OQP's architecture is narrower than its ambition, which is the point. The GET /capabilities endpoint answers what an agent is equipped to verify — not what it did, but what it is capable of auditing. GET /context/workflows exposes the business rules a given workflow must satisfy. POST /verification/execute runs the check. POST /verification/assess-risk returns a risk score for a proposed change . Together these four calls constitute a contract: the agent is no longer a black box that shipped something; it is a system that can be interrogated about whether…