Shared Core and Agent Architecture Source Pack

Source pack version 0.1 — verified 2 August 2026
This source pack records the status and intended use of each reference. A published specification does not guarantee tooling maturity or make every implementation conformant.

Status labels

Normative baseline — selected stable baseline for ANUKA contracts.
Baseline candidate — stable specification requiring an implementation ADR and tooling validation.
Implementation reference — useful official guidance or protocol that may be adopted by a component.
Tracking — draft, release candidate, or evolving work not automatically adopted.
Security baseline — official secure-development or operational reference.

HTTP and API contracts

OpenAPI Specification 3.2.0

Publisher: OpenAPI Initiative
URL: spec.openapis.org/oas/v3.2.0
Published: 19 September 2025
State: Baseline candidate
Used for: HTTP API descriptions, operations, parameters, security schemes, schemas, examples, and generated documentation.
ANUKA note: Tooling support must be validated before selecting 3.2.0 for the first production API.
Checked: 2 August 2026

OpenAPI Specification 3.1.2

Publisher: OpenAPI Initiative
URL: spec.openapis.org/oas/v3.1.2
Published: 19 September 2025
State: Baseline candidate
Used for: A broadly supported HTTP-contract option with JSON Schema alignment.
ANUKA decision required: Select 3.1.2 or 3.2.0 through an ADR after generator, validator, gateway, and documentation tests.
Checked: 2 August 2026

OpenAPI publications index

Publisher: OpenAPI Initiative
URL: spec.openapis.org/oas
State: Version registry
Important note: Published schemas can catch many errors but are not guaranteed to detect every specification violation; the specification text controls in a conflict.
Checked: 2 August 2026

Data schemas

JSON Schema Draft 2020-12

Publisher: JSON Schema project
URL: json-schema.org/draft/2020-12
Published: 16 June 2022
State: Normative baseline
Used for: Canonical JSON payload schemas, tool inputs and outputs, skill manifests, event payloads, and validation fixtures.
Important features: $dynamicRef, vocabularies, prefixItems, unevaluatedProperties, compound schema documents, and explicit format behavior.
Checked: 2 August 2026

JSON Schema specification page

Publisher: JSON Schema project
URL: json-schema.org/specification
Current version shown: 2020-12
State: Version registry
ANUKA rule: Every released schema uses a specific $schema URI and immutable $id.
Checked: 2 August 2026

Event-driven contracts

AsyncAPI Specification 3.1.0

Publisher: AsyncAPI Initiative
URL: asyncapi.com specification 3.1.0
Released: 31 January 2026
State: Normative event-interface candidate
Used for: Message-driven application contracts, channels, send and receive operations, messages, correlation IDs, bindings, and security schemes.
Compatibility note: The official release notes describe 3.1.0 as a compatible minor release from 3.0.0.
Checked: 2 August 2026

CloudEvents 1.0.2

Publisher: CNCF CloudEvents project
URL: cloudevents.io
Released: 5 February 2022
State: Normative event-envelope baseline
Used for: Common event metadata such as ID, source, type, subject, time, content type, schema reference, and data.
Project status: CNCF Graduated as of 25 January 2024.
Compatibility note: Version 1.0.2 is compatible with the 1.0 specification.
Checked: 2 August 2026

Agent integration

Model Context Protocol 2026-07-28

Publisher: Model Context Protocol project
URL: modelcontextprotocol.io/specification/2026-07-28
State: Normative agent-protocol candidate
Used for: Stateless model-facing requests, per-request capability negotiation, server discovery, tools, resources, prompts, elicitation, and extensions.
Observed features: Tasks, Skills over MCP, and MCP Apps are listed as optional extensions.
Security principles: Explicit user consent, control over data and actions, protected user data, and caution around arbitrary tool execution.
ANUKA boundary: MCP does not replace ANUKA authorization, consent, audit, or human approval.
Checked: 2 August 2026

MCP Specification Enhancement Proposals

Publisher: Model Context Protocol project
URL: modelcontextprotocol.io/seps
State: Protocol evolution registry
Used for: Tracking final, accepted, draft, and in-review changes and extension lifecycle.
Checked: 2 August 2026

MCP 2026 roadmap

Publisher: MCP core maintainers
URL: MCP 2026 roadmap
Published: 9 March 2026
State: Conceptual and planning reference
Used for: Transport scalability, agent communication, governance maturation, and enterprise readiness context.
ANUKA boundary: Roadmap statements are not normative protocol requirements.
Checked: 2 August 2026

Authorization and identity

OAuth 2.0 Security Best Current Practice — RFC 9700

Publisher: IETF / RFC Editor
URL: rfc-editor.org/info/rfc9700
State: Normative security baseline
Used for: Current OAuth threat mitigations, authorization code flow, PKCE, sender constraints, redirect security, and token protection.
Checked: 2 August 2026

OAuth 2.0 Rich Authorization Requests — RFC 9396

Publisher: IETF / RFC Editor
URL: rfc-editor.org/rfc/rfc9396
State: Normative authorization reference
Used for: Typed, detailed authorization requests and partial approval of requested authorization details.
Checked: 2 August 2026

OpenID AuthZEN Authorization API 1.0

Publisher: OpenID Foundation
URL: openid.net/specs/authorization-api-1_0
Status: OpenID Final Specification, approved 12 January 2026
State: Implementation reference
Used for: Separation of policy decision and enforcement through an interoperable authorization API.
Checked: 2 August 2026

Observability

OpenTelemetry Specification 1.59.0

Publisher: OpenTelemetry project
URL: opentelemetry.io/docs/specs/otel
State: Normative observability baseline candidate
Used for: Traces, metrics, logs, context, baggage, SDK behavior, resource metadata, and semantic conventions.
Version observed: 1.59.0
Checked: 2 August 2026

OTLP Specification 1.11.0

Publisher: OpenTelemetry project
URL: opentelemetry.io/docs/specs/otlp
State: Normative telemetry transport candidate
Used for: Export of traces, metrics, and logs over gRPC and HTTP.
Stability observed: Stable for traces, metrics, and logs; profiles remain in development.
Checked: 2 August 2026

OpenTelemetry telemetry schemas

Publisher: OpenTelemetry project
URL: opentelemetry.io/docs/specs/otel/schemas
State: Implementation reference
Used for: Versioned semantic-convention transformations and immutable schema URLs.
Checked: 2 August 2026

OpenTelemetry versioning and stability

Publisher: OpenTelemetry project
URL: OpenTelemetry versioning and stability
State: Implementation reference
Used for: Stable, development, deprecated, and removed lifecycle concepts and compatibility expectations.
Checked: 2 August 2026

Software versioning and metadata

Semantic Versioning 2.0.0

Publisher: Semantic Versioning project
URL: semver.org
State: Normative software-versioning baseline
Used for: MAJOR, MINOR, and PATCH compatibility meaning for public software and machine contracts.
Critical rule: Once a version is released, its contents must not be modified.
Checked: 2 August 2026

SPDX 3.0

Publisher: SPDX project / Linux Foundation
URL: spdx.dev/use/specifications
Current version shown: 3.0
State: Normative SBOM and supply-chain metadata candidate
International standard note: SPDX is ISO/IEC 5962:2021.
Used for: Software components, relationships, licenses, suppliers, hashes, and release evidence.
Checked: 2 August 2026

Secure development

NIST SP 800-218 — SSDF 1.1

Publisher: U.S. National Institute of Standards and Technology
URL: csrc.nist.gov/pubs/sp/800/218/final
Published: February 2022
State: Security baseline
Used for: Secure software development practices integrated into the software lifecycle.
Checked: 2 August 2026

NIST SP 800-218 Revision 1 draft — SSDF 1.2

Publisher: NIST
URL: csrc.nist.gov/pubs/sp/800/218/r1/ipd
Published: 17 December 2025
Status: Initial Public Draft; comment period closed 30 January 2026
State: Tracking
ANUKA baseline: SSDF 1.1 remains the final baseline until Revision 1 becomes final and is deliberately adopted.
Checked: 2 August 2026

NIST SP 800-218A

Publisher: NIST
URL: csrc.nist.gov/pubs/sp/800/218/a/final
Published: July 2024
State: AI secure-development profile
Used for: Additional secure-development practices for generative AI and dual-use foundation models.
Checked: 2 August 2026

NIST SP 800-61 Revision 3

Publisher: NIST
URL: csrc.nist.gov/pubs/sp/800/61/r3/final
Finalized: April 2025
State: Incident-response baseline
Used for: Integrating incident response into cybersecurity risk management.
Checked: 2 August 2026

NIST Cybersecurity Framework 2.0

Publisher: NIST
URL: nist.gov/cyberframework
State: Operational risk reference
Used for: Govern, Identify, Protect, Detect, Respond, and Recover outcomes.
Checked: 2 August 2026

Distribution security

Chrome Web Store Manifest V3 requirements

Publisher: Google Chrome Developers
URL: Manifest V3 requirements
State: Platform policy baseline
Used for: Prohibition on remotely hosted executable code and extension packaging constraints.
Checked: 2 August 2026

Chrome extension permissions

Publisher: Google Chrome Developers
URL: Declare permissions
State: Platform implementation reference
Used for: Required, optional, and host permissions and permission warning behavior.
Checked: 2 August 2026

Licensing

Open Source Definition

Publisher: Open Source Initiative
URL: opensource.org/osd
State: Normative terminology baseline
Used for: Whether ANUKA software can accurately be described as open source.
Checked: 2 August 2026

OSI Approved Licenses

Publisher: Open Source Initiative
URL: opensource.org/licenses
State: License registry
Used for: Repository and package license selection.
Checked: 2 August 2026

Adoption decisions required

The following require ADRs before implementation:

OpenAPI 3.1.2 versus 3.2.0;
AsyncAPI tooling and broker binding;
schema registry implementation;
MCP SDKs and supported extensions;
authorization policy engine;
OpenTelemetry Collector topology and backend;
signing and provenance mechanism;
SPDX generation and publication profile;
official SDK languages;
release channels and support windows.

Review procedure

Before each architecture release:

open every source;
confirm current published version and status;
distinguish stable, draft, and release-candidate material;
verify tooling support separately from specification publication;
confirm claims against the exact source text;
update protocol and SDK compatibility matrices;
rerun conformance and security tests;
record implementation ADRs and exceptions.

Registry maintenance

Last manual validation: 2 August 2026
Next review: Before implementation ADR ratification or within 90 days
Maintainer status: Founding draft