spec: announce 2026-11-30 as the v0.1 manifest issuance end date - #336
Merged
Conversation
Phase 5 of the COSE envelope migration (#315). The date was gated on phase 4 showing a consumer verifying v0.2 through a real path rather than a test harness. Both consumers now do: cmcp#530 and ca2a#122 merged 2026-08-19, and each rejects a payload declaring v0.1 under a v0.2 envelope at its loader boundary (AM-VEC-COSE-012). 2026-11-30 is roughly one v0.1 record lifetime of notice, the shortest period that cannot strand a manifest already in flight. Verifying v0.1 manifests is NOT deprecated and gets no end date. These are audit records under retention obligations that outlast their 90-day validity by years, so a verifier that stopped reading them would destroy evidence rather than remove code. Same reasoning that keeps the -8 Ed25519 code point acceptable indefinitely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 5 of #315.
Why now
Phase 5 was explicitly gated: "The date is a maintainer decision, not a technical one, and it should not be set before phase 4 shows a consumer verifying v0.2 in anger."
Phase 4 completed on 2026-08-19. cmcp#530 and ca2a#122 both merged, and each verifies a correctly signed v0.2 COSE envelope through its real loader path and rejects a payload declaring v0.1 under a v0.2 envelope (
AM-VEC-COSE-012). Two consumers exercising the gate at their own boundary is the condition, and it is met.The date
2026-11-30. Roughly one v0.1 record lifetime of notice, which is the shortest period that cannot strand a manifest already in flight.
What is not being deprecated
Verifying v0.1 manifests, which gets no end date at all. Manifests are audit records under retention obligations that outlast their 90-day validity by years. A verifier that stopped reading them would destroy evidence rather than remove code. This is the same reasoning already recorded for keeping the
-8Ed25519 code point acceptable indefinitely after RFC 9864 deprecated it.The distinction matters enough to state twice, because "v0.1 is deprecated" will otherwise be read as covering both.
Changes
spec/agent-manifest-spec-v0.2.md§2.4 Version Negotiation: the date, plus the explicit statement thatINCOMPATIBLE_VERSIONstays reserved for versions a verifier genuinely cannot interpret and never for v0.1.CHANGELOG.md: aDeprecatedentry under Unreleased carrying the same two halves.No code changes. The reference implementation still issues v0.1 on request until the date.