# RCO Records — Record of Cleared Orders

> RCO — the record of what the agent relied on. Agent line: every read, receipted.

RCO — the Record of Cleared Orders — is the record of what an AI agent relied on. Every answer the Allooloo record gives a regulated agent is receipted: one signed receipt per cleared read, chained to the one before, verifiable by anyone against a published key. Receipt v1: {v, id, seq, writer, caller, subject, subject_type, market, rule_version, cleared_at, answer_hash, prev_hash, hash, sig, kid}. Tools: write_receipt (bearer token per writer), verify_receipt (public).

Operator: Allooloo Technologies Corp. · https://allooloo.ai · Surface: https://rco-records.ai · Door: https://mcp.rco-records.ai/mcp · Surface version 2.3.0

## Receipt v1 (frozen)
Canonical JSON: keys sorted, UTF-8, no whitespace. One receipt per cleared read; idempotent on (writer, subject, subject_type, market, rule_version, cleared_at, answer_hash).
- v — 1
- id — "rco:" + 20-char base32 (RFC 4648, lowercase) of the first 100 bits of hash. Derived, never assigned.
- seq — monotonic integer across the whole chain.
- writer — the gate that wrote it.
- caller — who asked: "sha256:" + hex sha256 of a customer key id or an x402 wallet handle. Empty when unknown.
- subject · subject_type — what was read (isin · lei · gtin · ticker · cmr · … — open list).
- market — ISO country or exchange code of the read.
- rule_version — the rule set the gate cleared under.
- cleared_at — RFC 3339 UTC, seconds.
- answer_hash — "sha256:" + hex sha256 of the canonical answer bytes the agent received.
- prev_hash · hash — hash = "sha256:" + hex sha256 over the canonical receipt without hash, sig and id; prev_hash = the previous receipt's hash.
- sig · kid — Ed25519 over the UTF-8 bytes of the hash string (base64url), key kid on https://rco-records.ai/.well-known/jwks.json.
Fields are only ever added, never renamed or removed. Unknown fields are ignored by readers.

## History (v0)
Receipts written before 2026-10-29 keep their bytes and field names: {decision_id, gtin, market, actor_class, rule_version, cleared_at, writer, prev_hash, hash, sig, kid}; hash over the canonical JSON of {actor_class, cleared_at, decision_id, gtin, market, prev_hash, rule_version, writer}. Ledger-era rows carry kid gsc-rco-2026-08 and sig null.

## verify(receipt, jwks)
A pure function: recompute hash (and id for v1), check sig against kid. Reference implementations in TypeScript, Python and Go under MIT: https://github.com/allooloo/rco-records

## Tools (MCP, streamable HTTP, stateless)
- write_receipt — Authorization: Bearer <writer token>; returns the receipt.
- verify_receipt — public; argument id (rco:… or dec_…); returns the receipt and the verification result.
- list_receipts — customer key (Authorization: Bearer rcok_…); own rows only, by seq or date range.
- get_statement — customer key; a signed statement of the key's slice, monthly or on demand.
- issue_auditor_key — customer key; a read-only sub-key on the key's own slice for its auditor.

## x402 (paid calls, $0.01 — prices of record at https://rco-records.ai/facts.json)
- GET https://rco-records.ai/api — your wallet's own slice of the record; the paid call is receipted first, with caller = sha256("x402:" + your wallet). answer_hash covers the data block without the slice list (which holds this receipt).
- GET https://rco-records.ai/api/statement?month=YYYY-MM — a signed statement of your wallet's slice.
- Both rails on Base: x402 USDC (EIP-3009) and x402 USD — Open USD (Permit2, gas sponsored). No 402 on any MCP tool; verify_receipt and the verify URL are always free.

## RCO Register
A customer key is issued by Allooloo to a firm and invoiced monthly. The firm's agents present it on Allooloo's doors (header RCO-Key); every receipt they cause carries caller = sha256("key:" + key id). The key reads its own slice (list_receipts), receives a signed monthly statement (get_statement), and a nightly export of the day's rows with a signed manifest into the firm's own bucket. Auditors: https://rco-records.ai/auditors

## Verify URL
https://rco-records.ai/receipts/{id} — the same answer as verify_receipt, over GET.

## Machine kit
https://rco-records.ai/.well-known/agent-card.json · /.well-known/mcp.json · /.well-known/jwks.json · /.well-known/api-catalog · /.well-known/security.txt · /facts.json · /api (x402) · /health.json · /robots.txt · /sitemap.xml

## Errors
Typed, in the tool result: not_authorised · invalid_receipt · invalid_id · not_found · store_unavailable · store_error · chain_contention.