RFC: What's missing from v1.0.0?

[mas213]

We just published the first version of the OQP specification. Before we promote this more broadly, we want to hear from practitioners.

A few questions to get the conversation started:

1. Does the /verification/assess-risk endpoint capture what you'd actually need in a CI/CD gate? What's missing from the request/response schema?
2. The Knowledge Graph as the source of business rules, does this model make sense for your stack, or is there a simpler primitive we should define first?
3. MCP compatibility, are there gaps in how OQP maps to MCP's tool/resource model?

No wrong answers. The goal of v1.0.0 is to be wrong in the right ways so the community can correct it.