chore: 1.5.0 release with neutral spec-framing copy

CLAUDE.md

@@ -45,7 +45,7 @@ Peer-dep pattern: payment/x402/mppx/stripe modules import lazily at runtime; ven
 | `variable_cost_merchant.py` | Pay-per-actual-usage on **two protocols**: x402 upto (Permit2 + Settlement-Overrides) AND MPP tempo session (channel + SSE + mid-stream vouchers) |
 | `compliance_merchant.py` | Regulated-goods merchant: full compliance gate + custom `on_denied` composing the denial helpers (`verification_agent_instructions`, `is_fixable_denial`, `build_signer_mismatch_body`, `build_contact_support_next_steps`, `denial_reason_to_body`/`denial_reason_status`) |
 | `per_product_policy_merchant.py` | Multi-product merchant where each row carries its own compliance policy. One product hard-gates KYC + age + state; another is anonymous; a third uses `enforcement="soft"` (request KYC but don't block sale). Demonstrates `PolicyBlock`, `build_gate_from_policy`, `run_gate_with_enforcement`, `shipping_country_allowed`, `shipping_state_allowed`. |
-| `signed_ucp_merchant.py` | Signed UCP profile (`/.well-known/ucp`) + JWKS endpoint (`/.well-known/jwks.json`). AgentScore's `agentscore-profile+jws` is a vendor extension on top of UCP for trust-mode verifiers (Visa AP2 pilots, regulated-commerce verifiers) that opt into auditable cryptographic provenance — UCP §6 itself does NOT mandate signing; Pura Vida and other Shopify-backed UCP merchants ship unsigned in production. Wires ephemeral-for-dev / env-JWK-for-prod signing, kid rotation, and `Cache-Control` posture. Uses `generate_ucp_signing_key`, `sign_ucp_profile`, `build_jwks_response`, `UCPSigningKey.from_jwk`, `UCPVerificationError`. |
+| `signed_ucp_merchant.py` | Signed UCP profile (`/.well-known/ucp`) + JWKS endpoint (`/.well-known/jwks.json`). AgentScore's `agentscore-profile+jws` is a vendor extension on top of UCP for trust-mode verifiers (regulated-commerce, AP2-aware) that opt into auditable cryptographic provenance — UCP §6 itself does NOT mandate signing; production UCP merchants commonly ship unsigned. Wires ephemeral-for-dev / env-JWK-for-prod signing, kid rotation, and `Cache-Control` posture. Uses `generate_ucp_signing_key`, `sign_ucp_profile`, `build_jwks_response`, `UCPSigningKey.from_jwk`, `UCPVerificationError`. |
 
 ## Identity model
 

README.md

@@ -200,8 +200,7 @@ card = build_a2a_agent_card(name="My Service", url=base_url, capabilities=A2AAge
 # Output shape: {"ucp": {"version", "services", "capabilities",
 # "payment_handlers", "name?", "supported_versions?"}, "signing_keys": [...]}
 # — services / capabilities / payment_handlers are MAPS keyed by reverse-DNS
-# service / capability / handler name. Verified against the live Pura Vida
-# reference at puravidabracelets.com/.well-known/ucp.
+# service / capability / handler name (UCP spec §3 + §6).
 profile = build_ucp_profile(
     name="My Service",
     services={
@@ -231,7 +230,7 @@ profile = build_ucp_profile(
 )
 ```
 
-UCP §6 doesn't mandate profile-body JWS signing — Pura Vida and other Shopify-backed UCP merchants ship unsigned. AgentScore's `agentscore-profile+jws` is a vendor extension for trust-mode verifiers (Visa AP2 pilots, regulated-commerce verifiers) that opt into auditable profiles. Sign + verify via the optional `joserfc` extra (tested against joserfc v1.x; pin `joserfc>=1.0.0,<2`):
+UCP §6 doesn't mandate profile-body JWS signing; production UCP merchants commonly ship unsigned. AgentScore's `agentscore-profile+jws` is a vendor extension for trust-mode verifiers (regulated-commerce, AP2-aware) that opt into auditable profiles. Sign + verify via the optional `joserfc` extra (tested against joserfc v1.x; pin `joserfc>=1.0.0,<2`):
 
 ```bash
 pip install agentscore-commerce[ucp]

agentscore_commerce/identity/ucp.py

@@ -3,8 +3,7 @@
 Compose the JSON payload published at ``/.well-known/ucp`` per the UCP spec. Output
 shape matches the spec example: top-level ``{"ucp": {...}, "signing_keys": [...]}``
 envelope, with ``services`` / ``capabilities`` / ``payment_handlers`` as MAPS keyed by
-reverse-DNS name. Verified against the live production reference at
-``https://puravidabracelets.com/.well-known/ucp`` (Shopify's UCP integration).
+reverse-DNS name (UCP spec §3 + §6).
 
 AgentScore identity claims layer over UCP via the ``sh.agentscore.identity`` capability
 (vendor-namespaced; UCP doesn't define KYC/sanctions/age/jurisdiction natively).

examples/signed_ucp_merchant.py

@@ -1,12 +1,11 @@
 """Signed UCP profile example — ``/.well-known/ucp`` + ``/.well-known/jwks.json``.
 
 AgentScore's ``agentscore-profile+jws`` is a vendor extension layered on top of
-the UCP profile for trust-mode verifiers (Visa AP2 pilots, regulated-commerce
-verifiers) that opt into auditable cryptographic provenance. UCP §6 itself does
-NOT mandate profile-body signing — Pura Vida and other Shopify-backed UCP
-merchants ship unsigned in production today, and live UCP-aware agents (Google
-AI Mode, Gemini commerce, Microsoft Copilot, Perplexity) accept unsigned
-profiles. This example wires both routes against a persistent signing key
+the UCP profile for trust-mode verifiers (regulated-commerce, AP2-aware) that
+opt into auditable cryptographic provenance. UCP §6 itself does NOT mandate
+profile-body signing; production UCP merchants commonly ship unsigned, and
+vanilla UCP-aware agents read the canonical body and ignore the ``signature``
+field. This example wires both routes against a persistent signing key
 (env-loaded for prod, ephemeral for dev) for verifiers that DO opt into the
 signed envelope.
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "1.4.0"
+version = "1.5.0"
 description = "Agent commerce SDK for Python — identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agent commerce."
 readme = "README.md"
 license = "MIT"