ZeroBeacon trust harness

Four hosted modules and one composed flow. Every call except this page requires an enterprise X-API-Key.

Endpoints

Module	REST	MCP tool
Apathy, audit	`POST /api/trust/apathy/audit` `POST /api/trust/apathy/check` `POST /api/trust/apathy/verify-ref`	`audit_repo` `check_manifest` `verify_ref`
Proven, verify	`POST /api/trust/proven/facts` `POST /api/trust/proven/probe` `POST /api/trust/proven/drift`	`get_facts` `probe_server` `check_drift`
Anchor, certificate	`POST /api/trust/anchor/parse` `POST /api/trust/anchor/verify` `POST /api/trust/anchor/registry`	`parse_address` `verify_address` `registry_info`
Receipts, record	`POST /api/trust/receipts/append` `POST /api/trust/receipts/verify`	`append_receipt` `verify_receipts`
Disputes, routing	`POST /api/trust/disputes/route`	`dispute_route`
Amazon Pay rail (staged, fixture)	`POST /api/trust/amazonpay/propose` `POST /api/trust/amazonpay/capture`	—

MCP transport for the twelve tools above is POST /api/trust/mcp (JSON-RPC, protocol 2025-11-25). The catalogue POST /mcp list is unchanged.

Flow

POST /api/trust/flow

Proposal in (repo, manifest, server, address) → Apathy checks the manifest and Proven reads the measured verdict → an Anchor certificate when the address is already ISSUED in the signed registry, or a refusal that names the failed check. A receipt is recorded on both paths. No certificate is returned when a check fails.

When the server holds an Anchor signing secret, a passing flow also records the certified address once in a separate live registry and re-signs it (registry_source: "live"); a refusal never writes to it. Without the secret, the certificate comes from the demo registry (registry_source: "demo") and the response says live issuance is unconfigured. registry_info and POST /api/trust/anchor/registry report both registries, labelled.