{
  "topic": {
    "id": "conformance-failures",
    "name": "Conformance: reading a failed check",
    "kind": "conformance support",
    "about": "Conformance is the public black-box checklist a deployment runs against its own public surface. Every check names the exact request it makes, so anyone can re-run any check independently; a check that cannot even be attempted is a failure with the reason in its detail, never a silent skip. A deployment is Rightshold Certified only while every check passes, and the result is reported by the deployment itself — stated as such in the answer. Runs are computed live and are not stored: there is no conformance run record, so this topic carries the checklist itself — its version and its checks, each with what it proves — and never a count of runs.",
    "entry_points": {
      "page": "https://www.rightshold.com/conformance",
      "api": "https://www.rightshold.com/v1/conformance",
      "badge": "https://www.rightshold.com/conformance/badge.svg"
    },
    "checks": [
      "Discovery documents: The manifest, the OpenAPI description and the agent entry point (llms.txt) are all served, so an agent that has never heard of Rightshold can bootstrap from a bare URL.",
      "Agent card: The well-known agent card names the platform and its endpoints, so crawlers and agent frameworks can identify the deployment.",
      "MCP initialize: The MCP endpoint answers a protocol initialize and identifies itself as the Rightshold server with a supported protocol version.",
      "MCP core tools: tools/list exposes the core rights, identity and ledger tools an agent integration depends on (ask_rightshold, check_license, kya_lookup, verify_rights_manifest, ledger_verify).",
      "KYA configuration: The open RS-KYA standard's levels (L0–L2) are published at the well-known configuration and at /v1/kya, so relying parties can read the level definitions from the deployment itself.",
      "Issuer keys published: The keys that sign registration certificates and ledger blocks are published with their status, so signatures can be verified without trusting the deployment.",
      "JWKS published: The JSON Web Key Set behind kya+jwt tokens is served, so tokens can be verified offline.",
      "Honest pricing document: The machine-readable pricing lists every line with its planned price, states that nothing is charged during the preview, and names placement, grades and verdicts as never for sale.",
      "Ledger head served: The public append-only ledger answers with its signed head block, so history is inspectable from the outside.",
      "Published rate limits: The limits are published at /v1/limits and every API response carries its remaining budget, so agents can pace themselves instead of guessing.",
      "Ask answers deterministically: A plain-English rights question gets a deterministic license verdict (permitted, prohibited, needs_review or not_documented) — the decision agents actually rely on.",
      "A2A endpoint: The A2A (Agent2Agent) endpoint the agent card names as its url answers message/send with a completed task carrying the structured result, and tasks/get returns the same task — so A2A-native agents can work with the deployment, not just read its card."
    ],
    "outcomes": [
      {
        "signal": "a check fails",
        "meaning": "The check's detail names the exact request it made, the status it got back, and what was missing or different — that detail is the diagnosis.",
        "next_step": "Re-run the exact request the detail names against the deployment, fix what it shows on the deployment's own surface, then run GET /v1/conformance again — the MCP check_conformance tool runs the same checklist against a deployment an agent names (https only; http only for localhost)."
      },
      {
        "signal": "a check cannot be attempted",
        "meaning": "A network error or timeout while running a check is reported as a failure with the reason in the detail.",
        "next_step": "Read the reason in the detail, confirm the deployment answers at its public base URL, and re-run the checklist."
      },
      {
        "signal": "not_certified",
        "meaning": "At least one check failed, so the deployment is not Rightshold Certified at that moment; the summary counts pass, fail and skip across the checklist.",
        "next_step": "Work the failing checks from their details — certification is the state where every check passes, and it is read from a fresh run, not stored."
      }
    ],
    "record": {
      "checklist_version": "2026-10-12",
      "checks": 12,
      "checklist": [
        {
          "id": "discovery-documents",
          "label": "Discovery documents",
          "proves": "The manifest, the OpenAPI description and the agent entry point (llms.txt) are all served, so an agent that has never heard of Rightshold can bootstrap from a bare URL."
        },
        {
          "id": "agent-card",
          "label": "Agent card",
          "proves": "The well-known agent card names the platform and its endpoints, so crawlers and agent frameworks can identify the deployment."
        },
        {
          "id": "mcp-initialize",
          "label": "MCP initialize",
          "proves": "The MCP endpoint answers a protocol initialize and identifies itself as the Rightshold server with a supported protocol version."
        },
        {
          "id": "mcp-core-tools",
          "label": "MCP core tools",
          "proves": "tools/list exposes the core rights, identity and ledger tools an agent integration depends on (ask_rightshold, check_license, kya_lookup, verify_rights_manifest, ledger_verify)."
        },
        {
          "id": "kya-configuration",
          "label": "KYA configuration",
          "proves": "The open RS-KYA standard's levels (L0–L2) are published at the well-known configuration and at /v1/kya, so relying parties can read the level definitions from the deployment itself."
        },
        {
          "id": "issuer-keys",
          "label": "Issuer keys published",
          "proves": "The keys that sign registration certificates and ledger blocks are published with their status, so signatures can be verified without trusting the deployment."
        },
        {
          "id": "jwks",
          "label": "JWKS published",
          "proves": "The JSON Web Key Set behind kya+jwt tokens is served, so tokens can be verified offline."
        },
        {
          "id": "pricing-honest",
          "label": "Honest pricing document",
          "proves": "The machine-readable pricing lists every line with its planned price, states that nothing is charged during the preview, and names placement, grades and verdicts as never for sale."
        },
        {
          "id": "ledger-head",
          "label": "Ledger head served",
          "proves": "The public append-only ledger answers with its signed head block, so history is inspectable from the outside."
        },
        {
          "id": "rate-limit-transparency",
          "label": "Published rate limits",
          "proves": "The limits are published at /v1/limits and every API response carries its remaining budget, so agents can pace themselves instead of guessing."
        },
        {
          "id": "ask-answers",
          "label": "Ask answers deterministically",
          "proves": "A plain-English rights question gets a deterministic license verdict (permitted, prohibited, needs_review or not_documented) — the decision agents actually rely on."
        },
        {
          "id": "a2a-endpoint",
          "label": "A2A endpoint",
          "proves": "The A2A (Agent2Agent) endpoint the agent card names as its url answers message/send with a completed task carrying the structured result, and tasks/get returns the same task — so A2A-native agents can work with the deployment, not just read its card."
        }
      ],
      "runs_stored": false,
      "self_reported": true
    },
    "record_url": "https://www.rightshold.com/diagnostics/conformance-failures"
  }
}