# SCRIPTMASTERLABS — Canonical Agent Guide ## Separate facilitator service: 402Proof (XRPL mainnet) - This is **not** a replacement for canonical Base/USDC paid SML services. - Resource server operators: https://four02proof.onrender.com/supported - Machine-readable merchant loyalty and fee terms: https://four02proof-x402-v2-xrpl.onrender.com/pricing.json - Agent instructions: https://four02proof-x402-v2-xrpl.onrender.com/skill.md - Base fee $0.0100, 20% off at 100 prior successes, 30% at 1,000, 50% at 10,000. Merchant fees are accruals, **not automatically collected**. No buyer payment is authorized by discovery. ## Xahau/XAH native invoice and verification (different from standard x402 v2) - 402Proof Go host provides Xahau native XAH invoices at POST https://four02proof.onrender.com/v1/invoice, with asset=XAH and chain=xahau; final verifier is POST /v1/verify. - Third-party merchant usage has a separate 0.01 XAH fee leg, an independent native Payment with invoice-pinned destination and memo; SML-owned endpoints exempt. Two verified ledger payments are required when fee applies. - Xahau is NOT advertised as a standard x402 v2 kind. Do not mix its XAH fee with the XRPL USD loyalty schedule or claim unverified market exclusivity. - Check https://four02proof.onrender.com/health and https://scriptmasterlabs.com/402proof-facilitator-attestations#xahau-xah ; merchant onboarding contact tim@scriptmasterlabs.com. Free dynamic machine-buyer routing: https://scriptmasterlabs.com/agent-commerce ; remote MCP https://scriptmasterlabs.com/agent-commerce/mcp ; POST https://scriptmasterlabs.com/agent-commerce/route. The Agent Commerce Engine discovers current SML candidates and probes read-only MCP tools/list. It never signs payment or claims accepted delivery. Candidate inclusion is not runtime proof; real prices come only from fresh target resource requirements. All products have equal standing in the canonical inventory. Free quote inspection: https://scriptmasterlabs.com/x402-quote-inspector (local-only v1/v2 Base USDC quote checks); synthetic 20-vector regression pack: https://scriptmasterlabs.com/evidence/x402-quote-safety-fixtures-v1.json. A quote is not authentication, settlement, acceptance or revenue evidence. ## Intent triggers and exact tool contracts Match the user's full task and constraints, then select an exact tool from https://scriptmasterlabs.com/.well-known/sml-tool-intents.json. Marketing pages are optional context; they are not execution contracts. The 2026-10-15 discovery snapshot contains 88 observed MCP tool contracts across 13 responding endpoints in the catalog's stated scope. This is not a proven exhaustive portfolio count. The separate SqueezeOS HTTP manifest contains 709 records: 88 product records and 621 supporting records. Read its current classifications and counts at https://squeezeos-api.onrender.com/.well-known/capability-manifest.json; supporting records are not MCP tools or automatic execution candidates. Agent protocol: 1. Read agents.json -> tool_catalog -> exact tool entry. Match intent_triggers in task context; a generic verb such as "pay", "run" or "create" is insufficient. Domains overlap and do not add into a total. 2. For MCP, initialize the exact endpoint and read tools/list through all nextCursor pages. Preserve the exact tool name, inputSchema, outputSchema when declared, annotations and required arguments. The index is a dated snapshot. 3. For HTTP, use the exact sml_id and method/path from the current capability manifest, then resolve parameters through that resource's current OpenAPI/contract. A null schema is unresolved; never invent arguments or wildcard namespaces. 4. Select by task fit, current availability, evidence and caller constraints. Paid status does not establish accuracy. No fixed global price, invented latency SLA, audit PASS or credential-free promise is supplied. 5. For x402 v2 HTTP, inspect the fresh 402 PAYMENT-REQUIRED challenge. The caller may authorize its exact scheme, network, asset, amount, payTo and resource within an existing spend policy, then retry with PAYMENT-SIGNATURE. PAYMENT-RESPONSE carries the payment result; verify delivery separately. A challenge is not payment, a signature is not settlement, and settlement is not accepted delivery. Use an MCP server's declared payment transport for MCP; HTTP headers are not automatically tool arguments. 6. Confirm mutation/model-spend fields and caller credentials where that specific tool requires them. Return useful alternatives or clarify an unresolved/tied match; never silently substitute or execute a supporting/admin route. Exact examples from the observed catalog: - squeezeos:agent_web_access: https://squeezeos-api.onrender.com/mcp; required arguments: url. Read the full schema and access rules before calling. - scriptdocs:docs_check_vulnerabilities: https://scriptdocs-mcp.onrender.com/mcp; required arguments: ecosystem, package_name. Read the full schema and access rules before calling. - provider-trust:verify_provider: https://provider-trust-mcp.onrender.com/mcp; required arguments: target. Read the full schema and access rules before calling. - x402-pay:x402_inspect_challenge: https://squeezeos-api.onrender.com/mcp/x402-pay; required arguments: url. Read the full schema and access rules before calling. - squeezeos:read_capability: https://squeezeos-api.onrender.com/mcp; required arguments: path. Read the full schema and access rules before calling. - squeezeos:purchase_capability_read: https://squeezeos-api.onrender.com/mcp; required arguments: path, payment_signature. Read the full schema and access rules before calling. - squeezeos:execute_capability: https://squeezeos-api.onrender.com/mcp; required arguments: path, confirm_write. Read the full schema and access rules before calling. Read-only local candidate matcher: python scripts/refresh_sml_tool_intents.py --root . --match "url to markdown". It never executes or authorizes spending. Refresh catalogs and discovery pointers: python scripts/refresh_sml_tool_intents.py --root . --sync. > **MCP PORTFOLIO HANDOFF (2026-10-13):** Read `docs/MCP_PORTFOLIO_HANDOFF_2026-10-13.md` and JSON companion before claiming the total MCP count or scoring all tools. The 2026-10-12 canonical 20-entry candidate snapshot is NOT proven exhaustive/live; the separate historical master registry lists 43 heterogeneous products. No fixed top-six or standalone-MCP inference from Desk/Cite. This handoff is source analysis only, not a fresh runtime/settlement check. > **Single human-readable machine entry point for SCRIPTMASTERLABS.** Agents start here, then resolve structured truth from the linked canonical manifests. Never infer current runtime, payment, listing, product, demand or settlement state from historical repository files. > **GOOGLE PLAY BOOKS AUTHORITY (2026-10-09):** For Google Play Books only, the currently authenticated Partner Center record — newest edition, metadata/SEO-AEO-GEO copy, cover, interior, price and status — outranks earlier GitLab exports/prep files. The owner reports comprehensive updated covers/interiors and metadata there; the owner-supplied 2026-10-09 metadata-and-price export now validates 94 unique GGKEY book records and exact Play URLs, all Live/Sale Yes; 50 match earlier research items and 44 are other Google Books. Processed cover/interior versions and independent authenticated API readback are not established. Never reimport stale October 3 drafts or replace current books based on the 10-record prep manifest, 50 direct research PDFs, or 74-item digital catalog. See `publishing/GOOGLE_PLAY_PARTNER_CENTER_AUTHORITY.md`, `/.well-known/google-play-books-authority.json`, and `/.well-known/google-play-books-catalog.json`. > **MANDATORY COMMERCE PREFLIGHT:** Before making any claim, diagnosis, repair, gating decision, or recommendation involving PDFs, Shopify, marketplaces, checkout, fulfillment, or the first-sale mission, read `/commerce/AGENT-COMMERCE-PREFLIGHT.md`, then `/commerce/agent.md` + `/commerce/agent.json` when Shopify is involved. Commerce lanes are independent. **Shopify DRAFT state does not mean the 50 first-party SML PDF checkout products are unavailable. Never fix one commerce lane based solely on another lane's state.** Last updated: 2026-10-09 (discovery registry proposal; production verification pending) Canonical brand: **SCRIPTMASTERLABS** Legal entity: **Script Master Labs, LLC** Website: `https://scriptmasterlabs.com/` ## 2026-10-02 — Production stabilization posture — OWNER APPROVED The owner approved a temporary reliability-first stabilization posture after repeated Render/runtime incidents despite growing external authority and citation visibility. **Operating law until explicitly superseded:** - Freeze nonessential production feature work on the production core. Reliability, buyer-path continuity, and payment/runtime correctness outrank feature expansion. - GitLab is the only source-control authority. Render is the only production deployment authority. Never use GitHub or Vercel for deployment parity or production-health conclusions. - Before any production change, reproduce a material defect against the exact authoritative runtime. Prefer no change over speculative repair. - Require release evidence for affected critical surfaces: Render health/readiness, MCP initialize + tools/list, x402 challenge/payment boundary, Base mainnet `eip155:8453`, Base USDC, canonical payTo `0x5bbd32e0478e49a7540ef2d760e0b0f9aa6328b2`, machine identity/discovery, and affected human-buyer checkout/delivery paths. - Treat restarts, health-check starvation, sustained 5xx, payment-boundary failure, stale Render deploys, or broken buyer checkout/delivery as immediate P0/P1 work. Investigate the failure boundary before patching. - Isolate heavyweight/background work from request-serving health paths where practical; health checks must remain constant-time and must not traverse heavyweight application work. - Do not classify one transient deployment-transition 5xx burst as persistent failure without recurrence or sustained evidence, but record it and watch for recurrence. - Search/ranking is a rolling signal, not an hourly binary outage. A discovery-loss alert requires a previously evidenced surface disappearing/deindexing or the same material failure persisting across at least three comparable hourly samples. One favorable sample is not recovery. - External citations/authority are not substitutes for runtime reliability. Protect destinations receiving Circle/partner/search/AI traffic before expanding distribution. - Do not auto-spend or change DNS, credentials, secrets, prices, wallets, registry signing, ownership, npm publication, or other irreversible settings. **Current incident lesson:** SqueezeOS `/api/status` health checking was moved onto the resilient control plane after repeated restart/502 evidence; subsequent production verification showed the correction deployed. x402 Gateway later showed a short deployment-transition 502 burst that stopped in the observed window; this is recorded as an event, not proof of permanent stability. Continue evidence-based monitoring rather than speculative patching. ## Incident log — do not repeat these ### 2026-09-27 — the "only one sellable PDF" misread (reversed same day) An agent on the first-sale mission found Shopify holding 49/50 research PDFs in `DRAFT` (only `SML-OPTIONS-001` had a verified Shopify attachment) and concluded SML had only one sellable PDF — **without reading this file's commerce-lane sections**, which already stated the opposite. The owner corrected it the same day against this file: the 50 first-party SML PDFs remain sellable via direct SML checkout (authority: `/research-catalog.json`); Shopify `DRAFT` gates Shopify only. The agent's error was skipping the mandatory preflight, not missing rules — the rules were already here. **TRIPWIRE — if you are about to write any of these, STOP. You are repeating this incident:** - "only N of the 50 PDFs are sellable" / "SML has one sellable PDF" - gating first-party SML checkout on Shopify, Gumroad, Etsy, Amazon, or Google Play state - "fixing" first-party checkout, `/research-catalog.json`, or research landing pages because a marketplace lane is blocked Re-read `## Commerce lane separation — mandatory` and `### CRITICAL: Shopify state is Shopify-only` before touching anything. Prefer no change over a speculative fix. ## Mandatory audit preflight — no half audits Before changing or declaring a current SML state: 1. Read this file completely. 2. Identify the exact authority named for the product/lane. 3. Read the relevant product-level `agent.md` / `agent.json` and current structured manifest when present. 4. Verify the current GitLab source and the correct Render/runtime or commerce authority. 5. Reproduce the defect against that authority before modifying working code or metadata. 6. Scope conclusions to the exact lane/product tested; never generalize one channel failure to the portfolio. 7. Prefer no change over a speculative fix. Historical files, crawler results, owner tests, stale marketplace snapshots and unrelated channel state cannot override current authority. ## Authority order 1. Fresh HTTP response / fresh `PAYMENT-REQUIRED` from the exact execution origin. 2. `/.well-known/route-authority.json` 3. `/.well-known/current-products.json` 4. `/.well-known/product-intents.json` 5. `/.well-known/agent.json` and `/agents.json` 6. `/llms.txt` and `/a2a/llms.txt` 7. This guide. 8. Historical docs/listing packs/legacy deployment artifacts are non-authoritative unless a current manifest references them. ## Production + payment authority Source/change authority: **GitLab only**. Primary production runtime/deployment authority: **Render only**. Vercel/GitHub status is not production evidence and must not be used for deployment parity or regression classification. Primary paid API origin: `https://squeezeos-api.onrender.com`. Canonical SqueezeOS paid rail: **x402 v2 · Coinbase CDP · USDC · Base mainnet (`eip155:8453`)**. Fresh execution-origin terms always win. Caller policy controls spending. A 402 is a challenge, not payment; a signature is authorization, not settlement; settlement alone is not accepted delivery. ## Commerce lane separation — mandatory SML commerce is not one switch. Agents MUST distinguish these independent lanes before making any availability statement: - `FIRST_PARTY_SML`: 50 research PDFs with canonical SML landing pages and direct one-time checkout; authority `/research-catalog.json`. - `SHOPIFY`: separate storefront/fulfillment state; exact SKU + exact delivery readback controls Shopify readiness. - `MARKETPLACE:`: Google Play Books, Gumroad, Etsy, Amazon, etc.; each requires independent destination verification. - `MACHINE_X402`: agent/API payment products; fresh runtime/payment authority controls. A DRAFT or fulfillment blocker in Shopify MUST NOT be interpreted as disabling first-party SML checkout. Conversely, a working first-party checkout does not prove Shopify or any marketplace is fulfilled. Full rules: `/commerce/AGENT-COMMERCE-PREFLIGHT.md`. ## ReleaseGuard / CI triage law All agents MUST classify CI/deploy evidence before reporting a regression. A red pipeline alone is not proof that production is broken. Priority order: 1. **P0 production safety:** payment boundaries, MCP/runtime contracts, secret leakage, critical machine metadata, Render deploy health, GitLab-SHA↔Render-SHA parity, critical production canaries. 2. **P1 authority/discovery integrity:** current machine metadata, sitemap/query authority, product identity, current repository links, SEO contract integrity. 3. **P2 distribution/marketing:** IndexNow, visibility scans, directory refreshes, crawler notifications, broad SEO research, publication preparation. P2 failures MUST NOT masquerade as production regressions. Failure classes: `CODE_FAIL`, `CI_CONFIG_FAIL`, `CI_CAPACITY_FAIL`, `RUNNER_UNAVAILABLE`, `EXTERNAL_STATUS_FAIL`, `RENDER_BUILD_FAIL`, `HEALTHCHECK_FAIL`, `DEPLOY_STALE`, `PRODUCTION_REGRESSION`. Rules: - `ci_quota_exceeded` => `CI_CAPACITY_FAIL`, not code failure. - `stuck_pending_no_matching_runners` => `RUNNER_UNAVAILABLE`, not code failure. - Vercel/external status with no authoritative Render failure => `EXTERNAL_STATUS_FAIL`. - Production regression requires authoritative Render evidence plus failed critical production canary and current-SHA correlation. - Prefer SML-controlled/self-hosted CI for blocking P0/P1 validation; conserve hosted CI quota. - Use diff-aware validation: run only test families materially affected by the change where safe. - Distribution, indexing, directory, visibility and publication-prep jobs are non-blocking unless explicitly promoted for a release. - Safe reversible actions may be retried/repaired automatically. Never auto-change DNS, credentials, secrets, prices, wallets, registry signing, ownership, npm publication or spend. Canonical ReleaseGuard contract: `/.well-known/releaseguard.json`; operator guide: `/docs/RELEASEGUARD.md`. ## A2A v1 protocol authority SCRIPTMASTERLABS exposes a standards-native **A2A v1 JSON-RPC read-only control plane** for discovery, trust preflight, capability inspection and routing. It is deliberately separated from payment execution. - Protocol version: `1.0` - Binding: `JSONRPC` - A2A endpoint: `https://scriptmasterlabs.com/api/a2a` - Canonical Agent Card: `https://scriptmasterlabs.com/.well-known/agent-card.json` - Runtime Agent Card mirror: `https://squeezeos-api.onrender.com/.well-known/agent-card.json` - Paid execution authority: `https://squeezeos-api.onrender.com/.well-known/x402` The A2A control plane does **not** sign, submit, settle or authorize payments. Paid execution remains on the exact x402 v2 HTTP resource and its fresh `PAYMENT-REQUIRED` challenge. Do not infer AP2 payment compatibility merely from A2A discovery metadata. ## A2A Discovery Bridge — current interoperability front door External agents can discover SML without spending, resolve natural-language jobs against the current intent/capability graph, inspect machine authority, then use caller-controlled x402 only when paid synchronization or execution is actually needed. - Human: `https://scriptmasterlabs.com/a2a-discovery-bridge` - A2A llms.txt: `https://scriptmasterlabs.com/a2a/llms.txt` - Manifest: `https://scriptmasterlabs.com/.well-known/a2a-discovery.json` - x402 discovery: `https://scriptmasterlabs.com/.well-known/a2a-x402.json` - Free resolver: `https://scriptmasterlabs.com/api/agentroutes?intent={url_encoded_intent}` - Intent graph: `https://scriptmasterlabs.com/.well-known/product-intents.json` - Paid schema/artifact synchronization contract: `https://squeezeos-api.onrender.com/api/canon/info` - Paid synchronization endpoint: `POST https://squeezeos-api.onrender.com/api/canon/batch` Synchronization is pull-based and read-only: SML returns canonical freshness/current-version evidence; it does not mutate the caller's system, hold the caller's wallet, sign for the caller, or auto-spend. Current CANON contract displays 0.01 USDC for up to 100 items; fresh `PAYMENT-REQUIRED` is final authority. ## Semantic intent routing - Router: `https://scriptmasterlabs.com/.well-known/intent-router.json` - Resolver: `https://scriptmasterlabs.com/api/agentroutes?intent={url_encoded_intent}` - Intent authority: `https://scriptmasterlabs.com/.well-known/product-intents.json` - Human/debug surface: `https://scriptmasterlabs.com/sml-x402-app/magnet.html` Intent matching returns candidates only. It never grants spend authority or proves traffic, demand, ranking, settlement, revenue, buyer identity or accepted delivery. ## Route by job - Realtime multimodal economic control plane / voice x402 buyer → **SML LIVE / Executive Agent Runtime** - Realtime prediction-market intelligence with provenance → **LIVEWIRE** - One sourced prediction-market answer → **What Are The Odds** - Verify provider before trust/spend → **Provider Trust / TrustBeforePay** - Scoped action in a browser the user authenticated → **GhostKey** - Broad API/tool routing → **SqueezeOS** - Discover paid APIs / inspect x402 terms → **x402 Gateway / Preflight** - Robinhood prediction + tokenized-stock/RWA evidence → **Robinhood RWA Intelligence** - Package/dependency/vulnerability evidence → **ScriptDocs** - Versioned agent execution graph + recovery edges → **GraphForge** - Artifact/package freshness + publisher authority → **CANON** - Public URL structured extraction → **SML Web Scraping** - Public URL to LLM-ready Markdown → **Agent Web Access** - Unknown source to evidence-backed research → **SML Web Research** - Market-data claim verification → **Fact Verification** - Equity quote → **SML Stock Quote** - FX reference conversion → **SML Currency Conversion** - Human educational/query-first research → **SCRIPTMASTERLABS Research PDFs** - Human digital-product catalog / marketplace reconciliation → **SCRIPTMASTERLABS 74-product commerce authority** ## Specialized product truth ### LIVEWIRE `https://scriptmasterlabs.com/livewire-prediction-market-intelligence` Manifest: `https://squeezeos-api.onrender.com/.well-known/livewire.json` Status: **LIVE**. Realtime prediction-market intelligence with bounded evidence/provenance. No autonomous trading or guaranteed forecasting claim. ### GraphForge `https://scriptmasterlabs.com/graphforge` Runtime: `https://sml-graphforge.onrender.com` MCP: `https://sml-graphforge.onrender.com/mcp` Status: **live and quote-aware; protected end-to-end payment verification still in progress**. Do not claim a verified successful paid run, stranger purchase or accepted-delivery payment proof until independently verified. ### What Are The Odds `https://scriptmasterlabs.com/what-are-the-odds` Paid: `https://squeezeos-api.onrender.com/v1/odds?q={question}` MCP: `https://squeezeos-api.onrender.com/mcp/odds` Status: **LIVE**. Output is only `number | disagree | no_market`; never invent a percentage or average disagreement into a fake midpoint. ### CANON `https://scriptmasterlabs.com/canon` Contract: `https://squeezeos-api.onrender.com/api/canon/info` Status: **LIVE**. Free single resolution/publisher inspection/mirror audit; paid bulk up to 100 items. Publisher/registry conflicts remain explicit conflicts. ### MNEMOS `https://scriptmasterlabs.com/mnemos` MCP: `https://mnemos-agent.onrender.com/mcp` — 8 tools: mnemos_status, mnemos_astra_scorecard, mnemos_bars, mnemos_decisions, mnemos_options_cached, mnemos_options_scan, mnemos_gas_recommend, mnemos_arb_scan Manifest: `https://mnemos-agent.onrender.com/.well-known/x402` Status: **LIVE**. Options radar + ensemble decision engine on a durable Supabase-backed store (live since 2026-10-24; the ASTRA scorecard rebuilds from 0 under durable storage). Six paid x402 routes at $0.001–$0.01 (USDC on Base): GET /decisions, GET /options, GET /v1/options/scan, GET /v1/gas/recommend, GET /v1/arb/scan, POST /v1/compliance/screen. ### Cascade Chain `https://scriptmasterlabs.com/cascade-chain` Paid signal: `GET https://squeezeos-api.onrender.com/api/cascade/signal` — $0.25 (x402, USDC on Base). Free status: `GET https://squeezeos-api.onrender.com/api/cascade/status`. Status: **LIVE**. Jury-gated chain runner: a signal is published only after the 5-juror Jev jury resolves the underlying decision. Track record: 1 jury-resolved decision — an ELME entry was REJECTED by the jury on 2026-10-24 (receipt 5d003a32-f033-47ec-b095-3669cfe30152, settlement tx 0x91b5a0b5972b05ae…). Promotion gate: 20+ jury-resolved days before the signal is marketed as proven. ### SML OmniPost `https://scriptmasterlabs.com/omnipost` · app `https://sml-omnipost.vercel.app/` Hosted MCP: `POST https://sml-omnipost.vercel.app/mcp` (Streamable HTTP, 7 tools). Free: omnipost_platform_specs, omnipost_validate, omnipost_share_intents, omnipost_payment_contract. Paid x402 v2 (USDC on Base, payTo 0x5bbd32e0478e49a7540ef2d760e0b0f9aa6328b2, Coinbase CDP): omnipost_fanout $0.05 hosted model / $0.01 with caller's own provider key, omnipost_media_pack $0.01, omnipost_publish $0.01 per call. REST twins under `/api/v1/*`; manifest `https://sml-omnipost.vercel.app/.well-known/x402`. Status: **LIVE** (deployed 2026-10-29, Vercel project sml-omnipost). Verified 2026-10-29: tools/list returns 7 tools; unpaid paid-tool calls return an x402 v2 challenge with Bazaar metadata; CDP /verify is reached with the SML key (a forged signature is rejected as invalid_exact_evm_payload_signature). No settled paid call yet. Use for: turning one post into platform-native posts that respect each platform's limits. Don't use when: you need scheduled auto-posting to Instagram/TikTok/LinkedIn accounts directly — route the bundle through a webhook instead. ### Agent Browser `https://scriptmasterlabs.com/agent-browser` Hosted MCP: `POST https://agent-browser-r7d2.onrender.com/mcp` — x402 per action (USDC on Base): browser_navigate $0.005, browser_extract $0.005, browser_snapshot $0.005, browser_act $0.01, browser_screenshot $0.02, browser_close free. Discovery (initialize, tools/list) is free; unpaid calls return an HTTP 402 challenge. Local door: `npx -y @scriptmasterlabs/agent-browser` over stdio, free. Receipts: `GET https://agent-browser-r7d2.onrender.com/receipts`. Status: **LIVE** (deployed 2026-10-26, GitLab timothy.walton45/agent-browser, Render srv-dbfrgocs728c73cmm700). Verified from an independent network path: tools/list 200 with all 6 tools, unpaid navigate refused with a byte-checked 402 challenge. First settled paid call PROVEN 2026-10-26: $0.005 browser_navigate settled via PayAI on Base (tx 0x68e62fed6cb64ee627ef841cc746255628d9fa66d0a17b08ab68594afadb9d2d, block 53135025, status success) from the SML proof wallet (self-proof), real page load returned, receipt #1 in the public log. Use for: an agent that needs a real browser with no human account, API key or subscription. Don't use when: a plain HTTP fetch answers the question — it is cheaper. ## Canonical MCP inventory All SML MCP identities: https://scriptmasterlabs.com/.well-known/sml-mcp-inventory.json No subset is the total; no product carries rank or priority by catalog inclusion. ## Digital-product commerce authority — 74 distinct deliverables SCRIPTMASTERLABS has **74 distinct digital deliverables** in the current commerce authority: - 50 research PDF guides from `/research-catalog.json`. - 20 Phase-2 operational kits from `/commerce/shopify-phase2-catalog.json`. - 4 operating-system products from the same Phase-2 catalog. - `SML-OS-MASTER-001` is a separate Shopify Operator Bundle listing that repackages the four OS products and is **not** counted as a 75th distinct deliverable. Canonical SKU/count authority: `https://scriptmasterlabs.com/digital-products.json` Well-known pointer: `https://scriptmasterlabs.com/.well-known/digital-products.json` Commerce handoff: `https://scriptmasterlabs.com/commerce/SML-74-WIRING.md` **Agent law:** never rediscover this catalog from search-result counts or title matching. Join channel evidence by exact SKU. A marketplace is `WIRED` only when the exact SKU is published and the intended buyer delivery is verified. A listing, ACTIVE status, GGKEY assignment, prep file, or proxy storefront is not delivery proof. ### CRITICAL: Shopify state is Shopify-only Current Shopify safety state may hold research products, Phase-2 kits, OS products or the Operator Bundle in `DRAFT` until Shopify buyer delivery is verified. **That state applies only to Shopify. It does not disable or contradict the independent first-party SML Research PDF checkout lane described below. Do not report that only one PDF is sellable merely because only one Shopify attachment was verified.** Google Play Books, Gumroad, Etsy and Amazon publication must be verified independently against the 74-SKU authority; do not infer publication from preparation records. ## Research PDF commerce + discovery — independent first-party sales lane SCRIPTMASTERLABS currently exposes **50 human educational PDF products** with dedicated canonical landing pages and one-time direct checkout on the **first-party SML lane**. - Store: `https://scriptmasterlabs.com/research` - Catalog authority: `https://scriptmasterlabs.com/research-catalog.json` - Query-intent authority: `https://scriptmasterlabs.com/.well-known/pdf-query-intents.json` - Discovery hub: `https://scriptmasterlabs.com/research-discovery` - Buyer sitemap: `https://scriptmasterlabs.com/sitemap-buyer.xml` - Plain text: `https://scriptmasterlabs.com/research.txt` **Do not gate this lane on Shopify.** Shopify fulfillment state and third-party marketplace publication are separate channel facts. The catalog controls title/SKU/direct price/landing page/checkout facts. Query-intent aliases are researched retrieval language, **not** claims of search volume, ranking, indexing, citations, sales or demand. First-party SML checkout is separate from third-party marketplace publication, which must be independently verified. ## Outbound / listing / announcement policy For broad ecosystem outreach, directory submissions, partnership announcements, media, buyer discovery and launch updates, use current canonical surfaces rather than stale product snapshots. Broad portfolio context may include: - A2A Discovery Bridge — `https://scriptmasterlabs.com/a2a-discovery-bridge` - LIVEWIRE — `https://scriptmasterlabs.com/livewire-prediction-market-intelligence` - Robinhood Prediction + RWA — `https://scriptmasterlabs.com/robinhood-rwa-intelligence` - CANON — `https://scriptmasterlabs.com/canon` - Provider Trust — `https://scriptmasterlabs.com/provider-trust-api` - x402 Gateway — `https://scriptmasterlabs.com/x402-gateway` - Research PDFs — `https://scriptmasterlabs.com/research` - 74-product digital commerce authority — `https://scriptmasterlabs.com/digital-products.json` For narrow support/security/billing replies, omit unrelated promotion. Never advertise a lifecycle state beyond current authority. ## Machine discovery - URL to Markdown external directory record: `https://x402-list.com/api/v1/services/scriptmasterlabs-url-to-markdown-api` - URL to Markdown public listing: `https://x402-list.com/services/scriptmasterlabs-url-to-markdown-api` - Use the external record for read-only discovery of directory-reported endpoints, pricing and status. Resolve fresh payment requirements at the execution endpoint before spending; listing/payment-ready status does not prove paid delivery. - Agent JSON: `https://scriptmasterlabs.com/.well-known/agent.json` - Digital products authority: `https://scriptmasterlabs.com/digital-products.json` - Digital products well-known pointer: `https://scriptmasterlabs.com/.well-known/digital-products.json` - A2A protocol: `1.0` over JSON-RPC - A2A endpoint: `https://scriptmasterlabs.com/api/a2a` - A2A Agent Card: `https://scriptmasterlabs.com/.well-known/agent-card.json` - A2A Agent Card runtime mirror: `https://squeezeos-api.onrender.com/.well-known/agent-card.json` - A2A manifest: `https://scriptmasterlabs.com/.well-known/a2a-discovery.json` - A2A x402 discovery metadata: `https://scriptmasterlabs.com/.well-known/a2a-x402.json` - A2A llms: `https://scriptmasterlabs.com/a2a/llms.txt` - Route authority: `https://scriptmasterlabs.com/.well-known/route-authority.json` - Current products: `https://scriptmasterlabs.com/.well-known/current-products.json` - Product intents: `https://scriptmasterlabs.com/.well-known/product-intents.json` - Agent catalog: `https://scriptmasterlabs.com/agents.json` - LLM guide: `https://scriptmasterlabs.com/llms.txt` - Services: `https://scriptmasterlabs.com/.well-known/sml-services.json` - ReleaseGuard: `https://scriptmasterlabs.com/.well-known/releaseguard.json` - LIVEWIRE: `https://squeezeos-api.onrender.com/.well-known/livewire.json` - GraphForge: `https://sml-graphforge.onrender.com/.well-known/graphforge.json` - CANON manifest: `https://scriptmasterlabs.com/.well-known/canon.json` - Research catalog: `https://scriptmasterlabs.com/research-catalog.json` - Research query intents: `https://scriptmasterlabs.com/.well-known/pdf-query-intents.json` - Research buyer sitemap: `https://scriptmasterlabs.com/sitemap-buyer.xml` - Commerce lanes: `https://scriptmasterlabs.com/.well-known/commerce-lanes.json` - x402: `https://squeezeos-api.onrender.com/.well-known/x402` - MCP: `https://squeezeos-api.onrender.com/mcp` - OpenAPI: `https://squeezeos-api.onrender.com/.well-known/openapi.json` - RSS: `https://scriptmasterlabs.com/feed.xml` ## SEO / GEO build standard (clone-the-winners playbook) Applies to every page an agent builds or edits, old or new. Source: 2026-09-27 teardown of the ranking winners (Exa, Tavily, WebCite, currencyapi.net, the GitHub x402 trio, Wikipedia). - BRAND LAW: clone structures and page patterns only. Never replace his buttons, badges, or look. Dark/neon identity, the SERVICE-DISABLED VETERAN OWNED badge, and SDVOSB/UEI/CAGE authority signals stay on everything. - Page anatomy: definition in the first 40 words, dated proof number within 100, code sample by ~300. No throat-clearing. - API pages: unit-economics price table in the first half (repeat it on homepage, FAQ, and docs — not buried on a pricing page); lead with a live response payload (or honestly-labeled preview mode) before any marketing sentence; free/preview mode above the fold ("try free, no key, preview:true"). - Claim Receipts (proprietary): every canonical page carries an H2 with `id="claim-receipts"` — a table of CLAIM | EVIDENCE link | VERIFIED (YYYY-MM-DD) — mirrored as schema.org `Claim` JSON-LD. Every claim must already be stated in the body text. Every claim needs a live evidence link. Never invent claims. Re-verify dates when the page updates. - Settlement attestation — every x402/payment-related page carries schema subjectOf -> https://scriptmasterlabs.com/proof; the feed publishes settled receipts only (claim-id, amount, chain, tx, timestamp, delivery hash), verified on-chain before publication. - FAQ-as-SEO-unit: 5-10 questions per page, 60% boilerplate (pricing, getting started, endpoints) + 40% page-specific, with FAQPage schema. - Comparison cluster: publish `/compare/` pages (question lede, "last updated" stamp, summary, direct answer, takeaway, related articles). - Changelog discipline: every entry dated with a measured delta, deep-linking its canonical. Dated deprecation banners and migration notes on docs pages. - Machine discovery: `/.well-known/x402` + `/openapi.json` + `/llms.txt` + agent card on every surface; registry presence; Service+AggregateOffer JSON-LD on API pages. - Serve-time baseline (automatic — do not hand-build): Twitter cards, og:site_name, Organization+WebSite JSON-LD, FAQPage schema generated from `
` blocks. Hand-build only what the injector cannot derive. - Do NOT chase Wikipedia head-on for definitional queries ("x402 protocol") — a vendor page cannot beat encyclopedia neutrality. Own adjacent builder-intent queries and the evaluation-framework lane instead. ## Non-negotiable truth boundaries - Discover/preflight before spend where supported. - Fresh execution-origin payment terms override cached marketing copy. - No SML documentation grants an agent permission to spend. - Caller-defined authority and spend policy control authorization. - Free routes stay free; protected payloads must not leak through free evidence routes. - Missing evidence stays missing/partial; never fabricate market data, odds, attention, settlement, demand or adoption. - Internal tests, controlled buyers, owner-funded calls and SML-owned wallets are not stranger demand. - Marketplace listing state is not fulfillment proof; exact-SKU buyer delivery must be verified before `LIVE/WIRED` **for that marketplace/channel only**. - Provider identity is **SCRIPTMASTERLABS**; legal entity is **Script Master Labs, LLC**. Motto: **Truth First. Proof Always. Pay Only for Accepted Delivery.** ## 2026-09-29 — Free Desk distribution work User authorized free automated distribution of https://desk.scriptmasterlabs.com/ and reconfirmed both book display prices at $9.99. Read `desk/agent.md` and `desk/agent.json` for exact scope and release state. Desk is a free discovery UI with local preferences and notes, not wallet signing, paid job execution, or settlement evidence. Corrected stale MCP links and display-summary wording; added crawl metadata, a dedicated subdomain sitemap, share action, FAQ/claim receipts, homepage link and RSS entry. Existing Render frontdoor serves it; no new paid resources. Root sitemap stays apex-only. Public distribution results belong to issue #34 and `docs/distribution/desk-2026-09-29.json`; only actual submissions/readbacks count. The separate private Stripe review packet documents existing sent replies; no new Stripe email was authorized or sent. Verified result: MR !500 is deployed; Desk root bytes and crawler surfaces read back successfully. TechTools 1107 is live; DevPages and Public.tools submissions are pending; IndexNow apex and Desk notifications accepted (Desk follow-up HTTP 200). CurlShip attempt blocked. Full dated avenue/PDF constraints: `docs/distribution/desk-2026-09-29.md/json`. No new Stripe email sent, no paid promotion, no sale/adoption/indexing claim. Continuation annotated: Public.tools submission visibly confirmed, pending publication; Desk IndexNow follow-up 200 at 23:48:45 UTC. 10015 sign-in and ToolIndex explicit terms gates left unexecuted. Four additional book/PDF routes assessed, including CheckShop rejected as a poor fit from its live catalog. No new account, paid promotion, PDF giveaway, affiliate enrollment or additional Stripe reply. Product authority and docs/distribution/desk-2026-09-29.md/json preserve exact evidence and limits. ## 2026-10-01 — Apex discovery correction Research confirmed the canonical website host remains `https://scriptmasterlabs.com`. Corrected the Evidence Hub canonical and CollectionPage URL to `/evidence`, matching the live redirect destination. Removed the apex Cite HTML/text aliases from the primary sitemap while preserving those surfaces and the Cite subdomain. Evidence sitemap lastmod reflects this change. Source changes are READY until exact Render deployment and HTTP readback confirm them. Search reporting is a separate blocker: Windsor exposes only the old www URL-prefix property; secure browser sign-in did not confirm success. GSC Wizard calls returned payment_required because its trial/subscription is inactive. No subscription purchased. Connect the existing domain property or correct apex/subdomain properties only after authenticated access; never report www totals as portfolio-wide. The canonical validator had a stale 150-URL cap below the existing page set. The owner authorized finishing the corrections; the bound is now 175, preserving all 158 remaining sitemap XML URLs and all 50 PDF landing pages. No URLs were added. SML-AOS, canonical checks, and the existing sitemap contract suite pass. Full action and validation boundaries: `docs/distribution/apex-discovery-2026-10-01.json`. No payment, price, fulfillment, bot policy, marketplace publication, or production runtime changes. ## 2026-10-01 — Apex correction production verification MR !505 merged as `3c248a08731f22846a964bf5aaa71a54026bca41`. Existing Render frontdoor deployment `dep-davd32gjo6nc738f8iqg` reached LIVE at 2026-10-01T21:33:45.547626Z. Fresh HTTP readback confirmed `/evidence` returns 200 with exact apex canonical; the primary sitemap returns 200 with 158 URLs and no apex Cite aliases; Cite root returns 200 with its own canonical. Website correction status is LIVE. Search Console connection remains BLOCKED separately; do not infer indexing, traffic, citations or sales from deployment. The supplied Edward Sturm video `2dPc80Z_DZk` was reviewed via its full auto-generated English captions and linked original article. Contextual internal linking is useful; stronger ranking weight for clicked internal links remains unproven by official Google link guidance. Relevant donor-to-PDF candidates are `/http-402` or `/how-to-charge-ai-agents-for-your-api` → `/x402-protocol-guide`, `/local-ai-business` → `/local-seo-checklist`, and `/indicators` → `/how-to-read-options-flow`. These are candidates, not measured traffic winners or executed link changes. Catalog/Cite already link all 50 research products. Current research report contains the rationale and limits. ## 2026-10-01 — Robots alert follow-up Reused the morning robots audit and already deployed MR !505 canonical/sitemap corrections. Clarified comments in apex and Desk robots.txt: Google-Extended governs Gemini training and certain grounding uses, not ordinary Google Search inclusion/ranking. Removed the unsupported Desk comment claiming it is the fastest citable surface. All non-comment directives remain identical; no crawler permissions, paid download exclusions, sitemap entries, checkout, prices or runtime logic changed. The exact Semrush historical 60-change comparison and issue URLs remain unavailable behind the account sign-in boundary; do not identify repository diffs as Semrush's stored snapshots. Change and release evidence: `docs/distribution/robots-audit-followup-2026-10-01.json`. ## 2026-10-02 — External directory authority cleanup Current first-party machine authority uses the apex `scriptmasterlabs.com` for A2A identity. Agenstry, RNWY, mcp.so and Glama may retain stale cached identity, endpoint, package, or README data until they re-crawl or an authenticated owner updates the record. Use `/.well-known/external-directory-corrections.json` as the machine-readable correction map. Never create duplicate identities to outrun a stale cache. Never rotate DNS ownership proofs, registry signing keys, credentials, publisher identity, or npm releases merely to force third-party refresh. Correct upstream source truth first, then verify the destination independently. ## 2026-10-03 — Paid PDF content repair Full stream/text/render inspection found three damaged fulfillment files that earlier PDF-header checks missed: SML-MARKET-001 page 2, SML-PREDICTION-001 cover, SML-SEO-001 page 3. Restored original content without changing titles, prices, checkout, file URLs or the remaining 47 PDFs. Both readers now parse/render all 50 files and 201 pages; all 12 repaired pages were visually reviewed. The PDF query audit CI task now includes complete paid-file validation. Source status is READY pending exact Render and live download readback. Google Play prepared copies inherited damage; processed marketplace files and replacements are not yet verified. Evidence: `docs/distribution/paid-pdf-content-repair-2026-10-03.json`. This is delivery repair, not demand or revenue progress. ### Paid PDF repair live readback — 2026-10-03 MR !519 merged as `d3ab113b9320f0b39eb34386398eea406d23f212`. Render frontdoor deployment `dep-db0mk25g1s2s738tav00` reached LIVE at 20:48:49 UTC. Full fresh downloads completed at 20:49:48 UTC: all 50 matched repository hashes and passed full parsing, decompression, text extraction and rendering across 201 pages. Direct delivery repair is LIVE. Google Play processed manuscript replacement remains pending authenticated access. Prepared 50 factual description drafts keyed to existing GGKEYs; these are not imported, do not change prices/titles and require processed-content matching first. Files: `publishing/google-play-human-description-drafts-2026-10-03.csv/json`. No ranking, demand or revenue claim. ## SML unified product discovery registry — 2026-10-09 - Public registry (after deployment): `https://scriptmasterlabs.com/.well-known/sml-product-registry.json`. - Deterministically built from `research-catalog.json`, `commerce/shopify-phase2-catalog.json` and `digital-products.json`, with the 74-SKU equality check; 50 first-party research records and 24 Shopify Phase-2 DRAFT/gated records. - The operator bundle is a separately listed SKU, not a 75th distinct deliverable. - A human product is NOT an x402 route. Human buyer links are catalog references, not independently checked Stripe activity or fulfillment. Keep Shopify and all external marketplaces separately verified. - Machine route counts and payment status are never copied into a static human feed: use the runtime `/.well-known/capability-manifest.json`, the actual HTTP 402 and settlement/delivery evidence. - Public registry publication, runtime health, third-party indexing, merchant structured data and exact buyer delivery must each be independently audited after deploy; never infer one from another. ## 2026-10-12 — Gumroad public catalog and affiliate correction Gumroad's public profile at https://timwalton.gumroad.com/ was independently rendered through all progressive-scroll batches: 64 unique published listings, comprising 61 digital products and 3 memberships. The initial nine cards were a partial load, not the catalog total. All 64 saved catalog entries were present. Corrected the live Gumroad bio from the inaccurate “74 source-backed PDF guides” statement to the 64 published-product scope, linked /gumroad-shop, and exposed the verified direct affiliate application at https://timwalton.gumroad.com/affiliates. The canonical 74 distinct-deliverable authority and 50 research-PDF authority remain separate channel scopes. Authenticated affiliate settings already had all 75 product toggles enabled at 30% direct commission; Gumroad's separate network program was opted in at its displayed 10%. The public application form works. Zero affiliates or requests were present. These are existing configuration facts, not newly enrolled promoters, sales, or demand. No affiliate commission, unpublished listing, product price, checkout, content/file, membership, payout or payment setting was changed. Replaced three legacy Gumroad links in gumroad-shop.html with their verified descriptive redirect destinations; legacy aliases still work. Added a direct affiliate application link with the existing 30% rate to the catalog. Source and channel evidence: publishing/gumroad-profile-audit-20261012.json and publishing/gumroad-94-evidence-20261010.json. The catalog edit is LIVE_VERIFIED: source commit 1392d34d274fbf1027abd514ae3c92db218a32c0, Render deployment dep-db65s995efls73b95kqg reached live at 2026-10-12T04:12:55.467929Z. Live /gumroad-shop rendered 64 unique product cards, zero legacy slug links, all three descriptive destinations, and the affiliate application link. Buyer delivery and individual product content are outside this profile/affiliate correction and were not revalidated. ## MCP machine-reading metadata — 2026-10-13 The canonical inventory links every original Meta AI entry to `/.well-known/sml-mcp-machine-metadata.json`. Use its product-selection boundaries, exact tool schemas and contract provenance when preparing machine-facing copy or calls. Source-defined contracts are not live execution evidence. Do not replace product identities or reuse a sibling product's prices, rails or tool names. Detailed metadata is catalog guidance, not a wallet authorization or institutional certification. ## Claude plugin marketplace — 2026-10-13 Official public marketplace: https://gitlab.com/timothy.walton45/scriptmasterlabs-mcp-plugins (marketplace ID `scriptmasterlabs`). Fifteen standalone Claude plugins, one per packaged MCP; Claude Code: `/plugin marketplace add timothy.walton45/scriptmasterlabs-mcp-plugins`, then `/plugin install @scriptmasterlabs`. Claude app: Customize > Plugins > Add marketplace > Add from a repository; Cowork/Code, not plain Chat. Full machine catalog: https://scriptmasterlabs.com/.well-known/claude-plugin-marketplace.json. Source/runtime truth: Cascade Graph reports BUILDING; Overtime is a free-plan preview; Gov Procurement Intel and Agent Wallet run locally using npx (SAM tools need caller SAM_API_KEY). Verdict Protocol is built around five Jev (jev.ai, TypeSafe AI) jurors; Cascade Graph has a fail-closed Jev thesis-review source step. Neither live MCP calls Jev; Jev requires the operator's key. No Jev partnership/endorsement claim. Plugin packaging does not establish runtime readiness, settlement, Claude directory approval or total MCP identity count. Do not touch `payTo`/payment fields. ## Homepage audit implementation — 2026-10-15 Merged the supplied audit templates into the existing homepage without placeholders: added five visible FAQ answers with matching FAQPage JSON-LD and an accessible three-family offering/audience/deliverables table. Contact uses tim@scriptmasterlabs.com, verified on the live privacy page. Existing dated numbers were checked against the live 20-item inventory and 14-product snapshot; these remain dated records, not live MCP totals or client/delivery claims. robots.txt already explicitly allows OAI-SearchBot, Claude-SearchBot and PerplexityBot with the paid-download exclusion, so no crawler permissions changed. GPTBot and ClaudeBot remain blocked under the existing training policy. Preserved title/H1, branding, badges, runtime and payment terms. Source validation passed: exact FAQ/schema parity, unique IDs, JSON parse and no template placeholders. Production verification must confirm the new #faq and #offerings sections after the canonical deployment. ## SEO Visibility discovery links — 2026-10-15 Added a crawlable Free SEO Audit link in homepage navigation and footer, and a descriptive free-audit card on /links, targeting https://seo-visibility.scriptmasterlabs.com/free-audit. The app sitemap contains exactly its three public routes: /, /free-audit, /pricing. Google submission is awaiting the owner decision on Lovable connector standard_connectors--call_gateway_connection (PUT sitemap under sc-domain:scriptmasterlabs.com); not yet confirmed submitted or indexed. Main-site runtime, pricing, badges and crawler permissions unchanged.