The Specification Layer
One email a week from Kin Lane on the contracts underneath everything else: OpenAPI, Arazzo, Overlay, AsyncAPI, JSON Schema, GraphQL, Protobuf and gRPC, CloudEvents and OTLP, SPIFFE and OpenFeature, SPDX, OCI, in-toto, OSV, SLSA, TUF, Sigstore, FDC3 and CALM. Read straight off the specification repositories themselves — what merged, what shipped, and what did not move.
Subscribe to The Specification Layer Also on Mondays: the API Evangelist newsletter, read across thousands of API providers.
Latest issue · October 25 – November 1, 2026
A2A 1.1 Has a Release Candidate and a Two-SDK Test
A2A tagged 1.1.0-rc with no GitHub Release behind it, and its committee set the exit test: bidirectional messaging in two SDKs. FDC3 3.0 shipped. MCP moved its December release to March. And I correct my own Wix count, 1 to 205.
Read this issue →Every issue
-
A2A 1.1 Has a Release Candidate and a Two-SDK Test
A2A tagged 1.1.0-rc with no GitHub Release behind it, and its committee set the exit test: bidirectional messaging in two SDKs. FDC3 3.0 shipped. MCP moved its December release to March. And I correct...
-
OpenAPI 3.3 Learned to Say What It Depends On
OpenAPI 3.3 has a new top-level keyword. `features` lets a description declare which companion specifications it uses — security, lifecycle — and their versions, and the security objects began moving out of the core...
-
Discovery Learned to Describe the Description Layer
In its first week in this newsletter's count, Open Resource Discovery shipped 1.17, and it now knows how to publish OpenAPI Overlays, Arazzo workflows, Agent Skills and agent plugins — a discovery specification taking...
-
MCP Gave Discovery to the AI Catalog
MCP Server Cards reached Final this week, and the most consequential line in them is the one where MCP declines to own discovery: a domain advertises its MCP servers through an AI Catalog at...
-
MCP Put the Room in Front of the Proposal
In its first week in this newsletter's count, the Model Context Protocol changed how anything gets into it: a specification proposal now has to be discussed in a working group first, the published Amsterdam...
-
OpenAPI's Security Proposal Is Now a Pull Request
Eleven days ago Chris Wood presented a rethink of OpenAPI's security model to five people on a TDC call and I predicted a pull request within two weeks. It took eight days. On Thursday...
-
Five Hours After Nobody Would Decide, the Fix Shipped
Three weeks ago I reported that OpenAPI's published validation schema accepts a version number written in Bengali numerals. Two weeks ago the patch release could not carry the fix, by written policy. On Wednesday...
-
The Release Went Out, the Fix Stayed Home
OpenAPI 3.2.1 shipped on September 10, twenty days ahead of the prediction I put on the record three weeks ago — and the Bengali-digit defect I reported last week did not ship with it....
-
Nine Days Without a Bibliography
A maintainer cancelled a credit card he thought was unused. It was the one Heroku had on file for SpecRef — the bibliography database every ReSpec-built specification resolves its normative references against. For nine...
-
The Two Specifications I Was Not Watching Out-Worked the Thirty I Was
Eighty-five merges across thirty specifications, the lowest reading since I started counting — and then two specifications the Linux Foundation adopted this week, and which were not on my list, merged fifty-two pull requests...
-
Eleven Merges, Two Words of Specification, and a Planning Board Marked Internal Use Only
The OpenAPI Initiative merged eleven pull requests this week and changed exactly two words of specification text — and stamped its v3.3.0 milestone INTERNAL USE ONLY and renamed its planning discussion DO NOT CITE...
-
156 Changes Landed Across Thirty Specifications and Exactly One of Them Shipped
156 pull requests merged across the thirty specification repositories this week, and when you subtract the tool releases, exactly one actual specification version shipped — TUF's, off a thirty-two line edit. Nineteen of the...
-
150 Changes Merged Into the Contracts Last Week, and 89 of Them Were Robots
First issue. I pointed a harvester at the thirty specification repositories that describe most of the world's APIs — OpenAPI, Arazzo, Overlay, AsyncAPI, JSON Schema, GraphQL, Protobuf, gRPC, CloudEvents, OTLP, SPIFFE, OpenFeature, SPDX, OCI,...
