[liady]

What this PR does

Creates the registry that becomes the single source of truth for every agent protocol spec Ora tracks. Each of the 21 specs gets specs/<id>/spec.yaml (its versions, the latest upstream sources and the state Ora reviewed), validated by a strict JSON Schema and built into the @ora-ai/specs npm package. The spec drift watcher moves here as its only copy, with a daily watch, a fix workflow, a release workflow and the six protocol skills, so the Ora ranker and ax.guide can read versions and pins from one place instead of comparing two sets of pins.

Contents

• specs/<id>/spec.yaml for the 15 Ora manifest entries merged with ax.guide's 12 (the pins agreed: the lockstep run reported "pins agree with ax.guide" on 2026-11-11, and again on 2026-11-14 after both repos moved the Personal Agent Protocol to Draft 1.0), plus six watched-only specs with reviewed: null and live pins: A2A, llms.txt, OpenAPI, RFC 9309 (robots), RFC 9727 (api-catalog) and RFC 9728 (protected resource metadata).
• schema/spec.schema.json (draft 2020-12, additionalProperties: false everywhere) and scripts/build.mjs, which adds the checks a schema cannot express: folder named after the id, at most one current version, the reviewed version listed in versions, the watched revision folder agreeing with the dated folder pin, each pin of its kind's shape and on its own pin: "..." line, the named skill existing, and no em dashes.
• dist/: specs.json, index.js + index.d.ts (literal types, so versionIds("pap", [...]) is typed "1.0" | "0.4" | "0.3" | "0.2" | "0.1"), kinds.js (state shapes, sourceKey, link builders) and schema.json.
• scripts/spec-drift.mjs, moved from the Ora ranker. It now reads the spec files, pins are literals, the lockstep and peer comparison are gone, two kinds are new (rfc: status plus the RFCs that update or obsolete it; git-latest-file: the newest file name matching a pattern), and --status-out carries each source's shape-checked live value.
• Workflows: ci.yml; watch.yml (daily; issues, the status branch with status.json, and the report sent to ora.ai); fix.yml (schedule and dispatch only, never pull_request_target; code moves the pins, vet-staged confirms only pin lines changed, Claude writes the review only); release.yml (release-please, then an npm publish with OIDC trusted publishing and provenance on the model of oramono's publish-oss.yaml, then a smoke install from the registry).
• skills/protocol-{webmcp,mcp,mcp-apps,authmd,pap,nlweb}/: the spec rules that hold in any repo, split from Ora's skills (Ora's file postures and decisions stay in Ora's own overlay), plus their research reports.

Review notes

• Personal Agent Protocol moved to Draft 1.0 (2026-11-14 update). After this branch was cut, Ora and ax.guide moved PAP from Draft 0.3 to the in-progress Draft 1.0, read 2026-11-13. specs/pap/spec.yaml now records that state (the content/versions/1.0 tree, the new versions.json blob, the four moved working draft digests; 1.0 current with no published date, 0.4 the latest published, 2026-11-10), and skills/protocol-pap/ follows the 1.0 rules with the 2026-11-12 and 2026-11-13 reports added. One slip to know about: the commit message of 3e608f5 names three Ora PR numbers and three ax.guide PR numbers; nothing else from those PRs is in this repo.
• Live drift, left for the watch. The reviewed pins are Ora's as they are. Upstream has moved since: WebMCP index.bs, the AI Catalog specification tree, and PAP again after 2026-11-13 (the 1.0 tree, versions.json, and the spec, guides and Mediated Sign-In pages), so node scripts/spec-drift.mjs check specs shows them as drifted. The first watch run opens one issue per spec and starts the fix workflow.
• Redactions in the references. The reports are public here, so these lines changed from Ora's copies: the private oramono and nljev repository names and paths (NLWeb report), a local checkout path (MCP Apps report), a private PR and issue number (three PAP reports), the careers shim file names (WebMCP report), and the old scripts/pap-spec-digest.mjs and workflow names (two PAP reports).
• Not done here, needs the owner: the first npm publish, and these repository secrets: SPEC_DRIFT_INGEST_SECRET (watch to ora.ai), ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN (fix), and NPM_TOKEN (first publish only; then configure the npm Trusted Publisher and delete it). Each workflow skips cleanly without its secret.

Verification

• npm run check: 21 specs valid. npm test: 31 pass. npm run build && npm run typecheck: the published types compile, literal narrowing included.
• node scripts/spec-drift.mjs check specs --only pap --dry-run on 2026-11-14: every PAP source resolves; the four that moved upstream after 2026-11-13 show as drifted, the rest match.
• npm pack: 9 files, 19 kB.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NWyUpDvmVGnxkjcJcd7nKm