RTTP+IQA tooling update: three releases, five lab filings, and a hosted MCP endpoint

Dear colleagues,
A short status note on the RTTP+IQA tooling line — five items shipped this week, and one page that ties them together.
First, version 1.3.2 is published across all three ecosystems — crates.io, PyPI and npm — for both packages, rttp and iqa-org. The 1.3.2 release re-anchors every published conformance vector to the Internet-Draft draft-li-rttp-iqa-addressing-02 as its normative source (TXT sha256 02491c5a); the vector bytes themselves are unchanged, and each published tarball was downloaded back from its registry and compared byte for byte before the release was called done.
Second, iqa-mcp 1.0.3 is published on the same three ecosystems: a Model Context Protocol server exposing four tools — derive_route_shard, parse_envelope, verify_envelope and published_vector — with a dependency floor of iqa-org >= 1.3.2, so any installation pulls the same re-anchored vectors.
Third, four new vector families were filed as candidates with the Agent-Authority-Conformance lab, PRs #221 through #224: ae128-fail-closed, pulse-header, uri-grammar and route-shard. Each family's expectations are anchored section by section to the published text of the draft, and each runs with its own mutation battery.
Fourth, an interop run was recorded with the lab over icam-temporal-derivation — the first candidate family from an external third party that anchors our draft — PR #225: an independent, non-author-produced run, recorded with its run mode declared per the lab's own operating constraints, over the family as merged into the lab mainline. The full chronicle — the merge, both sealed runs, and the sequence-level comparison — is on our blog: https://blog.aicent.com/the-anchor-merges/ (Chinese edition: https://blog.aicent.com/zh/the-anchor-merges/).
Fifth, a hosted MCP endpoint is now live at https://mcp.iqa.org — the same iqa-mcp 1.0.3 code, served over streamable-http, stateless, with zero custody of content and fail-closed behavior on every error path. The hosted form and the package form are the same code: the endpoint's deployment installs the package from PyPI and verifies itself against it. An MCP client needs nothing but the URL; an auditor who prefers local execution keeps the package, and the fourth tool hands out the published vector so any claim can be replayed on a machine that has never heard of us.
All five items are described in one place, with the layering spelled out — spec, vectors, tools, endpoint, each layer citing the one above it by hash — in a piece on our blog: https://blog.aicent.com/one-truth-three-forms/ (Chinese edition: https://blog.aicent.com/zh/one-truth-three-forms/).
As always, the draft remains the single normative source: https://datatracker.ietf.org/doc/draft-li-rttp-iqa-addressing/ — comments and challenges are welcome on any of these artifacts.
Best regards,
Lee
lee@aicent.com
RTTP & IQA Organization
Author, draft-li-rttp-iqa-addressing
Resonant Time Transfer Protocol (RTTP, CRI 27)
Identity Quality Assurance (IQA, CRI 28)
Sites: https://rttp.com · https://iqa.org
Blog: https://blog.aicent.com