commandlayer · GsCommand · Mar 19, 2026
diff --git a/.gitignore b/.gitignore
@@ -2,6 +2,3 @@ node_modules
 npm-debug.log*
 dist
 .DS_Store
-
-# local build/pin staging
-/dist-pin/
diff --git a/.well-known/agent-cards-v1.1.0.json b/.well-known/agent-cards-v1.1.0.json
@@ -1,7 +1,7 @@
 {
   "id": "x402://commandlayer.eth/agent-cards/v1.1.0",
   "name": "CommandLayer Agent Cards Registry Descriptor (v1.1.0)",
-  "description": "Versioned discovery descriptor for CommandLayer Agent Cards v1.1.0.",
+  "description": "Frozen discovery snapshot for CommandLayer Agent Cards v1.1.0.",
   "owner": "commandlayer.eth",
   "ens": "commandlayer.eth",
   "version": "1.1.0",
@@ -25,6 +25,7 @@
     "current_release": "v1.1.0",
     "legacy_release": "v1.0.0",
     "publish_state": "ready-to-pin",
-    "license": "Apache-2.0"
+    "license": "Apache-2.0",
+    "role": "frozen-snapshot"
   }
 }
diff --git a/.well-known/agent.json b/.well-known/agent.json
@@ -1,7 +1,7 @@
 {
-  "id": "x402://commandlayer.eth/agent-cards/v1.1.0",
+  "id": "x402://commandlayer.eth/agent-cards/current",
   "name": "CommandLayer Agent Cards Registry",
-  "description": "Well-known descriptor for the current CommandLayer Agent Cards v1.1.0 release line.",
+  "description": "Current discovery pointer for the CommandLayer Agent Cards release line.",
   "owner": "commandlayer.eth",
   "ens": "commandlayer.eth",
   "version": "1.1.0",
@@ -18,13 +18,17 @@
     },
     "commercial_agent": {
       "http": "https://commandlayer.org/agent-cards/meta/commercial-agent.json"
+    },
+    "snapshot": {
+      "http": "https://commandlayer.org/agent-cards/.well-known/agent-cards-v1.1.0.json"
     }
   },
   "meta": {
     "agent_cards_version": "1.1.0",
     "current_release": "v1.1.0",
     "legacy_release": "v1.0.0",
     "publish_state": "ready-to-pin",
-    "license": "Apache-2.0"
+    "license": "Apache-2.0",
+    "role": "current-pointer"
   }
 }
diff --git a/README.md b/README.md
@@ -1,135 +1,80 @@
 # Agent Cards — CommandLayer
 
-Agent Cards are CommandLayer's identity and routing layer. They bind ENS names to canonical verbs, published request/receipt schemas, and semver-pinned x402 entrypoints without redefining the semantic contract.
+## Authority Model
 
-## Current version story
+- **Current line:** `v1.1.0`.
+- **Root repository:** canonical source of truth for current artifacts.
+- **`meta/manifest.json`:** canonical registry index for the current line.
+- **`.well-known/agent.json`:** current discovery pointer.
+- **`.well-known/agent-cards-v1.1.0.json`:** frozen discovery snapshot for `v1.1.0`.
+- **`dist-pin/agent-cards/v1.1.0/`:** derivative release bundle generated from root artifacts for repinning only.
+- **`checksums-v1.1.0.txt`:** canonical integrity surface for the current line.
 
-- **Current Agent Cards line:** `v1.1.0`
-- **Current Commons contract line:** `v1.1.0`
-- **Current Commercial contract line:** `v1.1.0`
-- **Legacy line retained for compatibility:** `v1.0.0`
+If root, manifest, dist-pin, and checksums disagree, root and current checksums win.
 
-## Design rule for v1.1.0
+## Current Line
 
-Agent Cards v1.1.0 is intentionally flat:
+`v1.1.0` is the only active release line in this repository. `v1.0.0` is archival and retained only for compatibility review.
 
-- cards live under `agents/v1.1.0/`
-- current schemas live under `schemas/v1.1.0/`
-- current cards use `schemas/v1.1.0/agent.card.schema.json`
-- current discovery files use `schemas/v1.1.0/agent.descriptor.schema.json`
-- current cards bind **directly** to published Commons / Commercial schema URLs
-- current cards bind **directly** to `commandlayer.org` mirror URLs
-- current v1.1.0 uses **no `_shared`**
+## Current Artifact Surface
 
-## How card bindings work
+- `agents/v1.1.0/` — canonical current cards.
+- `schemas/v1.1.0/` — canonical current schemas.
+- `meta/manifest.json` — canonical card registry index.
+- `meta/commons-agent.json` / `meta/commercial-agent.json` — current class registries.
+- `.well-known/agent.json` — current pointer.
+- `.well-known/agent-cards-v1.1.0.json` — frozen snapshot.
+- `checksums-v1.1.0.txt` — integrity file for the current canonical surface.
+- `dist-pin/agent-cards/v1.1.0/` — derivative bundle that must byte-match the current canonical surface.
 
-For `v1.1.0`:
+## Release Rules
 
-- `schemas.request` and `schemas.receipt` point to the tagged upstream schema source URLs
-- `schemas_mirror.request` and `schemas_mirror.receipt` point to the public `commandlayer.org` mirrors
-- `entry` remains `x402://<ens>/<verb>/v1.1.0`
+- Current cards are minimal bindings: identity, owner, ENS, class, status, schemas, mirrors, entry, and update timestamp.
+- Manifest entries must match cards exactly for `id`, `class`, `verb`, `version`, schema URLs, mirror URLs, `entry`, and `status`.
+- `.well-known/agent.json` is a pointer; `.well-known/agent-cards-v1.1.0.json` is the immutable snapshot it points to.
+- `dist-pin` is not authoritative. It is validated as a derivative copy of current artifacts.
+- `v1.0.0` is archival only. Do not treat it as the current protocol line.
 
-### Commons source pattern
+## Validation
 
-`https://raw.githubusercontent.com/commandlayer/protocol-commons/refs/tags/v1.1.0/schemas/v1.1.0/commons/<verb>/<verb>.request.schema.json`
+```bash
+npm install
+npm run validate
+```
 
-### Commons mirror pattern
+`npm run validate` performs the full current-line trust check:
 
-`https://commandlayer.org/schemas/v1.1.0/commons/<verb>/<verb>.request.schema.json`
+- validates current cards against the `v1.1.0` schema
+- validates the current pointer/snapshot discovery model
+- cross-validates `meta/manifest.json` against every current card
+- verifies `dist-pin/agent-cards/v1.1.0/` is an exact derivative bundle
+- verifies `checksums-v1.1.0.txt`
 
-### Commercial source pattern
+Optional commands:
 
-`https://raw.githubusercontent.com/commandlayer/protocol-commercial/refs/tags/v1.1.0/schemas/v1.1.0/commercial/<verb>/<verb>.request.schema.json`
+- `npm run validate:legacy` — archival `v1.0.0` structural checks only
+- `npm run validate:checksums` — verify `checksums-v1.1.0.txt`
+- `npm run validate:release` — network checks for schema URLs, mirrors, and entry URIs
 
-### Commercial mirror pattern
+## Checksums
 
-`https://commandlayer.org/schemas/v1.1.0/commercial/<verb>/<verb>.request.schema.json`
+- `checksums-v1.1.0.txt` covers `.well-known/`, `agents/v1.1.0/`, `meta/`, and `schemas/v1.1.0/`.
+- `checksums-v1.0.0.txt` is archival and covers `agents/v1.0.0/` and `schemas/v1.0.0/`.
+- `dist-pin` is excluded from checksum truth because it is derivative, not canonical.
 
-## Repository layout
+## Repository Layout
 
 ```text
 agent-cards/
 ├── agents/
-│   ├── v1.0.0/
-│   └── v1.1.0/
-│       ├── commons/
-│       └── commercial/
+│   ├── v1.0.0/            # archival only
+│   └── v1.1.0/            # canonical current cards
 ├── schemas/
-│   ├── v1.0.0/
-│   └── v1.1.0/
-│       ├── agent.card.schema.json
-│       └── agent.descriptor.schema.json
-├── meta/
-├── .well-known/
-├── dist-pin/agent-cards/v1.1.0/
-└── checksums.txt
-```
-
-## Example Commons v1.1.0 card
-
-```json
-{
-  "$schema": "https://commandlayer.org/agent-cards/schemas/v1.1.0/agent.card.schema.json",
-  "$id": "https://commandlayer.org/agent-cards/agents/v1.1.0/commons/summarizeagent.eth.json",
-  "id": "summarizeagent.eth",
-  "version": "1.1.0",
-  "class": "commons",
-  "implements": ["summarize"],
-  "schemas": {
-    "request": "https://raw.githubusercontent.com/commandlayer/protocol-commons/refs/tags/v1.1.0/schemas/v1.1.0/commons/summarize/summarize.request.schema.json",
-    "receipt": "https://raw.githubusercontent.com/commandlayer/protocol-commons/refs/tags/v1.1.0/schemas/v1.1.0/commons/summarize/summarize.receipt.schema.json"
-  },
-  "schemas_mirror": {
-    "request": "https://commandlayer.org/schemas/v1.1.0/commons/summarize/summarize.request.schema.json",
-    "receipt": "https://commandlayer.org/schemas/v1.1.0/commons/summarize/summarize.receipt.schema.json"
-  },
-  "entry": "x402://summarizeagent.eth/summarize/v1.1.0"
-}
-```
-
-## Example Commercial v1.1.0 card
-
-```json
-{
-  "$schema": "https://commandlayer.org/agent-cards/schemas/v1.1.0/agent.card.schema.json",
-  "$id": "https://commandlayer.org/agent-cards/agents/v1.1.0/commercial/checkoutagent.eth.json",
-  "id": "checkoutagent.eth",
-  "version": "1.1.0",
-  "class": "commercial",
-  "implements": ["checkout"],
-  "schemas": {
-    "request": "https://raw.githubusercontent.com/commandlayer/protocol-commercial/refs/tags/v1.1.0/schemas/v1.1.0/commercial/checkout/checkout.request.schema.json",
-    "receipt": "https://raw.githubusercontent.com/commandlayer/protocol-commercial/refs/tags/v1.1.0/schemas/v1.1.0/commercial/checkout/checkout.receipt.schema.json"
-  },
-  "schemas_mirror": {
-    "request": "https://commandlayer.org/schemas/v1.1.0/commercial/checkout/checkout.request.schema.json",
-    "receipt": "https://commandlayer.org/schemas/v1.1.0/commercial/checkout/checkout.receipt.schema.json"
-  },
-  "entry": "x402://checkoutagent.eth/checkout/v1.1.0"
-}
-```
-
-## Validation
-
-```bash
-npm install
-npm run validate
+│   ├── v1.0.0/            # archival only
+│   └── v1.1.0/            # canonical current schemas
+├── meta/                  # canonical current registry metadata
+├── .well-known/           # current pointer + frozen snapshot
+├── dist-pin/              # derivative release bundles
+├── checksums-v1.0.0.txt   # archival integrity file
+└── checksums-v1.1.0.txt   # canonical current integrity file
 ```
-
-Validation checks:
-
-- descriptor schema conformance
-- exact authoritative v1.1.0 card presence
-- version / path / `$schema` / `$id` alignment
-- direct Commons and Commercial source URL patterns
-- direct `commandlayer.org` mirror URL patterns
-- entry URI correctness
-- checksum determinism across cards, schemas, meta, discovery, and dist-pin
-
-## Release artifacts
-
-- `meta/manifest.json` — authoritative release index
-- `.well-known/agent.json` — current discovery descriptor
-- `.well-known/agent-cards-v1.1.0.json` — versioned descriptor
-- `dist-pin/agent-cards/v1.1.0/` — publish bundle for repinning
-- `checksums.txt` — deterministic artifact digests
diff --git a/RESOLUTION.md b/RESOLUTION.md
@@ -1,5 +1,37 @@
 # Resolution Log — Agent Cards
 
-| Date | Agent Name(s) | Action | Reason | Resolution | Approver(s) |
-|---|---|---|---|---|---|
-| 2026-03-19 | `analyzeagent.eth`, `classifyagent.eth`, `cleanagent.eth`, `convertagent.eth`, `describeagent.eth`, `explainagent.eth`, `fetchagent.eth`, `formatagent.eth`, `parseagent.eth`, `summarizeagent.eth`, `authorizeagent.eth`, `checkoutagent.eth`, `purchaseagent.eth`, `shipagent.eth`, `verifyagent.eth` | Updated | Post-publish alignment migration for Agent Cards v1.1.0. | Removed current-line `_shared` usage, switched v1.1.0 cards to direct flat Commons and Commercial schema URL bindings, regenerated manifest/discovery/checksums, and refreshed the v1.1.0 pin bundle. | `commandlayer.eth` |
+## 2026-03-19 — Current-line authority reset
+
+- **Decision:** `v1.1.0` is the only current line.
+- **Rationale:** The repository exposed multiple surfaces without a hard authority order.
+- **Affected artifacts:** `README.md`, `meta/manifest.json`, `.well-known/*`, `checksums-v1.1.0.txt`, `dist-pin/agent-cards/v1.1.0/`.
+
+## 2026-03-19 — `dist-pin` classified as derivative
+
+- **Decision:** `dist-pin/agent-cards/v1.1.0/` is a derivative release bundle, not a source of truth.
+- **Rationale:** Root artifacts must remain canonical; repinning bundles must be reproducible outputs.
+- **Affected artifacts:** `README.md`, `.gitignore`, `scripts/validate-cards.mjs`, `scripts/generate-checksums.mjs`, `dist-pin/agent-cards/v1.1.0/`.
+
+## 2026-03-19 — Discovery model fixed to pointer + frozen snapshot
+
+- **Decision:** `.well-known/agent.json` is the current pointer and `.well-known/agent-cards-v1.1.0.json` is the frozen snapshot.
+- **Rationale:** Both files remain only if their relationship is explicit and validated.
+- **Affected artifacts:** `.well-known/agent.json`, `.well-known/agent-cards-v1.1.0.json`, `schemas/v1.1.0/agent.descriptor.schema.json`, `scripts/validate-cards.mjs`.
+
+## 2026-03-19 — Checksum scope split by line
+
+- **Decision:** `checksums-v1.1.0.txt` is the current integrity file; `checksums-v1.0.0.txt` is archival.
+- **Rationale:** A single checksum file mixed current and archival truth, which slowed review and hid scope.
+- **Affected artifacts:** `checksums-v1.1.0.txt`, `checksums-v1.0.0.txt`, `meta/manifest.json`, `README.md`, `scripts/generate-checksums.mjs`.
+
+## 2026-03-19 — v1.1.0 cards reduced to protocol bindings
+
+- **Decision:** Current cards now carry only binding-critical fields.
+- **Rationale:** Descriptive metadata and capability prose made the cards look like product copy instead of protocol records.
+- **Affected artifacts:** `schemas/v1.1.0/agent.card.schema.json`, `agents/v1.1.0/**/*.json`, `meta/manifest.json`, `scripts/validate-cards.mjs`.
+
+## 2026-03-19 — v1.0.0 marked archival and placeholders removed
+
+- **Decision:** `v1.0.0` remains for compatibility review only; fake mirror URLs and unverifiable PGP claims were removed.
+- **Rationale:** Placeholder bindings and stale provenance fields undermine trust even in archival material.
+- **Affected artifacts:** `agents/v1.0.0/**/*.json`, `README.md`, `SECURITY_PROVENANCE.md`.
diff --git a/SECURITY_PROVENANCE.md b/SECURITY_PROVENANCE.md
@@ -1,10 +1,22 @@
 # Security & Provenance — Agent Cards
 
-Agent Cards prove identity and routing intent. They do not prove execution success.
+## Trust anchors now
 
-For v1.1.0, provenance expectations are:
+Current trust is anchored by four surfaces:
 
-- direct upstream schema source URLs
-- direct commandlayer.org mirror URLs
-- deterministic repo checksums
-- mirrored publish bundle under `dist-pin/agent-cards/v1.1.0/`
+1. the canonical root artifacts under `agents/v1.1.0/`, `schemas/v1.1.0/`, `meta/`, and `.well-known/`
+2. the registry index in `meta/manifest.json`
+3. the scoped integrity file `checksums-v1.1.0.txt`
+4. release-time verification that current schema URLs, mirrors, and `x402` entry URIs resolve as expected
+
+## What `dist-pin` means now
+
+`dist-pin/agent-cards/v1.1.0/` is a derivative release bundle. It exists for repinning and distribution. It is not an authority surface. Validation requires it to match the canonical root artifacts byte-for-byte.
+
+## Why legacy provenance fields changed
+
+`v1.0.0` cards previously carried `pgp_fingerprint` claims without a maintained, verifiable key-distribution path in this repository. Those claims were removed. The archival line now keeps only explicit archival notes and still-valid URLs.
+
+## What Agent Cards do not prove
+
+Agent Cards prove identity bindings, schema bindings, and discovery bindings. They do not prove runtime behavior, payment execution, settlement, or service quality.
diff --git a/agents/v1.0.0/commercial/authorizeagent.eth.json b/agents/v1.0.0/commercial/authorizeagent.eth.json
@@ -1,51 +1,55 @@
 {
   "$schema": "https://commandlayer.org/agent-cards/schemas/v1.0.0/_shared/agent.card.base.schema.json",
   "$id": "https://commandlayer.org/agent-cards/agents/v1.0.0/commercial/authorizeagent.eth.json",
-
   "id": "authorizeagent.eth",
   "slug": "authorizeagent",
   "display_name": "Authorize Agent",
   "description": "Commercial reference agent for the authorize verb. Creates and manages payment authorizations or mandates without immediate capture.",
-
   "owner": "commandlayer.eth",
   "ens": "authorizeagent.eth",
   "version": "1.0.0",
   "status": "protocol_reference",
   "class": "commercial",
-
-  "implements": ["authorize"],
-
+  "implements": [
+    "authorize"
+  ],
   "schemas": {
     "request": "https://commandlayer.org/schemas/v1.0.0/commercial/authorize/requests/authorize.request.schema.json",
     "receipt": "https://commandlayer.org/schemas/v1.0.0/commercial/authorize/receipts/authorize.receipt.schema.json"
   },
   "schemas_mirror": {
-    "request": "https://ipfs.io/ipfs/COMMERCIAL_SCHEMAS_CID/commercial/authorize/requests/authorize.request.schema.json",
-    "receipt": "https://ipfs.io/ipfs/COMMERCIAL_SCHEMAS_CID/commercial/authorize/receipts/authorize.receipt.schema.json"
+    "request": "https://commandlayer.org/schemas/v1.0.0/commercial/authorize/requests/authorize.request.schema.json",
+    "receipt": "https://commandlayer.org/schemas/v1.0.0/commercial/authorize/receipts/authorize.receipt.schema.json"
   },
-
   "entry": "x402://authorizeagent.eth/authorize/v1.0.0",
-
   "capabilities": {
     "operations": [
       "create_authorization",
       "refresh_authorization",
       "cancel_authorization"
     ],
-    "input_types": ["application/json"],
-    "output_types": ["application/json"]
+    "input_types": [
+      "application/json"
+    ],
+    "output_types": [
+      "application/json"
+    ]
   },
-
   "meta": {
     "publisher": "CommandLayer",
     "contact": "dev@commandlayer.org",
-    "pgp_fingerprint": "5016 D496 9F38 22B2 C5A2 FA40 99A2 6950 197D AB0A",
-    "tags": ["authorize", "commercial", "payments", "mandates"]
+    "tags": [
+      "authorize",
+      "commercial",
+      "payments",
+      "mandates"
+    ],
+    "archival_note": "v1.0.0 is retained for compatibility only. Legacy PGP claims were removed because this repository no longer maintains a verifiable key-distribution path for them."
   },
-
-  "networks": ["eip155:1"],
+  "networks": [
+    "eip155:1"
+  ],
   "license": "Apache-2.0",
-
   "created_at": "2025-11-22T00:00:00Z",
   "updated_at": "2025-11-22T00:00:00Z"
 }