The endpoint is the proof: one spec, three forms, four tools

Sources cited in this piece · the normative text everything anchors to: draft-li-rttp-iqa-addressing-02 (40 pp., 2026-11-01, TXT sha256 02491c5a) · the vector layer: iqa-org 1.3.2 (crates.io / PyPI / npm) · the tool layer: iqa-mcp 1.0.3 (crates.io / PyPI / npm) · the endpoint this piece announces: mcp.iqa.org (streamable-http, four tools) · offline replay without installing anything: iqa.org/challenge/ · the URI reference pages: rttp.com/URI/ · iqa.org/URI/ · four new vector families filed this week as lab candidates: PR #221 · #222 · #223 · #224 · Sister pillars: RTTP (rttp://, Resonant Time Transfer Protocol, IANA CRI 27) · IQA (iqa://, Identity Quality Assurance, IANA CRI 28)

Software projects ship tools when the documentation runs out of words. This one ships tools for a different reason: so the documentation can be checked. The two-pillar work — RTTP (rttp://) resolving where and when an intent lives, IQA (iqa://) stating whether a claim counts — has spent this blog's lifetime as text: a draft under ISE review, vector families with per-file hashes, byte-replayable run records. This week a fourth form joined the first three, and it changes the burden of proof: a hosted Model Context Protocol endpoint, live at mcp.iqa.org, that any MCP client can consume with a single URL — no install, no local runtime, no trust in us required.

Three forms, one set of bytes

The endpoint is not a separate implementation and not a re-write. Its deployment installs iqa-mcp 1.0.3 from PyPI into a clean virtual environment and serves exactly that code over streamable-http; the only addition is a launcher that selects the transport. That choice is the whole point. A developer who runs the package locally with stdio and a client that talks to the hosted endpoint are exercising the same four tools over the same vectors — and when the two ever disagree, that disagreement is a bug with a hash trail, not a philosophical difference. This is the same discipline the 1.3.2 release applied to anchors: the published tarballs were downloaded back from their registries and compared byte for byte before the release was called done; the endpoint gets the same treatment at deploy time, with a seven-check self-test run against the freshly installed package.

Layer by layer, the citations run uphill and stop at one document. The vectors in iqa-org 1.3.2 carry spec_ref fields pointing at draft-li-rttp-iqa-addressing-02, pinned at TXT sha256 02491c5a — the same draft under IETF/ISE review, the same bytes anyone can hash and check. The tools consume those vectors; the endpoint serves those tools. Nothing in the stack cites a blog post, a README's mood, or memory.

The four tools, and what each one refuses to do

The tool surface is deliberately small — four verbs, each mapped to one doctrinal move the draft makes:

derive_route_shard answers where the address comes from. Given a canonical authority it returns ROUTE_SHARD — SHA-256 of the ASCII authority, truncated — and the derived rttp:// address shape. The doctrine it embodies: addresses are derived, not registered. Anyone, offline, with any implementation, computes the same address. There is no landlord to ask and none to bribe.

parse_envelope answers what the bytes say. It decodes the AE-128 envelope field by field — magic, version, lease expiry, shard, attestation, organ, nonce, standing — and returns the statement the frame makes. What it deliberately does not return is a verdict: parsing is statement, not judgment. The separation between the two is the load-bearing wall of the whole design, and the tool respects it by construction.

verify_envelope answers whether the frame counts. Cryptographic verification over the full frame, against the organ's seal, with freshness checked against the stated lease expiry — and one absolute rule: fail closed. Malformed input, a bad hash, an expired lease, an unreachable verification path — every failure mode ends in refusal, never in the benefit of the doubt. The tool has no mercy setting because the protocol has no mercy setting.

published_vector answers do not trust us, replay it. It hands over the published test vector — the exact bytes and the expected result — so that any implementation anywhere can be checked against the same frozen input. This is the entry point of the self-verification line: the outputs are byte-replayable, which means every claim the endpoint makes can be re-derived without the endpoint.

Why a hosted endpoint, when the packages already exist

The honest answer has two halves. The convenience half: an MCP client needs one URL. The audit half is more interesting — the endpoint is where the stack meets people who will never install a Python package, and it behaves under exactly the constraints our own blog has been demanding of everyone else. It is stateless: no sessions to hijack, no accounts, no cookies. It holds zero custody: it never sees your content, never learns what you verified or why; the bytes you check were already yours. It is fail-closed by construction — the same rule we tested in a dedicated vector family, now running in production against ourselves. And it keeps no ledger of who asked, because the moment verification requires permission, verification becomes a service and stops being a check.

One more symmetry deserves the sentence. This same week, four new vector families — ae128-fail-closed, pulse-header, uri-grammar, route-shard — were filed as candidates with the Agent-Authority-Conformance lab (PRs #221 · #222 · #223 · #224). Read the two events together and the loop closes: the families test the rules; the tools enforce the rules; the endpoint serves the tools; the draft states the rules; the vectors cite the draft. Five links, one chain, and every link is hashed to the one above it.

What we are not claiming

The endpoint is a convenience and a demonstration, not a certification service: it vouches for bytes handed to it and for nothing else. It does not make the hosted form more authoritative than the package form — they are the same code, and the package form remains the one an auditor should prefer precisely because it runs where the auditor's own hands are. The endpoint runs on infrastructure we pay for, which is a fact, not a promise; the honest hedge against even that is the fourth tool: everything it hands out can be replayed on a machine that has never heard of us. And the spec layer stays where it has always been — a public draft under independent review, citable by section number, changeable only in the open.

One line: the text argued it, the vectors pinned it, the tools run it, the endpoint serves it — four forms of one truth, and the newest form asks nothing of you but a URL.