> ## Documentation Index
> Fetch the complete documentation index at: https://uqp.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Discovery and routing

> Discover a neutral reference profile and bound the cost of provider review.

## Reference discovery, not a live merchant

`https://uqp.dev/.well-known/uqp.json` is a peer-to-peer UQP discovery example, **reference, not production**. It publishes protocol and semver identifiers, reference REST/MCP/GraphQL definitions, supported pack versions, routing policy, checkout handoff choices and documentation. It does not accept orders or bookings. Its committed source is `spec/discovery/uqp.dev.json`; publication validates it against [discovery.json](https://uqp.dev/docs/spec/discovery.md).

`https://uqp.dev/.well-known/ucp` is the separate UCP 2026-08-25 reference profile. It advertises the `dev.uqp.quoting` service and `dev.uqp.quoting.estimate` and `dev.uqp.quoting.quote_lock` capabilities. These UQP entities use date version `2026-11-05`, not native UQP semver. Any transport endpoint under `https://api.studio.example` is illustrative and not operational. There is no conformance or adoption claim.

## Two stages and router hooks

Stage 1 is a stateless, non-binding estimate: no human effort, a target below 200 ms, and no reserved appointment. This is a design target, not a measured service guarantee. Stage 2 requests a reviewed quote from one or two shortlisted providers; poll the existing quote-request lifecycle instead of holding a call open.

The optional manifest/discovery `routing_policy` supplies:

| Field | Meaning |
| - | - |
| `allow_stateless_estimate` | Whether a router may obtain a Stage-1 estimate. |
| `require_human_quote_review` | Whether the provider requires human review before a binding quote. |
| `max_concurrent_quote_holds` | Positive ceiling for simultaneous quote holds; not a payment authorization. |

Optional `review_sla_seconds` is a positive integer describing the review budget. It is not automatic acceptance and does not change lifecycle transitions. Routers such as `https://router.example` must enforce their own scheduling, timeout and concurrency rules; these fields are declarative hooks, not a hosted routing service.

A request or quote may carry neutral `attribution` fields `referrer_id`, `token`, `campaign` and `source`. They record provenance without choosing an attribution vendor or proving a commission entitlement. Tokens are untrusted input, not payment authorization; avoid personal data and credentials.

## Public keys and agent identity

Both profiles can publish an empty `keys` array. Nonempty entries are public RFC 7517 JWKs: OKP/Ed25519 with EdDSA or EC/P-256 with ES256. Publish only the supported public members (`kty`, `kid`, `use`, `alg`, `crv`, `x`, `y`); never publish `d` or other private material.

Profiles can be used with the optional `UCP-Agent` request header and RFC 9421 HTTP Message Signatures / Web Bot Auth (`Signature-Agent`). Discovery of a public key is not proof that a request was signed: consumers must verify signatures, origin authority, freshness and key selection separately. This reference does not implement an identity verifier.

## Static namespace authority

`site/vercel.json` sets `Cache-Control: public, max-age=300, stale-while-revalidate=86400` on `/spec/(.*)` and `/.well-known/(.*)`. Both well-known profiles explicitly receive JSON content types, including the extensionless `/.well-known/ucp` path. Vercel supplies ETag/Last-Modified for static assets; the repository does not fabricate validators.

There are no redirects or rewrites for these namespaces. Next's `trailingSlash: true` applies to generated page routes; these files are copied from `public/` and served at their exact static paths without a slash redirect. Local smoke checks require a direct HTTP 200 and valid JSON for both profiles. Production headers and reverse-domain authority still require post-deployment verification; no deployment is performed by this reference workflow.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.