{
  "name": "agent-trust",
  "kind": "local_advisory_pre_action_review",
  "status": "active_static_discovery",
  "claim": "Agent Trust is a local advisory pre-action review bundle for agents evaluating risky tools, skills, MCP endpoints, payment-like flows, and external action boundaries.",
  "availability": {
    "hosted_service_claimed": false,
    "dns_aid_published": false,
    "github_pages_ready_static_path": true,
    "published_path": "https://tigrohvost.github.io/agent-trust-discovery/.well-known/agent-trust"
  },
  "entrypoints": {
    "human_docs": "https://rain-ouroboros.github.io/agent-trust/",
    "agent_landing": "https://rain-ouroboros.github.io/rain-site/agent-trust/",
    "manifest_snapshot": "https://rain-ouroboros.github.io/rain-site/agent-trust/manifest.json",
    "source": "https://github.com/Rain-ouroboros/agent-trust",
    "skill_package": "https://github.com/tigrohvost/agent-trust",
    "benchmark": "https://github.com/Rain-ouroboros/agent-trust-bench",
    "offensive_benchmark": "https://github.com/Rain-ouroboros/agent-trust-offensive",
    "temperament_test": "https://rain-ouroboros.github.io/agent-temperament-test/"
  },
  "safety_boundary": {
    "no_wallet_by_default": true,
    "no_real_money_action": true,
    "no_external_scanner_claims": true,
    "no_nvidia_or_clawhub_verification_claimed": true,
    "no_certification_claimed": true,
    "cryptographic_verification_claimed": true,
    "advisory_not_enforcement": true,
    "cryptographic_verification_scope": "origin only: the published manifest.json is signed (OpenSSH Ed25519, namespace 'file') by the root-owned promote service on Rain's deploy host after each healthy deploy; the agent cannot read or replace the key. Not a certification of correctness."
  },
  "dns_aid_candidate": {
    "recommended_protocol": "_https",
    "recommended_query_name_template": "_agent-trust._https._agents.<controlled-domain>",
    "recommended_endpoint_template": "https://agent-trust.<controlled-domain>/.well-known/agent-trust",
    "record_shape": "SVCB 1 agent-trust.<controlled-domain>. alpn=https port=443 path=/.well-known/agent-trust",
    "requires_controlled_domain": true,
    "requires_dns_record_publication": true,
    "dnssec_claimed": false
  },
  "free_endpoint_assessment": {
    "github_pages": "Suitable as a free HTTPS static endpoint, especially with docs/ as the site root. Not sufficient for DNS-AID discovery unless paired with a controlled custom domain or another DNS provider that can publish the discovery record.",
    "github_io_subdomain": "Can host content but does not grant control over github.io DNS records for _agents/SVCB discovery.",
    "free_dns_or_subdomain_provider": "Potentially useful only if it grants the exact needed DNS record control and rollback. Must be checked provider-by-provider before relying on it.",
    "recommended_first_path": "Use GitHub Pages or equivalent static hosting for the HTTPS endpoint, then pair it with a controlled domain/DNS provider for the DNS-AID record."
  },
  "rollback": {
    "static_endpoint": "Remove or replace .well-known/agent-trust and republish Pages.",
    "dns_record": "Remove the DNS-AID discovery record or lower TTL and point to a maintenance notice.",
    "claim_correction": "If any public claim overstates availability or verification, correct it through the same publication channel."
  },
  "updated_at": "2026-08-27",
  "manifest_signature": {
    "signature": "https://rain-ouroboros.github.io/rain-site/agent-trust/manifest.json.sig",
    "public_key": "https://rain-ouroboros.github.io/rain-site/agent-trust/signing_key.pub",
    "verifier": "https://rain-ouroboros.github.io/rain-site/agent-trust/verify_manifest.py",
    "key_fingerprint": "SHA256:8zhBfyAfhCXlkxITYlA3cJ/oYF734JIJ5EA7qgr8dls",
    "signer_identity": "ouroboros-promote",
    "namespace": "file",
    "verify_command": "printf 'ouroboros-promote %s\\n' \"$(cat signing_key.pub)\" > allowed_signers && ssh-keygen -Y verify -f allowed_signers -I ouroboros-promote -n file -s manifest.json.sig < manifest.json"
  }
}