Update to Verified by NPC

{
  "description": "Verify products, credentials, claims, and AI agents against NPC Labs' attestation records. Use when someone asks: is this real? verify this. is this authentic?",
  "included_files": [],
  "name": "verified-by-npc",
  "skill_md_contents": "---\nname: verified-by-npc\ndescription: Verify products, credentials, claims, and AI agents against NPC Labs' attestation records. Use when someone asks: is this real? verify this. is this authentic?\n---\n\n# Verified by NPC\n\nAnswer the question \"is this real?\" with a signed, checkable record instead of\nan opinion. This skill describes the five verification operations. All of them\nread from the NPC Verification API v1; none of them issue attestations, and\nnone of them reveal how the checking was done.\n\n## Operations\n\n### verify_product\nCheck whether a physical product is authentic through its NPC smart tag.\n- Input: `tag_id` (the smart-tag ID on the product)\n- API: `GET /v1/products/{tag_id}`\n- Result: `authentic`, `counterfeit`, or `unknown`, plus the public provenance\n  chain (origin and transfers the creator made public).\n\n### verify_credential\nCheck whether a certificate or credential is real.\n- Input: `credential_id`\n- API: `GET /v1/credentials/{id}`\n- Result: `valid`, `revoked`, `expired`, or `unknown`, with the credential\n  title, issuer, and issue date. The holder's name appears only if the holder\n  made it public.\n\n### verify_claim\nCheck a claim against NPC Labs' attested records: did this really happen, is\nthis claim true?\n- Input: `claim_text` or `claim_hash` (SHA-256 hex of the normalized claim)\n- API: `POST /v1/claims/verify`\n- Result: whether an attestation matched, and if so the sanitized attestation\n  summary (verdict, scope, tested dates, caveats, onchain anchor reference).\n  Findings are sanitized; methodology never leaves the building.\n\n### verify_agent\nCheck an AI agent's verification status.\n- Input: `agent_id`\n- API: `GET /v1/agents/{agent_id}/attestation`\n- Result: `verified`, `verified_with_caveats`, `not_verified`, or `unknown`,\n  with scope, time bounds, attestation ID, and onchain anchor.\n\n### explain_verification\nExplain what \"Verified by NPC\" means, when someone asks what a result means.\nThis is a static, public-safe explainer served by the plugin itself. No API\ncall. It explains the why, never the how:\n- \"Verified by NPC\" means an independent attestation record exists for the\n  subject: what was checked, when it was checked, and the verdict.\n- \"verified\" means NPC Labs checked the subject against a defined scope and\n  signed the result.\n- Every API answer is cryptographically signed, so it can be checked without\n  trusting the connection it arrived over.\n- \"unknown\" means NPC Labs has no record of the subject. It is not a claim\n  that the subject is false.\n\n## Rules that always hold\n\n- Fail closed. An unknown subject returns `unknown`, never a guess and never\n  a fabricated verdict. An unverifiable claim is reported as unverifiable,\n  not as false.\n- Trust the signature, not the transport. Every API response carries an\n  Ed25519 signature in the `X-NPC-Signature` header with the signing key ID\n  in `X-NPC-Key-ID`. Public keys are published at `GET /v1/keys`. A response\n  that fails verification is discarded, and the subject is treated as\n  `unknown`.\n- Read only. This plugin verifies. It cannot record attestations, and it\n  never asks the API to do so.\n- Privacy preserving. Record contents stay local to the API; API responses\n  carry no PII beyond what the subject made public.\n\n## HTTP details\n\n- Base URLs: `https://api.npclabs.xyz/v1` (production; deployment gated) and\n  `http://127.0.0.1:8787/v1` (local development).\n- Auth: Bearer API key with the `verifier` role.\n- Errors: `404` returns `{\"verdict\": \"unknown\"}` for unrecognized subjects.\n  `401` means the API key is missing or rejected. `429` means slow down and\n  retry.\n- The full machine-readable action surface is in `openapi-plugin.yaml`.\n"
}