From c704ec8831e63c57a0b3067ed51c80694ad516a6 Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Sun, 10 May 2026 13:10:35 -0700 Subject: [PATCH 1/2] chore(docs): drop named-vendor references from user-facing copy User-facing docs/READMEs/CLAUDE.md/example docstrings carried named-vendor references that didn't belong in published copy: a specific UCP merchant brand cited as the "live reference profile" for shape verification, and named payment-network/processor pilots in the trust-mode framing. Replaced with neutral spec-language: "production UCP merchants commonly ship unsigned" and "trust-mode verifiers (regulated-commerce, AP2-aware)". The technical content (envelope shape, signing posture, capability extension model) is unchanged. Patch bump 1.4.0 -> 1.4.1 since the package README ships to PyPI. Co-Authored-By: Claude Opus 4.7 (1M context) --- CLAUDE.md | 2 +- README.md | 5 ++--- agentscore_commerce/identity/ucp.py | 3 +-- examples/signed_ucp_merchant.py | 11 +++++------ 4 files changed, 9 insertions(+), 12 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index e3907c2..047bec4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -45,7 +45,7 @@ Peer-dep pattern: payment/x402/mppx/stripe modules import lazily at runtime; ven | `variable_cost_merchant.py` | Pay-per-actual-usage on **two protocols**: x402 upto (Permit2 + Settlement-Overrides) AND MPP tempo session (channel + SSE + mid-stream vouchers) | | `compliance_merchant.py` | Regulated-goods merchant: full compliance gate + custom `on_denied` composing the denial helpers (`verification_agent_instructions`, `is_fixable_denial`, `build_signer_mismatch_body`, `build_contact_support_next_steps`, `denial_reason_to_body`/`denial_reason_status`) | | `per_product_policy_merchant.py` | Multi-product merchant where each row carries its own compliance policy. One product hard-gates KYC + age + state; another is anonymous; a third uses `enforcement="soft"` (request KYC but don't block sale). Demonstrates `PolicyBlock`, `build_gate_from_policy`, `run_gate_with_enforcement`, `shipping_country_allowed`, `shipping_state_allowed`. | -| `signed_ucp_merchant.py` | Signed UCP profile (`/.well-known/ucp`) + JWKS endpoint (`/.well-known/jwks.json`). AgentScore's `agentscore-profile+jws` is a vendor extension on top of UCP for trust-mode verifiers (Visa AP2 pilots, regulated-commerce verifiers) that opt into auditable cryptographic provenance — UCP §6 itself does NOT mandate signing; Pura Vida and other Shopify-backed UCP merchants ship unsigned in production. Wires ephemeral-for-dev / env-JWK-for-prod signing, kid rotation, and `Cache-Control` posture. Uses `generate_ucp_signing_key`, `sign_ucp_profile`, `build_jwks_response`, `UCPSigningKey.from_jwk`, `UCPVerificationError`. | +| `signed_ucp_merchant.py` | Signed UCP profile (`/.well-known/ucp`) + JWKS endpoint (`/.well-known/jwks.json`). AgentScore's `agentscore-profile+jws` is a vendor extension on top of UCP for trust-mode verifiers (regulated-commerce, AP2-aware) that opt into auditable cryptographic provenance — UCP §6 itself does NOT mandate signing; production UCP merchants commonly ship unsigned. Wires ephemeral-for-dev / env-JWK-for-prod signing, kid rotation, and `Cache-Control` posture. Uses `generate_ucp_signing_key`, `sign_ucp_profile`, `build_jwks_response`, `UCPSigningKey.from_jwk`, `UCPVerificationError`. | ## Identity model diff --git a/README.md b/README.md index a3e7d4a..dba6fef 100644 --- a/README.md +++ b/README.md @@ -200,8 +200,7 @@ card = build_a2a_agent_card(name="My Service", url=base_url, capabilities=A2AAge # Output shape: {"ucp": {"version", "services", "capabilities", # "payment_handlers", "name?", "supported_versions?"}, "signing_keys": [...]} # — services / capabilities / payment_handlers are MAPS keyed by reverse-DNS -# service / capability / handler name. Verified against the live Pura Vida -# reference at puravidabracelets.com/.well-known/ucp. +# service / capability / handler name (UCP spec §3 + §6). profile = build_ucp_profile( name="My Service", services={ @@ -231,7 +230,7 @@ profile = build_ucp_profile( ) ``` -UCP §6 doesn't mandate profile-body JWS signing — Pura Vida and other Shopify-backed UCP merchants ship unsigned. AgentScore's `agentscore-profile+jws` is a vendor extension for trust-mode verifiers (Visa AP2 pilots, regulated-commerce verifiers) that opt into auditable profiles. Sign + verify via the optional `joserfc` extra (tested against joserfc v1.x; pin `joserfc>=1.0.0,<2`): +UCP §6 doesn't mandate profile-body JWS signing; production UCP merchants commonly ship unsigned. AgentScore's `agentscore-profile+jws` is a vendor extension for trust-mode verifiers (regulated-commerce, AP2-aware) that opt into auditable profiles. Sign + verify via the optional `joserfc` extra (tested against joserfc v1.x; pin `joserfc>=1.0.0,<2`): ```bash pip install agentscore-commerce[ucp] diff --git a/agentscore_commerce/identity/ucp.py b/agentscore_commerce/identity/ucp.py index d63f765..a9566d8 100644 --- a/agentscore_commerce/identity/ucp.py +++ b/agentscore_commerce/identity/ucp.py @@ -3,8 +3,7 @@ Compose the JSON payload published at ``/.well-known/ucp`` per the UCP spec. Output shape matches the spec example: top-level ``{"ucp": {...}, "signing_keys": [...]}`` envelope, with ``services`` / ``capabilities`` / ``payment_handlers`` as MAPS keyed by -reverse-DNS name. Verified against the live production reference at -``https://puravidabracelets.com/.well-known/ucp`` (Shopify's UCP integration). +reverse-DNS name (UCP spec §3 + §6). AgentScore identity claims layer over UCP via the ``sh.agentscore.identity`` capability (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively). diff --git a/examples/signed_ucp_merchant.py b/examples/signed_ucp_merchant.py index 6a53811..79b5d93 100644 --- a/examples/signed_ucp_merchant.py +++ b/examples/signed_ucp_merchant.py @@ -1,12 +1,11 @@ """Signed UCP profile example — ``/.well-known/ucp`` + ``/.well-known/jwks.json``. AgentScore's ``agentscore-profile+jws`` is a vendor extension layered on top of -the UCP profile for trust-mode verifiers (Visa AP2 pilots, regulated-commerce -verifiers) that opt into auditable cryptographic provenance. UCP §6 itself does -NOT mandate profile-body signing — Pura Vida and other Shopify-backed UCP -merchants ship unsigned in production today, and live UCP-aware agents (Google -AI Mode, Gemini commerce, Microsoft Copilot, Perplexity) accept unsigned -profiles. This example wires both routes against a persistent signing key +the UCP profile for trust-mode verifiers (regulated-commerce, AP2-aware) that +opt into auditable cryptographic provenance. UCP §6 itself does NOT mandate +profile-body signing; production UCP merchants commonly ship unsigned, and +vanilla UCP-aware agents read the canonical body and ignore the ``signature`` +field. This example wires both routes against a persistent signing key (env-loaded for prod, ephemeral for dev) for verifiers that DO opt into the signed envelope. From 97f6cd989e1896d635ca08509bfa00dd1c1fb861 Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Sun, 10 May 2026 13:12:13 -0700 Subject: [PATCH 2/2] chore: bump version 1.4.0 -> 1.5.0 to match node-commerce Aligns the python and node SDK versions; both ship the same UCP feature surface (spec-compliant profile shape, A2A extension support, supported versions advertisement). Co-Authored-By: Claude Opus 4.7 (1M context) --- pyproject.toml | 2 +- uv.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index b3cb966..0140f83 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "agentscore-commerce" -version = "1.4.0" +version = "1.5.0" description = "Agent commerce SDK for Python — identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agent commerce." readme = "README.md" license = "MIT" diff --git a/uv.lock b/uv.lock index 5a54e95..8c461b9 100644 --- a/uv.lock +++ b/uv.lock @@ -10,7 +10,7 @@ resolution-markers = [ [[package]] name = "agentscore-commerce" -version = "1.4.0" +version = "1.5.0" source = { editable = "." } dependencies = [ { name = "agentscore-py" },