schwaizer.ch/OCP — Open Companion Protocolv1.0-draft

OCP Provider profile — normative specification (v1.0-draft)

Extends Core. The key words MUST, MUST NOT, SHOULD, MAY are per RFC 2119.

The Provider is the party that owns the data and the intelligence: retrieval, generation, and hub-located tools. OCP v1 deliberately does NOT standardize a Hub↔Provider wire protocol — that boundary is in-process or private in most deployments. What it standardizes are the Provider's obligations: the behavior a Hub MUST be able to rely on so that everything promised to Surfaces and Companions in Core §8–§10 actually holds. A Hub embedding its Provider and a Hub calling a remote one are equally conformant if these obligations are met.

1. The turn contract

For each accepted turn.input the Hub invokes the Provider ONCE with, at minimum: the resolved user identity, the tenant/workspace, the effective permission context (tier × scopes × ACL inputs, per Core §7), the input text, and the session's current context (Core §6).

The Provider:

  • MUST stream its answer incrementally (deltas), not return it whole; the Hub maps the stream 1:1 onto turn.delta frames.
  • MUST treat the supplied identity/ACL inputs as the ONLY authority for what content may be read. Retrieval over content the user cannot access is a conformance violation, not a quality issue.
  • MUST honor cancellation promptly: the Hub exposes an abort signal, and the Provider MUST stop generating (and SHOULD stop retrieving) as soon as it observes it. Frames produced after abort are dropped by the Hub.
  • SHOULD interpret context.resource to scope or bias retrieval (e.g. answer within the document being viewed) and MUST NOT fail when context is absent.

2. Grounding & citations

  • Answers over tenant content MUST be grounded: derived from retrieved material, not the model's open-world knowledge, wherever the question is about the tenant's data.
  • The Provider MUST emit citations for grounded content; the Hub maps them to turn.citation frames (resource {kind, id, title?}, optional quote). kind/id MUST be resolvable by the Surface that published the context vocabulary (documents, tasks, records, files, comments…).
  • When retrieval yields nothing relevant, the Provider SHOULD say so rather than fabricate; an unsupported claim with a fabricated citation is worse than no answer.

3. Tools

  • Hub-located tools (Core §9, location: 'hub') are executed by the Provider. The Hub performs authorization and the write-confirm gate BEFORE invoking the Provider's tool; the Provider MUST still validate inputs against the tool's declared schema.
  • When the Hub offers tool invocation into a turn (initiator holds tools.invoke), the Provider MAY call surface-located tools through the Hub-provided function and MUST tolerate every failure shape it can return: denied (human said no), unknown_tool, timeout, aborted, session_closed. A denied write MUST NOT be retried within the same turn.

4. Connection modes

Three composable ways a tenant's content reaches the Provider:

  • Crawl (pull): domain/sitemap → tenant-scoped knowledge base. Public content only; the crawler MUST respect robots.txt and MUST NOT authenticate.
  • Push: the tenant's systems push content on change (webhook/CI). The pushed corpus is tenant-scoped; per-document ACL metadata SHOULD accompany content.
  • Federated (MCP live): the tenant exposes an MCP endpoint; no data is copied. Per-user authorization is the federated system's authority and MUST be re-checked on EVERY retrieval — the Provider MUST NOT cache authorization decisions across users or sessions.

The Hub presents all of a tenant's sources as ONE permission-filtered corpus: indexed sources via retrieval, federated sources via retrieval-as-a-tool.

5. Isolation & retention

  • Multi-tenant Providers MUST scope every query, embedding store, and cache by tenant; cross-tenant leakage through shared vector space or caches is a conformance violation.
  • The Provider MUST NOT persist turn audio (Core §11) and MUST apply the tenant's transcript-retention policy to anything it stores about turns.
  • Telemetry SHOULD be aggregate; raw user inputs in Provider logs MUST follow the same retention policy as transcripts.