v0.1.0

OSBP v0.1.0 is the first public proof-of-concept release.

Built in this release:

• BookingMandate-bounded booking flow and validation core
• Credential-free reference backend, demo, trace gallery, and conformance kit
• Adapter starter kit and AI-ready adapter context bundle
• Local MCP server proof wired to the Openings integration example
• Redacted Openings trace evidence and integration docs

Intentionally out of scope:

• Marketplace/search, payments, slot holds, cancel/reschedule, and production signed mandates
• Public conformance certification beyond the included conformance kit

Verification evidence:

• CI, CodeQL, dependency review, and secrets scan passed on the release PR
• Public check suite validates build, generated spec/schema artifacts, adapter context, and cspell coverage
• Reference and recorded traces are included under traces/v0.1.0/

v0.1.0: Foundation push

OSBP v0.1.0 -- Foundation push

---

OSBP is a narrow protocol layer that lets an AI agent book a service appointment on a user's behalf, under explicit, scoped permission. It rides on the Model Context Protocol (MCP) for transport: MCP carries the bytes, OSBP defines what the booking-related tool calls mean and the guardrails around them.

This is the first public release. It is labeled 0.1.0, not 1.0.0, deliberately: the version string is a promise, and 0.x means "usable proof, formative contract, breaking changes expected before the contract stabilizes."

What ships in v0.1.0

• Protocol spec (docs/spec/v0.1.0/): the full normative spec, platform-neutral. Covers tool semantics, the BookingMandate authority object, mandate validation, local idempotency, the audit envelope, fail-closed rules, security and privacy considerations, and the adapter contract.
• @osbp/core: mandate validation, the approval gate, audit logging, and shared types.
• @osbp/reference-backend: a credential-free synthetic booking backend across four verticals (dental, legal/notary, auto, fitness). No API keys, no external services. Run npm run demo to see the full booking loop, including the over-cap rejection that proves the gate fires.
• @osbp/conformance: 44 requirement-tagged conformance tests. Run npm run conformance --target ./your-adapter to check an adapter against the protocol contract.
• packages/adapter-starter: a typed skeleton for writing a new platform adapter, with conformance wired in from the start.
• Generation tooling: npm run trace replays five reference traces locally. npm run build:spec and npm run build:adapter-context regenerate the spec and the AI context bundle from source.

What this is not

v0.1.0 proves the authorization loop, not a production trust surface. Mandates are unsigned JSON, idempotency is local and in-process, and caller identity is self-declared. These are stated limitations, not design goals. The spec's Known Limitations section names them explicitly. Do not use this as a hardened system.

Getting started

git clone https://github.com/osbp-dev/osbp
cd osbp
npm install
npm run demo          # see the booking loop and the guardrail firing
npm run conformance   # 44/44 against the reference backend

To write an adapter for your platform, start from packages/adapter-starter or load dist/osbp-adapter-context.md into your AI coding agent of choice.

What comes next

v0.2.0 ("Remote reach") is additive: hosted MCP over HTTPS, OAuth, verifiable agent identity, OSBP contract version negotiation, and challenge.* names added alongside the current verification.* aliases. Nothing in v0.1.0 will be removed or renamed in v0.2.0. See ROADMAP.md and VERSIONING.md for the full cadence.