Evidence

The public scorecard

No vendor publishes this. Here is exactly what's real, what's specified, and what's still paper — graded row by row against a reference architecture for a merchant reasoning layer, with a file path or test suite behind every checkmark.

Verified 2026-09-02 · Open specs · Adoption guide · Conformance scoreboard

610/610Automated tests passingnpm test — verified 2026-09-02.

PassingTypeScriptnpx tsc --noEmit after building the engine declarations.

93.8%Line coverage (rules engine scope)Statements 92.8% · Branches 89.18% · Functions 82.25% · Lines 93.8% — measured over src/lib/rules only, per vitest.config.ts.

PassingProduction buildnpm run build (Next.js 16.2.6, Turbopack).

ESM + CJS@retailagentos/engine smoke-tested externallyInstalled as a tarball into a throwaway project outside this repo; both entry points resolve and run.

How to read the status column

Built & tested: Code exists, is exercised by an automated test, and is part of the current verified suite.
Partially built: Some of the surface is real and tested; the rest is still a gap called out below.
Specified / designed only: A spec or interface exists on paper. No implementation code backs it yet.
Planned, not designed in depth: On the roadmap. Not yet speced out, let alone built.
Explicit non-goal (for now): Deliberately out of scope for the current demo/reference phase — not an oversight.

Discovery & negotiation

Discovery manifest (/.well-known/ucp, tier + capabilities[])

Built & tested

Real Next.js route handler with tests; locked split-axis tier model. Data behind it is mock.

src/app/.well-known/ucp/route.tssrc/app/.well-known/ucp/route.test.ts · route test suite

Capability negotiation enforced at runtime

Built & tested

registry.manifestSubset() is load-bearing: an absent capability produces a documented, tested degraded result — not a crash.

src/lib/extensions/registry.tssrc/lib/extensions/__tests__/registry.test.ts · registry test suite

Canonical context & identity

Canonical buyer context

Built & tested

BuyerContext models loyaltyTier, trust.mode, activeExtensions; a prior modeling bug in activeExtensions has been removed.

src/lib/types/context.ts

Most-restrictive normalization + trust downgrade

Built & tested

Asserted privilege claims are downgraded for transaction-gating stages, per RAOS-0000 §7.2.

src/lib/rules/normalizeBuyerContext.tssrc/lib/rules/__tests__/normalizeBuyerContext.test.ts · normalization test suite

Real identity/consent/PII model (RAOS-0015)

Specified / designed only

Still spec’d only (WP-15, unstarted); interface designed, nothing built. Buyer token verification is simulated by decision (see f2).

Decision pipeline

Extension contract (UcpExtension: namespace@semver, stage, priority, pure evaluate)

Built & tested

Matches ARCH-UCP-EXTENSION-MCP.md §3.2.

src/lib/extensions/contract.ts

Registry + staged pipeline + fault isolation + now injection

Built & tested

A throwing evaluator degrades (BLOCK for safety stages) without crashing the pipeline — tested.

src/lib/extensions/registry.tssrc/lib/extensions/pipeline.tssrc/lib/extensions/__tests__/pipeline.test.ts · pipeline test suite

Determinism guarantee

Built & tested

Golden fixtures enforce: no Date.now/Math.random/IO in rules code; same inputs → byte-identical DecisionRecord.

src/lib/rules/__tests__/golden.test.ts · golden-fixture test suite

Decision vocabulary & explainability

Uniform reason vocabulary (ReasonEntry: code, severity, source, requirements)

Built & tested

blocking is deprecated with a migration path; status is derived, not authored.

src/lib/types/reasons.ts

Decision substrate for explainability (DecisionRecord)

Built & tested

Folded by the pipeline: ordered reasons with per-stage attribution.

src/lib/extensions/pipeline.ts

Per-audience trace renderings (merchant ops / buyer / developer JSON)

Built & testedREFRESHED — was designed only

WP-08 shipped: renderBuyerTrace / renderMerchantTrace / renderDeveloperTrace all exist, tested, and exported from the engine package.

src/lib/trace/derive.tssrc/lib/trace/render.tssrc/lib/trace/types.tssrc/lib/trace/__tests__/trace.test.ts · trace test suite

Domain semantics

Eligibility & visibility semantics (RAOS-0001)

Built & tested

Published Draft·RFC v1.1.0 with a reference implementation, a spec page, and every reason code fixture-covered. The flagship spec.

specs/0001-eligibility.mdsrc/lib/rules/__tests__/behaviors.test.ts · behaviors test suite

Contextual pricing — member/bulk/MOQ (RAOS-0002)

Built & testedREFRESHED — was partial

AppliedOffer / suppressedOffers shape landed and is the frozen contract RAOS-0006/0007 bind to.

specs/0002-contextual-pricing.mdsrc/lib/rules/pricing.tssrc/lib/rules/__tests__/pricing.test.ts · pricing test suite

Promo stacking ladder (RAOS-0006)

Specified / designed onlycorrected downward, not upgraded

Still unbuilt — no promos.ts exists and specs/0006-promo-stacking.md is not written. Fully designed (priority ladder + stackable/exclusive locked), zero code. The single biggest commercial-differentiation gap on this scorecard.

Inventory & availability (RAOS-0005)

Built & testedREFRESHED — was designed only

Published Draft·RFC v1.0.0; built and tested, including reservation TTL.

specs/0005-inventory.mdsrc/lib/rules/inventory.tssrc/lib/extensions/evaluators/inventory.tssrc/lib/rules/__tests__/inventory.test.ts · inventory test suite

Quote integrity / price lock (RAOS-0007)

Built & testedREFRESHED — was designed only

Published Draft·RFC v1.0.0; built and tested. The retailer-trust unlock is real, not paper.

specs/0007-quote-integrity.mdsrc/lib/rules/quote.tssrc/lib/extensions/evaluators/quote.tssrc/lib/rules/__tests__/quote.test.ts · quote test suite

Fulfillment feasibility (RAOS-0003)

Partially built

Built and tested: mode and region checks, lead time, cutoff, weekly operating hours, order-acceptance buffer and need-by evaluation. Provider-supplied delivery windows, courier capacity, route selection and multi-stop fulfilment remain unsupported.

Loyalty, subscriptions, tax/restricted, returns, discovery semantics, cart bridge (0009/0010/0011/0014/0004/0012)

Planned, not designed in depth

Catalogued with briefs, edge cases, and reason codes; none implemented. Each has a pending-task page under specs/wiki/pending/.

Trust, provenance & transport

Provenance/freshness envelope types

Built & testedREFRESHED — was partial

Published Draft·RFC v1.0.0; sign/verify, TTL matrix, key rotation built and tested; envelope attached centrally in the pipeline.

specs/0008-trust-provenance.mdsrc/lib/rules/trust.tssrc/lib/rules/__tests__/trust.test.ts · trust test suite

Real cryptography

Explicit non-goal (for now)

Simulated by locked decision; interface designed for a mechanical swap; TRUST_SIMULATED is labeled everywhere it applies.

Native WebMCP browser delivery layer

Built & tested

Controlled browser-local tools ship at /webmcp-showcase. Native verification in the ChatGPT in-app browser is complete; public Chrome/origin-trial QA has not yet been completed.

packages/webmcp/src/index.ts · canonical descriptor catalogsrc/app/webmcp-showcase/page.tsx · browser registration lifecyclespecs/WEBMCP-CHROME-VERIFICATION.md · browser verification record

Generalized remote MCP server

Specified / designed only

The architecture is documented, but no hosted remote server, agent authentication layer, or production transport has shipped.

specs/ARCH-UCP-EXTENSION-MCP.md · remote/server architecture

Conformance & production hardening

Test harness + golden fixtures + coverage

Built & tested

Vitest, 610/610 tests passing as verified 2026-09-02. Coverage is scoped to src/lib/rules, not the whole codebase.

vitest.config.ts · coverage.include scope

Public conformance suite third parties can run

Planned, not designed in depth

Internal only today; no packaged conformance kit. This is EVIDENCE-PLAN’s E4.

Persistence, multi-tenant infra, agent auth, rate limiting, real merchant/platform integrations

Explicit non-goal (for now)

Explicit non-goals of the demo phase. "Real merchant integrations" has moved from hypothetical to in progress — the TheCustomHub pilot is actively targeting this, unshipped.

The differentiator

Claims we deliberately don't make yet

Anyone can promise. The credible move is labeling exactly what isn't verified, right next to what is — so every ✅ above stays believable. Each of these is a feature that's designed, and unbuilt, on purpose.

"Production-ready"

No persistence, no multi-tenant infra, no agent auth, no rate limiting — all explicit non-goals of the current demo phase (row i1).

"Production remote MCP server"

Native browser WebMCP ships for the controlled showcase (row g1), but no generalized remote/server MCP transport, hosted endpoint, or agent authentication layer exists (row g2).

"Cryptographically signed"

Signing is simulated by locked decision, labeled TRUST_SIMULATED everywhere it appears (row f2). The interface is designed for a mechanical swap to real crypto — it just hasn’t happened.

"Real merchant integrations" (plural)

One pilot (TheCustomHub) is in progress, not shipped. Saying "integrations" before a second one lands overstates the evidence.

"Promo-stacking-aware"

RAOS-0006 is fully designed but zero code exists (row e3) — the single biggest gap this scorecard tracks.

"Loyalty-aware"

RAOS-0009 is catalogued with a brief and reason codes, nothing implemented (row e7).

All Specs See the adoption guide