generated: '2026-08-01'
method: derived
source: well-known/ + mcp/ + openapi/ artifacts in this repo
note: >-
  Asserts which cross-cutting standards Liquid Death's public surfaces conform to, each with the
  evidence it was derived from. No compliance certification program is published by Liquid Death, so
  no Compliance pointer is emitted for this repo.
standards:
  - id: ucp-2026-04-08
    name: Universal Commerce Protocol 2026-04-08
    conforms: true
    evidence: /.well-known/ucp advertises version 2026-04-08 with a dev.ucp.shopping MCP service endpoint
    spec: https://ucp.dev/2026-04-08/specification/overview/
  - id: mcp
    name: Model Context Protocol
    conforms: true
    evidence: UCP shopping service is exposed with transport "mcp" at https://liquiddeath.myshopify.com/api/ucp/mcp
  - id: json-rpc-2.0
    name: JSON-RPC 2.0
    conforms: true
    evidence: MCP endpoint returns a well-formed JSON-RPC 2.0 error object (observed 2026-08-01)
  - id: openrpc-1.3.2
    name: OpenRPC 1.3.2
    conforms: true
    evidence: the merchant profile declares https://ucp.dev/2026-04-08/services/shopping/mcp.openrpc.json as its MCP schema
  - id: oidc-discovery
    name: OpenID Connect Discovery 1.0
    conforms: true
    evidence: /.well-known/openid-configuration returns 200 with issuer, jwks_uri, and claims_supported
  - id: rfc8414
    name: RFC 8414 OAuth 2.0 Authorization Server Metadata
    conforms: true
    evidence: /.well-known/oauth-authorization-server returns 200 with a complete metadata document
  - id: oauth2
    name: OAuth 2.0
    conforms: true
    evidence: authorization_code and refresh_token grants advertised at account.liquiddeath.com
  - id: rfc7636
    name: RFC 7636 PKCE
    conforms: true
    evidence: code_challenge_methods_supported includes S256
  - id: rfc7523
    name: RFC 7523 JWT Bearer grant
    conforms: true
    evidence: grant_types_supported includes urn:ietf:params:oauth:grant-type:jwt-bearer
  - id: llmstxt
    name: llms.txt convention
    conforms: true
    evidence: /llms.txt returns 200 with a well-formed agent instruction document
  - id: agents-md
    name: AGENTS.md / agents.md convention
    conforms: true
    evidence: /agents.md returns 200 and is declared canonical in robots.txt and sitemap_agentic_discovery.xml
  - id: idempotency-key
    name: Idempotency-Key header convention
    conforms: true
    evidence: UCP meta.idempotency-key maps to the HTTP Idempotency-Key header; mandatory on complete_checkout, cancel_checkout, cancel_cart
  - id: sitemaps-org
    name: sitemaps.org protocol
    conforms: true
    evidence: /sitemap.xml returns a valid sitemapindex, including a dedicated agentic-discovery sitemap
  - id: rfc9457
    name: RFC 9457 Problem Details
    conforms: false
    evidence: no application/problem+json responses observed on either surface
  - id: rfc9116
    name: RFC 9116 security.txt
    conforms: false
    evidence: /.well-known/security.txt returned 404 on liquiddeath.com
  - id: rfc9727
    name: RFC 9727 API catalog
    conforms: false
    evidence: /.well-known/api-catalog returned 404
  - id: a2a
    name: A2A Agent Card
    conforms: false
    evidence: /.well-known/agent-card.json and /.well-known/agent.json returned 404 on all three hosts
  - id: openapi
    name: OpenAPI
    conforms: false
    evidence: >-
      Liquid Death publishes no OpenAPI. The spec in openapi/ was generated by API Evangelist from the
      endpoints the provider documents in /agents.md, not harvested from the provider.
  - id: asyncapi
    name: AsyncAPI
    conforms: false
    evidence: no event, streaming or webhook surface is published on any Liquid Death host
  - id: graphql
    name: GraphQL
    conforms: false
    evidence: no GraphQL endpoint advertised