Release status

16 September 2026 · 1.2.0-draft.2 service/evidence development reference

The team supports developer evaluation of this bounded free profile. The implementation is usable locally without a third-party platform. It is not yet approved as a stable, public production deployment.

Foundation positioning update, 17 September 2026: the Odexa Foundation was founded and is active. Its wider fair/open-web mission includes originator voice over access and use, governance, monitoring, monetisation and fair value exchange. The protocol is one initiative; the council and formal protocol governance remain in development. This update does not change the implementation or its technical validation status.

Implemented

• Native policy evaluation, exact URL scope and cumulative obligations.
• Local provisioning, HTTPS discovery and capability-scoped signing keys.
• Exact-context free offers, signed acceptance and immutable receipts.
• Transactional persistence, concurrent idempotency and process-crash recovery.
• Scoped opaque tokens, current authorization, access expiry and revocation.
• A real protected HTTPS resource and signed asset manifest.
• Distinct full, partial and metadata-only delivery observations.
• Signed usage claims, intake receipts, deduplication and source isolation.
• Owner-scoped portable evidence, retained verification material and offline verification with separate trust.
• Machine schemas, negative fixtures and an independently authored Node client.

See the validation report for actual results. An internally separate client is useful interoperability evidence; it is not an independent vendor implementation.

Limits and remaining work

Area	Current boundary	Evidence required before a broader claim
Public deployment	Loopback development server; bounded synthetic asset	Production transport, request limits/rate limiting, operational budgets, load/outage tests and deployment hardening
Authority changes	Fixed persisted configuration; current capability/key-state checks	Supported rotation/migration tools, retained history, compromised-key scenarios and independent review
Provider delegation	Same-origin service only	Cross-origin delegated authority, capability boundaries, failover/revocation semantics and interop tests
Payments	Explicit zero-price path only	Optional quote/mandate/settlement adapter and duplicate/mismatch/reversal tests
Export	Bounded reference export; no concurrent global snapshot protocol	Large-volume pagination, closed-snapshot inventory, completeness and migration tests
Production evidence	One origin gateway and synthetic traffic	Known independent ingress counts, failures/omissions, edge/caching deployment trials and measured overhead
Security assurance	Internal negative, crash and isolation tests	External review and remediation; public security reporting process
Adoption	Internal fixtures	Originator and agent-operator pilot with measured integration effort and participation
Release ownership	Foundation founded and active; council and formal protocol governance developing	Named release steward, contribution procedures and governance record

The acceptance tests inspect local dependency behavior and restrict the client to its configured origin. They do not include an operating-system packet capture or an externally enforced egress firewall. Do not describe the current run as a completed network-isolation audit.

The code pins configuration against persisted state. Do not edit the runtime policy or key files and expect transparent rotation. No automated production backup, credential rotation, account recovery, billing, legal-identity verification or multi-origin hosting service is supplied.

Release naming

Publish a development preview as 1.2.0-draft.2, accompanied by this exact supported-scope statement. Keep the policy document’s own version explicit. Use 1.2.0-rc.1 only after defining the release classes and closing the relevant gates. A free core can eventually be stable while optional paid/delegated profiles remain experimental, provided those capability boundaries are explicit and interoperable.

The documentation and downloadable reference are published under the approved open licences, recorded on 17 September 2026. The council and formal protocol governance remain in development. Provider delegation, payments and production deployment remain subject to the boundaries above.