Changelog

• Workflow-chain gallery visibility — internal chains (RFC 0135 Draft → Active, 2026-07-23). Adds one OPTIONAL boolean to the manifest's WorkflowChain (schemas/workflow-chain-pack-manifest.schema.json §WorkflowChain): internal — marks a composition-only fragment (typically an RFC 0133 sub-chain child). A host's default template-gallery/picker listing MUST omit internal: true chains (a host MAY offer an explicit opt-in author/admin view); internal MUST NOT change any non-presentational behavior (load/validate, resolve-by-id, expansion, from-chain, RFC 0133 composition all unchanged) and is explicitly NOT an authorization boundary (a host MUST NOT treat it as access control). Absent ⇒ false. Motivation: RFC 0133 made chains composable, which creates children that exist only to be composed — indistinguishable in the manifest from runnable templates, so galleries list half-a-workflow fragments as peers of their parent (the openwop-app lesson-batch child, tracked as that host's CGX-1; the stop-gap was a naming convention). additive per COMPATIBILITY.md §2.1 — new optional field, every existing chain byte-identical + listed exactly as before; no new capability flag. The 7-day comment window was waived under the bootstrap-phase single-maintainer steward waiver (CONTRIBUTING.md §"Bootstrap-phase notes"; same mechanism as RFC 0132/0133/0134), architect-reviewed by the steward. Landed at Active (wire shape LOCKED): schema + spec (workflow-chain-packs.md §"Chain visibility (RFC 0135)") + the always-on server-free workflow-chain-internal-flag.test.ts corpus legs (suite 1.57.0 → 1.58.0, 400 → 401 scenario files). Graduated Active → Accepted (2026-07-23) on the openwop-app tier-1 reference-host witness (rev e9e0a5ed0, PR openwop-app#2470): vendored schema synced, lesson-batch marked internal: true, the gallery route + zero-config seeder omit internal chains (host regression legs), and the workflow-chain-internal-flag + RFC 0133 composition scenarios passed non-vacuously under OPENWOP_REQUIRE_BEHAVIOR=true against the published suite 1.58.0 (internal-flag 3/3, sub-chain 16, workflow-chain 67). Corpus RFC counts move Accepted 130 → 131 / Active 4 → 3.

• Edge-condition truthy / falsy operators (RFC 0134 Draft → Active, 2026-07-23). Adds two members to the EdgeCondition.type enum (schemas/workflow-definition.schema.json §EdgeCondition + the inlined schemas/workflow-chain-pack-manifest.schema.json §EdgeCondition): truthy and falsy, which take a left path and NO right operand and route the edge iff the value at left is (resp. is not) truthy — treating a skipped upstream (output absent) as falsy, which is what reject-safe fan-in wiring depends on (equals true / notEquals true evaluate a skipped source the opposite way). Closes a gap between what hosts do (they already compute a boolean gate output's truthiness) and what the wire can say, and unblocks the approval-gate + reject-safe-barrier pattern (a challenge-authoring factory, multi-channel campaign orchestration) from converting to portable chain packs. truthy/falsy require a non-empty left (else chain_edge_condition_invalid, never a silently dead edge) and a host MUST ignore a stray right. additive per COMPATIBILITY.md §2.1 — new optional enum members; every existing EdgeCondition (one of the five prior operators) is byte-identical and replays identically; no new capability flag (the operator set is part of the always-present workflow-definition contract). The 7-day comment window was waived under the bootstrap-phase single-maintainer steward waiver (CONTRIBUTING.md §"Bootstrap-phase notes"; same mechanism as RFC 0132/0133), architect-reviewed by the steward. Landed at Active (wire shape LOCKED): schema + spec (workflow-chain-packs.md §"Edge-condition operators (RFC 0134)") + the always-on edge-condition-truthy-falsy.test.ts §A corpus legs all pass server-free; Graduated Active → Accepted (2026-07-23) on the openwop-app tier-1 reference-host witness (rev c8854cb5, PR openwop-app#2438): the host mapped the operators (edgeConditionMapping WIRE_OP truthy→truthy/falsy→falsy, vendored schemas synced) and the edge-condition-truthy-falsy §B host-mapping leg passed NON-VACUOUSLY under OPENWOP_REQUIRE_BEHAVIOR=true (4/4). Corpus RFC counts move Accepted 129 → 130 / Active 4 → 3.

• Workflow-chain composition — sub-chains + produced variables (RFC 0133 Draft → Active → Accepted, 2026-07-22 → 2026-07-23). Extends RFC 0013 workflow-chain packs with two OPTIONAL, additive capabilities so composed/stateful workflows need not stay hard-coded. (1) Sub-chains — a chain fragment MAY declare subChains[] (a sibling chainId, or an external published chain) and reference one from a core.subWorkflow / core.dispatch (child-run) node via config.subChainRef. Unlike RFC 0013's author-time inline splice, the host co-expands and co-registers the referenced chain as its own owned workflow, minting a deterministic, TENANT-SCOPED id from (tenantId, childChainId, version) (no cross-tenant collision on the global registry; a child shared across parents in a tenant registers once; a repeat instantiation converges), and rewrites the referencing node's subChainRef → the minted child config.workflowId — so the parent holds a runtime child (realizes "workflows can hold workflows", the future-RFC forward-reference RFC 0013 anticipated). Bounded by a cycle check (sub_chain_cycle) + a depth cap (maxSubChainDepth, RECOMMENDED 8 → the distinct sub_chain_max_depth_exceeded); an unresolvable ref → sub_chain_unresolved; a host without runtime child dispatch refuses a subChains-bearing chain with sub_chain_unsupported (422), never silently flattening. (2) Produced variables — a fragment MAY declare producedVariables[] (a value a node writes to the run bag that a downstream node reads by name via { type:"variable" }, distinct from author-time parameters), emitted into the expanded WorkflowDefinition.variables[] and closed-world validated (variable_undeclared); explicit output→input edges remain PREFERRED. New optional capabilities.workflowChainPacks.subChains sub-block gates the runtime path (producedVariables needs no flag). additive per COMPATIBILITY.md §2.1 — every new field optional; a subChains-free chain expands byte-identically; dispatch rides the existing core.subWorkflow/core.dispatch nodes (no new primitive); child ids minted at instantiate time (no run-log non-determinism; :fork replays byte-identically). Amends RFC 0013 (adds an Amended by row; qualifies its spec §Expansion step 9 + §What hosts dispatch for the opt-in runtime-child mode). The 7-day comment window was waived under the bootstrap-phase single-maintainer steward waiver (CONTRIBUTING.md §"Bootstrap-phase notes"; same mechanism as RFC 0043/0121/0131/0132), architect-reviewed by the steward. Landed at Active (wire shapes LOCKED): the schema + spec + reference library + three server-free scenarios (chain-subchain-sibling, chain-subchain-cycle-rejected, chain-produced-var-roundtrip) + the protocol-tier sub-chain-expansion-bounded invariant all pass non-vacuously server-free. Graduated Active → Accepted (2026-07-23) on the openwop-app tier-1 reference-host witness (rev e199bd96c, PR openwop-app#2429, ADR 0471): against @openwop/openwop-conformance@1.56.0 under OPENWOP_REQUIRE_BEHAVIOR=true, all 5 scenarios / 22 tests PASS with the two capability-gated §B legs (chain-subchain-fanout, chain-subchain-unsupported-refused) NON-VACUOUS (host advertised subChains {supported:true,maxDepth:8}; negative posture OPENWOP_CHAIN_SUBCHAINS=0 → block omitted, real sub_chain_unsupported refusal). On this witness sub-chain-child-tenant-scoped GRADUATED reference-impl → protocol (RFC 0079 / RFC 0132 precedent); a second non-steward host is the dual-witness strengthening, tracked in docs/KNOWN-LIMITS.md. All 3 §Unresolved questions swept: external-ref version pinning → resolved (pin SHOULD); maxSubChainDepth → resolved (8); child ownership lifecycle → carried forward (WCP5, reference-count RECOMMENDED). Companion registers: 0133-workflow-chain-composition.{gaps,risks}.md. Corpus RFC counts move Accepted 128 → 129 / Draft 2 → 1 (0038 Parked).
• SECURITY invariants +2 (both protocol-tier after the 2026-07-23 graduation). Adds sub-chain-expansion-bounded (protocol-tier — bounded sub-chain co-expansion: cycle + maxSubChainDepth fail closed with sub_chain_cycle; the workflow-chain analog of RFC 0071 artifact-schema-compile-bounded; public test chain-subchain-cycle-rejected.test.ts, witnessed server-free now) and sub-chain-child-tenant-scoped (reference-impl-tier — a co-registered child owned only by the parent's tenant, no cross-tenant workflow aliasing; CTI-1 parity; behavioral home chain-subchain-fanout.test.ts — landed reference-impl at Active, GRADUATED reference-impl → protocol at Active → Accepted 2026-07-23 on the openwop-app tier-1 witness rev e199bd96c). Totals: 156 invariants (124 → 126 protocol / 28 reference-impl / 2 advisory).
• Anonymous-actor authorization for public agent surfaces (RFC 0132 Draft → Accepted, 2026-07-22). Adds a third, explicit principal kind — anonymous — for callers on a public agent surface (an embeddable widget, a marketing-site assistant, a logged-out visitor) who authenticated no identity: opaque, origin-bound, per-session-ephemeral, non-cross-linkable, non-PII (RFC 0048 parity, resolving its §UQ1 principal-kind discriminator). An anonymous actor's authority is not a role and not the default-on tool baseline but a default-deny, explicit per-surface tool grant, advertised via a new OPTIONAL capabilities.anonymousActor family ({ supported, tiers, writeEgressControls?, failClosed }) with a tenant-scoped no-egress/no-secrets read tier and a bounded-write/egress tier permitted only behind a mandatory HITL/approval (RFC 0051) or rate-limit + per-session cap, over the RFC 0076/0079 SSRF-guarded audience-bound egress path. Adds an OPTIONAL run-snapshot.owner.principalKind (user/agent/anonymous, EXPLICIT — absent ⇒ today's behavior) as the wire witness, and an OPTIONAL openwop.actor.kind OTel attribute. Every anon tool call audits via the existing RFC 0049 authorization.decided event (no new event type). additive per COMPATIBILITY.md §2.1 (new optional capability off by default + new optional field on a server-emitted schema + normative requirements binding only opt-in surfaces). Spec minor bumps; conformance suite minor bumps with the new capability-gated scenarios; spec major does not bump. The 7-day comment window (GOVERNANCE.md §"Normative addition") was waived under the bootstrap-phase single-maintainer steward waiver (CONTRIBUTING.md §"Bootstrap-phase notes"; same mechanism as RFC 0043/0121/0131), architect-reviewed by the steward. Graduated Active → Accepted the same day on the openwop-app tier-1 reference witness (PR openwop-app#2403, rev 03d06d1f2): the five gated behavioral scenarios passed 10/10 non-vacuously under OPENWOP_REQUIRE_BEHAVIOR=true (steward-verified by booting the in-memory host — advert both tiers + hitl, seam served 200), so the five anon-actor-* invariants graduated reference-impl → protocol tier. All five §Unresolved questions resolved (UQ5 → anon egress credential-free by default, a host-side in-audience credential attach is an explicit opt-in outside the floor; UQ3 → an A2A-forwarded actor MUST NOT map to principalKind:"anonymous"; UQ1/2/4 → passive/out-of-scope/opaque). Corpus RFC counts move Accepted 127 → 128 / Draft 2 → 1 (0038 Parked).
• SECURITY invariants +5 (protocol-tier +5). Adds anon-actor-no-default-baseline, anon-actor-no-secret-reach, anon-actor-egress-ssrf-guarded, anon-actor-write-egress-gated, anon-actor-audit-opaque (RFC 0132 §F), each with its gated conformance scenario. All five are behavioral guarantees requiring a live tool-enabled public surface, so — per the RFC 0079 egress-credential-audience-bound precedent — they landed at reference-impl tier at Active and GRADUATED to protocol tier at Active → Accepted (2026-07-22) once the openwop-app reference host passed the scenario non-vacuously under OPENWOP_REQUIRE_BEHAVIOR=true. The always-on anonymous-actor-shape.test.ts proves the wire contract server-free. Totals: 154 invariants (119 → 124 protocol / 33 → 28 reference-impl / 2 advisory).
• Registry and extension-policy (RFC 0043 Accepted, 2026-07-07). Graduates Active → Accepted the one-stop governance policy that consolidates the project's non-wire stability surface: extension-namespace reservation + policing, pack-registry submission/deprecation/yank/key-rotation, profile/event/kind/capability name reservation against squatting, and the IPR posture. additive — policy text only, no wire-shape, schema, OpenAPI, or conformance change (the openwop:check gate is unaffected). The policy has been live and cited as authoritative from normative spec (host-extensions.md §"Canonical prefixes", registry-operations.md policy layer, docs/governance/registry-policy.md) since 2026-06-11; its only landing gate — a 7-day public comment window — was waived under the bootstrap-phase steward waiver (CONTRIBUTING.md §"Bootstrap-phase notes"; same mechanism as RFC 0121), with no unresolved objections on the additive policy. Working-group ratification remains a future-action gate, not a blocker (gated on the GOVERNANCE.md tripwire per RFC 0038, WG-revisitable). The five §Unresolved policy questions (DNS-ownership path, 72-hour yank window, no-trademark posture, 14-day patent-disclosure SLA, openwop./host. OTel namespace) stand at their proposed bootstrap defaults and are WG-revisitable — none was a graduation blocker. Corpus RFC counts move Accepted 126 → 127 / Active 4 → 3 / Draft 1 (0038).

Distinguishes a composable, task-scoped Skill from a top-level assistant agent, first-class on the agent manifest. One RFC reaches Accepted; wire shape additive per COMPATIBILITY.md §2.1 plus a schema-encoded safety-fix that binds only opt-in manifests. RFC counts move Accepted → +1 (0131).

• RFC 0131 — agent-manifest role + the Skill profile (Accepted, 2026-07-07). Adds an additive OPTIONAL AgentManifest.role ("skill" | "assistant") — EXPLICIT, never inferred (handoff presence does NOT imply skill; an assistant MAY ship a typed entry contract). An absent role is unconstrained — byte- and behavior-identical to today, no profile binds it. A manifest that opts in with role: "skill" binds the Skill profile, encoded in agent-manifest.schema.json as an if role==="skill" conditional: it MUST declare handoff and MUST constrain memoryShape to scratchpad-only (conversation/longTerm MUST be false/absent — persistent + multi-turn memory belong to the composing assistant/roster agent, RFC 0039; a stateful worker undermines replay determinism, RFC 0041). A violating skill manifest fails schema validation at publish/install (pack_validation_failed) — a malformed manifest (RFC 0003 §C author error), deliberately NOT an RFC 0072 §C degraded[] runtime tier (whose "the host lacks a capability a well-formed agent wants" meaning stays crisp). agent-memory.md §D states the memory constraint adjacent to §C with an explicit reject-vs-degrade contrast; node-packs.md §agents[] documents the field. Because enforcement is universal schema validation (no capabilities.* advert, no host behavior), there is no per-host interop variance — the always-on agent-manifest-role-profile.test.ts is the universal witness. Draft → Accepted via the bootstrap single-maintainer comment-window waiver (CONTRIBUTING.md §"Bootstrap-phase notes"), architect-reviewed by the steward (explicit role opt-in + schema-encoded reject were the two review-driven revisions). Reference host: openwop-app ADR 0312 (Phase-0 marketplace "Skill" label + Phase-2 worker-memory normalization).
• SECURITY invariants +1 (protocol-tier +1). Adds agent-skill-profile-stateless (RFC 0131 §B) with its matching always-on public conformance test.

---

Closes the RFC 0121–0129 cycle plus the RFC 0013 workflow-chain-pack errata: eleven RFCs reached Accepted (0114, 0116, 0117/0119, 0122, 0123, 0124, 0125, 0126, 0127, 0128, 0129) and four new ones landed their Active normative surface (0124, 0125, 0126, plus 0121 advancing to the at-own-risk implementation gate). The work clusters into CDP Track-2 (streaming/CDC triggers + purpose-propagation labels + data-residency), portable workflow-chain-pack parameter deferral + edge fan-in rules, data-parallel per-item dispatch, the self-hosted runner, and presentational connector-catalog grouping. All wire shapes additive per COMPATIBILITY.md §2.1; two safety-fixes (RFC 0013 substitution typing, RFC 0124 sensitive-param secret handling) close credential/portability leaks without relaxing any MUST. Corpus RFC counts move Accepted 113 → 124 / Active 8 → 4 / Draft 1 (0038).

• CDP Track-2 — streaming/CDC triggers, purpose labels, data-residency (RFC 0127/0128/0129 Accepted). triggerBridge.sources[] gains stream (broker message) + change (warehouse CDC record) with op-carrying envelopes reusing the RFC 0099 SSRF-guard + content-free trigger. events (0127). An OPTIONAL permittedPurposes: string[] label rides TriggerEvent + the A2A metadata.openwop. namespace; an advertising host MUST re-emit onward (MAY narrow, MUST NOT widen), and []-labelled data MUST NOT be forwarded (0128). An OPTIONAL capabilities.dataResidency {regions[]} + residency:{region} on POST /v1/runs makes region admission control a falsifiable MUST (accept iff advertised, else residency_unavailable, create no run); physical byte-confinement stays a §4 declared-intent SHOULD (0129). All three graduated single-witness on the tier-1 reference host, steward-curl-verified on the wire; each carries a named G4 tier-2 gap.
• Workflow-chain-pack portability — deferred parameters + edge fan-in (RFC 0124/0125 Accepted). RFC 0124 adds an OPTIONAL workflowChainPacks.deferredParameters mode that keeps chain {{params.*}} overridable per run without non-portable runtime tokens — the host materializes chain parameters into variables[] + rewrites to spec'd bindings, replay-deterministic via RunSnapshot.variables. RFC 0125 mirrors triggerRule onto FragmentEdge for pack-declared fan-in / error-routing. Both single-witness on the reference host.
• Data-parallel per-item dispatch (RFC 0126 Accepted). An OPTIONAL index-aligned nextWorkerInputs[] on NextWorkerDecision fans ONE childWorkflowId over N runtime items with distinct inputs, over the RFC 0022 projection, fail-closed on a non-advertising host or a length mismatch (validation_error, no child dispatched), replay-safe on :fork. Single-witness on a real core.dispatch executor.
• Self-hosted runner (RFC 0122 Accepted). New OPTIONAL selfHostedRunner capability: a hosted control plane routes per-step dispatch to a user-controlled runner that dials OUT (SSE receive + POST result) and holds local credentials the host cannot reach; the host stays the sole orchestration/replay authority. Graduated tier-1 (openwop-app, runner_unavailable=409) + tier-2 (MyndHyve, =503) — the 409/503 split demonstrates the #815 envelope-not-status contract cross-host.
• Front-end plugin packs + prompt-prefix cache + A2UI deltas (RFC 0117/0119, 0116, 0114 Accepted). Sandboxed cross-origin-iframe kind:"frontend-plugin" loader with deny-egress CSP + host-RPC allowlist (0117/0119); portable secret-free cachePrefixId prompt-prefix caching with tenant-keyed cross-tenant isolation (0116); OPTIONAL RFC 6902 A2UI delta-frame transport over the unchanged recorded ui.a2ui-surface envelope (0114). All single-witness, steward-curl-verified.
• Connection-pack provider vendor grouping (RFC 0123 Accepted). OPTIONAL presentational provider.vendor string groups a connector catalog by commercial vendor; gates no capability and carries no wire behavior, so the schema-validation legs are the witness. Evidence-upgraded to host-served real grouping on the reference host.
• Subscription-reuse provider auth mode (RFC 0121 Active, at-own-risk gate). Adds "subscription" to the aiProviders.authModes enum + the protocol-tier subscription-credential-user-scope-only MUST (credential_scope_forbidden on tenant/workspace bind). UQ1 (provider ToS legality) remains UNRESOLVED; a steward at-own-risk waiver permits implementation of the acquisition-bearing surface at operator/end-user risk — a risk waiver, not a legal clearance. The §B.8 request-scope rejection rail is steward-curl-witnessed on the reference host; the invariant's storage-resolvability clause is inherently host-test territory (host-covered by openwop-app #1444) — see docs/KNOWN-LIMITS.md §"Behavior tests too coarse".
• Two safety-fixes (COMPATIBILITY.md — no MUST relaxed). RFC 0013: a value that is exactly one {{params.x}} token resolves to the raw typed value (objects/arrays survive their JSON type), node.inputs are preserved verbatim through expansion, and a parameter-distinct persisted-identity rule prevents silent overwrite. RFC 0124 §Security: a sensitive param MUST materialize as source:"secret" (BYOK-resolved, never plaintext), is deferrable only in a prompt-body position, and fails closed (sensitive_param_not_deferrable, 422) everywhere else — closing a run-time RunSnapshot/at-rest leak.
• RFC 0013 errata (doc/test-only). Expanded node ids are unbounded — hosts MUST NOT cap id length (WorkflowNode.id has no maxLength); the host-expansion test seam decoupled onto a conformance-only workflowChainPacks.hostExpansionSeam flag + the workflow-chain-sample fixture bundled, so RFC 0013's Phase-3 host-expansion acceptance item is witnessed 6/6 harness-tier.
• SECURITY invariants 145 → 148 (protocol-tier 115 → 118). Adds subscription-credential-user-scope-only (0121 §B.8), runner-credential-non-transit (0122, BYOK SR-1 parity), and runner-output-untrusted-transport (0122, <UNTRUSTED> fencing) — each with a matching public conformance test.
• Conformance suite 1.46.0 → 1.54.0 (independent per-package cadence; scenario files 384 → 387). Ships the gated scenarios for every graduation this cycle: aiproviders-subscription-scope, self-hosted-runner, dispatch-per-item-input, workflow-chain-deferred-parameters, trigger-stream-cdc-sources, purpose-propagation, data-residency-admission, plus the RFC 0013 host-expansion fixture. Already published incrementally on npm.
• Honest scoping carried on the public credibility surface. RFC 0111 (contextBudget) stays Active — the tier-1 host honestly opted out (skeleton orchestrator loop, no real model turns; advertising would be a dishonest wire claim). Every graduation this cycle names its carried-forward tier-2 gap in INTEROP-MATRIX.md + docs/KNOWN-LIMITS.md; none is claimed as independent-organization dual-witness.

---

Closes the RFC 0109–0120 cycle: seven RFCs reached Accepted (0109, 0110, 0112, 0113, 0115, 0118, 0120) and five new ones landed their Active normative surface (0111, 0114, 0116, 0117, 0119). The work clusters into a token / transport economy, sandboxed front-end plugin packs, parallel sub-workflow fan-out, and a pack-delivered credential-egress allow-list. All wire shapes additive per COMPATIBILITY.md §2.1; no v1 wire break. RFC counts move Accepted 105 → 112 / Active 2 → 7 / Draft 1 (0038).

• RFC 0109 — Conversation-turn model provenance (Accepted, 2026-06-24). Additive OPTIONAL agent.model ({ provider, model }) on conversation-turn.schema.json recording which model produced a role:'agent' turn, gated on the new optional conversationTurnModelProvenance.supported capability. NON-SECRET / NON-PII by additionalProperties:false (the SR-1 guard — no credential/endpoint/prompt rides the stamp); read VERBATIM on :fork. Server-free shape scenario (conversation-turn-model-provenance-shape.test.ts). Draft → Accepted via the bootstrap single-maintainer comment-window waiver; reference stamp = openwop-app ADR 0124 Phase 2d.
• RFC 0110 — Channel presence (Accepted, 2026-06-24). Additive OPTIONAL ephemeral channel.presence RunEvent (channel-presence-payload.schema.json) for type:'channel' conversations — present-member subject refs + optional per-member typing — gated on channelPresence.supported. Hosts MUST NOT persist it to the replayable log; it is replay/:fork-invisible (the load-bearing distinction from the persisted conversation.exchanged turn). Membership-gated (DEFAULT-DENY, CTI-1), NON-PII (opaque subject refs only). Server-free shape scenario; Draft → Accepted via the bootstrap waiver. Reference-host emit DEFERRED (a single-instance deployment is the natural first emitter).
• RFCs 0112 / 0113 / 0115 — token + transport economy (Active → Accepted, 2026-06-27). Dual-witnessed vs published @openwop/openwop-conformance@1.43.0 (openwop-app reference rev 00332-gm2 + MyndHyve tier-2 revs 00511-len/00512-pej/00510-jiv), every gated scenario re-driven non-vacuously by the steward. 0112 compact tool projection — OPTIONAL ?view=compact on GET /v1/tools[/{toolId}] returning a lossy { tools: CompactToolDescriptor[] } with a self-contained input-schema subset (compact-tool-descriptor.schema.json) + toolCatalog.compactView. 0113 memory injection budget — OPTIONAL tokenBudget/rank/query on MemoryListOptions token-bounding the live injection read (rank:'relevance' delegates to memory.search, no new ranking primitive) + memory.injectionBudget; SR-1/CTI-1 hold by construction. 0115 run transport economy — OPTIONAL strong ETag + If-None-Match/304 + Content-Encoding negotiation on GET /v1/runs/{runId} + restTransport. Per GOVERNANCE.md tier-2 + reference-host evidence.
• RFCs 0111 / 0114 / 0116 — token-economy surfaces (Active, 2026-06-26). Normative wire surface landed, host witness pending. 0111 context economy — OPTIONAL multiAgent.executionModel.contextBudget (transcript token budget + a summarization contract whose substitutions record a content-free context.summarized event with a replay-reused summaryRef). 0114 A2UI surface deltas — OPTIONAL host-side RFC 6902 delta-frame transport (a2ui-surface-delta-frame.schema.json, ?a2uiDelta=1) over the UNCHANGED recorded ui.a2ui-surface envelope; every A2UI invariant MUST hold post-patch. 0116 portable prompt-prefix cache — OPTIONAL secret-free cachePrefixId on ctx.aiEnvelope.generate + provider-scoped aiProviders.promptPrefixCache + cost-only cacheReadTokens/cacheWriteTokens usage fields, with tenant-keyed cross-tenant isolation (prompt-prefix-cache-cross-tenant-isolation) + replay invariance.
• RFC 0117 — Front-end plugin packs (Active) + normative surface. Additive kind:"frontend-plugin" registry pack + OPTIONAL host.uiPlugins capability for portable sandboxed UI extensions: the wire owns the boundary, not a renderer — a mandated cross-origin-iframe isolation model (in-process loading is a protocol-tier MUST NOT), a closed postMessage host-RPC allowlist (ui-plugin/1, with an RFC 0059-style optimistic-concurrency version token), a deny-egress CSP, Ed25519 signing, and graceful degradation to RFC 0071 rendering. Lands the spec doc, frontend-plugin-manifest.schema.json + ui-plugin-message.schema.json, the four frontend-plugin-* invariants, and the gated frontend-plugin-packs.test.ts. Active → Accepted waits on the openwop-app reference host (ADR 0153 canvas editor) advertising host.uiPlugins.
• RFC 0119 — Mechanism-neutral plugin isolation (Active; amends RFC 0117). Reconciles RFC 0117's property-level isolation prose with its const "cross-origin-iframe" schema pin: widens capabilities.uiPlugins.isolation to a categorical model (enum [cross-origin-iframe, wasm, process, container, vm] + ^x-host-*, reusing the RFC 0035 vocabulary, cross-origin-iframe the default) and reframes the frontend-plugin-isolation MUST-NOT as mechanism-independent. Strengthens §Host-RPC for non-browser transports (transport-guaranteed framing + per-channel ordering; for wasm, no host import beyond the single ui-plugin/1 entrypoint). Prose + looser-validation only (COMPATIBILITY.md §4); no envelope-schema change.
• RFC 0118 — Parallel sub-workflow fan-out and join (Active → Accepted, 2026-06-28). Closes RFC 0007 §K3's deferred fan-out: additive fanOutPolicy:'parallel' + an optional joinPolicy (mode wait-all/quorum/first/race × onChildFailure collect/fail-fast/absorb) + maxConcurrency on DispatchConfig, emitting core.dispatch.fanOut/core.dispatch.join run-events with a replay-deterministic mergeOrder; gated on dispatch.fanOutSupported, default stays 'sequential'. Graduated on dual-witness discovery + behavioral evidence (openwop-app prod + MyndHyve tier-2 rev 00513-qib, steward-verified via the POST /v1/host/sample/dispatch/fanout seam: joinOutcome:"satisfied", 3 children, mergeOrder of 3; corroborated by MyndHyve's dispatch-fanout-parallel.test.ts 10/10). Honest tier-2 + reference-host, with the per-host joinModes/onChildFailureModes subset divergence the gating exists to surface.
• RFC 0120 — Connection-pack apiHosts credential-egress allow-list (Active → Accepted, 2026-06-29). Closes the pack-delivered confused-deputy gap: a connection pack (RFC 0095) could declare a provider's auth endpoints but not the API host(s) its resolved credential may egress to. Adds the OPTIONAL provider.apiHosts array (strict bare registrable hostnames; IP/wildcard/port/single-label rejected) — REQUIRED at the manifest when reach:openapi and at the RFC 0045 binding site (conditional MUST, fail-closed), an eTLD+1 floor with dot-anchored suffix containment, AND-composing with (never widening past) the RFC 0079 audience guard. Two protocol-tier invariants (connection-pack-api-host-shape + connection-pack-egress-host-bound) with the gated connection-pack-apihosts.test.ts. Graduated single-witness tier-2 + reference-host: openwop-app ran the published 1.46.0 leg non-vacuously under OPENWOP_REQUIRE_BEHAVIOR=true (PERMITs graph.facebook.com, fails closed on evil.com/notfacebook.com/facebook.com.evil.com); MyndHyve honestly opted out of the brokered-egress arm.
• SECURITY invariants 138 → 145 (protocol-tier 108 → 115). Adds the four frontend-plugin- invariants (RFC 0117), prompt-prefix-cache-cross-tenant-isolation (RFC 0116), and the two connection-pack- apiHosts invariants (RFC 0120); the A2UI invariant set (RFC 0114) MUST hold on the post-patch surface.
• Conformance suite 1.37.0 → 1.46.0 — published independently on its own openwop-conformance/v* tags as each RFC's gated + always-on scenarios landed (compact-tool / memory-budget / run-transport / context-budget + summarization-replay / a2ui-delta / prompt-prefix-cache / frontend-plugin / dispatch-fanout / connection-pack-apiHosts). Per the 2026-06 repo split, this corpus repo publishes exactly this one artifact.
• Honest scoping carried on the public credibility surface. RFCs 0111 / 0114 / 0116 stay Active (single-/no-witness — 0111 needs a real-orchestrator-loop host; MyndHyve architecturally opted out of 0114 + 0116); RFCs 0117 / 0119 stay Active pending a host advertising host.uiPlugins; RFCs 0118 / 0120 graduated on tier-2 + reference-host evidence, recorded as such — not independent-org dual-witness. Each is documented in docs/KNOWN-LIMITS.md + INTEROP-MATRIX.md.

---

Closes the RFC 0100–0108 graduation cycle: eight RFCs reached Accepted on dual-witness (one single-witness, bootstrap-waiver) behavioral evidence, landing agent-authored UI, localized content, portable HITL approver routing, speech synthesis, real-time voice, durable A2A tasks, multi-party conversation, and a self-hosted / OpenAI-compatible provider class. All wire shapes additive per COMPATIBILITY.md §2.1; no v1 wire break. RFC counts move Accepted 96 → 105 / Active 3 → 2 (0035, 0043) / Draft 1 (0038).

• RFC 0102 — A2UI agent-authored interface surfaces (Accepted, 2026-06-15). The optional, advertised core envelope kind ui.a2ui-surface — a declarative interactive UI a consumer renders with native widgets, routing user actions back without executing agent-supplied code (closed component tree, host-enumerated catalog, interrupt-resume / conversation-exchange confinement). Dual live evidence vs suite 1.26.0 (openwop-app rev 00204-v75 + MyndHyve, byte-identical core schema sha256 68f977c1…). New schemas/envelopes/ui.a2ui-surface.schema.json + five SECURITY invariants + a threat-model-prompt-injection.md §4.8 section. (Briefly amended to a vendor-namespaced kind on a blind first review (#715), then reverted to the core kind on re-review — cross-host portability is the property the core kind delivers.)
• RFC 0103 — Localized content surface (Accepted, 2026-06-17). A capability-gated surface for durable authored structured localized content (pages → sections) that reuses the Stable i18n.md Accept-Language / Content-Language negotiation verbatim and adds only the data model + a per-section field merge (resolveSection: exact → language-family → base). New core spec spec/v1/localized-content.md, four schemas, a content capability block, OpenAPI delivery + admin paths, three protocol-tier SECURITY invariants. Dual non-steward host evidence (openwop-app + MyndHyve) vs suite 1.27.0.
• RFC 0104 — Portable HITL approver routing (Accepted, 2026-06-19). Three optional advisory fields on the kind:"approval" interrupt payload (approverGroupRefs, approverRoleRefs, audience) + a top-level interrupt.approverRouting capability, so group / role approver routing is portable + capability-gated. The audience hint defaults to the resolved eligibility union and is fixed history on replay / :fork. Dual non-steward host evidence with honestly-divergent audience support (openwop-app + MyndHyve) vs suite 1.28.0.
• RFC 0105 — Speech synthesis adapter (Accepted, 2026-06-21). Additive aiProviders.speechSynthesis: "supported" exposing ctx.callSpeechSynthesizer(...) → a binary audio asset (host-served url or inline base64 + mimeType), a verbatim parallel of ctx.callImageGenerator. Dual independent non-steward host evidence vs suite 1.29.0 on the identical locked envelope with honest provider / asset-arm divergence (openwop-app MiniMax / url rev 00265-wtx + MyndHyve Gemini / base64 rev 00280-dcs). Reuses existing SSRF + untrusted-media guards (no new invariant).
• RFC 0106 — Real-time voice session profile (Accepted, 2026-06-24). Additive aiProviders.realtimeVoice profile: streaming transcription (ctx.callTranscriber), a streaming arm on ctx.callSpeechSynthesizer, and a voice.* turn-taking / barge-in run-event taxonomy (run-event types 100 → 107) with a distinct session-bound streamRef live-conduit handle. Per-capability graduation: the transcription core is dual-witnessed (openwop-app rev 00294-nhz + MyndHyve Gemini-multimodal rev 00503-row) vs suite 1.34.0; the optional synthesis / turnDetection / bargeIn arms stay single-witnessed + conformance-gated. voice-transcript-untrusted + voice-bargein-no-partial-leak are protocol-tier; voice-interim-not-durable + voice-streamref-tenant-bound stay reference-impl (their scenarios don't yet drive the adversarial leg — a conformance-hardening follow-on). A §B/§C return-primitive amendment corrected a surfaced replay-determinism hazard (node-facing ctx resolves a Promise + emits to the durable log, never a live AsyncIterable).
• RFC 0100 — Async / durable A2A tasks (Accepted, 2026-06-24). Graduates the a2a async / durable composition surface (durableTasks + pushNotifications) on dual-witness evidence vs suite 1.34.0 (openwop-app rev 00299-hns + MyndHyve rev 00505-seh): a durable tasks/get over a real approval-gated run (input-required, taskId == runId) + push-config SSRF rejection, both serving a credential-less GET-resolvable A2A v0.3 AgentCard. Honest scope: streaming (tasks/resubscribe) is omitted by both — suite 1.34.0 ships no resubscribe gated subtest, so advertising it would be vacuous. a2a-push-egress-ssrf was already protocol-tier (no graduation).
• RFC 0108 — Self-hosted / OpenAI-compatible provider class (Accepted, 2026-06-24). Additive optional aiProviders.selfHosted[] (a subset of supported[]) marking operator- / tenant-configured OpenAI-compatible endpoints, with truthful-advertisement (§A.2), endpoint non-disclosure (§A.3 / §D), and capability-non-inference (§B) rules + the protocol-tier self-hosted-endpoint-no-disclosure invariant. Single-witness close under the bootstrap steward waiver on the openwop-app conformance-harness witness (the appropriate tier for an intrinsically operator-private surface that MUST NOT be publicly exposed — the RFC 0035 harness-graduation precedent); production stays dark (OPENWOP_COMPAT_PROVIDER_ENABLED unset ⇒ selfHosted:[]). Passes both aiproviders-selfhosted-shape (always-on) and aiproviders-selfhosted-honesty (gated) non-vacuously vs suite 1.37.0.
• RFC 0101 — Multi-party group conversation (Accepted, 2026-06-22). Un-parked + graduated via the /prd five-architect pass. Three additive capability-gated facts so N agents co-participating in one shared transcript are cross-host-observable: an optional participants: AgentRef[] roster on conversation.opened, a conditionally-required speakerId on agent ConversationTurns, and a multiPartyConversation capability block. A follow-on landed the capability-gated behavioral leg + a /v1/host/sample/conversation/multi-party/* conformance seam (RFC 0101 mints no normative client wire-route to open a council). Reuses roster-attribution-no-content (no new invariant).
• RFC 0107 — Publishable declarative pack kinds (Active) + chat-card-kind correction (safety-fix). Lands the Active RFC 0107 (opened + flipped Draft → Active 2026-06-23): the published registry-version-manifest.schema.json gains a kind discriminator (node default) + per-kind declarative payloads (artifactTypes / provider / chains / prompts / cards), with runtime re-tightened by an if/then/else (executable kinds MUST carry it; declarative kinds MUST NOT) — every existing node manifest validates unchanged. Separately corrects a never-honored cross-RFC enum disagreement: the chat-card-pack kind is card (RFC 0071 authoritative), not chat-card; zero such packs were ever published (safety-fix).
• SECURITY invariants 125 → 138 (protocol-tier 99 → 108). Adds the five A2UI invariants (RFC 0102), three localized-content invariants (RFC 0103), the voice voice-transcript-untrusted + graduated voice-bargein-no-partial-leak (RFC 0106), and self-hosted-endpoint-no-disclosure (RFC 0108), plus new threat-model-prompt-injection.md §4.8 / §4.9 / §4.10 sections (A2UI render surface, synthesized-audio boundary, live-audio ingress).
• Conformance suite 1.25.0 → 1.37.0 — published independently on its own openwop-conformance/v* tags as each RFC's gated + always-on scenarios landed (A2UI, localized-content, approver-routing, speech-synthesis, the voice family, multi-party conversation, declarative pack kinds, self-hosted providers). Per the 2026-06 repo split, this corpus repo now publishes exactly this one artifact; the SDK ctx type additions (ctx.callTranscriber, the callSpeechSynthesizer streaming arm, the interrupt + A2A types) are sequenced into the openwop/openwop-sdks sibling repo.
• Honest scoping carried on the public credibility surface. RFC 0106's optional voice arms (synthesis / turnDetection / bargeIn) and two of its §F invariants stay below full protocol-tier / dual-witness until their scenarios drive the adversarial leg + a second witness lands; RFC 0100's tasks/resubscribe stays a zero-witness optional arm pending a gated subtest; RFC 0108 closed single-witness (operator-private surface, no dishonest public claim). Each is documented as such in docs/KNOWN-LIMITS.md + INTEROP-MATRIX.md.

Ships the structural repo split and a dense two-week graduation cycle. The spec corpus now publishes exactly one artifact — @openwop/openwop-conformance — and everything else (SDKs, packs/registry, reference hosts/examples, the reference app, the CLI) moved to sibling repos. Twelve RFCs reached Accepted and two new ones (0099/0100) landed their normative floor. All wire shapes additive per COMPATIBILITY.md §2.1; no conformance pass invalidated.

• Repository split (non-normative). The monorepo was decomposed with full history into sibling repos: SDKs → openwop/openwop-sdks (TS @openwop/openwop, Python openwop-client, Go), packs + published registry → openwop/openwop-registry, reference hosts + runnable examples → openwop/openwop-examples, the reference app → openwop/openwop-app (app.openwop.dev), and the CLI → openwop/openwop-cli. This repo now publishes one artifact: @openwop/openwop-conformance. ⚠️ Consumer-facing: the Go module path changed to github.com/openwop/openwop-sdks/go (re-pin required); npm + PyPI names unchanged. The pack-manifest schemas stay normative here. A coordinated v* spec release must be matched by SDK tags in openwop-sdks.
• RFC 0099 — external-event trigger ingestion Accepted. Floor + graduation: the content-free TriggerEvent envelope (ctx.triggerData), the TriggerSubscriptionRegistration create contract served by POST /v1/trigger-subscriptions, the additive triggerBridge.ingestion capability sub-block, and SECURITY invariants trigger-ingestion-ssrf + trigger-ingestion-content-redaction. Graduated on dual live evidence vs suite 1.25.0 (reference openwop-app 00177-75t + non-steward MyndHyve 00271-cj5, both steward-curl-verified, trigger-ingestion.test.ts non-vacuous).
• RFC 0100 — async / durable A2A tasks (Active; floor landed). New a2a capability block ({supported, agentCardUrl, streaming?, pushNotifications?, durableTasks?}) + the persisted A2ATaskState projection (taskId==runId, lowercase-hyphen state) + a2a-integration.md §"Async / durable Tasks" + SECURITY invariant a2a-push-egress-ssrf. Reference leg fully proven (openwop-app a2a-task-roundtrip 10/10 non-vacuous); stays Active pending a non-steward a2a witness.
• RFCs 0096 / 0097 / 0098 — reviewable-learning proposals · standing goals · agent-platform portability Accepted. Floor + dual-live-evidence graduation: agents.proposals (inert proposal.schema.json), agents.goals (judge-based goal.schema.json), the top-level portability block (export-bundle.schema.json, refs-only, dryRun:true when import:true), 5 protocol-tier SECURITY invariants, 5 content-free events. openwop-app reference (00174-6m6, portability.import:true) + MyndHyve non-steward (00269-ljm, honest import:false opt-out).
• RFC 0095 — connection packs Accepted. New kind:"connection" pack (portable signed provider definition the RFC 0045/0047 provider string resolves against) + connection-pack-manifest.schema.json + standalone spec/v1/connection-packs.md + the connection-pack-no-credential-material protocol-tier invariant. Dual evidence (MyndHyve 00268-x9l + openwop-app 00160-kjq).
• RFCs 0093 / 0094 — protocol hardening + wire-shape reconciliation Accepted. 0093 pins four security/correctness gaps (webhook delivery-time egress re-validation + the protocol-tier webhook-cross-tenant-isolation invariant; signed interrupt-token lifecycle; retryable responses MUST NOT replay from the dedup cache; approval-gate timeout auto-rejects). 0094 repairs published-artifact defects (the unsatisfiable createRun schema → unevaluatedProperties:false + a satisfiability probe; cancelling status; vendor-event anyOf closure; single-sourced ai.message.chunk; completed InterruptPayload.kind union; capabilities.grpc + limits.maxRequestBodyBytes).
• RFCs 0090 / 0091 / 0092 Accepted. 0090 — agent verifier turn (agent.verified event, verifier capability, multiAgent.executionModel.version: 6, verifier-no-content-leak); 0091 — multimodal perception input on ctx.callAI (content: string | ContentPart[], gated on aiProviders.input.modalities[]); 0092 — agent-level requiresCapabilities[] projecting to the RFC 0072 degraded[] field.
• RFC 0089 — conformance certification bundle Accepted. The openwop-conformance --certify generator captures discovery (canonical-JSON SHA-256), derives claimedProfiles, records each scenario's terminal state, and never lists a vacuously-run scenario in results.passed; a real reference-host bundle is committed + round-trip-verified.
• Conformance suite — @openwop/openwop-conformance 1.18.1 → 1.25.0 across the cycle (independently versioned, published on its own openwop-conformance/v* tags). Carries the RFC 0089–0100 scenario additions (trigger-ingestion, the async a2a-task-roundtrip subtests, proposal/goal/export-bundle, the five connection-pack scenarios, verifier-gating, callai-multimodal, agent-capability-degraded-projection, webhook-tenant-isolation, version-fold, stream-text-fixture, i18n-negotiation, grpc-transport).
• SECURITY invariants — 114 → 125 total (99 protocol-tier). New across the cycle: verifier-no-content-leak, webhook-cross-tenant-isolation, connection-pack-no-credential-material, the five proposal/goal/export invariants, trigger-ingestion-ssrf, trigger-ingestion-content-redaction, a2a-push-egress-ssrf.
• Reference app (now openwop/openwop-app). Before extraction, the app landed a governed agent-Workforce surface (seeded entity + deterministic synthetic history + metrics/governance/migration-wizard, all under /v1/host/sample/workforces, experimental x-host-openwop-workforce), the white-label foundation batch (deploy-posture gating, brand stamping, .env leak guards, an explicit-?tenantId=* fix that closed a latent cross-tenant GET /v1/agents visibility leak), and a board-rename + guided autonomy level. Operator surface only — no wire change.
• Docs + editorial. Full post-split + post-graduation drift sweeps: status-label normalization onto the Stable / Stabilizing / Draft / Experimental legend, SECURITY/RFC count reconciliation, per-host conformance-evidence suite-version syncs, the INTEROP-MATRIX.md rewrite into a lean public matrix + the GOVERNANCE.md "Acceptance evidence tiers" taxonomy, and post-split path requalification across README/ROADMAP/PUBLISHING. interrupt.md documents suspend as the accepted alias of interrupt (additive, host SHOULD expose both).

---

The largest graduation cycle since v1.0. The entire agent-platform program plus the bulk of the Active-RFC backlog graduated Active → Accepted on a non-steward host (MyndHyve), closing RFC counts to Accepted 85 / Active 1 / Draft 2. All wire shapes additive per COMPATIBILITY.md §2.1 — no schema, event, endpoint, or MUST change. This coordinated release also publishes the agent-platform read surface to the Python and Go SDKs (which had lagged the OpenAPI surface by 17 methods) and a TypeScript SDK minor. The header is 1.1.7 because 1.1.6 was consumed by an earlier TS-SDK-only npm patch. Full per-RFC history is in each RFC's Updated field, INTEROP-MATRIX.md, and the generated docs/PROTOCOL-STATUS.md.

• Agent-platform program Accepted end-to-end (the capstone). RFC 0085 (openwop-agent-platform meta-profile) Accepted, certifying MyndHyve a _full_ agent platform; with 0077/0086/0087/0083 (live manifest dispatch / standing roster / org-chart / durable trigger-bridge) and 0081/0082 (eval suite / deployment lifecycle), the whole program is Accepted on a non-steward host.
• Tool-egress, budget, and memory batches Accepted. RFCs 0078/0079 (portable tool catalog + credential-provenance/egress policy), 0084 (budget/quota/cost), and 0068/0080 (memory consolidation + capability reconciliation) graduated on green, non-vacuous gated behavioral scenarios.
• Enterprise + provider + UX RFCs Accepted. 0050 (SAML/SCIM — a real XML-DSig ACS the steward drove over the live wire for all 7 §A variants incl. signature-wrapping, plus SCIM fail-closed), 0067 (provider-catalog auth-modes), and 0066 (x-openwop-form) + 0065 (outputRole) on genuine reference-frontend consumption.
• Steward-side mechanism-codifications (amended criteria, architect-gated). 0069 (exec-class carve-out — RFC 0054 amendment precedent), 0080 (degraded-memory keystone), and 0042 (experimental capability tier) graduated steward-side, where a non-steward advertisement is structurally impossible or would be a false claim on the wire.
• Core Standard Profile (0088) + capability document-root layout (0073) Accepted. 0088 freezes the black-box-proven stable Core floor (0029 prompt-resolution chain + 0059 workspace isolation graduated into the black-box set); 0073 makes the conformance suite _enforce_ the document-root capability layout.
• Earlier-window graduations. RFC 0076 (pack runtime.requires[] + host ctx.http.safeFetch, §A + §B), 0072 (agent inventory + dispatch normative surface), 0054 (run diff & execution comparison), 0036 (multi-region idempotency + cross-engine ordering), 0025 (test-mode registry namespace), and 0056 (run feedback & annotations) all reached Accepted.
• Real-isolation WASM sandbox reference host (RFC 0035). New examples/hosts/wasm-sandbox/ executes pack-loaded typeIds as WebAssembly; all 7 testable node-pack-sandbox-* SECURITY invariants graduated reference-impl → protocol. RFC 0035 itself stays Active (gated on non-steward adoption by a host that runs untrusted packs).
• Conformance suite hardened + advanced to @openwop/openwop-conformance@1.18.1 (published per-package across this window): the agent-platform behavioral gates hardened against vacuous passes (1.17.0), the gated scenarios for every graduated RFC authored + published, the OTel collector-side BYOK-canary inspector + RFC 0041 §C replay-observable assertions landed, and the SAML behavioral leg expanded to the full 7-variant set.
• External-audit remediation. The corpus gate now blocks on open high/critical external-audit findings; the 2026-05-31 re-review's seven-item bar was mapped to the gap-closure program; multiple stale docs/KNOWN-LIMITS.md rows were retired against landed evidence (multi-region simulation harness, cross-engine CF-8, sandbox-timeout, the open-RFC table).
• New normative read surfaces (deferred Accepted-track). OpenAPI + AsyncAPI + TS SDK surface for the roster/org-chart (0086/0087) and eval/deployment (0081/0082) endpoints; AgentOrgChart Department/Role/Member published as named $defs.
• SDK parity completed across all three reference SDKs + machine-enforced. A parity audit found those agent-platform read surfaces — plus RFC 0078 tool catalog, run diff, and prompt-template CRUD — had reached only the TypeScript SDK. Ported the 17 missing helpers to openwop-client (Python) and the Go SDK, and added tools.list/tools.get + getArtifact across all three. New sdk/parity-expectations.json declares a per-SDK status (typed / excluded) for every OpenAPI operation, and scripts/check-sdk-parity.mjs (openwop:check step 7) fails on any undeclared route or typed-surface regression. sdk/PARITY.md's stale "34/34/34 as of 2026-05-15" headline corrected to 44 typed / 4 excluded (the four packs-test write-mirror operations — a server-side conformance affordance, not a client surface). This release publishes that surface: openwop-client 1.1.7 (PyPI) + github.com/openwop/openwop/sdk/go v1.1.7 finally carry the 17 agent-platform methods, and @openwop/openwop 1.2.0 (npm — a minor, not a patch, because client.prompts.get now returns PromptTemplate | null to match the other get-by-id helpers + the Python/Go SDKs: a 404 resolves to the null sentinel while a 400 prompt_ref_ambiguous still throws, so callers can distinguish "not found" from "ambiguous"). The conformance suite stays at 1.18.1 (no new scenarios). The parity gate also gained a word-boundary per-method symbols check so it catches a single method being deleted from a shared path family.
• Reference-app + host-sample. Agents tab + chat mention-symbol surface, durable read-through host-extension stores, cross-instance Kanban SSE fan-out, and a run of code-review / UX-review follow-ups. Rate-limit 429 envelope conformance (CF-6): the sample host now emits details.scope from the canonical closed enum ("tenant" | "route" | "global" | "key") per rest-endpoints.md §429 instead of internal limiter names (which moved to a non-normative details.reason), and honors OPENWOP_FORCE_RATE_LIMIT=true so the conformance harness can deterministically induce a 429 (rate-limit-envelope.test.ts).
• Registry + packs. core.openwop.http@2.0.0 (RFC 0076 §B safe-fetch consumer) signed + published to the in-tree mirror; tarball-signature gate added + unsigned tarballs yanked; agent-pack source-schema $id bumps.
• Release infrastructure + doc hygiene. Publish jobs are now idempotent — a corpus v* tag skips already-published package versions rather than partial-failing (PUBLISHING.md documents the property). generate-protocol-status.mjs --write self-heals the README corpus counts, retiring the giant-status-line merge bottleneck. The [1.1.6 — unreleased] changelog block was collapsed to release-notes shape + renamed 1.1.7 (1.1.6 was consumed by the TS SDK patch); the committed public/ site was rebuilt + deployed to openwop.dev to surface the graduations; and the INTEROP-MATRIX.md pass-rate header was corrected to mark 1.15.0 as the _last_ re-measurement (the published suite has since advanced to 1.18.1; a full re-measurement is pending).
• OpenAPI agent-path disambiguation (audit response). /v1/agents/{agentId} and /v1/agents/{agentId}/deployments now constrain agentId with pattern: '^(?!roster$|org-chart$).+$', so it can never collide with the sibling collection routes /v1/agents/roster/{rosterId} + /v1/agents/org-chart/{departmentId} (the path the third-party auditor flagged: /v1/agents/roster/deployments was structurally two-way). redocly's purely-structural no-ambiguous-paths rule (which can't see the pattern) is scoped off for exactly those two paths in api/.redocly.lint-ignore.yaml with a documented rationale — the rule stays enabled globally. Non-breaking: roster/org-chart were already reserved/ambiguous as literal agentIds.
• README published-artifact versions corrected. The "v1.x published artifacts" line pinned all four packages at v1.1.0; updated to the actual published versions — @openwop/openwop 1.1.6, @openwop/openwop-conformance 1.18.1, openwop-client (PyPI) 1.1.5, Go modules v1.1.5 — and clarified that the three SDKs hold feature parity even though patch versions diverge (the TS SDK took a 1.1.6 patch for the agent-platform helper surface) and the conformance suite versions independently.
• CLI agent-platform surfaces (@openwop/cli 0.1.2 → 0.2.0). The CLI now drives every demo-app protocol surface it previously lacked: \roster\ (RFC 0086), \org-chart\ (RFC 0087), \kanban\ boards + cards (with an SSE \watch\), \orgs\ orgs/teams/groups/roles/members RBAC + effective-access (RFC 0049), \workspace\ files (RFC 0059 §C real CRUD; the cross-owner test seam is deliberately not exposed), \byok\ secret refs (values never returned), and user-defined-agent \create\/\update\/\delete\ on the \agents\ group. All read commands support \--json\; all destructive commands require \--yes\. Also fixed the stale \--version\ constant (reported 0.1.0 on the 0.1.x package) and the pre-existing \agents run\ flag-parsing bug where \--task-json\/\--no-validate\ never took effect (option keys are camelCased).

Ships the first public release of the OpenWOP CLI to npm, brings channel messaging (Signal · iMessage · WhatsApp · Discord) to feature parity with the in-app AI chat, and closes the agent-manifest-runtime arc end-to-end on a non-steward host. All wire shapes additive per COMPATIBILITY.md §2.1.

• OpenWOP CLI v0.1.0 ships to npm. npm install -g @openwop/cli — a control-plane CLI for any OpenWOP-compatible host (auth onboarding, capabilities, runs + SSE streaming, prompts · memory · agents · interrupts, channel-relay daemons). Operator-side, independently versioned on its own cli/v* SemVer line; published through the existing OIDC publish pipeline with provenance (a new publish-cli job mirrors publish-ts-client). The 4085-line TypeScript bundle runs under strict + noImplicitAny: true; 149 node --test cases gate every release. A new /cli route in the demo app surfaces install + command catalog; a new homepage card on openwop.dev (§01.5 "Try it from your terminal") links the public to it.
• TypeScript + Python + Go SDKs bump 1.1.4 → 1.1.5 in lockstep. Conformance suite moved 1.7.0 → 1.10.0 mid-cycle across 12 net-new scenario files (artifact-type-pack-install, artifact-schema-compile-bounded, chat-card-pack-{execution,manifest-validation}, agent-manifest-runtime, byok-auth-modes, commitment-fired, exec-not-protocol-tier, memory-consolidation-{shape,idempotent}, artifact-type-store-without-render). No wire-shape changes.
• Messaging → AI-chat parity end-to-end. The relay-gateway lands routing enforcement (channel + peer → workflow OR agent), conversation-history threading (OPENWOP_MESSAGING_HISTORY_LIMIT-bounded turn replay), policy + pairing + allowlist + requireMention enforcement, direct agent dispatch as a routing target (with OPENWOP_MESSAGING_AGENT_DISPATCH_TIMEOUT_MS abort guard), and cross-channel identity unification. A code-review hardening sweep added tenant-scoped pairing/allowlist routes, CSPRNG pairing codes, a requireMention deny-all tripwire, defense-in-depth tenant scoping on listMessagingTurns, and a ?limit clamp on the delivery-log route. Postgres migrations 9-13 land on live Cloud SQL via the deploy ladder.
• RFC 0070 + 0072 + 0074 agent-runtime arc closes end-to-end. 0070 (agent-manifest runtime — agents.manifestRuntime) graduated Active → Accepted on MyndHyve production rev workflow-runtime-00394-jun (inventory + dispatch seam wired with toolSurface allowlist filter + attributed agent.reasoned/agent.decided). 0072 (normative GET /v1/agents) shipped. 0074 (tenant-scoped manifest-agent inventory — additive installScope: 'host' | 'tenant') graduated on multi-tenant rev workflow-runtime-00398-vup with steward-curl-verified A→1 agent, B→empty + cross-tenant 404. The 31 agent manifests on the workflow-engine host become runnable via agents.manifestRuntime + AgentRegistry + loader + dispatch.
• RFC 0071 (artifact-type packs + chat card packs) Accepted overall. Phase 1 graduated on MyndHyve Phase-1 adoption (16 → 7 reconciled types served as validated: true, validation: "open", registrationSource: "host"). Phase 2 graduated on Slice-B rev workflow-runtime-00402-bey — the real core.chat.cardExecute → ctx.aiEnvelope.generate binding with host.aiEnvelope advertised + contentTrust: "untrusted" on card-input-derived prompt segments. artifact-type-packs.md + chat-card-packs.md promoted DRAFT → FINAL. Two new SECURITY invariants: artifact-schema-compile-bounded + chat-card-input-trust-boundary.
• RFC 0073 (capability families are document-root properties of /.well-known/openwop) reconciles a contradictory discovery layout. The schema rooted agents / secrets / etc. at the doc root (no capabilities wrapper), but ~40 conformance scenarios + 4 reference hosts read nested — no host satisfied both. RFC 0073 lands a normative MUST + root-first conformance accessor; Phases 1-3 migrate 78/78 capability-gated scenarios; all 4 reference hosts (in-memory, sqlite, postgres, python) emit root + a deprecated-mirror via spread. Phase 4 (drop the wrapper-fallback + nested mirrors) defers to a future minor.
• RFC promotions Draft → Active. 0054 (run-diff — GET /v1/runs/{runId}:diff endpoint + canonical-comparison exclusion list pinned). 0073 (capability-root layout). 0074 (tenant-scoped agent inventory, amends 0072). 0075 (artifact-type-packs real-world adoption amendment, amends 0071 Phase 1 — host-native registration tier, additionalProperties: false MUST → SHOULD, per-type capability facets). Plus RFC 0071 Phase 2 (chat card packs) before its same-cycle promotion to Accepted.
• NEW Draft RFCs filed. 0067 (provider-catalog conventions — additive aiProviders.authModes + provider-name vocabulary). 0068 (memory consolidation + standing commitments — agents.memoryConsolidation / agents.commitments + content-free agent.memory.consolidated / commitment.fired events). 0069 (host-extension safety contract for exec-class tools — normative MUST-NOT carving exec out of protocol-tier + the exec-must-not-be-protocol-tier invariant). All additive.
• Registry hardening. Three published core.openwop.agents.* packs republished as @1.0.1 with their systemPromptRef bodies now bundled — the bundler dropped prompts/ from the tarball at @1.0.0 and an RFC 0003 §C fail-loud host (MyndHyve) correctly rejected them. New scripts/check-pack-prompt-refs.mjs (wired into openwop:check step 7) fails CI at build time if any source pack's systemPromptRef doesn't resolve to a bundlable prompts/ file. Separately: 81 pack-version index.json files corrected to declare the real publisher signing keys (openwop-team-1, myndhyve-internal-1, community-demo) instead of the stale openwop-registry-root default; check-registry-signer-consistency guard added.
• Reference workflow-engine: /readiness reports managed-provider health. When providers.json advertises a managed: true tier (e.g., openwop-free) but its server-held key was never seeded, /readiness returns 503 { status: "degraded", checks: { managedProviders: [...] } } with a per-provider detail naming the env var to set. Catches a dropped/unmounted-secret class of outage at deploy time instead of waiting for the first failed run.
• Honest deferrals + corrections. RFC 0054 (run-diff) stays Active — graduation to Accepted awaits a non-steward host advertising the endpoint. RFC 0072 graduation awaits a second cross-language host. The RFC 0073 wrapper-fallback removal (Phase 4) defers to a future minor. The v1.1.4 tag from 2026-05-26 silently did not trigger the publish workflow (no run record); this v1.1.5 corpus-aligned tag catches the TS SDK / Python / Go / conformance up. DEPLOY.md §6 corrected — the from-scratch --env-vars-file + --set-secrets form was a footgun for live redeploys; safe-redeploy recipe documented separately.
• Site updates. Homepage §01.5 "Try it from your terminal" card on openwop.dev introduces @openwop/cli with a dark-bg install snippet + capabilities list + deep-link to the in-app /cli command catalog. PUBLISHING.md artifact table gains the CLI row noting independent SemVer + cli/v* tag pattern.

Closes the first full week of post-1.1.3 cross-host adoption: the 8-RFC MyndHyve protocol-extension cohort + the 5-RFC autonomous-agent-runtime cohort all reach Accepted on production non-steward implementations, the multi-agent execution-model version: 1-4 ladder closes end-to-end, and three rounds of MyndHyve advertisement land RFCs 0028 / 0029 / 0040 / 0041 / 0055 / 0057. All wire shapes additive per COMPATIBILITY.md §2.1.

• TypeScript SDK 1.1.4 (@openwop/openwop) publishes the RFC 0057 memory.written typed event helper + the round-2 SDK-migration finishers (runsClient / interruptsClient / promptsClient / streamsClient on the published SDK, debug-bundle reverted to SDK after 1.1.3's regression). Python (openwop-client) and Go (openwopclient) bump in lockstep. No wire-shape changes.
• Conformance suite @openwop/openwop-conformance 1.5.0 → 1.6.0 → 1.6.1 → 1.7.0. 1.6.0 ships the 28 RFC 0045–0054 cohort scenarios; 1.6.1 patches a stale secrets.scopes allowlist in redaction.test.ts; 1.7.0 lands the autonomous-agent-runtime cohort coverage (+1 net-new scenario file plus per-RFC behavioral additions). Bundled synthetic SAML IdP fixture lands closing the RFC 0050 deferred conformance gap.
• MyndHyve protocol-extension cohort live in production (8 RFCs Draft → Accepted in one day). RFCs 0045 (connector pack manifest), 0046 (host.credentials), 0047 (host.oauth), 0048 (tenant·workspace·principal identity model), 0049 (RBAC scopes + authorization.decided), 0051 (approval & deployment-gate primitive), 0052 (scheduling & time-based triggers), 0053 (dead-letter routing) all graduated on MyndHyve workflow-runtime revision 00211-69w against @openwop/openwop-conformance@1.6.0 — 28 PASS / 0 FAIL (commit 85275cdf on the MyndHyve side). RFC 0050 (SAML/SCIM) + 0054 (run-diff) stay Draft per documented MyndHyve opt-outs.
• MyndHyve round-3 graduations (3 RFCs Active → Accepted 2026-05-26). Revision workflow-runtime-00217-q7c advertises capabilities.prompts.agentBindings: true (RFC 0029), aiProviders.maxInlineMediaBytes: 10485760 + modelCapabilities.advertised: ['vision-input', 'image-output'] (RFC 0055), and capabilities.memory.attribution.{supported: true, emitsWriteEvents: true} with canonical memory.written event dual-emitted alongside vendor x-host-myndhyve-memory-written (RFC 0057). Curl-verified on https://workflow-runtime-gjw5bcse7a-uc.a.run.app/.well-known/openwop.
• Multi-agent execution-model roadmap CLOSED end-to-end on a non-steward host. RFC 0040 (Phase 3 cross-host causation) + RFC 0041 (Phase 4 replay determinism) graduated Active → Accepted on MyndHyve's multiAgent.executionModel.version: 4 advertisement + replayDeterminism.{supported: true, llmCacheKeyRecipe: "spec-rfc-0041", refusalDivergenceEmission: true} block. The version: 1-4 ladder is fully production-validated; version: 5 (RFC 0061) opens the autonomous-agent-runtime extension.
• Autonomous-agent-runtime cohort (7 RFCs filed + 5 graduated). RFCs 0058 (run-execution bounds), 0059 (agent workspace), 0060 (host.heartbeat), 0061 (stateful agent-loop lifecycle, executionModel.version: 5), 0062 (memory.distillation "dreams"), 0063 (core.subWorkflow.outputAttestation), 0064 (host.toolHooks) filed Draft with Phase-0 architect-decision-batch clearance. Within the cycle: 0059/0060/0062/0063/0064 graduated Draft → Active → Accepted via in-memory reference-host M2 enforcement (each ships the documented POST /v1/host/sample/* seam + all scenarios green); 0058 + 0061 graduated to Active pending second-host M2 enforcement.
• RFC 0028 Tier-2 post-promotion strengthening. Workspace-membership normative + canonical workspace_membership_required 403 envelope error code + 2 new protocol-tier SECURITY invariants (prompt-mutation-workspace-membership-enforced, prompt-read-workspace-membership-enforced), filed in response to a self-disclosed adopter Admin-SDK-bypasses-DB-rules vulnerability — workspace gating now uniformly enforced across write + read paths.
• Reference-host milestones across all four hosts. in-memory: 5 M2 host surfaces (RFC 0059/0060/0062/0063/0064). Postgres: RFC 0026 cost-attribution + RFC 0031 model-capability gate + RFC 0040 Phase 3 cross-host causation + RFC 0056 feedback + RFC 0057 memory.written + RFC 0058 runTimeoutMs enforcement. SQLite: ports RFC 0022 dispatch/subWorkflow + 0026 + 0031 + 0056 + 0057 + 0058 from Postgres. Reference workflow-engine advertises capabilities.memory.attribution.emitsWriteEvents: true + emits on run-summary write. RFC 0031 model-capability gate-decision test seam lands on Postgres flipping the synthetic assertions live.
• Reference-app — 6 plan items closed end-to-end. Items #12 (pre-flight workflow validation against advertised engine limits), #13 (dedicated audit-log viewer page at /runs/:runId/audit), #15 (multi-turn conversation panel consuming conversation.{opened,exchanged,closed} events), #16 (A2A peer placeholder, forward-compat), #20 (Publish-to-registry helper banner), #25 (sticky-note canvas annotations via new clientOnly: true NodeCatalogEntry flag). The app-buildable plan closes at 23 ✅ / 2 🟡 / 0 ❌; the two 🟡 items are structurally unblockable from the openwop side and tracked in docs/myndhyve-round-2-handoff.md. Multimodal renderer (RFC 0055 §C consumer), media-emitting demo node, persistent HITL artifact cards, notification-system rewrite (Web Push + OS notifications + preferences + quiet hours + flagged review queue) all ship in the same cycle.
• vendor.myndhyve.brand@1.1.0 — first non-steward x-openwop-form pack (PR #232). Pilot annotation on brand.persona.discover.config.json adds provider-picker + model-picker { dependsOn: ["provider"] } (RFC 0066 normative cascade-clear). Path-to-Accepted for RFC 0066 unlocks once MyndHyve re-pins the new manifestHash. Bonus: scripts/emit-pin-json.cjs emits the 7-hash pin-block JSON for any registered pack version.
• +8 protocol-tier SECURITY invariants (94 → 102 total; 68 → 70 protocol-tier graduated to gate-verified). New: authorization-fail-closed (RFC 0049), prompt-{mutation,read}-workspace-membership-enforced (RFC 0028 Tier-2 — paired with a self-disclosed adopter vulnerability close-out), media-asset-url-tenant-scoped (RFC 0055), memory-attribution-{no-content,tenant-scoped} (RFC 0057), workspace-cross-tenant-isolation (RFC 0059 M2), subrun-merge-approval-fail-closed (RFC 0063 M2). Every protocol-tier MUST-NOT has at least one public test in conformance/src/scenarios/.
• NEW Draft RFCs filed (12). 0050 (SAML/SCIM enterprise identity profiles), 0054 (run-diff & execution comparison), 0055 (multimodal envelope variants), 0056 (run feedback & annotations), 0057 (memory write-attribution), 0058–0064 autonomous-agent-runtime cohort (run-execution bounds / agent workspace / heartbeat / stateful agent-loop / memory.distillation / subWorkflow attestation / host.toolHooks), 0065 (workflow node primary-output annotation — advisory outputRole: "primary" | "secondary" for chat-surface deterministic-artifact picking), 0066 (x-openwop-form vendor extension on pack configSchema).
• Honest non-graduations + opt-outs. RFC 0058 wall-clock arm took two rounds — MyndHyve initially advertised maxNodeExecutions in error, honestly retracted via docs/openwop-adoption/rfc-0058-round-3-retraction.md, then landed the real arm on 2026-05-26 (limits.maxRunDurationMs: 600000 now advertised; maxLoopIterations: null honestly absent — host attests run-create clamping + canonical cap.breached { kind: 'run-duration' } emission). RFC 0058 stays Active pending second-host adoption. RFC 0035 (sandbox), 0036 (multi-region), 0050 (SAML), 0054 (run-diff) opt-outs documented at docs/openwop-adoption/round-3-closure-2026-05-26.md with re-evaluation criteria. RFC 0058 round-3 closure agreement loop documented at docs/openwop-adoption/rfc-0058-round-3-retraction.md.
• Multi-agent "Phase N" → version-tagged rename + site regenerated. External-facing prose drops internal "Phase N" labels for the multi-agent execution model in favor of the wire-shape version: N identifier (per the 2026-05-24 external-reader feedback). Site openwop.dev/spec/v1/* regenerated to pick up RFC 0045–0057 + cohort promotions + 404 page (PR #164). Reference-app SDK migration finished — runsClient / interruptsClient / promptsClient / streamsClient all on the published SDK (cookie-mode SSE stays on native EventSource pending an SDK credentials: 'include' hook).

Closes the workflow-engine reference-host pass-rate inflation that the 2026-05-22 external standards-readiness review flagged, lands first non-steward host adoption of four RFCs, and ships the Phase 4 behavioral harness end-to-end. All wire shapes additive per COMPATIBILITY.md §2.1.

• TypeScript SDK 1.1.3 (@openwop/openwop) publishes coordinated parseRefusal() + buildReasoningDirective() helpers. Python (openwop-client) and Go (openwopclient) bump in lockstep. No wire-shape changes.
• Workflow-engine reference host pass-rate 80.9% → 95.5% via two bundled-path bugfixes (envelopeAcceptor.ts schema lookup + promptStore.ts/promptCompose.ts fixtures lookup) — both cases of __dirname + '..' × N overshooting under the esbuild-bundled tree. New shared _repoPath.ts::locateRepoDir() helper + 5-test regression guard. The inflated 129-failure number was a cascade from a single ENOENT crash, not 129 real conformance gaps.
• RFC 0041 §B Phase 4 closes — replay-divergence-at-refusal executor wiring lands the last it.todo from the 5-track audit harness. The workflow-engine's :fork mode: replay path now emits replay.divergedAtRefusal and fails with error.code: 'replay_diverged_at_refusal' when an envelope kind diverges between source and replay (both directions). Gated on OPENWOP_MULTI_AGENT_EXECUTION_MODEL_PHASE_4=true. RFC 0041 path-to-Accepted opens (gate: second host advertising multiAgent.executionModel.version: 4).
• Phase 4 behavioral harness — Tracks 1/2/5/6/7 + RFC 0042 close. Three new HTTP test-seam endpoint families on the reference workflow-engine drive five new conformance scenarios: multi-region partition simulator, cross-engine append-ordering harness, sandbox MVP (7-of-8 RFC 0035 §B invariants), secret-leakage OTel-attribute coverage, RFC 0042 experimental-tier shape probe. Suite scenario count 205 → 210. NEW spec/v1/host-sample-test-seams.md §6–§8 documents the new seams normatively.
• First non-steward cross-host adoption. MyndHyve (api.myndhyve.ai) ships Tier-1 advertisements for RFC 0021 (envelope), RFC 0027 (prompt templates with observability: 'full'), RFC 0028 (read-only prompt library), RFC 0029 (override hierarchy, node layer), RFC 0034 (OTel test seam, empty-buffer Tier-1), RFC 0039 Half B (memory lifecycle MAE-2 + MAE-3, crossChildMemoryConcurrency: 'strict'), RFC 0040 Sub-5b (MCP API-key auth). Verified live against /.well-known/openwop.
• RFC promotions Active → Accepted (5 total this release): 0027 (prompt templates) — first non-steward prompts.supported: true + observability: 'full'; 0034 (OTel collector test seam) — first non-steward Tier-1 seam-shape adoption; 0037 Phase 1 (multi-agent execution model) — first vendor-neutral validation signal; 0039 Half A (multi-agent confidence + memory lifecycle) — cross-host evidence via MyndHyve commit c4342b5b against suite v1.5.0; 0044 (confidence-escalation interrupt-kind advertisement, clarification to RFC 0039 §A).
• NEW Draft RFCs. 0042 (experimental capability tier — tier ∈ {stable, experimental} + experimentalUntil ≤ 12-month sunset + derived openwop-experimental profile + conformance soft-skip routing under default mode). 0043 (registry + extension policy + IPR posture — consolidates DCO + Apache-2.0 + CC-BY-4.0 + namespace reservation rules).
• Vendor-namespace pattern locked. MyndHyve picked Option 1 (x-host-myndhyve-memory-written) per host-extensions.md §"Canonical prefixes" for host-private SR-1 audit events. Preserves wire-shape compat with strict RunEventType validators; the canonicalize-via-RFC path stays open for any second host that wants the same shape.
• Honest correction — registerHostSampleRoutes wire-up bug. MyndHyve's /v1/host/sample/* routes were deployed for days but never wired into the runtime (404 in production until commit 60b569de). Four seams affected (RFC 0027 §E compose, RFC 0041 §A cache-key, RFC 0021 envelope-accept, RFC 0034 OTel scrape). All four now exercisable end-to-end; RFC 0027 status stays Accepted (the advertisement was real; the bug was wire-up, not logic).
• Audit response artifacts. NEW docs/AUDIT-RESPONSE-2026-05.md (point-by-point reply to the 2026-05-22 external review with calendar tripwires). NEW docs/CONFORMANCE-RUNS-2026-05.md (re-measurement of all 4 reference hosts against @openwop/openwop-conformance@1.4.0 + per-failure taxonomy). NEW docs/PHASE-4-PROGRESS.md (Phase 4 close-out accountability with closing-commit citations).
• Conformance suite 1.4.0 → 1.5.0. RFC 0044 vendor-kind routing relaxation splits one strict-equality assertion into discrete it() blocks (+6 tests, +6 passes). Postgres 1473/1564 (94.2%), SQLite 1486/1564 (95.0%), in-memory 1445/1564 (92.4%), Python 1387/1564 (88.7% total / 100% of applicable).
• Reference workflow-engine + sample-app polish. Real-LLM default in the builder (vendor.openwop-sample.chat-responder replaces the deterministic mock-ai node + managed openwop-free credential tile by default); Copy/Export buttons on the event-stream view; Cloud Run deploy-plumbing close-out (vendored schemas/ + dual-mount conformance-fixtures/ so the bundled host resolves sibling-repo paths under /app/lib); .gitignore for harness runtime state (.db-shm/.db-wal, .byok-master-key, host-fs/).
• Site shipped at openwop.dev (2026-05-21). 13 new content pages + REST API explorer (Redoc) + AsyncAPI + gRPC transport explorers + JSON-LD TechArticle structured data on every spec doc. Star-on-GitHub CTA in the marketing footer.

---

The first patch release after v1.1.1 closes every gap from the 2026-05-19 → 2026-05-21 batch covering the envelope LLM-contract-hardening RFCs, the prompt-library track, the dispatch primitives, the multi-agent execution model, the agent-pack catalog, and the marketing-site launch at openwop.dev. All wire shapes additive per COMPATIBILITY.md §2.1.

• TypeScript SDK 1.1.2 (@openwop/openwop), Python (openwop-client), Go (openwopclient) all bump in lockstep. Conformance suite @openwop/openwop-conformance 1.1.1 → 1.4.0 over the release window (1.2.0 / 1.3.0 / 1.4.0 minor bumps for new behavioral scenario families).
• Marketing site shipped to openwop.dev (2026-05-21). First public surface for the protocol. Multi-page spec corpus rendered from spec/v1/*.md, demo card, Star-on-GitHub CTA. Companion app.openwop.dev workflow-engine sample app deployed in parallel.
• spec/v1/ai-envelope.md DRAFT → FINAL v1.1 (2026-05-18). Closes the AI Envelope specification gap that was the largest remaining v1.0-era hole. Normative for envelope-acceptor wire shape, refusal kinds, capability stacking, and SR-1 secret redaction.
• Envelope-hardening track (RFCs 0030–0033) filed + promoted Draft → Active → Accepted in 4 days (2026-05-20 → 2026-05-21). 0030 envelope reasoning field + Tier-1 structured-output subset. 0031 envelope variant discrimination + model-capability declarations. 0032 envelope-reliability run-event vocabulary. 0033 envelope-completion contract (truncation vs schema-violation retry routing). Reference-host emission landed in dispatchStructured(); conformance scenarios cover all four RFCs end-to-end.
• Prompt-library track (RFCs 0027 / 0028 / 0029) filed Draft + promoted Active (2026-05-19 → 2026-05-20). RFC 0027 (prompt templates) reference-host implementation + Phase A wire shape + 4-kind dispatch wiring + slotIndex correctness. RFC 0028 (prompt library endpoints) reference-host /v1/prompts* endpoints + PromptStore + example prompt pack. RFC 0029 (prompt override hierarchy) four-layer resolver + /v1/host/sample/prompt/resolve seam. RFC 0027 §F shared divergencePoint schema diff.
• Multi-agent track filed Draft. RFC 0035 (sandbox execution contract), RFC 0036 (multi-region + cross-engine), RFC 0037 (multi-agent execution model Phase 1 — first vendor-neutral validation tripwire), RFC 0039 (multi-agent Phase 2 confidence-floor escalation + memory lifecycle MAE-2/MAE-3), RFC 0040 (Phase 3 cross-host causation), RFC 0041 (Phase 4 replay determinism under nondeterministic models). RFC 0037 Phase 1 promoted Draft → Active same day with reference-host wiring + behavioral conformance.
• RFC 0034 (OTel collector test seam) filed Draft → Active (2026-05-21). Replaces the failed POST-based shape with a GET-based scrape after the standards-readiness review surfaced the POST→GET reconciliation gap.
• RFC promotion cohort Active → Accepted (15 RFCs): 0013 (workflow-chain packs — Draft → Active → Accepted same day on Phase 4 in-tree example landing); 0014–0021 graduation cohort (8 capability RFCs — behavioral conformance via opt-in test seam); 0022 (core.dispatch + core.subWorkflow runtime variable mapping — Postgres reference impl + dispatch trio); 0023 (conformance agent-event emitters); 0024 (streaming agent.reasoned deltas + SDK typed-helper rollout); 0026 (provider.usage event — filed Draft → Active → Accepted same day); 0030 / 0031 / 0032 / 0033 envelope-hardening track promoted Active → Accepted at the close of the release window.
• 5 new Draft RFCs filed against the 2026-05-21 standards-readiness review findings. Each maps to a specific audit finding; full close-out lands in 1.1.3's Phase 4 harness work.
• Agent pack catalog (4 tiers, 28 packs total). Phase 1 — Tier 0/1 foundations (9 packs). Phase 2 — Tier 2 productivity skills (5 packs). Phase 3 — Tier 3 vertical agents (10 packs). Phase 4 — Tier 4 crews + skills-bridge (4 packs). Catalog seeded with reference manifests + signing material for downstream registry publication.
• **17 core.openwop.* packs published to packs.openwop.dev** under steward-internal pre-audit (2026-05-17). First non-trivial registry population. Includes pre-publication triage finding: core.openwop.http@1.1.2 (idempotency-key generator made deterministic), core.openwop.data@1.2.1 + core.openwop.crypto@1.0.2 (correctness fix for nodes mis-declared as pure), core.openwop.ai@1.1.1 + core.openwop.crypto@1.0.3 (defensive parsing of model output + JWT shapes), core.openwop.ai@1.1.2 + core.openwop.mcp@1.1.1 (UNTRUSTED-marker discipline on ctx.trustBoundary='untrusted' runs), core.openwop.agents@1.0.1 (raw-JS tool handler — closes OPENWOP-AUDIT-2026-003). Old core.openwop.ai@1.1.1 + core.openwop.mcp@1.1.0 marked deprecated.
• Pack patches: SSRF + JWT alg-confusion fixes (P0.1) (2026-05-17). Yank-and-republish on the affected versions.
• Workflow-chain packs (RFC 0013) — Phases 1–4 land in sequence. Reference example at examples/branching-workflow/. Phase 4 in-tree example demonstrates chain-pack composition end-to-end.
• apps/workflow-engine@P3 — Firebase Auth signup + Cloud SQL persistence + KMS-encrypted BYOK (2026-05-17). Production rollout fixes (post-mortem) (2026-05-18). First fully-managed reference deployment serving as the app.openwop.dev surface.
• Workflow-engine sample app — 30+ feature commits covering: BYOK canary echo node + provisioning, core.channelWrite + append-with-TTL reducer, capability_not_provided refusal contract, idempotency body-hash mismatch, quorum-aware approval gate, recursionLimit + conversationPrimitive refusal, core.subWorkflow executor + variable mutation seam, JSON content negotiation, getWorkflow endpoint + strict streamMode validation, bulk-cancel endpoint + idempotency replay header, MCP discovery shape + approval resume validation, fixture input-port → variable resolution, credential-shape redaction, cache hit semantics + debug-bundle endpoint, fs absolute-path rejection + kv.cas canonical shape, events/poll lastSequence + SSE bufferMs aggregation, prompt-library UI staging, managed "Try it free" provider tile, RFC 0022 dispatch cluster, parent/child cancel-cascade interrupt profile, external-event interrupt support, AI chat viewport-lock + Lucide thumbs icons.
• Storage adapter parity harness — SQLite vs Postgres via pg-mem (2026-05-18) + real Postgres via @testcontainers/postgresql for end-to-end behavioral fidelity. Closes the storage-adapter parity gap from the v1.1.0 close-out.
• Conformance close-outs: 7 aiEnvelope. scenarios graduated from shape probes to behavioral assertions (2026-05-18); agent.toolReturned causationId pairing tightened; envelope-track it.todo placeholders drained (sub-tracks E + E2 + A.reasoning-redaction); OPENWOP_REQUIRE_BEHAVIOR wired across the prompt-\ scenario family; soak-gate close-out (opt-out axes + SQLite artifact stub).
• Untrusted-content propagation, persisted envelope-correlation dedup, downstream-LLM untrusted-content wrap, envelope-contract capability stacking refusal, approval-gate trust-boundary refusal — five protocol-tier behavioral hardening rows close in the sample-host (2026-05-19).

---

Six additive commits landed on main after the v1.1.0 release tag. None changes a wire shape; all ship in a 1.1.1 patch when the registry SDKs are next published. Two close adopter-experience footnotes (lockfile demo + community pack re-sign), one closes a conformance-probe scope limit (MCP transports), and three close the RFC-process self-acceptance loop (0008 promotion + node-packs §WASM cross-link, 0001 promotion + CHANGELOG status drift fix).

• Workspace lockfile demo (daeaef5) — examples/core-packs-lockfile/openwop-pack-lockfile.json + README pins the 4 audit-gated core packs (core.openwop.{ai,http,mcp,triggers}@1.0.0) using the pack-lockfile schema. Demonstrates SRI integrity + Ed25519 signature material for offline / air-gapped resolution. Closes the controllable half of the "build + sign + lockfile in-tree" Phase E task; the audit-blocked half (publication to packs.openwop.dev) remains gated on SECURITY/external-audit-engagement.md §2.1.
• community.openwop-team.demo re-signed (0bf08cc) — Option-B reconciliation of a 3-way signing-identity drift. The demo pack now ships signed by community-openwop-team-demo-1 (over canonical pack.json) instead of openwop-registry-root (over tarball), matching PACKS-MVP-PLAN.md §211's per-tier-key intent and illustrating the per-publisher-identity pattern. New registry/keys/community-openwop-team-demo-1.pub + signingKeys[] entry in registry/.well-known/openwop-registry.json (namespace-scoped to community.openwop-team.demo only — cannot sign for core. or vendor.). Canonical verifier (registry/scripts/verify-signatures.mjs) passes 29/29.
• MCP probe scope-limit footnote closed (beb5ae6) — all three MCP transports now verified end-to-end against @modelcontextprotocol/sdk@1.29.0. SSE-streamed responses verified via the same SDK without enableJsonResponse (probe's existing readSseUntilId correlates frames by JSON-RPC id). Stdio transport — HTTP-incompatible by design — exercised via the new examples/mcp-stdio-bridge/ shim that wraps any newline-delimited-JSON-RPC stdio server as HTTP for the probe (bundled echo-stdio-server.mjs + per-session-id child-process lifecycle; 2/2 pass). INTEROP-MATRIX.md §"Composition partners" MCP row + spec/v1/mcp-integration.md §"Conformance + interop" + docs/PROTOCOL-GAP-CLOSURE-PLAN.md Track 6 all updated to retire the previous scope-limit language.
• RFC 0008 (WASM ABI) promoted Active → Accepted (6118cce, 2026-05-13) — all 8 acceptance-criteria items satisfied. The one previously-stuck gap (spec/v1/node-packs.md §"WASM runtime" cross-link) landed in the same commit with a 6-scenario coverage table mapping each wasm-pack-*.test.ts to its RFC 0008 anchor. The previously-stale Open spec gaps row NP1 — WASM ABI for language: wasm packs flipped to ✅ closed. README + CHANGELOG status banners refreshed to reflect 0008/0009/0010/0011 all Accepted.
• RFC 0001 (RFC process) promoted Active → Accepted (20e0d1c, 2026-05-13) — closes the meta-RFC's self-acceptance loop. All 6 acceptance-criteria items confirmed: RFCS/README.md + 0000-template.md + this file shipped together; GOVERNANCE.md cross-references RFCS/ at five locations; CHANGELOG.md records the RFC process landing; rfc PR label created in the public repo (#5319e7 purple, description references the process RFC). Subsequent normative additions land under standard RFC review rather than the bootstrap waiver pattern. Same commit fixed CHANGELOG status drift for RFCs 0009/0010/0011 (had been stale at Active even though all three were promoted to Accepted 2026-05-12).
• Final RFC ladder state (2026-05-13): RFCs 0001–0011 all Accepted (11 total). 0000 is the template scaffold; 0012 (memory compaction) is parallel-session Draft. Every RFC with a satisfied acceptance checklist is now promoted.
• RFC 0012 (Memory Compaction Profile) Active → Accepted (2026-05-15) — comment window waived per CONTRIBUTING.md §"Bootstrap-phase notes" (sole-steward repo, no non-steward maintainer of record, no external commenters during the 48h the window was open). All 6 acceptance criteria satisfied at promotion time. RFC ladder state: 0001–0012 all Accepted (12 total). 0000 is the template scaffold. Future RFCs revert to the canonical 7-day comment window once MAINTAINERS.md lists a non-steward maintainer.
• RFC 0012 (Memory Compaction Profile) Phase 3 prep landed 2026-05-14 (promoted to Accepted 2026-05-15 under the bootstrap waiver above):

- Reference host — examples/hosts/postgres/src/memory-adapter.ts gains runCompaction + applyCompactionRedaction + REFERENCE_COMPACTION_CAPABILITY. Server.ts conditionally advertises capabilities.memory.compaction when OPENWOP_MEMORY_COMPACTION=true and exposes the test seam at POST /v1/test/memory/{seed,compact} when OPENWOP_TEST_TRIGGER_COMPACTION=true. SR-1 carry-forward (RFC 0012 §D) honored by re-substituting [BYOK:...] form-leaks + non-canonical <REDACTED:...> markers with [REDACTED:carry-forward-<n>] BEFORE the derived entry persists. Output entries carry the compacted-from:<id> provenance tag per §C. - 3 conformance scenarios — memory-compaction-event-emitted.test.ts (canonical §B payload shape), memory-compaction-sr1-carry-forward.test.ts (load-bearing §D — replaces the Phase 2 it.todo() stub), memory-compaction-provenance-tag.test.ts (soft assertion on §C). All three gate on capabilities.memory.compaction.supported + test seam reachability. 3/3 pass live against the Postgres reference host. - Host smoke — examples/hosts/postgres/test/memory-compaction.test.ts verifies 7 paths end-to-end (advertisement + seed + compact + outputId readability + SR-1 §D + provenance + empty-noop).

• RFC 0012 (Memory Compaction Profile) Draft → Active (2026-05-13) — opens the 7-day public comment window (closes 2026-05-20). New optional capabilities.memory.compaction advertisement + memory.compacted canonical event + SR-1 carry-forward invariant for any host that distills short-lived MemoryEntry rows into longer-lived ones. Additive per COMPATIBILITY.md §2.1.
• Tarball-fetch + signature-verify roundtrip vs packs.openwop.dev (2026-05-13) — conformance/src/scenarios/registry-public.test.ts gains a 4th describe block that fetches core.openwop.examples@1.0.0's tarball + .sig + publisher public key from the live registry, asserts SRI integrity matches a fresh SHA-256 of the tarball bytes, and runs Ed25519 verification per node-packs.md §"Signing recipe" (method=ed25519 signs the whole tarball). Closes coverage.md row 34's "Remaining: tarball-fetch + signature-verify roundtrip" gap. 6/6 tests pass against live packs.openwop.dev.
• Strict-mode opt-out signaling (2026-05-13) — new OPENWOP_OPTED_OUT_PROFILES=name1,name2 env var consumed by conformance/src/lib/behavior-gate.ts distinguishes "host opted out (honest minimal posture)" from "host claims but doesn't deliver (bug)". Strict mode (OPENWOP_REQUIRE_BEHAVIOR=true) skips opted-out profiles with a "honest opt-out" log line instead of failing. SQLite + Python reference hosts can now achieve strict-mode green without falsifying capability claims. Advertise + opt-out conflict surfaces a loud warning so typos don't mask real bugs.
• Batch A — adopter-facing prose refresh (2026-05-13):

- examples/hosts/postgres/conformance-full.md + INTEROP-MATRIX.md re-measured against suite v1.1.0 with conditional-profile env vars: 781/850 (91.9% total, 95.2% of non-todo, 96.4% of applicable) — up from 728/797 the prior measurement. +53 scenarios + +53 passes net of Phase H/I capability surfaces + 9 stage5 vendor packs. One failure remains: documented webhook-signed-delivery flake (passes in isolation; full-suite timing collision). - docs/migration/v1.0-to-v1.1.md — new adopter-facing "what's new" guide. Documents v1.1 as purely additive per COMPATIBILITY.md §2.1: every v1.0 conformance pass remains valid, no code changes required for v1.0 implementations. Per-capability sections walk through Phase H (BYOK / AI providers / MCP / HTTP / cap-breach kinds) + Phase I (memory / agents / auth profiles) + Phase G (spec-corpus close-out) with cross-links to RFCs + conformance scenarios. Linked from README.md §"Document index". - ROADMAP.md §"v1.2 outlook (projected)" — new gate-conditioned projection of v1.2 candidates: RFC 0012 memory compaction, WASM Component Model sub-RFC, Rust SDK v0.1 (demand-gated), 4 audit-gated core.openwop.* packs, cross-host SSE replay, mTLS termination on Postgres, multi-region idempotency end-to-end fixture. Each item carries its specific gate (RFC comment window / external audit / capability flag / adopter ask) — no fixed calendar; items move to next minor or Withdrawn if no signal. - sdk/python/QUICKSTART.md + sdk/go/QUICKSTART.md — new 5-minute end-to-end walkthroughs that boot the in-memory reference host on your laptop, run a workflow against it, and read the event log. Both READMEs link to the new quickstarts.

• Batch C — conformance coverage close-outs (2026-05-13):

- Multi-region idempotency convergence-rule resolver (Track 13) — new examples/hosts/postgres/src/multi-region.ts ships the canonical algorithm for idempotency.md §"Multi-region idempotency" §"Convergence rule": lex-min(runId) wins, losers get run.cancelled { reason: 'cross_region_dedup_loss' }, every region's cache redirects to the winning runId. Pure function — same inputs → same outcome regardless of caller order, region, or wall clock; two regions running the resolver independently arrive at the same survivor without coordination. Smoke test (test/multi-region-idempotency.test.ts) verifies 6 paths including label-determinism for the operator-tier openwop.idempotency.cross_region_conflicts_total counter. Conformance scenario (multi-region-idempotency.test.ts) extended to also verify that hosts claiming crossRegion: 'best-effort' or 'strict' advertise the operator metric per §"Operator surface". The Postgres reference host stays single-region (crossRegion: 'single-region'); the resolver is operator-adoption-ready for any future multi-region host. - Cross-host trace-context propagation across core.subWorkflow (Track 11 remaining row) — new conformance/src/scenarios/otel-trace-propagation-subworkflow.test.ts closes the previously-partial gap on coverage.md row 52. Asserts: when a parent run is started with an inbound traceparent and contains a core.subWorkflow node, the dispatched child run's spans MUST share the parent's traceId. Distributed traces stitch across the dispatch boundary without operator-side correlation hacks. Gates on capabilities.observability + conformance-subworkflow-parent fixture advertisement + OPENWOP_OTEL_COLLECTOR=true. coverage.md Observability row + per-scenario row both flipped to A (full coverage).

• Batch B — Postgres reference host additive surfaces (2026-05-13):

- Phase I.2 reasoning-event emission wiring — Postgres host's core.llm.chat / core.llm.completion executors now emit agent.reasoned (verbosity-gated per RunOptions.configurable.reasoningVerbosity → host default fallback "summary" with 512-token cap) + agent.decided (confidence ∈ [0,1]) after a successful AI-proxy call. core.mcp.toolCall emits agent.toolCalled BEFORE the call (carrying argumentsSha256) and agent.toolReturned AFTER (paired via shared callId, with outcome.{resultSha256,resultLength,isError,durationMs} on success or error.{code,message} on failure). SR-1 + MCP-1 preserved end-to-end: only SHA-256 digests + lengths + outcome flags appear on payloads — never raw tool arguments or result content. Verified by examples/hosts/postgres/test/reasoning-event-emission.test.ts via two new host-private fixtures (loaded through the OPENWOP_EXTRA_FIXTURES_DIR test seam — these typeIds are implementation-specific and not yet protocol-normative). - Phase I.7 mTLS termination — Postgres host now claims openwop-auth-mtls end-to-end when OPENWOP_MTLS_CERT_PATH + OPENWOP_MTLS_KEY_PATH are set. HTTP listener switches to node:https.createServer({ requestCert: true, rejectUnauthorized: OPENWOP_MTLS_REQUIRED !== 'false' }); OPENWOP_MTLS_CA_PATH is optional (when present, only client certs signed by that CA bundle pass the handshake). Discovery emits capabilities.auth.mtls.{supported: true, required: <bool>, subjectMapping: 'cn'} only when configured (honesty principle). Verified end-to-end by test/mtls.test.ts (advertisement shape + valid-cert 201 + no-cert TLS handshake rejection). The existing conformance/src/scenarios/auth-mtls.test.ts now flips from "Not claimed" to a verified positive path when the Postgres host is launched with OPENWOP_MTLS_* configured.

---

The close-out release for v1.0. The protocol contract was frozen on 2026-05-08 (see the spec-freeze entry below) and first published as v1.0.0 on 2026-05-11 (see entry below). This 1.1.0 release closes every controllable gap from the 2026-05-10 deep-dive review and the 2026-05-12 architectural re-evaluation, hardens the Postgres reference host to production-runtime parity, and lands 18 additive feature surfaces (Phase H launch-blockers + Phase I enterprise-blockers).

All changes in this release are additive per COMPATIBILITY.md §2.1 — no existing required fields changed type or optionality, no event-type shape changed, no endpoint contract relaxed, no existing MUST weakened. Hosts that were v1.0.0-compliant remain v1.x-compliant; this release just adds new capability surfaces that hosts may now advertise + new conformance scenarios that gate on those advertisements.

Per-track closure status is tracked in docs/PROTOCOL-GAP-CLOSURE-PLAN.md (archived 2026-05-12); per-host conformance evidence lives in examples/hosts/*/conformance.md + INTEROP-MATRIX.md.

Spec corpus state

• 29 prose specs at Status: FINAL v1. Zero DRAFT / STUB / OUTLINE tags remain. New additions since 2026-05-08 freeze: auth-profiles.md, capabilities-change-detection.md, grpc-transport.md, i18n.md, compliance.md, host-capabilities.md, production-profile.md, replay.md retention/expiry annex, node-packs.md lockfile + Component-Model annexes.
• 22 first-class JSON Schemas under schemas/, all JSON Schema 2020-12 with $id at https://openwop.dev/spec/v1/<name>.schema.json and additionalProperties: false on every object. New: agent-manifest, agent-ref, memory-entry, memory-list-options, audit-verify-result, pack-lockfile, orchestrator-decision, dispatch-config.
• OpenAPI 3.1 (api/openapi.yaml) — every endpoint has operationId + tags + ≥ 1 error response; every schema referenced via cross-file $ref. Lints clean under redocly lint. New operations: verifyAuditLog, bulkCancelRuns.
• AsyncAPI 3.1 (api/asyncapi.yaml) — every channel binds to a message + payload schema reference. Lints clean under asyncapi validate.
• gRPC transport profile (api/grpc/openwop.proto + spec/v1/grpc-transport.md) — canonical openwop.v1.Engine service; profile-gated via capabilities.supportedTransports: ["grpc"].

RFCs landed

• RFC 0001 — RFC process itself (Accepted).
• RFC 0002 — Agent identity + reasoning events (Accepted).
• RFC 0003 — Agent packs (Accepted).
• RFC 0004 — Memory layer + MemoryAdapter contract (Accepted).
• RFC 0005 — Conversation as run primitive (Accepted).
• RFC 0006 — Orchestrator-supervisor role (Accepted).
• RFC 0007 — core.dispatch core node (Accepted).
• RFC 0008 — WASM ABI (Accepted 2026-05-13) + Component-Model variant annex.
• RFC 0009 — Production-profile conformance (Accepted 2026-05-12).
• RFC 0010 — Auth-profile conformance + v1.0 closure umbrella (Accepted 2026-05-12).
• RFC 0011 — Auth-scoped discovery (Accepted 2026-05-12).

Multi-Agent Shift (RFCs 0002–0007 + RFC 0008)

• Phase 1 — AgentRef wire shape; agent.reasoned / agent.toolCalled / agent.toolReturned / agent.handoff / agent.decided events; confidence escalation contract (CP-1); message reducer.
• Phase 2 — Agent capability discovery on /.well-known/openwop; pack.json agents[] extension; agent-pack manifests.
• Phase 3 — Agent memory layer: memoryRef resolution + redaction (SR-1) + cross-tenant isolation (CTI-1) + host MemoryAdapter contract.
• Phase 4 — Conversation as run primitive: conversation.start / conversation.exchange / conversation.close suspend variants.
• Phase 5 — Orchestrator-supervisor: core.orchestrator.supervisor typeId + OrchestratorDecision schema + runOrchestrator.decided event.
• Phase 6 — core.dispatch core node: conservative dynamic graph mutation (CP-2); causationId propagation per RFC 0007 §E.
• WASM ABI — RFC 0008 Active; reference Rust pack at examples/packs/rust-hello/ (28 KiB wasm32); Wasmtime-free loader at examples/hosts/in-memory/src/wasm-loader.ts; six conformance scenarios; deliberately-misbehaving packs for memory-cap (examples/packs/rust-misbehaving-memory/) and ABI-mismatch (examples/packs/rust-misbehaving-abi/) positive-path testing. Schema extension: capBreached.kind enum gained wasm-memory, wasm-fuel, wasm-execution-time (RFC 0008 §K). New optional capability capabilities.nodePackRuntimes.wasm.loadedPacks[] surfaces accepted pack names; rejected packs (declared ABI not in abiVersions[]) MUST be absent — drives the conformance positive path since rejection happens at load time before any node-invoke surface.
• OTLP/gRPC collector (Track 11 closure) — conformance/src/lib/grpc-framing.ts (hand-rolled length-prefixed gRPC HTTP/2 framing, zero npm deps) + OtelCollector.startGrpc() (parallel node:http2 server, shared spans/metrics store). New optional capability capabilities.observability.otel.exportProtocols[] advertises the supported OTLP transports (http/json, http/protobuf, grpc); spec/v1/observability.md gains a §"Export protocols" normative section. New conformance scenario otel-emission-grpc.test.ts gates on the array. Opt-in via OPENWOP_OTEL_COLLECTOR_GRPC=true (default port 4317).

Capability surfaces

Hosts advertise optional behaviors at /.well-known/openwop. New capability blocks added between 2026-05-08 and 2026-05-12:

• capabilities.runs.{pauseResume, bulkCancel} — pause/resume + bulk-cancel endpoints.
• capabilities.webhooks.{supported, signatureAlgorithms} — HMAC v1 signing ({timestamp}.{rawBody}).
• capabilities.secrets.{supported, scopes, resolution} — BYOK secret resolution (host-managed).
• capabilities.aiProviders.{supported, byok, policies} — AI provider routing with 4-mode policy enforcement (disabled / optional / required / restricted).
• capabilities.mcpClient.{supported, transports, trustBoundary} — MCP tool invocation; trustBoundary: "untrusted" per threat-model-prompt-injection.md §UNTRUSTED.
• capabilities.httpClient.{supported, methods, ssrfGuard, maxResponseBodyBytes} — universal core.http.request typeId with SSRF guard.
• capabilities.memory.{supported, maxEntrySizeBytes, ttlSupported} — MemoryAdapter read-side contract per RFC 0004.
• capabilities.agents.{supported, profile, modelClasses, orchestratorPattern, memoryBackends, orchestrator, dispatch, reasoning} — Multi-Agent Shift Phase 1–6 advertisement.
• capabilities.auth.{profiles[], rotation, oauth2, oidc, auditLogIntegrity} — auth-profile advertisement (rotation; OAuth2-CC; OIDC user-bearer; audit-log integrity).
• capabilities.discovery.authScoped.{supported, mode} — RFC 0011 same-endpoint auth-scoped discovery.
• capabilities.production.{supported, backpressure, retention, debugBundle} — production-profile claim (RFC 0009).
• capabilities.observability.{otel, metrics} — OTel emission with openwop.{run.backlog, queue.depth, run.duration} metrics; OTLP/HTTP-JSON + OTLP/HTTP-protobuf encodings supported.

Reference SDKs at 1.1.0

• @openwop/openwop (TypeScript, npm) — first-class methods on OpenwopClient for every OpenAPI endpoint; HTTP_ERROR_CODES catalog with 40+ canonical codes; RunEventDoc type + isTerminalRunStatus helper; new typed exports added in 1.1.0: MemoryEntry, MemoryListOptions, AgentRef, AgentsCapability, AuthProfileClaim, AICredentialRef, McpToolCallNodeConfig, HttpRequestNodeConfig.
• openwop-client (Python, PyPI) — stdlib-only port preserving the same surface; HTTP_ERROR_CODES frozenset; matching wire types.
• github.com/openwop/openwop/sdk/go (Go modules) — same surface; HTTPErrorCodes slice; doc comments on every exported symbol; go vet clean.
• Rust SDK — foundation demand-gated; conformance suite is language-agnostic black-box, so future Rust client tests against the same wire contract.

Reference hosts

Four reference implementations live under examples/hosts/. Conformance evidence per host in INTEROP-MATRIX.md:

• In-memory (TypeScript, examples/hosts/in-memory/) — local-dev fastest-boot; no persistence; claims openwop-core + stream profiles.
• SQLite (TypeScript, examples/hosts/sqlite/) — single-machine durability; 669/731 (91.5%) conformance pass rate; claims audit-log-integrity + 4 interrupt profiles + auth-api-key-rotation + discovery-auth-scoped.
• Python in-memory (Python 3.11 stdlib-only, examples/hosts/python/) — cross-language portability proof; 700/788 (100% of applicable, ZERO failures) conformance pass rate.
• Postgres (TypeScript, examples/hosts/postgres/) — production durability path; first host claiming openwop-production; 730/799 (91.4%) conformance pass rate. Ships with BYOK + 4-mode AI policy + MCP client + HTTP client (SSRF-guarded) + MemoryAdapter + agents capability + API-key rotation + auth-scoped discovery + OAuth2-CC + OIDC user-bearer JWT validators (RS256 + ES256 with JWKS cache + alg: "none" rejection) + cap-breach enforcement + per-workflow configurableSchema validation + subworkflow outputMapping + parent linkage.

Conformance suite at 1.1.0

• @openwop/openwop-conformance — 103 scenario files under conformance/src/scenarios/. New since the 1.0.0 publish: production-profile (backpressure + retention-expiry), auth profiles (api-key-rotation + OAuth2-CC + OIDC + mTLS shape), audit-log integrity, BYOK roundtrip, MCP/A2A real-impl interop (verified against @modelcontextprotocol/server-everything + A2A 0.3 JSON-RPC reference), agent memory (roundtrip + cross-tenant + redaction + TTL), webhook signed delivery, stream-modes (buffer + mixed-mode), bulk-cancel, MCP-toolcall redaction, HTTP-client SSRF, WASM pack ABI-version-rejection + memory-cap positive-path, configurableSchema positive overlay, pause-resume race + drain semantics.
• Two execution modes: npm test (parallel files, ~95s) and npm run test:strict (--no-file-parallelism for production-backpressure + OTel envelope coverage).
• Behavior-gated: OPENWOP_REQUIRE_BEHAVIOR=true flips capability-gated scenarios from skip to fail when the host doesn't advertise the profile.

SECURITY invariants

• 68 invariants tracked (SECURITY/invariants.yaml):

- 35 protocol-tier (all with public conformance tests; CI-gated via scripts/check-security-invariants.sh). - 32 reference-impl tier (verified by each reference impl's own CI). - 1 advisory (defense-in-depth, no hard MUST).

• New protocol-tier invariants added between freeze and release: mcp-toolcall-payload-redaction, http-client-ssrf-guard, agent-memory-cti-1, agent-memory-sr-1-redaction, auth-key-rotation-no-canary-echo.
• Threat-model docs at SECURITY/threat-model-*.md (secret-leakage, prompt-injection, provider-policy, node-packs, auth-profiles).
• CNA registration + bug-bounty program annex at SECURITY/cna.md + SECURITY/bug-bounty.md.

Wire-shape stability

The wire contract remains frozen at v1 per COMPATIBILITY.md §2 — additive changes only inside v1.x, safety-fix only when correctness or CVE-class issues require it. Breaking changes wait for v2. This 1.1.0 release adds new optional capability surfaces; hosts that advertised the 1.0.0 capability set remain v1.x-compliant without change.

Domain and package naming

• Canonical domain: openwop.dev
• Registry: packs.openwop.dev (TLS cert provisioned; live)
• Package names: @openwop/openwop, @openwop/openwop-conformance, openwop-client, github.com/openwop/openwop/sdk/go — stable through any v1.x release per PUBLISHING.md.

Verification

npm run openwop:check — the 8-step pre-merge gate — passes for every commit on main:

1. TypeScript reference SDK builds + emits dist/ 2. Conformance suite typechecks + server-free scenarios pass 3. Python reference SDK syntax + import smoke clean 4. Go reference SDK go vet + tests clean 5. OpenAPI 3.1 redocly lint clean 6. AsyncAPI 3.1 asyncapi validate clean 7. Publish-metadata + npm-pack-contents + Python/Go release-surface clean 8. SECURITY invariants — every protocol-tier MUST-NOT has a public test

---

First publication of the openwop spec corpus to the package registries. Captures everything that was in scope at the v1 spec freeze (2026-05-08) plus three days of pre-publish hardening: SQLite host conformance fixes, registry TLS provisioning, audit-log integrity profile shipped end-to-end on SQLite, CI gate hardening (NPM_CACHE / GOCACHE cross-platform), recruitment artifacts for first non-steward host + pack-author.

Published artifacts

• npm: @openwop/openwop@1.0.0 (TypeScript SDK), @openwop/openwop-conformance@1.0.0 (conformance suite). Published 2026-05-11 05:06–05:09 UTC.
• PyPI: openwop-client@1.0.0 (Python SDK).
• Go modules: tagged sdk/go/v1.0.0 on origin.
• Tag: v1.0.0 on origin at commit 6a637f1.

Scope at 1.0.0

• Spec freeze content per [1.0] — 2026-05-08 entry below — 26 prose specs at FINAL v1; 17 first-class JSON Schemas; OpenAPI 3.1 + AsyncAPI 3.1; three reference SDKs (TS/Python/Go); conformance suite v1.0.0.
• Phase A conformance behavior closure — SQLite host pass rate 91.5% under OPENWOP_REQUIRE_BEHAVIOR=true.
• Phase B spec corpus completion — all DRAFT/STUB/OUTLINE tags retired; host-capabilities.md promoted; i18n.md + compliance.md annexes shipped.
• Phase C round 1 — three reference hosts (in-memory, sqlite, python) advertising their respective capability surfaces.
• Phase F — MCP + A2A probe extensions (synthetic fakes).
• Registry — packs.openwop.dev live with TLS; 3+ packs published with Ed25519 chains.
• CI — npm run openwop:check 8-step gate green.

Known gaps at 1.0.0 (closed in 1.1.0)

• Postgres reference host had not yet shipped the BYOK / MCP / HTTP / agent-memory / OAuth2-CC / OIDC / API-key-rotation / auth-scoped-discovery surfaces.
• 11 conformance scenarios were shape-graded (not behavior-graded).
• Phase F real-impl interop (against @modelcontextprotocol/server-everything + A2A 0.3 reference) was not yet wired.
• Phase H launch-blockers + Phase I enterprise-blockers from the 2026-05-12 architectural re-evaluation were not yet identified.

---

Protocol contract locked. The spec corpus, schemas, API definitions, reference SDKs, and conformance suite all reach 1.0 artifact versions. This date marks the freeze — no breaking wire-shape changes after this point inside v1.x.

The 4-day window between this freeze and the 2026-05-12 release closes every controllable gap from the deep-dive review and hardens reference hosts to production-runtime parity. See the [1.0.0] release entry above for the consolidated record.

What's locked at freeze

• Prose specs — 26 docs at Status: FINAL v1: auth.md, capabilities.md, channels-and-reducers.md, idempotency.md, interrupt.md, node-packs.md, observability.md, replay.md, rest-endpoints.md, run-options.md, stream-modes.md, version-negotiation.md, profiles.md, scale-profiles.md, debug-bundle.md, host-extensions.md, a2a-integration.md, mcp-integration.md, and the v1 profile/addendum docs.
• JSON Schemas — 17 first-class schemas including agent-ref, agent-manifest, memory-entry, memory-list-options, conversation-turn, conversation-event, and dispatch-config schemas.
• API definitions — OpenAPI 3.1 (api/openapi.yaml) + AsyncAPI 3.1 (api/asyncapi.yaml).
• Reference SDKs at 1.0 — @openwop/openwop (TypeScript), openwop-client (Python), openwopclient (Go).
• Conformance suite at 1.0 — @openwop/openwop-conformance.
• CI gating — scripts/openwop-check.sh + .github/workflows/openwop-spec.yml.
• Governance — CONTRIBUTING.md, GOVERNANCE.md, MAINTAINERS.md, COMPATIBILITY.md, SECURITY.md.

Multi-Agent Shift (Phases 1-6 landed by freeze)

• Phase 1 (RFC 0002) — Agent identity (AgentRef), agent reasoning + tool + handoff event family, confidence-escalation contract, message reducer.
• Phase 2 (RFC 0003) — Agent capability discovery on /.well-known/openwop + pack.json agents[] extension.
• Phase 3 (RFC 0004) — Agent memory layer — memoryRef resolution, redaction guarantees, host MemoryAdapter contract.
• Phase 4 (RFC 0005) — Conversation as run primitive — conversation.start / conversation.exchange / conversation.close.
• Phase 5 (RFC 0006) — Orchestrator-supervisor role — core.orchestrator.supervisor node type.
• Phase 6 (RFC 0007) — core.dispatch core node — conservative dynamic graph mutation.

Domain and package naming

• Canonical domain: openwop.dev
• Registry: packs.openwop.dev
• Package names: @openwop/openwop, @openwop/openwop-conformance, openwop-client, openwopclient