OpenAPI 3.3 has a new top-level keyword. `features` lets a description declare which companion specifications it uses — security, lifecycle — and their versions, and the…

In its first week in this newsletter's count, Open Resource Discovery shipped 1.17, and it now knows how to publish OpenAPI Overlays, Arazzo workflows, Agent Skills and agent…

MCP Server Cards reached Final this week, and the most consequential line in them is the one where MCP declines to own discovery: a domain advertises its MCP servers through an AI Catalog at /.well-known/ai-catalog.json, the A2A project's format, and the card itself stays deliberately static, leaving capabilities to live negotiation. Also: Overlay 1.2, which I held for three weeks at the group's request, is published with its schemas and now in SchemaStore; FDC3 3.0's board closed and a beta shipped; CALM's row now reads the specification instead of the tooling; x402 joins the count, with a warning attached; and the established layer was 40% human.

In its first week in this newsletter's count, the Model Context Protocol changed how anything gets into it: a specification proposal now has to be discussed in a working group first, the published Amsterdam notes say pull requests on the specification are limited to maintainers, and a six-month release cycle that moves December to March goes to a vote next week. The rule itself was written by an AI agent at a maintainer's request and merged after he sent it back once. Also: a finding about my own registry — the CALM repository I have read for nine weeks is the tooling, not the specification; the A2A AI Catalog merged four changes without a full TSC vote and said so on each one; SLSA shipped its first verifier and attester; FDC3 3.0 is three issues from done.

Eleven days ago Chris Wood presented a rethink of OpenAPI's security model to five people on a TDC call and I predicted a pull request within two weeks. It took eight days. On Thursday the TDC agreed where it belongs; that evening the existing Security Scheme and OAuth Flow objects were proposed for a move out of the core specification; on Friday the formal proposal landed — a separate OpenAPI Security Specification, a profile framework for FAPI 2.0, and a registry for national variants. It is a proposal, not a change, and its first review asks the right question. Also: OpenAPI cleared every blocker I listed last week; I read twenty-one working-group sessions and five produced an outcome on the public record; SPDX 3.1-rc2 missed its date, as predicted; FDC3 started calling itself 3.0.

Three weeks ago I reported that OpenAPI's published validation schema accepts a version number written in Bengali numerals. Two weeks ago the patch release could not carry the fix, by written policy. On Wednesday I sat in the OpenAPI TDC call and watched the pull request that would publish it stall on a question nobody would own — what date goes on the file — and end with no decision. Five hours later the person who raised the question dropped her commit, a TSC member merged it, and the fix went live. The URL is dated August 30. Also: GraphQL merged five human changes after six silent weeks, reversing a rule from 2015; Arazzo put a mid-November date on 1.2; OpenAPI merged nothing; the established thirty hit 50% human; and a correction I owe you about OCI.

OpenAPI 3.2.1 shipped on September 10, twenty days ahead of the prediction I put on the record three weeks ago — and the Bengali-digit defect I reported last week did not ship with it. Not an oversight: the OAI's own written rule says a patch release cannot carry a schema update, so the fix waits on a separate track while both published 3.2 schemas still accept a version number written in Bengali numerals. The release vote took three and a half minutes. Meanwhile Overlay woke up after five silent weeks, cleared its own release vote in a day, and still has not shipped. And the EU Cyber Resilience Act's first hard deadline landed on September 11, in a week when nine of the ten supply-chain specifications merged nothing at all.

A maintainer cancelled a credit card he thought was unused. It was the one Heroku had on file for SpecRef — the bibliography database every ReSpec-built specification resolves its normative references against. For nine days no OpenAPI specification could be released, and I watched the OpenAPI TDC hit the wall live on Thursday's call. SpecRef came back on Saturday, moved to a new org, and its maintainer opened a governance issue this morning asking who should own it. Also: the OpenAPI validation schema accepts a version number written with a Bengali digit, and this time the defect really is in the published artifact. And 167 merges made this the first human-majority week — entirely because of two specifications I only started tracking eight days ago.

Eighty-five merges across thirty specifications, the lowest reading since I started counting — and then two specifications the Linux Foundation adopted this week, and which were not on my list, merged fifty-two pull requests between them in the same seven days. Forty-eight of those were written by people. My entire tracked layer managed thirty-five. TRACE and PDP-Connect each individually out-merged every specification in my registry, and the honest headline is 137, not 85. Elsewhere: SLSA landed the largest specification diff in this newsletter's short life — a whole new Dependency Track, in draft, its author disclosing on the record that he used an LLM to structure it. OpenAPI's total specification text change across three weeks now stands at two capitalized words and one deleted space.