Protocol

UCP

Universal Commerce Protocol

A legal_context link in the checkout carries the ATR hash, before the business signs the checkout. Source: lcp docs: agentic checkouts⁠ (opens in a new tab)

UCP, the Universal Commerce Protocol, is a project of the UCP Authors. Source: ucp.dev⁠ (opens in a new tab) Integra is not affiliated; we read their published interfaces.

Sources (1)

lcp docs: agentic checkouts⁠ (opens in a new tab)

The protocol’s own site⁠The standard’s illustration of this protocol (LCP §C.3)⁠

What it is

UCP is an open standard for the full commerce lifecycle: discovery, catalog, checkout, orders, fulfilment and post-purchase adjustments. Source: LCP §C.3⁠ (opens in a new tab)

Sources (1)

LCP §C.3⁠ (opens in a new tab)

Where the ATR hash rides

The checkout carries the ATR hash and a link to the ATR, before the business signs it.

The standard

The package appends one legal_context entry to the checkout’s links[], carrying the link to the ATR and the ATR hash as its LCP string, before the business signs the checkout. Source: lcp docs: agentic checkouts⁠ (opens in a new tab)

Under UCP’s AP2 Mandates extension, the buyer’s checkout mandate commits to that signed checkout; without it, UCP defines no buyer signature, and the pairing’s record says so. Source: lcp docs: agentic checkouts⁠ (opens in a new tab)

A UCP checkout paid in x402 goes through the payment handler com.integraledger.lcp.x402, whose specification is an LCP profile published with the package; the x402 payment then carries the ATR hash where its own pairing places it. Source: lcp docs: agentic checkouts⁠ (opens in a new tab)

UCP has no extensions map on the checkout response, and a vendor capability activates only where both parties declare it: the base schema is the place a reference is always read. Source: LCP §C.3⁠ (opens in a new tab)

What a payment through it proves

Each pairing’s record states what a payment through it shows, and what it does not, in the package’s own words. These are read from the package when the site is built. Source: lcp docs: pairings reference⁠ (opens in a new tab)

Of these 4 pairings, 2 have the buyer’s signature cover the ATR hash, 0 leave a public proof of it, and 0 let anyone read it back from the chain alone. Source: lcp docs: pairings reference⁠ (opens in a new tab)

Switch to Technical to see each pairing, and the sentence its record states about what a payment through it proves.

Sources (1)

lcp docs: pairings reference⁠ (opens in a new tab)

The standard

ucp/booking/ap2-mandateOpaque ChallengeBuyer signs H: yesH on chain: noPublic proof: noRecoverable from chain: no
Pattern: Opaque Challenge (LCP §8.3.4)⁠ (opens in a new tab)
What a payment through it proves: Before this payment, the buyer signed and paid an agreement transaction carrying this ATR's hash on <network>, recorded in <transaction>. The booking response carried this ATR's hash and link as its legal_context link before the business signed it (ap2.merchant_authorization, the seller's signature). The buyer's checkout mandate, issued by the platform or the user's credential under UCP's AP2 Mandates extension, carries checkout_hash, the SHA-256 of that signed booking, and the seller read the hash from the booking inside it. The seller did not verify the mandate's signature; the PSP verifies the payment mandate over the same booking hash. The seller reported the payment. This does not show that amount, payee or timing match the ATR's content.
LCP profile: ucp/checkout/legal-context⁠ (opens in a new tab)
ucp/booking/unsignedHTTP-layer advisoryBuyer signs H: noH on chain: noPublic proof: noRecoverable from chain: no
Pattern: HTTP-layer advisory (LCP §8.3.7)⁠ (opens in a new tab)
What a payment through it proves: Before this payment, the buyer signed and paid an agreement transaction carrying this ATR's hash on <network>, recorded in <transaction>. The booking response the platform received carried this ATR's hash and link as its legal_context link before the buyer completed the booking, and the ATR was in the seller's storage before that. UCP without the AP2 Mandates extension defines no buyer signature, so the buyer's approval, given in the platform's interface, did not sign the hash. The seller tied the payment to the hash in its report.
LCP profile: ucp/checkout/legal-context⁠ (opens in a new tab)
ucp/checkout/ap2-mandateOpaque ChallengeBuyer signs H: yesH on chain: noPublic proof: noRecoverable from chain: no
Pattern: Opaque Challenge (LCP §8.3.4)⁠ (opens in a new tab)
What a payment through it proves: Before this payment, the buyer signed and paid an agreement transaction carrying this ATR's hash on <network>, recorded in <transaction>. The checkout response carried this ATR's hash and link as its legal_context link before the business signed it (ap2.merchant_authorization, the seller's signature). The buyer's checkout mandate, issued by the platform or the user's credential under UCP's AP2 Mandates extension, carries checkout_hash, the SHA-256 of that signed checkout, and the seller read the hash from the checkout inside it. The seller did not verify the mandate's signature; the PSP verifies the payment mandate over the same checkout hash. The seller reported the payment. This does not show that amount, payee or timing match the ATR's content.
LCP profile: ucp/checkout/legal-context⁠ (opens in a new tab)
ucp/checkout/unsignedHTTP-layer advisoryBuyer signs H: noH on chain: noPublic proof: noRecoverable from chain: no
Pattern: HTTP-layer advisory (LCP §8.3.7)⁠ (opens in a new tab)
What a payment through it proves: Before this payment, the buyer signed and paid an agreement transaction carrying this ATR's hash on <network>, recorded in <transaction>. The checkout response the platform received carried this ATR's hash and link as its legal_context link before the buyer completed the checkout, and the ATR was in the seller's storage before that. UCP without the AP2 Mandates extension defines no buyer signature, so the buyer's approval, given in the platform's interface, did not sign the hash. The seller tied the payment to the hash in its report.
LCP profile: ucp/checkout/legal-context⁠ (opens in a new tab)

Where a sentence names <network> and <transaction>, the pairing’s record fills them in: they name the agreement payment the buyer made first. Source: lcp docs: pairings reference⁠ (opens in a new tab) · Source: lcp docs: the agreement URL⁠ (opens in a new tab)

The rails it settles on

A checkout through this protocol is paid by the provider the checkout names, so it lists no rail of its own.

The live demonstrations are not running on this site at the moment.