# auth.md — cpg-500.io (GreenCore Solutions Corp.)

## Posture

This signal door is **open**: no authentication, no payment, no 402 challenge. x402 is declared as a capability (`x-gsc-x402: ready`) with no terms.

## Enforcement posture — the sign (declared 2026-08-24)

These endpoints are open by design. When the buy side's credential standard reaches GA — expected Q4 2026-Q1 2027 — transactional methods migrate to OAuth 2.1 challenge per the MCP 2025-11-25 specification. Read access stays open. That is not pending work; that is the published plan.

```json
{
  "enforcement_posture": "open-by-declaration",
  "migration_standard": "OAuth 2.1 + PKCE challenge (401 + WWW-Authenticate) on mcp:transact methods, per MCP spec 2025-11-25",
  "migration_trigger": "ecosystem GA of credentialed counterparties (enterprise A2A/MCP buy-side GA)",
  "migration_window": "Q4 2026 - Q1 2027",
  "declared": "2026-08-24",
  "operator": "GreenCore Solutions Corp.",
  "duns": "24-336-6774"
}
```

## Protected resource

- Resource: https://cpg-500.io
- Protected Resource Metadata: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization server (Microsoft Entra): https://login.microsoftonline.com/54939635-2f2e-465a-8526-a907cb3c8ebd/v2.0
- AS metadata mirror: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)

## Agent registration (self-contained flow)

- **Agent audience:** buyer-side and sourcing AI Agents reading CPG-500 / ACM-500.
- **Registration endpoint:** https://gsc-navigator.ai/ — the GSC Trading Desk (human-reviewed; no self-serve dynamic client registration). Intake: the profile door's form on cpg-68000.ai (POST https://formspree.io/f/xjybzzdz with fields name, email, message).
- **Agents' channel:** Instant Messaging — https://x-gsi.ai/ingest → https://mcp.cpghumanintheloop.ai/mcp.
- **Supported method — verified email:** GSC verifies the operator's email, then provisions credentials after review.
- **Credential use:** Microsoft Entra OAuth 2.0 client credentials; Bearer token in the Authorization header. Revocation on request via the same endpoint.

```json
{
  "agent_auth": {
    "skill": "https://cpg-500.io/auth.md",
    "register_uri": "https://gsc-navigator.ai/",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "claim_uri": "https://gsc-navigator.ai/"
  }
}
```

Operated by GreenCore Solutions Corp. · D-U-N-S 24-336-6774