Evidence

The public scorecard

No vendor publishes this. Here is exactly what's real, what's specified, and what's still paper — graded row by row against a reference architecture for a merchant reasoning layer, with a file path or test suite behind every checkmark.

Verified 2026-07-04 · Open specs · Adoption guide · Conformance scoreboard

328/328Automated tests passing13 test suites, npx vitest run — verified 2026-07-04.

CleanTypeScriptnpx tsc --noEmit exits with zero errors.

93.8%Line coverage (rules engine scope)Statements 92.8% · Branches 89.18% · Functions 82.25% · Lines 93.8% — measured over src/lib/rules only, per vitest.config.ts.

PassingProduction buildnpm run build — 24 routes generated successfully (Next.js 16.2.6, Turbopack).

ESM + CJS@retailagentos/engine smoke-tested externallyInstalled as a tarball into a throwaway project outside this repo; both entry points resolve and run.

How to read the status column

Built & tested: Code exists, is exercised by an automated test, and is part of the 328/328 passing suite.
Partially built: Some of the surface is real and tested; the rest is still a gap called out below.
Specified / designed only: A spec or interface exists on paper. No implementation code backs it yet.
Planned, not designed in depth: On the roadmap. Not yet speced out, let alone built.
Explicit non-goal (for now): Deliberately out of scope for the current demo/reference phase — not an oversight.

Discovery & negotiation

Discovery manifest (/.well-known/ucp, tier + capabilities[])

Built & tested

Real Next.js route handler with tests; locked split-axis tier model. Data behind it is mock.

src/app/.well-known/ucp/route.tssrc/app/.well-known/ucp/route.test.ts · route test suite

Capability negotiation enforced at runtime

Built & tested

registry.manifestSubset() is load-bearing: an absent capability produces a documented, tested degraded result — not a crash.

src/lib/extensions/registry.tssrc/lib/extensions/__tests__/registry.test.ts · registry test suite

Canonical context & identity

Canonical buyer context

Built & tested

BuyerContext models loyaltyTier, trust.mode, activeExtensions; a prior modeling bug in activeExtensions has been removed.

src/lib/types/context.ts

Most-restrictive normalization + trust downgrade

Built & tested

Asserted privilege claims are downgraded for transaction-gating stages, per RAOS-0000 §7.2.

src/lib/rules/normalizeBuyerContext.tssrc/lib/rules/__tests__/normalizeBuyerContext.test.ts · normalization test suite

Real identity/consent/PII model (RAOS-0015)

Specified / designed only

Still spec’d only (WP-15, unstarted); interface designed, nothing built. Buyer token verification is simulated by decision (see f2).

Decision pipeline

Extension contract (UcpExtension: namespace@semver, stage, priority, pure evaluate)

Built & tested

Matches ARCH-UCP-EXTENSION-MCP.md §3.2.

src/lib/extensions/contract.ts

Registry + staged pipeline + fault isolation + now injection

Built & tested

A throwing evaluator degrades (BLOCK for safety stages) without crashing the pipeline — tested.

src/lib/extensions/registry.tssrc/lib/extensions/pipeline.tssrc/lib/extensions/__tests__/pipeline.test.ts · pipeline test suite

Determinism guarantee

Built & tested

Golden fixtures enforce: no Date.now/Math.random/IO in rules code; same inputs → byte-identical DecisionRecord.

src/lib/rules/__tests__/golden.test.ts · golden-fixture test suite

Decision vocabulary & explainability

Uniform reason vocabulary (ReasonEntry: code, severity, source, requirements)

Built & tested

blocking is deprecated with a migration path; status is derived, not authored.

src/lib/types/reasons.ts

Decision substrate for explainability (DecisionRecord)

Built & tested

Folded by the pipeline: ordered reasons with per-stage attribution.

src/lib/extensions/pipeline.ts

Per-audience trace renderings (merchant ops / buyer / developer JSON)

Built & testedREFRESHED — was designed only

WP-08 shipped: renderBuyerTrace / renderMerchantTrace / renderDeveloperTrace all exist, tested, and exported from the engine package.

src/lib/trace/derive.tssrc/lib/trace/render.tssrc/lib/trace/types.tssrc/lib/trace/__tests__/trace.test.ts · trace test suite

Domain semantics

Eligibility & visibility semantics (RAOS-0001)

Built & tested

Published Draft·RFC v1.1.0 with a reference implementation, a spec page, and every reason code fixture-covered. The flagship spec.

specs/0001-eligibility.mdsrc/lib/rules/__tests__/behaviors.test.ts · behaviors test suite

Contextual pricing — member/bulk/MOQ (RAOS-0002)

Built & testedREFRESHED — was partial

AppliedOffer / suppressedOffers shape landed and is the frozen contract RAOS-0006/0007 bind to.

specs/0002-contextual-pricing.mdsrc/lib/rules/pricing.tssrc/lib/rules/__tests__/pricing.test.ts · pricing test suite

Promo stacking ladder (RAOS-0006)

Specified / designed onlycorrected downward, not upgraded

Still unbuilt — no promos.ts exists and specs/0006-promo-stacking.md is not written. Fully designed (priority ladder + stackable/exclusive locked), zero code. The single biggest commercial-differentiation gap on this scorecard.

Inventory & availability (RAOS-0005)

Built & testedREFRESHED — was designed only

Published Draft·RFC v1.0.0; built and tested, including reservation TTL.

specs/0005-inventory.mdsrc/lib/rules/inventory.tssrc/lib/extensions/evaluators/inventory.tssrc/lib/rules/__tests__/inventory.test.ts · inventory test suite

Quote integrity / price lock (RAOS-0007)

Built & testedREFRESHED — was designed only

Published Draft·RFC v1.0.0; built and tested. The retailer-trust unlock is real, not paper.

specs/0007-quote-integrity.mdsrc/lib/rules/quote.tssrc/lib/extensions/evaluators/quote.tssrc/lib/rules/__tests__/quote.test.ts · quote test suite

Fulfillment feasibility (RAOS-0003)

Partially built

Mode/region flags are evaluated today via RAOS-0001; real feasibility (windows, lead times, BOPIS, cutoffs) is still designed only — no specs/0003-*.md written.

Loyalty, subscriptions, tax/restricted, returns, discovery semantics, cart bridge (0009/0010/0011/0014/0004/0012)

Planned, not designed in depth

Catalogued with briefs, edge cases, and reason codes; none implemented. Each has a pending-task page under specs/wiki/pending/.

Trust, provenance & transport

Provenance/freshness envelope types

Built & testedREFRESHED — was partial

Published Draft·RFC v1.0.0; sign/verify, TTL matrix, key rotation built and tested; envelope attached centrally in the pipeline.

specs/0008-trust-provenance.mdsrc/lib/rules/trust.tssrc/lib/rules/__tests__/trust.test.ts · trust test suite

Real cryptography

Explicit non-goal (for now)

Simulated by locked decision; interface designed for a mechanical swap; TRUST_SIMULATED is labeled everywhere it applies.

MCP server (tools + resources over the pipeline)

Specified / designed only

Zero live transport code (WP-19 unstarted). The engine is now packaged (@retailagentos/engine) specifically so a real transport can be built outside this repo — the TheCustomHub pilot is the first concrete attempt, in progress, not shipped.

Conformance & production hardening

Test harness + golden fixtures + coverage

Built & tested

Vitest, 13 test suites, 328/328 tests passing. Line coverage is 93.8% — scoped to src/lib/rules, not the whole codebase.

vitest.config.ts · coverage.include scope

Public conformance suite third parties can run

Planned, not designed in depth

Internal only today; no packaged conformance kit. This is EVIDENCE-PLAN’s E4.

Persistence, multi-tenant infra, agent auth, rate limiting, real merchant/platform integrations

Explicit non-goal (for now)

Explicit non-goals of the demo phase. "Real merchant integrations" has moved from hypothetical to in progress — the TheCustomHub pilot is actively targeting this, unshipped.

The differentiator

Claims we deliberately don't make yet

Anyone can promise. The credible move is labeling exactly what isn't verified, right next to what is — so every ✅ above stays believable. Each of these is a feature that's designed, and unbuilt, on purpose.

"Production-ready"

No persistence, no multi-tenant infra, no agent auth, no rate limiting — all explicit non-goals of the current demo phase (row i1).

"Live MCP server"

Zero live transport code exists yet (row g1). The engine is packaged so one can be built outside this repo; none has shipped.

"Cryptographically signed"

Signing is simulated by locked decision, labeled TRUST_SIMULATED everywhere it appears (row f2). The interface is designed for a mechanical swap to real crypto — it just hasn’t happened.

"Real merchant integrations" (plural)

One pilot (TheCustomHub) is in progress, not shipped. Saying "integrations" before a second one lands overstates the evidence.

"Promo-stacking-aware"

RAOS-0006 is fully designed but zero code exists (row e3) — the single biggest gap this scorecard tracks.

"Loyalty-aware"

RAOS-0009 is catalogued with a brief and reason codes, nothing implemented (row e7).

All Specs See the adoption guide