---
type: "article"
title: "The Specification Layer — MCP Put the Room in Front of the Proposal"
summary: "In its first week in this newsletter's count, the Model Context Protocol changed how anything gets into it: a specification proposal now has to be discussed in a working group first, the published Amsterdam notes say pull requests on the specification are limited to maintainers, and a six-month release cycle that moves December to March goes to a vote next week. The rule itself was written by an AI agent at a maintainer's request and merged after he sent it back once. Also: a finding about my own registry — the CALM repository I have read for nine weeks is the tooling, not the specification; the A2A AI Catalog merged four changes without a full TSC vote and said so on each one; SLSA shipped its first verifier and attester; FDC3 3.0 is three issues from done."
newsletter: "The Specification Layer"
newsletter_handle: "the-specification-layer"
newsletter_url: "https://usecommune.com/n/the-specification-layer"
author: "Kin Lane (@kinlane)"
published: "2026-10-05T17:44:57.704Z"
canonical_url: "https://usecommune.com/n/the-specification-layer/a/95oR3eHs"
markdown_url: "https://usecommune.com/n/the-specification-layer/a/95oR3eHs.md"
chat_url: "https://usecommune.com/n/the-specification-layer/a/95oR3eHs/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 4525
---

# The Specification Layer — MCP Put the Room in Front of the Proposal

This is the ninth issue of The Specification Layer.

**This newsletter window:** September 27 through October 4. Thirty-three specification repositories and twenty-five feeds, all read clean for the ninth consecutive week — no source errored. **207 pull requests merged. 6 releases cut. 25 posts published.** Fourteen of the thirty-three specifications did not move. The two release-path dependencies merged 3 between them.

**Two things are different this week.** The registry grew by one: **MCP joins**, as I said it would, reported alongside the established thirty rather than inside them. And I attended none of the working-group calls — I was at apidays London all week — so everything in From the Room comes from the groups' own public recordings and published notes, which, as it turns out, is enough to report a week.

**That 207 is not a jump in activity, and I would rather say so than let the number stand.** Merges are up 63 on last week. Twelve of those are MCP, newly counted. Fifty-three are one repository, CALM's, which went from 10 merges to 63 — and, as the second section explains, that repository is not the specification I thought it was.

**Predictions from last week, graded:**

| Prediction | Result |
| --- | --- |
| MCP's repository joins the registry, reported alongside the established thirty | **Done.** It is in the table below and in the lead. |
| The OpenAPI security proposal ([sig-security #54](https://github.com/OAI/sig-security/pull/54)) gets its complete OpenAPI description example before its first approval | **Open.** No commit, review or comment since September 25. |
| Arazzo 1.2 by mid-November | **One of four landed.** SOAP support, [#533](https://github.com/OAI/Arazzo-Specification/pull/533), merged September 30. |
| The schema-date question comes back the next time a 3.2 schema changes | **Open.** No 3.2 schema changed. |

![Beneath the neon grid, a small figure carries a glowing gold tablet down a corridor toward a heavy round vault door, the only way to it running through a round lit council chamber where tiny figures sit in a ring, a side passage sealed off.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-the-lead.png)

## The Lead: MCP Put the Room in Front of the Proposal

Every specification in this newsletter has a way for an idea to become a change. For the Model Context Protocol it is the SEP — a Specification Enhancement Proposal, opened as a pull request. Until this week, the [SEP guidelines](https://modelcontextprotocol.io/community/sep-guidelines) mentioned talking to a working group first only as a tip inside a note. **As of September 28 it is a requirement.**

[#3336, "Require WG/IG discussion before SEP submission,"](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3336) merged at 22:47 UTC on Sunday the 28th. What it changes, from the pull request:

- Prior discussion with the relevant working or interest group **is required**. SEP authors bring the idea to the group before opening the SEP, and link that discussion — a Discord thread, meeting notes or a GitHub Discussion — in the pull request.
- **The sponsor confirms** the discussion happened and is linked before a SEP moves to `in-review`.
- `#general` or GitHub Discussions is the fallback when no relevant group exists.

It is live: the published guidelines now open with *"Discuss with the relevant group: Bring your idea to the matching working or interest group and refine it there."*

### Where it came from

The rule did not come out of nowhere, and the record now shows the whole path.

|   |   |
| --- | --- |
| **Sep 1** | \#3336 opened. Its description records it was *"Requested by Den Delimarsky"* in the maintainers' Slack, and it ends *"Generated by Claude Code."* |
| **Sep 15–16** | MCP's core maintainers meet in person in Amsterdam. |
| **Sep 28** | @localden requests changes, then approves, and merges #3336. |
| **Sep 30** | The Amsterdam notes are published: [the core maintainer meeting](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3402) and [maintainer day](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3403). |

The maintainer-day notes record a wider decision than the one that merged:

> *"Working group sponsorship becomes a requirement for SEPs; until now any maintainer could sponsor. Working group leads hold access to the review queue, and larger ideas have a pre-review path before anyone writes a SEP. Pull requests on the specification repository are now limited to maintainers, and the backlog of stale SEP pull requests will be closed."*

The same notes add that **conformance tests are now part of SEP acceptance** — *"this is the first full cycle with that requirement"* — and that SEPs should arrive with a failing conformance test. And the core maintainers' notes from September 30 add a written path for questions *before* a SEP: a working-group lead *"writes the question down (a doc, a PR, or a decision record in the WG repo) and puts it in the same queue."*

Read together, that is a specification closing its front door to drive-by proposals and routing every idea through a room first. It is the most significant governance change I have seen land in this newsletter's nine weeks — and it happened in the week MCP started being counted.

### The release cycle is now a public proposal

Last week, from a working-group call, I held back a change to MCP's release timing because it had not been published. **It now has.** [SEP-3398, "Release Cycle Updates"](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3398), is an open pull request whose text reads: *"Specification releases occur every six months, generally on the last Tuesday of March and September,"* and *"the proposed transition moves the December 2026 release target to late March 2027."* The Amsterdam notes describe an eight-month cycle overlapped to ship every six months, and record that *"the room welcomed the shift from December to March 2027."* The September 30 notes put it at: comments this week, vote next week.

That is a proposal, and I am reporting it as one. If it passes, there is no MCP specification release in December.

### Two notes I want to make flatly

**The rule was written by an agent.** Both of the merges in MCP's repository this week that came from `claude[bot]` — #3336 and [#3408](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3408), which lists the conformance repository's maintainers in MAINTAINERS.md — carry a line naming the maintainer who requested them in Slack, and both were reviewed and merged by that same person; #3336 was sent back once before it was approved. I count them as bot merges in the split below, for consistency, though they are better described as a maintainer's change with an agent doing the typing. Last week the OpenAPI security proposal arrived with a "Generated with Claude Code" line too. That makes four specification bodies since the end of August — SLSA, FDC3, the OpenAPI Initiative and now MCP — where agent authorship is visible in the record. The pattern is no longer worth flagging as unusual. It is worth counting.

**MCP's first week in the count:** 12 merges, 7 by bots (2 of them `claude[bot]`), 5 by people. Mostly documentation: SEP redirect pages, a Ruby SDK Tier 1 assessment, dead-link fixes, a CLI added to the client matrix. The governance change is the one that matters.

![Two parallel underground halls beneath the grid separated by a thick wall: a bright crowd of tiny figures swarms over gold scaffolding in the near hall, while through an opening the far hall holds a single quiet gold slab, and a lantern beam has just swung toward it.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-the-registry.png)

## A Finding About My Own Registry: I Have Been Reading CALM's Tooling

This week [CALM #3201](https://github.com/finos/architecture-as-code/pull/3201) updated the project's security metadata to say the project spans three repositories, and named `finos/calm-schema`** as the home of the CALM specification**. The repository this newsletter has read as "CALM" since its first issue, `finos/architecture-as-code`, is the tooling — the CLI, CALM Hub, the VS Code extension, now CALM Lab. `finos/calm-governance` holds governance.

**The schema repository was created July 29, before this newsletter's first issue.** Its history, from its merged pull requests:

- **August 4–7:** the schema history migrated in stages — the 2025-03 draft, 1.0-rc1, 1.0-rc2, 1.0, 1.1 and 1.2 — and `@finos/calm-schema` 1.0, 1.1 and 1.2 were published to npm on August 7.
- **Since then, nothing that changes the schema:** OpenSSF Baseline parity work and a dependency bump on October 2, and an examples migration on October 4.

So every CALM line I have printed for nine weeks measured the tooling. The conclusion I kept repeating — tooling releases every week *"while the schema has not changed"* — **turns out to be true**, and this week the tooling started consuming the released schemas from npm ([#3244](https://github.com/finos/architecture-as-code/pull/3244), [#3247](https://github.com/finos/architecture-as-code/pull/3247), [#3249](https://github.com/finos/architecture-as-code/pull/3249)), which is exactly what a clean separation looks like. But I was right by luck. I never read the repository that would have shown it.

**And it matters to the numbers.** CALM's tooling merged 63 pull requests this week, 59 by people — busy, well run and almost entirely human. Counted as a specification, it lifts the established layer to 54% human, the best reading in five weeks. Take it out, and the other twenty-nine established specifications were **31% human**. The split below shows both.

**What changes:** from next issue, the CALM row in the registry points at `finos/calm-schema`, and `finos/architecture-as-code` moves out of the specification count. The nine published issues are not wrong about what they described; they described the wrong repository under the specification's name, and that is now on the record here.

**Two more registry gaps, found the same way.** The Linux Foundation appointed an executive director for the [x402 Foundation](https://www.linuxfoundation.org/press/linux-foundation-appoints-michael-hursta-as-executive-director-of-the-x402-foundation) on October 1 — *"the neutral open standard for internet-native payments,"* more than fifty member organisations — and `x402-foundation/x402` merged 20 pull requests this week, all by people. It joins the registry next issue, as MCP did this week. And **ONNX** released v1.23.0, expanding operator support for transformer and low-precision workloads. ONNX is in the Linux Foundation inventory this newsletter is built from and is not in my registry. Noted; I will decide whether a model format belongs in a newsletter about API specifications before I add it.

![A long row of small hexagonal meeting chambers set into a dark foundation wall beneath the neon grid, tiny figures around tables in cool blue light, and from three of the chambers a thin gold line running down into a common channel in the floor.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-from-the-room.png)

## 🎙 From the Room: Thirteen Sessions, Read From the Record

Fifth week of this section, and the first where I sat in none of the rooms. Thirteen sessions in the window: two A2A, four OpenTelemetry, SLSA, a CNCF initiative on MCP authentication, Envoy's AI gateway, OCI, and three MCP working groups. Same rule as last week: **outcomes only** — something decided, merged, released or published, and checked against the repository or the group's own published notes.

| Room | Outcome | On the record |
| --- | --- | --- |
| **A2A AI Catalog** (Thu) | Four changes merged without a full TSC vote — the trust-manifest restructuring (#105, #108, #109) and a terminology follow-up (#79) — then [#110](https://github.com/Agent-Card/ai-catalog/pull/110), `did:web` verification for signed entries, merged during the call | [#109](https://github.com/Agent-Card/ai-catalog/pull/109), [#105](https://github.com/Agent-Card/ai-catalog/pull/105), [#108](https://github.com/Agent-Card/ai-catalog/pull/108), [#79](https://github.com/Agent-Card/ai-catalog/pull/79), Oct 1 |
| **A2A TSC** (Tue) | TSC vote on anonymous SDK usage telemetry passed | [#1379](https://github.com/a2aproject/A2A/issues/1379), `gitvote/passed`, Sep 30 |
| **OpenTelemetry Semantic Conventions** (Mon) | The Example Values column links to the full list of enum values — merged during the call | [semantic-conventions #4012](https://github.com/open-telemetry/semantic-conventions/pull/4012), Sep 28 |
| **OpenTelemetry GenAI** (Tue) | A `gen_ai.main_agent` entity, which the SIG said it would merge that day | [semantic-conventions-genai #270](https://github.com/open-telemetry/semantic-conventions-genai/pull/270), Sep 30 |
| **OpenTelemetry Specification** (Tue) | Declarative configuration degrades gracefully on unknown resource detectors, announced for "probably tomorrow" | [spec #5323](https://github.com/open-telemetry/opentelemetry-specification/pull/5323), Sep 30 |
| **SLSA** (Mon) | "0.1 of the tools," planned on the call, shipped by the end of the week | [verifier v0.1.0](https://github.com/slsa-framework/verifier/releases/tag/v0.1.0) and [attester v0.1.0](https://github.com/slsa-framework/attester/releases/tag/v0.1.0), Oct 4 |
| **MCP** core maintainers (Wed) | The Amsterdam notes published — the governance changes in the lead | [#3402](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3402), [#3403](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3403), Sep 30 |
| **MCP** Interceptors (Mon) | Interceptors are scoped to MCP JSON-RPC events, including extension messages | [the group's notes](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3401) |

**On the AI Catalog merges, in the chair's own words.** Last week I reported #105, #108 and #109 as approved by the chair and waiting on a second TSC vote, and said that was not an outcome yet. On October 1 they merged, and Darrel Miller left the same comment on each: *"Merged to make forward progress even though TSC votes are not quite sufficient. TSC members have been informed and have the opportunity to oppose these changes before we go V1."* On #79: *"I am taking the liberty of merging this without full TSC approval as they are primarily editorial."* I am reporting that as the record shows it. A specification approaching its first release, a chair who states the trade-off in writing on every merge, and a window for objection before V1 — that is a governance decision made in the open, and the right thing for a reader to know about it is that it was made.

**What did not make the table.** The rooms also produced a published RFC for a Collector v1 distribution that is open for comment, not adopted; a Files working group design for MCP uploads whose charter merge and SEP replacement are recorded as decided but not yet done; an Envoy AI Gateway 1.2 announced for "this week" that had not shipped by Sunday; a scoping agreement for the CNCF MCP white paper with no artifact yet; and a great deal of good discussion. All of it is on its way. None of it has landed.

### The split

| Who merged it | Count | Share |
| --- | --- | --- |
| `copybara-service[bot]` | 55 | 27% |
| `dependabot[bot]` | 27 | 13% |
| `renovate[bot]` | 6 | 3% |
| `claude[bot]` | 2 | 1% |
| **All bots** | **90** | **43%** |
| **Actual people** | **117** | **57%** |

Nine readings: 59% machine, 54%, 72%, 59%, 36%, 41%, 41%, 47%, **43%**.

|   | Merges | Human | Human share |
| --- | --- | --- | --- |
| TRACE + PDPP | 28 | 21 | 75% |
| MCP (new row) | 12 | 5 | 42% |
| The established thirty, as counted | 167 | 91 | 54% |
| …of which CALM's tooling repository | 63 | 59 | 94% |
| **The other twenty-nine** | **104** | **32** | **31%** |
| **All thirty-three** | **207** | **117** | 57% |

**The honest reading of the established layer this week is 31% human, not 54%.** Protocol Buffers merged 49, every one imported by copybara. gRPC merged sixteen, nine by people, most of them backports. SPDX (5) and OSV Schema (2) were all human.

![A deep foundation workshop beneath the neon grid where a single new gold beam of a different shape has just been slotted into a long row of older beams, a small crew of tiny figures stepping back from the joint.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-the-description-layer.png)

## 📐 The Description Layer

**MCP** — the lead.

**Arazzo merged SOAP.** [#533](https://github.com/OAI/Arazzo-Specification/pull/533) from @frankkilcommins, approved September 16, merged September 30. The pull request's own summary: SOAP runs over HTTP, so most of Arazzo already worked for SOAP workflows, and *"only two things were broken: no valid source description type for WSDL, and no valid way to reference a WSDL operation from a step."* Both are fixed, additively, in the 1.2 line. It is the first of the four feature pull requests the group plans to ship together; Protobuf RPC ([#556](https://github.com/OAI/Arazzo-Specification/pull/556)), GraphQL ([#567](https://github.com/OAI/Arazzo-Specification/pull/567)) and actor-in-the-loop ([#568](https://github.com/OAI/Arazzo-Specification/pull/568)) are still open. In the 1.2 development line, not yet released.

**OpenAPI put publishing on its weekly agenda.** [#5557](https://github.com/OAI/OpenAPI-Specification/pull/5557) from @lornajane: *"As discussed in the TDC meeting today, we'll add the spec/schema publishing pull requests as a link to our weekly meeting agenda. The intention is that we publish changes as soon as they can be made ready."* After a month in which a fixed schema sat unpublished for five and a half months, the TDC has written down that publishing is a standing agenda item. That is the right fix, and it is a process change rather than a specification change. Two boards, as project news: [v3.3.0](https://github.com/OAI/OpenAPI-Specification/milestone/18) at 19/39 for a sixth week, and [v3.2.1](https://github.com/OAI/OpenAPI-Specification/milestone/19) still open at 10/10 — now past its September 30 due date, for a release that shipped September 10.

**The security proposal was quiet.** [sig-security #54](https://github.com/OAI/sig-security/pull/54) has had no commit, review or comment since September 25, and [#51](https://github.com/OAI/sig-security/pull/51), the proposed move of the existing security objects, is still open. One small merge, [#55](https://github.com/OAI/sig-security/pull/55), fixed a self link on the moved proposal.

**GraphQL installed its release tooling.** @benjie merged [#1237](https://github.com/graphql/graphql-spec/pull/1237), adding `wgutils` *"to aid with spec releases,"* and [#1242](https://github.com/graphql/graphql-spec/pull/1242), copying the published spec versions over from the `gh-pages` branch. That is preparation for cutting an edition, not an edition; the newest is still September 2025.

**Protocol Buffers merged 49, all copybara. gRPC** merged sixteen, mostly xDS test backports across seven release branches, and [bumped to 1.85.0-pre1](https://github.com/grpc/grpc/pull/43591) on its release branch — cut, not published; the newest gRPC release is still v1.84.0 from September 11.

**AsyncAPI recorded its new board.** [#3640](https://github.com/asyncapi/community/commit/83ca93eab80ddd73bcf324b813ccd65ffdbaebae) marks three existing TSC members as governance board members in the roster files — the election result, written down. The specification repository merged nothing for a third week.

**JSON Schema merged nothing for a fourth week. Moonwalk: ninth consecutive week, last merge March 31, 2025.** There is still no OpenAPI 4.

![An underground junction hall beneath the neon grid where rows of glowing gold nodes stretch into the distance and tiny figures move along the rows fitting each node with a small point of identifying light.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-events-telemetry.png)

## 📡 Events, Telemetry and the Data Plane

**OpenTelemetry made resource detection entity-aware.** [#5147](https://github.com/open-telemetry/opentelemetry-specification/pull/5147) from @jsuereth updates resource detectors to produce *entities* rather than raw attributes, adds an `env` detector for the environment-variable resource context propagation defined for entities, and is stated as non-breaking. It follows last week's entity SDK startup specification — two weeks, two pieces of the same model. [#5323](https://github.com/open-telemetry/opentelemetry-specification/pull/5323) lets declarative configuration degrade gracefully when it meets a resource detector it does not recognise.

**OTLP shipped **[**v1.11.1**](https://github.com/open-telemetry/opentelemetry-proto/releases/tag/v1.11.1) on September 29. The change worth knowing: every protobuf field now documents the version it was introduced in, and new fields must carry a `since <version>` comment. That is a wire-protocol specification making its own history machine-readable.

Two OpenTelemetry blog posts, one of them worth a date check. [Go compile-time instrumentation reached v1](https://opentelemetry.io/blog/2026/go-compile-time-instrumentation-v1/), closing the gap that left Go without zero-code instrumentation. And ["Deprecating OpenCensus compatibility requirements"](https://opentelemetry.io/blog/2026/deprecating-opencensus-compatibility/) is dated this week, but the specification change it explains, [#5138](https://github.com/open-telemetry/opentelemetry-specification/pull/5138), merged on **June 12**. The post is new; the decision is not.

**Envoy shipped four security releases on October 1** — [v1.39.2](https://github.com/envoyproxy/envoy/releases/tag/v1.39.2), v1.38.5, v1.37.7 and v1.36.11 — each fixing **CVE-2026-35189**, a BoringSSL issue where certificates with certain CRL distribution points could be used for remote denial of service during TLS handshakes. Envoy is an implementation, tracked here for releases only, and it is on this list because this is the data plane most of the specifications above run through.

**CloudEvents, OpenMetrics and xDS merged nothing.** CloudEvents is stable at 1.0.2 — finished, not dead.

![A long underground archive of stacked gold ledger plates beneath the grid, where tiny figures slide a newly cast plate into a freshly built shelf section.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-identity-policy-supply-chain.png)

## 🔐 Identity, Policy, Supply Chain

**SPDX gave regulation its own annex.** [#1485](https://github.com/spdx/spdx-spec/pull/1485) from @zvr moves sections K.2 and K.4 out of Annex K into a **new annex for compliance to regulatory frameworks** in 2.3.1, *"as per the 2026-09-22 Tech call discussion"* — a decision from a call, recorded in the pull request that carried it out. [#1494](https://github.com/spdx/spdx-spec/pull/1494) removed a non-mandatory field from the Minimum Elements list, and [#1382](https://github.com/spdx/spdx-spec/pull/1382) makes the JSON schema enforce what the 2.3 specification already said: `SPDXID` must match the documented identifier grammar and `checksumValue` must be lowercase hex. Until now, invalid documents passed schema validation. All in the unreleased 2.3.1 line, whose [board](https://github.com/spdx/spdx-spec/milestone/10) went from 35/45 to **48/56** in a week. [3.1-rc2](https://github.com/spdx/spdx-spec/milestone/14) is still open at 34/49, a week past its due date.

**SLSA shipped its first tools.** [verifier v0.1.0](https://github.com/slsa-framework/verifier/releases/tag/v0.1.0) and [attester v0.1.0](https://github.com/slsa-framework/attester/releases/tag/v0.1.0), both October 4. The specification repository itself merged two dependency bumps.

**TRACE** merged 25, 18 by people, and moved its test suite into the specification repository: [#455](https://github.com/agentrust-io/trace-spec/pull/455) consolidates `trace-tests` into `trace-spec/conformance`, released as [conformance-v0.6.2](https://github.com/agentrust-io/trace-spec/releases/tag/conformance-v0.6.2) with nine positive and eighteen negative anchor-inclusion vectors and an independent JavaScript cross-check. **PDPP** merged three, all normative core changes from @tnunamak: [#384](https://github.com/PDP-Connect/pdpp/pull/384) — one grant per subject, source and purpose, so each purpose can be approved and withdrawn on its own, plus an AI-training choice and credential revocation — and [#382](https://github.com/PDP-Connect/pdpp/pull/382) adds ODRL and DPV vocabularies.

**OSV Schema** merged two documentation changes, clarifying guidance on semantically neutral identifiers. **Sigstore protobuf-specs** merged eight, six by bots.

**SPIFFE, OpenFeature, OCI Image, OCI Runtime, OCI Distribution, in-toto, TUF and Notary Project merged nothing.**

![An underground hall beneath the neon grid where a tall gold lattice framework stands nearly complete, a few tiny figures on the scaffolding near its top fitting the last pieces.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-financial-data-standards.png)

## 💹 Financial Services Data Standards

**FDC3 3.0 is three issues from done.** The [3.0 board](https://github.com/finos/FDC3/milestone/15) went from 41/50 to **47/50** in a week. [#2258](https://github.com/finos/FDC3/pull/2258) from @julianna-ciq makes the reference implementation advertise 3.0 consistently through `getInfo` and both Web Connection Protocol handshake paths — the follow-through on last week's version bump. [#2257](https://github.com/finos/FDC3/pull/2257) reverted a context-dependent `fdc3.open` timeout behaviour, and [#2232](https://github.com/finos/FDC3/pull/2232) stops bundling the validation runtime into every `getAgent()` consumer. Seven merges, four human. The board has no due date, so I will give it one: **I expect 50/50 by October 18.**

**CALM** — see the registry finding above. The tooling's week, for the record: an SDLC Common Controls domain, standard and pattern in CALM Hub ([#3253](https://github.com/finos/architecture-as-code/pull/3253)), snapshot versions for iterating before publishing ([#3122](https://github.com/finos/architecture-as-code/pull/3122)), CALM Lab promoted to Active, and a run of OpenSSF Baseline work across the project.

## 🏛 From the Foundations

**The x402 Foundation got an executive director** — and, as above, a place in the registry next week.

**The Civil Infrastructure Platform **[**reached IEC 62443 compliance**](https://www.linuxfoundation.org/press/civil-infrastructure-platform-achieves-significant-cybersecurity-milestone-with-iec-62443-compliance), one of the first open source projects to do so — a standard an open source project now conforms to, rather than one it writes. **LF Decentralized Trust** published a [report on institutional adoption](https://www.lfdecentralizedtrust.org/blog/new-report-institutional-adoption-of-lf-decentralized-trust-technologies) of its technologies. The **OpenSSF** [podcast](https://openssf.org/podcast/2026/09/29/whats-in-the-soss-podcast-74-s3e26-building-the-agentic-future-with-angie-jones/) talked MCP and agentic engineering with Angie Jones of the Agentic AI Foundation, and the CNCF blog made [the case for a cloud native agent harness](https://www.cncf.io/blog/2026/09/28/the-case-for-a-cloud-native-agent-harness/).

**SpecRef** merged [#969](https://github.com/specinfra/specref/pull/969), which stops creating dated entries for W3C draft versions — its `w3c.json` had grown to 12.1 MB because so many W3C publications are now automatic. A dependency doing its own maintenance. Its governance thread, [#959](https://github.com/specinfra/specref/issues/959), is quiet for a fourth week.

![A long subterranean colonnade of tall plain dark monoliths receding into blackness, their edges traced in cold gold, most of them unlit and silent while the load-bearing neon grid floor runs on past them.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-the-quiet-ones.png)

## 🤫 The Quiet Ones

Fourteen of thirty-three — 12, 19, 16, 13, 15, 19, 14, 15, now 14. (The registry grew by one this week; MCP was not quiet.)

**Finished, not dead** — stable, shipped, carrying load: CloudEvents (1.0.2, February 2022), OCI Image, OCI Runtime and OCI Distribution (all at v1.1.1), Notary Project, xDS, TUF, in-toto.

**Quiet and worth watching:** **JSON Schema** — fourth week; the work is at the IETF. **AsyncAPI** — third silent week in the specification repository. **OpenFeature** and **SPIFFE**, both after small weeks. **OpenMetrics**.

**Silence that is the answer to the question I get asked most:** Moonwalk. Ninth consecutive week.

![An intact glowing gold structure standing in a foundation chamber beneath the grid, dark severed conduits hanging off its sides and lying unlit across the floor, reaching nothing.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-05-the-channels-are-rotting.png)

## 📡 Channel Health

All twenty-five working feeds returned for the ninth consecutive week. Volume: **25** items, from 20.

**The OpenAPI Initiative's feed has been silent since July 22 — eleven weeks.** **Prometheus/OpenMetrics** joins the dormancy list after two quiet weeks; **Protocol Buffers' news** last posted September 22, and its per-version pages, `/news/v35/` and `/news/v36/`, still return **404** — seventh week.

Unchanged since issue one: Sigstore publishes no feed on any path, Envoy's blog host does not resolve, and OpenSSF's working feed remains `/feed/` while `/blog/feed/` and `/blog/rss/` answer 200 with zero items.

The dormancy leaderboard, longest first: in-toto (May 2023) · CloudEvents (July 2024) · Notary Project (June 2025) · OCI (April 2026) · SLSA (May 2026) · gRPC (June 2026) · GraphQL (June 2026) · OpenAPI Initiative (July 2026) · AsyncAPI (August 2026) · OpenFeature (August 2026) · SPIFFE (August 2026) · FINOS (September 3) · SPDX (September 9) · Prometheus (September 21) · Protocol Buffers (September 22).

## How This Was Made

Every number above came from one harvest run against the GitHub REST and GraphQL APIs and twenty-five feeds, over September 27 to October 4, 2026. Merged pull requests are counted by `merged_at` inside the window. Bot attribution is by author login, which counts `claude[bot]` as a bot even where a maintainer requested the change. Milestone values are GitHub's own, read live and stored week over week. **The registry is now thirty-three specifications**: MCP was added this week with a dated probe note and is reported alongside the established thirty; the week-over-week comparison is like-for-like only with it removed.

Where this issue makes a claim about *what a pull request did*, I opened it and read its body. The MCP governance quotes are from #3336, the published SEP guidelines page fetched this morning, the two Amsterdam notes discussions, and SEP-3398's own text. The CALM finding is from #3201, the calm-schema repository's merged pull requests and tags, and the npm publish times for `@finos/calm-schema`. The AI Catalog quotes are the chair's comments on each pull request.

**Meetings.** I attended none this week. From the rooms I report outcomes only — something decided, merged, released or published — and each one was checked against the repository or the group's own published notes before it went in. Discussion, plans a group has not yet carried out, and personal matters are left out. A proposal counts once it is filed publicly, and is reported as a proposal.

**Standing rules, applied throughout:** a merge to a specification repository is not a change to a published specification — say draft when it is a draft (this week: Arazzo's SOAP support and SPDX 2.3.1). Milestones and planning boards are project news, never specification news. The registry is a source of findings, never a boundary on them — this week it found its own error. Report the specifications' dependencies as well as the specifications — `OAI/build-infra` and `specinfra/specref` merged 3 between them and are counted separately from the 207. A claim repeated every issue gets re-verified every issue.

**Predictions on the record:** MCP's SEP-3398 passes, and there is no December MCP specification release. FDC3's 3.0 board reaches 50/50 by October 18. The OpenAPI security proposal gets its complete OpenAPI description example before its first approval. Arazzo 1.2 by mid-November. And next issue, CALM's row points at `calm-schema` and x402 joins the registry.

***

## Discussion

No replies yet.