git:20260602.7d2bfe5 to git:20260602.8bfcfa4

8 added, 4 removed. Audit A to A.

---

name: openapi-adapter

description: External-adapter sub-skill; turns an OpenAPI operation into a governed tool call.

source:

type: external-adapter

external_adapter:

manifest_path: manifest.json

inputs:

operation_id:

type: string

required: true

description: The OpenAPI operationId to invoke.

petId:

type: string

required: false

description: Path parameter for the getPet operation.

fields:

type: string

required: false

description: Optional query parameter.

---

An OpenAPI front, expressed as an external adapter. The adapter reads a

checked-in OpenAPI spec (`openapi.json`), resolves the requested operation,

- validates parameters against the spec, and returns the resolved HTTP request as

- the sealed result. This proves the governed core runs from an external spec, not

- only from MCP: the same `external-adapter` lane carries any protocol.

+ validates parameters against the spec, performs the governed HTTP call, and seals

+ the response. The network leg lives on the adapter, the supervised side of the

+ boundary; when the endpoint is unreachable (the bare harness, no fixture server)

+ it falls back to the resolved request so the example still runs offline. This

+ proves the governed core runs from an external spec, not only from MCP: the same

+ `external-adapter` lane carries any protocol.

- Run it as a step in a graph; external-adapter is a graph-step front, not a

+ `examples/openapi-graph/run.sh` starts a local fixture endpoint and shows the real

+ response sealed into the receipt. external-adapter is a graph-step front, not a

top-level runner.