@openwop/spec-artifacts 2.8.2 → 2.8.3

package/CORPUS-STAMP.json

@@ -1,17 +1,17 @@
 {
   "_comment": "Provenance of @openwop/spec-artifacts (RFC 0168 §D.2). files: SHA-256 per file; the conformance suite compares the installed peer against dist/spec-artifacts.lock.json at start.",
   "package": "@openwop/spec-artifacts",
-  "version": "2.8.2",
-  "corpusTag": "v2.8.2",
+  "version": "2.8.3",
+  "corpusTag": "v2.8.3",
   "files": {
     "api/.redocly.lint-ignore.yaml": "bf5a8350b88a72fa43f59605ed8d903ed24b6cfccda5e45509c9f6ed9ee4e712",
     "api/asyncapi.yaml": "d5ecb9ee6114582be3b1f662c84bfac9ae96dae7bacb853e461168f70a8e1c7d",
     "api/grpc/openwop.proto": "c3e72bb17cba514ee98feb6434e6c9b6ea6795bfd086489ec69fd882dd1ad977",
     "api/openapi.yaml": "39081c59fb696159806b0f2f9a42e7e9ff830d622fcf2ad4159b21357580a955",
     "api/redocly.yaml": "b0604c89b2ca6d5076ec25725c539dad44a741a811fe524439ee6daef8baa09f",
-    "api/seams-v2.yaml": "296a5283690fc422d525815abc780eacd3b6ab7c0fe04e3d4ea72f460f9fabb6",
-    "api/v2/asyncapi.yaml": "21407d943fd706afe9e5c4b5703e453fbd86a8594428014d49b71eb35b937d7c",
-    "api/v2/openapi.yaml": "704e81cd815e8aab818e0dd7dba1b744499e3e9d1f2ad4d7d528161d34a671ae",
+    "api/seams-v2.yaml": "64deea9efd193ce9c885b2e05586fd1cd5c45c5eb1a0ffa075ee3ceaa983c039",
+    "api/v2/asyncapi.yaml": "c9217395cc0acb0acd6e2bc29e3a9beb305b3e6fab08be3214eb18b69856298f",
+    "api/v2/openapi.yaml": "7649ddd91c669937781f2ec7234b4b02345f27e919a8d25258ab74f03a543f4a",
     "api/v2/redocly.yaml": "1e66b60e6118ad11a823bb620678be464d99dfe50a40e3e6f93ec9429b88b34c",
     "schemas/README.md": "0c0b737ffcf8f30e7d2809cec8a498232de710f41443212922ad8337cdde0b51",
     "schemas/a2a-task-state.schema.json": "c9365918f993f943b4b619d42551eb066a1ed33a08d895d51b395432a5b1f1bc",
@@ -141,7 +141,7 @@
     "schemas/v2/envelopes/schema.request.schema.json": "be2c5f7aa881cdd252ccff47ac02193659e1393633a1541f4297383205d384a2",
     "schemas/v2/envelopes/schema.response.schema.json": "d049a081267c06c28879c331b147f3ed821b14ccfd93005c67aff64db0a8c68e",
     "schemas/v2/envelopes/ui.a2ui-surface.schema.json": "0a06fbbdc8ba797a6818c79336a98e211ac5ba5747945b4e4098072cd3974d79",
-    "schemas/v2/error-envelope.schema.json": "9c8f747e5bea81943d70e0930bc7d26586a4c3a3d90be77f46359b19b7e56cbe",
+    "schemas/v2/error-envelope.schema.json": "b2c6b673c14dd7c0603d0862f4bf0dad00e401c88c418914753bcd744d8400f5",
     "schemas/v2/eval-summary.schema.json": "9d31025752d0f67ad3b8a32e82a5314972c530ef9f780dd82e484ae8c5131198",
     "schemas/v2/export-bundle.schema.json": "bd28905a7729437ab7f2ad8bb33e13a371b2bf5605a7eb2962a0d246de312d69",
     "schemas/v2/form-content-pack-manifest.schema.json": "461529e4287ec3b15a9fbcde57226a1c6f17ea3ae71b33b418e6f595ff0619fe",
@@ -201,7 +201,7 @@
     "schemas/workspace-file.schema.json": "464de85c2a068243084ee9c1d969bc7cd5d8f7948574e58450d6493c38a0e1e4",
     "spec/v1/alias-detectors.json": "e90916db12d2297e2e560b2d54d2c4702d6cb3bef7179a575844687a7ec17262",
     "spec/v1/capability-declaration-classes.json": "e7729aed5c4b4e1dd02abab0530f14cc95f5d4070fe51fb139e7f5cccefa00c6",
-    "spec/v1/core-standard-manifest.json": "c6d57dec530f5b37f0f1db857db923d1cbd88606cf8ae6b6cbebdb54e35aa950",
+    "spec/v1/core-standard-manifest.json": "540b87d21baa032b986e68a13ed07ddc2c62519baf5f16395126d0420e8266ed",
     "spec/v1/deprecations.json": "c81c8f71460936c8d489d8270477c7661cf4a5d7b7bad86c98899750b5656027",
     "spec/v1/deprecations.schema.json": "18c87e78bedc210431f795ae44c5b5d202f2f3317850d5cf86867d4f1fa1cdfb",
     "spec/v1/event-codemap.json": "3da60d884157793a360da532a9fcbbfb5285636db325a74cec94b34622186d97",
@@ -217,7 +217,7 @@
     "spec/v2/core/capabilities.md": "9e81d578e177f9875499677d22207df909e59e3d4ddaa3d90f18a7035cfb31f4",
     "spec/v2/core/conformance.md": "a451c0a2ba79d93c55e540ccef480eba7de9602d59bbb03eead05daafde0beac",
     "spec/v2/core/connection-packs.md": "2e53c92476f68304139faf0c370874dc27bbba56a127a07e0906ff06edbb8ff1",
-    "spec/v2/core/errors.md": "c3ac131dff970ab7574629d72735ace52cc56cd4a7ab5d1206ce91f382bc9a68",
+    "spec/v2/core/errors.md": "6b6a1480ed889013172d8ce8c6985e321d2f4f73e1d9fae0bac9b961d0dd1a8c",
     "spec/v2/core/events.md": "6ab8c727df3ebc5a60de3837c82a0075b4357d6f7e28435c6f80585687d41a76",
     "spec/v2/core/form-content-packs.md": "d4c5295dfd28972be205c87c34d0d34ced64f4a2561ebff7f9d24b436d83df25",
     "spec/v2/core/headers.md": "14cdf4ae9ee7d80eebfd426d7c3552e577baea0300915cd4bb3a68e8588195a8",
@@ -236,7 +236,7 @@
     "spec/v2/core/workflow-chain-packs.md": "26bb65721f826285b7d90c3cb62fa7e9fb2414c1bc6e0fd25b33209168c3102e",
     "spec/v2/declaration.json": "facd8b8466ea86b61325670450a1205c672e844e0dbcd9d9392ef0eb2021cca3",
     "spec/v2/declaration.schema.json": "c86e3083fb9789c1958ecb4576cc6f71aa90e6f339521139238543ed08211dd4",
-    "spec/v2/errors.json": "4ff032033f02d7e3fb4204581456408ba5e7642b438c1f349bbd1c264e63e419",
+    "spec/v2/errors.json": "aac91b12f954cc90574d310070ae3c651b131055d4389d2c6155242763765195",
     "spec/v2/event-codemap.json": "37869a03cdfd8758b57e6f350641a6ebbd383231cebda51f5473ad85f94ab74c",
     "spec/v2/event-codemap.schema.json": "b173f2a9bcc0bf9b62a474ce3b91e1431d597e64fd1560fc58662cd8606eaf9c",
     "spec/v2/ext/README.md": "ff91a503e0795e1b898e37d9e445add2d5975529723f7b32b2599b60a24c1ae3",
@@ -273,8 +273,8 @@
     "spec/v2/path-manifest.json": "c123c9fd77dc1b3f9c2e9346ace80cdae007e6511138894956abda01e61ec1c6",
     "spec/v2/peer-dependency-aliases.json": "d10299280abee08258502925bc327293ee413e0108cd6e6ec75ff6110653308d",
     "spec/v2/profiles.json": "0636f19fceae625390003a347e70ef4797d84766b5c24ce8a02cea52aadebca4",
-    "spec/v2/release.json": "0bcbacf7697213dced197b2bc0cf8ee0af61786db4518eb39aad9524c1a74d80",
+    "spec/v2/release.json": "35e41f5f136dacf24a5d14a271e987fc6955b821c9708bd9ff5895ef09ab9324",
     "spec/v2/retention-floors.json": "eaf3722d95c79947af1d4269ef85117e126518c588cfcf1a2b21b97269f51624"
   },
-  "corpusCommit": "ae9a19cf3e20a12f2d0ab08eb194f191c1609613"
+  "corpusCommit": "9eb4c793dad242f5e0231e168085d1d5e6bc1598"
 }

package/api/seams-v2.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP conformance seams profile (openwop-conformance-seams-v2)
-  version: 2.8.2
+  version: 2.8.3
   description: 'GENERATED by scripts/derive-v2-api.py. RFC 0168 §C: the seams are a versioned conformance profile with their
     own document and path space (/conformance/seams/…), validated against the canonical v2 schemas with no tolerance path,
     forbidden from the capability namespace (a host advertises the profile, never a testSeams flag). This document carries

package/api/v2/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.1.0
 info:
   title: OpenWOP v2 event streams
-  version: 2.8.2
+  version: 2.8.3
   description: GENERATED by scripts/derive-v2-api.py (RFC 0171 §E.1, RFC 0172 §C.2). One run-events channel whose address
     is the OpenAPI path key; the server pathname is empty (bare origin). streamMode is a pattern over the closed set and its
     comma-separated combinations (`values` never combines). hostEvents has a real address (RFC 0171 §E.1) — the documented

package/api/v2/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OpenWOP v2 API
-  version: 2.8.2
+  version: 2.8.3
   summary: REST surface for declaring, executing, suspending, resuming, and observing multi-step workflows.
   description: GENERATED by scripts/derive-v2-api.py from api/openapi.yaml and the RFC 0167 children (v2 charter Phase 3,
     P3-C). Bare origin, unversioned path keys, negotiation by `OpenWOP-Version` + `protocolVersions[]` (RFC 0172 §A). No seam

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/spec-artifacts",
-  "version": "2.8.2",
+  "version": "2.8.3",
   "description": "The OpenWOP machine-readable contract: api/ (OpenAPI, AsyncAPI, the seams profile), schemas/ (v1 and v2 JSON Schemas), the spec/v1 and spec/v2 registries (errors, event codemap, declaration, deprecations, migrations, gaps) and CORPUS-STAMP.json — published from the openwop/openwop corpus tag; the peer dependency @openwop/openwop-conformance digest-checks at start (RFC 0168 §D.2).",
   "license": "Apache-2.0",
   "repository": {

package/schemas/v2/error-envelope.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://openwop.dev/spec/v2/error-envelope.schema.json",
   "title": "ErrorEnvelope (v2)",
-  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 98 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
+  "description": "GENERATED from spec/v2/errors.json by scripts/generate-error-envelope.mjs (RFC 0171 §B.1). 99 registered codes; vendor codes match ^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$. Consumers MUST accept an unknown registered member and MUST NOT act on it (RFC 0171 §A.5).",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -52,6 +52,7 @@
             "sender_constraint_missing",
             "unauthenticated",
             "credential_forbidden",
+            "credential_scope_forbidden",
             "delegation_scope_amplified",
             "forbidden",
             "force_engine_version_forbidden",
@@ -240,6 +241,7 @@
     "sender_constraint_missing": 401,
     "unauthenticated": 401,
     "credential_forbidden": 403,
+    "credential_scope_forbidden": 403,
     "delegation_scope_amplified": 403,
     "forbidden": 403,
     "force_engine_version_forbidden": 403,

package/spec/v1/core-standard-manifest.json

@@ -4,7 +4,7 @@
   "provenance": {
     "suite": {
       "package": "@openwop/openwop-conformance",
-      "version": "2.8.2"
+      "version": "2.8.3"
     },
     "note": "Derived from the corpus at generation time. Regenerate with --write; verify with --check."
   },
@@ -419,5 +419,5 @@
       "$id": "https://openwop.dev/spec/v1/workspace-file.schema.json"
     }
   ],
-  "digest": "2d5e2eb843ab9d9c6affb0d9219cfd08e43e4c7bd0a091617613d04d43e993ee"
+  "digest": "18e2a55ecea063b7e2c1d4c4ac5160499cb6143b7a81e1af914867c41f5e447f"
 }

package/spec/v2/core/errors.md

@@ -8,7 +8,7 @@ Every error a v2 host returns is a row in one registry. A client routes on `erro
 
 ## The registry
 
-`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`. It registers **98** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`. It registers **99** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
 
 A host MUST return a registered code, or a vendor code, in every error response. A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$` with its first segment an org registered in `spec/v2/declaration.json`; `openwop.` is reserved. The registry grows by the closed-enum rule in overview.md §0: a producer MUST NOT emit an unregistered member, and a consumer MUST accept an unknown registered member and MUST NOT act on it.
 
@@ -28,7 +28,7 @@ An interrupt has one code per state: a token or run-scoped resolve against an in
 
 ## Codes by HTTP status
 
-Generated from `spec/v2/errors.json` (98 codes; `retriable` and `statusSource` are in the registry).
+Generated from `spec/v2/errors.json` (99 codes; `retriable` and `statusSource` are in the registry).
 
 Code | Status
 --- | ---
@@ -69,6 +69,7 @@ Code | Status
 `sender_constraint_missing` | 401
 `unauthenticated` | 401
 `credential_forbidden` | 403
+`credential_scope_forbidden` | 403
 `delegation_scope_amplified` | 403
 `forbidden` | 403
 `force_engine_version_forbidden` | 403
@@ -96,22 +97,22 @@ Code | Status
 `replay_diverged_at_refusal` | 409
 `replay_memory_snapshot_unavailable` | 409
 `run_already_active` | 409
-`run_terminal` | 409
 `run_state_conflict` | 409
+`run_terminal` | 409
 `version_conflict` | 409
 `workspace_conflict` | 409
 `interrupt_cancelled` | 410
 `interrupt_expired` | 410
-`workspace_too_large` | 413
 `payload_too_large` | 413
+`workspace_too_large` | 413
 `unsupported_media_type` | 415
 `capability_not_provided` | 422
 `capability_required` | 422
 `credential_required` | 422
 `envelope_invalid` | 422
 `envelope_refusal` | 422
-`fork_point_invalid` | 422
 `envelope_truncation_unrecoverable` | 422
+`fork_point_invalid` | 422
 `loop_limit_exceeded` | 422
 `mcp_mrtr_rounds_exceeded` | 422
 `pack_runtime_requirement_unmet` | 422
@@ -125,8 +126,8 @@ Code | Status
 `rate_limited` | 429
 `event_type_unmapped` | 500
 `internal_error` | 500
-`payload_unprojectable` | 500
 `pack_load_failure` | 500
+`payload_unprojectable` | 500
 `credential_unavailable` | 501
 `pack_registry_unreachable` | 503
-`runner_unavailable` | 503
+`runner_unavailable` | 503

package/spec/v2/errors.json

@@ -2,7 +2,7 @@
   "$schema": "https://openwop.dev/spec/v2/errors.schema.json",
   "$comment": "RFC 0171 §B.1 — the error registry: one row per code {code, httpStatus, retriable, details, since, deprecated?}. schemas/v2/error-envelope.schema.json is GENERATED from it (scripts/generate-error-envelope.mjs). Retry timing lives in Retry-After only (§B.2). statusSource records whether the status was stated in v1 prose, a v1 convention, or decided here. details is null until a code's details schema is registered (a null row means details is an open object for that code — closure over details is the RFC 0171 Phase 3 follow-up G-row).",
   "version": "2.0",
-  "updated": "2026-09-17",
+  "updated": "2026-09-18",
   "vendorCodePattern": "^(?!openwop\\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\\.[a-z][a-z0-9_]*$",
   "rows": [
     {
@@ -360,6 +360,15 @@
       "since": "1.0",
       "source": "spec/v1/rest-endpoints.md §Error response shape"
     },
+    {
+      "code": "credential_scope_forbidden",
+      "httpStatus": 403,
+      "statusSource": "v1 prose",
+      "retriable": false,
+      "details": null,
+      "since": "1.0",
+      "source": "spec/v1/capabilities.md §B.8"
+    },
     {
       "code": "delegation_scope_amplified",
       "httpStatus": 403,

package/spec/v2/release.json

@@ -1,6 +1,6 @@
 {
   "$comment": "RFC 0172 §D.1 — the one release identity the v2 artifacts derive from. `version` is the next corpus tag `v<version>` (the publish workflow's coordinated-release tag pattern `v*`; RFC 0172's `openwop/v2.<minor>.<patch>` spelling is amended to this at its flip). api/v2/*.yaml info.version, the suite's 2.x version and @openwop/spec-artifacts read it. Bumped by the release PR that cuts the tag, never by hand elsewhere.",
-  "version": "2.8.2",
-  "corpusTag": "v2.8.2",
+  "version": "2.8.3",
+  "corpusTag": "v2.8.3",
   "updated": "2026-09-18"
 }