Conformance & CI

Once your agent talks to Artos, keep it honest: verify the deployment still satisfies the UCP contract your client relies on, and gate that check in CI so a drift fails the build instead of a buyer’s checkout.

artos conformance

The CLI ships a conformance runner that probes a live deployment and prints a pass / warn / fail report. It exits non-zero if any required check fails (warnings don’t fail the run), so it drops straight into a pipeline.

npx @artos-commerce/ucp-cli conformance \
  --api https://api.artos.sh \
  --key "$UCP_PLATFORM_API_KEY"

What it checks:

Add --store <slug> to verify a specific merchant can be checked out (signing keys present), and --json for a machine-readable report:

npx @artos-commerce/ucp-cli conformance --store acme --json

The auth-challenge and oauth-scopes warnings map directly to the silent-refresh checklist — if either warns, refresh-without-reconsent will not work.

In CI

Smoke-gate a deployment (GitHub Actions)

Run conformance against your target deployment on every push, before promoting:

name: ucp-conformance
on: [push]
jobs:
  conformance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: UCP conformance
        env:
          UCP_PLATFORM_API_KEY: ${{ secrets.UCP_PLATFORM_API_KEY }}
        run: |
          npx @artos-commerce/ucp-cli@latest conformance \
            --api https://api.dev.artos.sh \
            --key "$UCP_PLATFORM_API_KEY" \
            --json

Use https://api.artos.sh for production gates. Point --store <slug> at a store that exists on the target environment (see Use the CLI).

Keep your signing path byte-parity

If you sign AP2 mandates yourself, the SDK ships frozen verification vectors (a fixed public key plus accept/reject merchant_authorization and detached-JWS cases). Verification is deterministic, so the same vectors pass in every repo — assert them in your own suite to catch a canonical-form drift before it breaks a signed checkout. The vectors ship in the published @artos-commerce/ucp-client package at test/test-vectors/ap2-verify.json (and canonical-json.json).

Local sanity check

Before pushing, artos doctor checks your own connection (key, API, OAuth metadata, and your published agent profile):

npx @artos-commerce/ucp-cli doctor

Test capability negotiation with hosted fixtures

These docs host static agent-profile fixtures at https://docs.artos.sh/ucp/agent-profiles/2026-04-08/… — point your UCP-Agent header at one to exercise how the API negotiates against a given capability set:

Fixtures are versioned by UCP protocol version (the directory name), so older conformance runs stay reproducible across protocol bumps.

Keeping versions aligned

Always install the latest @artos-commerce/ucp-client and @artos-commerce/ucp-cli (e.g. npm install @artos-commerce/ucp-client@latest) — each release mirrors the UCP protocol version it implements as a UCP_VERSION constant, and the protocol version is what /.well-known/ucp declares as ucp.version.

artos conformance warns when the server’s declared ucp.version differs from the client’s, which is your signal to upgrade the package (or the deployment). See Profiles & trust for how versions are negotiated per capability.