# WillItPlug publisher identity verification

The `trustManifest` in the resource catalog describes publisher identity. Its identity is
`https://willitplug.com`, matching the publisher domain in each `urn:air:willitplug.com:...`
resource identifier.

## Verification procedure

1. Fetch `https://willitplug.com/.well-known/ard.json` over HTTPS. The apex redirects to
   the canonical `www.willitplug.com` origin. Require valid TLS for both origins.
2. Check each entry's identifier domain against `trustManifest.identity`. All resource
   URLs must resolve to the declared site or its explicitly linked public integration repository.
3. Retrieve the linked official MCP Registry listing. Confirm its server name is
   `com.willitplug/willitplug` and its remote URL is `https://www.willitplug.com/mcp/`.
   The Registry listing was published using HTTP domain-ownership authentication.
4. The Registry ownership proof is served directly on both hosts at
   `/.well-known/mcp-registry-auth`. The file contains the public ownership key, not a private key.

## Scope

This profile uses HTTPS origin control and the independent Registry listing to establish
the publishing domain. It provides no signed artifact digest or third-party compliance
certification. The listing identifies the product MCP server; the catalog's other entries
are published by the same domain and are not separately claimed as Registry-listed.

Electrical facts have their own per-country sources and verification dates in the API.
Publisher identity does not replace checking the input label of an individual device.