{"type":"agent-commerce-contract","version":"2.3","updated":"2026-10-05","canonical_scope":"Commerce contract: platform capabilities, API endpoints, authentication, trust framework, ranking model, connected platforms, protocol declarations. For agent action policies see agent-policy.json. For trust thresholds see agent-trust-manifest.json.","fidoDigitalCredentials":{"passkeys":{"status":"active","description":"WebAuthn passkeys as optional 2FA for merchant dashboard accounts. Max 5 passkeys per user.","endpoints":"/api/v1/auth/webauthn/*"},"merchantVerification":{"status":"code_complete","description":"Merchant identity verification via Digital Credentials API (Chrome 141+, Safari 26+). Supports US mDL (AAMVA VICAL). DEPLOYED, NOT IN USE: the endpoint is registered and no merchant has verified through it, so the trust boost below has never been applied.","protocols":["openid4vp","org-iso-mdoc"],"endpoints":"/api/v1/verification/credentials/*","trustBoost":{"BASIC":0.05,"STANDARD":0.1},"trustBoostNote":"The boost that would apply on a successful verification, not one currently in effect for any merchant.","registryEntry":"https://trusteed.xyz/.well-known/trusteed-capabilities.json → merchant_verification_dc"},"agentOperatorKya":{"status":"code_complete","description":"Agent operator identity verification via Verifiable Digital Credentials. DEPLOYED, NOT IN USE: no real operator has verified through it — the only identities in production are seeded demo data.","trustBoost":0.1,"trustBoostNote":"The boost that would apply to a verified operator, not one currently in effect.","registryEntry":"https://trusteed.xyz/.well-known/trusteed-capabilities.json → agent_operator_kya"}},"identityLinking":{"status":"experimental","enabled":false,"rolloutAccess":"guided_beta","description":"UCP Identity Linking — OAuth 2.0 flow to link shopper identity across platforms. EXPERIMENTAL: the associated loyalty / member checkout-discount behaviour is feature-flagged OFF by default and is NOT generally available. Do not rely on loyalty pricing or member-discount scopes as stable. Limited to guided-beta rollout for approved merchants; not a self-serve paid tier.","endpoints":{"authorize":"https://api.trusteed.xyz/api/v1/ucp/identity/authorize","token":"https://api.trusteed.xyz/api/v1/ucp/identity/token","profile":"https://api.trusteed.xyz/api/v1/ucp/identity/profile","revoke":"https://api.trusteed.xyz/api/v1/ucp/identity/revoke"},"supportedScopes":["loyalty:read","identity:link","checkout:discount"],"loyaltyDiscount":{"status":"disabled","note":"Loyalty discount is gated OFF (feature flag default-off). Treat as experimental, not stable."}},"platform":{"name":"Trusteed","url":"https://trusteed.xyz","api":"https://api.trusteed.xyz/api/v1","docs":"https://trusteed.xyz/en/developers","openapi":"https://api.trusteed.xyz/api/v1/openapi.json","llmsTxt":"https://trusteed.xyz/llms.txt","llmsTxtLarge":"https://trusteed.xyz/llms-full.txt","protocolCoverageMatrix":"https://trusteed.xyz/en/protocol-coverage","markdownMirrors":{"agentsMd":"https://trusteed.xyz/agents.md","authMd":"https://trusteed.xyz/auth.md","trust":"https://trusteed.xyz/en/trust.md","protocolCoverage":"https://trusteed.xyz/en/protocol-coverage.md","description":"text/markdown mirrors of the same content object the HTML page renders (no hand-transcribed copy, cannot drift). EN-only for now."},"directories":{"merchantIndex":"https://trusteed.xyz/.well-known/merchant-index.json","storeDirectory":"https://api.trusteed.xyz/api/v1/stores/directory","description":"merchantIndex: full merchant registry with slug, top_categories, trust_score, freshness_tier, mcp_endpoint (ISR 5min). storeDirectory: paginated REST API supporting ?platform= and ?q= filters."},"acpFeed":{"status":"active","feedUrl":"https://api.trusteed.xyz/api/v1/public/{slug}/acp-feed","promotionsUrl":"https://api.trusteed.xyz/api/v1/public/{slug}/acp-promotions","formats":["tsv","json"],"refreshRateMinutes":15,"description":"OpenAI ACP-compatible product feed (public, no auth) for ChatGPT product-discovery surfaces. Required fields: id, title, description, price, availability, image_url."},"description":"Multi-merchant trust and execution layer for agentic commerce. Provides a single authenticated REST API for AI agents to search, compare, and purchase products across verified merchants."},"capabilitiesNote":"These are HTTP actions on the aggregated REST API, rooted at `platform.api` — NOT MCP tool names. Some share a name with an MCP tool and the auth contract differs: the REST endpoints below all require a token, while the MCP discovery tools of the same name (search_products, compare_products, get_merchant_profile) need no token on any store. Both are true; they are different surfaces. Resolve each `path` against `platform.api`, and call MCP tools at POST /{storeSlug}/mcp.","capabilities":[{"action":"search_products","method":"POST","path":"/agent/search","description":"Search products across all connected merchants in one request. Supports filters by category, price range, verification level, and trust score.","authentication":"required"},{"action":"get_product_detail","method":"GET","path":"/agent/products/{id}","description":"Retrieve full product data including structured policies, trust signals, and merchant operational data.","authentication":"required"},{"action":"compare_products","method":"POST","path":"/agent/compare","description":"Side-by-side comparison of multiple products with normalised data, price range, and best trust score summary.","authentication":"required"},{"action":"check_availability","method":"GET","path":"/agent/availability/{id}","description":"Check real-time stock and price with freshness indicator (fresh < 1h, stale > 24h).","authentication":"required"},{"action":"create_cart","method":"POST","path":"/agent/cart","description":"Create a cart with stock validation and merchant grouping. Cart expires after 24 hours.","authentication":"required"},{"action":"complete_checkout","method":"POST","path":"/agent/checkout","description":"Complete checkout flow. Creates a per-merchant checkout session and returns checkout URLs. Does NOT process payments.","authentication":"required"},{"action":"get_merchant_profile","method":"GET","path":"/agent/merchants/{slug}","description":"Retrieve merchant profile with trust score, verification level, structured policies (return, shipping), and platform connectors.","authentication":"required"}],"authentication":{"type":"per_surface","matrix":{"discovery":{"endpoint":"POST /{storeSlug}/mcp/discovery","auth_mode":"anonymous","credential":"none"},"customer":{"endpoint":"POST /{storeSlug}/mcp/customer","auth_mode":"oauth_customer","credential":"OAuth 2.1 Bearer token bound to the customer"},"merchant_checkout":{"endpoint":"POST /{storeSlug}/mcp/checkout","environment":"real merchant","auth_mode":"agentic_trust","credential":"OAuth 2.1 Bearer token with agent client identity","api_key_accepted":false,"note":"Payment mandate and idempotency requirements depend on the tool; inspect tools/list."},"demo_checkout":{"endpoint":"POST /demo-store/mcp/checkout","environment":"synthetic demo","auth_mode":"sandbox_key","credential":"agnt_sandbox_ key in Authorization: Bearer or X-Agent-Api-Key","note":"The sandbox key is not an OAuth token and works only on demo-store."},"agent_rest":{"endpoint":"/api/v1/agent/*","auth_mode":"api_key","credential":"X-Agent-Api-Key","note":"This REST API is separate from merchant MCP. Its OAuth replacement is not registered as a working route; do not assume the MCP token works here."},"legacy_mcp":{"endpoint":"POST /{storeSlug}/mcp","auth_mode":"per_tool_deprecated","credential":"Inspect the selected tool and the response challenge; prefer the dedicated bucket."},"advertised_api_key_sunset":"2026-10-01","advertised_api_key_sunset_enforced":false,"advertised_api_key_sunset_note":"The policy advertises this date for its legacy fallback. It is not proof that every API-key route has an OAuth replacement or that keys cease working on that date."},"note":"Choose the row matching both the endpoint and environment. The API key header applies to Agent REST and the demo sandbox; real merchant MCP checkout uses OAuth."},"rateLimits":[{"tier":"STARTER","aliases":["FREE"],"aliasNote":"FREE is a backward-compatible alias for STARTER in the AgentApiKeyTier enum — same tier, same limit, both accepted.","requestsPerMinute":100,"notes":"Default for new keys"},{"tier":"GROWTH","requestsPerMinute":500,"notes":"Paid plan"},{"tier":"PRO","requestsPerMinute":2000,"notes":"Paid plan"},{"tier":"ENTERPRISE","requestsPerMinute":10000,"notes":"Custom SLA available; 10,000/min technical ceiling by default"}],"rateLimitHeaders":["X-RateLimit-Limit","X-RateLimit-Remaining","X-RateLimit-Reset"],"eligibilityRequirements":{"minimumVerificationLevel":"BASIC","minimumTrustScore":0.3,"description":"LISTING eligibility only. Merchants with BASIC+ verification and trustScore >= 0.3 appear in agent API results. This is not a licence to transact.","transactionFloorNote":"Being eligible is not being safe to transact with. /.well-known/agent-policy.json → failSafePolicy instructs agents not to initiate checkout below trustScore 0.5, which is HIGHER than this listing floor. A merchant in [0.3, 0.5) is legitimately listed here and legitimately off-limits there. The platform enforces the listing floor and does NOT enforce the transaction floor — no checkout path reads the merchant trust score, so that one is on the agent.","transactionFloor":0.5,"evaluationOrder":"https://trusteed.xyz/.well-known/agent-policy.json#failSafePolicy.evaluationOrder","thresholdSourceOfTruth":"packages/shared/src/trust/store-score-bands.ts — the same constants that drive search visibility and auto-suspension."},"trustFramework":{"description":"Every merchant has a trustScore (0.0–1.0 in API, 0–100 on dashboard) computed under algorithm v4.1. This is an agentic readiness score, not a consumer review rating. Score is recomputed live on every relevant state change. A separate, older 12-component breakdown (methodology 2.0, agent-policy.json's trustScoreInterpretation.components) is refreshed every 6 hours and served alongside v4.1 as additive detail — not the same figure, not the same schedule.","algorithmVersion":"4.1","scalingNote":"Agent API: 0.0–1.0 (score/100). Dashboard: 0–100 integer.","tiers":[{"name":"cold_start","cap":0.65,"condition":"No verified agent purchases (new store)","weights":{"agenticReadiness":1,"merchantReliabilityBase":0,"agenticEvidence":0}},{"name":"human_established","cap":0.85,"condition":"Human orders processed and delivered","weights":{"agenticReadiness":0.3,"merchantReliabilityBase":0.7,"agenticEvidence":0}},{"name":"agent_verified","cap":1,"condition":"Autonomous agent purchases verified","weights":{"agenticReadiness":0.25,"merchantReliabilityBase":0.35,"agenticEvidence":0.4}}],"agenticReadinessComponents":[{"name":"setup_quality","weight":0.55,"subcomponents":["price_accuracy(0.20)","availability_accuracy(0.20)","data_consistency(0.15)","catalog_completeness(0.25)","policy_coverage(0.20)"]},{"name":"protocol_security","weight":0.25,"description":"Ed25519 signing key active + rotated within 90d"},{"name":"compliance_health","weight":0.1,"description":"GDPR + PCI (payment method) + eIDAS circuit-breaker"},{"name":"integration_freshness","weight":0.1,"description":"Webhook sync < 72h + catalog completeness"}],"methodologyUrl":"https://trusteed.xyz/en/trust/methodology","trustScorePage":"https://trusteed.xyz/en/for-merchants/trusted-score"},"verificationLevels":[{"level":"UNVERIFIED","description":"No verification completed","issuable":true},{"level":"BASIC","description":"Email and domain control verified","issuable":true},{"level":"STANDARD","description":"Business review completed","issuable":true},{"level":"PREMIUM","description":"Business review plus stronger operational history requirements","issuable":true},{"level":"QUALIFIED","description":"Identity verified against official business registries (eIDAS QTSP). Highest level on this scale and NOT issuable today: the integration is code-complete but no QTSP is provisioned — /api/v1/health reports qtsp.enabled=false and no merchant has ever been verified through it. See trustReceipts.complianceMatrix.eIDAS_2_0.blockers.","issuable":false}],"highestIssuableVerificationLevel":"PREMIUM","merchantStatusStates":[{"status":"active","condition":"trustScore >= 0.5, not suspended","visibility":"Full visibility in agent API results"},{"status":"deprioritized","condition":"trustScore in [0.3, 0.5)","visibility":"Appears after all active merchants in ranked results (hard boundary)"},{"status":"hidden","condition":"trustScore in [0.2, 0.3)","visibility":"Excluded from agent API, visible only in merchant dashboard"},{"status":"suspended","condition":"trustScore < 0.2 or manually suspended","visibility":"Excluded everywhere"}],"ranking":{"formula":"relevanceScore = (text_relevance * 0.55) + (store_trust_score * 0.25) + (freshness * 0.10) + (in_stock * 0.10)","factors":{"text_relevance":{"range":"0.0-1.0","description":"Normalised sum of title match (1.0) + description match (0.5) + tag match (0.3), divided by 1.8"},"store_trust_score":{"range":"0.0-1.0","description":"Operational reliability score described in trustFramework"},"freshness":{"range":"0.0-1.0","tiers":{"< 1h":1,"< 6h":0.8,"< 24h":0.6,">= 24h":0.3,"null":0}},"in_stock":{"range":"0.0 or 1.0","description":"1.0 if inventoryQuantity > 0, otherwise 0.0"}},"deprioritizationBoundary":"Products from stores with trustScore < 0.5 (deprioritized: true) are placed after all active-store products regardless of their computed relevanceScore. This is a hard two-tier sort, not a tiebreaker. It changes POSITION in results, never the ability to buy — do not read it as a transaction gate."},"connectedPlatforms":[{"platform":"Shopify","status":"guided_beta","embed":true,"webhooks":true,"webhookDelivery":{"mechanism":"native_api","automatic":true,"events":["orders/*","fulfillments/*"],"note":"The connector registers the subscriptions itself via Shopify's `webhookSubscriptionCreate` mutation."}},{"platform":"WooCommerce","status":"guided_beta","embed":true,"webhooks":true,"webhookDelivery":{"mechanism":"native_api","automatic":true,"events":["order.created","order.updated","order.refunded"],"note":"The connector registers the subscriptions itself via the WooCommerce REST `/webhooks` endpoint, with a per-store HMAC secret."}},{"platform":"PrestaShop","status":"guided_beta","embed":true,"webhooks":true,"webhookDelivery":{"mechanism":"our_module_push","automatic":true,"events":["order.status_updated","order.slip_added"],"note":"PrestaShop has NO native webhooks — catalog sync is polling (1h delta, 24h full). Order events reach us because the Trusteed module registers PrestaShop hooks when installed."}},{"platform":"Odoo","status":"sandbox","embed":true,"webhooks":false,"webhookDelivery":{"mechanism":"manual_setup","automatic":false,"events":[],"note":"No native webhooks and nothing is registered for you: the merchant must build Automated Actions by hand in Odoo Studio. Until they do, no event reaches Trusteed and sync is polling only."},"note":"Connector and embedded panel built; in validation with pilot merchants, not open self-serve."},{"platform":"Magento","status":"guided_beta","embed":false,"webhooks":true,"webhookDelivery":{"mechanism":"our_module_push","automatic":true,"events":["order.placed","order.updated"],"note":"Magento has no native outbound webhooks: the Trusteed module pushes via Observer/Plugin once installed."},"note":"NLWeb endpoint + signed manifest + standalone TrustReceipt verifier (Magento Marketplace)"}],"connectedPlatformsLegend":{"guided_beta":"Integration is built and merchants are onboarded with assistance. Not open self-serve at scale.","sandbox":"Integration is built and reachable, validated with pilot merchants only."},"trustReceipts":{"description":"TrustReceipt is a cryptographically signed transaction evidence record (JWS Compact, Ed25519) attached to each agent-initiated purchase. Verifiable outside the platform.","schemaVersionActive":"1.0","schemaVersionPending":"1.1","v11FeatureFlag":"TRUST_RECEIPT_EIDAS_HARDENING_ENABLED (false in production)","signingAlgorithm":"Ed25519","issuerJwks":"https://api.trusteed.xyz/.well-known/jwks.json","verificationEndpoint":"GET /api/v1/trust/receipts/{receiptId}/verify","documentation":{"en":"https://trusteed.xyz/en/trust/trust-receipt","es":"https://trusteed.xyz/es/trust/trust-receipt"},"complianceMatrixNote":"Coverage percentages and tiers in this matrix are Trusteed's OWN estimates against the published requirements of each scheme. They are not the result of an external audit, certification or conformity assessment, and no accredited body has reviewed them. Treat them as a self-declared work-in-progress indicator, not as evidence of compliance.","complianceMatrix":{"eIDAS_2_0":{"status":"partial","assessment":"self-declared","assessedBy":"Trusteed (internal)","coverage_v10":"45-55%","coverage_v11_projected":"65-75%","coverageBasis":"Proportion of the eIDAS 2.0 requirements the team maps to an implemented receipt capability. Counted by hand against the requirement list; no external validation.","blockers":["QTSP contract pending","KMS terraform pending","canary not started"]},"ESIGN_UETA":{"status":"partial","note":"v1.1 is NOT active in production. Receipts are v1.0: basic evidence only. The disclosure hash, once v1.1 is enabled, proves the disclosure VERSION, not its content; no ESIGN/UETA consent evidence over specific content is claimed today."},"UK_DIATF":{"status":"partial","assessment":"self-declared","assessedBy":"Trusteed (internal)","tier":"Low Confidence (GPG 45 Level 1)","tierBasis":"Self-placed against the GPG 45 profile descriptions. Trusteed is NOT certified under DIATF and holds no trustmark; a DIATF tier is only conferred by a certified conformity assessment body.","note":"Level 2 requires DSIT-certified IDP, not yet pursued"}}},"agentRiskControls":{"description":"The platform applies anti-fraud and anti-abuse signals per checkout flow. Signal details are not exposed to protect integrity.","documentedAt":"https://trusteed.xyz/en/trust#agent-rules","playground":"https://trusteed.xyz/en/demo-store","playgroundTab":"agent-rules","playgroundDescription":"Interactive simulator: test 46 of the engine's 52 merchant rules and the KYAI policy engine against predefined agent profiles (conservative, aggressive, corporate, luxury, budget). No authentication required. Declared is not active: most rules are off in production and merchants start in observation mode.","merchantConfigurable":true,"configurableRules":["maximum_order_value","allowed_categories","require_confirmation_above_threshold"]},"dataNotice":{"isPaymentProcessor":false,"isMerchantOfRecord":false,"isLegalCertificationAuthority":false,"trustScoresAreGuarantees":false,"trustScoreDescription":"Trust scores and signals are decision-support tools, not guarantees of merchant quality."},"protocolDeclarations":{"acp":{"name":"Agent Commerce Protocol","version":"2026-01-30","spec":"https://github.com/agentic-commerce-protocol/agentic-commerce-protocol","discovery_url":"/.well-known/acp.json","status":"sandbox","environment":"sandbox","provider":"stripe","capabilities":{"inbound":true,"outbound":true,"settlement":"stripe","sandbox":true,"cart_persistence":true,"agent_session_resume":true,"display_context":["webview","headless"],"payment_handlers":["stripe","x402","paypal","ucp"]},"detectionMethod":"X-Protocol header or body shape","mcpTools":["create_cart","get_shipping_rates","select_shipping_option","apply_discount","preview_checkout","complete_checkout"],"documentation":"/en/for-agents"},"ap2":{"name":"Agent Payment Protocol v2","version":"0.1","spec":"https://ap2-protocol.org/specification/","status":"experimental","environment":"sandbox","provider":"google","capabilities":{"inbound":true,"outbound":true,"settlement":"cart-mandate","sandbox":true},"detectionMethod":"X-Protocol header or Cart Mandate body","mcpTools":["create_cart","complete_checkout"],"documentation":"/en/for-agents"},"x402":{"name":"x402 Stablecoin Protocol","version":"1.0","spec":"https://www.x402.org/","status":"sandbox","environment":"sandbox","network":"base-sepolia","settlement_evidence":"Test-only. Settles real on-chain USDC transfers on Base Sepolia (testnet, no real value), in the demonstration store only (Store.isDemo); the testnet is accepted only when X402_TESTNET_ENABLED is on and only for such stores. No x402 settlement with real value, on any network, is claimed. Do not read this field as today's state: the authoritative per-rail state and verification date is the signed registry at /.well-known/trusteed-capabilities.json.","provider":"coinbase","capabilities":{"inbound":true,"outbound":true,"settlement":"USDC-on-chain","sandbox":true},"detectionMethod":"PAYMENT-SIGNATURE or X-PAYMENT header","currency":"USDC","mcpTools":["create_cart","complete_checkout"],"documentation":"/en/for-agents"},"ucp":{"name":"Universal Commerce Protocol","version":"2026-08-25","spec":"/.well-known/ucp","status":"active","environment":"production","settlementEnvironment":"none","settlesTransactions":false,"provider":"trusteed","capabilities":{"inbound":true,"outbound":false,"settlement":"protocol-bridge","sandbox":false,"settlementNote":"The six checkout tools are served in production. No UCP transaction has been settled: the payment leg does not complete. See /.well-known/trusteed-capabilities.json → ucp."},"detectionMethod":"UCP discovery endpoint","mcpTools":["ucp_add_items_to_checkout","ucp_cancel_checkout","ucp_complete_checkout","ucp_create_checkout","ucp_get_checkout","ucp_update_checkout"],"mcpToolsRequiringStoreFlag":["ucp_get_catalog"],"mcpToolsNote":"mcpTools are exposed by any store with UCP enabled. mcpToolsRequiringStoreFlag additionally depend on a per-store flag, so a given merchant may not expose them — call tools/list and read the answer.","documentation":"/en/for-agents"},"ag_ui":{"name":"AG-UI (Agent-User Interaction Protocol)","version":"0.0.48","author":"CopilotKit","spec":"https://docs.ag-ui.com","documentationUrl":"/en/for-agents","status":"production","environment":"production","operator":"trusteed","type":"UI/Communication Protocol","transport":"Server-Sent Events (SSE)","capabilities":{"inbound":true,"outbound":false,"streaming":true,"humanInTheLoop":true,"stateSync":"RFC 6902 JSON Patch"},"verification":{"capabilityRegistry":"/.well-known/trusteed-capabilities.json","capabilityId":"agui","note":"State, evidence and public claim ceiling for this rail are published in the signed capability registry. Internal test counts are not published: a third party cannot verify them, so they are not evidence."},"detectionMethod":"AG-UI endpoint POST /{storeSlug}/ag-ui","endpoint":"/{storeSlug}/ag-ui","confirmationEndpoint":"/{storeSlug}/ag-ui/confirm","confirmationMechanism":"HMAC-SHA256 token (5-minute window)","supportedEvents":12,"mcpTools":["search_products","get_product_details","browse_categories","get_merchant_profile","create_cart","apply_discount","preview_checkout","complete_checkout"],"documentation":"/en/for-agents"},"mcp_server":{"name":"Model Context Protocol","version":"2025-11-25","server_card":"/.well-known/mcp.json","sdk_version":"1.29.0","status":"production","environment":"production","transport":"streamable-http","endpoint_template":"https://trusteed.xyz/{storeSlug}/mcp","endpoint_template_note":"endpoint_template always renders the canonical domain. It is a fallback, not an address: a merchant homed on another deployment answers on its own host. Resolve a slug by reading that merchant's mcp_endpoint (and mcp_endpoints_by_bucket) in /.well-known/merchant-index.json, which carries the real host per row; use this template only when the merchant is not listed there. A 'Store not found' from the canonical domain does not mean the merchant does not exist — it may mean it is not homed here."},"a2a":{"name":"Agent-to-Agent Protocol","status":"production","environment":"production","provider":"trusteed","surface":"/.well-known/agent-card.json","scope":"discovery","note":"Discovery only: what is deployed is a public agent card. Publishing an agent card is not a checkout rail, and that any agent has consumed it cannot be claimed.","documentation":"/en/protocol-coverage"},"scp":{"name":"Shopper Context Protocol","status":"production","environment":"production","provider":"trusteed","governedByFlag":"SCP_ENABLED","flagDefault":"on","note":"GET /api/v1/scp-provider/{slug}/magic-link/preview → 400 (not 404) on demo-store AND agenticmcpstore (non-demo); routes registered in production, SCP_ENABLED is opt-out (on by default)","documentation":"/en/protocol-coverage"}},"recent_changes":["2.2 (2026-09-23): recent_changes now serves the 5 most recent entries plus a pointer to the full history at /.well-known/changelog.json, a new document that serves every discovery manifest's complete changelog keyed by its served path. Nothing is dropped and the field keeps its name and shape: it is a public contract and third-party readers cannot be enumerated or migrated. Measured before the change: 3.2 KB of history in a 27.0 KB document (11.2%), oldest entry from 2026-04-04. The same split was applied to agent-policy.json, where history was 15.1% of the document.","2.1 (2026-08-28): coherence audit remediation. UCP mcpTools now derived from the tool registry and split into mcpTools (always-on) and mcpToolsRequiringStoreFlag — the 2.0 fix below replaced three invented names with 'the six real ones' and got two of the six wrong: ucp_get_catalog needs a per-store flag and was declared unconditionally, and ucp_add_items_to_checkout is always-on and was missing. QUALIFIED verification level now carries issuable:false while no QTSP is provisioned, plus highestIssuableVerificationLevel — it was described as 'highest available assurance level' in the same document whose eIDAS_2_0.blockers say 'QTSP contract pending'. A2A and SCP are now declared: both were published as production on the human surfaces and absent here. Protocol versions now come from one source shared with /en/protocol-coverage, which published a different number for ACP, AP2, UCP and MCP. AG-UI internal test counts removed: a third party cannot verify them. generated_at is now the real generation timestamp instead of the content date padded to midnight.","2.0 (2026-08-19): x402 status corrected from production-ready to sandbox — the object contradicted itself (production-ready over environment:sandbox) and the settlement network is base-sepolia, a testnet; the ACP twin above had already received this fix. UCP mcpTools corrected: ucp_discover/ucp_checkout/ucp_status do not exist in the tool registry (ucp_checkout is a per-store flag alias, not a tool) and are replaced by the six real ucp_* tools. Single published state per rail now lives in one place and is enforced in CI.","1.9 (2026-06-11): Added platform.acpFeed (public ACP-compatible product feed + promotions, no auth) and identityLinking block (UCP Identity Linking, marked EXPERIMENTAL/guided-beta — loyalty checkout-discount is feature-flagged OFF and NOT generally available; do not rely on it as stable).","1.8 (2026-05-12): TrustReceipt public documentation page published at /en/trust/trust-receipt and /es/trust/trust-receipt — explains eIDAS-aligned, ESIGN/UETA and UK retained trust services law parameters; linked from agent-policy.json trustReceiptCompliance.documentation and agent-card.json trust-receipts.documentation."],"recent_changes_total":10,"recent_changes_archive":"https://trusteed.xyz/.well-known/changelog.json","recent_changes_note":"recent_changes carries the 5 most recent entries. The full history of every discovery manifest is served at /.well-known/changelog.json, keyed by document path. The field kept its name and shape on purpose: it is a public contract and third-party readers cannot be enumerated or migrated.","related_documents":{"agent_policy":"/.well-known/agent-policy.json","agent_trust_manifest":"/.well-known/agent-trust-manifest.json","agent_playbooks":"/.well-known/agent-playbooks.json","agent_pay":"/.well-known/agent-pay.json","agent_failsafe":"/.well-known/agent-failsafe.json","merchant_index":"/.well-known/merchant-index.json","mcp_server_card":"/.well-known/mcp.json","mcp_manifest":"/mcp.json","llms_txt":"/llms.txt","oauth_resource":"/.well-known/oauth-protected-resource/{storeSlug}/mcp"},"generated_at":"2026-10-07T06:05:21.870Z"}