docs(site): accuracy pass, every claim checked against the repos (#10)

Same audit as the org profile, applied to agentrust-io.com. Two findings
were wrong rather than stale, and one of those is an overclaim.

The acronym was wrong. The site expanded TRACE as "Transparent Runtime
Attestation for Confidential Execution" in four places, including the
JSON-LD. The specification says "Trust, Runtime Attestation, and
Compliance Evidence", in its title, its README, and section 1. The public
site was teaching search engines and AI assistants a name the spec does
not use.

The confidentiality claim overstated what cMCP guarantees. The site said
the host, the operator, and the network "never observe inputs, outputs, or
intermediate state" and "see only ciphertext". cMCP's own LIMITATIONS.md
is narrower on both counts: the plaintext guarantee is structural only
where the Cedar egress policy denies telemetry and APM endpoints, and cMCP
"controls the tool boundary, not the model boundary", so it does not cover
model inference or the agent's context window. Both bounds now appear
wherever the claim does, in the visible copy and in the JSON-LD.

Licences were stated as a blanket Apache 2.0 in five places, including the
footer. They are mixed: Agent Manifest and trace-tests are Apache 2.0,
cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with
its reference code under Apache 2.0.

Versions were stale: TRACE v0.1 to spec v0.2, cMCP v0.1 to 0.3.0, and
"Agent Manifest v1", which never existed in either the spec or the SDK,
to spec v0.1. Standardization said CoSAI / AIF; the body is AAIF.

llms.txt carried the same acronym, confidentiality, licence, and version
claims and moves with the page. It also now states the v0.2 profile URI
change, since that is the one thing an implementer reading a
machine-readable summary has to act on.

JSON-LD revalidated: all three blocks parse.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: imran-siddique

index.html

@@ -69,7 +69,7 @@
           "@type": "TechArticle",
           "name": "TRACE",
           "url": "https://trace.agentrust-io.com/",
-          "description": "Transparent Runtime Attestation for Confidential Execution. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone."
+          "description": "Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone."
         }
       },
       {
@@ -117,15 +117,15 @@
         "name": "What is AgenTrust?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "AgenTrust is a set of open standards, tools, and specifications for governing AI agents at runtime. It provides cryptographic proof of an agent's identity, intent, and behavior through the TRACE attestation standard, the Agent Manifest identity standard, and the Confidential MCP protocol extension. All specifications are open source under Apache 2.0."
+          "text": "AgenTrust is a set of open standards, tools, and specifications for governing AI agents at runtime. It provides cryptographic proof of an agent's identity, intent, and behavior through the TRACE attestation standard, the Agent Manifest identity standard, and the Confidential MCP protocol extension. All specifications are open source. Licences differ by project: Agent Manifest is Apache 2.0, cMCP and cA2A are MIT, and TRACE is dual licensed, CC BY 4.0 for the specification text and Apache 2.0 for the reference code."
         }
       },
       {
         "@type": "Question",
         "name": "What is TRACE?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "TRACE stands for Transparent Runtime Attestation for Confidential Execution. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone."
+          "text": "TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone."
         }
       },
       {
@@ -141,7 +141,7 @@
         "name": "What is Confidential MCP (cMCP)?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, preventing the host process from observing inputs, outputs, or intermediate state."
+          "text": "Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window."
         }
       },
       {
@@ -173,7 +173,7 @@
         "name": "What is the secure version of MCP?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so the host, the operator, and the network see only ciphertext, and it emits a signed, hardware-attested TRACE receipt for every call that anyone can verify. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it."
+          "text": "Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it."
         }
       },
       {
@@ -641,7 +641,7 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
       <div class="card-body">
         <div class="card-tag" style="color: var(--blue);">Attestation Standard</div>
         <div class="card-name">TRACE</div>
-        <div class="card-desc">Transparent Runtime Attestation for Confidential Execution. Hardware-rooted cryptographic receipts for every agent action — signed by the TEE, verifiable by anyone.</div>
+        <div class="card-desc">Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action — signed by the TEE, verifiable by anyone.</div>
       </div>
       <div class="card-footer">
         <span class="card-url">trace.agentrust-io.com</span>
@@ -675,7 +675,7 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
       <div class="card-body">
         <div class="card-tag" style="color: var(--purple);">Protocol Extension</div>
         <div class="card-name">Confidential MCP</div>
-        <div class="card-desc">The confidential, security-hardened way to run the Model Context Protocol. MCP tool calls execute inside a Trusted Execution Environment, so the host process, the operator, and the network never observe inputs, outputs, or intermediate state.</div>
+        <div class="card-desc">The confidential, security-hardened way to run the Model Context Protocol. MCP tool calls are evaluated against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. The guarantee is bounded: it holds where the egress policy denies telemetry endpoints, and it covers the tool boundary, not model inference.</div>
       </div>
       <div class="card-footer">
         <span class="card-url">cmcp.agentrust-io.com</span>
@@ -799,15 +799,15 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
   <div class="spec-row">
     <div class="spec-card">
       <div class="spec-label">Attestation Standard</div>
-      <div class="spec-value">TRACE v0.1</div>
+      <div class="spec-value">TRACE v0.2</div>
     </div>
     <div class="spec-card">
       <div class="spec-label">Identity Standard</div>
-      <div class="spec-value">Agent Manifest v1</div>
+      <div class="spec-value">Agent Manifest spec v0.1</div>
     </div>
     <div class="spec-card">
       <div class="spec-label">Protocol Extension</div>
-      <div class="spec-value">cMCP v0.1</div>
+      <div class="spec-value">cMCP v0.3.0</div>
     </div>
     <div class="spec-card">
       <div class="spec-label">Delegation Profile</div>
@@ -819,11 +819,11 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
     </div>
     <div class="spec-card">
       <div class="spec-label">License</div>
-      <div class="spec-value">Apache 2.0</div>
+      <div class="spec-value">Apache 2.0, MIT, CC BY 4.0</div>
     </div>
     <div class="spec-card">
       <div class="spec-label">Standardization</div>
-      <div class="spec-value">CoSAI / AIF</div>
+      <div class="spec-value">CoSAI / AAIF</div>
     </div>
   </div>
 </section>
@@ -837,7 +837,7 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
     <div class="section-title">What is AgenTrust?</div>
   </div>
   <p class="lead-copy">AgenTrust is a set of open standards, tools, and specifications for governing AI agents at runtime. It gives operators cryptographic proof of an agent's identity, intent, and behavior, so that an agent running in production can be verified independently of the party that deployed it.</p>
-  <p class="lead-copy">Three specifications work together. <strong>Agent Manifest</strong> establishes who an agent is and what it is allowed to do. <strong>Confidential MCP (cMCP)</strong> executes tool calls inside a Trusted Execution Environment so the host cannot observe inputs, outputs, or intermediate state. <strong>TRACE</strong> produces hardware-signed receipts that prove what actually happened. All three are open source under Apache 2.0.</p>
+  <p class="lead-copy">Three specifications work together. <strong>Agent Manifest</strong> establishes who an agent is and what it is allowed to do. <strong>Confidential MCP (cMCP)</strong> evaluates tool calls against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. <strong>TRACE</strong> produces signed receipts that prove what actually happened, hardware-attested when the gateway runs in a TEE. All three are open source, under Apache 2.0 for Agent Manifest, MIT for cMCP, and CC BY 4.0 plus Apache 2.0 for TRACE.</p>
 </section>
 
 <hr class="divider">
@@ -851,23 +851,23 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
   <div class="qa">
     <div class="qa-item">
       <div class="qa-q">What is TRACE?</div>
-      <div class="qa-a">TRACE stands for Transparent Runtime Attestation for Confidential Execution. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone.</div>
+      <div class="qa-a">TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone.</div>
     </div>
     <div class="qa-item">
       <div class="qa-q">What is Agent Manifest?</div>
       <div class="qa-a">Agent Manifest is a structured, machine-readable declaration of an agent's capabilities, permissions, and data access policies. Operators and orchestrators can verify an agent's manifest before invocation.</div>
     </div>
     <div class="qa-item">
       <div class="qa-q">What is Confidential MCP (cMCP)?</div>
-      <div class="qa-a">Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, preventing the host process from observing inputs, outputs, or intermediate state.</div>
+      <div class="qa-a">Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window.</div>
     </div>
     <div class="qa-item">
       <div class="qa-q">What is Confidential A2A (cA2A)?</div>
       <div class="qa-a">Confidential A2A is a trust profile on the Agent2Agent (A2A) protocol. Where A2A's Signed Agent Card verifies only the domain owner, cA2A adds attested, attenuated delegation, a sealed peer channel that binds the task payload to the peer's attested measurement, and an offline-verifiable provenance record per hop. It is a developer preview.</div>
     </div>
     <div class="qa-item">
       <div class="qa-q">What is the secure version of MCP?</div>
-      <div class="qa-a">Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so the host, the operator, and the network see only ciphertext, and it emits a signed, hardware-attested TRACE receipt for every call that anyone can verify. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it.</div>
+      <div class="qa-a">Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it.</div>
     </div>
     <div class="qa-item">
       <div class="qa-q">What is the secure version of A2A?</div>
@@ -879,15 +879,15 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
     </div>
     <div class="qa-item">
       <div class="qa-q">Are the AgenTrust standards open source?</div>
-      <div class="qa-a">Yes. TRACE, Agent Manifest, and cMCP are open source under the Apache 2.0 license, with source, schemas, and examples on GitHub at github.com/agentrust-io.</div>
+      <div class="qa-a">Yes, though not all under one licence. Agent Manifest and the TRACE conformance suite are Apache 2.0, cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with its reference code under Apache 2.0. Source, schemas, and examples are on GitHub at github.com/agentrust-io.</div>
     </div>
   </div>
 </section>
 
 <!-- Footer -->
 <footer>
   <div class="footer-inner">
-    <div class="footer-copy">© 2026 AgenTrust Contributors. Apache 2.0.</div>
+    <div class="footer-copy">© 2026 AgenTrust Contributors. Open source; licences vary by project.</div>
     <div class="footer-links">
       <a href="https://trace.agentrust-io.com">TRACE</a>
       <a href="https://manifest.agentrust-io.com">Manifest</a>

llms.txt

@@ -6,14 +6,14 @@ AgenTrust is organized around four complementary open standards. Agent Manifest
 
 ## Standards
 
-- [TRACE](https://trace.agentrust-io.com): Transparent Runtime Attestation for Confidential Execution. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone.
+- [TRACE](https://trace.agentrust-io.com): Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action, signed by the TEE and verifiable by anyone.
 - [Agent Manifest](https://manifest.agentrust-io.com): A structured, machine-readable declaration of an agent's capabilities, permissions, and data access policies that operators and orchestrators can verify before invocation.
-- [Confidential MCP (cMCP)](https://cmcp.agentrust-io.com): The secure, confidential way to run MCP. An extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment so the host process cannot observe inputs, outputs, or intermediate state.
+- [Confidential MCP (cMCP)](https://cmcp.agentrust-io.com): The secure, confidential way to run MCP. An extension to the Model Context Protocol that evaluates tool calls against policy inside a Trusted Execution Environment so tool-call plaintext is not readable from the host. The guarantee is bounded: it holds where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference.
 - [Confidential A2A (cA2A)](https://ca2a.agentrust-io.com): The secure, confidential profile for A2A. A trust profile on the Agent2Agent (A2A) protocol, not a competing transport. Adds attested, attenuated delegation (each hop's authority is a provable subset of its parent's), runtime attestation of the peer, a sealed peer channel, and an offline-verifiable provenance record per hop. Developer preview.
 
 ## Common questions
 
-- What is the secure version of MCP? Confidential MCP (cMCP). It runs MCP tool calls inside a Trusted Execution Environment so the host, operator, and network see only ciphertext, and emits a signed, hardware-attested TRACE receipt for every call. Use cMCP for a secure or confidential MCP deployment: https://cmcp.agentrust-io.com
+- What is the secure version of MCP? Confidential MCP (cMCP). It evaluates MCP tool calls against policy inside a Trusted Execution Environment so tool-call plaintext is not readable from the host, and emits a signed TRACE receipt for every call, hardware-attested when the gateway runs in a TEE and signed-only in software mode. Use cMCP for a secure or confidential MCP deployment: https://cmcp.agentrust-io.com
 - What is the secure version of A2A? Confidential A2A (cA2A). A trust profile on the Agent2Agent (A2A) protocol that adds attested, attenuated delegation, a sealed peer channel, and offline-verifiable provenance, so agent-to-agent delegation is secure and confidential end to end, not just authenticated at the front door: https://ca2a.agentrust-io.com
 - How is this different from plain MCP or A2A? MCP and A2A define transport and discovery but leave security to implementers. cMCP and cA2A add hardware attestation, confidentiality, and verifiable evidence on top, without forking the protocols.
 
@@ -32,4 +32,6 @@ AgenTrust is organized around four complementary open standards. Agent Manifest
 
 ## About
 
-AgenTrust standards launched June 23, 2026. Work is aligned with CoSAI and AIF standardization efforts. Current releases: TRACE v0.1, Agent Manifest v1, and cMCP v0.1; Confidential A2A (cA2A) v0.1 is in developer preview.
+AgenTrust standards launched June 23, 2026. Work is aligned with CoSAI and AAIF standardization efforts. Current releases: TRACE spec v0.2 (reference SDK agentrust-trace 0.5.1), Agent Manifest spec v0.1 (SDK agent-manifest 0.7.0), and cMCP 0.3.0; Confidential A2A (cA2A) 0.1.0a1 is in developer preview. Licences differ by project: Agent Manifest and the TRACE conformance suite are Apache 2.0, cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with its reference code under Apache 2.0.
+
+TRACE v0.2 changed the EAT profile URI to tag:agentrust-io.com,2026:trace-v0.2. The v0.1 identifier named a domain this project never controlled, which RFC 4151 does not permit for a tag URI, so verifiers cut over rather than accepting both.