A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: "The Specification Layer Now Has a Home," Kin Lane, October 26, 2026, https://apievangelist.com/2026/10/26/the-specification-layer-now-has-a-home/
Priya ran release engineering for a company that moved freight, and she read the post on a Monday between two builds that were taking too long. She had come for the headline and stayed for the list.
The first thing she felt was a small, unreasonable irritation. Fifty-two specifications in seven groups looked like someone claiming the whole map. She scrolled the groups the way she'd scroll a vendor's partner logos, looking for the padding. Supply chain and artifacts was the group that concerned her, and it was long: SPDX, the three OCI specifications, in-toto, OSV, SLSA, TUF, Notary, Sigstore and more. She used maybe four of those on purpose and a few more without knowing it.
Then she slowed down at the sentence about why the page exists. Kin Lane wrote that a new build level in SLSA, a changed agent discovery draft in A2A, and a new top-level keyword in OpenAPI 3.3 had landed in one week, and that "almost none of that showed up in anyone’s feed". She tried to remember when she'd last learned about a spec change from a feed. Her honest answer was that she learned about them when a pipeline broke, or when a security reviewer asked a question she couldn't answer.
She did not fully trust it, and she let herself say so. One person reading fifty-two repositories every Monday sounded like either a very good habit or a slow way to burn out. The line about reporting honestly, "including the weeks I get it wrong", helped some, because it admitted the failure mode instead of hiding it. It didn't settle whether she'd rely on it. She noticed she was more comfortable with a source that said it could be wrong than with one that never mentioned it.
What stuck was the distinction in the first paragraph, between "not what was announced, what merged". That was exactly the gap in her own work. Her team's wiki had a page called supply chain standards that was mostly announcements, copied from conference slides eighteen months earlier. Nobody had checked whether any of it had actually shipped.
She didn't sign up for anything yet. She also skipped the part about funding and well-known paths, which felt like someone else's job. Instead she opened her team's build repository in a second tab and listed, on a scrap of paper, the specifications her release path actually touched. It came to five: SLSA, Sigstore, SPDX, the OCI image specification, and OpenAPI for the internal services. She held the paper next to the page's supply chain group and saw that all five were there.
She suspected there was a sixth she depended on without having a name for it. The post asked readers to say which specification they relied on that wasn't tracked, and why. She wasn't ready to answer that.
What she did was small. She put a reminder on her calendar for the following Monday, titled to read the newsletter archive, and pasted the page's link into the old wiki page with one line above it: check these against what merged, not what was announced. Then she went back to the slow build.