Independent platform-provider implementation (pre-spec) — GoMag network, signed TSO layer

[AdiVlop]

Hi UCP team & community,

I'm Adrian, founder of CatyAI / PayAi-X (Romania). Sharing an independent
implementation for visibility and to offer feedback from the field.

We built the core UCP primitives — well-known discovery manifest, Ed25519
signing, deterministic capability declarations — independently and prior to
the public spec, as a zero-trust middleware preventing AI hallucination on
commerce data. Now aligned to 2026-04-08.

Live & verifiable:

• Manifest: https://api.catyai.io/.well-known/ucp (Grade A on ucpchecker.com)
• JWKS (dual-key): https://api.catyai.io/.well-known/jwks.json — Ed25519 V1/V2
  for discovery + ES256/P-256 for AP2 CartMandate
• MCP server, 47 tools: https://api.catyai.io/api/mcp (tools/list, JSON-RPC)

What we bring as a platform provider: native integration with GoMag
(4,500+ EU merchants) — UCP-ready through a single deployment, not
per-merchant onboarding.

Two questions:

1. What's the current path for platform-provider sandbox access?
   (interest form submitted, Case 28139441940)
2. On the temporal-validity discussion (📢 Heads up: A New Version of UCP is Coming soon! #328): we sign every commercial
   data point as a Trust State Object with validity windows — happy to
   share the approach if useful to that thread.

Thanks for building this in the open.