The Specification Layer

This is the eleventh issue of The Specification Layer.

This newsletter window: October 11 through October 18. Thirty-six specification repositories and twenty-five feeds, all read clean for the eleventh consecutive week. 208 pull requests merged. 12 releases cut. 19 posts published. Ten of the thirty-six did not move. The two release-path dependencies merged 2.

The registry grew by two. Last week I went looking at which of the Linux Foundation Europe’s NeoNephos projects this newsletter tracked, and the answer was none. NeoNephos hosts fourteen projects, and two of them are specifications in the strict sense — Open Resource Discovery and the Open Component Model. Both join this week, reported alongside the established thirty like MCP and x402. The other twelve — Gardener, IronCore, Platform Mesh, Luigi and the rest — are software, and this newsletter counts specification repositories, so they are in the standards catalog but not here.

The 208 is up 84 on last week, and most of it is not the established layer. The six newest rows — TRACE, PDPP, MCP, x402, ORD and OCM — merged 97, 89 of them by people. The established thirty merged 111.

Predictions from last week, graded:

Prediction	Result
SEP-3398 passes, and there is no December MCP specification release	Half right, and the half that can be graded is right. The core maintainers voted it through 7–0 on October 14. The pull request is accepted but not yet merged, and no December release date has been withdrawn on paper.
FDC3 3.0 final, not beta, by the end of November	Open. The maintainers agreed to open a seven-day adoption vote, with release “expected shortly after.”
SPDX 2.3.1 publishes by October 25	Wrong question. It had already shipped — on October 5. See the correction below.
The A2A AI Catalog ships its 0.9 release candidate before AgentCon	Open. No tag; the trust-manifest change, #117, is still open.
The OpenAPI security proposal gets its complete example before its first approval	Open. No activity since September 25.
Arazzo 1.2 by mid-November	At risk. Eleven Arazzo merges this week, none of them feature work. Below.

Beneath the neon grid, a vast underground index chamber where a single gold registry wall holds row upon row of small lit niches, and into the newest niches tiny figures slot thin transparent layers, folded route maps and small sealed kits, each glowing as it settles into place.

The Lead: Discovery Learned to Describe the Description Layer

Open Resource Discovery is a protocol for a system to describe what it exposes — its APIs, its events, its data products — through a document served from /.well-known/open-resource-discovery, so a catalog or an agent can read it instead of scraping documentation. It began as an SAP standard and is now governed under NeoNephos. It is also the most active new row I have added: fourteen merges in its first week, thirteen by people, and a release.

ORD v1.17.0 shipped on October 12. Read its changelog next to the last month of this newsletter and it lands in an interesting place:

OpenAPI Overlays are now a publishable resource. #157 adds oas-overlay-v1 as a definition type, because “publishers may already use OpenAPI Overlay v1.0.0 and need to expose those documents through ORD without converting them first.” ORD has its own overlay model for its own metadata; it now carries the OpenAPI Initiative’s alongside it, and explains how the two differ.
Arazzo workflows are discoverable. #158 models every Arazzo document as a workflow capability with an arazzo-v1 definition, and adds an ord:orchestrates relation from a workflow to the APIs it calls. Its motivation is blunt: Arazzo “describes multi-step API workflows, but ORD currently has no standard way to publish or discover those documents.”
Agent Skills and agent plugins are first-class. #102 adds agent-skill and agent-plugin capability types, with ZIP definitions for distributing them, and lets a capability declare the APIs, events or other capabilities it depends on — down to selecting individual skills from a bundle by name.

So in one release, a discovery specification took in the two newest pieces of the OpenAPI Initiative’s description layer and the packaging format agents are converging on. That is the same question I keep circling in this newsletter — MCP pointing its discovery at the AI Catalog, Personal Agent Protocol defining its own poppy.json — answered from a third direction. ORD’s answer is not a new front door for each artifact. It is one document that knows what all the artifacts are and how they relate: this workflow orchestrates these APIs; this skill depends on that event.

Two honest qualifications. ORD’s own README describes it as “currently geared towards the SAP ecosystem,” and adoption outside it is something I have not measured. And its /.well-known/ path is registered with IANA only provisionally, since 2023 — which, after the post I wrote last week, puts it ahead of most of the agent specifications and ahead of APIs.json, whose registration I only requested this week.

The Open Component Model, the other NeoNephos specification, merged two documentation changes to its signing chapter, including an optional RFC 3161 timestamp on signatures (#153). Its specification repository has tagged one release, in 2023; expect it in The Quiet Ones most weeks.

A foundation archive beneath the grid where one long row of gold ledger plates has a single plate slid halfway out and lit from below, a small figure holding a lamp up to the date cut into its edge.

A Correction: SPDX 2.3.1 Shipped on October 5

Last week I wrote that SPDX 2.3.1 was “one issue from done,” listed it under the standing rule as a draft — “say draft when it is a draft (this week: … SPDX 2.3.1)” — and predicted it would publish by October 25.

It had already been published. The v2.3.1 tag, “Patch release 2.3.1 of the SPDX Specification,” is dated October 5 at 17:01 UTC, and the 2.3.1 specification was deployed to the SPDX site minutes earlier. That is inside last issue’s window. The ten merges I described as release preparation were the release.

What went wrong is my instrument, and it is worth saying exactly. The harvester counts GitHub Release objects. SPDX published 2.3.1 as an annotated git tag and a documentation deploy, without a Release object, so the harvest recorded no release, and I read a 55/56 milestone board as a project that had not shipped. The milestone is still open at 55/56 today — boards and releases are not the same thing, which is a rule I state in every issue and did not apply.

From this issue, a release is a GitHub Release or a new tag. I added tag detection to the harvester this morning, checked that it finds SPDX’s v2.3.1 on October 5, and re-ran this week: no other specification shipped a tag without a Release. The grading table above marks the prediction as wrong in the way it was wrong.

A long row of small hexagonal meeting chambers set into a dark foundation wall beneath the neon grid, tiny figures around tables in cool blue light, and from several of the chambers a thin gold line running down into a common channel in the floor.

🎙 From the Room: Seventeen Sessions, Seven Outcomes

Seventh week of this section. Seventeen sessions in the groups’ own recordings and published notes; I was at no spec calls this week. Outcomes only, each checked against the repository.

Room	Outcome	On the record
MCP core maintainers (Wed)	SEP-3398, the six-month release cycle, passed unanimously, seven of seven	notes #3438; #3398 labelled `accepted`, Oct 14
A2A TSC (Tue)	Terminal versus interrupted task-state semantics clarified, and `SubscribeToTask` moved from POST to GET	#2270, #2068, Oct 13
MCP Interceptors (Tue)	The SEP text brought in line with the group’s decisions on out-of-process execution and configuration	experimental-ext-interceptors #43, Oct 13
MCP Inspector V2 (Wed)	Inspector 2.11.0 released	2.11.0, Oct 14
CloudEvents / xRegistry (Thu)	xRegistry’s HTTP header handling cleaned up — last week “conditionally approved,” this week merged	xregistry #741, Oct 16
FDC3 maintainers (Wed)	Agreed to open the FDC3 3.0 adoption vote, seven days, release “expected shortly after”; automated conformance suite now runs in CI	notes #2286; #2048, Oct 15
OpenTelemetry Specification (Tue)	A sampler shutdown operation added to the SDK specification	#5335, Oct 16

On MCP’s vote, what it does and does not settle. The notes record the vote and two follow-ups: the community documentation gets updated, and a blog post on the release timeline is drafted once the SEP merges. They give no date for the next release. The SEP text, which I quoted last week, moves the December 2026 target to late March 2027. When that post is published, the prediction gets graded in full.

Announced, not landed by Sunday: A2A 1.1 (its milestone has three open items; v1.0.1 is still current). The AI Catalog’s 0.9 release candidate and #117. MCP’s extension lifecycle SEP, #3392, whose vote opened October 14. MCP’s events extension, #3415, a week of review away from a vote. FDC3 3.0 final.

No outcome: the Envoy AI Gateway / Agent Router call, the CNCF MCP authentication initiative, OCI, two MCP interest-group sessions, and SLSA’s call, which lacked quorum on the US holiday.

The split

Who merged it	Count	Share
`copybara-service[bot]`	55	26%
`dependabot[bot]`	20	10%
`oai-spec-publisher[bot]`	6	3%
`renovate[bot]`	5	2%
`github-actions[bot]`, `claude[bot]`	2	1%
All bots	88	42%
Actual people	120	58%

Eleven readings: 59% machine, 54%, 72%, 59%, 36%, 41%, 41%, 47%, 43%, 52%, 42%.

	Merges	Human	Human share
The six newest rows (TRACE, PDPP, MCP, x402, ORD, OCM)	97	89	92%
The established thirty	111	31	28%
All thirty-six	208	120	58%

Read the headline 58% with care — the established layer was 28% human, its lowest in five weeks. Protocol Buffers merged 42, all copybara; Arazzo’s eleven were six publishing-bot syncs, four dependency bumps and a README line. The human work this week was concentrated in the youngest specifications: PDPP merged 32, every one by @tnunamak, almost all of it test engineering ahead of its October 26 lock; TRACE merged 36, 33 by people.

The bot rule, decided. Last week I said I would decide whether machine accounts with ordinary logins — PhilBot402, renovate-bot, and this week openfeaturebot — count as bots. I am keeping the login rule, for comparability across eleven weeks, and disclosing the exceptions every week instead. This week it is three merges; counted as machines, the split is 44%.

A deep foundation workshop beneath the neon grid where a crew of small automated arms polish and re-stack the same gold beams over and over, while three empty gold frames for new beams stand waiting at the far end of the hall.

📐 The Description Layer

ORD — the lead.

Arazzo merged eleven and moved no closer to 1.2. Six of the merges were oai-spec-publisher[bot] syncing branches (v1.2-dev, v1.1-dev, dev), four were dependency bumps, and one (#592) added the UseArazzo parser to the README’s tooling list. The three feature pull requests 1.2 is waiting on — Protobuf RPC (#556), GraphQL (#567) and actor-in-the-loop (#568) — were all updated this week and are all still open. A busy count, a quiet specification. Meanwhile ORD started publishing Arazzo documents.

OpenAPI merged a proposal for multiple documentation links. #5467 from @lornajane adds a proposal for externalLinks — “like externalDocs but allow more than one” — addressing #1034, one of the longest-standing requests on the project. It is a proposal document, not a specification change, and it carries an AI disclosure I’d like to see more of: “talked through with Claude and got the sillier ideas out of the way before proposing this approach, but the writing is my own.” The v3.3.0 board grew to 19/40. OAI’s build tooling merged two refactors from @handrews.

JSON Schema merged three corrections in the development draft — output schema objects, registry examples, broken footnotes. MCP merged six, four by bots; the governance work this week happened in the notes. AsyncAPI merged three dependency bumps into its converter. Protocol Buffers cut v37.0-rc1, a release candidate, and gRPC merged sixteen, three by people.

Overlay, GraphQL and Moonwalk merged nothing. Moonwalk: eleventh week, last merge March 31, 2025.

An underground junction hall beneath the neon grid where rows of glowing gold nodes stretch into the distance and a single new conduit is being fed into the row from the side, tiny figures splicing it in.

📡 Events, Telemetry and the Data Plane

OTLP gave profiles a version number for the meantime. #857 defines a temporary otlp-profiles-development-version request metadata — and an OTLP-Profiles-Development-Version HTTP header — for the still-in-development profiles signal: a positive integer, missing means version 1, incremented on every incompatible schema change. It is a wire protocol admitting a signal is unstable and giving clients a way to say which instability they speak. #873 clarifies “unset” for attribute keys.

OpenTelemetry’s specification added a sampler shutdown operation (#5335); no release, 1.61.0 is still current. Its GenAI conventions merged MCP session-duration and MCP error attributes, and made provider-supplied tool-call IDs required on execute_tool — the agent layer being instrumented in the open.

CloudEvents merged one fix aligning the verifiability extension’s test vectors with its reference implementation (#1400). The specification is stable at 1.0.2; its weekly call did its work in xRegistry again.

Envoy shipped v1.40.0 on October 13, and patch releases on four older lines the day before — tracked here for releases only.

A long underground archive of stacked gold ledger plates beneath the grid, where tiny figures fit a set of small gauges and test fixtures onto a gold frame before it is lowered into place.

🔐 Identity, Policy, Supply Chain

OpenFeature shipped its first conformance assets. specification/assets/provider-tck v0.1.0 is the set of files four provider conformance implementations run against (#423), released through the release-please setup merged the week before. One detail I liked: #448 stopped the tooling from cutting it as 1.0.0 by default. The normative appendix describing the suite is still in review.

SLSA generalized an upstream field. #1648 renames upstreamProvenance to upstreamAttestations in the Dependency Ingestion Provenance predicate — an array that can carry verdicts on any upstream attestation, not only SLSA build provenance. In the development line.

OSV Schema released v1.9.2, adding Raspberry Pi OS as an ecosystem with an RPI advisory prefix (#631) — a Debian derivative whose kernel advisories Debian’s do not cover. OCI Runtime added a go.mod and made its version a string literal. TUF merged three dependency bumps.

PDPP merged thirty-two, every one from @tnunamak, and cut three repository releases ahead of the October 26 lock of v0.1.0 — the latest adds a draft conformance suite for the pre-lock text, “partial coverage, not a certification.” TRACE merged thirty-six, thirty-three by people.

SPIFFE, OCI Image, OCI Distribution, in-toto and Notary Project merged nothing. SPDX merged one tooling option — and the correction above.

💹 Financial Services Data Standards

FDC3 3.0 goes to an adoption vote. The 3.0 board closed at 54/54, the maintainers agreed to open a seven-day adoption vote timed with the Open Source in Finance Forum, and the conformance suite now runs automatically in CI (#2048). v3.0.0-beta.1 remains the newest release.

CALM’s specification repository merged four: #33 publishes releases to calm.finos.org and starts tool compatibility tests against each schema release, plus an AGENTS.md, a CLA-only contribution policy and Security Insights metadata. No schema change; 1.2 from August is current. FINOS also announced the SDLC Common Controls Catalog.

x402 merged seven, all people. Under the rule I set when it joined — a specification change only if it touches specs/ — none of them was: SDK fixes, a security policy, documentation, and the removal of an outdated roadmap.

🏛 From the Foundations

The Linux Foundation launched the BUILD Foundation for large-scale, multi-language build and test systems. LF Decentralized Trust demonstrated a verifiable trust community in Prague, from the ToIP/DIF trust-graph group and the OpenVTC lab. OpenSSF published a case study on GitHub expanding malware advisories across eight ecosystems — the OSV format at work. The CNCF blog made the case for carbon intensity as an OpenTelemetry signal.

A long subterranean colonnade of tall plain dark monoliths receding into blackness, their edges traced in cold gold, most of them unlit and silent while the load-bearing neon grid floor runs on past them.

🤫 The Quiet Ones

Ten of thirty-six — 12, 19, 16, 13, 15, 19, 14, 15, 14, 11, now 10.

Finished, not dead — stable, shipped, carrying load: OCI Image and OCI Distribution (v1.1.1), Notary Project, xDS, in-toto.

Quiet and worth watching: Overlay, after two housekeeping merges last week. GraphQL. SPIFFE. OpenMetrics.

Silence that is the answer to the question I get asked most: Moonwalk. Eleventh consecutive week.

📡 Channel Health

All twenty-five working feeds returned for the eleventh consecutive week. Volume: 19 items, from 33.

Protocol Buffers’ news feed came back with changes announced on October 15. AsyncAPI and LF AI & Data rejoin the dormancy list. The OpenAPI Initiative’s feed has been silent since July 22 — thirteen weeks.

The dormancy leaderboard, longest first: in-toto (May 2023) · CloudEvents (July 2024) · Notary Project (June 2025) · OCI (April 2026) · SLSA (May 2026) · gRPC (June 2026) · GraphQL (June 2026) · OpenAPI Initiative (July 2026) · OpenFeature (August 2026) · SPIFFE (September 3) · Prometheus (September 21) · LF Edge (September 28) · LF Networking (October 1) · LF AI & Data (October 6) · AsyncAPI (October 7).

How This Was Made

Every number above came from one harvest run against the GitHub REST and GraphQL APIs and twenty-five feeds, over October 11 to October 18, 2026. Merged pull requests are counted by merged_at inside the window. Bot attribution is by author login — [bot] accounts and copybara; machine accounts with ordinary logins are counted as people and disclosed. Milestone values are GitHub’s own.

The registry is now thirty-six specifications. Open Resource Discovery and the Open Component Model (specification repository only, not its toolset) joined this week from NeoNephos; with MCP, x402, TRACE and PDPP they are reported alongside the established thirty, never inside them.

Releases are GitHub Release objects and, as of this issue, new tags. SPDX 2.3.1 shipped as a tag without a Release object, the harvest missed it, and I reported it as unreleased. The correction is above, and the harvester now reads the latest tags of every repository and dates each one.

Where this issue makes a claim about what a pull request did, I opened it and read its body. The ORD claims are from the three pull requests and the v1.17.0 release notes; the MCP vote is from the published core maintainer notes and the pull request’s own label and comment.

Meetings. I attended no specification calls this week. From the rooms I report outcomes only, each checked against the repository or the group’s own published notes.

Standing rules, applied throughout: a merge to a specification repository is not a change to a published specification — say draft when it is a draft (this week: SLSA’s upstreamAttestations, JSON Schema’s corrections, OpenAPI’s externalLinks proposal). Milestones are project news, never specification news — and a milestone is not a release, the rule I broke last week. Report the dependencies as well: OAI/build-infra merged 2, specinfra/specref none.

Predictions on the record: MCP’s release-timeline post confirms no December specification release (carried, half graded). FDC3 3.0 final by the end of November (carried). The AI Catalog ships 0.9 before AgentCon (carried). Arazzo 1.2 by mid-November (carried, at risk — none of its three feature pull requests merged). PDPP locks v0.1.0 on October 26 as scheduled. ORD ships 1.18 by the end of the year — it released 1.16.4 and 1.17.0 ten days apart this month, after a three-month gap.