Public Trust Anchor for the GSC Agentic Stack.
Verify the statement. DPUone publishes the public keys used to verify signed records and machine identities across the GSC agentic estate. No account. No shared secret. No call back to GSC. Fetch the key. Verify the signature.
https://dpuone.ai/.well-known/jwks.json
$ curl -sI https://mcp.cpgknowledgegraph.ai/ x-gsc-protocol: CPG-68000 x-gsc-version: 4.0 x-gsc-handshake: https://gsc-registry.ai/resolve/mcp.cpgknowledgegraph.ai x-gsc-card: https://mcp.cpgknowledgegraph.ai/.well-known/agent-card.json x-gsc-trust-anchor: https://dpuone.ai/.well-known/jwks.json x-gsc-operator: GreenCore Solutions Corp. x-gsc-duns: 24-336-6774 x-gsc-node: mcp.cpgknowledgegraph.ai x-gsc-region: France Central x-gsc-jurisdiction: apex x-gsc-signal: CPG-200 x-gsc-state: ALLOW x-gsc-graph: https://mcp.cpgknowledgegraph.ai/mcp x-gsc-mcp: https://mcp.cpgknowledgegraph.ai/mcp x-gsc-inbound: https://x-gsi.ai/ingest x-gsc-timestamp: per-request x-gsc-nonce: per-request
Five parts, one discipline.
| Method | What it is |
|---|---|
| DPU | Digital Proof Unit — the artifact this anchor is named for: a per-GTIN, machine-readable proof object served at /dpu/<gtin>.json, carrying the product, the license, and its compliance state. |
| ECO-10060 | Electronic Compliance Object — the per-jurisdiction compliance object of the SM-ECO-10060 sovereign manifest (fr-eco-10060, uk-eco-10060 …): the territory's rules resolved into a machine-checkable object. |
| Registry 2FA | The second factor for agentic commerce — every transaction claim resolves against this registry before capital moves. Deterministic: it resolves or it stops. |
| HITL | Human-in-the-Loop — two lanes, never mixed. Instant Agent Message for agents (x-gsi.ai/ingest → instantagentmessage.ai, four verbs: submit_rfq, check_rfq_status, escalate_to_human, contact_trading_desk) · the GSC Trading Desk (gsc-navigator.ai) for humans. Machine discovery, human confirmation. |
| Azure | GSC on Microsoft Azure, global and secure — 18 regions, sovereign in-country nodes, the serving region on every response as x-gsc-region. Microsoft AI Cloud Partner. |
What this anchor is. This domain holds the estate's public keyring at /.well-known/jwks.json — four keys, named: gsc-cards-2026-08 (agent cards), gsc-radar-2026-08 (RADAR editions), gsc-x402-receipts-2026-08 (payment receipts), gsc-amp-2026-08 (marketplace records). Every signature on the estate verifies against it. Keys held in Azure Key Vault; private material never leaves it.
Fetch the key. Verify the signature.
Signing keys identify their algorithm, purpose and key id on the public keyring. Private signing material remains under its declared custody. Key rotation is append-only: successor keys are added; retired or revoked identities remain part of the historical record.
Trust follows the issuer.
RCO-A2A records issued by GSC identify gsc-rco-2026-08. Partner RCOs verify against the partner's own JWKS as registered by Consortium-10060. The consortium trust anchor fingerprint is pinned on the keyring page.
Two factors, no passcode.
Human two-factor authentication proves a person is present. Agentic commerce needs the equivalent for software: proof that what an agent is about to buy — and who it is buying from — resolves against a governed registry before capital moves.
The agent decides.
A buyer's AI Agent forms an order: the SKU, the jurisdiction, the counterparty. Logic, not identity — on its own, unverifiable.
The anchor confirms.
Before execution, the claim is checked against the signed facts record at gsc-registry.ai/resolve/<host>, verified against the keys held here; the header read on the wire — operator, D-U-N-S, jurisdiction, liveness — confirms the surface. No resolution, no transaction.
The check is deterministic — a registry lookup and a header read, not a probabilistic guess. A claim either resolves or it does not. Escalation past the boundary goes to a human: Human-in-the-Loop on every purchase order.
Verification is a request, not a promise.
Every surface in the GSC estate answers with its own identity. Send one request to any GSC hostname and read the second factor off the wire.
| Header | Attests |
|---|---|
| x-gsc-node | The emitting surface names itself. |
| x-gsc-jurisdiction | The SM-ECO-10060 member the surface serves under — residency as a checkable claim. |
| x-gsc-operator · x-gsc-duns | GreenCore Solutions Corp., D-U-N-S 24-336-6774. |
| x-gsc-handshake | The signed facts record for this surface — the registry proof itself. |
| x-gsc-card | The signed agent card — identity carried, verifiable against this keyring. |
| x-gsc-timestamp · x-gsc-nonce | Concrete per-request values — liveness, not cached prose. |
| x-gsc-trust-anchor | This keyring. |
Signals, members, and the header canon are published open at mcp.cpgagentprotocols.ai — CPG-68000: SPARKS classifies · SM-ECO-10060 resolves · ACM-68000 signals, seven CPG codes.
The anchored estate
| Surface | Role |
|---|---|
| mcp.cpgknowledgegraph.ai | Data — the CPG Knowledge Graph, powered by SPARKS. |
| mcp.gsc-fleet.ai | Discovery — the Carrier Class fleet. |
| mcp.cpghumanintheloop.ai | Transaction — a human on every purchase order. |
| mcp.gsc-marketplace.ai | Selection — AI Orderability, the x402 payment rail. |
| mcp.cpgagentprotocols.ai | Standards — CPG-68000: SPARKS · SM-ECO-10060 · ACM-68000. |
Figures are published floors — the meter of record is gsc-radar.ai.
Register a catalog. Verify a counterparty.
BPC makers joining the estate, and counterparties with a verification question, reach the registrar here.