# xAgent ID

> Customer-controlled installation and evidence for SEO, AEO, GEO and AGO.

## Start here

1. Installation contract: `/.well-known/xagent-install.json?url=https://example.com`.
2. A2A interfaces and skills: `/.well-known/agent-card.json`.
3. Credentials and stop conditions: `/auth.md`.
4. Canonical installation workflow: `/skill.md`.
5. Quickstart: `/agent-quickstart.md`.

The install manifest is the source of truth for package version, npm integrity, target host, requested grants, bounded files, workflow commands and rollback. Do not reconstruct install commands from this page.

## What the service does

xAgent ID connects a customer-owned website Agent to measurement and recommendations:

- convert any public HTTPS website into a source-backed, A2A-compatible business Agent Card draft;
- audit public SEO, AEO, GEO and AGO readiness;
- collect observed crawler reads, fixed-question citations and conversion events;
- return evidence-backed improvement work to the website Agent;
- verify bounded changes with a customer receipt and an independent public refetch;
- retain rollback evidence and keep missing data separate from zero results;
- expose A2A, MCP and OpenAPI contracts for implemented operations.

## Authority boundary

- Default access is public read only.
- Domain ownership must be verified before private website actions.
- Site Agent credentials remain in a customer-controlled server, worker, CMS connector or repository Agent.
- xAgent ID does not request general source repository or deployment access.
- A bounded write requires explicit owner approval, an allowlisted AI-related path and a rollback method.
- Installation does not guarantee ranking, citation, recommendation, conversion or revenue lift.
- Synthetic and sample outcomes are not reportable evidence.

## Human business contact

- Open a company's public xAgent ID profile and use the AInbox handoff form to prepare a business inquiry.
- A person must review the message and click Send. An agent cannot send an inquiry automatically or execute tools through this path.
- An unclaimed profile is not an official company contact channel. xAgent ID holds submitted inquiries until a domain-verified owner claims that AInbox.
- Do not include the prior prompt text or a full referrer URL in a handoff message.

## Audit methodology

- Public audit: `GET /api/agent/audit_report?url=https://example.com`; methodology: `/docs/audit-methodology.md`; counter: `GET /api/agent/public_stats` (aggregated only). Schema `agentx-r1-audit-report-v0.2` with `schema_version` and `methodology_url` in every report; weighted pass-rate, not a ranking.

## Public website to Agent Card

- `GET /api/card?url=https://example.com`: build a source-backed card from bounded public pages.
- `POST /api/card/legal-entity/confirm`: a verified-domain controller binds one exact GLEIF LEI.
- Auto-matches are candidates; the `GLEIF LEI record` badge requires confirmation plus current domain and LEI records.
- No CMS access; publishing needs owner approval and domain verification.
- Candidate only: no certification, ranking, citation, conversion or revenue guarantee.

## Canonical public contracts

- Release manifest: `/.well-known/agent-id-release.json`
- Release receipt: `/.well-known/agent-id-release-receipt.json`
- Public identity: `/.well-known/agent-id.json`
- OAuth metadata: `/.well-known/oauth-authorization-server`
- OpenAPI: `/agent/openapi.json`
- MCP manifest: `/agent/mcp.json`; paste-ready client config in `invocation.mcp_servers` and `invocation.claude_code`
- Machine pricing: `/agent/pricing.json`
- Human dashboard: `/dashboard`

## Installation sequence

1. Fetch the target-bound install manifest.
2. Run the production preflight with no side effect.
3. Produce a dry-run plan in the actual website project root.
4. Show the owner the exact files, grants and rollback action.
5. Apply only after explicit owner approval.
6. Publish and verify the domain proof.
7. Activate read-only managed inspection if requested.
8. Use a one-time Dashboard pairing link for human review.

Stop when the release is not ready, the target host does not match, domain ownership is unverified, owner approval is missing, or refetch does not match the receipt.

## Evidence channels

- A1: observed AI crawler requests (customer-authorized logs only). A1 does not prove citation.
- A2: observed answers from a fixed prompt set; pending and failed rows kept separate. A2 does not prove conversion.
- B1: observed leads, RFQs, orders, CRM events or disclosed attribution surveys. B1 attribution does not prove incrementality.

## Agent calls

- Public audit: `POST /api/agent/audit`
- A2A audit task: `POST /a2a/v1/message:send` with `A2A-Version: 1.0`
- Gemini Enterprise compatibility: `POST /a2a/v0.3/v1/message:send` with `A2A-Version: 0.3`
- Private website actions: `POST /api/site_agents/call` with a verified-domain Site Agent Key
- Read installation guide: `GET /api/site_agents/install_guide?url=https://example.com`
- Read capabilities: `GET /api/agent/capabilities`

Use the Agent Card, OpenAPI or installation guide for POST requests.

## Operational workflow registry

- Route before modules: `POST /api/agent/workflow_router` (`w1_workflow_router`). Choose the route before running modules.
- Review a package: `POST /api/agent/package_review` (`s2_package_review`) for Agent marketplace review.
- Validate a skill package: `POST /api/agent/skill_package_validate` (`s1_skill_package_validation`); `validation_does_not_execute_package_code`.
- Prepare marketplace evidence: `POST /api/agent/marketplace_submission` (`marketplace_submission_pack`); result is `not_marketplace_approved` until external approval exists.
- Read readiness: `GET /api/agent/marketplace_readiness` (`marketplace_readiness_score`).
- Record approvals: `POST /api/agent/marketplace_approval_receipts` (`marketplace_approval_receipts`); `approved_only_for_listed_platforms`.
- Read billing guidance: `GET /api/agent/billing_guide` (`agent_billing_guide`); `checkout_intent_is_not_payment_confirmation`.

Machine-readable Customer SDK contract:

- createSiteAgentClient().contentWorkflow: content_workflow_package; content diagnosis, answer-first rewrite.
- createSiteAgentClient().contentPublication: content_publication_package.
- createSiteAgentClient().promptTestCycle: prompt_test_run_sheet -> prompt_test_results.
- createSiteAgentClient().contentPack.
- createSiteAgentClient().aiReads: a1_ai_reads; observed server/CDN logs. createSiteAgentClient().a1ReadPackage: a1_read_evidence_package.
- createSiteAgentClient().conversions: b1_conversions. createSiteAgentClient().b1ConversionPackage: b1_conversion_evidence_package; not incrementality proof.
- createSiteAgentClient().outcomeReport: outcome_report. createSiteAgentClient().outcomePackage: m1_outcome_evidence_package. createSiteAgentClient().outcomeReview. createSiteAgentClient().optimizationCycle: optimization_cycle.
- createSiteAgentClient().jobDrafts: job_drafts. createSiteAgentClient().acceptJobDraft: accept_job_draft. createSiteAgentClient().decideJobDraft: decide_job_draft. createSiteAgentClient().draftDecisions: draft_decisions. These helpers do not start implementation work; does not accept drafts automatically.
- createSiteAgentClient().monthlyEvidenceLoop. Required request field: url. Optional request fields: audit_url, questions, competitors, engines, content, content_pack, period.
- Response fields: ok, action, pack, review, review_gate, repair_pack when blocked or advisory, repair_job_drafts when blocked or advisory, package, tracker, scorecard, dashboard, delivery_summary, steps.
- The base sequence is `content_pack -> content_workflow_review -> monthly_package -> monthly_tracker -> monthly_scorecard -> monthly_dashboard`. content_repair_pack; repair_job_drafts; delivery_summary.decision_queue; does not accept or start jobs automatically; review_gate repair_items; not an AI citation claim.

## Google identity boundary

The `agt_*` identifier is an xAgent ID portable alias, not Google Agent Identity. Google provisions that identity; xAgent ID only prepares and verifies a binding candidate.

Read `/api/agent/google_identity_bridge` for the onboarding plan. A verified Google binding requires authenticated server-side Google API evidence and an issuer-signed receipt.

## Human and legal routes

- Product home: `/`
- Dashboard: `/dashboard`
- Privacy: `/privacy`
- Terms: `/terms`
- Contact: `/contact`

## Pricing contract

XAGENT-PRICING-20261007-v1: Free Check is free; Identity US$29.99/month (AI Friendly), AInbox US$49.99/month, Agentic US$99.99/month, Operate US$199.99/month. Paid new purchases are closed by default pending delivery acceptance. Agent Skills are coming later and not available; planned total slots are 1 for Agentic and 2 for Operate. Future Agent Store additions are US$50/month per Agent with no purchase entry. Availability: /agent/pricing.json. Monitor and Scale: historical.