Skip to content

v0.1.0: Foundation push

Choose a tag to compare

View all tags
@downtempo downtempo released this 19 Jun 23:09
· 10 commits to main since this release
v0.1.0-foundation
4b520f2

OSBP v0.1.0 -- Foundation push

OSBP is a narrow protocol layer that lets an AI agent book a service appointment on a user's behalf, under explicit, scoped permission. It rides on the Model Context Protocol (MCP) for transport: MCP carries the bytes, OSBP defines what the booking-related tool calls mean and the guardrails around them.

This is the first public release. It is labeled 0.1.0, not 1.0.0, deliberately: the version string is a promise, and 0.x means "usable proof, formative contract, breaking changes expected before the contract stabilizes."

What ships in v0.1.0

  • Protocol spec (docs/spec/v0.1.0/): the full normative spec, platform-neutral. Covers tool semantics, the BookingMandate authority object, mandate validation, local idempotency, the audit envelope, fail-closed rules, security and privacy considerations, and the adapter contract.
  • @osbp/core: mandate validation, the approval gate, audit logging, and shared types.
  • @osbp/reference-backend: a credential-free synthetic booking backend across four verticals (dental, legal/notary, auto, fitness). No API keys, no external services. Run npm run demo to see the full booking loop, including the over-cap rejection that proves the gate fires.
  • @osbp/conformance: 44 requirement-tagged conformance tests. Run npm run conformance --target ./your-adapter to check an adapter against the protocol contract.
  • packages/adapter-starter: a typed skeleton for writing a new platform adapter, with conformance wired in from the start.
  • Generation tooling: npm run trace replays five reference traces locally. npm run build:spec and npm run build:adapter-context regenerate the spec and the AI context bundle from source.

What this is not

v0.1.0 proves the authorization loop, not a production trust surface. Mandates are unsigned JSON, idempotency is local and in-process, and caller identity is self-declared. These are stated limitations, not design goals. The spec's Known Limitations section names them explicitly. Do not use this as a hardened system.

Getting started

git clone https://github.com/osbp-dev/osbp
cd osbp
npm install
npm run demo          # see the booking loop and the guardrail firing
npm run conformance   # 44/44 against the reference backend

To write an adapter for your platform, start from packages/adapter-starter or load dist/osbp-adapter-context.md into your AI coding agent of choice.

What comes next

v0.2.0 ("Remote reach") is additive: hosted MCP over HTTPS, OAuth, verifiable agent identity, OSBP contract version negotiation, and challenge.* names added alongside the current verification.* aliases. Nothing in v0.1.0 will be removed or renamed in v0.2.0. See ROADMAP.md and VERSIONING.md for the full cadence.

Assets 2
Loading