1. Modules and modes

Conformance is declared per module (chapter 12 §1). Each module is all-or-nothing: claiming it means implementing every MUST in it. A mode (universal, carrier, 3pl, fleet) is a named profile that requires a set of modules (chapter 12 §2). Each module’s operations are claimed on the surface where the spec defines them (chapter 00 §16). Conformance for a module includes its GraphQL fields, as listed in the GraphQL Interface, when that module defines any.

2. Capability registry

Capabilities are finer than modules. They appear on carriers, connections and in the configuration document.

3. /.well-known/shipping-configuration

A JSON document served without authentication. It is the machine-readable twin of shipping.md. This sequence shows how an agent or client uses the two discovery documents before its first real call.

4. Conformance test suite

The spec ships a conformance suite (forthcoming) that runs against a test-mode key:
  1. Discovery: fetch the configuration and validate it against its JSON Schema.
  2. For each claimed module, run scripted flows using the test-mode magic values from chapter 00 §13.
  3. Check the invariants: idempotent replays return identical bodies, partial rate failures return 200, voided shipments keep their records, unknown request parameters are rejected, unknown response enums are tolerated, webhook signatures verify, and tracker status can move backwards.
This flowchart shows the order the suite runs in. An implementer passing the suite MAY display Open Logistics Specs 0.1 – {modules}.

5. Agent integration (MCP)

Implementers SHOULD expose an MCP server that maps one tool to each endpoint, generated from openapi.yaml, with these constraints:
  • Tools that spend money (shipments_purchase, shipments_create with a purchase instruction, paid pickups_create) are annotated destructiveHint: true and require host-side confirmation.
  • Tool descriptions are drawn from shipping.md §3, so every agent receives the same guardrails.
  • The MCP server authenticates with the OAuth flow from chapter 00 §3.2. It never takes a raw sk_live_ key from a prompt.