---
type: "article"
title: "The Specification Layer — MCP Gave Discovery to the AI Catalog"
summary: "MCP Server Cards reached Final this week, and the most consequential line in them is the one where MCP declines to own discovery: a domain advertises its MCP servers through an AI Catalog at /.well-known/ai-catalog.json, the A2A project's format, and the card itself stays deliberately static, leaving capabilities to live negotiation. Also: Overlay 1.2, which I held for three weeks at the group's request, is published with its schemas and now in SchemaStore; FDC3 3.0's board closed and a beta shipped; CALM's row now reads the specification instead of the tooling; x402 joins the count, with a warning attached; and the established layer was 40% human."
newsletter: "The Specification Layer"
newsletter_handle: "the-specification-layer"
newsletter_url: "https://usecommune.com/n/the-specification-layer"
author: "Kin Lane (@kinlane)"
published: "2026-10-12T14:35:50.778Z"
canonical_url: "https://usecommune.com/n/the-specification-layer/a/cRmXxZX9"
markdown_url: "https://usecommune.com/n/the-specification-layer/a/cRmXxZX9.md"
chat_url: "https://usecommune.com/n/the-specification-layer/a/cRmXxZX9/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 3897
---

# The Specification Layer — MCP Gave Discovery to the AI Catalog

This is the tenth issue of The Specification Layer.

**This newsletter window:** October 4 through October 11. Thirty-four specification repositories and twenty-five feeds, all read clean for the tenth consecutive week — no source errored. **124 pull requests merged. 7 releases cut. 33 posts published.** Eleven of the thirty-four specifications did not move. The two release-path dependencies merged nothing.

**Two registry changes, both promised last week, both made.** CALM's row now reads `finos/calm-schema`, the specification, instead of `finos/architecture-as-code`, the tooling — so CALM went from 63 merges last week to one, and that is not a collapse, it is the correction. And **x402 joins**, reported alongside the established thirty like MCP, with a caution I explain in the financial section.

**That 124 is down 83 on last week, and most of the drop is the CALM correction.** Like for like — the established specifications without CALM's tooling — merges went from 104 to 86.

**Predictions from last week, graded:**

| Prediction | Result |
| --- | --- |
| MCP's SEP-3398 passes, and there is no December MCP release | **Open.** The core maintainers moved it to a vote on October 7. No result is on the record yet. |
| FDC3's 3.0 board reaches 50/50 by October 18 | **Right, early.** The board grew by two and closed at **52/52** by October 8, and [v3.0.0-beta.1](https://github.com/finos/FDC3/releases/tag/v3.0.0-beta.1) shipped October 7. |
| The OpenAPI security proposal gets its complete OpenAPI description example before its first approval | **Open.** [sig-security #54](https://github.com/OAI/sig-security/pull/54) has not moved since September 25. |
| Arazzo 1.2 by mid-November | **Still one of four.** #556, #567 and #568 are open; Arazzo merged nothing this week. |
| CALM's row points at `calm-schema`, and x402 joins the registry | **Done.** |

![Beneath the neon grid, a long underground gallery where a single small gold card hangs at the mouth of a glowing round shaft that descends to a shared catalog chamber below, thin lines of light running from the card down into the chamber while the card itself stays dark and still.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-the-lead.png)

## The Lead: MCP Gave Discovery to the AI Catalog

[SEP-2127, "MCP Server Cards — HTTP Server Discovery,"](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) merged on October 6 with its status set to **Final**. It was opened in January, moved over from an earlier proposal, and drew review from three working groups before @tadasant and @kurtisvg approved and @dsp-ant merged it. It is an Extensions Track SEP — the extension identifier is `io.modelcontextprotocol/server-card` — and its normative wire format lives in its own repository, `ext-server-card`, not in the SEP.

A Server Card is a static document describing a *remote* MCP server before anyone connects to it: its name, version and description, its transport endpoints, and the protocol versions it supports. Cards can live at any unreserved URI; `<streamable-http-url>/server-card` is the recommended location.

**The line I want every API provider to read is the one about discovery.** The SEP does not define a well-known location for MCP. It hands that job to someone else:

> *"For domain-level discovery, an AI Catalog can link to or embed the relevant Server Cards."*

And the example is explicit: a restaurant *"would advertise the two relevant Server Cards in an AI Catalog at *`restaurant-a.com/.well-known/ai-catalog.json`*."* The [AI Catalog](https://github.com/Agent-Card/ai-catalog) is the A2A project's specification — a different working group, a different repository, and, as of this week, pushing for a 0.9 release candidate before AgentCon. MCP is building on it rather than beside it: *"leaving the catalog responsible for domain-level discovery and the Server Card responsible for MCP-specific identity and connection details."*

That is two Linux Foundation-hosted agent protocols agreeing on who owns which layer of discovery, in a merged, Final document. I have been arguing for a single front door for a provider's machine-readable surface since APIs.json. This is the first time I have seen two of the agent protocols put it in writing.

### The card is static on purpose

The second thing worth reading slowly is what the card leaves out. It does not advertise capabilities or extension support:

> *"capabilities and extensions describe negotiated runtime behavior and can depend on the client, identity, configuration, and deployment state. They remain available through live protocol negotiation."*

`supportedProtocolVersions` tells a client whether to *try*. What the server will actually do, it tells you when you connect. I heard the same principle argued for OpenAPI on Thursday's community call, and [wrote it up afterwards](https://apievangelist.com/2026/10/08/three-specification-calls-in-one-thursday/): when a description and the runtime disagree, the most dynamic source wins, and a value you write into a document is a cache that can go stale. MCP has now designed a discovery document around exactly that limit. I think it is the right call, and I think every description format in this newsletter is going to have to decide where its own line is.

### The rest of MCP's week

- **SEP-3398, the release cycle, moved to a vote.** The [October 7 core maintainer notes](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3421): one comment, approving, no objections — *"@kurtisvg opens the vote."* No result by Sunday.
- **SEP-3371, consistent SDK extension points, was not voted.** Same notes: the authors return with a transport-layer middleware proposal and a versioning path. The open question is whether middleware sits at the JSON-RPC layer or the transport — auth and Server Cards being the HTTP-only cases. I sat in on the Files working group's filesystems track the same day, and its plan waits on this SEP.
- **Pluggable transports: no vote, data model first.** The maintainers split it into three proposals — describe MCP's data model independently of JSON-RPC, decide whether custom transports must still carry JSON-RPC, then a tier-one transport interface. *"Protobuf over gRPC is not MCP today even with the same data model."*
- **The Files working group consolidation was abandoned.** Last week I noted [#3389](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3389), merging the File Uploads and Filesystems groups, as decided but not done. On October 11 it was closed: *"We're actually going to abandon this, per discussion in Discord, and keep the WGs separate for now."*
- **A Governance Working Group was chartered** — [#3423](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3423), from @sarahnovotny, a single home for revising MCP's governance documentation and an advisory channel to the core maintainers.

MCP merged six this week, five by people.

![A vaulted chamber beneath the grid where a gold translucent layer has been lowered over a long unchanged stone slab, the two resting exactly on top of each other, a pale beam of light from above finally falling on both after a long dark.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-overlay.png)

## Overlay 1.2, Now Reported

In issue #08 I pulled the Overlay 1.2 release out of the lead at the working group's request, and I have held it since. The group is ready, it is published, and here it is.

- **Released** — [Overlay 1.2.0](https://github.com/OAI/Overlay-Specification/releases/tag/1.2.0), September 22 at 15:29 UTC. The [Release 1.2 board](https://github.com/OAI/Overlay-Specification/milestone/4) is 7/7.
- **Published** — [the 1.2.0 specification](https://spec.openapis.org/overlay/v1.2.0.html) is live on spec.openapis.org, and the publishing site merged [#141, "Overlay - publish schema iterations,"](https://github.com/OAI/spec.openapis.org/pull/141) on October 6.
- **In SchemaStore** — @baywet's [#6465](https://github.com/SchemaStore/schemastore/pull/6465) added the Overlay 1.2 schema on October 8, alongside [#6466](https://github.com/SchemaStore/schemastore/pull/6466) (updated OpenAPI 3.x schemas) and [#6467](https://github.com/SchemaStore/schemastore/pull/6467) (Arazzo 1.1). Editors that validate through SchemaStore now know about all three.

The headline features are `$self` and a `components` section for reusable actions. The repository itself merged two housekeeping changes this week from @baywet, the schema-publishing workflow triggers and contributing-branch guidance. The [1.3](https://github.com/OAI/Overlay-Specification/milestone/5) board is at 0/3 and [2.0](https://github.com/OAI/Overlay-Specification/milestone/2) at 4/7.

There is also a live argument about what Overlays are *for*, in [discussion #412](https://github.com/OAI/Overlay-Specification/discussions/412). I took part, [and wrote up my position](https://apievangelist.com/2026/10/08/an-overlay-is-a-layer-not-a-diff/) — an overlay is a layer, not a diff — so read that as a participant's view, not this newsletter's.

![A long row of small hexagonal meeting chambers set into a dark foundation wall beneath the neon grid, tiny figures around tables in cool blue light, and from several of the chambers a thin gold line running down into a common channel in the floor.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-from-the-room.png)

## 🎙 From the Room: Sixteen Sessions, Six Outcomes

Sixth week of this section. Fourteen sessions are in the groups' own public recordings and notes, and I sat in on three calls — the OpenAPI community call, the A2A AI Catalog, and MCP's Files working group — two of which have no public record. Same rule as always: **outcomes only**, each checked against the repository.

| Room | Outcome | On the record |
| --- | --- | --- |
| **MCP** core maintainers (Wed) | SEP-3398 to a vote; SEP-3371 sent back; pluggable transports split into three SEPs | [#3421](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3421), Oct 7 |
| **MCP** Progressive Disclosure (Mon) | Problem statement and tool-search analysis ratified | [the group's notes](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/3416) |
| **A2A AI Catalog** (Thu) | [#119](https://github.com/Agent-Card/ai-catalog/pull/119) merged during the call — only the Go and Rust SDKs stay listed as official implementations | [recording](https://zoom.us/rec/share/w2ZegtvNPoP5Q4ccL8l5SOowu8OYemo9OKpOBghNrCjC4xatx0xScEoq0aDc_Qw2.W72wt3bJoyfxyKHx), Oct 8 |
| **CloudEvents / xRegistry** (Thu) | xRegistry pagination changes accepted and merged the same day | [xregistry #738](https://github.com/xregistry/spec/pull/738), Oct 8 |
| **OpenTelemetry Semantic Conventions** (Mon) | The v2 migration marking identifying attributes on entities landed its first pieces — OS and CPU, container, deployment | [#4165](https://github.com/open-telemetry/semantic-conventions/pull/4165), [#4164](https://github.com/open-telemetry/semantic-conventions/pull/4164), [#4167](https://github.com/open-telemetry/semantic-conventions/pull/4167), Oct 6–11 |
| **Envoy AI Gateway** (Mon) | The release discussed shipped as [v1.2.0](https://github.com/theagentrouter/agent-router/releases/tag/v1.2.0) — the first under the **Agent Router** name; `envoyproxy/ai-gateway` now redirects to `theagentrouter/agent-router` | Oct 7 |
| **OpenAPI** community call (Thu) | Companion specifications will be versioned per special interest group | my notes; no public recording |

**On the AI Catalog, what is coming rather than what landed.** The group set its sights on a **0.9 release candidate before AgentCon**, with the self-contained trust-manifest change, [#117](https://github.com/Agent-Card/ai-catalog/pull/117), as the one change planned for 0.9 — still open. It also agreed to start an "awesome AI catalogs" repository: a catalog of catalogs, linted, with a large disclaimer. Read the lead with that in mind. MCP just pointed its discovery at a specification that has not shipped 0.9.

**Announced, not landed by Sunday:** A2A [#2270](https://github.com/a2aproject/A2A/pull/2270), clarifying terminal versus interrupted task states, approved for the 1.1 branch on the TSC call and still open — A2A is still at v1.0.1. xRegistry [#741](https://github.com/xregistry/spec/pull/741), header handling, "conditionally approved." The remaining semantic-conventions entity migrations. Envoy's quota-aware load balancing ([#47805](https://github.com/envoyproxy/envoy/pull/47805)). OpenTelemetry GenAI's [#571](https://github.com/open-telemetry/semantic-conventions-genai/pull/571), with naming pushed to a later session.

**No outcome:** the OpenTelemetry Specification SIG (no agenda, adjourned early), OSV (two attendees), the two GenAI sessions beyond the above, OpenFeature (updates only), and OCI (a review-queue walkthrough; nothing merged).

### The split

| Who merged it | Count | Share |
| --- | --- | --- |
| `copybara-service[bot]` | 39 | 31% |
| `dependabot[bot]` | 18 | 15% |
| `renovate[bot]` | 5 | 4% |
| `mintlify[bot]` | 2 | 2% |
| `claude[bot]` | 1 | 1% |
| **All bots** | **65** | **52%** |
| **Actual people** | **59** | **48%** |

Ten readings: 59% machine, 54%, 72%, 59%, 36%, 41%, 41%, 47%, 43%, **52%**.

|   | Merges | Human | Human share |
| --- | --- | --- | --- |
| TRACE + PDPP | 23 | 13 | 57% |
| MCP + x402 (newest rows) | 14 | 11 | 79% |
| **The established thirty** | **87** | **35** | **40%** |
| **All thirty-four** | **124** | **59** | 48% |

**The established layer was 40% human, up from last week's honest 31.** Protocol Buffers merged 32, every one imported by copybara; gRPC merged eight, one by a person. SPDX (10), FDC3 (10 of 11) and the Overlay, JSON Schema, OpenAPI, OCI Runtime, TUF and CALM merges were people.

**A counting note I owe you.** Bot attribution here has always been by login: an account ending in `[bot]`, or copybara. Three accounts this week merged work that a machine did under an ordinary user login — `PhilBot402` in x402, described on its own profile as *"PhilBot by @phdargen,"* plus `prombot` and `renovate-bot`. Five merges between them. The login rule counts them as people, and I have kept it so this week compares with the last nine. Counted as machines, the split is 56% machine. I will decide next week whether to change the rule, and say so if I do.

![A foundation hall beneath the neon grid where a single gold causeway runs straight down the middle between stepped stone structures, a few tiny figures standing along its edges.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-the-description-layer.png)

## 📐 The Description Layer

**MCP** and **Overlay** — above.

**JSON Schema restored a definition it had broken by accident.** [#1786](https://github.com/json-schema-org/json-schema-spec/pull/1786) from @Kaileshwar16 returns the `uri` format to *"a valid URI according to RFC 3986."* During the move from URI to IRI terminology it had been changed to RFC 3987, which made `uri` identical to `iri`. A specification bug fix — in the development draft, not the published 2020-12. [#1782](https://github.com/json-schema-org/json-schema-spec/pull/1782) removed stale changelog entries. JSON Schema's first merges in five weeks.

**OpenAPI merged one template fix** and holds two boards: [v3.3.0](https://github.com/OAI/OpenAPI-Specification/milestone/18) at 19/39 for a seventh week. The real work is in the special interest groups, where the companion-specification approach decided on Thursday's call has to be written down next.

**gRPC cut **[**v1.85.0-pre1**](https://github.com/grpc/grpc/releases/tag/v1.85.0-pre1) on October 9 — a pre-release; v1.84.0 is still the newest stable. **Protocol Buffers** merged 32, all copybara, including conformance-test fixtures and a `--source_code_info_out` compiler flag.

**AsyncAPI recorded a board and maintainer update** ([#3643](https://github.com/asyncapi/community/commit/b027d3b967bd0db2a292c192fc1ee014885912aa)) and posted its September community update; the specification repository merged nothing for a fourth week. **Arazzo, GraphQL and Moonwalk merged nothing.** Moonwalk: tenth consecutive week, last merge March 31, 2025. There is still no OpenAPI 4.

![An underground junction hall beneath the neon grid where rows of glowing gold nodes stretch into the distance and a single new conduit is being fed into the row from the side, tiny figures splicing it in.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-events-telemetry.png)

## 📡 Events, Telemetry and the Data Plane

**OpenTelemetry mapped systemd's journal.** [#4995](https://github.com/open-telemetry/opentelemetry-specification/pull/4995) from @bachp adds an example mapping of journald fields to the OpenTelemetry log data model, with a Collector prototype behind it. Two spec-compliance matrix updates (JavaScript logs, .NET) and two dependency bumps made five. The blog previewed **the Java agent 3.0**, targeted for October, with 2.32.0 as its release candidate.

**Envoy shipped four patch releases on October 6** — [v1.39.3](https://github.com/envoyproxy/envoy/releases/tag/v1.39.3), v1.38.6, v1.37.8 and v1.36.12 — tracked here for releases only. And its AI gateway is now [**Agent Router**](https://github.com/theagentrouter/agent-router), shipping v1.2.0 under the new name.

**OTLP** merged two dependency bumps, **OpenMetrics** one synced file. **CloudEvents and xDS merged nothing** — CloudEvents is stable at 1.0.2, finished, not dead; its weekly call did its work in xRegistry this week.

![A long underground archive of stacked gold ledger plates beneath the grid, where tiny figures reroute one thin gold thread so that it no longer passes through a neighbouring plate on its way down.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-identity-policy-supply-chain.png)

## 🔐 Identity, Policy, Supply Chain

**TUF released **[**v1.0.37**](https://github.com/theupdateframework/specification/releases/tag/v1.0.37) with one normative clarification. [#327](https://github.com/theupdateframework/specification/pull/327) from @cyphar: the spec's wording implied a client should keep a global list of roles walked and never walk into the same role twice, even down different delegation paths — which was meant only to stop cycles. Skipping silently *"could potentially allow a delegated role A to mask entries from a different delegated role B."* Unlikely to be practical, the author says, *"but it's better to be safe than sorry."* Now roles are skipped only when they recur in the same path.

**OCI Runtime relaxed a rule to match reality.** [#1324](https://github.com/opencontainers/runtime-spec/pull/1324) from @kolyshkin allows `delete` of a container in the `created` state — which runc and crun have both done since before runtime-spec 1.0.0 — while keeping the old behaviour, an error, valid. A specification catching up with its implementations, years later.

**SPDX 2.3.1 is one issue from done.** Ten merges, all from people, nearly all release preparation — title, version numbers, contributor list, a "Differences between V2.3.1 and V2.3" annex, and a publish workflow defaulting to v2.3.1. The [2.3.1 board](https://github.com/spdx/spdx-spec/milestone/10) went from 48/56 to **55/56**. [3.1-rc2](https://github.com/spdx/spdx-spec/milestone/14) is at 36/49, two weeks past its due date. SPDX's blog counted [four new SPDX tools in five weeks](https://spdx.dev/4-new-spdx-tools-in-the-last-5-weeks/).

**TRACE** merged 20, 12 by people, including [#477](https://github.com/agentrust-io/trace-spec/pull/477), a normative section on what a matching platform measurement actually covers on a measured-boot platform. **PDPP extended its public review** to October 26 ([#399](https://github.com/PDP-Connect/pdpp/pull/399)) because *"several people said their comments are coming"*; the v0.1.0 lock moves with it. **OpenFeature** now cuts specification releases with release-please ([#440](https://github.com/open-feature/spec/pull/440)), the base of a provider-conformance stack.

**SLSA, OSV Schema and Sigstore protobuf-specs** merged only dependency bumps. **SPIFFE, OCI Image, OCI Distribution, in-toto and Notary Project merged nothing.**

![An underground hall beneath the neon grid where a tall gold lattice framework stands complete with its scaffolding coming down, and beside it a new, smaller frame is being raised in a different shape, wrapped in machinery.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-financial-data-standards.png)

## 💹 Financial Services Data Standards

**FDC3 3.0 closed its board and shipped a beta.** The [3.0 milestone](https://github.com/finos/FDC3/milestone/15) reached 52/52, and [v3.0.0-beta.1](https://github.com/finos/FDC3/releases/tag/v3.0.0-beta.1) went out on October 7 with 3.0 branding and a versioned website. A beta, not 3.0. Ten of eleven merges were human. The one I want to flag: [#2204](https://github.com/finos/FDC3/pull/2204) adds a `StartPayment`** intent and an **`fdc3.payment`** context** *"to support standardized institutional payments and blockchain settlement,"* bridging to ISO 20022. Payments arriving in a desktop interoperability standard is new.

**x402 joins the count — with a warning.** The [x402 Foundation](https://www.linuxfoundation.org/press/linux-foundation-appoints-michael-hursta-as-executive-director-of-the-x402-foundation) is the Linux Foundation's home for *"the neutral open standard for internet-native payments,"* and `x402-foundation/x402` is now a registry row. But it is a monorepo: the specification lives under `specs/`, beside TypeScript, Python, Go and Java SDKs, contracts, examples and documentation. That is the CALM mistake waiting to happen again, so the rule is in the registry: a merge there is a specification change only if it touches `specs/`. This week, of eight merges, **one did** — [#3666](https://github.com/x402-foundation/x402/pull/3666) from @phdargen adds facilitator-authored settlement metadata (`m`) to the `builder-code` extension, with deterministic CBOR encoding and a 65,535-byte limit. The rest were SDK and documentation work.

**CALM, now read correctly.** `finos/calm-schema` merged one change: [#35](https://github.com/finos/calm-schema/pull/35), the project's badge updated from Incubating to **Graduated**, plus a Cyber Resilience Act notice. No schema change — the schema is still the 1.2 published to npm on August 7. The tooling repository made the same Graduated change ([#3282](https://github.com/finos/architecture-as-code/pull/3282)), shipped CLI 1.61.0, and is no longer counted here.

## 🏛 From the Foundations

**The Linux Foundation released the **[**OpenChain Automotive SBOM Framework 1.0**](https://www.linuxfoundation.org/press/linux-foundation-releases-openchain-automotive-sbom-framework-1.0-for-greater-reliability-and-traceability-in-automotive-software) — a sector framework built on the SBOM standards this newsletter tracks. And **OSERA** reported that major banks back it, with *"an open standard for AI-scale remediation and attestation of vulnerabilities"* [within its first 100 days](https://www.linuxfoundation.org/press/major-banks-back-osera-to-deliver-industry-wide-remediation-standards-and-fixes-to-secure-open-source-software). I have not yet found that standard's repository; until I do, it is a claim in a press release, not a row in my registry.

**AWS became a **[**Platinum member**](https://www.linuxfoundation.org/press/aws-becomes-a-platinum-member-of-the-linux-foundation-deepening-commitment-to-open-source)** of the Linux Foundation**, and OVHcloud of the CNCF. The LF launched [**OpenGrid**](https://www.linuxfoundation.org/press/linux-foundation-launches-opengrid-to-build-open-shared-infrastructure-for-the-worlds-electric-grid) for electric-grid infrastructure. **OpenSSF** added four members, JetBrains among them, and [released CRA resources](https://openssf.org/press-release/2026/10/06/openssf-shares-expanded-membership-and-new-global-policy-resources-during-community-day-europe/); the Cyber Resilience Act showed up in the repositories too, as CRA sections added to CALM's security files. OpenChain [welcomed KushBitx](https://openchainproject.org/conformance/2026/10/05/kushbitx-joins-the-openchain-community-of-conformance) to its conformance community.

The CNCF blog asked the question this newsletter keeps circling: [*"Don't give AI agents root. Make them propose the next system state."*](https://www.cncf.io/blog/2026/10/08/dont-give-ai-agents-root-make-them-propose-the-next-system-state/)

![A long subterranean colonnade of tall plain dark monoliths receding into blackness, their edges traced in cold gold, most of them unlit and silent while the load-bearing neon grid floor runs on past them.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-10-12-the-quiet-ones.png)

## 🤫 The Quiet Ones

Eleven of thirty-four — 12, 19, 16, 13, 15, 19, 14, 15, 14, now 11.

**Finished, not dead** — stable, shipped, carrying load: CloudEvents (1.0.2, February 2022), OCI Image and OCI Distribution (v1.1.1), Notary Project, xDS, in-toto.

**Quiet and worth watching:** **Arazzo**, with three feature pull requests open for 1.2. **AsyncAPI**, fourth silent week in the specification repository. **GraphQL**, after installing release tooling last week. **SPIFFE**.

**Silence that is the answer to the question I get asked most:** Moonwalk. Tenth consecutive week.

## 📡 Channel Health

All twenty-five working feeds returned for the tenth consecutive week. Volume: **33** items, from 25.

**AsyncAPI and SPDX are off the dormancy list** — AsyncAPI posted its September community update, SPDX its tools roundup. **The OpenAPI Initiative's feed has been silent since July 22 — twelve weeks**, in the week Overlay 1.2 reached SchemaStore. The news is happening; the channel is not carrying it.

Unchanged since issue one: Sigstore publishes no feed on any path, Envoy's blog host does not resolve, and OpenSSF's working feed remains `/feed/`.

The dormancy leaderboard, longest first: in-toto (May 2023) · CloudEvents (July 2024) · Notary Project (June 2025) · OCI (April 2026) · SLSA (May 2026) · gRPC (June 2026) · GraphQL (June 2026) · OpenAPI Initiative (July 2026) · OpenFeature (August 2026) · SPIFFE (August 2026) · FINOS (September 3) · Prometheus (September 21) · Protocol Buffers (September 22) · LF Edge (September 28) · LF Decentralized Trust (September 29) · LF Networking (October 1).

## How This Was Made

Every number above came from one harvest run against the GitHub REST and GraphQL APIs and twenty-five feeds, over October 4 to October 11, 2026. Merged pull requests are counted by `merged_at` inside the window. Bot attribution is by author login — `[bot]` accounts and copybara — which counts `claude[bot]` as a bot and counts machine accounts with ordinary logins as people; this week that is five merges, disclosed in the split. Milestone values are GitHub's own, read live and stored week over week.

**The registry is now thirty-four specifications.** CALM's row moved from the tooling repository to `finos/calm-schema`, so week-over-week CALM numbers are not comparable with issues #01–#09. x402 was added with a dated probe note and a rule that only merges touching `specs/` are reported as specification changes. MCP, x402, TRACE and PDPP are reported alongside the established thirty, never inside them.

Where this issue makes a claim about *what a pull request did*, I opened it and read its body. The lead quotes are from the merged text of SEP-2127 itself, not its pull-request description. The MCP governance items are from the core maintainers' published notes of October 7 and the pull requests they name. The Overlay facts are from the release, the spec site and the SchemaStore pull requests.

**Meetings.** I attended three calls this week; two have no public recording, and from those I report only what I have also written about publicly. From every room I report outcomes only — something decided, merged, released or published — each checked against the repository or the group's own published notes. Discussion, plans a group has not yet carried out, and personal remarks are left out.

**Standing rules, applied throughout:** a merge to a specification repository is not a change to a published specification — say draft when it is a draft (this week: JSON Schema's `uri` fix, SPDX 2.3.1). Milestones and planning boards are project news, never specification news. The registry is a source of findings, never a boundary on them. Report the specifications' dependencies as well — `OAI/build-infra` and `specinfra/specref` merged nothing. A claim repeated every issue gets re-verified every issue.

**Predictions on the record:** SEP-3398 passes and there is no December MCP specification release (carried). FDC3 3.0 final, not beta, by the end of November. SPDX 2.3.1 publishes by October 25. The A2A AI Catalog ships its 0.9 release candidate before AgentCon. The OpenAPI security proposal gets its complete example before its first approval (carried). Arazzo 1.2 by mid-November (carried).

***

## Discussion

No replies yet.