Tighten release-candidate publication surfaces

.well-known/agent-cards-v1.1.0.json

@@ -1,7 +1,7 @@
 {
   "id": "x402://commandlayer.eth/agent-cards/v1.1.0",
   "name": "CommandLayer Agent Cards Registry Descriptor (v1.1.0)",
-  "description": "Immutable versioned discovery descriptor for CommandLayer Agent Cards v1.1.0.",
+  "description": "Versioned discovery descriptor for the CommandLayer Agent Cards v1.1.0 release-candidate line.",
   "owner": "commandlayer.eth",
   "ens": "commandlayer.eth",
   "version": "1.1.0",
@@ -24,7 +24,7 @@
     "agent_cards_version": "1.1.0",
     "current_release": "v1.1.0",
     "legacy_release": "v1.0.0 (archival compatibility only)",
-    "publish_state": "published",
+    "publish_state": "release_candidate_pending_validation",
     "license": "Apache-2.0",
     "publication_model": "root-canonical-plus-derivative-dist-pin"
   }

.well-known/agent.json

@@ -1,7 +1,7 @@
 {
   "id": "x402://commandlayer.eth/agent-cards/v1.1.0",
   "name": "CommandLayer Agent Cards Registry",
-  "description": "Well-known discovery pointer for the current CommandLayer Agent Cards v1.1.0 release line.",
+  "description": "Well-known discovery pointer for the current CommandLayer Agent Cards v1.1.0 release-candidate line.",
   "owner": "commandlayer.eth",
   "ens": "commandlayer.eth",
   "version": "1.1.0",
@@ -24,7 +24,7 @@
     "agent_cards_version": "1.1.0",
     "current_release": "v1.1.0",
     "legacy_release": "v1.0.0 (archival compatibility only)",
-    "publish_state": "published",
+    "publish_state": "release_candidate_pending_validation",
     "license": "Apache-2.0",
     "publication_model": "root-canonical-plus-derivative-dist-pin"
   }

ONBOARDING.md

@@ -2,14 +2,14 @@
 
 ## Start here
 
-Agent Cards v1.1.0 is the current canonical release line. Root repository artifacts are authoritative.
+Agent Cards v1.1.0 is the current release-candidate line. Root repository artifacts are authoritative within the repository, but the line should not be represented as fully published until `validate:release` and external bindings are confirmed.
 
 - root `agents/v1.1.0/`, `meta/`, `.well-known/`, and `schemas/v1.1.0/` are canonical
 - `meta/manifest.json` is the registry index
 - `.well-known/` is discovery
-- `checksums.txt` proves integrity for both the authoritative root artifacts and the committed derivative `dist-pin/` bundle
+- `checksums.txt` proves integrity for both the authoritative root artifacts and the committed derivative `dist-pin/` bundle in-repo; release publication claims still wait on `validate:release`
 - `agents/v1.0.0/` and `schemas/v1.0.0/` are archival legacy
-- `dist-pin/agent-cards/v1.1.0/` is a committed generated derivative publish bundle reproducible from the repository root
+- `dist-pin/agent-cards/v1.1.0/` is a committed generated derivative current-line bundle reproducible from the repository root
 
 - `agents/v1.1.0/commons/*.json`
 - `agents/v1.1.0/commercial/*.json`
@@ -44,7 +44,7 @@ Use the supported root package scripts and current commands instead: `npm run va
 6. update `RESOLUTION.md`
 7. run `npm run validate`
 8. run `npm run validate:release`
-9. `validate` checks local structure and checksums; `validate:release` adds external URL resolution and publish-bundle reproducibility
+9. `validate` checks local structure and checksums; `validate:release` adds external URL resolution and derivative-bundle reproducibility before publication claims
 10. after review, have a maintainer create or move the release tag on the exact validated commit; the release snapshot is the tagged commit plus `checksums.txt`
 
 ## Release procedure

POLICY.md

@@ -2,7 +2,7 @@
 
 ## Release policy
 
-- `v1.1.0` is the current authoritative Agent Cards line.
+- `v1.1.0` is the current release-candidate Agent Cards line.
 - Root repository artifacts for `v1.1.0` are the source of truth.
 - `v1.0.0` is superseded and retained only as an archival compatibility line.
 - Current v1.1.0 work must stay flat and self-contained.
@@ -12,13 +12,13 @@
 
 - `meta/manifest.json` is the canonical registry index.
 - `.well-known/` files are discovery pointers only.
-- `dist-pin/agent-cards/v1.1.0/` is a derivative published bundle for pinning/repinning.
+- `dist-pin/agent-cards/v1.1.0/` is a derivative current-line bundle for pinning/repinning.
 - No surface other than the root `v1.1.0` artifacts may be treated as co-equal authority.
 
 ## Binding policy
 
-- Commons cards bind directly to published Commons v1.1.0 URLs and commandlayer.org mirrors.
-- Commercial cards bind directly to published Commercial v1.1.0 URLs and commandlayer.org mirrors.
+- Commons cards bind directly to the intended Commons v1.1.0 URLs and commandlayer.org mirrors pending release validation.
+- Commercial cards bind directly to the intended Commercial v1.1.0 URLs and commandlayer.org mirrors pending release validation.
 - Stale path styles are non-compliant for the current line.
 
 ## Release integrity

README.md

@@ -14,12 +14,12 @@ See the x402 protocol specification for the canonical definition: `https://docs.
 
 ## Authority Model
 
-- **Current canonical release line:** `v1.1.0`
-- **Canonical source of truth:** root artifacts in this repository for the `v1.1.0` line (`agents/`, `schemas/`, `meta/`, `.well-known/`, `checksums.txt`)
+- **Current release-candidate line:** `v1.1.0`
+- **Canonical source of truth:** root artifacts in this repository for the `v1.1.0` line (`agents/`, `schemas/`, `meta/`, `.well-known/`, `checksums.txt`), pending release validation and external binding confirmation
 - **Canonical registry index:** `meta/manifest.json`
 - **Current discovery pointer:** `.well-known/agent.json`
 - **Immutable versioned descriptor:** `.well-known/agent-cards-v1.1.0.json`
-- **`dist-pin/` role:** committed published bundle generated from the root canonical artifacts for pinning/repinning; it is derivative, reproducible from the repository root, and not a second source of truth
+- **`dist-pin/` role:** committed derivative current-line bundle generated from the root canonical artifacts for pinning/repinning; it is reproducible from the repository root and not a second source of truth
 - **Legacy line:** `v1.0.0` is retained for archival compatibility only. It is superseded by `v1.1.0` and is not the primary release line.
 
 ## Quick verification
@@ -44,7 +44,7 @@ A current-line card is intentionally narrow. It exists to publish canonical bind
 
 v1.1.0 cards intentionally omit descriptive and editorial metadata such as display copy, capabilities summaries, tags, and extra links. If a detail is owned by the Commons or Commercial schema contract, the card links to that contract instead of restating it.
 
-`v1.1.0` is the canonical line. The repository's default validation path, release bundle, discovery descriptors, and checksum coverage are all centered on `v1.1.0`. `v1.0.0` remains in-tree as an archival and compatibility line only.
+`v1.1.0` is the current release-candidate line. The repository's default validation path, derivative bundle, discovery descriptors, and checksum coverage are centered on `v1.1.0`, but the line must not be treated as fully published until `validate:release` and external bindings are confirmed. `v1.0.0` remains in-tree as an archival compatibility line only.
 
 ## Design rule for v1.1.0
 
@@ -54,7 +54,7 @@ Agent Cards v1.1.0 is intentionally flat:
 - current schemas live under `schemas/v1.1.0/`
 - current cards use `schemas/v1.1.0/agent.card.schema.json`
 - current discovery files use `schemas/v1.1.0/agent.descriptor.schema.json`
-- current cards bind **directly** to published Commons / Commercial schema URLs
+- current cards bind **directly** to the intended Commons / Commercial schema URLs for release validation
 - current cards bind **directly** to `commandlayer.org` mirror URLs
 - current v1.1.0 uses **no `_shared`**
 
@@ -89,7 +89,7 @@ npm run validate:release
 npm run validate:release -- --require-mirrors
 ```
 
-`validate` checks local structure and checksums; `validate:release` adds external URL resolution and publish-bundle reproducibility.
+`validate` checks local structure and checksums; `validate:release` adds external URL resolution and derivative-bundle reproducibility before publication claims should be made.
 
 That trust path is the intended clean-clone review flow:
 
@@ -98,7 +98,7 @@ That trust path is the intended clean-clone review flow:
 3. `agents/v1.1.0/` contains the canonical current cards.
 4. `.well-known/` exposes discovery descriptors that point back to the manifest and tier registries.
 5. `agents/v1.0.0/` is preserved only as archival legacy material.
-6. `dist-pin/agent-cards/v1.1.0/` is the committed reproducible publish bundle derived from the canonical root files and reproducible from the repository root.
+6. `dist-pin/agent-cards/v1.1.0/` is the committed reproducible derivative bundle derived from the canonical root files and reproducible from the repository root.
 
 ## Authority model
 
@@ -107,7 +107,7 @@ That trust path is the intended clean-clone review flow:
 - **Discovery surface:** `.well-known/agent.json` and `.well-known/agent-cards-v1.1.0.json`
 - **Integrity surface:** root `checksums.txt`
 - **Legacy scope:** `agents/v1.0.0/` and `schemas/v1.0.0/`
-- **Publish bundle role:** `dist-pin/agent-cards/v1.1.0/` is committed, derivative, reproducible from the repository root, and never authoritative
+- **Derivative bundle role:** `dist-pin/agent-cards/v1.1.0/` is committed, derivative, reproducible from the repository root, and never authoritative
 
 ```text
 agent-cards/

SECURITY_PROVENANCE.md

@@ -7,4 +7,4 @@ CommandLayer Agent Cards prove identity and routing intent. They do not prove ex
 - direct upstream schema source URLs
 - direct commandlayer.org mirror URLs
 - deterministic repo checksums
-- derivative published bundle under `dist-pin/agent-cards/v1.1.0/`, regenerated from the canonical root artifacts
+- derivative current-line bundle under `dist-pin/agent-cards/v1.1.0/`, regenerated from the canonical root artifacts

SPEC.md

@@ -2,7 +2,7 @@
 
 ## One-line model
 
-This repo publishes canonical CommandLayer Agent Cards for the current **v1.1.0** line. Cards are minimal discovery and binding artifacts, `meta/manifest.json` is the registry index, `.well-known/` exposes discovery, root checksums verify integrity, legacy is archival, and `dist-pin/agent-cards/v1.1.0/` is a derivative publish bundle reproduced from the canonical root files.
+This repo maintains canonical CommandLayer Agent Cards for the current **v1.1.0** release-candidate line. Cards are minimal discovery and binding artifacts, `meta/manifest.json` is the registry index, `.well-known/` exposes discovery, root checksums verify integrity, legacy is archival, and `dist-pin/agent-cards/v1.1.0/` is a derivative current-line bundle reproduced from the canonical root files.
 
 Agent Cards publish only canonical binding facts:
 
@@ -18,13 +18,13 @@ They do not define semantic meaning, feature behavior, or implementation detail.
 
 ## 2. Authority and release lines
 
-- `v1.1.0` is the current canonical Agent Cards line.
+- `v1.1.0` is the current release-candidate Agent Cards line.
 - Root repository artifacts for `v1.1.0` are authoritative.
 - `meta/manifest.json` is the canonical registry index.
 - `.well-known/agent.json` is the current discovery pointer.
 - `.well-known/agent-cards-v1.1.0.json` is the immutable versioned descriptor for the canonical line.
-- `dist-pin/agent-cards/v1.1.0/` is a derivative published bundle for pinning/repinning and is not an independent source of truth.
-- `checksums.txt` covers both the authoritative root artifacts and the derived `dist-pin/` bundle so reviewers can verify source and publication surfaces independently.
+- `dist-pin/agent-cards/v1.1.0/` is a derivative current-line bundle for pinning/repinning and is not an independent source of truth.
+- `checksums.txt` covers both the authoritative root artifacts and the derived `dist-pin/` bundle so reviewers can verify source and release-candidate surfaces independently.
 - `v1.0.0` is superseded and retained only for archival compatibility. Legacy `v1.0.0` references may still rely on IPFS-era addressing and should be read as archival compatibility material, not the current authority path.
 
 ## 3. Current schema files
@@ -108,7 +108,7 @@ A repo state is conformant when:
 - the authoritative v1.1.0 card set exists
 - current cards use no `_shared` references
 - current cards contain only the minimal canonical binding fields
-- cards point at direct published source URLs and direct `commandlayer.org` mirrors
+- cards point at direct source URLs and intended `commandlayer.org` mirrors for release validation
 - `meta/manifest.json` describes the same current release line as the discovery descriptors
 - the derivative `dist-pin/agent-cards/v1.1.0/` bundle matches the canonical root release artifacts
 - `checksums.txt` matches repo contents

checksums.txt

@@ -1,5 +1,5 @@
-ca117a8816f0e7ce8ce4a11caddedcf3ea2b32634f3e55da7c5a7ae9cf3e7b04  .well-known/agent-cards-v1.1.0.json
-660da08d96bcc7346228c1b6edf638727a120a86c4f3a37f16273382e523d194  .well-known/agent.json
+0e71d19605b66d56ef412d84e28cd97404d35b0aaa9819cf8f8eafda1679a203  .well-known/agent-cards-v1.1.0.json
+28fbc1f9f2c4640966498935d874d96c4e5d3041356901dc27314e44720d88dc  .well-known/agent.json
 b7d185443a2efcf37f760f687b38963558dc82899fa249f6b0a43a6631ebb717  agents/v1.0.0/commercial/authorizeagent.eth.json
 864bfc0467080e4ff6c1514f044449eed79790a5cab420588c052e6ff77c47aa  agents/v1.0.0/commercial/checkoutagent.eth.json
 0f718f2125c5e6b792c56156f7312e98b8ec7b6e53df24436423135f6ae4abca  agents/v1.0.0/commercial/purchaseagent.eth.json
@@ -30,12 +30,13 @@ eeff77968e928f63329abd0839666b217651cfb4204c21a603b4dfbe707d086d  agents/v1.1.0/
 84aca63347052d746c4c87121fa5705847844786cb521e2c6d6ad85a272df97e  agents/v1.1.0/commons/formatagent.eth.json
 f45b8bb7f745af38fce9a78c1d3a40d36a558e0c4716f59f8e70e561c89ae4e6  agents/v1.1.0/commons/parseagent.eth.json
 315eedad7b1bd8559efa8d3bdf8567c1af7b241be1c934e2ca1dfd90059d90c8  agents/v1.1.0/commons/summarizeagent.eth.json
-3204719c980ffc68f7a317a01b9df67ca8655d5314168c6026415e06dcd8b0f8  dist-pin/agent-cards/v1.0.0/.well-known/agent.json
-d3cde6eef58761fe5b88e3df5cb448002a289735df8f1c164fdc3b74193c61b9  dist-pin/agent-cards/v1.0.0/meta/commercial-agent.json
-783178e57e9b754d939d90b9564740b45175fe0d360cfa4191716eb60e466c2e  dist-pin/agent-cards/v1.0.0/meta/commons-agent.json
-10c6ca12542dbdb21ccb1816ba7c98704789729e016b8dafe5ee2361f8b0e75c  dist-pin/agent-cards/v1.0.0/meta/manifest.json
-ca117a8816f0e7ce8ce4a11caddedcf3ea2b32634f3e55da7c5a7ae9cf3e7b04  dist-pin/agent-cards/v1.1.0/.well-known/agent-cards-v1.1.0.json
-660da08d96bcc7346228c1b6edf638727a120a86c4f3a37f16273382e523d194  dist-pin/agent-cards/v1.1.0/.well-known/agent.json
+2320ed25bb42f4dc6fab2249aa0df0665ccc00e29f7663fbd12caf316410feeb  dist-pin/agent-cards/v1.0.0/.well-known/agent.json
+d9fbd6adc82e9b69f72507472a0dead801a245ae97b764a8e1f857ad22a0000c  dist-pin/agent-cards/v1.0.0/ARCHIVE_NOTICE.md
+9b0015b8d9342111771b77e32086726e434dc346a0b54b695a00dd85b17f504f  dist-pin/agent-cards/v1.0.0/meta/commercial-agent.json
+d11d58d5c981bd542211f1d9f4109b5f542cf580a46670928b6d0bac0e581bb5  dist-pin/agent-cards/v1.0.0/meta/commons-agent.json
+9f04639c33292d1c410805e79632c6d7c0a36ec9826597842c8c3e011e5b7e94  dist-pin/agent-cards/v1.0.0/meta/manifest.json
+0e71d19605b66d56ef412d84e28cd97404d35b0aaa9819cf8f8eafda1679a203  dist-pin/agent-cards/v1.1.0/.well-known/agent-cards-v1.1.0.json
+28fbc1f9f2c4640966498935d874d96c4e5d3041356901dc27314e44720d88dc  dist-pin/agent-cards/v1.1.0/.well-known/agent.json
 d12610ea54b31b80758fbc68fcfaf8f20e5588097630f7d04a552bde1be458b1  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commercial/authorizeagent.eth.json
 0c7834aaf6d0692d2db9f29862ce2ae25b987cc41926bd242706da7b2847f21a  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commercial/checkoutagent.eth.json
 584a77bb4c75dc84f9e4ddf5d700a0ef2183777acd4cdf2c1761998cb2565d22  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commercial/purchaseagent.eth.json
@@ -51,14 +52,14 @@ eeff77968e928f63329abd0839666b217651cfb4204c21a603b4dfbe707d086d  dist-pin/agent
 84aca63347052d746c4c87121fa5705847844786cb521e2c6d6ad85a272df97e  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commons/formatagent.eth.json
 f45b8bb7f745af38fce9a78c1d3a40d36a558e0c4716f59f8e70e561c89ae4e6  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commons/parseagent.eth.json
 315eedad7b1bd8559efa8d3bdf8567c1af7b241be1c934e2ca1dfd90059d90c8  dist-pin/agent-cards/v1.1.0/agents/v1.1.0/commons/summarizeagent.eth.json
-13f95359b05a8dbad843bb4782d9993af3d40f6bba0c9330ed3962ac00e8dda4  dist-pin/agent-cards/v1.1.0/meta/commercial-agent.json
-5745c140392a255acf8c4fab082f0c03f14e80e908ed5be099cbec88afe15a8c  dist-pin/agent-cards/v1.1.0/meta/commons-agent.json
-8f04dab243db9e03c105ba79f9f05c0c8e3f5ca909dd9b6179f0e9d1b8994269  dist-pin/agent-cards/v1.1.0/meta/manifest.json
+f69357fe86b31ae3378c76e3f842915ae4ba1e709e0035b1d161fcd59f9d9ac4  dist-pin/agent-cards/v1.1.0/meta/commercial-agent.json
+0b017cd078d834b3f1949cbdd7cbfb75950a4bdbf1e3bcb216b2f632067c8aca  dist-pin/agent-cards/v1.1.0/meta/commons-agent.json
+de25064894795d5e44a959427211a8faca2062243cf31476e44ac91e8498dbab  dist-pin/agent-cards/v1.1.0/meta/manifest.json
 ffc066f827668ccc28b29efaf6b75def28b4931227545a6210e9faee8c4527c2  dist-pin/agent-cards/v1.1.0/schemas/v1.1.0/agent.card.schema.json
 6e082c065b0ab5365b0fe3424062855587e6226a06b5ee092d77f91ea829afe2  dist-pin/agent-cards/v1.1.0/schemas/v1.1.0/agent.descriptor.schema.json
-13f95359b05a8dbad843bb4782d9993af3d40f6bba0c9330ed3962ac00e8dda4  meta/commercial-agent.json
-5745c140392a255acf8c4fab082f0c03f14e80e908ed5be099cbec88afe15a8c  meta/commons-agent.json
-8f04dab243db9e03c105ba79f9f05c0c8e3f5ca909dd9b6179f0e9d1b8994269  meta/manifest.json
+f69357fe86b31ae3378c76e3f842915ae4ba1e709e0035b1d161fcd59f9d9ac4  meta/commercial-agent.json
+0b017cd078d834b3f1949cbdd7cbfb75950a4bdbf1e3bcb216b2f632067c8aca  meta/commons-agent.json
+de25064894795d5e44a959427211a8faca2062243cf31476e44ac91e8498dbab  meta/manifest.json
 ec6b2669daca50f99c9b8e04db7b8010169786788431cd74b68e547441216b8a  schemas/v1.0.0/_shared/agent.card.base.schema.json
 c22100701ae9ebad97cfc1cb468a0369e424a0cdcec2d62968b848ef5d14369c  schemas/v1.0.0/_shared/agent.descriptor.schema.json
 ffc066f827668ccc28b29efaf6b75def28b4931227545a6210e9faee8c4527c2  schemas/v1.1.0/agent.card.schema.json

dist-pin/agent-cards/v1.0.0/.well-known/agent.json

@@ -1,13 +1,14 @@
 {
   "id": "x402://commandlayer.eth/agent-cards/v1",
   "name": "CommandLayer Agent Cards Registry",
-  "description": "Well-known descriptor for the CommandLayer Agent Cards registry (Commons + Commercial).",
+  "description": "Archival discovery descriptor for the superseded CommandLayer Agent Cards v1.0.0 line.",
   "owner": "commandlayer.eth",
   "ens": "commandlayer.eth",
   "version": "1.0.0",
   "contact": "dev@commandlayer.org",
-  "networks": ["eip155:1"],
-
+  "networks": [
+    "eip155:1"
+  ],
   "registry": {
     "manifest": {
       "http": "https://commandlayer.org/agent-cards/meta/manifest.json",
@@ -22,10 +23,11 @@
       "ipfs": "ipfs://bafybeihwxbbslsmvdnt3qj6qg5e6uj44hokxgs4h6p43jdmjyghvzjz4l4/meta/commercial-agent.json"
     }
   },
-
   "meta": {
     "agent_cards_version": "1.0.0",
     "agent_cards_cid": "",
-    "license": "Apache-2.0"
+    "license": "Apache-2.0",
+    "archive_state": "archival_only_unverified_snapshot",
+    "trust_notice": "integrity_manifest_removed_due_to_incomplete_bundle"
   }
 }

dist-pin/agent-cards/v1.0.0/ARCHIVE_NOTICE.md

@@ -0,0 +1,8 @@
+# v1.0.0 archival notice
+
+This directory is retained only as an archival metadata snapshot for the superseded v1.0.0 line.
+
+- It is not the current release line.
+- It is not an integrity-verified release bundle.
+- `checksums.txt` was removed because the historical bundle contents are incomplete in-repo and the old checksum surface could be mistaken for a trustworthy release artifact.
+- Use the repository root and `dist-pin/agent-cards/v1.1.0/` for the current release-candidate authority model.