The doctrine: GSC never authors your record and never holds your private key. GSC verifies, receipts, and serves. The write path accepts only what already verifies.
Admission is a signed row in the consortium issuer registry: your issuer id, rail cpg, your JWKS URL, status, admitted date, your slot block on this rail, and a contact. Request a seat at the GSC Trading Desk. The Enterprise Partner License (06 suite) governs the seat; counsel writes the words.
Subscribe in the developer portal - product Partner Issuers, approval required, one subscription key per issuer. The key meters and rate-limits your door; it never signs anything.
Author to the record schema (GTIN × jurisdiction, the unit rule), sign with your own ES256 key (detached JWS, RFC 7515 + 7797, RFC 8785 signing input - test vectors), then:
POST https://gsc-rco-partner.azure-api.net/partner/mcp
Ocp-Apim-Subscription-Key: <your key>
{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"publish_record","arguments":{"record":{...}}}}
A 200 returns your slot, the record URL, and the Azure Confidential Ledger receipt. Any failed check is a typed error; your record is never modified. Idempotent republish returns the same receipt. Full walkthrough: the publish-record skill.