Stacked on the trust-annotations base. Declarative inputMetadata / returnMetadata
+ outcome classifiers (incl. requires_review) on ToolAnnotations. Carries forward
the field semantics from SEP-2061 (Action Security Metadata, @rreichel3), closed
2026-06-13 in favour of this extension.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Restructure the incubation into two extensions plus interchangeable data-labelling
schemes, shipped as a stack of three PRs:
- This PR (base): shared scaffolding + the trust-annotations extension.
- action-metadata moves to its own stacked PR.
- The IFC/FIDES work moves out of specification/draft/ entirely — it is one
data-labelling scheme (ifc.fides.v1) that fills the trust-annotations
evidenceRef slot, not an extension and not a sibling. It lands in a schemes/
folder built to hold alternative approaches (data-class, capability tokens,
cosigning, sequence-shape, attestation) so no single academic model is baked
into the wire.
README, sep-disposition, related-work, trust-model, open-questions and the
decision log are reframed accordingly (two extensions + a schemes folder; the
range of candidate schemes drawn from the SEP-1913 thread and cited literature).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ifc-fides (review by @JoannaaKL):
- confidentiality is public/private only on the wire; drop the reader-list
(logins aren't uniform across servers, are themselves access-restricted,
and reader sets can be huge)
- add Reader-set resolution section: two private markers aren't equal, the
confidentiality join is the intersection and isn't computable from opaque
wire markers, so hosts resolve to concrete reader sets at decision time
- integrity join is total/wire-computable; confidentiality join is not
- emitter MUST classify per resource, not per repository (public repos serve
non-world-readable sub-resources), making github-mcp-server a real proof point
action-metadata / docs:
- SEP-2061 closed 2026-06-13 in favour of this extension; this draft is now the
canonical home. Updated action-metadata.mdx, README, sep-disposition,
related-work, and intent-comment status accordingly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Official extension specs (ext-auth) use only `title:` in frontmatter
plus an <Info> protocol-revision marker. Remove the invented
extension_identifier / status / maintainers / related / profile_of
fields and restate the identifier and profile relationship in the body
prose where they belong.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Carve the schema-bearing parts of SEP-1913 into three independent
experimental extensions, per @localden's "narrower first cut" ask and
the Tool Annotations IG's 2026-05-28 extension-first decision:
- io.modelcontextprotocol/trust-annotations (headline): narrow
data-classification taxonomy (sensitive, untrusted) + open-ended
evidenceRef pointer.
- io.modelcontextprotocol/action-metadata: carries forward SEP-2061
(inputMetadata/returnMetadata/outcomes + requiresReview).
- io.modelcontextprotocol/ifc-fides: FIDES information-flow control as
a profile of evidenceRef, not a wire root.
Adds repo meta (README, MAINTAINERS, CONTRIBUTING, LICENSE) and docs
(sep-disposition, intent-comment, decisions, open-questions,
trust-model, related-work). FIDES demoted to a profile; DataClass and
requiresReview rehomed; maliciousActivityHint and propagation parked on
the SEP-1913 umbrella. Citations index on public sources only.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
