feat: mid-2026 spec update — skills, MCP modernization, and team governance#13
Merged
Conversation
…ation Adds three accepted Standards-Track HEPs and their schema surface. All additions are optional fields or additive enum values, so the harness `version` stays "1" and every existing v1 document remains valid. - HEP-4: top-level `skills` section — declare a portable SKILL.md capability directly (source/version/enabled/loading/integrity) without bundling it in a plugin. - HEP-5: `streamable-http` transport (canonical; `http` retained as an alias), `sse` deprecated, plus optional `source`/`version`/`integrity` provenance on MCP server declarations. - HEP-6: `policy` governance section — an org ceiling for approved MCP/plugin/skill sources, marketplaces, permission caps, and require-integrity; accumulates across the extends chain and is enforced as a fatal validation step. Prototype: examples extended and validated; eval suite grows to 248 tests (skills, MCP modernization, policy schema coverage + a skills-inheritance merge), with the compiler normalizing the streamable-http/http alias. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Normative prose for the three schema additions, plus a mid-2026 accuracy pass: - profile-schema, mcp-declarations, instructions, application, inheritance, terminology, source-resolution: document the `skills` and `policy` sections, the modernized MCP transports and server provenance/integrity, AGENTS.md as a first-class operational target, and the now seven-step application pipeline (added Enforce Policy). - overview: document interoperation with the agent standards stack (AGENTS.md, Agent Skills / SKILL.md, the MCP registry). - security: extend integrity verification to skills and stdio MCP server packages; add a provenance/integrity-pinning mitigation to skill injection. - extensions: refresh the pre-HEP design sketches (hooks, agents, models, session, execution-environment note) with current ecosystem state. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Port the protocol/extensions/security changes into the docs-site MDX mirror so the two surfaces stay in sync: skills and policy sections, MCP transport/provenance updates, AGENTS.md instruction mapping, the seven-step pipeline, the standards-stack interoperation note, and the security supply-chain additions. Build verified clean (36 pages, no broken links). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an [Unreleased] CHANGELOG section recording the architectural-constraints, skills, MCP modernization, and governance-policy additions, and update the README's section enumeration and reading paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
siracusa5
added
documentation
… remote-MCP exemption Address findings from the PR review: - Governance example: `team-overlay` set `policy.require-integrity: true` but its plugins and stdio server had no integrity hashes — it would have failed its own ceiling at apply time. Added integrity hashes so the example is self-consistent and demonstrates the feature. - require-integrity scope: clarify across HEP-6, application.md, and integrity.md that the requirement covers plugins, skills, and *stdio* MCP servers; remote servers have no fetched package and are exempt (verified via TLS/registry). Prevents a strict reading that would reject all remote servers. - Effective config: the eval resolver now excludes `enabled: false` skills from the resolved skill set, matching the "disabled skills excluded" contract in application.md (suppression still applies during merge). Added a test. - eval/README: test counts (249) and merge-rule count (13). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address findings from an independent review (Sonnet + Haiku critics): - BLOCKING: `skills` schema required `source` on every entry, but the suppression prose says a child disables an inherited skill with `enabled: false` and only `name`. Made `source` conditionally required (required unless `enabled: false`) via schema if/then/else, matching the prose. Only relaxes a constraint — fully backward compatible. - Policy enforcement: specify how sourceless entries are treated under an `allowed-sources` list (fail closed; SHOULD require a source), and add the "only declared lists participate" / disjoint-allowlist note to inheritance. - Add `skills[].name` uniqueness to semantic validation (spec + reference impl + test). - Clarify `enabled: false` suppresses a plugin-bundled skill of the same name. - Clarify `policy.plugins` source + marketplace constraints are conjunctive. - Add compiler test for the streamable-http → http normalization. Eval suite: 253 passing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The spec hadn't been touched since 2026-04-19, and the agentic-coding ecosystem moved hard in the interim. This is a holistic refresh that makes the Harness Protocol accurate, flexible, and ready for engineering teams in mid-2026. It adds three accepted Standards-Track HEPs plus an accuracy pass, all backward-compatible: every addition is an optional field or an additive enum value, so the harness
versionstays"1"and every existing v1 document remains valid.Changes
Normative additions (HEPs 4–6):
skills: a top-levelskillssection so a harness declares a portableSKILL.mdcapability directly (source/version/enabled/loading/integrity) instead of only bundling it inside a plugin.streamable-httpas the canonical remote transport (httpkept as an alias),ssedeprecated,wsdocumented as non-standard, and optionalsource/version/integrityprovenance on MCP server declarations — closing the supply-chain gap the spec itself had flagged.policyceiling (approved MCP/plugin/skill sources, allowed marketplaces, permission caps,require-integrity) that accumulates across theextendschain (constraints only tighten) and is enforced as a new fatal pipeline step.Accuracy / editorial pass:
instructions.operationalnow maps toAGENTS.md(the cross-tool standard) as a first-class target alongsideCLAUDE.md.SKILL.md, the MCP registry) under the Agentic AI Foundation.schema/draft/harness.schema.jsonupdated (snapshot + published mirror intentionally untouched — those sync at release).protocol/,extensions/,security/and theirwebsite/content/docsMDX mirrors.Test Plan
examples/*.harness.yamlvalidate against the updated schemaNotes
requiredis still justversion; no enum value removed;$idunchanged.execution-environmentwas left as a refreshed reserved-field design note (sandbox-convergence direction), not a HEP.main(website dependencies); not introduced by this PR.