OACP Truth Inventory

Evidence-backed inventory of what is implemented, gated, missing, or stale across the current OACP split.

Canonical end-to-end flow: OACP authority overview.

This inventory is based on the Grantex C6Z authority route, the OACP artifact signer, verifier, key store, status list and artifact store, mandates, the ledger routes, the protocol surfaces, and tests in apps/auth-service, as merged to main and deployed on 2026-10-20 (status).

Truth Table

Category	Grantex reality	Owner/action
Implemented runtime	C6Z authority endpoint under commerce auth; allowlisted AgenticOrg service-token access; artifact issuance signed with an ES256 detached JWS over the RFC 8785 envelope by a DB-backed OACP issuer key published in /.well-known/jwks.json; persistence of every issue and refusal (oacp_artifacts); replay, read and revoke routes; an OACP Token Status List entry on every artifact and a signed revocation artifact on revoke; artifact safety checks; TTL; adapter mapping payloads; Intent, Cart and Payment mandates as ES256 JWTs (AP2-mapped claims, on the OACP Token Status List, revocable with their descendants, every refusal recorded) with presence and amr from the Commerce Passport and a passkey assertion over the cart’s checkout_hash for human_present carts; suspension and reinstatement of artifacts and mandates; arbiter decision ledger with machine-profile decision grants, audit witness checkpoints and the wallet ledger hash chain; UCP business profile, ACP delegate-payment allowance and order events, @grantex/mcp-auth identity-linking scopes; x402 / MPP settlement receipts as signed commitment_evidence; profile-driven agent request signatures; the POS handoff boundary in policy and protocol artifacts (no POS evidence reaches Grantex today, so mandate_capability says offline_pos_evidence_status: "unverified"). Before this, the signature was a template string checked by string equality; that code is deleted. AgenticOrg owns implemented tenant/merchant/seller scoped commerce config and Shopify runtime sync.	Grantex keeps tests and guard scans current.
Implemented in source, not released	OACP artifact and mandate verifiers in the TypeScript, Python and Go SDKs, the oacp conformance suite, @grantex/agent-httpsig profiles, the @grantex/x402 receipt helpers, the @grantex/mpp Payment scheme, and @grantex/mcp-auth commerce scopes.	Release through the normal package process; until then, build from the repository.
Implemented docs only	Historical Commerce V1 PRDs, launch plans, C6 review reports, and publication drafts.	Mark as historical where they conflict with this architecture.
Implemented but not broad launch	Commerce V1 payment-control pilot code and Plural sandbox/UAT-compatible adapter paths exist separately from the AgenticOrg OACP runtime split.	Keep separate from OACP authority docs.
Requires credentials or approval	COMMERCE_C6Z_AUTHORITY_SERVICE_TOKEN, COMMERCE_C6Z_AUTHORITY_SERVICE_TENANTS, the first OACP issuer key (POST /v1/commerce/oacp/issuer-keys/rotate; none exists in production on 2026-10-20), OACP_PUBLIC_DISCOVERY_ISSUANCE_ENABLED=true before any merchant’s public discovery can be issued enabled, OACP_STATUS_LIST_PUBLIC_ENABLED=true for relying-party status checks (off in production on 2026-10-20), HTTP_SIGNATURE_DIRECTORY_ENABLED, REGISTRY_SCHEME_AGENT_IDS_ENABLED and AGENT_PASSPORT_KYA_TIER_ENABLED (all off by default), merchant/AgenticOrg tenant approval, production key custody, provider or bank rail approval, POS callback approval, and external channel approvals.	Ops owner must collect evidence before public claims.
Missing	Public standards approval, broad external protocol partner program, universal buyer-surface rollout, live non-Shopify source adapters, live bank/custom provider adapters, live POS provider approval, and order/payment/POS execution through OACP artifacts (mandates authorise; the provider executes). SD-JWT VC mandates (AP2 v0.2) and a buyer-signed Trusted Surface are not implemented. Grantex writes no commerce_orders rows and sends no outbound ACP webhooks. Per-key signatures on the registry key directory need agent-held keys and are not implemented (the registry countersigns).	Treat as pending runtime/product gaps.
Stale/confusing docs	Older copy that says Grantex is the merchant connector runtime or payment-control loop for every buyer interaction.	Supersede with OACP authority docs and link here.

Evidence Pointers

• Route: apps/auth-service/src/routes/commerce-oacp-runtime.ts
• Artifact logic: apps/auth-service/src/lib/commerce/oacp-runtime-vertical.ts
• Trust helpers: apps/auth-service/src/lib/commerce/oacp-trust-artifacts.ts
• Signer and verifier: apps/auth-service/src/lib/commerce/oacp-jws.ts
• Issuer keys: apps/auth-service/src/lib/commerce/oacp-issuer-keys.ts
• Status list: apps/auth-service/src/lib/commerce/oacp-status.ts, route routes/oacp-status.ts
• Persistence, replay, revocation: apps/auth-service/src/lib/commerce/oacp-artifact-store.ts
• Migrations: apps/auth-service/src/db/migrations/133_oacp_issuer_keys_artifacts.sql, 134_commerce_ledger.sql, 135_oacp_mandates.sql, 136_agent_network_identity.sql
• Mandates: apps/auth-service/src/lib/commerce/mandates.ts (issuance, persistence, revocation), oacp-mandate-jwt.ts (claims, signer, verifier), route routes/commerce-oacp-mandates.ts; decision: OACP mandates decision
• Ledger: lib/commerce/oacp-arbiter-decisions.ts (route routes/commerce-oacp-arbiter.ts), lib/audit-witness.ts (route routes/audit-witness.ts)
• Protocol surfaces: lib/commerce/ucp-profile.ts, acp-delegate-payment.ts, acp-order-events.ts (routes commerce-oacp-runtime.ts, commerce-oacp-acp.ts); settlement receipts settlement-evidence-store.ts (route commerce-oacp-settlement-evidence.ts)
• Adapter preview (route-mounted, unsigned): schemaorg-preview.ts only. The UCP-style, ACP-style and AP2-style previews are removed; the UCP profile (ucp-profile.ts) is rendered from issued artifacts and AP2 is served by signed mandates (mandates.ts).
• Tests: commerce-c6z-runtime-artifact-authority.test.ts, commerce-c6w2-oacp-artifact-authority.test.ts, oacp-jws-vectors.test.ts, oacp-canonicalization.test.ts, commerce-oacp-artifacts-postgres.integration.test.ts, oacp-mandate-vectors.test.ts, commerce-oacp-mandates-postgres.integration.test.ts, commerce-presence-amr.test.ts, commerce-oacp-suspension-auth.test.ts, commerce-oacp-arbiter-decisions.test.ts, audit-witness-checkpoints.test.ts, commerce-ucp-profile.test.ts, commerce-acp-delegate-payment.test.ts, commerce-acp-order-events.test.ts, commerce-settlement-receipt-evidence.test.ts

Pending Runtime Gaps

Gap	Owner	Action
External protocol approval	Grantex + partners	Create a public partner review process and evidence checklist before making official status claims.
Production turn-on	Grantex operator + owner	Create the first OACP issuer key, then turn on OACP_STATUS_LIST_PUBLIC_ENABLED, in that order (runbook).
AgenticOrg production tenant rollout	AgenticOrg + Grantex	After the turn-on: allowlist tenant, rotate service token, verify source evidence intake, and run authority request smoke. AgenticOrg’s arbiter, ledger, protocol surfaces and mandate client are still in review in AgenticOrg.
Non-Shopify source adapters	AgenticOrg + merchants	Keep WooCommerce, ERP, PIM, OMS, WMS, and custom API configs as pending adapter until connector code, source precedence, tests, and approvals exist.
Provider or bank rail execution	Pine Labs Plural/P3P, banks, fintech/custom providers + merchant + AgenticOrg	Complete provider-owned approval, webhook, rollback, and human review path. Grantex stores only non-sensitive evidence refs where needed.
Buyer-surface approvals	AgenticOrg + channel owners	Verify WhatsApp, Telegram, MCP, OpenAPI, A2A, and web policies before public launch.

Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: [e-mail] or [e-mail].