Discovery

Before a quote, a mandate, a decision or a settlement has anything to act on, an agent has to find a seller and read what it offers. Merchants already publish machine-readable surfaces for exactly that. This takes a merchant origin, reads what is published, normalises it into one profile, records which surface every fact came from, and grades how much that self-description is worth.

Four reads, fixed

/llms.txt

Title, summary and the sections of links the merchant publishes for machine readers.

/.well-known/ucp

A capability manifest. Declared capability names and the version, as stated.

/.well-known/agent-card.json

The other manifest shape. Skill ids and the publisher's name for itself.

Nominated pages

Documents the caller names, scanned for Schema.org product and offer markup. The origin root by default.

That list does not grow at runtime, and nothing found in one read causes another. It is the difference between a read layer and a crawler, and it is also the bound that stops one hostile document turning into an unbounded request fan-out.

The grade, which is the point

Every fact here is self-reported. It is the lowest class on the evidence ladder and the weak tier on provenance, unconditionally, whatever the page looks like and whoever the merchant is. A merchant's own page, its own published file and its own manifest are the same party talking about itself over three channels. Nothing in the grade can climb.

TLS proves the bytes came from the host that answers for the name. It proves nothing about whether the price is real, whether the product exists, or whether the merchant will honour either.

Nothing here is verified. Every fact is what this seller published
about itself, read from its own surfaces. Prices are indicative only
and are not agreed: an agreed price comes from a quote against a live
session, not from a page.

What confidence actually measures

Internal consistency of the self-description, and nothing else. It moves on whether the merchant's several surfaces agree with each other and whether it published enough to check. Moderate needs two independent surfaces, a fact they state identically, TLS, and no off-origin links laundered into the self-description. Anything published at all is low. Nothing published is none.

There is deliberately no high. The fact that would justify it, a third party's word, an attestation, a settled transaction, is exactly the fact this layer cannot obtain.

Signals are held or not held, never scored. A weight would imply the parts trade off against each other, and they do not: an https origin does not compensate for a manifest that contradicts the page, it just means the contradiction arrived encrypted.

Every fact keeps its source

Capabilities and names are lists of sourced facts, not merged maps. Two surfaces that disagree both survive into the profile, sorted so neither reads as the winner, and the disagreement reaches the grade as a stated reason instead of being resolved by whichever read landed last. Every attempt is recorded including the ones that found nothing, because "we asked and it was not there" and "we never asked" are different facts about a merchant.

A discovered price is not an agreed price

A price is carried as an exact minor-unit amount or it is dropped with a note. It is never a float and never rounded. But exactness is not agreement: the status of a discovered price is indicative, always. The number a merchant is bound to comes from the commerce quote step against a live session. An agent that pays a discovered price has paid a figure nobody promised it.

Bounded against a hostile page

Every read is bounded, and all the ceilings are caller-settable because the right ceiling is a deployment question. All of them have defaults because a caller that forgets one must not thereby get an unbounded read of a stranger's server.

• 256 KiB per URL, enforced against the stream rather than against a declared length, because a lying or absent length is free. The body is only decoded once the ceiling has held, so an oversized document never reaches a parser.
• 5 seconds per fetch, raced as well as signalled: a fetch that honours the signal releases the socket, and one that ignores it still loses the race.
• 8 URLs per profile, spent and never refilled.
• 50 offers, 200 links, 50 sections, 20 markup blocks, 2,000 graph nodes, 12 levels of nesting, 500 characters of any free-text field.