{"service":"MarketNow Universal Trust API","version":"1.0.0","uts_version":"2.0.0","uta_version":"1.0.0","description":"UTA (Universal Trust Adapter) — The USB-C of Agent Trust. 12-stage fail-closed pipeline, 8 credential formats, real cryptographic verification.","architecture":"Universal Trust Schema (UTS) v2 as IR. 12-stage verification pipeline. 8 adapters. O(N) complexity.","pipeline":"12 stages: PARSE → DETECT → SCHEMA → CRYPTO → ISSUER → KEY_BINDING → POP → PROVENANCE → LIFECYCLE → EVIDENCE → POLICY → DECISION","golden_rule":"UNKNOWN = DENY, ERROR = DENY, EXPIRED = DENY, REVOKED = DENY","formats_available":[{"id":"atc-v3","name":"Agent Trust Card v3","version":"3.0.0","status":"stable","algorithm":"Ed25519 (RFC 8032)"},{"id":"jwt","name":"JWT (OAuth/OIDC)","version":"RFC 7519","status":"stable","algorithm":"RS256 / ES256 / EdDSA"},{"id":"w3c-vc","name":"W3C Verifiable Credential","version":"2.0","status":"stable","algorithm":"Ed25519Signature2020"},{"id":"a2a-card","name":"Google A2A Agent Card","version":"1.0","status":"stable","algorithm":"Ed25519Signature2020"},{"id":"eat-ai","name":"IETF EAT-AI (CWT/COSE)","version":"draft-00","status":"beta","algorithm":"EdDSA / ES256 / RS256"},{"id":"zta","name":"Anthropic ZTA","version":"1.0","status":"beta","algorithm":"Ed25519 + UTA-ZTA-CARD domain"},{"id":"mcp-card","name":"MCP Server Card","version":"1.0","status":"stable","algorithm":"Ed25519 + UTA-MCP-CARD domain"},{"id":"x509","name":"X.509 Certificate","version":"3","status":"stable","algorithm":"RSA / ECDSA / Ed25519"}],"cryptographic_features":{"signing":"Ed25519 (RFC 8032) — 64-byte signatures, ~100μs verify","canonicalization":"RFC 8785 JCS — deterministic JSON serialization","domain_separation":"7 distinct domains prevent cross-context signature reuse","pop":"Proof-of-Possession with 32-byte nonce, single-use (anti-replay)","multi_sig":"N-of-M quorum with required_key_ids policy","post_quantum":"ML-DSA-65 (FIPS 204) abstraction + hybrid mode ready","revocation":"CRL + OCSP responder + Bitstring Status List (W3C 2021)","audit":"Signed action receipts + Merkle audit log (tamper-evident)"},"endpoints":{"verify":"POST /api/trust?action=verify — auto-detect + verify any format","translate":"POST /api/trust?action=translate — translate payload from format X to Y","issue":"POST /api/trust?action=issue — issue credentials in multiple formats","bridge":"POST /api/trust?action=bridge — verify in ecosystem A, issue in B","formats":"GET /api/trust?action=formats — list all 8 supported formats","pipeline":"GET /api/trust?action=pipeline — list 12 pipeline stages","revocation":"GET /api/trust?action=revocation — list revocation methods"},"stats":{"tests_passing":"480+ (Node.js) + 16 (Python SDK)","performance":"6,744 verifications/sec (1.8x overhead vs raw Ed25519)","npm_packages":"20+ packages (@marketnow/trust-*)","language_sdks":"TypeScript, Python, Rust, Go","test_vectors":"36 (8 positive + 17 negative + 5 mutation + 6 cross-language)","fuzz_iterations":"400 (0 crashes)","property_tests":"23 mathematical properties verified"},"supply_chain":{"sbom":"SPDX 2.3 generated per package","slsa":"Build Level 3 (slsa-github-generator)","sigstore":"Keyless signing (Fulcio + Rekor via cosign)","npm_provenance":"npm publish --provenance attestation"},"deployment":{"docker":"Multi-stage build, Node 20 slim, non-root user","kubernetes":"Helm chart with HPA (2-10 replicas)","ci_cd":"GitHub Actions: build → test → SBOM → SLSA → Sigstore → publish","cli":"uta-verify command (7 formats, auto-detect)","dashboard":"Web UI for metrics, receipts, and verification"},"compliance":{"soc2":"11 Trust Services Criteria mapped","iso27001":"13 Annex A Controls mapped","nist_csf":"5 Functions (Identify, Protect, Detect, Respond, Recover)","threat_model":"STRIDE + MITRE ATLAS (35 mitigations, 10 AI techniques)"},"license":"AL-1.0 (AliceLabs Source-Available License v1.0)","built_by":"AliceLabs LLC — Edison Flores & Alejandro Flores"}