Standards and protocols¶

The architecture uses established standards where they exist. This page lists the ones that matter most, with a note on how they relate to the ecosystem.

Contracts and data¶

Standard	What it is	Where it fits
OpenAPI	HTTP API description format	Product APIs and SDK contracts
JSON Schema	Schema language for JSON data	Harmovela events, tool inputs, contracts
JSON-RPC	Remote procedure call protocol	Mnemovela and runtime interfaces
gRPC	RPC framework	High-throughput service interfaces
CloudEvents	Event envelope specification	Event interoperability (where used)

Identity and security¶

Standard	What it is	Where it fits
OAuth 2.0	Authorization framework	Delegated access
OpenID Connect	Identity layer on OAuth 2.0	Agent identity provider interfaces
SPIFFE	Workload identity framework	Workload attestation
W3C DID	Decentralized identifiers	Identity patterns (design space)
mTLS	Mutual TLS	Workload authentication
NIST SP 800-207	Zero trust architecture	Trust-boundary design

Telemetry and operations¶

Standard	What it is	Where it fits
OpenTelemetry	Traces, metrics, logs	Runtime and gateway telemetry
OpenTelemetry semantic conventions	Naming conventions for telemetry	Consistent traces and metrics
SLSA	Supply-chain levels	Build and artifact integrity
CycloneDX	SBOM format	Software and skill inventories

Architecture practice¶

Standard	What it is	Where it fits
ISO/IEC/IEEE 42010	Architecture description	Viewpoints and concerns
TOGAF	Enterprise architecture framework	Portfolio and method context
ArchiMate	Architecture modeling language	Enterprise architecture models
C4	Software architecture diagrams	System/container/component views
arc42	Architecture documentation template	Document structure

Risk and security frameworks¶

Framework	What it is	Where it fits
NIST AI RMF	AI risk management framework	Governance and risk framing
OWASP Top 10 for LLM Applications	LLM application risks	Threat modeling
OWASP ASVS	Application security verification	Security review

Protocols in the ecosystem¶

MCP — tool and context integration.
A2A — agent-to-agent interaction patterns.
Harmovela — asynchronous coordination protocol (see the project page).

How to use this page¶

Standards are tools, not badges. A project “using” a standard should be able to show the contract, the conformance evidence, and the boundary where the standard is enforced. If it cannot, the standard is a label, not an architecture.