---

Why

Spectral rulesets are how a great many organizations express machine-readable API governance. The Dutch government's REST API Design Rules — a mandatory standard on the Netherlands' comply-or-explain list — are written as Spectral rulesets, and they are not the only government that has done this. Large enterprises run the engine behind their own internal validation platforms. Startups wire it into CI on day one. The tool all of that rests on has stopped moving.

• Acquisition. Stoplight was acquired by SmartBear, and investment in the project did not follow.
• Abandonment, and it is measurable. Issue triage peaked in 2021 and fell away after — 157 issues closed that year, 12 in 2025, 10 so far in 2026.
• A backlog nobody is draining. 241 open issues and 39 open pull requests. The oldest community pull request has waited five years.
• A supply-chain incident. In July 2026 a compromised dependency reached Spectral through its rulesets package. The issue reporting it is still open, and the single follow-up question on it was never answered.
• Telemetry. On 2026-06-30, install-time analytics were added across the packages — what it sends, and how to opt out.
• The format needs room to grow. People already lint far more than OpenAPI and AsyncAPI with it, and it has nowhere to go while coupled to one unmaintained CLI.

Because the specification and the tool were never separated, an unmaintained tool means an unmaintained format. The full case, with the data →

What this is not

Where it goes next

Multi-specification. OpenAPI, AsyncAPI, Arazzo, Overlays, JSON Schema, Swagger 2.0, GeoJSON, OData, GraphQL, A2A agent cards, MCP, JSON-LD, APIs.json, and Markdown. Multi-engine. Spectral, vacuum, Open Policy Agent, Cedar — a documented format is the interchange layer between them. JavaScript stays. Browser support is a hard requirement, and a compiled binary cannot serve it. The full scope →

Where it lives

API Commons is the home for now — deliberately a parking spot rather than a destination. It is not a home for technology and not a funding mechanism; it is an information, story and research-sharing venue, and somewhere neutral for a project to stand while its permanent home gets worked out. Nobody driving this wants to own it.

The OpenAPI Initiative is a candidate, though its charter has historically constrained tooling — awkward when the whole point is keeping the spec and the tool aligned. The Linux Foundation is a candidate. A European home is a candidate. And there is a structural question underneath all of them that decides more than it looks like it does: whether the technical home and the fiscal home are allowed to be different, because that is what determines whether this specification can ever be sponsored directly rather than folded into somebody's membership story. That question is an open issue, and the funding argument is here.

How the work is tracked

Vendor neutrality is the whole argument, and neutrality that only exists in prose is not neutrality. So the decisions are issues, the roadmap is generated from those issues, and every item that gets built will have a single pull request pointing back at the thread that argued for it. Nothing about the direction of this format should require knowing who to ask. The roadmap →

The same applies to the ecosystem. The tool here is one implementation among many, and that claim is worth nothing without a published list — every engine, every product that embeds the format behind its own interface, and the adjacent tooling that solves the same problem differently, with the evidence for each. The implementation landscape →