Skip to main content

​
Reference discovery, not a live merchant

https://uqp.dev/.well-known/uqp.json is a peer-to-peer UQP discovery example, reference, not production. It publishes protocol and semver identifiers, reference REST/MCP/GraphQL definitions, supported pack versions, routing policy, checkout handoff choices and documentation. It does not accept orders or bookings. Its committed source is spec/discovery/uqp.dev.json; publication validates it against discovery.json. https://uqp.dev/.well-known/ucp is the separate UCP 2026-08-25 reference profile. It advertises the dev.uqp.quoting service and dev.uqp.quoting.estimate and dev.uqp.quoting.quote_lock capabilities. These UQP entities use date version 2026-11-05, not native UQP semver. Any transport endpoint under https://api.studio.example is illustrative and not operational. There is no conformance or adoption claim.

​
Two stages and router hooks

Stage 1 is a stateless, non-binding estimate: no human effort, a target below 200 ms, and no reserved appointment. This is a design target, not a measured service guarantee. Stage 2 requests a reviewed quote from one or two shortlisted providers; poll the existing quote-request lifecycle instead of holding a call open. The optional manifest/discovery routing_policy supplies: Optional review_sla_seconds is a positive integer describing the review budget. It is not automatic acceptance and does not change lifecycle transitions. Routers such as https://router.example must enforce their own scheduling, timeout and concurrency rules; these fields are declarative hooks, not a hosted routing service. A request or quote may carry neutral attribution fields referrer_id, token, campaign and source. They record provenance without choosing an attribution vendor or proving a commission entitlement. Tokens are untrusted input, not payment authorization; avoid personal data and credentials.

​
Public keys and agent identity

Both profiles can publish an empty keys array. Nonempty entries are public RFC 7517 JWKs: OKP/Ed25519 with EdDSA or EC/P-256 with ES256. Publish only the supported public members (kty, kid, use, alg, crv, x, y); never publish d or other private material. Profiles can be used with the optional UCP-Agent request header and RFC 9421 HTTP Message Signatures / Web Bot Auth (Signature-Agent). Discovery of a public key is not proof that a request was signed: consumers must verify signatures, origin authority, freshness and key selection separately. This reference does not implement an identity verifier.

​
Static namespace authority

site/vercel.json sets Cache-Control: public, max-age=300, stale-while-revalidate=86400 on /spec/(.*) and /.well-known/(.*). Both well-known profiles explicitly receive JSON content types, including the extensionless /.well-known/ucp path. Vercel supplies ETag/Last-Modified for static assets; the repository does not fabricate validators. There are no redirects or rewrites for these namespaces. Next’s trailingSlash: true applies to generated page routes; these files are copied from public/ and served at their exact static paths without a slash redirect. Local smoke checks require a direct HTTP 200 and valid JSON for both profiles. Production headers and reverse-domain authority still require post-deployment verification; no deployment is performed by this reference workflow.