IETF-W3C

The HTTP/2 Rapid Reset episode exposed a gap that standards documents cannot close on their own. A protocol rule can permit a sequence of actions; a security researcher or operator can show how that sequence becomes an attack; a working group can review the behavior; and vendors can ship fixes. None of those steps, separately or together, proves that every exposed service has stopped accepting the dangerous path. The repair becomes durable only when implementation releases, package updates, operator controls and measurement converge.

The label “IETF–W3C” compresses two standards institutions into one directory entry. The public record supports a narrower description: the organizations have documented channels of cooperation, but the evidence reviewed does not establish one legal entity, one administrative owner, or one universal remedy for disputes involving both.

The IETF repaired a dangerous ambiguity in TLS renegotiation. That repair changed the protocol. It did not, by itself, prove that every older library, appliance, endpoint and application path had stopped accepting the unsafe behavior.

The label IETF-W3C suggests a single governance center. The public record describes something more fragmented: the IETF standards process, the IETF Administration LLC, and W3C’s technical and membership structures assign different powers to different bodies. That distinction determines who can decide, who can object, and what remedy is actually available.

IETF standards do not operate networks. They define the state machines, security dependencies and recovery procedures that networks must implement if they are to interoperate. That distinction matters when a protocol becomes part of the Internet’s operating surface: continuity no longer belongs to a standards body alone, but to implementers, operators, measurement systems and the institutions that maintain the specifications.

An anonymous questionnaire can ask hard questions because the answer is not supposed to point back to the person. W3C’s new member and wider-community surveys make that promise, then each invites respondents to leave an email address for a follow-up interview. Nothing public shows that an answer has been exposed or improperly joined. The problem is more exact: readers cannot inspect the boundary that keeps the contact field from becoming an identity key. W3C should publish that separation rule while the survey is still open.

W3C's new WebAuthn Level 3 Recommendation links a fixed test report with four browser columns. The transition record adds that part of Chrome's implementation differs from Edge's. That caveat is important—and incomplete. Product names show where tests ran; they do not tell a later reader which feature was independently implemented on which technical path.

W3C's updated *ARIA in HTML* Recommendation points readers to an implementation report whose visible date is 22 March 2026. The public file history shows a large revision on 20 May and another change on 27 May. Both can be true: March may be the evidence cutoff and May the publication history. The governance problem is that the page calls only one of them “Last updated.”

The W3C and GS1 workshop on e-commerce for humans and AI agents will bring several emerging protocols into one room. Its public pages already expose a small but consequential recordkeeping problem: ACP names two different public artifacts. Before the event turns presentations into conclusions or possible next steps, each protocol reference should carry a compact key that says exactly which artifact, version and steward it means.

The new Agent Conformance and Benchmarking Community Group gives itself a crisp test: two independent parties should be able to reproduce a published score to the same value. That would be useful evidence that a procedure can be rerun. It would not yet answer whether the procedure measures the right property, whether its pass line is justified, or who may use the result to bind a vendor, buyer or regulated party.

A new WebTransport charter gives peer-to-peer work a legitimate place to be explored, but not yet a named standards output. That distinction is the useful part of the decision. It lets engineers test local-network and NAT-traversal ideas without asking readers to confuse an incubation lane, a future specification and deployed capability.

W3C’s accessibility reviewers have asked to stop receiving duplicate charter-review tickets because they already work from the central Strategy queue. Privacy reviewers, meanwhile, say their local copies are useful. The disagreement is not about whether horizontal review matters. It is about where work should enter each group and where everyone else can verify that it arrived, was answered and reached a disposition.

W3C’s call for a TPAC 2026 mini-workshop on Data Governance & Ownership asks a useful question: what is broken, and what should Web standards do next? It also reserves a quieter power. Because the subject overlaps AI and Society and Age Assurance, organisers may ask a contributor to resubmit in another workshop or as a standalone breakout. That can improve a crowded programme. It also changes the room, the neighbouring evidence and the path into a planned W3C paper. The route should therefore remain visible without being mistaken for a standards decision.

The public page for W3C’s active Accessibility Guidelines Working Group charter ends on 28 August 2026. Four calendar days later, draft minutes record the group accepting a new set of WCAG 3 updates and freezing the reviewed document while preparing a Call for Consensus. That sequence does not prove the work lacked authority. It proves that the public authority record and the public work record no longer join on the page. W3C needs a small continuity receipt that says which instrument carried the group across the displayed date, what work it permitted and when a successor charter will replace it.

W3C's public recharter issue says the Linked Web Storage Working Group is making no substantive change. It also says the first charter was aggressively optimistic and the group now hopes to reach Candidate Recommendation in late 2026 or early 2027 before moving into maintenance. That is a consequential change in the public timetable. Yet the immutable proposed charter still asks its editor to “Choose one” between maturity paths, leaves five completion dates blank and retains a specimen deliverable and FooML timeline. The refinement window remains open. The governance question is therefore not whether W3C has broken a rule, but when a scope-continuity label becomes a review-ready document.

At 12:24 UTC on 28 August, Intel told the W3C Devices and Sensors Working Group that it had concerns about removing five peripheral APIs from a proposed charter. The message arrived through the channel and by the date named in the call for consensus. The same public archive then supported two procedural outcomes. WHATWG launched a workstream with all five specifications after recording no objections to the W3C call while acknowledging Intel's concerns. Two days later, W3C recorded that concerns had been raised and therefore consensus on removal had not been reached. The institutions did not vote on the same proposition, but their records expose a missing control: how a response is classified when one venue makes its decision depend on another venue's process.

The W3C Math Working Group has a sensible rule for decisions made in meetings: every resolution remains provisional until a call for consensus gives absent participants a week to respond. The difficult part begins when the week ends. Its charter says no objections can turn the resolution into Working Group consensus. The governing W3C Process also says silence is abstention and consensus requires substantial support. A credible decision record must preserve both facts.

A machine can follow two RDF links and produce a third: a resource conforms to a profile; that profile is a profile of a specification; therefore the resource conforms to the specification. The W3C’s new Profiles Vocabulary draft makes that inference explicit. It also exposes why the result cannot yet travel alone. The axiom remains at risk, communities still define what conformance means, the dated Turtle artifact does not carry the axiom, and the public implementation record has not filled its per-feature evidence table.

An accessibility report can contain a precise percentage and still leave its denominator invisible. W3C’s new WCAG Evaluation Methodology says the random part of a representative sample should equal 10% of the structured part. It does not say that evaluators inspect 10% of the product. That distinction is more than arithmetic: it determines what the evidence can support, who is accountable for selecting it and whether a public statement is mistaken for a whole-product WCAG conformance claim.

On 6 August, a W3C repository changed one word: “Measurement” became “Ratings.” Twelve days later, the Sustainable Web Interest Group published its first Group Note Draft under the narrower name. The distinction is honest. The document combines evidence and expert judgment, not four direct measurements. Yet it still turns ratings for People, Planet and Prosperity, plus an expected timeframe, into one number that can order 71 guidelines. The name now admits judgment; the total still hides where that judgment entered.

W3C’s open Web Machine Learning charter patch does more than add an AI-labelled deliverable. It would put JavaScript tool registration, browser mediation and declarative annotations on HTML forms inside the Working Group’s proposed scope. Yet the same diff leaves the charter’s named coordination list unchanged. The Strategy issue asks for HTML, ARIA, accessibility, security, privacy and architecture review, and those conversations are plainly happening. What is missing is not participation. It is an attributable map that says which group owns which cross-layer decision, how the groups communicate and where an unresolved objection goes before Advisory Committee review.

An open correction to W3C’s next WebRTC charter separates two decisions that its public draft had joined together. WebRTC Identity may be discontinued because implementors have shown too little interest. SFrame may cover a limited subset of its use cases. But the Working Group co-chair responding to a security review says the technologies are not replacements and that no successor deliverable in the group preserves Identity’s peer-verification and media-isolation properties. The repair now needed is not a verdict that the old design must survive. It is a public account of which properties moved, which did not and who owns the residual question.

W3C opened refinement of a new Security Interest Group charter on 19 August. The draft draws a clear outer boundary: the group will advise, review and publish in-scope material, while Recommendation-track opportunities move to a competent Working Group or an incubation group. Yet its participation and communication clauses still describe implementors, specification editors, test leads and public specification drafts without saying which document class those roles belong to. That is a repairable draft problem—and a useful test of whether authority follows a title or a named handoff.

W3C has approved a new charter for the Web Performance Working Group through August 2028. Its most consequential governance choice is a distinction, not a deliverable: two implementors may express interest in a feature before it enters a specification maintained as a Candidate Recommendation, yet that is not the same evidence as two independent implementations passing open tests. The difference needs to remain visible after a feature moves from incubation into standards work.

On 4 August, W3C’s Advisory Board published five proposals for bringing human-rights considerations further into the consortium’s technical work. The third proposal treated a Threats and Harms Community Group as a possible next step. W3C’s own community record tells the chronology in the opposite order: the group had been proposed on 28 July and launched on 29 July. The discrepancy does not discredit either project. It reveals that the public document has no place to say when a proposal has crossed into reality.

W3C’s proposed Web Application Security charter is unusually candid about time: almost every normative deliverable says its expected completion is undetermined. That is not evidence that sixteen specifications are late. It is evidence that the charter maps authority better than it maps delivery. As refinement approaches its announced early-September estimate, the missing governance object is a per-deliverable record that lets uncertainty remain unknown while showing who must make the next decision, what dependency stands in the way and when the forecast was last reviewed.

W3C has publicly opened a route for Web Speech API to enter the Audio Working Group, but the document that would confer that authority has not caught up. The recharter issue calls adoption a substantive scope change; the draft charter still says speech recognition and synthesis are out of scope. That is not a scandal or a rejection. It is a live governance state that needs a visible handoff from proposal to authority.