# Publisher trust: monitoring, re-scans and a scoped pre-flight verdict for every claimed server

The trust bundle over a claimed publisher server, composed from three live catalog services and callable today. Computed live from the platform state on every read: 0 claims on live accounts (0 verified, 0 pending), 0 with a monitoring target, 0 monitoring checks sealed for those targets and 0 vetting scans recorded for claimed servers. Scoped verdicts across live claims: avoid 0, proceed 0, proceed_with_caution 0, insufficient_history 0. Every number in this document is computed live from the platform state at the moment of the read — the usage counts from the publisher claims of live accounts (sandbox and canary accounts excluded), the monitoring targets and sealed checks matching those claims' endpoints, the vetting scans recorded for the claimed servers, and a scoped pre-flight verdict computed for every live claim at this same read. Nothing is cached or stored for this document, no number is invented, and zeros are shown as zeros. The public documents show a claimed server's public claim view and aggregate counts only; the owner tenant, the claim proof token and any credential never appear in any public output. The publisher trust bundle is not charged today; verification is free and needs no key.

Data: https://www.a2ally.com/v1/publisher-trust · For publishers: https://www.a2ally.com/for-publishers · Catalog: https://www.a2ally.com/services · Pricing: https://www.a2ally.com/pricing

## 73. Uptime + behavior monitoring for agent endpoints

proof-carrying alerts. State: live.

## 85. Skill/plugin vetting scans

the Rightshold resource-scan, productized for any agent stack. State: live.

## 15. Counterparty pre-flight check

"should you transact with this agent?" verdict API. State: live.

## How the bundle works

The publisher_trust entitlement is one bundle over three live catalog services, composed for a claimed publisher server: endpoint monitoring (catalog service 73), vetting scans (catalog service 85) and the counterparty pre-flight check (catalog service 15). The bundle itself is not a separate charge: charged_today is false, price_today_usd_cents is 0 and founder_eligible is true, and no price figure appears anywhere in these surfaces — each component keeps its own catalog entitlement, pulled live from the services catalog, and pricing for anything is referenced by the pricing URL only. The bundle reads and writes only through the components' own machinery: monitoring through the endpoint-health targets, re-scans through the vetting scans, and the verdict through the counterparty pre-flight rule scoped to the claim.

Monitoring rule: the owner of a claim registers the claim's endpoint for monitoring with POST /v1/publisher-trust/claims/{id}/monitor — the claim's endpoint_url becomes an endpoint-health target on the owner's account through the endpoint monitoring machinery (GET method, the default check interval). Registration is idempotent: a repeat call returns the existing target instead of registering a second one. A claim's monitoring summary reads the owner's targets whose stored URL matches the claim's endpoint — the endpoint URL is stored in its normalized form, so both the normalized and the as-claimed forms are matched — together with the checks sealed for those targets; a claim with no matching target reads registered false with null state, never an invented state.

Re-scan rule: the owner of a claim records a fresh vetting scan of the claimed server with POST /v1/publisher-trust/claims/{id}/rescan, sending the server's current bytes as content (1 to 131072 characters) and an optional version_label. The scan is recorded by the vetting-scan machinery itself — artifact_name is the claim's server_name, artifact_kind is mcp_server and source_url is the claim's endpoint_url — analyzed in memory, never stored, and sealed by that machinery. Version change is decided by the content hash, never by the label: version_changed is true when a previous scan for the same server exists under this account and the new scan's artifact_sha256 differs from it, and false on the first scan and when the hash is unchanged; the rescan block names the previous scan's id and hash either way. In the bundle view the latest scan for a server is current and every earlier scan is superseded.

Publisher trust scoped pre-flight verdict rule: if the bound agent's passport status is suspended, the verdict is avoid. Otherwise, if the claim proof status is pending, the verdict is proceed_with_caution (the namespace is not yet proven). Otherwise, if the latest vetting scan for the claimed server exists and its checks_flagged is above 0, or the claimed endpoint's monitoring target last checked not-ok, the verdict is proceed_with_caution. Otherwise, the verdict is the base counterparty pre-flight verdict for the bound agent, computed by the counterparty pre-flight rule from the agent's passport status and skeleton reputation score.

The scoped verdict is plain arithmetic over public sealed records and the claimed server's own recorded evidence only (the bound agent's passport status and skeleton reputation score, the claim's proof state, the latest vetting scan's flagged-check count and the monitoring target's latest state), not a credit decision, not financial/legal advice, not a guarantee of performance; insufficient_history means too little sealed history to judge — it is NOT a negative finding about the agent or the server; a proceed verdict does not guarantee the server will perform. The base verdict inherits the counterparty pre-flight limits: The verdict is plain arithmetic over public sealed records only (passport status + skeleton reputation score), not a credit decision, not financial/legal advice, not a guarantee of performance; insufficient_history means too little sealed history to judge — it is NOT a negative finding about the agent; a proceed verdict does not guarantee the counterparty will perform.

## Callable surfaces

- GET /v1/publisher-trust (free, no key) — this index document: the publisher_trust entitlement, the three component services with their catalog facts and entitlements, the entitlement, monitoring, re-scan and pre-flight rules, the callable surfaces and the live usage counts
- POST /v1/publisher-trust/claims/{id}/monitor (account key, owner only) — register the claim's endpoint as a monitoring target for the owner through the endpoint monitoring machinery (GET method, default interval); idempotent — a repeat returns the existing target
- POST /v1/publisher-trust/claims/{id}/rescan (account key, owner only) — record a fresh vetting scan of the claimed server from submitted content (1 to 131072 characters, with an optional version_label) through the vetting-scan machinery, and report whether the version changed — the new scan's hash against the previous scan's hash for the same server
- GET /v1/publisher-trust/claims/{id}/preflight (free, no key) — the scoped pre-flight verdict for one claimed server: the base counterparty pre-flight verdict for the bound agent, scoped by the claim's proof state, the latest vetting scan's flagged count and the endpoint's monitoring state, under the printed verdict rule
- GET /v1/publisher-trust/claims/{id} (free, no key) — one claimed server's trust bundle: the claim's public view, the publisher_trust entitlement, its monitoring summary, its vetting summary with drift status and its scoped pre-flight verdict
- GET /v1/publishers (free, no key) — the publisher claim index and public directory this bundle builds on
- GET /v1/endpoint-monitoring (free, no key) — catalog service 73, the monitoring component
- GET /v1/vetting-scans (free, no key) — catalog service 85, the vetting-scan component
- GET /v1/counterparty-preflight (free, no key) — catalog service 15, the pre-flight component the scoped verdict falls through to