Delete the AI Envelope from v2

Summary

The AI Envelope (RFC 0021) is structured text a model emits and an engine parses. Hosts now reach models through provider tool calls and structured output. This RFC deletes the AI Envelope from v2, with no deprecation period, by extending the existing corrections.json licence with a steward-deletion class that exists only while no outside host does. Reasoning and reliability semantics move to aiProviders unchanged. The run event envelope, the error envelope and the persisted envelope.* reliability events stay. RFC 0256 states the contract for tool turns and is not a prerequisite for this deletion.

Motivation

Measured 2026-10-30. openwop-app production runs d1421077a; origin/main is 7407073d0.

A deprecation period protects users, and there are none. Keeping the surface costs real maintenance: 34 envelope and A2UI scenarios, 182 requirement ids, and a kind of model output no maintained code should keep parsing.

MCP and A2A cannot be the replacement. A model emits a provider tool call; only the host speaks MCP, and A2A addresses peers. This RFC removes a channel and does not move it onto either protocol.

Proposal

§A What is deleted

Stale text is deleted in the same change. This covers at least events.md:20,251,256, runs.md:104, versioning.md:116, capabilities.md:430, replay.md:65, persistence.md:104, overview.md:34,44,49, workflow-definition:244, node-pack-manifest:243, prompt-template:70 and chat-card-pack-manifest:85. The corpus gates do not catch these, so a tree-wide grep for each deleted name is an acceptance criterion.

Not deleted. The trigger envelope, the run event envelope, the error envelope, limits.clarificationRounds, and persisted payload enums such as cap.breached.kind. The event type ui.a2ui-surface stays readable, because 4 are stored, and is no longer emitted.

§B Kept, and why

The six envelope.* reliability events stay under their names. They record provider truncation, refusal and retry on structured output, which remain real. Renaming them is possible through the codemap reader, but needs a new storage era for a cosmetic gain, so it is out of scope. run-event-payloads keeps them readable.

§C Limits

limits.maxToolRounds and limits.maxRepairRounds are added as OPTIONAL facets. maxToolRounds is named for what hosts enforce: rounds, not calls. A required addition would be a restriction the §D licence does not cover, and is not needed.

§D The steward-deletion class

spec/v2/corrections.json gains a row class steward-deletion. check-v2-surface-monotone.mjs already treats a corrections row as a removal licence.

A row of class steward-deletion MAY remove a v2 surface, including a required one, in a 2.x minor. It MUST record the census of committed bundles carrying the surface, whatever that number is. It MUST NOT remove a reader for persisted data. A new row MUST be refused while evidence/host-tiers.json or the INTEROP-MATRIX.md v2 table names a tier-3 host, or a committed bundle comes from an origin neither lists. Existing rows are never re-judged.

Three gate changes are required. Each lands with a sabotage fixture.

1. check-v2-retirement.mjs rescans bundles through bundlesCarrying for every corrections row. Today a typed bundles: 0 passes with 52 bundles carrying the surface, although the header claims the census is falsified there.
2. check-v2-surface-monotone.mjs refuses a same-release baseline change without a licence. Today deleting a surface and regenerating the baseline turns the gate green.
3. requirements gains a tombstone form, and --write refuses to drop an id silently. 182 ids are cited 149 times across 51 bundles.

Committed bundles are measurements at their own suite. They are not rewritten, and their validation against the newer schema is not a claim anyone relies on: 0 of 55 validate after this change, and no gate re-validates them.

COMPATIBILITY.md §3a and overview.md §0a gain this class. GOVERNANCE.md is amended: the "adopter-facing machinery is built even though no external adopter exists" rule does not apply to a steward deletion, and it resumes for all work when an outside host appears. "Evidence gates are never waived" is unchanged.

§E Interrupt surfaces

interrupt.md gains a short section stating the rules for a declarative form on an interrupt: closed catalog, no code execution, actions resolve only that interrupt, no network egress, no secret input, and redaction. The a2ui- invariants are renamed to interrupt-form- and each gets a test against a fixture run. The invariants MUST NOT lose their only witness at any commit.

Decided 2026-10-30 with openwop-app: the form is ClarificationData.form (schemas/v2/interrupt-form.schema.json), an OPTIONAL property, since production's root-level keys fail the closed ClarificationData. It keeps the closed profile, so the envelope schema can go, and narrows the action to resume. Every input id is a questions[].id, and the form and its fallback both resume with { answers: [{ id, answer }] }. a2ui-untrusted-blocks-approval becomes interrupt-form-never-resolves-approval: a form appears only on a clarification, so it cannot reach an approval; RFC 0256 §C governs untrusted approvals.

Wire shape changes

- schemas/v2/ai-envelope.schema.json, schemas/v2/envelopes/*, a2ui-surface-delta-frame
  spec/v2/corrections.schema.json
+   class: steward-deletion, bundleCensus
  schemas/v2/capabilities.schema.json (generated)
-   aiEnvelope, supportedEnvelopes, schemaVersions, envelopeStrictness, envelopeContracts, envelopes, a2uiSurface
    aiProviders:
+     reasoning, tierOneSubsetCompliance, reliability
    limits:
-     envelopesPerTurn, schemaRounds
+     maxToolRounds?, maxRepairRounds?

Examples

Positive. A steward-deletion row names limits.schemaRounds, records a census of 55, and removes the facet. Both gates pass.

Negative.

• The same row with a typed census of 0 fails.
• A row filed after a tier-3 host enters the matrix fails. A row filed before does not.
• A surface removed with no row fails, even if the baseline is regenerated at the same release.
• A row removing a persisted-event reader fails.

Compatibility

Breaking, by steward decision. No outside host or known consumer exists. Published packs that require aiEnvelope fail pack_peer_dependency_undefined, so new pack versions without that peer are published before the suite. Persisted data: the census found no stored fenced emission, so no compatibility reader is built. The 4 stored ui.a2ui-surface events stay readable under the reader rule.

Conformance

• Deleted: every scenario for a deleted surface. All seven aiEnvelope.* are major 1 and are already frozen history; the deletion affects the major-2 scenarios v2-ai-envelope-advertisement, v2-envelope-contracts-advertisement, v2-envelopes-advertisement, v2-limits-envelope-caps-advertisement, v2-a2ui-v09-surface.
• New: v2-envelope-surfaces-absent (unaided), v2-provider-output-reliability (structured output through the mock provider: truncation, exhaustion, refusal), v2-interrupt-form-rules, and the steward-deletion legs of check-v2-retirement and check-v2-surface-monotone as corpus gates.
• Re-pointed: v2-envelopes-advertisement became v2-structured-output-advertisement (the aiProviders facets), v2-limits-envelope-caps-advertisement became v2-limits-clarification-rounds-advertisement, and the a2ui-v09-profile corpus legs judge interrupt-form.schema.json. Their ids carry alias rows; every other retired id carries a tombstone naming openwop.correction.v2.5.

Falsifiability

Alternatives considered

1. Deprecate and remove at 3.0. Rejected by the steward.
2. Cut 3.0 for this. Rejected. It needs a new tree, path space and suite line to remove one feature.
3. A new steward-deletions.json file. Rejected after the trial. corrections.json is already a licence the gate reads, and a new file adds surface.
4. Delete before porting the run-lane clarification. Rejected. It would remove a shipped feature and its round cap, though the census shows it has never run.
5. Keep a2uiSurface. Rejected. Zero bundles carry it, and no producer feeds it.
6. Do nothing. Rejected.

Unresolved questions

None open. Decided 2026-10-30: v2-provider-output-reliability uses configurable.ai.mockProvider, and a seam is added only if that cannot force a truncation. Published packs are fixed by new versions, with no declaration.aliases entry for aiEnvelope.

Implementation notes (non-normative)

Order is in the openwop-app plan: census, stand-alone security fixes, corpus lane, run-lane port, pack versions, spec deletion and suite publish, one host PR with the pin, certified cut, sibling sweep, then a later table drop. check-core-budget falls from a 38,000 cap to 37,000 with five fewer homed families; the trial measured 37,493, so about 500 words must go beyond the deleted sections, more with §E.

Prerequisites

• [x] Census of production, 2026-10-30 (see Motivation). Chat transcripts were not scanned; chat has no replay path that would read them.
• [x] Run-lane clarification no longer uses an envelope (openwop-app ADR 1006, #5413, live on 85fba5fa8 2026-10-31): one host tool, openwop:ask-user, with clarificationRounds enforced and its schema generated from CLARIFICATION_LIMITS.
• [x] New versions of vendor.myndhyve.ai, .brand and .web-research published without the aiEnvelope peer (openwop-registry #103, f228326: brand, kanban and web-research 2.0.0; vendor.myndhyve.ai 1.0.1 and 1.0.2 yanked).

Acceptance criteria

• [x] corrections class, gate changes and sabotage fixtures merged; GOVERNANCE.md and COMPATIBILITY.md amended; waivers logged.
• [x] Deletions merged (row openwop.correction.v2.5); every deleted name absent from spec/v2, schemas/v2, api/v2 and non-frozen scripts; openwop:check green apart from version-bump and cross-repo steps.
• [x] Suite published; one PR on openwop-app bumps the pin and deletes the host code. Suite 2.46.36 (2026-10-31); openwop-app #5416 (ba0d3893e, ADR 1007) pins it and deletes the acceptor, normalizers, A2UI surface admission and delta transport.
• [x] A certified bundle on a deployed host carries 0255. at executed-pass. This is not waived. openwop-app's production cut 9f4cca7d4 carries 0255.surfaces-absent and the three 0255.provider-output- legs; the reference host's cut carries the three §E legs. Against openwop-app's previous cut 72e610b3d, no row changes result; the 31 rows that leave are the deleted surfaces' own.
• [x] SDKs, examples, registry, site and adopters carry no deleted name. SDK 2.8.0 (openwop-sdks #66, #67), site (openwop-site #234), registry (#104), the v2 reference host (openwop-examples #179); the remaining hits in openwop-examples are v1 hosts, where the names are still valid v1 wire.

References

RFC 0021, 0030–0033, 0055, 0102, 0114, 0144, 0171, 0193, 0197, 0205, 0209; COMPATIBILITY.md §2.2, §3a; GOVERNANCE.md; openwop-app ADR 0858, 1001, 1002.