Secure remote delegation and stamp OA 1.6.1

[aswhitehouse]

• Implemented and pushed fixes for #111 and #112.

Branch: agent/fix-spec-version-remote-sandbox
Commit: 7db88ca
Create the pull request (https://github.com/prime-vector/open-agent-spec/pull/new/agent/fix-spec-version-remote-sandbox)

What changed:

• Remote http://, https://, and resolved oa:// spec destinations are checked before fetching.
• Blocked dependencies fail before any network request or earlier model call.
• Added unit and conformance coverage.
• Normative specification and schema metadata now identify OA 1.6.1.
• Added revision history and corrected compatibility wording.
• Updated reference documentation and changelog.

Validation:

• Python: 543 passed, 3 skipped
• npm: 10 passed
• Conformance: zero failures
• Ruff: clean
• Website build: passed
• Working tree: clean

Issue #110 remains intentionally separate until cross-document sandbox inheritance semantics are agreed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
open-agent-spec	Ready	Preview	Sep 2, 2026 1:03am UTC

[sgriffiths]

Verified against 7db88ca: Python suite 544 passed / 3 skipped, conformance 37 pass / 0 fail / 1 unsupported, ruff clean.

The security change is in the right place. _check_remote_spec_endpoint reuses _check_url_domain, preflight walks the chosen task plus direct depends_on before _resolve_chain, and the fetch path checks again. oa:// resolves to openagentspec.dev and is required on the allowlist rather than implicitly trusted. The Python unit test is the real pin — mock_fetch and mock_invoke both stay uncalled. Leaving #110 alone is correct.

Direct-deps-only preflight is sound rather than a hole: _resolve_chain also only executes direct dependencies (deep-lattice.yaml documents this), so preflight coverage matches execution coverage exactly.

Five things to settle before merge.

1. Fold this into the existing [1.6.1] section, with a Breaking note

## [1.6.1] - 2026-08-31 already exists carrying #103/#104. #100, #111 and #112 sit above it in [Unreleased], while §14.4 in this PR attributes remote delegated-spec fetches to that same dated 1.6.1. Those cannot both be true.

1.6.1 is unreleased everywhere — no v1.6.1 tag, no GitHub release, PyPI latest is 1.6.0 — so nothing has shipped under that number and folding is safe. The 2026-08-31 date is already stale and needs re-setting in the section, §14.4, and the spec header when it ships. Details inline on CHANGELOG.md.

2. The document stamp is incomplete

Header, §14.1 and the schema descriptions moved to 1.6.1, but the Abstract still opens "This document defines the Open Agent Spec (OA) 1.6.0", and spec/conformance/README.md:3 still opens as the 1.6.0 suite while line 9 — changed here — says 1.6.1. Appendix examples pinned at "1.6.0" are correct; those are minimum versions. File comments on both.

3. Sibling sandbox cases are now mis-stamped

spec/conformance/cases/sandbox/domain-port-mismatch.yaml:7 and mcp-domain-preflight.yaml:7 pin open_agent_spec: "1.6.0", but §14.4 as written here dates host/port-pinned MCP rules and stricter allow_domains to 1.6.1 — and the new case correctly pins "1.6.1". The suite's own rule is to pin the minimum version the behaviour requires. Neither file is in this PR, so no inline comment.

4. No oa:// conformance case

"For an oa:// reference, the resolved registry URL is the destination checked" is a §11.2 MUST as of this PR, pinned only by Python unit tests. AGENTS.md asks for a conformance case whenever behaviour is normative, so no runtime regresses silently. A sibling to remote-delegation-preflight.yaml is the cross-runtime pin.

Worth not over-claiming while we're here: the harness only asserts expect_error, so a runtime that ran first and then blocked the fetch would still pass the new case. mock_invoke.assert_not_called() in the Python test is what actually forbids the earlier model call. Same limitation as mcp-domain-preflight.yaml — not new, just not what the case proves.

5. Scope the claim to what is actually enforced

Two gaps sit inside the current wording:

• Redirects. The check is on the declared URL; _fetch_remote_spec uses urlopen, which follows redirects, so an allowed host that 302s to a blocked one is fetched and then executed. Filed as #114 — the same defect exists at native.py:138/:179 and mcp.py:113, so it is one fetch-layer fix rather than a delegation fix, and does not belong in this PR.
• #110. The gate reads the delegating task's sandbox within the same document. Parent allow_domains: [safe.example] → local child spec → https://blocked.example/spec.yaml still fetches: preflight recurses into the child, resolves its empty sandbox, and the check no-ops. Deferring #110 is right, but "Remote delegated-spec fetches respect the sandbox" reads as closed.

So: narrow §11.3(6) and the CHANGELOG line to the declared URL and to the delegating task's sandbox, record http:// and redirects as deferred, and cross-link §7.4 → §11.3(6).

Same pass, not separate blockers

• Resolve malformed oa:// during preflight regardless of the allowlist — inline on runner.py.
• spec/conformance/CONFORMANCE.md is still the 1.5.2 / 33-case matrix with no sandbox rows; regenerate once the new cases land.

_fetch_remote_spec taking no sandbox argument is a nit rather than a blocker — the gate is caller-side, so a future call site skips it silently.

npm is fine to leave alone: loader.ts refuses sandbox: under the honesty rule and the node adapter does not declare the capability, so the new case is UNSUPPORTED there rather than failing.

[aswhitehouse]

All review items are addressed in 3c44e14.

• Folded npm CLI: accept bare spec path in oa-run/validate for parity with Python oa validate #100/Normative spec document edited in place while still stamped 1.6.0 #111/Remote spec delegation fetch is not gated by the effective sandbox #112 into [1.6.1] - Unreleased, added the oa:// breaking note, and synchronized the spec/revision release state.
• Completed the remaining 1.6.1 document stamps and added the §7.4 → §11.3(6) cross-reference.
• Scoped enforcement claims to the declared/resolved initial URL; redirects remain Redirect following bypasses http.allow_domains at every fetch site #114 and cross-document inheritance remains Sandbox constraints do not propagate across spec delegation (all keys) #110.
• Resolve malformed oa:// references during preflight regardless of whether an allowlist exists, with a regression test proving no fetch or model call occurs.
• Updated the sibling sandbox cases to minimum version 1.6.1, added the oa:// registry-host conformance case, and regenerated CONFORMANCE.md.

Validation: 545 Python tests passed / 3 skipped; Ruff and Mypy clean; npm build and 10 tests passed; conformance matrix has 38 Python passes and 33 npm passes with zero failures.