Week of October 25 – November 1, 2026
A2A 1.1 Has a Release Candidate and a Two-SDK Test
This is the thirteenth issue of The Specification Layer.
This newsletter window: October 25 through November 1. Fifty-two specification repositories and twenty-five feeds, all read clean. 405 pull requests merged. 18 releases cut. 25 posts published.
Do not compare that 405 with last week’s 174. The core series grew from 36 repositories to 46 this issue, adding A2A, the AI Catalog, ONNX and the gap-review specifications, so this is the first week of a new baseline. Core: 255 merged, 77 by bots (30%), 16 releases, and 20 of 46 did not move. Reported alongside, not inside: six added specifications merged 150, 34 by bots, with x402 alone at 73. The two release-path dependencies merged 4, all bots.
A correction to my own number. Last week I published a census of /.well-known/ucp across the APIs.io catalog that counted 1 host run on Wix. Monday’s run counts 205. That is not a Wix rollout. 204 of them were already in the hosts I probed on October 30, and an independent run in September found Wix at 50 of 50. My first run most likely missed them, and I don’t yet know why. So my statement that nearly every host serving only /ucp is self-run was also wrong: Wix is most of them.
Predictions from last week, graded:
| Prediction | Result |
|---|---|
| MCP’s release timeline confirms no December specification release | Right. SEP-3398 merged on October 27 and proposes moving the December target to March 30, 2027, subject to the transition calendar. |
| FDC3 3.0 final by the end of November | Right, early. FDC3 3.0 shipped October 26. |
OAI/sig-security joins the registry |
Done. It merged nothing this week. |
| PDPP locks v0.1.0 on October 26 | Partly. Comment closed on the 26th and the revisions merged on the 27th, but that pull request says the text stays a draft until the dispositions are published, and I found no announcement of the lock. |
| The AI Catalog ships 0.9 before the end of November | Open. No tag yet; the path is clearer (see below). |
The features default inconsistency is fixed before a 3.3 release candidate |
Open. On v3.3-dev the prose still says 1.0.0 and the schema 1.1.0. |
| The OpenAPI security proposal gets its complete example before its first approval | Open. |
| Arazzo 1.2 by mid-November | I expect to be wrong. The feature pull requests are open, and a structural proposal now sits in front of them. |
| ORD 1.18 by the end of the year | Open. |
The Lead: A2A 1.1 Has a Release Candidate and a Two-SDK Test
On October 29, A2A got a v1.1.0-rc tag on its dev-1.1 line. There is no GitHub Release behind it, so the rule I added two weeks ago, counting new tags as releases, is the only reason it appears here. v1.0.1 is still the current release.
Comparing the tag to main shows ten commits, and they change how a conversation with an agent works:
SendLiveMessageadds bidirectional interaction, and clients can write artifacts throughSendMessageRequest.- Coherent task history orders the timeline and artifacts together, and a
generationfield supports ordering, long polling and optimistic concurrency. - Terminal and non-terminal task states are clarified, including what
interruptedmeans. SubscribeToTaskmoves from POST to GET in the HTTP binding.- Discovery prefers the AI Catalog over the well-known URI, which I covered last week.
- An
application/a2a-agent-card+jsonregistration template is new this window, matching the media type the AI Catalog advertises.
The exit test is the news. On the October 27 technical steering committee call, the group’s plan was to cut the candidate, implement bidirectional messaging in the SDKs, and call 1.1 ready once it works in at least two of them. A specification that won’t ship until two implementations prove the hard part is rarer than it should be. It also means the date depends on SDK work the group itself expects to be large, so I’d read this as a gate, not a countdown.
Read it as a release candidate on a development line. Nothing here changes the published A2A 1.0 until 1.1 ships, and agents built today should keep treating 1.0 as the contract. My last count had most cards still declaring 0.3 anyway.
🎙 AI & Agents, and From the Room
MCP moved its calendar and defined how extensions grow up. SEP-3398 sets releases for the last Tuesday of March and September, on overlapping eight-month cycles with rotating release managers, and proposes March 30, 2027 as the first. SEP-3392 gives extensions a lifecycle, Experimental to Beta to Stable or promotion into core, with the stage visible in the repository name. If you build on an MCP extension, the repo prefix now tells you whether it can break under you.
The AI Catalog cleared its blockers for 0.9. #117, independently signed Trust Manifests, merged on October 28 after weeks open. After the October 29 call, Darrel Miller recorded the identifier decision: urn:air:{publisher}{:namespace+}:{name}{#kind}, with suggested kinds not yet listed in the specification. A commenter pointed out the same day that RFC 8141 says a URN’s fragment must be ignored when deciding equivalence. So #mcp and #skill can’t distinguish two entries as identifiers. That deserves an answer before 0.9 is tagged.
The registry had an infrastructure week. The MCP Registry merged 25 pull requests from one author and tagged v1.8.5 through v1.8.7. Nearly all of it is capacity, autoscaling and listing performance. It’s service code, not a format change.
ONNX added a line about AI. #8678 discourages test listings in AI-generated pull request descriptions, in a repo where the checklist already asks a human to take responsibility. ONNX also revised its roadmap dates.
In the working groups. MCP’s Progressive Disclosure group published its decisions: keep groups and groups/get, with its relationship to Skills over MCP still open. I attended the Arazzo and OpenAPI calls, which have no public recording, so from those I report only what the repositories confirm.
📐 The Description Layer
Arazzo merged four 1.1 fixes, and may be about to restructure 1.2. Vincent Biret and Vladimír Gorej’s corrections landed on v1.1-dev on October 29: xpath-31 in the text, arbitrary JSON for payload replacement, reusable object values as any type and the identity of success and failure actions. #615, the channel value, remains open.
The larger story is Frank Kilcommins’ comment on the RPC pull request: with RPC, GraphQL, actor-in-the-loop and more proposed for 1.2, step object legibility is degrading. He posted an example with a type field on each step. I think he’s right, and it’s cheaper now than after release. It’s also why I don’t expect 1.2 by mid-November.
OpenAPI merged nothing. v3.3.0 sits at 19 of 40. External Links, #5573, is still open. Overlay and the security group were also quiet.
JSON Schema moved schema evaluation into its own section and corrected format examples and RFC citations, both in the work-in-progress line. gRPC released 1.85.0 and backports. Protobuf’s 15 merges were all bots. AsyncAPI updated its TSC and board list.
Adoption this week. Hosts serving each document on provider websites, Monday’s run, of 27,280 reachable:
| Path | Hosts |
|---|---|
/llms.txt |
7,873 |
/.well-known/security.txt |
2,579 |
/.well-known/oauth-authorization-server |
2,033 |
/.well-known/robots-content-signals |
1,748 |
/.well-known/api-catalog |
853 |
/.well-known/openid-configuration |
703 |
/.well-known/ucp |
672 |
/.well-known/ucp.json |
425 |
/.well-known/agent-card.json |
418 |
/.well-known/ai-catalog.json |
410 |
/apis.json |
156 |
/.well-known/http-message-signatures-directory |
94 |
/.well-known/agent-descriptions |
3 |
None of the changes since October 30 is a trend yet. The UCP rise is the Wix correction. Nearly all of the agent card and api-catalog rise comes from hosts new to the catalog, which grew by more than 1,100. Most rows are new this week, so they have no comparison at all. The method and data are public.
📡 Events, Telemetry and the Data Plane
OpenTelemetry’s RPC conventions are marked stable. #4246 promotes RPC spans, call duration metrics and attributes, including gRPC and Apache Dubbo. Connect RPC, JSON-RPC and exception events stay in development. It’s merged to the repository, not yet in a tagged conventions release. The same repo keeps removing entities for its v2 work, marked breaking.
Agent traffic gets telemetry names. #195 adds conventions for A2A calls, and #447 adds a unified model for tracking agent-to-agent interactions. These are on a repository with no release yet.
OpenTelemetry also announced OTTL v1, eBPF Instrumentation v1.0.0 and its Governance Committee election results. A maintainer’s post argues the project’s main constraint is maintainers, not ideas. xRegistry merged three fixes. Envoy shipped four patch releases, reported for releases only.
🔐 Identity, Policy, Supply Chain
PDPP’s review closed with a heavy merge day. On October 27 the combined v0.1.0 revisions landed with their parts: separate permission for AI training, use and deletion duties for copies an app holds, access and MCP profiles, and a draft AI Training Profile. Its v1.13.1 tag is a software version, not the specification’s.
OpenVEX reverted itself, for the right reason. Two drafts for v1, identity and dependency paths, merged and came straight back out. The revert says why: the pull request “was automerged without review”. That’s a small, public example of a specification protecting its review process.
Elsewhere: Sigstore merged a work-in-progress Bundle Version 2. Security Insights tightened validation of non-empty lists. Open Component Model deprecated its label merge field. Cedar’s seven merges were mostly proof and tooling work. SPDX merged one bot change, and 3.1 sits at 47 of 114.
💹 Financial Services Data Standards
FDC3 3.0 is final. The release notes describe a significant evolution: ContextMetadata becomes a required part of the Desktop Agent API, and the Standard and its JS/TS, .NET and Go bindings aim to make inter-app workflows more observable, more secure and easier to implement. Agent Bridging 3.0 is part of the release. Read them before you upgrade a desktop agent.
The Common Domain Model tagged 7.9.0, 6.31.0, 5.41.0 and 8.0.0-dev.13. x402 merged 73, mostly SDK fixes across TypeScript, Python and Go, plus dependency floors for published security advisories and a facilitator-managed voucher mode in the batch-settlement draft. CALM did not move.
🏛 From the Foundations
The Linux Foundation put a number on AI pull requests. Its research release says generative AI cuts open source coding time in half, while 25% of incoming pull requests are considered “AI slop”, with a companion post. That’s survey data, not something I measured, but read it beside ONNX’s new guidance and the OpenVEX revert. CNCF published a piece on the boundary problem in agentic AI, and FINOS set its OSFF New York keynote lineup. KubeCon NA is November 9 to 12 in Salt Lake City.
🤫 The Quiet Ones
Twenty of forty-six in the new core series. The old count doesn’t carry over, so this is the new baseline.
Finished, not dead: CloudEvents, stable at 1.0.2 and still running the industry. xDS, Notary Project and TUF. The OCI specifications were quiet this week, which is ordinary for them.
Quiet and worth watching: OpenAPI and Overlay, in the week after 3.3’s largest change. GraphQL, whose motion lives in its working-group notes. AGENTS.md and Agent Skills, neither merging anything this week while the agent world talks about little else. OASF, OpenFeature, OpenMetrics, in-toto Attestation, OpenChain and CALM also didn’t move.
Silence that is the answer to the question I get asked most: Moonwalk. Thirteenth consecutive week.
📡 Channel Health
All twenty-five working feeds returned. Volume: 25 items, from 23. The OpenAPI Initiative’s feed has now been silent for fifteen weeks. CloudEvents’ last post is from July 2024.
How This Was Made
One harvest run against the GitHub REST and GraphQL APIs and twenty-five feeds, October 25 to November 1, 2026. Merged pull requests are counted by merged_at inside the window. A release is a GitHub Release or a new tag. Bot attribution is by author login; machine accounts with ordinary logins count as people.
Where this issue says what a pull request did, I opened it and read its body, its diff or its comparison. I read the MCP dates from the merged SEP text and checked the features inconsistency against v3.3-dev this morning. My statement on the A2A plan comes from the public recording, and I report outcomes only. From calls without public recordings I report only what the repositories confirm.
The adoption table comes from a single probe of every provider website, with one attempt per path and a shape test on each document, so a 200 alone doesn’t count. Sites that block automated requests read as misses, and one run can miss a whole platform, as the Wix correction shows. Treat these as lower bounds, and treat changes with suspicion until a series exists.
Standing rules: a merge to a development branch is not a published specification; this week that covers A2A 1.1, OpenAPI 3.3, the OpenTelemetry merges and Sigstore’s Bundle V2. Milestones are project news. Report the dependencies: OAI/build-infra merged 4, all bots, and specinfra/specref none.
Predictions on the record: A2A 1.1 is not final by the end of November. The AI Catalog changes or explains its #kind syntax in light of RFC 8141 before tagging 0.9, and tags 0.9 before the end of November (carried). Arazzo adopts a step type for 1.2, and 1.2 misses mid-November (carried). MCP publishes the transition calendar confirming March 30 by year end. The features default is fixed before a 3.3 release candidate (carried). ORD 1.18 by the end of the year (carried).
