Conformance: reading a failed check

conformance support · Checklist 2026-10-12 · 12 checks · runs are computed live and not stored · Machine form: /v1/diagnostics/conformance-failures · Markdown

Conformance is the public black-box checklist a deployment runs against its own public surface. Every check names the exact request it makes, so anyone can re-run any check independently; a check that cannot even be attempted is a failure with the reason in its detail, never a silent skip. A deployment is Rightshold Certified only while every check passes, and the result is reported by the deployment itself — stated as such in the answer. Runs are computed live and are not stored: there is no conformance run record, so this topic carries the checklist itself — its version and its checks, each with what it proves — and never a count of runs.

Entry points

Checks to run

Discovery documents: The manifest, the OpenAPI description and the agent entry point (llms.txt) are all served, so an agent that has never heard of Rightshold can bootstrap from a bare URL.
Agent card: The well-known agent card names the platform and its endpoints, so crawlers and agent frameworks can identify the deployment.
MCP initialize: The MCP endpoint answers a protocol initialize and identifies itself as the Rightshold server with a supported protocol version.
MCP core tools: tools/list exposes the core rights, identity and ledger tools an agent integration depends on (ask_rightshold, check_license, kya_lookup, verify_rights_manifest, ledger_verify).
KYA configuration: The open RS-KYA standard's levels (L0–L2) are published at the well-known configuration and at /v1/kya, so relying parties can read the level definitions from the deployment itself.
Issuer keys published: The keys that sign registration certificates and ledger blocks are published with their status, so signatures can be verified without trusting the deployment.
JWKS published: The JSON Web Key Set behind kya+jwt tokens is served, so tokens can be verified offline.
Honest pricing document: The machine-readable pricing lists every line with its planned price, states that nothing is charged during the preview, and names placement, grades and verdicts as never for sale.
Ledger head served: The public append-only ledger answers with its signed head block, so history is inspectable from the outside.
Published rate limits: The limits are published at /v1/limits and every API response carries its remaining budget, so agents can pace themselves instead of guessing.
Ask answers deterministically: A plain-English rights question gets a deterministic license verdict (permitted, prohibited, needs_review or not_documented) — the decision agents actually rely on.
A2A endpoint: The A2A (Agent2Agent) endpoint the agent card names as its url answers message/send with a completed task carrying the structured result, and tasks/get returns the same task — so A2A-native agents can work with the deployment, not just read its card.

Outcomes

a check fails — The check's detail names the exact request it made, the status it got back, and what was missing or different — that detail is the diagnosis. Next step: Re-run the exact request the detail names against the deployment, fix what it shows on the deployment's own surface, then run GET /v1/conformance again — the MCP check_conformance tool runs the same checklist against a deployment an agent names (https only; http only for localhost).
a check cannot be attempted — A network error or timeout while running a check is reported as a failure with the reason in the detail. Next step: Read the reason in the detail, confirm the deployment answers at its public base URL, and re-run the checklist.
not_certified — At least one check failed, so the deployment is not Rightshold Certified at that moment; the summary counts pass, fail and skip across the checklist. Next step: Work the failing checks from their details — certification is the state where every check passes, and it is read from a fresh run, not stored.