Everything this origin serves to a machine.
12 documents and 8 JSON Schemas, each with what it is for and what it does not assert. Read-only, no key, no account, no telemetry.
None of these documents is proof, and none of them carries state. They describe and they route. Current state lives in the Resolver and must be read there, live, every time it matters.
Discovery
Route guide for language models
The readable map of this site, its role boundaries, and the inferences a reader is forbidden to draw from anything here.
Sitemap
Generated after every build by walking the exported routes, so it cannot describe a page that was not shipped.
Compact actions
The small set of things a machine can usefully do from here, each with its destination surface.
Developer Gateway index
The machine index of this surface: role split, the V5 information architecture, the Accountability Chain, production status, and the machine-readable endpoints.
Surface declaration
What this origin is, what it will not do, and where its canonical interface and manifest live.
Binding declarations
MCP binding declaration
The operator ECZ-ID behind the first-party Trust MCP server, its registry name, endpoint and public tools. A pointer to the record, never the record.
Agent declaration
States plainly that this origin is a static export and not an agent, and names the operator responsible for it.
AI catalog entry
The server card for the first-party Trust MCP, for catalogues that read this format.
Schemas
Schema index
Every Action Envelope Stack schema, with its role and its example instances.
Acquisition routing manifest
A read-only routing projection of priced products. It creates no checkout and no entitlement. For which families are free and open, read the live acquisition contract in TrustOps instead.
Worked examples
First-party interoperability example
One real operator record, one real MCP registry binding, and the reciprocal-reliance shape that relates two independently operated machines. Every URL in it resolves.
Action Envelope Stack schemas
JSON Schema 2020-12. These describe metadata only. Nothing validated against them changes verification state, activates public proof, processes a purchase or implies certification.
- /schemas/action-envelopes/agent-action-envelope.schema.json
- /schemas/action-envelopes/ap2-ucp-readiness.schema.json
- /schemas/action-envelopes/mcp-action-envelope.schema.json
- /schemas/action-envelopes/reciprocal-reliance-envelope.schema.json
- /schemas/action-envelopes/request-to-resolve.schema.json
- /schemas/action-envelopes/resolver-action-envelope.schema.json
- /schemas/action-envelopes/resolver-recheck-contract.schema.json
- /schemas/action-envelopes/trustops-product-action-manifest.schema.json
Surfaces that are not this one
Three endpoints a machine will want and this origin deliberately does not serve. They belong to the surfaces that own them.
https://api.ecocitizenz.com/api/p/{ecz_id}.json
The public machine record
The one to automate against. 200 with the record, 404 when none exists, 429 or 503 when it cannot be read — and unreadable is not absent.
https://resolver.ecocitizenz.org/p/{ecz_id}
The public human record
Client-rendered, for people. Link to it; do not scrape it.
https://trustops.ecocitizenz.com/api/v1/acquisition/families
The acquisition contract
Which Passport families are free and open, read live. Never hard-code the list; availability changes with no release on either side.
