Canonical vocabulary · 18 ResultStates
MCP / KYA Result States
Canonical ResultState vocabulary used by every ECZ-ID verifier, Action Envelope, and MCP/KYA doc. Eighteen states. FAILED_VERIFICATION is not used for missing proof — missing proof is NO_PUBLIC_RESOLVER_PROOF_FOUND.
Why a fixed state vocabulary
A verifier, an MCP server, an agent, and a relying party must all use the same words to describe what was observed. The 18 ResultStates below are the only words that ECZ-ID verifiers and Action Envelopes use. Granular details live in ReasonCodes.
The 18 canonical ResultStates
| State | Meaning | Reliance posture |
|---|---|---|
| RESOLVER_VERIFIABLE | Backend/Core observed control evidence and Resolver projects a current public proof for the exact ECZ-ID target. | Re-check before reliance. Backend remains final authority. |
| NO_PUBLIC_RESOLVER_PROOF_FOUND | No public Resolver proof was found for the target. This does not mean unsafe. Local policy decides. | Share resolver guidance. Local policy decides. |
| PARTIAL_PUBLIC_PROOF_FOUND | Some referenced bindings have public proof, others are missing. | Re-check before reliance. Local policy decides. |
| SETUP_REQUIRED | A binding or manifest reference is present but setup is incomplete; TrustOps setup is required by the operator. | Start setup in TrustOps if you operate the target. Share resolver guidance if you do not. |
| CHALLENGE_ISSUED | TrustOps issued a challenge to the operator. Awaiting publication. | Re-check before reliance. |
| OBSERVED | Backend observed at least one signal. Verification is incomplete. | Re-check before reliance. |
| DEGRADED | Some signals present, some missing or stale. | Local policy decides. Re-check before reliance. |
| MISMATCH | An observed value does not match the canonical record (for example manifest_hash_mismatch). | Do not infer safety. Local policy decides. |
| EXPIRED | Previous proof has lapsed. | Re-check before reliance. Start setup in TrustOps if you operate the target. |
| SUSPENDED | A lifecycle hold has been applied by the operator or by TrustOps. | Local policy decides. |
| REVOKED | The operator or registry revoked the binding. | Do not infer safety. Local policy decides. |
| NOT_APPLICABLE | The check does not apply to the target type. | Local policy decides. |
| UNSUPPORTED_TARGET | The target type is not supported by this verifier. | Local policy decides. |
| LEGACY_ALIAS_NOT_ACTIVE_SKU | The reference points at a legacy SKU alias that is no longer an active sellable product. Refer the operator to the current canonical SKU registry in TrustOps. | Refer the operator to the current canonical SKU in TrustOps. |
| REJECTED_PRODUCT_NOT_SELLABLE | The reference points at a product proposal that was rejected and is not sellable. | Do not promise checkout. Share resolver guidance only. |
| DEFERRED_PRODUCT_NOT_SELLABLE | The reference points at a deferred product that is not sellable as a live product. | Do not promise checkout. Share resolver guidance only. |
| PARENT_UPGRADE_REQUIRED | The requested binding or package requires the parent ECZ-ID at a higher tier. | Start setup in TrustOps to upgrade the parent tier. |
| UNKNOWN_PHASE1_SKU | The reference cites a Phase 1 SKU that is unknown to the canonical product registry. | Refer the operator to the current canonical SKU in TrustOps. |
Missing proof is not failure
FAILED_VERIFICATION is not a canonical ResultState for missing proof. Missing public Resolver proof is reported as NO_PUBLIC_RESOLVER_PROOF_FOUND. This does not mean unsafe. Re-check before reliance. Local policy decides.
No overclaim posture
- No public resolver proof found yet does not mean unsafe.
- Re-check before reliance.
- Local policy decides.
- The verifier does not create or change verification state.
ECZ-ID separates setup, verification state, and public proof so operators can prepare evidence and relying parties can re-check before they act. TrustOps handles setup. Resolver remains the public proof surface. The verifier does not create or change verification state. Start setup in TrustOps when you operate the target. Share resolver guidance when you do not. Local policy decides. Re-check before reliance.