git:20260602.8bfcfa4 to git:20260604.c61c112

2 added, 2 removed. Audit A to A.

---

name: openapi-adapter

- description: External-adapter sub-skill; turns an OpenAPI operation into a governed tool call.

+ description: External-adapter sub-skill; turns an OpenAPI operation into a sealed tool result.

source:

type: external-adapter

external_adapter:

manifest_path: manifest.json

inputs:

operation_id:

type: string

required: true

description: The OpenAPI operationId to invoke.

petId:

type: string

required: false

description: Path parameter for the getPet operation.

fields:

type: string

required: false

description: Optional query parameter.

---

An OpenAPI front, expressed as an external adapter. The adapter reads a

checked-in OpenAPI spec (`openapi.json`), resolves the requested operation,

- validates parameters against the spec, performs the governed HTTP call, and seals

+ validates parameters against the spec, performs the adapter-owned HTTP call, and seals

the response. The network leg lives on the adapter, the supervised side of the

boundary; when the endpoint is unreachable (the bare harness, no fixture server)

it falls back to the resolved request so the example still runs offline. This

proves the governed core runs from an external spec, not only from MCP: the same

`external-adapter` lane carries any protocol.

`examples/openapi-graph/run.sh` starts a local fixture endpoint and shows the real

response sealed into the receipt. external-adapter is a graph-step front, not a

top-level runner.