RCTP Core Concepts

The Re-Commerce Trust Profile (RCTP) is an open profile of the Universal Commerce Protocol (UCP) and the Agent Payments Protocol (AP2) for person-to-person trade in second-hand goods, where one or both sides act through an AI agent. It defines only what UCP and AP2 leave open: negotiation, a seller's private limits, an enforcement decision on every agent call, and signed proof. Everything else is UCP.

What RCTP solves

UCP is built around retail. A business publishes a price, stands behind the item as merchant of record, and an agent's job is to discover the offer and pay for it. A second-hand deal between two people breaks four of those assumptions at once.

The one party both people already trust is the marketplace. RCTP makes it the enforcement point: agents can be clever, but they cannot change a rule, see a secret, or move money. The marketplace holds the rules, applies them to every call, and signs what happened.

Key goals

Roles & participants

RCTP names roles, never companies. Every agent call passes through the marketplace.

Core concepts

RCTP revolves around five constructs. Each answers one of the four broken assumptions, and none redefines anything UCP or AP2 already defines.

# a buyer offers under the floor: refused, the floor never stated
RCTP-Decision: forbid;action="offer.create";reason=below_floor

# the seller's agent accepts within terms, at tier ask
RCTP-Decision: ask;approval_id="apr_01K8ZB7";expires_in=900;on_timeout=deny

# a buyer probing for the floor runs out of offers
RCTP-Decision: forbid;reason=offer_budget_exhausted;retry_after=3600

Capabilities & verbs

RCTP declares two standalone UCP capabilities. Neither extends dev.ucp.shopping.checkout: an offer exists before any checkout does, and accepting one produces it.

Verbs read as the story of a deal: listing.* puts an item up, offer.* works toward a price, deal.* runs the agreed trade. A verb's prefix names its capability, and its scope is {capability}:{scope}, as in UCP Identity Linking.

Discovery

RCTP adds nothing to UCP discovery. The marketplace's profile at /.well-known/ucp lists the two RCTP capabilities with their config, declares the RCTP scopes and tiers in dev.ucp.common.identity_linking, and publishes its signing keys. Agents name their own profile on every call with UCP-Agent; an operator's profile adds a dev.rctp.operator entry with its legal entity, jurisdiction and incident contact.

{
  "ucp": {
    "version": "2026-08-25",
    "capabilities": {
      "dev.rctp.listing": [{ "version": "2026-11-draft5",
        "config": { "term_sets": ["goods.small/1"] } }],
      "dev.rctp.deal": [{ "version": "2026-11-draft5",
        "config": {
          "offer_expiry": { "default_seconds": 172800, "max_seconds": 604800 },
          "offer_budget": { "per_agent": 3, "per_operator": 10, "window_hours": 24 } } }],
      "dev.ucp.common.identity_linking": [{ "version": "2026-08-25",
        "config": { "scopes": {
          "dev.rctp.deal:offer_accept":  { "default_tier": "ask",  "allowed_tiers": ["ask", "auto"] },
          "dev.rctp.listing:create":     { "default_tier": "ask",  "allowed_tiers": ["ask"] }
          // … one entry per scoped verb
        } } }]
    }
  },
  "keys": [{ "kid": "S1qDUEozf3a-2kEg7jyXV9dikUd_9Wfgc3q3bKGpj1o",
             "kty": "EC", "crv": "P-256", "alg": "ES256", … }]
}

Trimmed from the reference gateway's profile. Key IDs are the key's RFC 7638 thumbprint, which is what binds a grant to the key that signs each call. The expiry and budget numbers are the reference defaults; each marketplace publishes its own.

Life of a deal

1. Connect. The seller grants an agent its verbs and tiers on the marketplace's consent screen. No prices.
2. List. The agent calls listing.create; the seller sets the terms on the approval page and signs with their passkey.
3. Offer. A buyer agent offers on Deal Terms. Below the floor it is refused below_floor; otherwise it reaches the seller agent.
4. Negotiate. Counters and re-offers, linked by negotiation_id and supersedes, each with an expiry.
5. Accept. The seller side accepts at its tier; the listing is reserved and the offer becomes a single-use checkout.
6. Pay. The buyer redeems the checkout; the holder of funds signs funds_held.
7. Hand over. The seller commits to ship; the carrier signs shipped and delivered.
8. Confirm. The buyer agent signs accepted, and the holder signs released. Or rejected, a signed return, and a refund.

Fixed rules & invariants

Six rules are fixed. Everything else is an open value named by reverse domain, as in UCP.

Conformance tests hold implementations to nine invariants, each of which has a test vector that records both the correct result and the plausible wrong one.

Relationship to UCP & AP2

Where UCP or AP2 defines a verb or noun, RCTP uses it.

Out of scope: booking and tracking shipments, moving money, negotiation strategy and pricing, identity-proofing methods, transports. RCTP composes with the standards that cover them.

Namespace & versioning

RCTP lives under dev.rctp.*, governed at rctp.dev, and follows UCP's reverse-domain model: anyone can add a term set, an event type or an attestation type under their own domain (for example example.carrier:picked_up_sealed), and parties that don't recognise it treat it as informative and never let it change a decision. Capabilities carry a draft version, currently 2026-11-draft5, and pin a UCP release (2026-08-25). A breaking change increments the version; a deployment may serve the previous version beside it for at most 90 days.

Status