fix(identity): regenerate cross-lang fixture corpus for spec-compliant shape

Mirror of node-commerce. Updated regen script to use the spec-compliant input
(services / capabilities / payment_handlers as dicts keyed by reverse-DNS
name) and regenerated all 10 py-* fixtures + synced the 10 node-* fixtures
from the node sibling.

Also corrected the stale docstring in examples/signed_ucp_merchant.py that
claimed "UCP §6 trust-mode requires JWS signature" — UCP doesn't mandate
signing; that's an AgentScore vendor extension for opt-in trust-mode
verifiers (Pura Vida and Shopify-backed UCP merchants ship unsigned).

test_ucp_cross_lang.py: 21/21 pass. The corpus now actually tests
cross-language byte-parity for the spec-compliant shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vvillait88

examples/signed_ucp_merchant.py

@@ -1,9 +1,14 @@
 """Signed UCP profile example — ``/.well-known/ucp`` + ``/.well-known/jwks.json``.
 
-UCP §6 trust-mode verification (Google AI Mode, Gemini commerce) requires the
-profile to carry a JWS signature and the merchant to publish a JWKS endpoint
-verifiers can fetch the public key from. This example wires both routes against
-a persistent signing key (env-loaded for prod, ephemeral for dev).
+AgentScore's ``agentscore-profile+jws`` is a vendor extension layered on top of
+the UCP profile for trust-mode verifiers (Visa AP2 pilots, regulated-commerce
+verifiers) that opt into auditable cryptographic provenance. UCP §6 itself does
+NOT mandate profile-body signing — Pura Vida and other Shopify-backed UCP
+merchants ship unsigned in production today, and live UCP-aware agents (Google
+AI Mode, Gemini commerce, Microsoft Copilot, Perplexity) accept unsigned
+profiles. This example wires both routes against a persistent signing key
+(env-loaded for prod, ephemeral for dev) for verifiers that DO opt into the
+signed envelope.
 
 Run::
 

scripts/regenerate_cross_lang_fixtures.py

@@ -1,14 +1,18 @@
 """Regenerate the full cross-lang fixture corpus (Python side).
 
-Writes all ``py-*.json`` fixtures under ``tests/fixtures/cross-lang/``. Used
-after a canonicalization-relevant change (typ rename, capability-name rename,
-schema-URL rename, key-sort tweak, etc.) where every JWS in the corpus needs
+Writes all ``py-*.json`` fixtures under ``tests/fixtures/cross-lang/``. Used after a
+canonicalization-relevant change (typ rename, capability-name rename, schema-URL
+rename, key-sort tweak, profile-shape change) where every JWS in the corpus needs
 to be re-signed.
 
-Each scenario hand-crafts the profile body, signs with a fresh keypair, and
-writes the ``{profile, jwks, alg, kid, generator}`` envelope. Cross-lang
-verify in ``tests/test_ucp_cross_lang.py`` (and the Node sibling) pulls these
-in alongside the ``node-*`` fixtures generated by the Node sibling.
+Each scenario hand-crafts the profile body using the spec-compliant input shape
+(``services`` / ``capabilities`` / ``payment_handlers`` as MAPS keyed by reverse-DNS
+service / capability / handler name), signs with a fresh keypair, and writes the
+``{profile, jwks, alg, kid, generator}`` envelope. Cross-lang verify in
+``tests/test_ucp_cross_lang.py`` (and the Node sibling) pulls these in alongside the
+``node-*`` fixtures generated by the Node sibling.
+
+Run: ``uv run python scripts/regenerate_cross_lang_fixtures.py``
 """
 
 from __future__ import annotations
@@ -20,9 +24,9 @@
 from agentscore_commerce.identity import (
     AssessResult,
     OperatorVerification,
-    UCPCapability,
-    UCPPaymentHandler,
-    UCPService,
+    UCPCapabilityBinding,
+    UCPPaymentHandlerBinding,
+    UCPServiceBinding,
     UCPSigningKey,
     build_ucp_profile,
 )
@@ -51,82 +55,139 @@ def _envelope(signed: dict[str, Any], public_jwk: dict[str, Any], alg: str, kid:
     }
 
 
+# Spec-compliant binding helpers — each scenario uses these (or variants) so the
+# fixtures cover the full set of canonical UCP fields per binding type.
+
+
+def _shop_service_mcp(host: str) -> UCPServiceBinding:
+    return UCPServiceBinding(
+        version="2026-04-08",
+        spec="https://ucp.dev/2026-04-08/specification/overview",
+        transport="mcp",
+        endpoint=f"{host}/api/ucp/mcp",
+        schema="https://ucp.dev/services/shopping/openrpc.json",
+    )
+
+
+def _shop_service_a2a(host: str) -> UCPServiceBinding:
+    return UCPServiceBinding(
+        version="2026-04-08",
+        spec="https://ucp.dev/2026-04-08/specification/overview",
+        transport="a2a",
+        endpoint=f"{host}/.well-known/agent-card.json",
+    )
+
+
+def _tempo_handler(config: dict[str, Any] | None = None) -> UCPPaymentHandlerBinding:
+    h = UCPPaymentHandlerBinding(
+        id="tempo",
+        version="2026-04-08",
+        spec="https://agentscore.sh/specification/payment-handlers/tempo",
+        schema="https://agentscore.sh/schemas/payment-handlers/tempo.json",
+    )
+    if config is not None:
+        h.config = config
+    return h
+
+
+def _x402_handler(networks: list[str]) -> UCPPaymentHandlerBinding:
+    return UCPPaymentHandlerBinding(
+        id="x402",
+        version="2026-04-08",
+        spec="https://agentscore.sh/specification/payment-handlers/x402",
+        schema="https://agentscore.sh/schemas/payment-handlers/x402.json",
+        config={"networks": networks},
+    )
+
+
+def _stripe_handler(config: dict[str, Any]) -> UCPPaymentHandlerBinding:
+    return UCPPaymentHandlerBinding(
+        id="stripe",
+        version="2026-04-08",
+        spec="https://agentscore.sh/specification/payment-handlers/stripe-spt",
+        schema="https://agentscore.sh/schemas/payment-handlers/stripe-spt.json",
+        config=config,
+    )
+
+
 def main() -> None:
-    # py-minimal
+    # py-minimal — empty maps; just metadata + signing keys.
     kid = "py-minimal-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     profile = build_ucp_profile(
-        name="Minimal Merchant",
-        services=[UCPService(type="rest", url="https://m.example.com")],
-        payment_handlers=[],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://m.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        name="Minimal Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-minimal", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-es256-rails
+    # py-es256-rails — multi-transport service + multi-rail + ES256 signing key.
     kid = "py-es256-rails-ES256"
     key = generate_ucp_signing_key(kid=kid, alg="ES256")
     profile = build_ucp_profile(
-        name="ES256 Merchant",
-        services=[
-            UCPService(type="rest", url="https://a.example.com"),
-            UCPService(type="a2a", url="https://a.example.com/agent-card.json"),
-        ],
-        payment_handlers=[
-            UCPPaymentHandler(name="tempo", config={"rail": "tempo-mainnet", "chain_id": 4217}),
-            UCPPaymentHandler(name="x402", config={"networks": ["base-8453"]}),
-        ],
+        services={
+            "dev.ucp.shopping": [
+                _shop_service_mcp("https://a.example.com"),
+                _shop_service_a2a("https://a.example.com"),
+            ],
+        },
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        payment_handlers={
+            "sh.agentscore.payment.tempo": [_tempo_handler({"rail": "tempo-mainnet", "chain_id": 4217})],
+            "sh.agentscore.payment.x402": [_x402_handler(["base-8453"])],
+        },
+        name="ES256 Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid, alg="ES256")
     _write("py-es256-rails", _envelope(signed, key.public_jwk, "ES256", kid))
 
-    # py-extras-int
+    # py-extras-int — payment_handler config with int + string fields.
     kid = "py-extras-int-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     profile = build_ucp_profile(
-        name="Extras Merchant",
-        services=[UCPService(type="rest", url="https://e.example.com")],
-        payment_handlers=[UCPPaymentHandler(name="stripe", config={"profile_id": "abc", "count": 7})],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://e.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        payment_handlers={
+            "sh.agentscore.payment.stripe-spt": [_stripe_handler({"profile_id": "abc", "count": 7})],
+        },
+        name="Extras Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-extras-int", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-capability — hand-crafted vendor capability (renamed to
-    # sh.agentscore.identity to match the new namespace; the in-fixture name
-    # is independent of the SDK's auto-injection but consistency keeps the
-    # corpus honest about what callers should publish).
+    # py-capability — hand-crafted vendor capability under sh.agentscore.identity.
     kid = "py-capability-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
+    custom_capability = UCPCapabilityBinding(
+        version="1",
+        spec="https://agentscore.sh/specification/identity",
+        schema="https://agentscore.sh/schemas/ucp/sh-agentscore-identity-v1.json",
+        # `extras` flat on the binding — kyc_required is a vendor field on this binding.
+        extras={"kyc_required": True},
+    )
     profile = build_ucp_profile(
-        name="Capability Merchant",
-        services=[UCPService(type="rest", url="https://c.example.com")],
-        capabilities=[
-            UCPCapability(
-                name="sh.agentscore.identity",
-                schema="https://agentscore.sh/schemas/ucp/sh-agentscore-identity-v1.json",
-                version="1",
-                extras={"kyc_required": True},
-            ),
-        ],
-        payment_handlers=[
-            UCPPaymentHandler(name="tempo", config={"rail": "tempo-mainnet", "chain_id": 4217}),
-        ],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://c.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        capabilities={"sh.agentscore.identity": [custom_capability]},
+        payment_handlers={
+            "sh.agentscore.payment.tempo": [_tempo_handler({"rail": "tempo-mainnet", "chain_id": 4217})],
+        },
+        name="Capability Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-capability", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-unicode
+    # py-unicode — multi-byte UTF-8 in name / endpoint / config.
     kid = "py-unicode-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     profile = build_ucp_profile(
-        name="Café 日本 🍷 Merchant",
-        services=[UCPService(type="rest", url="https://日本.example.com")],
-        payment_handlers=[UCPPaymentHandler(name="tempo", config={"note": "メモ"})],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://日本.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        payment_handlers={
+            "sh.agentscore.payment.tempo": [_tempo_handler({"note": "メモ"})],
+        },
+        name="Café 日本 🍷 Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-unicode", _envelope(signed, key.public_jwk, "EdDSA", kid))
@@ -135,13 +196,15 @@ def main() -> None:
     old_key = generate_ucp_signing_key(kid="py-multikey-old")
     new_key = generate_ucp_signing_key(kid="py-multikey-new")
     profile = build_ucp_profile(
-        name="Multi-Key Merchant",
-        services=[UCPService(type="rest", url="https://mk.example.com")],
-        payment_handlers=[UCPPaymentHandler(name="tempo", config={"rail": "tempo-mainnet"})],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://mk.example.com")]},
         signing_keys=[
             UCPSigningKey.from_jwk(old_key.public_jwk),
             UCPSigningKey.from_jwk(new_key.public_jwk),
         ],
+        payment_handlers={
+            "sh.agentscore.payment.tempo": [_tempo_handler({"rail": "tempo-mainnet"})],
+        },
+        name="Multi-Key Merchant",
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=new_key.private_key, kid="py-multikey-new")
     _write(
@@ -155,33 +218,35 @@ def main() -> None:
         },
     )
 
-    # py-emoji-keys — extras with non-ASCII object keys (BMP private use, CJK
-    # compatibility, supplementary plane). Exercises codepoint-vs-UTF-16 sort.
+    # py-emoji-keys — extras at top-level (outside the `ucp` envelope) with non-ASCII
+    # object keys (BMP private use, CJK compatibility, supplementary plane).
+    # Exercises codepoint-vs-UTF-16 sort.
     kid = "py-emoji-keys-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     profile = build_ucp_profile(
-        name="Emoji Keys Merchant",
-        services=[UCPService(type="rest", url="https://emoji.example.com")],
-        payment_handlers=[UCPPaymentHandler(name="tempo", config={})],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://emoji.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        payment_handlers={
+            "sh.agentscore.payment.tempo": [_tempo_handler()],
+        },
+        name="Emoji Keys Merchant",
         extras={
             "a": 1,
             "豈": 2,
-            "": 3,
+            "": 3,
             "🍷": 4,
         },
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-emoji-keys", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-int-boundary — exercises Number.MAX_SAFE_INTEGER round-trip.
+    # py-int-boundary — exercises Number.MAX_SAFE_INTEGER round-trip via top-level extras.
     kid = "py-int-boundary-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     profile = build_ucp_profile(
-        name="Int Boundary Merchant",
-        services=[UCPService(type="rest", url="https://i.example.com")],
-        payment_handlers=[],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://i.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        name="Int Boundary Merchant",
         extras={
             "max_safe_int": 9007199254740991,
             "min_safe_int": -9007199254740991,
@@ -193,9 +258,9 @@ def main() -> None:
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-int-boundary", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-data-driven-claims — exercises the build_ucp_profile data path with
-    # API-shape "missing" sentinels (empty string + None). Both languages MUST
-    # emit identical canonical bytes for this input.
+    # py-data-driven-claims — exercises build_ucp_profile data path with API-shape
+    # "missing" sentinels (empty string + None). Both languages MUST emit identical
+    # canonical bytes for this input.
     kid = "py-data-driven-claims-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     result = AssessResult(
@@ -213,17 +278,16 @@ def main() -> None:
         },
     )
     profile = build_ucp_profile(
-        name="Data Driven Claims Merchant",
-        services=[UCPService(type="rest", url="https://d.example.com")],
-        payment_handlers=[],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://d.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        name="Data Driven Claims Merchant",
         data=result,
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)
     _write("py-data-driven-claims", _envelope(signed, key.public_jwk, "EdDSA", kid))
 
-    # py-typed-claims — exercises the typed AssessResult fields (no raw
-    # fallback). Cross-lang parity check for the typed-field-only call site.
+    # py-typed-claims — exercises typed AssessResult fields (no raw fallback).
+    # Cross-lang parity check for the typed-field-only call site.
     kid = "py-typed-claims-EdDSA"
     key = generate_ucp_signing_key(kid=kid)
     result = AssessResult(
@@ -245,10 +309,9 @@ def main() -> None:
         raw=None,
     )
     profile = build_ucp_profile(
-        name="Typed Claims Merchant",
-        services=[UCPService(type="rest", url="https://t.example.com")],
-        payment_handlers=[],
+        services={"dev.ucp.shopping": [_shop_service_mcp("https://t.example.com")]},
         signing_keys=[UCPSigningKey.from_jwk(key.public_jwk)],
+        name="Typed Claims Merchant",
         data=result,
     )
     signed = sign_ucp_profile(profile.to_dict(), signing_key=key.private_key, kid=kid)