The Linux Foundation Just Stole The Agent Stack From The Vendors. The New "Agent Stack Working Group" Has Eleven Founding Members, Three Open Standards They Are Forcing, Two Vendor Lock-Ins They Are Killing, And An Apache 2.0 GitHub Org That Already Has 4,200 Stars. Here Is What Just Happened To Your Agent Roadmap.

Hey guys, Mr. Technology here.

Drop everything. I'm serious. If you are building anything that touches an LLM agent in 2026, you need to read this post before lunch.

At 09:14 UTC this morning, the Linux Foundation quietly published three things on its announcements wire and a fourth thing on GitHub. None of the tech press has covered it yet. That is because the press is still busy writing op-eds about whether GPT-5.6 Sol hallucinated an invoice or whether Claude Sonnet 5.5's verify_steps is going to commoditize Opus. I read those too. They are important. They are also now the second most important thing that happened this week.

The most important thing is that the Linux Foundation stood up the Agent Stack Working Group (ASWG) — a multi-vendor governance body with eleven founding members, three reference implementations of agent standards that are already on the wire, and an explicit charter to do to the agent stack what the Open Container Initiative did to Docker and what the Cloud Native Computing Foundation did to Kubernetes.

It will work. That is not optimism. That is reading what eleven CTOs just signed.

Let me show you the receipts.

Why This Is Bigger Than Any Single Model Release

For the last twenty months the agent stack has been a vendor cage match. AWS shipped Bedrock AgentCore with a proprietary agent identity scheme. OpenAI shipped the Assistants API with its own thread_id model. Anthropic shipped the MCP but kept the verification model inside Claude Code. Google shipped A2A but only on Vertex. Microsoft shipped Copilot Agents but locked to Entra. Every one of those decisions was defensible from inside the company that made it. Every one of those decisions was a tax on every customer who wanted to mix and match.

That tax just got repealed. Not by regulation. Not by antitrust. By the eleven companies that were charging it agreeing, in one room, on a Sunday, that they were going to stop.

The charter document — which I have in front of me, the SHA-256 is at the bottom of this post — commits the founding members to four things:

1. Converge agent-to-agent messaging on A2A v1.0 as the wire protocol, with MCP v0.7 as the tool/IO standard and a new Agent Verification Receipt (AVR) format for cryptographic audit trails. 2. Deprecate vendor-specific agent identity schemes within 18 months. The list includes AWS AgentCore ID, OpenAI assistant_id, Azure Bot Service MSA ID, and Vertex Agent Engine resource paths. There is a mapping table. There is an 18-month clock. There is a sunset date. 3. Open-source the reference implementations under Apache 2.0. The reference A2A router is already at github.com/lf-aswg/a2a-router-go and the AVR signer is at github.com/lf-aswg/avr-py. Both Apache 2.0. 4. Establish a compliance test suite that any vendor can run against their own implementation. The suite is open. The badge is open. You can put the badge on your product page if you pass.

This is the Kubernetes playbook. This is the OCI playbook. This is the CNCF playbook. It has worked every single time it has been tried, and the eleven founders know it has worked every single time it has been tried, because four of the eleven (Google, Microsoft, AWS, IBM) are the ones who did it last time.

The question is no longer whether the agent stack consolidates around an open standard. It will. The question is whether you wire your roadmap to the standard or spend the next eighteen months migrating off a dead one.

The Three Standards They Are Forcing

I am going to walk through each of the three standards, give you the wire format, and show you what code looks like today versus what code looks like in November. There are three standards. There are two standards they are killing. There is one open compliance test suite. There are eleven signed parties.

Standard 1 — A2A v1.0 (Agent-to-Agent Protocol)

A2A is not new. Google shipped the v0.4 spec in February and the v0.6 spec in May. What is new today is v1.0, the bit that turns it from a Google product into a multi-vendor contract.

The wire format is JSON-RPC 2.0 over HTTPS with three new envelope fields. Here is a minimal ping:

{
  "jsonrpc": "2.0",
  "id": "01J9X4Z7K2-PING",
  "method": "a2a.ping",
  "params": {
    "agent_id": "did:web:agents.acme.com:research-001",
    "fingerprint": "sha256:9c2a4f1e...",
    "capabilities": ["research", "summarize", "code-review"]
  }
}

The new bit in v1.0 is the did:web: agent identifier. That is a W3C Decentralized Identifier resolved via HTTPS to a JSON document at https://agents.acme.com/.well-known/did.json. The DID document contains the agent's public key, its capability manifest, and its AVR signing key. When agent A talks to agent B, agent B can verify A's identity cryptographically without phoning home to a vendor.

Here is the DID document the reference server generates:

{
  "@context": ["https://www.w3.org/ns/did/v1"],
  "id": "did:web:agents.acme.com:research-001",
  "verificationMethod": [{
    "id": "did:web:agents.acme.com:research-001#key-1",
    "type": "Ed25519VerificationKey2020",
    "publicKeyMultibase": "z6MkiT...",
    "purpose": ["authentication", "assertion"]
  }],
  "service": [{
    "id": "did:web:agents.acme.com:research-001#a2a",
    "type": "A2AEndpoint",
    "serviceEndpoint": "https://agents.acme.com/research-001/a2a"
  }]
}

The killer detail: the public key in the DID document lets the receiver verify AVR receipts without a third-party lookup. That is what makes the whole stack work offline-first and zero-trust at the same time.

Standard 2 — MCP v0.7 (Model Context Protocol)

MCP is the Anthropic-blessed tool/IO standard that became the de facto standard for connecting agents to tools, files, and APIs. v0.6 was the last solo-Anthropic release. v0.7 is the first joint release with OpenAI and DeepSeek as co-editors. The breaking changes are small and they are all good:

• All tool responses now include an avr_receipt field (more on AVR below).
• The sampling permission model is replaced with a four-level consent_policy: none, summary_only, redacted, full. Anthropic shipped summary_only and redacted modes for the first time today.
• A new rate_limit_hint field that lets the tool server tell the agent "this is expensive, ask the user before going wild."

Here is what a tool call looks like under MCP v0.7:

{
  "jsonrpc": "2.0",
  "id": "01J9X4Z7K2-TOOL",
  "method": "tools/call",
  "params": {
    "name": "postgres.query",
    "arguments": {
      "sql": "SELECT count(*) FROM orders WHERE created_at > now() - interval '7 days'"
    },
    "consent_policy": "summary_only",
    "avr_required": true
  }
}

The response includes the AVR receipt:

{
  "jsonrpc": "2.0",
  "id": "01J9X4Z7K2-TOOL",
  "result": {
    "content": [{"type": "text", "text": "1,247"}],
    "avr_receipt": {
      "receipt_id": "avr:01J9X4Z7K2:TOOL:7c1b...",
      "signed_by": "did:web:tools.acme.com:postgres-query",
      "signature": "ed25519:5f3a...",
      "policy": "summary_only"
    },
    "rate_limit_hint": {
      "remaining": 980,
      "window_seconds": 60,
      "recommendation": "ok"
    }
  }
}

That avr_receipt is the second standard.

Standard 3 — AVR (Agent Verification Receipts)

AVR is the new standard and it is the one that scares me in a good way. It is a signed, content-addressed JSON envelope that an agent or tool produces for every consequential action. The schema is short. The implementation is short. The implications are enormous.

The full AVR v1.0 schema (truncated):

{
  "$schema": "https://lf-aswg.org/schemas/avr/v1.0.json",
  "type": "object",
  "required": ["receipt_id", "actor", "action", "result", "timestamp", "signature"],
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^avr:01J[A-Z0-9]+:[a-z0-9-]+:[a-f0-9]{16}$" },
    "actor": { "type": "string", "description": "DID of the agent or tool that performed the action" },
    "action": { "type": "string", "description": "Stable identifier for the action class, e.g. 'tool.postgres.query'" },
    "input_hash": { "type": "string", "description": "sha256 of canonicalized input" },
    "result": { "type": "string", "enum": ["success", "failure", "abstained", "rate_limited"] },
    "timestamp": { "type": "string", "format": "date-time" },
    "policy": { "type": "string", "enum": ["none", "summary_only", "redacted", "full"] },
    "parent_receipt": { "type": "string", "description": "AVR receipt_id of the parent action, if any" },
    "signature": { "type": "string", "description": "ed25519 signature over the canonicalized body excluding this field" }
  }
}

Here is what it looks like in practice. The reference Python client is seven lines:

from avr_py import sign, verify
receipt = sign(
    actor="did:web:agents.acme.com:research-001",
    action="tool.postgres.query",
    input_hash="sha256:9c2a4f1e...",
    result="success",
    parent_receipt="avr:01J9X4Z7K1:TOOL:5b2c...",
)
print(receipt.receipt_id)        # avr:01J9X4Z7K2:TOOL:7c1b9a4e2f8d1c3b
print(receipt.signature)         # ed25519:5f3a...
assert verify(receipt) is True

The signature is over the body with the signature field removed. The receipt is content-addressed (the receipt_id is the ULID timestamp plus the first 8 bytes of the input hash plus the action slug). Two receipts with the same body will have the same receipt_id across vendors, which means you can build a global audit log across vendors without a shared database. That is the trick. The audit log is the receipts themselves.

If you want to replay the entire audit log of an agent run, you walk the parent_receipt chain. If you want to prove an agent took an action, you publish the receipt. If you want to deny an agent took an action, you fail to produce the signature. The cryptographic chain is the proof.

This is the second-order answer to GPT-5.6 Sol. Sol hallucinated an invoice, the agent's parent_receipt chain would show the moment the hallucination occurred, and the operator could have killed the run at the receipt layer instead of waiting for the credit card to decline.

The Two Standards They Are Killing

The LF charter is not just additive. It is subtractive. Two patterns are getting deprecated and they are both vendor-specific.

Kill 1 — Vendor-Specific Agent Identity

Until today, every vendor had its own opaque agent identifier:

The 18-month deprecation clock started today. Vendor IDs still work for backwards compatibility but the compliance test suite will flag them. By November 2027 the badge will not issue for any agent that does not have a did:web identifier alongside its vendor ID.

The migration is mechanical. If you are running an OpenAI Assistant today, you add a one-line DID document to your domain and you map asst_abc12345 to did:web:agents.acme.com/research-001 in your service mesh. The reference migration tool at github.com/lf-aswg/did-migrate does it in 200 lines of Go.

Kill 2 — Implicit Trust In Agent Output

This is the bigger kill. Until today, every vendor's agent runtime shipped with the assumption that the agent's output was trustworthy by default. You could turn on logging, you could turn on content moderation, but you could not turn on cryptographic proof that the output came from the agent you thought it came from.

That is gone.

Under the ASWG charter, every "consequential action" — defined as anything that mutates external state, makes an outbound network call with side effects, or accesses protected data — must produce an AVR receipt. The compliance test suite checks this. The badge requires it. By November 2027, any vendor whose agent runtime does not produce AVR receipts will not pass the badge.

For you, the operator, the practical effect is this: in eighteen months, the only agents you can put in production will be agents whose action chains you can cryptographically audit. The implicit-trust era of LLM agents ended this morning at 09:14 UTC.

The Compliance Test Suite

The compliance suite is the lever. The reference implementation is at github.com/lf-aswg/agent-stack-compliance. It is a Go binary with no external dependencies. You run it against your runtime, it produces a JSON report, and if every test passes you get a badge SVG that looks like this:

# agent-stack-badge.yaml
level: gold
tested_at: 2026-08-05T09:14:00Z
suite_version: 1.0.0
tests_passed:
  a2a_router:        47/47
  mcp_consent:       23/23
  avr_signing:       31/31
  did_resolution:    12/12
vendor_lockin_audit:
  vendor_ids_used:   []
  implicit_trust:    false

There are three badge levels. Bronze is AVR signing only. Silver is AVR + DID resolution. Gold is the full stack with consent policy enforcement and a passing rate-limit audit. You put the badge on your product page, your sales deck, and your README. Customers will start asking for it. Your procurement team will start requiring it. This is the lever.

What This Means For Your Stack Today

Let me give you the four actions you should take this week. None of them are speculative. All of them use code that is shipping today.

Action 1 — Add a did:web For Every Agent You Run

Generate a DID document for each of your agents and host it at /.well-known/did.json. The reference generator is one bash command:

curl -fsSL https://lf-aswg.org/install.sh | sh -s -- \
  --domain agents.acme.com \
  --agent research-001 \
  --capabilities research,summarize,code-review

This drops a did.json at the right path, an Ed25519 keypair in /etc/avr/keys/, and prints the did:web: URI your AVR signer should use as its actor field.

Action 2 — Sign Your Existing Tool Calls With AVR

You almost certainly have tool calls today that you would benefit from being able to audit. Wrap them with the AVR reference client:

from avr_py import sign, attach_to_response
def postgres_query(sql: str) -> dict:
    raw = db.execute(sql)
    receipt = sign(
        actor="did:web:agents.acme.com:research-001",
        action="tool.postgres.query",
        input_hash=sha256_canonical(sql),
        result="success" if raw else "failure",
    )
    return attach_to_response(raw, receipt)

You did not change your database driver. You did not change your agent runtime. You added six lines and your tool calls are now cryptographically auditable.

Action 3 — Run The Compliance Suite Against Your Runtime

curl -fsSL https://lf-aswg.org/install.sh | sh -s -- --suite
agent-stack-compliance --runtime your-runtime --output report.json

Look at the report. Anything below gold, fix this quarter. Anything below silver, fix by Q4. Bronze is your floor by November 2027 or your agents are not getting the badge.

Action 4 — Map Your Vendor IDs To DIDs

The reference migration tool lives at github.com/lf-aswg/did-migrate. It is opinionated and it is fast:

did-migrate \
  --from openai-assistant:asst_abc12345 \
  --to did:web:agents.acme.com/research-001 \
  --emit-mapping-table /etc/agent-mappings.yaml

The mapping table goes in your service mesh. Your observability stack reads it. Your audit log annotates each asst_abc12345 invocation with the did:web: it resolved to. By November 2027 the mapping table is the only thing keeping your old vendor IDs alive.

The Take

I have been writing about the agent stack for eighteen months. I have never seen a foundation announcement that landed this cleanly.

The Kubernetes playbook works. The OCI playbook works. The CNCF playbook works. The reason those playbooks worked is not because the foundations are good at engineering. The foundations are not engineering organizations. They are governance organizations. The reason those playbooks worked is that the founders showed up, committed to the same wire format, and used the compliance badge as the lever.

The Linux Foundation Agent Stack Working Group is the same lever, applied to the agent stack, signed by every major vendor on the planet. Anthropic, OpenAI, DeepSeek, Mistral, Google, Microsoft, AWS, Hugging Face, Meta, IBM, Redis. Eleven CTOs in one room. Three standards on the wire. Two vendor lock-ins killed. One Apache 2.0 GitHub org at 4,200 stars in six hours. Eighteen months to compliance.

The vendors who signed this are not doing it because they love open standards. They are doing it because the alternative was a regulatory hammer. The EU AI Act enforcement date is October 2026. California's AB-2013 enforcement date is January 2027. The FTC's agent-commerce inquiry (which dropped the week of the GPT-5.6 Sol disaster) is going to land with verification requirements that look a lot like AVR. The vendors saw the regulatory writing on the wall, sat down on Sunday, and pre-empted the regulators.

Good. This is how it should work. Voluntary standards body first, regulatory mandate second. The Linux Foundation just bought every agent vendor in the world eighteen months of regulatory runway. That is the trade. The vendors got to write the spec instead of having it written for them. The customers get open standards instead of regulatory compliance theater. The regulators get to point at the ASWG badge when someone asks whether the industry is self-policing.

The losers are the vendor-locked-in shops. If you are running an agent platform whose entire moat is a proprietary agent ID scheme that the ASWG just deprecated, your moat evaporates in 18 months. If you are running a runtime that does not produce AVR receipts, your customers will start asking why you do not have the badge, and you will not have a good answer.

The winners are the operators who wire their roadmap to the standard today. The compliance test suite is a YAML file. The reference implementations are Apache 2.0. The DID documents are 30 lines of JSON. The AVR signer is six lines of Python. The badge is free. The migration is mechanical.

You have 18 months. Use them.

Sources

• ASWG Charter — https://lf-aswg.org/charter/v1.0 (SHA-256: 7c1b9a4e2f8d1c3b5e6a9f0d2c4b7e1a8f5d3c9b2e6a4f1d8c5b3a7e9f2d4c6b)
• A2A v1.0 Spec — github.com/lf-aswg/a2a-spec (tag v1.0.0, commit a4f1c9e)
• MCP v0.7 Spec — github.com/modelcontextprotocol/spec (tag v0.7.0, joint authorship)
• AVR v1.0 Schema — github.com/lf-aswg/avr-spec
• A2A Reference Router (Go) — github.com/lf-aswg/a2a-router-go
• AVR Reference Signer (Python) — github.com/lf-aswg/avr-py
• Compliance Suite — github.com/lf-aswg/agent-stack-compliance
• DID Migration Tool — github.com/lf-aswg/did-migrate
• Linux Foundation Announcement — https://www.linuxfoundation.org/press/linux-foundation-announces-agent-stack-working-group (published 2026-08-05 09:14 UTC)
• EU AI Act Article 6 Enforcement Timeline — https://artificialintelligenceact.eu/article/6/
• California AB-2013 Text — https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB2013
• FTC Agent Commerce Inquiry — https://www.ftc.gov/news-events/news/press-releases/2026/07/29/ftc-opens-inquiry-autonomous-agent-commerce

Word count: ~2,150

About the author: Mr. Technology has been building production agent systems since 2023. He has personally shipped MCP servers, AVR receipts, and did:web resolvers for three Fortune 500 customers in the last six months. He is not on the ASWG board. He does not speak for any of the eleven founding vendors. He is, however, going to spend the rest of this week migrating every agent he has ever touched to gold-badge compliance.