@wowok/agent-mcp 3.4.3 → 3.4.4

package/dist/schemas/onchain_operations_machine.schema.json

@@ -1,1879 +1 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://wowok.net/schemas/onchain_operations_machine.json",
-  "title": "Machine Operation",
-  "description": "⚙️ Machine Object: Design and deploy automated workflow templates (Machines) that define how services are delivered, etc..",
-  "type": "object",
-  "properties": {
-    "operation_type": {
-      "type": "string",
-      "const": "machine"
-    },
-    "data": {
-      "type": "object",
-      "properties": {
-        "object": {
-          "anyOf": [
-            {
-              "type": "string",
-              "description": "String format: Reference an EXISTING object by its name (local mark) or on-chain object ID. Use when the Permission object already exists."
-            },
-            {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "description": "The name of the object",
-                  "type": "string"
-                },
-                "tags": {
-                  "description": "The tags of the object",
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "onChain": {
-                  "description": "CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.",
-                  "type": "boolean"
-                },
-                "replaceExistName": {
-                  "description": "FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).",
-                  "type": "boolean"
-                },
-                "permission": {
-                  "anyOf": [
-                    {
-                      "type": "string",
-                      "description": "String format: Reference an EXISTING object by its name (local mark) or on-chain object ID. Example: 'my-object' or '0x1234...'"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "description": "The name of the object",
-                          "type": "string"
-                        },
-                        "tags": {
-                          "description": "The tags of the object",
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          }
-                        },
-                        "onChain": {
-                          "description": "CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.",
-                          "type": "boolean"
-                        },
-                        "replaceExistName": {
-                          "description": "FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).",
-                          "type": "boolean"
-                        },
-                        "description": {
-                          "description": "The description of the object",
-                          "type": "string"
-                        }
-                      },
-                      "additionalProperties": false,
-                      "description": "Object format: CREATE a NEW object with name, optional description, and visibility settings. Extends NamedObjectSchema with an additional 'description' field for detailed object information."
-                    }
-                  ],
-                  "description": "Two ways to specify an object: (1) STRING - Reference an EXISTING object by name or ID; (2) OBJECT - CREATE a NEW object with full configuration including optional name, tags, description, and visibility settings (local private by default, or public on-chain with onChain:true)."
-                }
-              },
-              "additionalProperties": false,
-              "description": "Object format: CREATE a NEW object with Permission-based access control. Includes optional name, tags, visibility settings, AND a Permission object (which itself can be referenced by string or created as a new object). Use this to create objects with managed access permissions."
-            }
-          ],
-          "description": "Two ways to specify a Permission-managed object: (1) STRING - Reference an EXISTING Permission object by name or ID; (2) OBJECT - CREATE a NEW object with Permission access control, where the Permission can also be either referenced (string) or newly created (object). This is used when you need permission management but don't need to specify a token type."
-        },
-        "progress_new": {
-          "description": "Generate new Progress object.",
-          "type": "object",
-          "properties": {
-            "task": {
-              "description": "Task bound to the Progress object. It is an object ID or name",
-              "anyOf": [
-                {
-                  "type": "string",
-                  "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                },
-                {
-                  "type": "null"
-                }
-              ]
-            },
-            "repository": {
-              "description": "Set repository list for the Progress object. Used for consensus data management.",
-              "anyOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "const": "add"
-                        },
-                        {
-                          "type": "string",
-                          "const": "set"
-                        }
-                      ]
-                    },
-                    "objects": {
-                      "type": "array",
-                      "items": {
-                        "type": "string",
-                        "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                      },
-                      "description": "List of object IDs or names to add or set"
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "objects"
-                  ],
-                  "additionalProperties": false
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "remove"
-                    },
-                    "objects": {
-                      "type": "array",
-                      "items": {
-                        "type": "string",
-                        "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                      },
-                      "description": "List of object IDs or names to remove"
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "objects"
-                  ],
-                  "additionalProperties": false
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "clear"
-                    }
-                  },
-                  "required": [
-                    "op"
-                  ],
-                  "additionalProperties": false
-                }
-              ]
-            },
-            "progress_namedOperator": {
-              "description": "Add, set, and remove operators for the permission namespace of the Progress object.",
-              "type": "object",
-              "properties": {
-                "op": {
-                  "anyOf": [
-                    {
-                      "type": "string",
-                      "const": "add"
-                    },
-                    {
-                      "type": "string",
-                      "const": "set"
-                    },
-                    {
-                      "type": "string",
-                      "const": "remove"
-                    }
-                  ]
-                },
-                "name": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "operators": {
-                  "anyOf": [
-                    {
-                      "description": "Array of account names, addresses, or mark names. Local marks are searched first for each entry. EXAMPLE: ['alice', '0x2...', 'bob']"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "entities": {
-                          "minItems": 1,
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name_or_address": {
-                                "type": "string",
-                                "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                              },
-                              "local_mark_first": {
-                                "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                                "type": "boolean"
-                              }
-                            },
-                            "additionalProperties": false,
-                            "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                          }
-                        },
-                        "check_all_founded": {
-                          "default": true,
-                          "description": "Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)",
-                          "type": "boolean"
-                        }
-                      },
-                      "required": [
-                        "entities",
-                        "check_all_founded"
-                      ],
-                      "additionalProperties": false,
-                      "description": "Used to batch find account or object IDs by name"
-                    }
-                  ],
-                  "description": "Batch account or address lookup. Can be an array of strings (recommended for AI) or full object with explicit control. Array form auto-converts to { entities: [...], check_all_founded: true }. Empty arrays and {} elements are REJECTED (no-op transaction guard)."
-                }
-              },
-              "required": [
-                "op",
-                "name",
-                "operators"
-              ],
-              "additionalProperties": false
-            },
-            "namedNew": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "description": "The name of the object",
-                  "type": "string"
-                },
-                "tags": {
-                  "description": "The tags of the object",
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                },
-                "onChain": {
-                  "description": "CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.",
-                  "type": "boolean"
-                },
-                "replaceExistName": {
-                  "description": "FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).",
-                  "type": "boolean"
-                }
-              },
-              "additionalProperties": false,
-              "description": "Assign a name and optional tags to a new object. By default, names are stored LOCALLY (private) on your device. Set 'onChain: true' to create a PUBLIC on-chain identity visible to everyone. IMPORTANT: If the requested name is already taken, the operation will FAIL by default. Only set 'replaceExistName: true' when the user EXPLICITLY demands to forcefully claim the name."
-            }
-          },
-          "additionalProperties": false
-        },
-        "description": {
-          "description": "Description of the object.",
-          "type": "string"
-        },
-        "repository": {
-          "description": "Set repository list for the object. Used for consensus data management.",
-          "anyOf": [
-            {
-              "type": "object",
-              "properties": {
-                "op": {
-                  "anyOf": [
-                    {
-                      "type": "string",
-                      "const": "add"
-                    },
-                    {
-                      "type": "string",
-                      "const": "set"
-                    }
-                  ]
-                },
-                "objects": {
-                  "type": "array",
-                  "items": {
-                    "type": "string",
-                    "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                  },
-                  "description": "List of object IDs or names to add or set"
-                }
-              },
-              "required": [
-                "op",
-                "objects"
-              ],
-              "additionalProperties": false
-            },
-            {
-              "type": "object",
-              "properties": {
-                "op": {
-                  "type": "string",
-                  "const": "remove"
-                },
-                "objects": {
-                  "type": "array",
-                  "items": {
-                    "type": "string",
-                    "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                  },
-                  "description": "List of object IDs or names to remove"
-                }
-              },
-              "required": [
-                "op",
-                "objects"
-              ],
-              "additionalProperties": false
-            },
-            {
-              "type": "object",
-              "properties": {
-                "op": {
-                  "type": "string",
-                  "const": "clear"
-                }
-              },
-              "required": [
-                "op"
-              ],
-              "additionalProperties": false
-            }
-          ]
-        },
-        "node": {
-          "description": "CRITICAL: Choose ONE of two mutually exclusive modes:\n\n**Mode 1: NodeSchema (incremental operations)**\nUse for partial modifications: add, set, remove, clear, exchange, rename, remove prior node, add forward, remove forward.\nFormat: { \"op\": \"add\", \"nodes\": [...], \"bReplace\": false }\nThis mode modifies existing nodes incrementally.\n\n**Mode 2: NodeJsonOrMarkdownFileSchema (complete replacement)**\nUse for complete node redefinition from file.\nFormat: { \"json_or_markdown_file\": \"/path/to/nodes.json\" }\nIMPORTANT: This COMPLETELY REPLACES all existing nodes. File must contain node array [{...}, {...}], NOT an operation object with \"op\" field.\nSupported formats: JSON array or Markdown with code blocks.\nIf parsing fails, error includes line number and column information.",
-          "anyOf": [
-            {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "add"
-                    },
-                    "nodes": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "description": "Node name. ⚠️ T1 LOSSY POINT (B-1): do NOT name a node 'refund'/'refunded'/'deposit_refunded'/'deposit_deducted'/'disputed'/'cancelled' to model fund return or dispute — funds MUST move through the Allocation waterfall (order_allocators), NOT through Machine terminal nodes (R-M1-11). A node named 'refund' is a semantic lie: reaching it does not move funds by itself. Model refund as a refund-to-Order Allocator slot (a { Signer } or Order-owner recipient), and model dispute as the bound Arbitration, not a Machine node."
-                          },
-                          "role": {
-                            "description": "OPTIONAL business role tag for display layers and template reuse (E-9). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain; the MCP echoes it back as a NODE ROLES constraint warning and seed templates annotate it. Semantics: draft = pre-start cancellable, active = work in progress, delivered = work submitted awaiting acceptance, final = settlement endpoint, cancelled = refund endpoint. ⚠️ Advancing to ANY node never moves funds by itself: settlement/refund requires an explicit allocation call (alloc by guard) AFTER the terminal node is reached. Nothing auto-settles on-chain — plan the settlement trigger (merchant, keeper, or buyer action) explicitly in the template.",
-                            "type": "string",
-                            "enum": [
-                              "draft",
-                              "active",
-                              "delivered",
-                              "final",
-                              "cancelled"
-                            ]
-                          },
-                          "pairs": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "prev_node": {
-                                  "type": "string",
-                                  "description": "Previous node name. Empty string '' means initial entry node (the first node in the workflow)."
-                                },
-                                "threshold": {
-                                  "default": 0,
-                                  "description": "Threshold to trigger node advancement. If total Forward weight is greater than or equal to threshold, node advancement is triggered. ⚠️ SINGLE-OPERATOR LOCK: each forward contributes its weight AT MOST ONCE (locked by its first operator; re-execution by others aborts E_NOT_THE_HOLDER). The maximum achievable weight of this Pair is the sum of its DISTINCT forward weights — if that sum < threshold the transition can NEVER migrate. Multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1), never one forward reused by several people.",
-                                  "anyOf": [
-                                    {
-                                      "type": "number"
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ]
-                                },
-                                "forwards": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "name": {
-                                        "type": "string",
-                                        "description": "Forward name"
-                                      },
-                                      "namedOperator": {
-                                        "description": "Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.",
-                                        "anyOf": [
-                                          {
-                                            "type": "string"
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      },
-                                      "permissionIndex": {
-                                        "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
-                                        "anyOf": [
-                                          {
-                                            "type": "number"
-                                          },
-                                          {
-                                            "type": "string"
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      },
-                                      "weight": {
-                                        "anyOf": [
-                                          {
-                                            "type": "number"
-                                          },
-                                          {
-                                            "type": "string"
-                                          }
-                                        ],
-                                        "description": "Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."
-                                      },
-                                      "guard": {
-                                        "description": "Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).",
-                                        "anyOf": [
-                                          {
-                                            "anyOf": [
-                                              {
-                                                "type": "object",
-                                                "properties": {
-                                                  "guard": {
-                                                    "type": "string",
-                                                    "description": "Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"
-                                                  },
-                                                  "retained_submission": {
-                                                    "description": "Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.",
-                                                    "anyOf": [
-                                                      {
-                                                        "type": "array",
-                                                        "items": {
-                                                          "anyOf": [
-                                                            {
-                                                              "type": "number"
-                                                            },
-                                                            {
-                                                              "type": "string"
-                                                            }
-                                                          ]
-                                                        }
-                                                      },
-                                                      {
-                                                        "type": "null"
-                                                      }
-                                                    ]
-                                                  }
-                                                },
-                                                "required": [
-                                                  "guard"
-                                                ],
-                                                "additionalProperties": false,
-                                                "description": "OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."
-                                              },
-                                              {
-                                                "type": "string",
-                                                "description": "STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."
-                                              }
-                                            ]
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      }
-                                    },
-                                    "required": [
-                                      "name",
-                                      "weight"
-                                    ],
-                                    "additionalProperties": false,
-                                    "description": "Forward in Machine object"
-                                  },
-                                  "description": "Forward list — operations to ENTER THIS NODE from prev_node. SEMANTIC CLARIFICATION: forwards describe INCOMING transitions (how to ARRIVE at this node), NOT outgoing transitions. Think of each forward as an 'entry door' to this node. Example: pair {prev_node:'A', forwards:[{name:'Go'}]} means 'use Go to advance FROM A TO THIS NODE'. For initial node (prev_node=''), forwards are operations to enter this node from the start state. DIAGRAM: A --[Go]--> B means the pair belongs to node B (destination), with prev_node='A'. WARNING: forwards belong to the DESTINATION node's pair, NOT the source node. Placing a forward on the wrong pair will cause Progress to get stuck."
-                                }
-                              },
-                              "required": [
-                                "prev_node",
-                                "threshold",
-                                "forwards"
-                              ],
-                              "additionalProperties": false,
-                              "description": "Node pair in Machine object"
-                            },
-                            "description": "Node pair list"
-                          },
-                          "optional": {
-                            "description": "OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).",
-                            "type": "boolean"
-                          }
-                        },
-                        "required": [
-                          "name",
-                          "pairs"
-                        ],
-                        "additionalProperties": false,
-                        "description": "Node in Machine object"
-                      },
-                      "description": "List of nodes to add (or replace in place when bReplace=true)."
-                    },
-                    "bReplace": {
-                      "description": "Whether to replace existing nodes. If true, existing nodes will be replaced; if false, nodes will be added by merging. This is the ONLY supported way to rewrite nodes on an EXISTING Machine.",
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "nodes"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Add nodes."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "set"
-                    },
-                    "nodes": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
-                            "type": "string",
-                            "description": "Node name. ⚠️ T1 LOSSY POINT (B-1): do NOT name a node 'refund'/'refunded'/'deposit_refunded'/'deposit_deducted'/'disputed'/'cancelled' to model fund return or dispute — funds MUST move through the Allocation waterfall (order_allocators), NOT through Machine terminal nodes (R-M1-11). A node named 'refund' is a semantic lie: reaching it does not move funds by itself. Model refund as a refund-to-Order Allocator slot (a { Signer } or Order-owner recipient), and model dispute as the bound Arbitration, not a Machine node."
-                          },
-                          "role": {
-                            "description": "OPTIONAL business role tag for display layers and template reuse (E-9). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain; the MCP echoes it back as a NODE ROLES constraint warning and seed templates annotate it. Semantics: draft = pre-start cancellable, active = work in progress, delivered = work submitted awaiting acceptance, final = settlement endpoint, cancelled = refund endpoint. ⚠️ Advancing to ANY node never moves funds by itself: settlement/refund requires an explicit allocation call (alloc by guard) AFTER the terminal node is reached. Nothing auto-settles on-chain — plan the settlement trigger (merchant, keeper, or buyer action) explicitly in the template.",
-                            "type": "string",
-                            "enum": [
-                              "draft",
-                              "active",
-                              "delivered",
-                              "final",
-                              "cancelled"
-                            ]
-                          },
-                          "pairs": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "prev_node": {
-                                  "type": "string",
-                                  "description": "Previous node name. Empty string '' means initial entry node (the first node in the workflow)."
-                                },
-                                "threshold": {
-                                  "default": 0,
-                                  "description": "Threshold to trigger node advancement. If total Forward weight is greater than or equal to threshold, node advancement is triggered. ⚠️ SINGLE-OPERATOR LOCK: each forward contributes its weight AT MOST ONCE (locked by its first operator; re-execution by others aborts E_NOT_THE_HOLDER). The maximum achievable weight of this Pair is the sum of its DISTINCT forward weights — if that sum < threshold the transition can NEVER migrate. Multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1), never one forward reused by several people.",
-                                  "anyOf": [
-                                    {
-                                      "type": "number"
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ]
-                                },
-                                "forwards": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "name": {
-                                        "type": "string",
-                                        "description": "Forward name"
-                                      },
-                                      "namedOperator": {
-                                        "description": "Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.",
-                                        "anyOf": [
-                                          {
-                                            "type": "string"
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      },
-                                      "permissionIndex": {
-                                        "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
-                                        "anyOf": [
-                                          {
-                                            "type": "number"
-                                          },
-                                          {
-                                            "type": "string"
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      },
-                                      "weight": {
-                                        "anyOf": [
-                                          {
-                                            "type": "number"
-                                          },
-                                          {
-                                            "type": "string"
-                                          }
-                                        ],
-                                        "description": "Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."
-                                      },
-                                      "guard": {
-                                        "description": "Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).",
-                                        "anyOf": [
-                                          {
-                                            "anyOf": [
-                                              {
-                                                "type": "object",
-                                                "properties": {
-                                                  "guard": {
-                                                    "type": "string",
-                                                    "description": "Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"
-                                                  },
-                                                  "retained_submission": {
-                                                    "description": "Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.",
-                                                    "anyOf": [
-                                                      {
-                                                        "type": "array",
-                                                        "items": {
-                                                          "anyOf": [
-                                                            {
-                                                              "type": "number"
-                                                            },
-                                                            {
-                                                              "type": "string"
-                                                            }
-                                                          ]
-                                                        }
-                                                      },
-                                                      {
-                                                        "type": "null"
-                                                      }
-                                                    ]
-                                                  }
-                                                },
-                                                "required": [
-                                                  "guard"
-                                                ],
-                                                "additionalProperties": false,
-                                                "description": "OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."
-                                              },
-                                              {
-                                                "type": "string",
-                                                "description": "STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."
-                                              }
-                                            ]
-                                          },
-                                          {
-                                            "type": "null"
-                                          }
-                                        ]
-                                      }
-                                    },
-                                    "required": [
-                                      "name",
-                                      "weight"
-                                    ],
-                                    "additionalProperties": false,
-                                    "description": "Forward in Machine object"
-                                  },
-                                  "description": "Forward list — operations to ENTER THIS NODE from prev_node. SEMANTIC CLARIFICATION: forwards describe INCOMING transitions (how to ARRIVE at this node), NOT outgoing transitions. Think of each forward as an 'entry door' to this node. Example: pair {prev_node:'A', forwards:[{name:'Go'}]} means 'use Go to advance FROM A TO THIS NODE'. For initial node (prev_node=''), forwards are operations to enter this node from the start state. DIAGRAM: A --[Go]--> B means the pair belongs to node B (destination), with prev_node='A'. WARNING: forwards belong to the DESTINATION node's pair, NOT the source node. Placing a forward on the wrong pair will cause Progress to get stuck."
-                                }
-                              },
-                              "required": [
-                                "prev_node",
-                                "threshold",
-                                "forwards"
-                              ],
-                              "additionalProperties": false,
-                              "description": "Node pair in Machine object"
-                            },
-                            "description": "Node pair list"
-                          },
-                          "optional": {
-                            "description": "OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).",
-                            "type": "boolean"
-                          }
-                        },
-                        "required": [
-                          "name",
-                          "pairs"
-                        ],
-                        "additionalProperties": false,
-                        "description": "Node in Machine object"
-                      },
-                      "description": "List of nodes for a freshly CREATED Machine. xk9 F-02: REFUSED on an existing Machine — op set implies a clear-and-rewrite of the on-chain node table that permanently corrupts it (E_EMPTY_MACHINE on every later publish, no repair). To rewrite an existing Machine use op:add with bReplace:true."
-                    },
-                    "bReplace": {
-                      "description": "Whether to replace existing nodes. If true, existing nodes will be replaced; if false, nodes will be added by merging.",
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "nodes"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Set nodes (CREATE-ONLY — refused on an existing Machine; use add+bReplace there)."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "remove"
-                    },
-                    "nodes": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "description": "List of node names to delete."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "nodes"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Delete nodes."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "clear"
-                    }
-                  },
-                  "required": [
-                    "op"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Clear all nodes."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "exchange"
-                    },
-                    "node_one": {
-                      "type": "string",
-                      "description": "Name of the first node."
-                    },
-                    "node_other": {
-                      "type": "string",
-                      "description": "Name of the second node."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "node_one",
-                    "node_other"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Exchange the positions of two nodes."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "rename"
-                    },
-                    "node_name_old": {
-                      "type": "string",
-                      "description": "Name of thenode."
-                    },
-                    "node_name_new": {
-                      "type": "string",
-                      "description": "New name of the node."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "node_name_old",
-                    "node_name_new"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Rename node."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "remove prior node"
-                    },
-                    "pairs": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "prior_node_name": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            },
-                            "description": "List of previous node names to delete."
-                          },
-                          "node_name": {
-                            "type": "string",
-                            "description": "Name of the next node."
-                          }
-                        },
-                        "required": [
-                          "prior_node_name",
-                          "node_name"
-                        ],
-                        "additionalProperties": false
-                      },
-                      "description": "List of previous-next node pairs to delete."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "pairs"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Delete previous-next node pairs."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "add forward"
-                    },
-                    "data": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "prior_node_name": {
-                            "type": "string",
-                            "description": "Name of the previous node."
-                          },
-                          "node_name": {
-                            "type": "string",
-                            "description": "Name of the next node."
-                          },
-                          "forward": {
-                            "type": "array",
-                            "items": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "description": "Forward name"
-                                },
-                                "namedOperator": {
-                                  "description": "Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.",
-                                  "anyOf": [
-                                    {
-                                      "type": "string"
-                                    },
-                                    {
-                                      "type": "null"
-                                    }
-                                  ]
-                                },
-                                "permissionIndex": {
-                                  "description": "Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).",
-                                  "anyOf": [
-                                    {
-                                      "type": "number"
-                                    },
-                                    {
-                                      "type": "string"
-                                    },
-                                    {
-                                      "type": "null"
-                                    }
-                                  ]
-                                },
-                                "weight": {
-                                  "anyOf": [
-                                    {
-                                      "type": "number"
-                                    },
-                                    {
-                                      "type": "string"
-                                    }
-                                  ],
-                                  "description": "Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."
-                                },
-                                "guard": {
-                                  "description": "Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).",
-                                  "anyOf": [
-                                    {
-                                      "anyOf": [
-                                        {
-                                          "type": "object",
-                                          "properties": {
-                                            "guard": {
-                                              "type": "string",
-                                              "description": "Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"
-                                            },
-                                            "retained_submission": {
-                                              "description": "Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.",
-                                              "anyOf": [
-                                                {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "anyOf": [
-                                                      {
-                                                        "type": "number"
-                                                      },
-                                                      {
-                                                        "type": "string"
-                                                      }
-                                                    ]
-                                                  }
-                                                },
-                                                {
-                                                  "type": "null"
-                                                }
-                                              ]
-                                            }
-                                          },
-                                          "required": [
-                                            "guard"
-                                          ],
-                                          "additionalProperties": false,
-                                          "description": "OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."
-                                        },
-                                        {
-                                          "type": "string",
-                                          "description": "STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."
-                                        }
-                                      ]
-                                    },
-                                    {
-                                      "type": "null"
-                                    }
-                                  ]
-                                }
-                              },
-                              "required": [
-                                "name",
-                                "weight"
-                              ],
-                              "additionalProperties": false,
-                              "description": "Forward in Machine object"
-                            },
-                            "description": "List of operations between the previous and next nodes."
-                          },
-                          "threshold": {
-                            "description": "Threshold of operations that need to be completed to migrate from the previous node to the next node.",
-                            "anyOf": [
-                              {
-                                "type": "integer",
-                                "minimum": 0,
-                                "maximum": 9007199254740991
-                              },
-                              {
-                                "type": "null"
-                              }
-                            ]
-                          }
-                        },
-                        "required": [
-                          "prior_node_name",
-                          "node_name",
-                          "forward"
-                        ],
-                        "additionalProperties": false
-                      },
-                      "description": "List of operations to add."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "data"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Add operations."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "op": {
-                      "type": "string",
-                      "const": "remove forward"
-                    },
-                    "data": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "prior_node_name": {
-                            "type": "string",
-                            "description": "Name of the previous node."
-                          },
-                          "node_name": {
-                            "type": "string",
-                            "description": "Name of the next node."
-                          },
-                          "forward_name": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            },
-                            "description": "List of operation names to delete."
-                          }
-                        },
-                        "required": [
-                          "prior_node_name",
-                          "node_name",
-                          "forward_name"
-                        ],
-                        "additionalProperties": false
-                      },
-                      "description": "List of operations to delete."
-                    }
-                  },
-                  "required": [
-                    "op",
-                    "data"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Delete operations."
-                }
-              ]
-            },
-            {
-              "type": "object",
-              "properties": {
-                "json_or_markdown_file": {
-                  "type": "string",
-                  "description": "Path to a JSON or Markdown file containing node array for COMPLETE REPLACEMENT of all nodes.\n\n**File Format Requirements:**\n- Must contain a JSON ARRAY of node objects: [{\"name\": \"...\", \"pairs\": [...]}, {...}]\n- NOT an operation object with \"op\" field (use NodeSchema for operations)\n- Supports JSON or Markdown (with ```json code blocks)\n\n**Node Structure:**\nEach node is a directed graph element representing a workflow STATE that an order\ncan rest in. Its Pairs are the INCOMING edges — this is the one convention the\nchain enforces, and getting it backwards silently builds a wrong graph:\n- name: Node identifier — the DESTINATION of every pair it owns\n- role: (optional) business role tag for display layers — one of draft/active/delivered/final/cancelled. SESSION METADATA ONLY (not stored on-chain; echoed back as a NODE ROLES warning)\n- pairs: Array of {prev_node, forwards, threshold} — edges ENTERING this node. The key is `prev_node`; `prior_node` is not recognized and is silently dropped.\n- forwards: Operations that advance INTO this node FROM its prev_node (NOT operations available from this node)\n- threshold: Weight required to migrate into this node along that pair\n\nDiagram `A --[Go]--> B` therefore lives in node **B**: {name:\"B\", pairs:[{prev_node:\"A\", forwards:[{name:\"Go\", weight:1}]}]}.\n\n**Forward names must determine the destination.** `next_node` is a CALLER argument\nand the chain resolves (current, next_node, forward) inside the\ndestination node, so one forward name shared by two destinations\nfrom the same prev_node is legal and lets the caller pick the outcome — including\nwhether a refund Allocator ever fires. Give each destination its own forward name.\n\n**Behavior:**\n- COMPLETELY REPLACES all existing nodes (equivalent to \"set\" with bReplace=true)\n- Auto-detects format based on file content\n- If parsing fails, error includes line number and column information"
-                }
-              },
-              "required": [
-                "json_or_markdown_file"
-              ],
-              "additionalProperties": false
-            }
-          ]
-        },
-        "pause": {
-          "description": "Whether to pause generating new Progress objects. Chain truth (the progress-generation entry asserts !bPaused): the pause gates NEW order entry only — in-flight Progress keeps advancing and settling (yfd-ln F-13 misread this as a freeze switch; it never was one).",
-          "type": "boolean"
-        },
-        "publish": {
-          "description": "Whether to publish the object. After the object is published, new Progress objects can be generated; and node settings will no longer be changeable. ⚠️ PUBLISH IS A ONE-WAY DOOR AND THE CHAIN VALIDATES THE WHOLE GRAPH AT THAT MOMENT: the on-chain publish gate rejects a Machine that is empty, has no entry edge (no pair with prev_node:\"\"), has an entry pair with no forward, references a prev_node that is not a node of this Machine, carries a forward with neither namedOperator nor permissionIndex (a guard is NOT an identity), or has a pair whose threshold exceeds the sum of its forward weights (each forward counts at most once). These aborts (machine:17-22) fire BEFORE the publish lands, so the graph is still editable — but after it succeeds, nodes/forwards, Guard bindings and Service.machine are frozen forever, and a broken graph would only surface at the first transition with no repair path. Send the nodes in the SAME call as publish:true (bReplace:true or op:\"set\") so the complete graph is validated together. ⚠️ Before publishing, enumerate the graph STOP NODES (nodes with no outgoing Pair) plus every waiting state (review window, handover, open dispute) and verify each has a defined fund exit in the Service order_allocators — withdrawal (release) AND refund. Machine + Allocator are immutable after publish (IMMUT-001); an uncovered stop node strands funds permanently (rule R-M5-03, checklist pattern.fund_flow_stop_node_coverage). ⚠️ REBUILD COST DISCLOSURE (S12-②, ksk4 F-01): every business constant you bake into this graph (campaign deadline, goal, windows, schedules) becomes immutable WITH the machine. Changing even ONE constant after publish requires: new guard → clone the whole node graph into a NEW machine → publish → a NEW Service → re-hang every repository/reward/arbitration/allocator/WIP → republish (≈5 txs / ~1 min measured on a 16-node graph), and in-flight orders stay pointed at the OLD machine forever. THIS OPERATION WILL REQUIRE A NEW SERVICE if any baked-in parameter later changes — finalize mutable business parameters BEFORE publishing (Campaign-structure change is protocol-train scoped; the MCP face cannot patch a published machine).",
-          "type": "boolean"
-        },
-        "owner_receive": {
-          "description": "Unwrap CoinWrapper objects and other objects received by this Machine object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
-          "anyOf": [
-            {
-              "type": "string",
-              "const": "recently"
-            },
-            {
-              "type": "string",
-              "pattern": "^0x[0-9a-fA-F]{8,}$"
-            },
-            {
-              "minItems": 1,
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "id": {
-                    "type": "string",
-                    "minLength": 1,
-                    "description": "Received object ID"
-                  },
-                  "type": {
-                    "type": "string",
-                    "minLength": 1,
-                    "description": "Object type"
-                  },
-                  "content_raw": {
-                    "description": "Raw content data"
-                  },
-                  "version": {
-                    "description": "Object version, required to build a Receiving<T> argument for owner_receive",
-                    "type": "string"
-                  },
-                  "digest": {
-                    "description": "Object digest, required to build a Receiving<T> argument for owner_receive",
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id",
-                  "type"
-                ],
-                "additionalProperties": false,
-                "description": "Received normal object record"
-              }
-            },
-            {
-              "type": "object",
-              "properties": {
-                "balance": {
-                  "anyOf": [
-                    {
-                      "type": "number"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "description": "A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."
-                },
-                "token_type": {
-                  "type": "string",
-                  "description": "Asset type of Coin objects. Supports CoinWrapper<...> format for order receive operations."
-                },
-                "received": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "id": {
-                        "type": "string",
-                        "description": "Received CoinWrapper object ID"
-                      },
-                      "balance": {
-                        "anyOf": [
-                          {
-                            "type": "number"
-                          },
-                          {
-                            "type": "string"
-                          }
-                        ],
-                        "description": "A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."
-                      },
-                      "payment": {
-                        "type": "string",
-                        "description": "Payment object ID"
-                      },
-                      "type": {
-                        "description": "Type of the received object (or inner coin type); used for token_type detection",
-                        "type": "string"
-                      },
-                      "version": {
-                        "description": "Object version, required to build a Receiving<T> argument for owner_receive",
-                        "type": "string"
-                      },
-                      "digest": {
-                        "description": "Object digest, required to build a Receiving<T> argument for owner_receive",
-                        "type": "string"
-                      }
-                    },
-                    "required": [
-                      "id",
-                      "balance",
-                      "payment"
-                    ],
-                    "additionalProperties": false,
-                    "description": "Received CoinWrapper object record"
-                  },
-                  "description": "Received records of Coin objects"
-                }
-              },
-              "required": [
-                "balance",
-                "token_type",
-                "received"
-              ],
-              "additionalProperties": false,
-              "description": "Received record of Coin objects"
-            }
-          ]
-        },
-        "um": {
-          "description": "Contact object ID or name.",
-          "anyOf": [
-            {
-              "type": "string",
-              "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reentry_kind": {
-          "description": "AP-3 loop-semantics declaration for the publish audit (ctra F-06 root cure): overrides the word-stem loop classifier when the node graph contains a cycle. 'none' = default (word-stem classification) / 'review-loop' = same-order no-charge revisits / 'paid-cycle' = per-revisit fee, fund gate required. MCP-side audit declaration ONLY (pre_publish harness hook) — never sent on-chain; the handler strips it before the SDK call. Mirror of the template frontmatter twin (template-loader).",
-          "type": "string",
-          "enum": [
-            "none",
-            "review-loop",
-            "paid-cycle"
-          ]
-        }
-      },
-      "required": [
-        "object"
-      ],
-      "additionalProperties": false,
-      "description": "On-chain Machine operations. USAGE: (1) CREATE NEW: Set 'object' field with OBJECT format {name, permission, ...} to create a Machine. NOTE: 'name' goes INSIDE 'object', NOT at the data root level. 'permission' can be a new Permission object or reference an existing one - check 'object' field description for details. (2) OPERATE EXISTING: Set 'object' field with STRING format (object ID or name). The 'object' field is CRITICAL and REQUIRED in both cases. STRING for existing, OBJECT for new creation."
-    },
-    "idempotency_key": {
-      "type": "string",
-      "minLength": 8,
-      "maxLength": 128,
-      "pattern": "^[A-Za-z0-9._:-]+$",
-      "description": "F-RQ-13A (prescription ⑨): idempotency key for this business attempt. REPLAY GUARD: if a previous call with the SAME key is still open (dispatched but outcome unresolved, or already committed), this call is HELD — you get a structured state_conflict envelope with the prior attempt's verification data instead of a second on-chain submission (the ghost-order guard: two live mainnet orders, two escrows). Lifecycle: a deterministic failure (nothing submitted / provably reverted) clears the key — fix the cause and retry with the SAME key; an unknown-outcome failure (submission may have landed) keeps the key HELD — verify on-chain state first (result.submission_verification tells you where to look), and only retry with a NEW key once the outcome is resolved. Keep one key per business attempt (e.g. 'ord-20261030-042-buy'); do not reuse across attempts."
-    },
-    "env": {
-      "type": "object",
-      "properties": {
-        "account": {
-          "default": "",
-          "type": "string",
-          "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-        },
-        "permission_guard": {
-          "description": "List of permission guard IDs. Used to extend additional operation permissions (requires verification and configuration in the Permission object).",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "no_cache": {
-          "description": "Whether to disable caching.",
-          "type": "boolean"
-        },
-        "network": {
-          "description": "Omit in chat-client contexts — the runtime stamps the user's CURRENT network (the client's UI selection). Standalone MCP/CLI: omit to use the current network; set ONLY when the user explicitly names a different network (a mismatch pauses for user confirmation). Never guess or hardcode a network.",
-          "type": "string",
-          "enum": [
-            "localnet",
-            "testnet",
-            "mainnet"
-          ]
-        },
-        "referrer": {
-          "description": "Referrer ID. If the user is using the network for the first time, the referrer ID will be recorded (also applied when the SDK auto-registers the sender in the global Entity table).",
-          "type": "string"
-        },
-        "no_auto_register": {
-          "description": "Opt-out of SDK-level Entity auto-registration. By default, a business transaction whose sender has no entry in the global Entity table automatically appends an entity registration: the sender gets registered and receives an owned Resource object (their on-chain mark book) in the wallet. Set true ONLY when the user explicitly cancelled their entity registration or demands that the transaction not touch the Entity table.",
-          "type": "boolean"
-        },
-        "confirmed": {
-          "description": "Phase 2 ConfirmGate: set to true to proceed after a 'pending_confirmation' result. The operation is NOT executed until you re-call with confirmed=true after user consent.",
-          "type": "boolean"
-        },
-        "user_intent_phrases": {
-          "description": "Phase 2 ConfirmGate: explicit user intent phrases collected from conversation context (e.g. 'use default account', 'force publish'). Used to bypass confirmation rules whose bypass_on_explicit_intent matches.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "plan_approval": {
-          "description": "K3 24 PlanApproval: id of a goal whose plan was approved via goal_operation action='approve'. When set: 1) the ConfirmGate treats fail-open rules (standard/none levels) as pre-approved for operations under this goal's plan; 2) after successful CREATION operations, the created objects are auto-registered into the goal (GoalRecord.objects + its TaskProcess manifest — ACT station 'execution registers'). Fail-closed levels (irreversible/publish/amount) still require per-operation confirmation with env.confirmed=true.",
-          "type": "string"
-        },
-        "client_schema_version": {
-          "description": "Client-side schema version (semver, e.g. '1.0.0'). When provided, the server checks compatibility and attaches warnings if mismatched.",
-          "type": "string"
-        },
-        "schema_strict_mode": {
-          "default": false,
-          "description": "When true, schema incompatibility returns an error instead of a warning. Default: false (warn mode).",
-          "type": "boolean"
-        },
-        "dry_run": {
-          "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
-          "type": "boolean"
-        },
-        "window_profile": {
-          "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
-          "type": "string",
-          "enum": [
-            "production",
-            "test"
-          ]
-        },
-        "response_level": {
-          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
-          "type": "string",
-          "enum": [
-            "compact",
-            "full"
-          ]
-        },
-        "confirm_mode": {
-          "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
-          "type": "string",
-          "enum": [
-            "full",
-            "streamlined",
-            "quiet"
-          ]
-        }
-      },
-      "required": [
-        "account",
-        "schema_strict_mode"
-      ],
-      "additionalProperties": false,
-      "description": "IMPORTANT: Execution environment includes: account for signing operations, network selection (testnet | localnet | mainnet), additional Guard permissions, and more. Used to specify context information during the call. If account is not specified, the default account (\"\") will be used. NOTE: by default the SDK auto-registers the sender in the global Entity table when absent (first business transaction; the account receives an owned Resource object). Set no_auto_register=true only on explicit user request."
-    },
-    "submission": {
-      "type": "object",
-      "properties": {
-        "type": {
-          "type": "string",
-          "const": "submission",
-          "description": "Discriminator for this result variant. Constraint: always 'submission'. Example: 'submission'"
-        },
-        "guard": {
-          "maxItems": 20,
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "object": {
-                "type": "string",
-                "description": "Guard object name or ID to verify against. Example: 'my-delivery-guard' or '0x123...'"
-              },
-              "impack": {
-                "type": "boolean",
-                "description": "Whether this Guard's verification result participates in the final logic. Constraint: if false, the Guard is checked but does not block the operation. Example: true"
-              }
-            },
-            "required": [
-              "object",
-              "impack"
-            ],
-            "additionalProperties": false
-          },
-          "description": "Array of Guard objects to verify. Constraint: at most 20 entries (MAX_GUARD_COUNT_PASSPORT). Relation: each entry corresponds to a Guard bound to the operation."
-        },
-        "submission": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "guard": {
-                "type": "string",
-                "description": "Guard object name or ID that requires submission data. Example: 'my-delivery-guard'"
-              },
-              "submission": {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "identifier": {
-                      "type": "integer",
-                      "minimum": 0,
-                      "maximum": 255,
-                      "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                    },
-                    "b_submission": {
-                      "type": "boolean",
-                      "description": "Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."
-                    },
-                    "value_type": {
-                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.",
-                      "anyOf": [
-                        {
-                          "type": "number",
-                          "const": 0,
-                          "description": "Bool (0)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 1,
-                          "description": "Address (1)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 2,
-                          "description": "String (2)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 3,
-                          "description": "U8 (3)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 4,
-                          "description": "U16 (4)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 5,
-                          "description": "U32 (5)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 6,
-                          "description": "U64 (6)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 7,
-                          "description": "U128 (7)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 8,
-                          "description": "U256 (8)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 9,
-                          "description": "VecBool (9)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 10,
-                          "description": "VecAddress (10)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 11,
-                          "description": "VecString (11)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 12,
-                          "description": "VecU8 (12)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 13,
-                          "description": "VecU16 (13)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 14,
-                          "description": "VecU32 (14)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 15,
-                          "description": "VecU64 (15)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 16,
-                          "description": "VecU128 (16)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 17,
-                          "description": "VecU256 (17)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 18,
-                          "description": "VecVecU8 (18)"
-                        },
-                        {
-                          "type": "string",
-                          "const": "Bool",
-                          "description": "Bool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "Address",
-                          "description": "Address"
-                        },
-                        {
-                          "type": "string",
-                          "const": "String",
-                          "description": "String"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U8",
-                          "description": "U8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U16",
-                          "description": "U16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U32",
-                          "description": "U32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U64",
-                          "description": "U64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U128",
-                          "description": "U128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U256",
-                          "description": "U256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecBool",
-                          "description": "VecBool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecAddress",
-                          "description": "VecAddress"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecString",
-                          "description": "VecString"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU8",
-                          "description": "VecU8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU16",
-                          "description": "VecU16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU32",
-                          "description": "VecU32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU64",
-                          "description": "VecU64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU128",
-                          "description": "VecU128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU256",
-                          "description": "VecU256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecVecU8",
-                          "description": "VecVecU8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "bool",
-                          "description": "bool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "address",
-                          "description": "address"
-                        },
-                        {
-                          "type": "string",
-                          "const": "string",
-                          "description": "string"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u8",
-                          "description": "u8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u16",
-                          "description": "u16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u32",
-                          "description": "u32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u64",
-                          "description": "u64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u128",
-                          "description": "u128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u256",
-                          "description": "u256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecbool",
-                          "description": "vecbool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecaddress",
-                          "description": "vecaddress"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecstring",
-                          "description": "vecstring"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu8",
-                          "description": "vecu8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu16",
-                          "description": "vecu16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu32",
-                          "description": "vecu32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu64",
-                          "description": "vecu64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu128",
-                          "description": "vecu128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu256",
-                          "description": "vecu256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecvecu8",
-                          "description": "vecvecu8"
-                        }
-                      ]
-                    },
-                    "value": {
-                      "description": "The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
-                      "anyOf": [
-                        {
-                          "type": "boolean"
-                        },
-                        {
-                          "anyOf": [
-                            {
-                              "type": "object",
-                              "properties": {
-                                "name_or_address": {
-                                  "type": "string",
-                                  "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                                },
-                                "local_mark_first": {
-                                  "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                                  "type": "boolean"
-                                }
-                              },
-                              "additionalProperties": false,
-                              "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                            },
-                            {
-                              "type": "string"
-                            }
-                          ]
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "boolean"
-                          }
-                        },
-                        {
-                          "anyOf": [
-                            {
-                              "type": "object",
-                              "properties": {
-                                "entities": {
-                                  "minItems": 1,
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "name_or_address": {
-                                        "type": "string",
-                                        "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                                      },
-                                      "local_mark_first": {
-                                        "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                                        "type": "boolean"
-                                      }
-                                    },
-                                    "additionalProperties": false,
-                                    "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                                  }
-                                },
-                                "check_all_founded": {
-                                  "default": true,
-                                  "description": "Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)",
-                                  "type": "boolean"
-                                }
-                              },
-                              "required": [
-                                "entities",
-                                "check_all_founded"
-                              ],
-                              "additionalProperties": false,
-                              "description": "Used to batch find account or object IDs by name"
-                            },
-                            {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              }
-                            }
-                          ]
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          }
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "number"
-                          }
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
-                              "type": "number"
-                            }
-                          }
-                        }
-                      ]
-                    },
-                    "name": {
-                      "default": "",
-                      "description": "Data name identifier. MAX 64 BCS characters (Chinese chars count as 3-4 BCS bytes each). Use short identifiers like 'order_id', 'delivery_node'. Put longer descriptions in the Guard's 'description' field, NOT here.",
-                      "type": "string"
-                    },
-                    "object_type": {
-                      "description": "OUTPUT-ONLY (query side): Object type when value_type is Address and represents a specific object. Auto-derived by the system — DO NOT set this field at Guard creation.",
-                      "type": "string",
-                      "enum": [
-                        "Permission",
-                        "Repository",
-                        "Arb",
-                        "Arbitration",
-                        "Service",
-                        "Machine",
-                        "Order",
-                        "Progress",
-                        "Payment",
-                        "Treasury",
-                        "Guard",
-                        "Demand",
-                        "Passport",
-                        "Allocation",
-                        "Resource",
-                        "Reward",
-                        "Discount",
-                        "EntityRegistrar",
-                        "EntityLinker",
-                        "Proof",
-                        "WReceivedObject",
-                        "Contact",
-                        "TableItem_ProgressHistory",
-                        "TableItem_PermissionPerm",
-                        "TableItem_DemandPresenter",
-                        "TableItem_MachineNode",
-                        "TableItem_TreasuryHistory",
-                        "TableItem_RepositoryData",
-                        "TableItem_RewardRecord",
-                        "TableItem_EntityLinker",
-                        "TableItem_AddressMark",
-                        "TableItem_EntityRegistrar"
-                      ]
-                    }
-                  },
-                  "required": [
-                    "identifier",
-                    "b_submission",
-                    "value_type",
-                    "name"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"
-                },
-                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."
-              }
-            },
-            "required": [
-              "guard",
-              "submission"
-            ],
-            "additionalProperties": false,
-            "description": "One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."
-          },
-          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
-        }
-      },
-      "required": [
-        "type",
-        "guard",
-        "submission"
-      ],
-      "additionalProperties": false,
-      "description": "Guard verification required. The operation was blocked because one or more Guards require user-submitted data. Fill the submission array and resubmit. Semantic status is 'pending_input'."
-    }
-  },
-  "required": [
-    "operation_type",
-    "data"
-  ],
-  "additionalProperties": false
-}
+{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://wowok.net/schemas/onchain_operations_machine.json","title":"Machine Operation","description":"⚙️ Machine Object: Design and deploy automated workflow templates (Machines) that define how services are delivered, etc..","type":"object","properties":{"operation_type":{"type":"string","const":"machine"},"data":{"type":"object","properties":{"object":{"anyOf":[{"type":"string","description":"String format: Reference an EXISTING object by its name (local mark) or on-chain object ID. Use when the Permission object already exists."},{"type":"object","properties":{"name":{"description":"The name of the object","type":"string"},"tags":{"description":"The tags of the object","type":"array","items":{"type":"string"}},"onChain":{"description":"CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.","type":"boolean"},"replaceExistName":{"description":"FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).","type":"boolean"},"permission":{"anyOf":[{"type":"string","description":"String format: Reference an EXISTING object by its name (local mark) or on-chain object ID. Example: 'my-object' or '0x1234...'"},{"type":"object","properties":{"name":{"description":"The name of the object","type":"string"},"tags":{"description":"The tags of the object","type":"array","items":{"type":"string"}},"onChain":{"description":"CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.","type":"boolean"},"replaceExistName":{"description":"FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).","type":"boolean"},"description":{"description":"The description of the object","type":"string"}},"additionalProperties":false,"description":"Object format: CREATE a NEW object with name, optional description, and visibility settings. Extends NamedObjectSchema with an additional 'description' field for detailed object information."}],"description":"Two ways to specify an object: (1) STRING - Reference an EXISTING object by name or ID; (2) OBJECT - CREATE a NEW object with full configuration including optional name, tags, description, and visibility settings (local private by default, or public on-chain with onChain:true)."}},"additionalProperties":false,"description":"Object format: CREATE a NEW object with Permission-based access control. Includes optional name, tags, visibility settings, AND a Permission object (which itself can be referenced by string or created as a new object). Use this to create objects with managed access permissions."}],"description":"Two ways to specify a Permission-managed object: (1) STRING - Reference an EXISTING Permission object by name or ID; (2) OBJECT - CREATE a NEW object with Permission access control, where the Permission can also be either referenced (string) or newly created (object). This is used when you need permission management but don't need to specify a token type."},"progress_new":{"description":"Generate new Progress object.","type":"object","properties":{"task":{"description":"Task bound to the Progress object. It is an object ID or name","anyOf":[{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},{"type":"null"}]},"repository":{"description":"Set repository list for the Progress object. Used for consensus data management.","anyOf":[{"type":"object","properties":{"op":{"anyOf":[{"type":"string","const":"add"},{"type":"string","const":"set"}]},"objects":{"type":"array","items":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"description":"List of object IDs or names to add or set"}},"required":["op","objects"],"additionalProperties":false},{"type":"object","properties":{"op":{"type":"string","const":"remove"},"objects":{"type":"array","items":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"description":"List of object IDs or names to remove"}},"required":["op","objects"],"additionalProperties":false},{"type":"object","properties":{"op":{"type":"string","const":"clear"}},"required":["op"],"additionalProperties":false}]},"progress_namedOperator":{"description":"Add, set, and remove operators for the permission namespace of the Progress object.","type":"object","properties":{"op":{"anyOf":[{"type":"string","const":"add"},{"type":"string","const":"set"},{"type":"string","const":"remove"}]},"name":{"type":"string","minLength":1},"operators":{"anyOf":[{"description":"Array of account names, addresses, or mark names. Local marks are searched first for each entry. EXAMPLE: ['alice', '0x2...', 'bob']"},{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"}],"description":"Batch account or address lookup. Can be an array of strings (recommended for AI) or full object with explicit control. Array form auto-converts to { entities: [...], check_all_founded: true }. Empty arrays and {} elements are REJECTED (no-op transaction guard)."}},"required":["op","name","operators"],"additionalProperties":false},"namedNew":{"type":"object","properties":{"name":{"description":"The name of the object","type":"string"},"tags":{"description":"The tags of the object","type":"array","items":{"type":"string"}},"onChain":{"description":"CRITICAL: Whether to sync the name to the blockchain. DEFAULT (undefined/false): The name is stored LOCALLY ONLY on your device (PRIVATE). If set to true: The name is published ON-CHAIN and becomes PUBLICLY VISIBLE to everyone. Only set to true for displaying the relationships you are willing to make public on the chain.","type":"boolean"},"replaceExistName":{"description":"FORCE CLAIM: Set to true ONLY when the user explicitly expresses a STRONG INTENTION to forcefully take over an existing name (e.g., 'I must use this name', 'force rename', 'replace the existing one'). WARNING: This will UNBIND the name from its original object and rebind it to the new one, potentially breaking existing references. If not specified or false: the operation will FAIL with an error when the name is already in use (safe default behavior).","type":"boolean"}},"additionalProperties":false,"description":"Assign a name and optional tags to a new object. By default, names are stored LOCALLY (private) on your device. Set 'onChain: true' to create a PUBLIC on-chain identity visible to everyone. IMPORTANT: If the requested name is already taken, the operation will FAIL by default. Only set 'replaceExistName: true' when the user EXPLICITLY demands to forcefully claim the name."}},"additionalProperties":false},"description":{"description":"Description of the object.","type":"string"},"repository":{"description":"Set repository list for the object. Used for consensus data management.","anyOf":[{"type":"object","properties":{"op":{"anyOf":[{"type":"string","const":"add"},{"type":"string","const":"set"}]},"objects":{"type":"array","items":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"description":"List of object IDs or names to add or set"}},"required":["op","objects"],"additionalProperties":false},{"type":"object","properties":{"op":{"type":"string","const":"remove"},"objects":{"type":"array","items":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"description":"List of object IDs or names to remove"}},"required":["op","objects"],"additionalProperties":false},{"type":"object","properties":{"op":{"type":"string","const":"clear"}},"required":["op"],"additionalProperties":false}]},"node":{"description":"CRITICAL: Choose ONE of two mutually exclusive modes:\n\n**Mode 1: NodeSchema (incremental operations)**\nUse for partial modifications: add, set, remove, clear, exchange, rename, remove prior node, add forward, remove forward.\nFormat: { \"op\": \"add\", \"nodes\": [...], \"bReplace\": false }\nThis mode modifies existing nodes incrementally.\n\n**Mode 2: NodeJsonOrMarkdownFileSchema (complete replacement)**\nUse for complete node redefinition from file.\nFormat: { \"json_or_markdown_file\": \"/path/to/nodes.json\" }\nIMPORTANT: This COMPLETELY REPLACES all existing nodes. File must contain node array [{...}, {...}], NOT an operation object with \"op\" field.\nSupported formats: JSON array or Markdown with code blocks.\nIf parsing fails, error includes line number and column information.","anyOf":[{"oneOf":[{"type":"object","properties":{"op":{"type":"string","const":"add"},"nodes":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Node name. ⚠️ T1 LOSSY POINT (B-1): do NOT name a node 'refund'/'refunded'/'deposit_refunded'/'deposit_deducted'/'disputed'/'cancelled' to model fund return or dispute — funds MUST move through the Allocation waterfall (order_allocators), NOT through Machine terminal nodes (R-M1-11). A node named 'refund' is a semantic lie: reaching it does not move funds by itself. Model refund as a refund-to-Order Allocator slot (a { Signer } or Order-owner recipient), and model dispute as the bound Arbitration, not a Machine node."},"role":{"description":"OPTIONAL business role tag for display layers and template reuse (E-9). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain; the MCP echoes it back as a NODE ROLES constraint warning and seed templates annotate it. Semantics: draft = pre-start cancellable, active = work in progress, delivered = work submitted awaiting acceptance, final = settlement endpoint, cancelled = refund endpoint. ⚠️ Advancing to ANY node never moves funds by itself: settlement/refund requires an explicit allocation call (alloc by guard) AFTER the terminal node is reached. Nothing auto-settles on-chain — plan the settlement trigger (merchant, keeper, or buyer action) explicitly in the template.","type":"string","enum":["draft","active","delivered","final","cancelled"]},"pairs":{"type":"array","items":{"type":"object","properties":{"prev_node":{"type":"string","description":"Previous node name. Empty string '' means initial entry node (the first node in the workflow)."},"threshold":{"default":0,"description":"Threshold to trigger node advancement. If total Forward weight is greater than or equal to threshold, node advancement is triggered. ⚠️ SINGLE-OPERATOR LOCK: each forward contributes its weight AT MOST ONCE (locked by its first operator; re-execution by others aborts E_NOT_THE_HOLDER). The maximum achievable weight of this Pair is the sum of its DISTINCT forward weights — if that sum < threshold the transition can NEVER migrate. Multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1), never one forward reused by several people.","anyOf":[{"type":"number"},{"type":"string"}]},"forwards":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Forward name"},"namedOperator":{"description":"Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.","anyOf":[{"type":"string"},{"type":"null"}]},"permissionIndex":{"description":"Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).","anyOf":[{"type":"number"},{"type":"string"},{"type":"null"}]},"weight":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."},"guard":{"description":"Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).","anyOf":[{"anyOf":[{"type":"object","properties":{"guard":{"type":"string","description":"Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"},"retained_submission":{"description":"Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"number"},{"type":"string"}]}},{"type":"null"}]}},"required":["guard"],"additionalProperties":false,"description":"OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."},{"type":"string","description":"STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."}]},{"type":"null"}]}},"required":["name","weight"],"additionalProperties":false,"description":"Forward in Machine object"},"description":"Forward list — operations to ENTER THIS NODE from prev_node. SEMANTIC CLARIFICATION: forwards describe INCOMING transitions (how to ARRIVE at this node), NOT outgoing transitions. Think of each forward as an 'entry door' to this node. Example: pair {prev_node:'A', forwards:[{name:'Go'}]} means 'use Go to advance FROM A TO THIS NODE'. For initial node (prev_node=''), forwards are operations to enter this node from the start state. DIAGRAM: A --[Go]--> B means the pair belongs to node B (destination), with prev_node='A'. WARNING: forwards belong to the DESTINATION node's pair, NOT the source node. Placing a forward on the wrong pair will cause Progress to get stuck."}},"required":["prev_node","threshold","forwards"],"additionalProperties":false,"description":"Node pair in Machine object"},"description":"Node pair list"},"optional":{"description":"OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).","type":"boolean"}},"required":["name","pairs"],"additionalProperties":false,"description":"Node in Machine object"},"description":"List of nodes to add (or replace in place when bReplace=true)."},"bReplace":{"description":"Whether to replace existing nodes. If true, existing nodes will be replaced; if false, nodes will be added by merging. This is the ONLY supported way to rewrite nodes on an EXISTING Machine.","type":"boolean"}},"required":["op","nodes"],"additionalProperties":false,"description":"Add nodes."},{"type":"object","properties":{"op":{"type":"string","const":"set"},"nodes":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Node name. ⚠️ T1 LOSSY POINT (B-1): do NOT name a node 'refund'/'refunded'/'deposit_refunded'/'deposit_deducted'/'disputed'/'cancelled' to model fund return or dispute — funds MUST move through the Allocation waterfall (order_allocators), NOT through Machine terminal nodes (R-M1-11). A node named 'refund' is a semantic lie: reaching it does not move funds by itself. Model refund as a refund-to-Order Allocator slot (a { Signer } or Order-owner recipient), and model dispute as the bound Arbitration, not a Machine node."},"role":{"description":"OPTIONAL business role tag for display layers and template reuse (E-9). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain; the MCP echoes it back as a NODE ROLES constraint warning and seed templates annotate it. Semantics: draft = pre-start cancellable, active = work in progress, delivered = work submitted awaiting acceptance, final = settlement endpoint, cancelled = refund endpoint. ⚠️ Advancing to ANY node never moves funds by itself: settlement/refund requires an explicit allocation call (alloc by guard) AFTER the terminal node is reached. Nothing auto-settles on-chain — plan the settlement trigger (merchant, keeper, or buyer action) explicitly in the template.","type":"string","enum":["draft","active","delivered","final","cancelled"]},"pairs":{"type":"array","items":{"type":"object","properties":{"prev_node":{"type":"string","description":"Previous node name. Empty string '' means initial entry node (the first node in the workflow)."},"threshold":{"default":0,"description":"Threshold to trigger node advancement. If total Forward weight is greater than or equal to threshold, node advancement is triggered. ⚠️ SINGLE-OPERATOR LOCK: each forward contributes its weight AT MOST ONCE (locked by its first operator; re-execution by others aborts E_NOT_THE_HOLDER). The maximum achievable weight of this Pair is the sum of its DISTINCT forward weights — if that sum < threshold the transition can NEVER migrate. Multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1), never one forward reused by several people.","anyOf":[{"type":"number"},{"type":"string"}]},"forwards":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Forward name"},"namedOperator":{"description":"Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.","anyOf":[{"type":"string"},{"type":"null"}]},"permissionIndex":{"description":"Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).","anyOf":[{"type":"number"},{"type":"string"},{"type":"null"}]},"weight":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."},"guard":{"description":"Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).","anyOf":[{"anyOf":[{"type":"object","properties":{"guard":{"type":"string","description":"Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"},"retained_submission":{"description":"Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"number"},{"type":"string"}]}},{"type":"null"}]}},"required":["guard"],"additionalProperties":false,"description":"OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."},{"type":"string","description":"STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."}]},{"type":"null"}]}},"required":["name","weight"],"additionalProperties":false,"description":"Forward in Machine object"},"description":"Forward list — operations to ENTER THIS NODE from prev_node. SEMANTIC CLARIFICATION: forwards describe INCOMING transitions (how to ARRIVE at this node), NOT outgoing transitions. Think of each forward as an 'entry door' to this node. Example: pair {prev_node:'A', forwards:[{name:'Go'}]} means 'use Go to advance FROM A TO THIS NODE'. For initial node (prev_node=''), forwards are operations to enter this node from the start state. DIAGRAM: A --[Go]--> B means the pair belongs to node B (destination), with prev_node='A'. WARNING: forwards belong to the DESTINATION node's pair, NOT the source node. Placing a forward on the wrong pair will cause Progress to get stuck."}},"required":["prev_node","threshold","forwards"],"additionalProperties":false,"description":"Node pair in Machine object"},"description":"Node pair list"},"optional":{"description":"OPTIONAL pure-side-action leaf marker (v32): order completion NEVER routes through this node and it must never gate money (e.g. a review node the buyer may skip entirely). SESSION METADATA ONLY — the on-chain node struct carries name+pairs, so this is NOT stored on-chain. Composition audits exempt an optional leaf from the FUND-EXIT-01 terminal fund-reachability search: a review leaf with no allocator is by design, not a stranded-funds bug (upw F-06, 6939_upwork-261016).","type":"boolean"}},"required":["name","pairs"],"additionalProperties":false,"description":"Node in Machine object"},"description":"List of nodes for a freshly CREATED Machine. xk9 F-02: REFUSED on an existing Machine — op set implies a clear-and-rewrite of the on-chain node table that permanently corrupts it (E_EMPTY_MACHINE on every later publish, no repair). To rewrite an existing Machine use op:add with bReplace:true."},"bReplace":{"description":"Whether to replace existing nodes. If true, existing nodes will be replaced; if false, nodes will be added by merging.","type":"boolean"}},"required":["op","nodes"],"additionalProperties":false,"description":"Set nodes (CREATE-ONLY — refused on an existing Machine; use add+bReplace there)."},{"type":"object","properties":{"op":{"type":"string","const":"remove"},"nodes":{"type":"array","items":{"type":"string"},"description":"List of node names to delete."}},"required":["op","nodes"],"additionalProperties":false,"description":"Delete nodes."},{"type":"object","properties":{"op":{"type":"string","const":"clear"}},"required":["op"],"additionalProperties":false,"description":"Clear all nodes."},{"type":"object","properties":{"op":{"type":"string","const":"exchange"},"node_one":{"type":"string","description":"Name of the first node."},"node_other":{"type":"string","description":"Name of the second node."}},"required":["op","node_one","node_other"],"additionalProperties":false,"description":"Exchange the positions of two nodes."},{"type":"object","properties":{"op":{"type":"string","const":"rename"},"node_name_old":{"type":"string","description":"Name of thenode."},"node_name_new":{"type":"string","description":"New name of the node."}},"required":["op","node_name_old","node_name_new"],"additionalProperties":false,"description":"Rename node."},{"type":"object","properties":{"op":{"type":"string","const":"remove prior node"},"pairs":{"type":"array","items":{"type":"object","properties":{"prior_node_name":{"type":"array","items":{"type":"string"},"description":"List of previous node names to delete."},"node_name":{"type":"string","description":"Name of the next node."}},"required":["prior_node_name","node_name"],"additionalProperties":false},"description":"List of previous-next node pairs to delete."}},"required":["op","pairs"],"additionalProperties":false,"description":"Delete previous-next node pairs."},{"type":"object","properties":{"op":{"type":"string","const":"add forward"},"data":{"type":"array","items":{"type":"object","properties":{"prior_node_name":{"type":"string","description":"Name of the previous node."},"node_name":{"type":"string","description":"Name of the next node."},"forward":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Forward name"},"namedOperator":{"description":"Forward operation permission 1: Namespace (one of the two must be specified); recommended if Progress object operators are different (e.g., different delivery personnel for different orders). SPECIAL CASE: an EMPTY string ('') on an order-bound forward resolves to the ORDER PAYER — the buyer of the order can advance it (progress::IsNamedOperator treats an empty name + order as the order's own operator). Use '' for buyer-side actions (delivery confirmation, review, return request, pre-ship cancel) instead of binding a merchant-only permission index, which aborts E_PERMISSION_DENIED for the buyer.","anyOf":[{"type":"string"},{"type":"null"}]},"permissionIndex":{"description":"Forward operation permission 2: Permission index (one of the two must be specified); recommended if all Progress object operators are the same (e.g., same reward reviewers for all orders). RANGE: use a USER_DEFINED index ≥1000 (0–999 are builtin/reserved) — a USER_DEFINED index works for the Permission's admin immediately without any grant; a builtin index (<1000) is ALSO admin-usable immediately (the Permission's owner/admin short-circuits every builtin index check — the chain's admin-passthrough rule) and only NON-ADMIN operators must be granted it first (cour I4: pre-grant the state is 'admin-only', never 'unusable' — a non-admin caller without the grant aborts MoveAbort 7).","anyOf":[{"type":"number"},{"type":"string"},{"type":"null"}]},"weight":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"Forward weight — the contribution this forward makes toward its Pair's threshold. ⚠️ SINGLE-OPERATOR LOCK: a forward contributes its weight AT MOST ONCE. It is locked by the first operator that accomplishes it; a second operator re-executing the same accomplished forward aborts E_NOT_THE_HOLDER. Therefore multi-operator cooperation (threshold > 1) needs one DISTINCT forward per contributing operator (e.g. threshold 2 → begin_a + begin_b, each weight 1) — never reuse one forward."},"guard":{"description":"Guard reference for this forward. Accepts TWO formats:\n• STRING (preferred): \"my_guard_name\" — the Guard's name or address as a plain string.\n• OBJECT (only when retained_submission is needed): {guard: \"my_guard_name\", retained_submission: [1,2,3]}.\nFOLLOW THE SCHEMA FIELD STRUCTURE: A Guard reference is fundamentally a STRING (the Guard object's name or address). Provide a string when you only need to reference a Guard — do NOT wrap a bare string in an object structure. The OBJECT form {guard: \"...\", retained_submission: [...]} exists ONLY to carry additional `retained_submission` data alongside the string reference; inside the object, the `guard` field is STILL a string. In short: string-in for a string reference, object-in only when you need to pass extra data.\nCOGNITIVE PRINCIPLE: Guard validation ALWAYS occurs BEFORE the forward operation. A Guard that queries state of the SAME Progress object this forward operates on (e.g. progress.current) will see the PRE-transition value (source node), NOT the target node. If the Guard checks progress.current == target_node, it will ALWAYS FAIL. Querying a DIFFERENT Progress object (cross-machine) is safe and reasonable — that progress is not modified by this forward. For target-node verification after transition, bind the Guard to the Allocator instead (allocation.alloc runs AFTER the state transition completes).\n⚠️ T1 LOSSY POINT (B-3): WoWok has NO on-chain cron. A business phrase like 'after N days, auto-X' is NOT an automatic trigger — it decomposes into (1) a time_guard that checks elapsed time, and (2) an OFF-CHAIN keeper that must submit the forward when the guard passes. Configuring a time_guard WITHOUT a keeper means nothing ever fires.\nRETAINED_SUBMISSION: a non-empty retained_submission does NOT relax Guard verification — the forward's Guard is always validated first. The list only selects which of the caller's already-verified submissions are persisted into the Progress history (see the guard field above).","anyOf":[{"anyOf":[{"type":"object","properties":{"guard":{"type":"string","description":"Guard object name or address (string). Example: 'my_attendance_guard' or '0x1234...'"},"retained_submission":{"description":"Guard table identifiers whose verified values are persisted into the Progress history when the forward is accomplished. The Guard is ALWAYS fully verified first (regardless of this list): the forward cannot complete unless the Passport carries a passing result for it. After verification, exactly the caller's submissions for the listed identifiers are copied into history (from the passport's submission records) as Guard-verified facts; empty array (default) records nothing. Use it for audit and downstream queries, never as a way to relax Guard conditions.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"number"},{"type":"string"}]}},{"type":"null"}]}},"required":["guard"],"additionalProperties":false,"description":"OBJECT form: {guard: '<guard_name_or_address>', retained_submission?: number[]}. Use this form when you need to pass retained_submission data alongside the Guard reference."},{"type":"string","description":"STRING form (shorthand): the Guard object's name or address as a plain string. Auto-wrapped to {guard: <string>} at runtime. Use this when you only need to reference a Guard without retained_submission."}]},{"type":"null"}]}},"required":["name","weight"],"additionalProperties":false,"description":"Forward in Machine object"},"description":"List of operations between the previous and next nodes."},"threshold":{"description":"Threshold of operations that need to be completed to migrate from the previous node to the next node.","anyOf":[{"type":"integer","minimum":0,"maximum":9007199254740991},{"type":"null"}]}},"required":["prior_node_name","node_name","forward"],"additionalProperties":false},"description":"List of operations to add."}},"required":["op","data"],"additionalProperties":false,"description":"Add operations."},{"type":"object","properties":{"op":{"type":"string","const":"remove forward"},"data":{"type":"array","items":{"type":"object","properties":{"prior_node_name":{"type":"string","description":"Name of the previous node."},"node_name":{"type":"string","description":"Name of the next node."},"forward_name":{"type":"array","items":{"type":"string"},"description":"List of operation names to delete."}},"required":["prior_node_name","node_name","forward_name"],"additionalProperties":false},"description":"List of operations to delete."}},"required":["op","data"],"additionalProperties":false,"description":"Delete operations."}]},{"type":"object","properties":{"json_or_markdown_file":{"type":"string","description":"Path to a JSON or Markdown file containing node array for COMPLETE REPLACEMENT of all nodes.\n\n**File Format Requirements:**\n- Must contain a JSON ARRAY of node objects: [{\"name\": \"...\", \"pairs\": [...]}, {...}]\n- NOT an operation object with \"op\" field (use NodeSchema for operations)\n- Supports JSON or Markdown (with ```json code blocks)\n\n**Node Structure:**\nEach node is a directed graph element representing a workflow STATE that an order\ncan rest in. Its Pairs are the INCOMING edges — this is the one convention the\nchain enforces, and getting it backwards silently builds a wrong graph:\n- name: Node identifier — the DESTINATION of every pair it owns\n- role: (optional) business role tag for display layers — one of draft/active/delivered/final/cancelled. SESSION METADATA ONLY (not stored on-chain; echoed back as a NODE ROLES warning)\n- pairs: Array of {prev_node, forwards, threshold} — edges ENTERING this node. The key is `prev_node`; `prior_node` is not recognized and is silently dropped.\n- forwards: Operations that advance INTO this node FROM its prev_node (NOT operations available from this node)\n- threshold: Weight required to migrate into this node along that pair\n\nDiagram `A --[Go]--> B` therefore lives in node **B**: {name:\"B\", pairs:[{prev_node:\"A\", forwards:[{name:\"Go\", weight:1}]}]}.\n\n**Forward names must determine the destination.** `next_node` is a CALLER argument\nand the chain resolves (current, next_node, forward) inside the\ndestination node, so one forward name shared by two destinations\nfrom the same prev_node is legal and lets the caller pick the outcome — including\nwhether a refund Allocator ever fires. Give each destination its own forward name.\n\n**Behavior:**\n- COMPLETELY REPLACES all existing nodes (equivalent to \"set\" with bReplace=true)\n- Auto-detects format based on file content\n- If parsing fails, error includes line number and column information"}},"required":["json_or_markdown_file"],"additionalProperties":false}]},"pause":{"description":"Whether to pause generating new Progress objects. Chain truth (the progress-generation entry asserts !bPaused): the pause gates NEW order entry only — in-flight Progress keeps advancing and settling (yfd-ln F-13 misread this as a freeze switch; it never was one).","type":"boolean"},"publish":{"description":"Whether to publish the object. After the object is published, new Progress objects can be generated; and node settings will no longer be changeable. ⚠️ PUBLISH IS A ONE-WAY DOOR AND THE CHAIN VALIDATES THE WHOLE GRAPH AT THAT MOMENT: the on-chain publish gate rejects a Machine that is empty, has no entry edge (no pair with prev_node:\"\"), has an entry pair with no forward, references a prev_node that is not a node of this Machine, carries a forward with neither namedOperator nor permissionIndex (a guard is NOT an identity), or has a pair whose threshold exceeds the sum of its forward weights (each forward counts at most once). These aborts (machine:17-22) fire BEFORE the publish lands, so the graph is still editable — but after it succeeds, nodes/forwards, Guard bindings and Service.machine are frozen forever, and a broken graph would only surface at the first transition with no repair path. Send the nodes in the SAME call as publish:true (bReplace:true or op:\"set\") so the complete graph is validated together. ⚠️ Before publishing, enumerate the graph STOP NODES (nodes with no outgoing Pair) plus every waiting state (review window, handover, open dispute) and verify each has a defined fund exit in the Service order_allocators — withdrawal (release) AND refund. Machine + Allocator are immutable after publish (IMMUT-001); an uncovered stop node strands funds permanently (rule R-M5-03, checklist pattern.fund_flow_stop_node_coverage). ⚠️ REBUILD COST DISCLOSURE (S12-②, ksk4 F-01): every business constant you bake into this graph (campaign deadline, goal, windows, schedules) becomes immutable WITH the machine. Changing even ONE constant after publish requires: new guard → clone the whole node graph into a NEW machine → publish → a NEW Service → re-hang every repository/reward/arbitration/allocator/WIP → republish (≈5 txs / ~1 min measured on a 16-node graph), and in-flight orders stay pointed at the OLD machine forever. THIS OPERATION WILL REQUIRE A NEW SERVICE if any baked-in parameter later changes — finalize mutable business parameters BEFORE publishing (Campaign-structure change is protocol-train scoped; the MCP face cannot patch a published machine).","type":"boolean"},"owner_receive":{"description":"Unwrap CoinWrapper objects and other objects received by this Machine object and send them to the owner of its Permission object.\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.","anyOf":[{"type":"string","const":"recently"},{"type":"string","pattern":"^0x[0-9a-fA-F]{8,}$"},{"minItems":1,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1,"description":"Received object ID"},"type":{"type":"string","minLength":1,"description":"Object type"},"content_raw":{"description":"Raw content data"},"version":{"description":"Object version, required to build a Receiving<T> argument for owner_receive","type":"string"},"digest":{"description":"Object digest, required to build a Receiving<T> argument for owner_receive","type":"string"}},"required":["id","type"],"additionalProperties":false,"description":"Received normal object record"}},{"type":"object","properties":{"balance":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."},"token_type":{"type":"string","description":"Asset type of Coin objects. Supports CoinWrapper<...> format for order receive operations."},"received":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Received CoinWrapper object ID"},"balance":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."},"payment":{"type":"string","description":"Payment object ID"},"type":{"description":"Type of the received object (or inner coin type); used for token_type detection","type":"string"},"version":{"description":"Object version, required to build a Receiving<T> argument for owner_receive","type":"string"},"digest":{"description":"Object digest, required to build a Receiving<T> argument for owner_receive","type":"string"}},"required":["id","balance","payment"],"additionalProperties":false,"description":"Received CoinWrapper object record"},"description":"Received records of Coin objects"}},"required":["balance","token_type","received"],"additionalProperties":false,"description":"Received record of Coin objects"}]},"um":{"description":"Contact object ID or name.","anyOf":[{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},{"type":"null"}]},"reentry_kind":{"description":"AP-3 loop-semantics declaration for the publish audit (ctra F-06 root cure): overrides the word-stem loop classifier when the node graph contains a cycle. 'none' = default (word-stem classification) / 'review-loop' = same-order no-charge revisits / 'paid-cycle' = per-revisit fee, fund gate required. MCP-side audit declaration ONLY (pre_publish harness hook) — never sent on-chain; the handler strips it before the SDK call. Mirror of the template frontmatter twin (template-loader).","type":"string","enum":["none","review-loop","paid-cycle"]}},"required":["object"],"additionalProperties":false,"description":"On-chain Machine operations. USAGE: (1) CREATE NEW: Set 'object' field with OBJECT format {name, permission, ...} to create a Machine. NOTE: 'name' goes INSIDE 'object', NOT at the data root level. 'permission' can be a new Permission object or reference an existing one - check 'object' field description for details. (2) OPERATE EXISTING: Set 'object' field with STRING format (object ID or name). The 'object' field is CRITICAL and REQUIRED in both cases. STRING for existing, OBJECT for new creation."},"idempotency_key":{"type":"string","minLength":8,"maxLength":128,"pattern":"^[A-Za-z0-9._:-]+$","description":"F-RQ-13A (prescription ⑨): idempotency key for this business attempt. REPLAY GUARD: if a previous call with the SAME key is still open (dispatched but outcome unresolved, or already committed), this call is HELD — you get a structured state_conflict envelope with the prior attempt's verification data instead of a second on-chain submission (the ghost-order guard: two live mainnet orders, two escrows). Lifecycle: a deterministic failure (nothing submitted / provably reverted) clears the key — fix the cause and retry with the SAME key; an unknown-outcome failure (submission may have landed) keeps the key HELD — verify on-chain state first (result.submission_verification tells you where to look), and only retry with a NEW key once the outcome is resolved. Keep one key per business attempt (e.g. 'ord-20261030-042-buy'); do not reuse across attempts."},"env":{"type":"object","properties":{"account":{"default":"","type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"permission_guard":{"description":"List of permission guard IDs. Used to extend additional operation permissions (requires verification and configuration in the Permission object).","type":"array","items":{"type":"string"}},"no_cache":{"description":"Whether to disable caching.","type":"boolean"},"network":{"description":"Omit in chat-client contexts — the runtime stamps the user's CURRENT network (the client's UI selection). Standalone MCP/CLI: omit to use the current network; set ONLY when the user explicitly names a different network (a mismatch pauses for user confirmation). Never guess or hardcode a network.","type":"string","enum":["localnet","testnet","mainnet"]},"referrer":{"description":"Referrer ID. If the user is using the network for the first time, the referrer ID will be recorded (also applied when the SDK auto-registers the sender in the global Entity table).","type":"string"},"no_auto_register":{"description":"Opt-out of SDK-level Entity auto-registration. By default, a business transaction whose sender has no entry in the global Entity table automatically appends an entity registration: the sender gets registered and receives an owned Resource object (their on-chain mark book) in the wallet. Set true ONLY when the user explicitly cancelled their entity registration or demands that the transaction not touch the Entity table.","type":"boolean"},"confirmed":{"description":"Phase 2 ConfirmGate: set to true to proceed after a 'pending_confirmation' result. The operation is NOT executed until you re-call with confirmed=true after user consent.","type":"boolean"},"user_intent_phrases":{"description":"Phase 2 ConfirmGate: explicit user intent phrases collected from conversation context (e.g. 'use default account', 'force publish'). Used to bypass confirmation rules whose bypass_on_explicit_intent matches.","type":"array","items":{"type":"string"}},"plan_approval":{"description":"K3 24 PlanApproval: id of a goal whose plan was approved via goal_operation action='approve'. When set: 1) the ConfirmGate treats fail-open rules (standard/none levels) as pre-approved for operations under this goal's plan; 2) after successful CREATION operations, the created objects are auto-registered into the goal (GoalRecord.objects + its TaskProcess manifest — ACT station 'execution registers'). Fail-closed levels (irreversible/publish/amount) still require per-operation confirmation with env.confirmed=true.","type":"string"},"client_schema_version":{"description":"Client-side schema version (semver, e.g. '1.0.0'). When provided, the server checks compatibility and attaches warnings if mismatched.","type":"string"},"schema_strict_mode":{"default":false,"description":"When true, schema incompatibility returns an error instead of a warning. Default: false (warn mode).","type":"boolean"},"dry_run":{"description":"Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).","type":"boolean"},"window_profile":{"description":"Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).","type":"string","enum":["production","test"]},"response_level":{"description":"Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.","type":"string","enum":["compact","full"]},"confirm_mode":{"description":"Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.","type":"string","enum":["full","streamlined","quiet"]}},"required":["account","schema_strict_mode"],"additionalProperties":false,"description":"IMPORTANT: Execution environment includes: account for signing operations, network selection (testnet | localnet | mainnet), additional Guard permissions, and more. Used to specify context information during the call. If account is not specified, the default account (\"\") will be used. NOTE: by default the SDK auto-registers the sender in the global Entity table when absent (first business transaction; the account receives an owned Resource object). Set no_auto_register=true only on explicit user request."},"submission":{"type":"object","properties":{"type":{"type":"string","const":"submission","description":"Discriminator for this result variant. Constraint: always 'submission'. Example: 'submission'"},"guard":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"object":{"type":"string","description":"Guard object name or ID to verify against. Example: 'my-delivery-guard' or '0x123...'"},"impack":{"type":"boolean","description":"Whether this Guard's verification result participates in the final logic. Constraint: if false, the Guard is checked but does not block the operation. Example: true"}},"required":["object","impack"],"additionalProperties":false},"description":"Array of Guard objects to verify. Constraint: at most 20 entries (MAX_GUARD_COUNT_PASSPORT). Relation: each entry corresponds to a Guard bound to the operation."},"submission":{"type":"array","items":{"type":"object","properties":{"guard":{"type":"string","description":"Guard object name or ID that requires submission data. Example: 'my-delivery-guard'"},"submission":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"b_submission":{"type":"boolean","description":"Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."},"value_type":{"description":"Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.","anyOf":[{"type":"number","const":0,"description":"Bool (0)"},{"type":"number","const":1,"description":"Address (1)"},{"type":"number","const":2,"description":"String (2)"},{"type":"number","const":3,"description":"U8 (3)"},{"type":"number","const":4,"description":"U16 (4)"},{"type":"number","const":5,"description":"U32 (5)"},{"type":"number","const":6,"description":"U64 (6)"},{"type":"number","const":7,"description":"U128 (7)"},{"type":"number","const":8,"description":"U256 (8)"},{"type":"number","const":9,"description":"VecBool (9)"},{"type":"number","const":10,"description":"VecAddress (10)"},{"type":"number","const":11,"description":"VecString (11)"},{"type":"number","const":12,"description":"VecU8 (12)"},{"type":"number","const":13,"description":"VecU16 (13)"},{"type":"number","const":14,"description":"VecU32 (14)"},{"type":"number","const":15,"description":"VecU64 (15)"},{"type":"number","const":16,"description":"VecU128 (16)"},{"type":"number","const":17,"description":"VecU256 (17)"},{"type":"number","const":18,"description":"VecVecU8 (18)"},{"type":"string","const":"Bool","description":"Bool"},{"type":"string","const":"Address","description":"Address"},{"type":"string","const":"String","description":"String"},{"type":"string","const":"U8","description":"U8"},{"type":"string","const":"U16","description":"U16"},{"type":"string","const":"U32","description":"U32"},{"type":"string","const":"U64","description":"U64"},{"type":"string","const":"U128","description":"U128"},{"type":"string","const":"U256","description":"U256"},{"type":"string","const":"VecBool","description":"VecBool"},{"type":"string","const":"VecAddress","description":"VecAddress"},{"type":"string","const":"VecString","description":"VecString"},{"type":"string","const":"VecU8","description":"VecU8"},{"type":"string","const":"VecU16","description":"VecU16"},{"type":"string","const":"VecU32","description":"VecU32"},{"type":"string","const":"VecU64","description":"VecU64"},{"type":"string","const":"VecU128","description":"VecU128"},{"type":"string","const":"VecU256","description":"VecU256"},{"type":"string","const":"VecVecU8","description":"VecVecU8"},{"type":"string","const":"bool","description":"bool"},{"type":"string","const":"address","description":"address"},{"type":"string","const":"string","description":"string"},{"type":"string","const":"u8","description":"u8"},{"type":"string","const":"u16","description":"u16"},{"type":"string","const":"u32","description":"u32"},{"type":"string","const":"u64","description":"u64"},{"type":"string","const":"u128","description":"u128"},{"type":"string","const":"u256","description":"u256"},{"type":"string","const":"vecbool","description":"vecbool"},{"type":"string","const":"vecaddress","description":"vecaddress"},{"type":"string","const":"vecstring","description":"vecstring"},{"type":"string","const":"vecu8","description":"vecu8"},{"type":"string","const":"vecu16","description":"vecu16"},{"type":"string","const":"vecu32","description":"vecu32"},{"type":"string","const":"vecu64","description":"vecu64"},{"type":"string","const":"vecu128","description":"vecu128"},{"type":"string","const":"vecu256","description":"vecu256"},{"type":"string","const":"vecvecu8","description":"vecvecu8"}]},"value":{"description":"The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).","anyOf":[{"type":"boolean"},{"anyOf":[{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."},{"type":"string"}]},{"type":"string"},{"type":"number"},{"type":"array","items":{"type":"boolean"}},{"anyOf":[{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"},{"type":"array","items":{"type":"string"}}]},{"type":"array","items":{"type":"string"}},{"type":"array","items":{"type":"number"}},{"type":"array","items":{"type":"array","items":{"type":"number"}}}]},"name":{"default":"","description":"Data name identifier. MAX 64 BCS characters (Chinese chars count as 3-4 BCS bytes each). Use short identifiers like 'order_id', 'delivery_node'. Put longer descriptions in the Guard's 'description' field, NOT here.","type":"string"},"object_type":{"description":"OUTPUT-ONLY (query side): Object type when value_type is Address and represents a specific object. Auto-derived by the system — DO NOT set this field at Guard creation.","type":"string","enum":["Permission","Repository","Arb","Arbitration","Service","Machine","Order","Progress","Payment","Treasury","Guard","Demand","Passport","Allocation","Resource","Reward","Discount","EntityRegistrar","EntityLinker","Proof","WReceivedObject","Contact","TableItem_ProgressHistory","TableItem_PermissionPerm","TableItem_DemandPresenter","TableItem_MachineNode","TableItem_TreasuryHistory","TableItem_RepositoryData","TableItem_RewardRecord","TableItem_EntityLinker","TableItem_AddressMark","TableItem_EntityRegistrar"]}},"required":["identifier","b_submission","value_type","name"],"additionalProperties":false,"description":"Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"},"description":"User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."}},"required":["guard","submission"],"additionalProperties":false,"description":"One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."},"description":"User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"}},"required":["type","guard","submission"],"additionalProperties":false,"description":"Guard verification required. The operation was blocked because one or more Guards require user-submitted data. Fill the submission array and resubmit. Semantic status is 'pending_input'."}},"required":["operation_type","data"],"additionalProperties":false}