fix: Provide stable API/SDK interfaces for AgentBOM and MCP Posture specs (#42)

README.md

@@ -19,7 +19,6 @@ Source: canonical media hub in the org-wide [`.github` repository](https://githu
 | [bscode](https://github.com/WasmAgent/bscode) | Cloudflare Workers benchmark & demo workload |
 | [trace-pipeline](https://github.com/WasmAgent/trace-pipeline) | Trace ingestion, audit, claim/eval pipeline |
 | [open-agent-audit](https://github.com/WasmAgent/open-agent-audit) | Open evidence format and Cloudflare-native audit toolkit |
-| [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) | AgentBOM, MCP Posture & Trust Passport specifications |
 | [fresharena](https://github.com/WasmAgent/fresharena) | Sister project — agent evaluation arena |
 | [.github](https://github.com/WasmAgent/.github) | Org-wide public ledgers (media, releases, claims) |
 | [wasmagent](https://github.com/WasmAgent/wasmagent) | This repo — project home, roadmap |
@@ -44,7 +43,9 @@ The public media, claims, and release ledgers live in the org-wide
 
 Shipped milestones are tracked in the consolidated [release ledger](RELEASE_LEDGER.md).
 AgentBOM, MCP Posture, and Trust Passport have graduated off the roadmap and are
-recorded there as shipped/closed agent-trust-infra deliverables.
+recorded there as shipped/closed agent-trust-infra deliverables. For the
+code-level API/SDK interfaces, see the
+[agent-trust-infra API/SDK reference](docs/agent-trust-infra-specs.md).
 
 ## Roadmap
 

docs/agent-trust-infra-specs.md

@@ -0,0 +1,35 @@
+# AgentBOM & MCP Posture — API/SDK interfaces
+
+The canonical, code-level definitions of the **AgentBOM**, **MCP Posture**, and
+**Trust Passport** specifications live in the
+[WasmAgent/agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra)
+repository, which is the source of truth for the MCP / Trust / Attestation
+domain. This page is the WasmAgent-side index that points tooling and
+downstream issues (for example `wasmagent#40`) at those interfaces so they can
+link to a stable canonical location rather than to prose alone.
+
+## What agent-trust-infra provides
+
+For each of the AgentBOM, MCP Posture, and Trust Passport specs,
+agent-trust-infra owns:
+
+- the normative **specification** document,
+- the **validators** — the code-level interface that consumers integrate
+  against, and
+- the **trust artifacts** schema.
+
+These are the surfaces WasmAgent relies on for trust and attestation, and that
+the MCP Firewall / Gateway / Policy / Attestation packages interoperate with.
+
+## Status
+
+Per the WasmAgent [release ledger](../RELEASE_LEDGER.md), the AgentBOM, MCP
+Posture, and Trust Passport specifications, validators, and trust artifacts are
+recorded as shipped via
+[agent-trust-infra PR #48](https://github.com/WasmAgent/agent-trust-infra/pull/48)
+(end-to-end chain visualization, runnable demo, README stitching), and the
+corresponding npm publishes have shipped.
+
+agent-trust-infra remains the authoritative source for the current API surface,
+schema versions, and stability classification. Consult its README and published
+packages for the binding contract before integrating.

docs/roadmap.md

@@ -7,6 +7,7 @@ milestones are recorded in the org-wide
 
 ## Complete
 
+- [x] AgentBOM, MCP Posture & Trust Passport specifications, validators, and trust artifacts — shipped in [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) (PR #48); see the [API/SDK interface reference](agent-trust-infra-specs.md) and the [release ledger](../RELEASE_LEDGER.md).
 - [x] Public trace-pipeline launch — shipped; see the release ledger.
 - [x] Cloudflare Workers Agent demo (bscode) — shipped; see the release ledger.