RCO-A2A

rco-a2a.ai — Regulatory Compliance Object resolver for AI Agents. Signed, versioned, per-jurisdiction compliance state. mcp.rco-a2a.ai

A Regulatory Compliance Object (RCO) is the signed, deterministic, machine-verifiable compliance state of one object in one jurisdiction: a GTIN in an SM-ECO-10060 member node, resolved upstream against that jurisdiction's versioned rule set and served as one record with one signal and one state. Agents consume the result of the rules, not the rules themselves. The record names the rule set it was resolved under (id, version, hash), the evidence it rests on, the issuer and the key that signed it; the agent reads the record, verifies the signature, and acts. Nothing is resolved at request time and nothing is narrative.

Canonical endpoint: https://mcp.rco-a2a.ai/mcp (streamable-http, no auth on the read tools, typed errors).

This repository is the MIT protocol layer and the connect kit: the record schema, rule-set schema, issuer-registry schema, tool contract, signature test vectors and fleet manifest under schema/, plus runnable examples against the live resolver. The GSC rail (records, rule sets, keys, fleet operation) is a proprietary GSC service. Nothing here carries a key, a secret or a customer.

Tools

Tool	What it does
resolve_compliance	Return the current signed RCO for an object in a jurisdiction. Inside the resolved universe an unknown object returns a pre-resolved, signed CPG-404 record; outside it the typed error record_not_found.
get_record	Return any RCO by record_id, including superseded records: the audit trail, retained byte-identical.
list_issuers	Return the signed consortium issuer registry, verbatim as published at consortium-10060.org/issuers.json.
list_rule_sets	List the versioned rule sets in force and formerly in force for a jurisdiction: id, version, hash, effective dates, artifact URL. Never the regulation text.
publish_record	Issuer-only. The one write path in the suite: publishes a signed RCO to the partner rail (rco-a2a-cpg.ai) and accepts only what already verifies against the issuer's own registered key. Behind the partner door, key per issuer.

Keyring and record signing

• Keyring: https://dpuone.ai/.well-known/jwks.json. GSC records carry key_id gsc-rco-2026-08 and verification_url pointing at that keyring; the keyring is rooted in the signed issuer registry at https://consortium-10060.org/issuers.json.
• Signature: detached JWS Compact Serialization (RFC 7515 with RFC 7797 b64:false), ES256 over the RFC 8785 canonical JSON of the record with the signature member removed. The signature field is BASE64URL(protected) || '..' || BASE64URL(signature). Verification verifies every byte of the canonical signing payload; nothing claims to reproduce signature bytes. Test vectors with a published test key: schema/v1.2/signature-test-vectors.json.
• Trust anchor: the consortium key gsc-consortium-2026-08 is pinned on the dpuone keyring page and in DNS at _trust-anchor.consortium-10060.org.

Current record-holding records

The record-holder is the pair GTIN × jurisdiction; nothing else is a unit. resolve_compliance returns the current record for the pair. When a pair is re-resolved, a new record is issued with the next sequence number and its supersedes field names the record it replaces; the superseded record is never modified or removed and stays retrievable by get_record. The record_id carries the sequence: rco:<issuer>:<object_id>:<jurisdiction>:<n>. The published list of current record-holding pairs on the GSC rail is https://rco-a2a.ai/schema/v1.3/record-holders.json.

Examples

Walk	Python	TypeScript
one worked territory (IT-ECO-10060, GTIN 00990832300082): resolve_compliance, verify the signature against the keyring, get_record on the record and down its supersedes chain; then the same chain walk on the rail's one supersession pair, for the shape of a chain with depth	examples/rco_walk.py	examples/rco_walk.ts

Python 3 standard library (cryptography for the signature check when installed). TypeScript runs on Node 24 as-is (node examples/rco_walk.ts) with no dependencies. Each script prints what it got and stops. Live endpoint only.

The full 19-territory pull for the elyssah case study, with the re-cut script, lives in the elyssah connect kit: https://github.com/greencore-solutions/elyssah/tree/main/rco — it pulls from this resolver; it is not duplicated here.

Sources on the wire

https://rco-a2a.ai · https://rco-a2a-bpc.ai (GSC rail) · https://rco-a2a-cpg.ai (partner rail) · https://status.rco-a2a.ai · https://dpuone.ai/.well-known/jwks.json · https://consortium-10060.org/issuers.json · https://sm-eco-10060.org · https://acm-68000.org

Registry listing: io.github.greencore-solutions/rco-a2a. Anthropic connector directory: rco-a2a.

---

GreenCore Solutions Corp. — 4611 Viking Way, Suite #260, Richmond BC V6V 2K9 Canada GSC Agentic Pty Ltd — Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia

Operated by GreenCore Solutions Corp. · https://gsc-em.com · @GSC_Rail_ai · @ACM68000