": "spec/v2/facets/agents.schema.json §proposals; RFC 0249"
     }
   ]
 }

package/spec/v2/facets/agents.schema.json

@@ -368,7 +368,7 @@
     },
     "proposals": {
       "type": "object",
-      "description": "RFC 0096 (`Active`). Reviewable learning — the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. v2 defines no protocol path for the proposal surface. A host advertising this emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate or RFC 0049 RBAC — no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis). Hosts that omit this block do not synthesize proposals; the conformance scenarios skip cleanly. The redaction-safety of `rationale` and `provenance.sourceRunIds` and the lifecycle are in `proposal.schema.json`.",
+      "description": "RFC 0096 (`Active`), operations by RFC 0249. Reviewable learning — the host synthesizes reusable artifacts (skills/packs/templates/automations) from run/tool traces as INERT, reviewable drafts that MUST NOT influence the resolution, planning, or execution of any run until an authorized principal activates them. The surface is the seven `proposals` operations (`listProposals`, `getProposal`, `submitProposal`, `reviseProposal`, `applyProposal`, `rejectProposal`, `archiveProposal`; scopes `proposals:read`, `proposals:write`, `proposals:apply`); a host that omits this block answers each as `errors.md` §Unadvertised operations requires. A proposal another tenant owns MUST be answered exactly as an unknown id. `applied`, `rejected` and `archived` are terminal: revise, apply or reject on one, and archive on `applied` or `archived`, is refused `409 proposal_state_conflict`. A host advertising this emits the content-free `proposal.created` / `proposal.activated` events. Activation is delegated to RFC 0051 approval-gate (apply opens a gate run that suspends on an `approval` interrupt) or RFC 0049 RBAC (`proposals:apply`) — no new authorization path. On `apply` the installed artifact MUST byte-match the last-persisted `artifact` (no silent re-synthesis); `activation.installedArtifact` names the read that shows it. The redaction-safety of `rationale` and `provenance.sourceRunIds` and the lifecycle are in `proposal.schema.json`.",
       "additionalProperties": false,
       "required": [
         "artifactKinds",
@@ -401,6 +401,25 @@
             "direct-rbac"
           ],
           "description": "`approval-gate`: `apply` MUST drive an RFC 0051 gate (role/scope/quorum, audited override) and MUST NOT install unless granted/overridden. `direct-rbac`: `apply` requires only the RFC 0049 scope the host advertises for activation. An `overridden` gate MUST be audited."
+        },
+        "clientDrafts": {
+          "type": "boolean",
+          "default": false,
+          "description": "RFC 0249 §B. When `true`, `submitProposal` accepts a client-authored draft. A submitted draft MUST be held to every rule a synthesized one is, inertness first, with `provenance.sourceRunIds: []`. Absent or `false`, `submitProposal` answers `404 not_found`."
+        },
+        "readback": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": [
+              "agent-pack",
+              "workflow-chain-pack",
+              "prompt-template",
+              "automation"
+            ]
+          },
+          "description": "RFC 0249 §D. The kinds whose installed artifact resolves through `activation.installedArtifact`; a subset of `artifactKinds`. For `prompt-template` the read is `getPromptTemplate`, only `meta` is host-owned, and while a proposal is unapplied `getPromptTemplate` / `listPromptTemplates` MUST NOT serve a template carrying its `(templateId, version)` and `POST /prompts:render` naming it MUST fail as for an unknown template. Install follows the prompts write in the applying tenant, and a refused install is `409 proposal_install_conflict`. A kind proposed but absent here has no outside read-back: its RFC 0096 rules bind but are not checkable from the wire (`workflow-chain-pack`, `agent-pack` and `automation` have no read-back at v2 today)."
         }
       }
     },