# Agent-Readiness Implementation Notes

Last updated: 2026-06-23.

## Supported discovery files

| Surface | Path |
| --- | --- |
| Content Signals | `/robots.txt` (Content-Signal: search=yes, ai-input=yes, ai-train=no) |
| AI summary | `/llms.txt` |
| Homepage markdown mirror | `/index.md` |
| Auth policy | `/auth.md` |
| Commerce policy | `/commerce-agent.md` |
| API catalog (linkset+json) | `/.well-known/api-catalog` |
| OpenAPI 3.1 descriptor | `/openapi.json` |
| OAuth Protected Resource metadata | `/.well-known/oauth-protected-resource` |
| OAuth Authorization Server metadata | `/.well-known/oauth-authorization-server` |
| OpenID Connect discovery | `/.well-known/openid-configuration` |
| OAuth placeholder authorize endpoint | `/oauth/authorize` (returns `not_implemented`) |
| OAuth placeholder token endpoint | `/oauth/token` (returns `not_implemented`) |
| MCP placeholder endpoint | `/mcp` (returns `not_implemented`) |
| A2A placeholder endpoint | `/a2a` (returns `not_implemented`) |
| Web Bot Auth / HTTP Message Signatures directory | `/.well-known/http-message-signatures-directory` |
| MCP Server Card | `/.well-known/mcp/server-card.json` |
| MCP canonical card (SEP-2127 alias) | `/.well-known/mcp-server-card` |
| MCP top-level index | `/.well-known/mcp.json` |
| MCP server cards list | `/.well-known/mcp/server-cards.json` |
| A2A Agent Card | `/.well-known/agent-card.json` |
| Agent Skills index | `/.well-known/agent-skills/index.json` |
| Agent Skills (markdown) | `/.well-known/agent-skills/request-quote.md`, `read-services.md`, `contact-business.md` |
| UCP commerce discovery | `/.well-known/ucp` |
| ACP commerce discovery | `/.well-known/acp.json` |
| WebMCP in-page tools | Registered defensively at runtime via `navigator.modelContext` when supported |

## Supported public agent actions

- Read any public marketing page on the site.
- Fetch every discovery document listed above.
- Guide a consenting human user through the public quote form (`/quote`) and contact form (`/contact`).
- Summarize services, service areas, and public company information.

## Unsupported and restricted actions

- `/admin/`, `/unsubscribe`, and any non-public or user-specific route are off-limits to agents.
- No programmatic lead, payment, or admin write API is exposed. Submissions must go through the public web form with explicit user consent.
- No OAuth/OIDC token, authorization, introspection, or revocation endpoints currently exist; discovery documents declare this truthfully.
- No live MCP server or A2A runtime endpoint is operated; the MCP Server Card and A2A Agent Card are static discovery metadata only and `/mcp` and `/a2a` return HTTP 501.
- No agentic payment, checkout, or AP2/MPP/x402 surface exists. See `/commerce-agent.md`.

## Auth policy

See `/auth.md`. Public read access is open; no bearer tokens are accepted; no agent registration endpoint is currently operated.

## Commerce and payment policy

See `/commerce-agent.md`. This is a lead-generation site. Pricing requires an on-site visit. UCP and ACP documents declare `paymentRequired: false` and `payments: false`.

## Contact and quote flow

Agents direct users to `/quote` or `/contact`. Direct phone numbers and addresses are listed on the public contact page. The business will follow up within one business day.

## Cloudflare deployment notes

The site is served through Cloudflare. App-level files live under `public/` and are deployed as static assets. Response-header concerns (RFC 8288 `Link` headers on `/`, MIME types for extension-less and `.md` paths, `Accept: text/markdown` content negotiation, DNS-AID SVCB/HTTPS records, DNSSEC) are implemented at the Cloudflare edge via a Worker, Transform Rules, and DNS records, as documented in `/CLOUDFLARE_MAX_AGENT_READINESS.md` in the source repository.

## Validation

- `curl -sI https://azpristinepainting.com/.well-known/api-catalog` returns `application/linkset+json` (after Cloudflare MIME rule).
- `curl -s https://azpristinepainting.com/openapi.json | jq .openapi` returns `"3.1.0"`.
- Skill digests: the `digest` field for each entry in `/.well-known/agent-skills/index.json` must be `sha256:{hex}` where the hex matches `sha256sum` of the corresponding `agent-skills/*.md` file.
- DNSSEC: check via DNSViz once the registrar enables it.
- `curl -s https://azpristinepainting.com/.well-known/mcp/server-card.json | jq '.serverInfo.name, .endpoint, .capabilities'` returns the advertised name, endpoint, and capabilities.
- `curl -s https://azpristinepainting.com/.well-known/agent-card.json | jq '.name, .version, .supportedInterfaces[0].protocolBinding'` returns the advertised agent name, version, and interface binding.

## Rollback

All app-level changes are static files under `public/`. Delete the files above and remove the `Content-Signal` line from `public/robots.txt`. Edge-level Cloudflare Worker, Transform Rules, and DNS records can be disabled independently from the Cloudflare dashboard.