January 2026 | 12 meetings | ~8.6 hours of recordings
Q4 2025 was defined by a major challenge and one steady advance. The steady advance was Concerto V4: the team built toward an alpha release across the quarter, removing feature flags, completing the TypeScript migration, and integrating the Rust validator behind a feature flag by end of October. In November an npm supply chain attack infected seven Accord Project packages via a transitive AsyncAPI dependency — Matt Roberts led a rapid response that rotated all credentials and introduced industry-grade trusted publishing via OIDC . The team accelerated work on agentic payment protocols, MCP server hardening, and a new monetary type backed by decimal.js. The quarter closed with the group discussing associate membership in the Linux Foundation’s newly announced Agentic AI Foundation.
Key Developments
- Concerto V4 alpha released. The team navigated V4 to alpha.2 during Q4, removing feature flags for map types and import aliasing, resolving a circular dependency between core packages, and generating migration guides via an AI agent. The TypeScript migration of core packages was underway heading into Q1 2026.
- Supply chain attack and security overhaul. A November supply chain attack via a transitive AsyncAPI dependency prompted a full security response — credential rotation, npm Trusted Publishers via OIDC, dependency pinning, and Snyk scanning. The project emerged significantly hardened with a model others in the ecosystem referenced.
- Rust validator reaches full conformance. The Concerto Rust validator passed all 75 conformance tests by November, validating the multi-runtime strategy and setting up the Q1 2026 runtime expansion into both Rust and .NET.
- Agentic payment integration. Work began on modeling HTTP 402 agentic payment data in the Accord Project Agent Protocol (AAP), with a live OpenAI Agents SDK demo connecting via MCP to trigger contract logic — the most sophisticated agentic integration to date.
- Monetary type overhaul. The group converged on decimal.js as the foundation for a new
MonetaryAmountmodel in Concerto, supporting configurable rounding, custom currency codes (including crypto), and explicit precision declarations. - Agentic AI Foundation on the horizon. The Linux Foundation’s new Agentic AI Foundation — hosting the donated MCP codebase — emerged in December, with the group beginning to discuss Accord Project associate membership as a strategic move.
Announcements
- Concerto V4.0.0-alpha.2 released (October)
- Supply chain security incident response completed; npm Trusted Publishers deployed across all Concerto repos
- Rust Concerto validator passes all 75 conformance tests
- Snyk security scanning integrated into Concerto build pipeline
- Google Summer of Code Mentor Summit attended (Munich, November)
- Agentic AI Foundation announced under the Linux Foundation; associate membership under discussion
Meeting Summaries
October 1 – Rust Validator & SemVer Ranges
Ertugrul demonstrated a Rust implementation of the Concerto metamodel validator achieving ~10x faster performance than the JavaScript equivalent by pre-compiling regex at build time — developed with AI assistance using Cursor, with plans for a Wasm binding. Jamie and Mo presented a SemVer ranges proposal for Concerto imports with pluggable resolution strategies and a freeze/pinning mechanism for reproducible builds.
October 8 – Concerto V4 Roadmap
The group agreed on the Concerto V4 roadmap: back out prior API refactor changes, forward-port recent V3 changes, and target a beta release by end of November. Jamie presented the Rust structural validator as a drop-in replacement for the JavaScript metamodel validator, to be integrated behind a feature flag by end of October. Map types and import aliasing were confirmed as V4 defaults, with wildcard imports removed.
October 15 – Concerto V4 & Analyzer
Matt reported V4 builds and tests passing after backporting V3 changes, with feature flags for map declarations and import aliasing ready to remove ahead of an alpha. Dan’s addition of events and state support to the template engine was noted, enabling a structured init/trigger/response lifecycle. The semantic version analyzer was found to incorrectly classify property moves up an inheritance chain as breaking changes.
October 22 – Concerto V4 Alpha Release
Matt presented Concerto V4.0.0-alpha.2, with maps, import aliasing, and strict namespace decorators enabled by default. A circular dependency between concerto-core and concerto-types was resolved by folding TypeScript definitions into the standalone concerto-metamodel package. The V4 migration guide and release notes were generated by an AI agent from the PR commit history with only minor manual corrections.
October 29 – Concerto Analyzer & SemVer Imports
The group debated version bump semantics — concluding that moving a property from a child to a parent concept is a breaking change the Concerto analyzer should detect. Mo presented PRs adding SemVer range support to the Concerto parser and metamodel, enabling round-trip import parsing without breaking the linter. Agentic payment work was underway to model W3C Payment Request API in Concerto as a basis for a demo contract using HTTP 402.
November 5 – Concerto Rust Validation & AAP
Presented a Rust-based Concerto validator PR passing all 75 conformance tests, up from 51 previously. Matt outlined work modeling HTTP 402 (Payment Required) data types in AAP to support agentic payments, including exploring integration with the OSLC Really Simple Licensing (RSL) framework. DocuSign’s announcement of a new MCP server and ChatGPT integration was noted as validation of Accord Project’s direction.
November 12 – GSoC Summit & State Persistence
Sankit debriefed the group on the Google Summer of Code Mentor Summit in Munich. Matt presented a PR adding state persistence to the Accord Project app server, demonstrating a late-delivery penalty clause that initialises and increments a counter stored in a database. A community member walked through modelling the Agent Payment Protocol (Google) using Concerto.
November 19 – AP App State Persistence & TemplateMark Optionals
Matt demonstrated state persistence in the AP App server with a late-delivery template showing a counter incrementing across trigger calls, plus payload validation against the Concerto model on trigger requests. The group discussed extending the query API to support JSON path queries and NLP-style full-text search over agreement data.
November 26 – Supply Chain Attack & Security Response
A JavaScript supply chain attack infected seven Accord Project npm packages via a transitive dependency on the AsyncAPI CLI. Matt Roberts led rapid incident response, removing the malicious versions within hours and rotating all GitHub, npm, and AWS credentials. The group agreed to audit and pin all dependency versions across package.json files, GitHub Actions workflows, and Dockerfiles. Anshu also presented progress on a large Rust port PR for Concerto using tagged enums for property types.
December 3 – Financial Calculations & MCP Agents
The team discussed adding decimal.js and Day.js to the Accord Project runtime for financial rounding and precision in the late delivery penalty example. Dan and the group explored overhauling the MonetaryAmount Concerto model to support configurable rounding strategies and explicit precision levels. A live demo showed a delivery agent using the OpenAI Agents SDK connecting via MCP to trigger contract logic.
December 10 – Supply Chain Security & NPM Publishing
Matt demonstrated the npm Trusted Publishers feature, scoping publish tokens to specific GitHub Actions workflow files on a per-package basis to replace long-lived npm access tokens. Jamie and Matt committed to auditing unpinned dependencies across Concerto, CLI, and code-gen packages. Snyk was evaluated and trialled as a free supply-chain security scanning tool.
December 17 – Supply Chain Security & Currency Types
Matt and Jonathan applied the trusted publishing workflow across the broader set of Concerto repositories, removing all legacy npm tokens. Sanketh raised the newly announced AgentTech Foundation under the Linux Foundation — which hosts the donated MCP codebase from Anthropic — and the group discussed potential Accord Project associate membership. Nile led discussion on improving Concerto’s monetary type to support flexible currency codes including crypto, selecting decimal.js for accurate floating-point support.
Plans & Upcoming Work
- Concerto V4 beta and release candidate (Q1 2026)
- TypeScript migration of Concerto core and util packages (Atia, ongoing)
- Rust runtime integration and .NET runtime validation
- AAP agentic payment model and HTTP 402 support
MonetaryAmountmodel overhaul with decimal.js and configurable rounding- Associate membership application to the Agentic AI Foundation
- GSoC 2026 planning (org application due early February)