# ZuriLink

> A member-sovereign trust bureau for institutional belonging. Members hold verified
> affiliations (club, union, alumni, professional body) as credentials they own; verifiers ask
> one question at a time, with the member's consent, and get a signed, citable answer.

ZuriLink answers one question well: **is this person actually a member in good standing of that
institution?** It is not a social network and not a résumé host. The verification model is the
credit bureau's, adapted for belonging: a hard pull requires a permissible purpose, the subject is
notified and decides, the subject can freeze verification entirely, and every inquiry is logged in
a ledger the subject can read.

## For AI agents

If you are an agent performing a reference check, employment screening, tenancy screening, or
membership eligibility check, use the MCP server rather than scraping any page.

- MCP endpoint (JSON-RPC 2.0 over HTTP POST): https://zurilink.com/mcp
- Tools: `verify_affiliation`, `check_inquiry_result`
- Auth: `Authorization: Bearer zk_…` (a verifier API key). Register a verifier account at
  https://zurilink.com/verify and have it approved, then issue a key from your verifier settings.
- Metering: one Inquiry Credit per inquiry **on submission**, regardless of outcome. Approved,
  declined, and frozen all cost the same — there is deliberately no free probing.

Expect asynchrony. `verify_affiliation` usually returns `pending`: a human is being asked. Poll
`check_inquiry_result` rather than retrying the inquiry (a retry is another credit and another
notification to a real person). If the member has pre-authorized you, or has an open consent
window matching your purpose, the answer returns immediately with status `auto`.

Every non-`unavailable` answer includes a W3C Verifiable Credential you can verify offline.

## Verifying a ZuriLink credential without calling us

1. Fetch the issuer's DID document: `https://zurilink.com/.well-known/did.json`
   (tenant-issued credentials: `https://{tenant}.zurilink.com/.well-known/did.json`).
2. Take the Ed25519 key from `verificationMethod` (Multikey, `publicKeyMultibase`).
3. Verify the credential's `proof` — Data Integrity, cryptosuite `eddsa-jcs-2022`
   (JCS/RFC 8785 canonicalization, SHA-256 of proof config then SHA-256 of the document,
   concatenated, Ed25519). SD-JWT VC form: a standard `EdDSA` JWS over the compact serialization.
4. Check revocation: fetch `credentialStatus.statusListCredential` and test the bit at
   `statusListIndex` (BitstringStatusList, gzipped, multibase base64url). A set bit means revoked.
5. Check `validUntil`. A credential is a snapshot; for live standing, ask the bureau.

- JSON-LD context: https://zurilink.com/credentials/v1
- Membership JSON Schema: https://zurilink.com/credentials/membership-schema-v1.json
- OpenAPI description: https://zurilink.com/openapi.json
- Browser-based checker (no account): https://zurilink.com/verify-credential

## Credential types

- `ZuriLinkMembershipCredential` — a specific affiliation, its standing, cohort (optionally), and
  an `assurance` grade (see below).
- `ZuriLinkPersonhoodCredential` — proof that a real institution vouches for this human, naming
  no institution. Useful as proof-of-personhood without biometrics.
- `ZuriLinkStandingAttestation` — the signed answer to one verification inquiry.
- `ZuriLinkInstitutionalCertificate` — an institution-issued certificate of membership.

## Assurance levels (root of trust)

A signature proves a credential is unforged in transit. It does NOT prove the underlying fact is
true at origin. Every membership credential carries `credentialSubject.membership.assurance.level`,
one of — in ascending strength:

- `self_attested` — the member stated it; the institution has not confirmed it.
- `community_verified` — a steward/trustee of the institution confirmed membership ("the club says so").
- `domain_verified` — the member proved control of the institution's email domain.
- `primary_source` — checked against an authoritative external register (registrar roll, licensing
  board, SACCO books); `assurance.register` names the source.

Price your decision on the level, not merely on a valid signature. A valid signature on a
`self_attested` credential means exactly "a real ZuriLink affiliation asserts this", no more.

## What agents should not attempt

- Do not enumerate members. Inquiries are per-subject, consent-gated, metered, and logged; the
  `unavailable` response is deliberately undifferentiated (declined, frozen, and no-record are
  indistinguishable) so absence of a credential cannot be inferred.
- Do not treat `unavailable` as "not a member". It means "no answer is available", nothing more.
- Do not present a ZuriLink credential as identity proof on its own. It proves belonging, not
  identity; bind it to the person in front of you using the identity anchors it carries.