A standard every product follows
Each product is described by a consistent set of machine-readable files so an agent can evaluate it the same way every time — manifest, agent card, license, risk rating, and verification checks.
The standard file set
Per product (mapped onto the existing product metadata):
product-manifest.json— identity, version, included files, referencesagent-card.json— the compact agent-facing summarylicense.json/risk-rating.json— machine-readable terms and riskverification-checks.json— the checks for a good deliverychangelog.md·support.md·refund-and-cancellation.md
Checksum honesty
Manifests carry sha256:PENDING-COMPUTED-AT-PACKAGING until real deliverable zips exist and hashes are computed at packaging. No fabricated checksum is ever published. Standards + templates live in the agent-native infrastructure layer.
The boundary that never moves
Public agent-readable discovery is free and ungated. Paid value is in the product packages, premium modules, subscriptions, updates, and support. No agent may purchase, subscribe, renew, procure an API, install an MCP server/tool, or onboard a vendor without prior human/business-owner authorization and budget permission. Checkout is not active and nothing is purchasable yet.