{ "$schema": "https://supply-y.vercel.app/agent-compatibility-report/0.5/schema.json", "object_type": "supply_y_agent_compatibility_report", "report_version": "0.5.0", "generated_at": "2026-07-15T06:10:00Z", "requested_mode": "production_exchange", "subject": { "implementation": "Customer Agent Java integration" }, "target": { "protocol_version": "supply-y/1.0", "integration_profile": "protocol_contract", "implementation_language": "Java 21", "conformance_profile": { "profile_id": "supply-y-agent-conformance/1.0", "profile_version": "1.0.0", "url": "https://supply-y.vercel.app/agent-conformance/1.0/profile.json", "content_digest": "sha-256=:UVD6ZXXvG39jbLWsPaKtPovnvoqDCoiYr4zz8vjTclc=:" }, "skills": [ { "skill_id": "supply-y.core", "version": "0.1.0", "artifact_digest": "sha-256=:mNzQqLDzGSKy/6Ex/cUsTTMl/uMPCPH2/mzfH5LWFI0=:" } ], "connection_profile": { "schema": "https://supply-y.vercel.app/customer-connection-profile.schema.json", "profile_version": "0.1.0", "environment": "production", "status": "incomplete" }, "transport_mode": "unselected", "api_production_available": false, "publisher_trust": "test-only-preview" }, "checks": [ { "check_id": "discovery_manifest", "status": "passed", "evidence": { "executed_by": "Customer Agent conformance runner", "observed_at": "2026-07-15T06:01:00Z", "results": [ { "result_id": "discovery_schema_valid", "status": "passed", "detail": "Discovery validated against its versioned schema." }, { "result_id": "release_manifest_digest_verified", "status": "passed", "detail": "The immutable Protocol 1.0 Manifest digest matched." }, { "result_id": "bundle_digest_verified", "status": "passed", "detail": "The public Bundle and all embedded artifact digests matched." } ] } }, { "check_id": "implementation_contract", "status": "passed", "evidence": { "executed_by": "Customer Agent Java implementation", "observed_at": "2026-07-15T06:02:00Z", "results": [ { "result_id": "object_schemas_loaded", "status": "passed", "detail": "The Java implementation loaded all seven object schemas." }, { "result_id": "openapi_contract_loaded", "status": "passed", "detail": "The Java implementation mapped the Agent API contract." }, { "result_id": "prohibited_fields_enforced", "status": "passed", "detail": "Unknown and prohibited disclosure fields were rejected." } ] } }, { "check_id": "skill_release", "status": "blocked", "evidence": { "executed_by": "Customer Agent Skill installer", "observed_at": "2026-07-15T06:03:00Z", "results": [ { "result_id": "publisher_lifecycle_verified", "status": "blocked", "detail": "The available publisher key is test-only and cannot authorize production use." }, { "result_id": "release_signature_verified", "status": "passed", "detail": "The preview release signature verified for conformance only." }, { "result_id": "artifact_digest_verified", "status": "passed", "detail": "The canonical Core Skill artifact digest matched." }, { "result_id": "operator_approval_required", "status": "passed", "detail": "The installer requires operator approval before activation." } ] } }, { "check_id": "protocol_fixtures", "status": "passed", "evidence": { "executed_by": "Customer Agent Java schema runner", "observed_at": "2026-07-15T06:04:00Z", "results": [ { "result_id": "valid_fixtures_accepted", "status": "passed", "detail": "All seven valid Bundle fixtures were accepted." }, { "result_id": "invalid_fixtures_rejected", "status": "passed", "detail": "All 17 red-team Bundle fixtures were rejected." } ] } }, { "check_id": "cryptographic_profile", "status": "passed", "evidence": { "executed_by": "Customer Agent Java cryptographic adapter", "observed_at": "2026-07-15T06:05:00Z", "results": [ { "result_id": "sender_signature_verified", "status": "passed", "detail": "The sender ES256 vector verified in Java." }, { "result_id": "recipient_decryption_verified", "status": "passed", "detail": "The recipient JWE vector decrypted in Java." }, { "result_id": "tampering_rejected", "status": "passed", "detail": "Changed signatures and ciphertext were rejected." }, { "result_id": "plaintext_hidden_from_supply_y", "status": "passed", "detail": "No platform decryption key was introduced." } ] } }, { "check_id": "key_lifecycle", "status": "blocked", "evidence": { "executed_by": "Customer infrastructure setup", "observed_at": "2026-07-15T06:06:00Z", "results": [ { "result_id": "signing_rotation_enforced", "status": "not_run", "detail": "Production signing key rotation has not been exercised." }, { "result_id": "revocation_enforced", "status": "not_run", "detail": "Production key revocation has not been exercised." }, { "result_id": "non_exporting_key_adapter_verified", "status": "blocked", "detail": "Customer KMS or HSM adapters are not configured." } ] } }, { "check_id": "agent_interoperability", "status": "not_run", "evidence": { "executed_by": "Customer Agent integration workspace", "observed_at": "2026-07-15T06:07:00Z", "results": [ { "result_id": "sender_recipient_exchange_completed", "status": "not_run", "detail": "The customer Java Agent has not exchanged with a second company Agent." }, { "result_id": "receipt_signature_verified", "status": "not_run", "detail": "No customer recipient receipt exists yet." }, { "result_id": "duplicate_payload_copy_rejected", "status": "not_run", "detail": "Single-path payload custody has not been tested in the customer environment." }, { "result_id": "transport_binding_verified", "status": "not_run", "detail": "The customer has not selected Native or Catena-X transport." } ] } }, { "check_id": "policy_receipt", "status": "passed", "evidence": { "executed_by": "Customer Agent Java policy adapter", "observed_at": "2026-07-15T06:08:00Z", "results": [ { "result_id": "receipt_signature_verified", "status": "passed", "detail": "The committed Policy Receipt signature vector verified." }, { "result_id": "package_binding_verified", "status": "passed", "detail": "Package and policy digest mismatch cases were rejected." }, { "result_id": "eligibility_gate_enforced", "status": "passed", "detail": "Ineligible Package decisions prevented local transmission." } ] } }, { "check_id": "customer_integration", "status": "not_run", "evidence": { "executed_by": "Customer infrastructure setup", "observed_at": "2026-07-15T06:09:00Z", "results": [ { "result_id": "connection_profile_valid", "status": "not_run", "detail": "The production connection profile is incomplete." }, { "result_id": "credentials_referenced_not_embedded", "status": "not_run", "detail": "Production OAuth and key references are not configured." }, { "result_id": "notification_path_verified", "status": "not_run", "detail": "Production webhook or polling delivery has not run." } ] } } ], "key_custody": { "sender_signer": "not_configured", "recipient_decrypter": "not_configured", "private_key_exported": false }, "missing_configuration": [ "supply_y_api_url", "oauth_client", "organization_id", "agent_id", "approved_skill", "signing_key", "encryption_key", "transport_mode", "disclosure_policy", "notification_delivery" ], "decision": { "recommendation": "do_not_enable", "scope": "production_exchange", "production_use_allowed": false, "reasons": [ "The hosted production API and production Skill publisher trust are unavailable.", "Customer key adapters, peer interoperability, transport and production configuration are incomplete." ] }, "summary": "The Java Agent proves the language-neutral contract without an SDK dependency, but it must not enable production exchange until every customer-environment result and production trust requirement passes." }