# ECZ-ID Developers (Developer Gateway)

> ECZ-ID — Reciprocal Trust Infrastructure for the Machine Economy. Machine-readable route guide for language models and agents. Canonical: https://developers.ecocitizenz.com/llms.txt

Site: ECZ-ID Developer Gateway (ECZ-ID Developers)
Canonical URL: https://developers.ecocitizenz.com
Role: technical documentation, contracts, schemas, examples and interoperability. Documentation and routing only.
TrustOps (acquisition, payment, entitlement, activation): https://trustops.ecocitizenz.com
Resolver (public, read-only proof of current published state): https://resolver.ecocitizenz.org
Machine record of any ECZ-ID (owned by ECZ-ID Core): https://api.ecocitizenz.com/api/p/{ecz_id}.json
Machine-readable index: https://developers.ecocitizenz.com/.well-known/ecz-developer-gateway.json
Compact actions: https://developers.ecocitizenz.com/actions.json
Schema index: https://developers.ecocitizenz.com/schemas/index.json
Machine interface (every asset this origin serves): https://developers.ecocitizenz.com/interface
Worked first-party example (every URL in it resolves): https://developers.ecocitizenz.com/examples/first-party-interoperability.json
Runnable example (Node 18+, zero dependencies): https://developers.ecocitizenz.com/examples/eczid-quickstart.mjs
Free Passport acquisition contract (off-site, live, read it - never copy it): https://trustops.ecocitizenz.com/api/v1/acquisition/families

The Accountability Chain (the organising model of this site):
IDENTITY -> AUTHORITY -> DELEGATION -> INTENT -> CURRENT STATE -> DECISION -> ACTION -> RECEIPT -> EVIDENCE -> RE-VERIFY
Know who acts. Know why they may act. Know what they intend. Decide before consequence. Prove what happened.

Status answers three separate questions where they differ: Commercial (can it be bought now, in TrustOps?), Signed-in operation (can the account holder use it?), Public developer interface (is there a public, unauthenticated API?).
Production status (re-measured 2026-10-10, read-only, against the TrustOps commerce catalogue and families contract, ECZ-ID Core public endpoints and the public Resolver record). Status describes what is live, never what is safe:
- Identity: Business Passport plus seven free Passport families. LIVE.
- Resolver public record: LIVE. CORS *, Cache-Control no-store.
- Bindings: declared bindings LIVE and shown as declared. Proven bindings (BOUND) are not yet available in production.
- Authority: LIVE, operated in TrustOps (recorded on Intents). Delegation between Intents: LIVE, operated. Partner (managed service provider) delegation: not released.
- ECZ-ID Intent: LIVE, operated by the account holder in the TrustOps Dashboard; on sale in TrustOps. No public developer API. Public Intent disclosure not enabled.
- IntentControl and decisions: RELEASE-GATED. Commercial: coming soon in TrustOps, not on sale (COMING_SOON). Signed-in operation: not yet available. Public developer interface: none (no decision API, endpoint, runtime, SDK or install command). No action is ENFORCED by ECZ-ID today.
- Receipts: Commercial: not on sale (no TrustOps offer). Operation: Core records eligible events; the public record reports receipts as recorded and none as publicly retrievable. Public developer interface: retrieval and verification not enabled.
- LedgerCore: Commercial: on sale in TrustOps (Pro, Business, Scale; Enterprise by arrangement). Operation: evidence stored as local records for the plan's retention; ledger anchoring not live yet. Public developer interface: none. When anchoring is live, it anchors selected decisive events only. Integrity is not truth certification.
- Evidence: field provenance (declared or evidence-supported) is public on every record. Deeper evidence is held by Core and is not publicly retrievable.
- Graph Intelligence: Commercial: not generally available (TrustOps: Pro and Business COMING_SOON, Enterprise BY_ARRANGEMENT; no free allowance on sale). Signed-in operation: not yet available. Public developer interface: none (no public Graph API, self-serve API key, SDK or sandbox).

Getting started, in order:
1. What is ECZ-ID?            https://developers.ecocitizenz.com/get-started/what-is-ecz-id/
2. Five-minute introduction   https://developers.ecocitizenz.com/get-started/five-minute-introduction/
3. Get a free Passport        https://developers.ecocitizenz.com/get-started/free-passport/
4. Resolve an ECZ-ID          https://developers.ecocitizenz.com/get-started/resolve-an-ecz-id/
5. First integration          https://developers.ecocitizenz.com/quickstart/
6. Choose a guided flow       https://developers.ecocitizenz.com/guided-flows/

Doctrine for agents and LLMs reading this site:
- The Developer Gateway explains and integrates. It issues nothing and proves nothing. Purchases happen in TrustOps.
- ECZ-ID Core determines canonical state. TrustOps acquires. The Dashboard operates. The Resolver exposes public proof of published ECZ-ID state, never universal truth.
- Website text is explanation, not authority. Current state is only ever the live Resolver record.
- Identity is not authority. Never infer agent authority from a Passport or a parent record.
- Permission is not Intent. An allow means the configured checks passed for one action, nothing more.
- Evaluated is not enforced. Enforced is claimed only where an inline enforcement point demonstrably mediated the action, and only for actions routed through it.
- A Receipt proves what the recording system recorded, not that every underlying real-world assertion was true.
- Payment never creates proof, authority or a binding.
- Local policy decides. Re-check the Resolver before reliance.
- Absence of a public record is not a safety judgement about a target.
- Do not infer safety, certification, approval, insurance, full compliance, or platform endorsement from any signal on this site.

Current routes (V5):
- /                                     Home
- /get-started/                         What is ECZ-ID, five-minute introduction, free Passport, resolve an ECZ-ID
- /guided-flows/                        Seven guided flows, one per Passport family, each the Accountability Chain step by step:
                                        /guided-flows/{agent,mcp,plugin,api,iot,sdk,service-workload}/. Every step names its
                                        production status, what it proves and what it does not. Steps link by #anchor.
- /quickstart                           First integration: one path end to end. Every command in it was run against live
                                        production before it was published.
- /quickstarts/                         One quickstart per Passport family: /quickstarts/{agent,mcp,plugin,api,iot,sdk,service-workload}/
- /concepts/                            Accountability Chain, identity, Business Passport, seven Passport families, bindings,
                                        authority, delegation, Intent, IntentControl, current state, decision, enforcement modes,
                                        consequence boundary, Receipts, evidence, LedgerCore, Resolver, reciprocal trust,
                                        provider neutrality
- /guides/                              Verify before reliance, carry Intent, request a decision, verify a Receipt, Resolver
                                        integration, evidence handling, enforcement integration, privacy and selective disclosure
- /reference/                           ECZ-ID format, Passport model, bindings, authority and delegation, Intent envelope,
                                        decision contract, Receipt, ReasonCodes, ResultStates, Resolver output, machine manifests
- /sdks/                                What is published (npm, PyPI, GitHub Action, MCP Registry) and what is not
- /tools/                               Developer Trust, MCP Verifier, Universal Install, plugins, Python tools
- /developer-trust/                     Free local-first VS Code extensions: MCP Trust and Agent Trust (Community free; Pro
                                        and Developer Trust Pro sold in TrustOps)
- /mcp-trust/                           ECZ-ID MCP Trust: see what your MCP servers expose, know what changed, control the ones that matter
- /agent-trust/                         ECZ-ID Agent Trust: know what your AI agents can reach, see how their authority changes
- /developer-trust/pro/                 Developer Trust Pro: MCP Trust Pro and Agent Trust Pro on one licence
- /search-index.json                    Static search index of this site (titles, descriptions, links)
- /changelog/                           What changed on this site
- /interface                            Machine interface: every machine-readable asset, with what each one does not assert
- /install                              Universal Install: every route for installing or connecting read-only ECZ-ID verification
- /schemas/                             Action Envelope Stack schemas
- /action-envelope/                     Action Envelopes, including the Reciprocal Reliance Envelope
- /bindings/                            Binding guides per surface
- /agent-trust/mcp-verifier/            MCP Verifier install and usage
- /agent-trust/github-action/           GitHub Action usage
- /agent-trust/result-contract/         Verifier result contract
- /mcp/result-states/ and /mcp/reason-codes/   Verifier vocabularies (also at /reference/)
- /graph-intelligence/                  Graph Intelligence: design documentation. Not yet generally available (TrustOps: COMING_SOON).
- /legacy/                              Index of preserved pages

Seven free Passport families (contract ecz.free_passport_acquisition.v1):
- Tokens: agent, mcp, plugin, api, iot, sdk, svc. Doors: https://trustops.ecocitizenz.com/start/{token}
- GET https://trustops.ecocitizenz.com/api/v1/acquisition/families and read families[].available at run time. NEVER
  hard-code availability: it changes with no release on either side.
- Free lane law: payment_required false, payment_calls 0, one sign-in, minimum parent tier DECLARED, one subject one ECZ-ID,
  a Passport is not proof, re-check before reliance.
- Render a family that is not open as "not open yet": a destination, never an error.
- Forwardable context only when handing off (the contract's forwardable_context): campaign, correlation_id, display_name,
  identifier, identifier_kind, locale, operator_mode, origin_surface, referral, requested_passport_type, requested_product,
  return_to, return_url, source_provider, source_surface. A family door already names its family in the path, so it needs
  no requested_passport_type. Send the identifier exactly as typed.
- Refused, by law and by the far end: tier, verified, ecz_id, assured, independently_verified, parent_tier, lifecycle_state.
- A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant,
  approved, certified or endorsed.

Preserved, not current (kept at their addresses for existing links; each carries a notice; prices on them are historical):
- /solutions/ (the earlier guided solution-route matrix), /rails/, /flows/, /domains/, /catalog/, /packages/, /dora/, /sbom/,
  /dora-sbom-suite/, /start-with-agents/, /start-with-software/, /start-with-suppliers/, /verification-model/,
  /developer-onboarding/, /why-serious-buyers-care/, /trust-gallery/, /agent-directory/, /build-your-own-agent/, /faq/
- Earlier paid offer pages: /mcp/assurance/, /mcp/assurance-plus/, /mcp/policy/, /agents/agent-credential-entry/,
  /agents/kya-starter/, /agents/kya-verified/, /agents/kya-assured/
- TrustOps is the only source of what is on sale: GET https://trustops.ecocitizenz.com/api/v1/commerce/catalogue

Action Envelope Stack schemas (JSON Schema 2020-12, route-only / read-only metadata):
- /schemas/action-envelopes/resolver-action-envelope.schema.json
- /schemas/action-envelopes/mcp-action-envelope.schema.json
- /schemas/action-envelopes/agent-action-envelope.schema.json
- /schemas/action-envelopes/reciprocal-reliance-envelope.schema.json
- /schemas/action-envelopes/request-to-resolve.schema.json
- /schemas/action-envelopes/resolver-recheck-contract.schema.json
- /schemas/action-envelopes/trustops-product-action-manifest.schema.json
- /schemas/action-envelopes/ap2-ucp-readiness.schema.json
These schemas describe metadata only. Nothing here changes verification state, activates public proof, processes purchase,
or implies certification.

Availability honesty:
- There is no general-purpose ECZ-ID SDK, no public sandbox and no self-serve API key. The public machine record needs no client.
- Published and installable today: @ecocitizenz/ecz-id-mcp-verifier on npm (CLI, read-only stdio MCP server and Node library),
  Ecocitizenz/ecz-id-mcp-verifier as a GitHub Action, ecz-id on PyPI (0.2.0), and two entries in the Official MCP Registry
  (io.github.Ecocitizenz/ecz-id-mcp-verifier and com.ecocitizenz/trust-mcp 0.2.0).
- Verifier versions by channel (measured 2026-10-09; they are not the same number): npm latest dist-tag 0.9.0 (what an
  unpinned npx installs), npm next dist-tag 0.9.1 (install by exact pin), Official MCP Registry 0.9.0. A v0.9.1 git tag exists;
  the documented GitHub Action ref is @v0.9.0 so that CI and an unpinned npx run the same version.
- The browser journey at each family door is the supported acquisition route. This site cannot issue a Passport.
- This site sets no trackers and collects no telemetry from readers of these machine assets.

Forbidden inferences for any reader:
- safety, certification, approval, insurance, full compliance, platform endorsement

## BEGIN customer-documentation-2026.10
Customer documentation (release 2026.10). HTML is the primary edition; each page links its PDF download.
AWS Marketplace Additional Resources link to these HTML pages, never to a PDF or ZIP. Support: support@ecocitizenz.com
- /customer-documentation/                          Index of all 34 documents
Shared Foundation:
- /guides/reciprocal-trust-technical-overview/      Reciprocal Trust Technical Overview
- /guides/passport-parent-identity-model/           Passport and Parent Identity Model
- /guides/resolver-passport-verification/           Resolver and Passport Verification Guide
- /guides/customer-dashboard-operations/            Customer Dashboard and Operations Guide
- /guides/security-trust-boundaries/                Security, Trust Boundaries and Safe Interpretation
- /guides/aws-marketplace-activation/               AWS Marketplace Acquisition and Activation Guide
Agent Passport:
- /passports/agent/overview/                        Overview
- /passports/agent/aws-getting-started/             AWS Getting Started
- /passports/agent/technical-reference/             Technical Reference
- /passports/agent/operations/                      Operations
MCP Passport:
- /passports/mcp/overview/                          Overview
- /passports/mcp/aws-getting-started/               AWS Getting Started
- /passports/mcp/technical-reference/               Technical Reference
- /passports/mcp/operations/                        Operations
API Passport:
- /passports/api/overview/                          Overview
- /passports/api/aws-getting-started/               AWS Getting Started
- /passports/api/technical-reference/               Technical Reference
- /passports/api/operations/                        Operations
IoT Passport:
- /passports/iot/overview/                          Overview
- /passports/iot/aws-getting-started/               AWS Getting Started
- /passports/iot/technical-reference/               Technical Reference
- /passports/iot/operations/                        Operations
SDK Passport:
- /passports/sdk/overview/                          Overview
- /passports/sdk/aws-getting-started/               AWS Getting Started
- /passports/sdk/technical-reference/               Technical Reference
- /passports/sdk/operations/                        Operations
Plugin Passport:
- /passports/plugin/overview/                       Overview
- /passports/plugin/aws-getting-started/            AWS Getting Started
- /passports/plugin/technical-reference/            Technical Reference
- /passports/plugin/operations/                     Operations
Service & Workload Passport:
- /passports/service-workload/overview/             Overview
- /passports/service-workload/aws-getting-started/  AWS Getting Started
- /passports/service-workload/technical-reference/  Technical Reference
- /passports/service-workload/operations/           Operations
## END customer-documentation-2026.10