@openwop/spec-artifacts 2.7.0 → 2.7.1

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.7.0",
-  "corpusTag": "v2.7.0",
+  "version": "2.7.1",
+  "corpusTag": "v2.7.1",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "0a44c26467543367068e89db69a0e01f3e95c7f5e41708bc18c625d252c6091e",
-    "api/v2/asyncapi.yaml": "5a431c280d7a7f3eeaabc5a6ee404762336d9cb4e615154fdc898f2b6a6ab557",
-    "api/v2/openapi.yaml": "ad75daf10c3f9bfb909f496c75a9480c967f699fbdd6ca1c722aef577c5c5319",
+    "api/seams-v2.yaml": "b243b0ef6d4327e2cb7330304f619f700223eb2c5e542925fca79832693a4066",
+    "api/v2/asyncapi.yaml": "41bfda7698cf076a39c8fb2580aebd0d2c5cf05a08b8666ddc16e1c1591f4531",
+    "api/v2/openapi.yaml": "17b23fc7f5b6cb2afaddc50ae5d01df61141ec3e534db0a8ceb384b60b5f5621",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -201,20 +201,20 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "bbb35b8db5c1670f08ac1948f75112344f1200ae935ae7d19db33f8d9ed94f65",
+    "spec/v1/core-standard-manifest.json": "48358d15114eedd48ac3c958cafc5e4f8a1e008c3596f884871b380c9bcf3226",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
     "spec/v1/event-codemap.schema.json": "d05933b2e88103aff51a2f774df97b9bda065e0fc88dbd9b114cc47a32189174",
     "spec/v1/extensions.json": "79a60754aa16cbdbdb604f8e5c00038af535a1690a4d07bd5ff7c38f0256a7bc",
-    "spec/v1/gaps.json": "4cfbca9d11e666685c874a113e7e4b4056014ff67224046258bfdd8ff1fc75a5",
+    "spec/v1/gaps.json": "d9f21ba6e6822eb6a12fefa9f2ecf52e4c3dc6f812d1c6f6da73f0e663e9dbfd",
     "spec/v1/gaps.schema.json": "8fd83259f556553c9df0f53e7a82ca8c2a4771d471197f69b4e2ae0ceeacfd66",
     "spec/v1/migrations.json": "8839497d6a4830b53fa7867014a8336f0d725ef2346352e54fb580b7947897af",
     "spec/v1/migrations.schema.json": "886779aa6c22e646db097f5df210adb018a4dd14a7b815465a18c8a7056c8f72",
     "spec/v1/operation-path-manifest.json": "5f5f4e3842669371730ebbd1aace3fb794192615f0018dc144f484ba5db82ac3",
     "spec/v1/spec-gaps.json": "eb3bfcb9c7d05c9a6845d4a40ec9493cfaa5a671932daf1af561310136fdabe8",
     "spec/v2/README.md": "5d49f56f41e06b44312c61ad8144b786c9a90ec42fd0660a40d89520ef206137",
-    "spec/v2/core/capabilities.md": "35696991582729c86b5760f292251734e37cee45398fa5179764cefa5a91037f",
+    "spec/v2/core/capabilities.md": "9e81d578e177f9875499677d22207df909e59e3d4ddaa3d90f18a7035cfb31f4",
     "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
     "spec/v2/core/connection-packs.md": "2e53c92476f68304139faf0c370874dc27bbba56a127a07e0906ff06edbb8ff1",
     "spec/v2/core/errors.md": "c3ac131dff970ab7574629d72735ace52cc56cd4a7ab5d1206ce91f382bc9a68",
@@ -272,8 +272,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "fe784abdffc2089df66c6eda874d61a50b45912f8817b90051a91dc9c624380f",
+    "spec/v2/release.json": "4a756e0b13888047ec429a0d28928599633a553baa6d4550517d6f528ce2bd9b",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "35659ff7e741cc827a52f41140cac72aa0a4abeb"
+  "corpusCommit": "b0a202870a1ec8c4921297cb7b2a178751cb4b04"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.7.0
+  version: 2.7.1
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.7.0
+  version: 2.7.1
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.7.0
+  version: 2.7.1
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.7.0"
+      "version": "2.7.1"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "ad097f5a97036bd42ca27c49119a4251e5b485a8f3075a4d96c9bda21a7e56b9"
+  "digest": "dd71fdff1a70bdff918a3c55d239d70208cae1533febc0c14052a610baa628d0"
 }

package/spec/v1/gaps.json

@@ -4355,7 +4355,7 @@
       "surface": "`tokenCounter` enum vs provider-native tokenizers — does a portable enum diverge too far from real cost?",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -4372,7 +4372,7 @@
       "surface": "Transcript seam: host-sample-only seam vs a normative read endpoint",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -4389,7 +4389,7 @@
       "surface": "Replay determinism of host summaries — must `summaryRef` artifact be byte-stable across replays?",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -4406,7 +4406,7 @@
       "surface": "Verbatim floor unit: `keepLastTurns` (count) vs `keepLastTokens` (tokens)",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -4423,8 +4423,8 @@
       "surface": "No non-steward host advertises `contextBudget` yet",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "externally-gated",
+      "target": "non-steward-host",
       "sources": [
         {
           "file": "RFCS/registers/0111-context-economy.gaps.md",
@@ -5120,8 +5120,8 @@
       "surface": "No confirmed provider terms-of-service permits API-shaped third-party automation under a reused consumer-subscription login, for any vendor.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "externally-gated",
+      "target": "provider-tos-clearance",
       "sources": [
         {
           "file": "RFCS/registers/0121-subscription-provider-auth.gaps.md",
@@ -5137,7 +5137,7 @@
       "surface": "Whether the acquisition mechanism is direct API calls under a borrowed session (ToS-risky, cheap) or an official-client subprocess harness (ToS-safer, architecturally distinct — closer to RFC 0035 than to `ctx.callAI`) is unresolved.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -5154,7 +5154,7 @@
       "surface": "Whether `subscription`-mode credentials need their own dedicated schema shape beyond reusing `host.credentials` `scope: \"user\"`, or whether the existing RFC 0046 credential-reference shape is sufficient as-is.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -5171,7 +5171,7 @@
       "surface": "The existing `conformance/src/scenarios/byok-auth-modes.test.ts` scenario hard-codes the current four-item enum via `toEqual([...])`; it will fail once the schema enum gains a fifth value unless updated in the same conformance release.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {
@@ -5188,8 +5188,8 @@
       "surface": "Rate-limit/seat-abuse potential — even at correct single-user scope (§B clause 8), a host could still architect around the scope constraint by rapidly rotating which user \"owns\" a shared login. Not fully closed by the scope-binding MUST alone.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
-      "target": null,
+      "disposition": "transferred",
+      "target": "docs/KNOWN-LIMITS.md",
       "sources": [
         {
           "file": "RFCS/registers/0121-subscription-provider-auth.gaps.md",
@@ -5205,7 +5205,7 @@
       "surface": "The new `credential_scope_forbidden` error code's exact envelope shape (does it follow the standard OpenWOP error envelope 1:1, or does it need additional fields identifying which scope was attempted?) is sketched but not fully specified.",
       "witness": "unclassified",
       "requirementId": null,
-      "disposition": "open",
+      "disposition": "closed",
       "target": null,
       "sources": [
         {

package/spec/v2/core/capabilities.md

@@ -255,7 +255,7 @@ Witness `witnessable-gated`; owner RFC 0053.
 
 ### § webhooks
 
-Witness `witnessable-gated`; owner no owning RFC (declaration row); facets `signatureAlgorithms`.
+Witness `witnessable-gated`; owner RFC 0188; facets `deadLetter`, `retryPolicy`, `signatureAlgorithms`.
 
 ### § triggerBridge
 

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.7.0",
-  "corpusTag": "v2.7.0",
+  "version": "2.7.1",
+  "corpusTag": "v2.7.1",
   "updated": "2026-09-18"
 }