Discovery only · Resolver is proof
Manifest & Discovery Surfaces
Manifests are discovery only. They help relying parties find an Agent Credential or API Passport reference. They are not proof.
Manifest role: discovery only
A manifest declares where to look for an Agent Credential or API Passport. It does not assert current state. Relying parties must always confirm current proof in Resolver.
Supported discovery surfaces
- /.well-known/ecz-agent.json on the operator origin
- Optional HTTP response headers that reference the manifest URL and resolver URL
- Repository or package metadata that points to the manifest URL
- OpenAPI documents using the x-ecz-id, x-ecz-api-passport, and x-ecz-agent-credential extensions
What a manifest can say
- Operator ECZ-ID reference
- Agent Credential or API Passport identifier
- Declared logical scope
- Declared API dependencies
- Manifest URL and Resolver URL pointers
What a manifest cannot prove
- Whether the credential is currently authorised
- Whether the operator is currently in good standing
- Whether the dependency relationship is currently valid
- Whether the agent is approved for any platform, marketplace, or use case
Stale, copied, or modified manifests
Manifests can be copied to other origins, frozen at an old state, or edited locally. None of those operations transfer trust. Copied JSON does not copy trust. Current proof must be checked in Resolver.
ECZ-ID separates setup, verification state, and public proof. Developer Gateway documents setup paths and verifier guidance. TrustOps handles setup. Resolver remains the public proof surface. Re-check before reliance. Local policy decides.