diff --git a/README.md b/README.md
index 5f1933c..4551547 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,12 @@ Source: canonical media hub in the org-wide [`.github` repository](https://githu
 | [.github](https://github.com/WasmAgent/.github) | Org-wide public ledgers (media, releases, claims) |
 | [wasmagent](https://github.com/WasmAgent/wasmagent) | This repo — project home, roadmap |
 
+Repository classification (public products vs. internal tooling) is available as
+machine-readable metadata in [`repos.yml`](repos.yml); see
+[docs/repository-manifest.md](docs/repository-manifest.md) for the schema. The
+project-table generator consumes this manifest to omit internal tools such as
+`claude-bot` and `wasmagent-ops`.
+
 ## Key concepts
 
 - **Agent Execution Proof (AEP)** — every tool call produces a structured, hash-linked audit record
diff --git a/docs/repository-manifest.md b/docs/repository-manifest.md
new file mode 100644
index 0000000..8a254be
--- /dev/null
+++ b/docs/repository-manifest.md
@@ -0,0 +1,56 @@
+# Repository manifest
+
+WasmAgent ships a machine-readable manifest that classifies every repository in
+the organization as a **public product** or **internal tool**. It is the
+canonical metadata source consumed by the project-table generator
+([wasmagent#48](https://github.com/WasmAgent/wasmagent/issues/48)) and other org
+tooling to decide which repositories to surface publicly.
+
+- Manifest: [`repos.yml`](../repos.yml)
+- Schema version: `1`
+
+## Schema
+
+Each entry in `repositories[]` exposes the following fields.
+
+| Field | Type | Description |
+|---|---|---|
+| `name` | string | Repository name without the owner prefix. |
+| `url` | string | Canonical GitHub URL. |
+| `category` | enum | `public-product`, `infrastructure`, `project-home`, or `internal-tool`. |
+| `public_product` | boolean | `true` when the repo should be surfaced as a public product/table row; `false` for internal tooling. |
+| `purpose` | string | Short human-readable description. |
+
+## Filtering rule
+
+To reproduce the public project table, include only repositories where
+`public_product == true`:
+
+```python
+import yaml
+
+with open("repos.yml") as f:
+    manifest = yaml.safe_load(f)
+
+public_products = [r for r in manifest["repositories"] if r["public_product"]]
+```
+
+Internal tools such as `claude-bot` and `wasmagent-ops` set
+`public_product: false` and are therefore omitted from the public table.
+
+## Categories
+
+| Category | Meaning |
+|---|---|
+| `public-product` | A shipped product or library consumed by users. |
+| `infrastructure` | Org-wide infrastructure (for example, the `.github` ledgers). |
+| `project-home` | The org project home and index repository. |
+| `internal-tool` | Internal operations and automation tooling — not a public product. |
+
+## Adding a repository
+
+1. Append a new entry to `repositories[]` in [`repos.yml`](../repos.yml).
+2. Set `category` and `public_product` to reflect whether the repository is a
+   public product or an internal tool.
+3. The project-table generator picks up the change automatically on the next
+   build; no Markdown table edits are required.
diff --git a/repos.yml b/repos.yml
new file mode 100644
index 0000000..1f9b822
--- /dev/null
+++ b/repos.yml
@@ -0,0 +1,91 @@
+# WasmAgent repository manifest
+#
+# Machine-readable classification of repositories in the WasmAgent organization.
+# This is the canonical metadata source for distinguishing public products from
+# internal tooling. The project-table generator (wasmagent#48) and other org
+# tooling consume this manifest to decide which repositories to surface.
+#
+# Schema (version 1):
+#   schema_version   -> integer; manifest schema version (currently 1)
+#   repositories[]   -> list of repository entries
+#     name            -> string; repository name without the owner prefix
+#     url             -> string; canonical GitHub URL
+#     category        -> enum; one of:
+#                          public-product  - a shipped product or library
+#                          infrastructure  - org-wide infrastructure (e.g. ledgers)
+#                          project-home    - the org project home / index repo
+#                          internal-tool   - internal operations/automation tooling
+#     public_product  -> boolean; true when the repository should be surfaced as
+#                        a public product / table row; false for internal tooling
+#     purpose         -> string; short human-readable description
+#
+# Filtering rule for the public project table:
+#   include repositories where `public_product == true`.
+
+schema_version: 1
+
+repositories:
+  # --- Public products ------------------------------------------------------
+  - name: wasmagent-js
+    url: https://github.com/WasmAgent/wasmagent-js
+    category: public-product
+    public_product: true
+    purpose: Core JS/TS runtime and MCP server
+
+  - name: agent-trust-infra
+    url: https://github.com/WasmAgent/agent-trust-infra
+    category: public-product
+    public_product: true
+    purpose: >-
+      MCP / Trust / Attestation specifications, validators, and trust artifacts
+      (AgentBOM, MCP Posture, Trust Passport)
+
+  - name: bscode
+    url: https://github.com/WasmAgent/bscode
+    category: public-product
+    public_product: true
+    purpose: Cloudflare Workers benchmark & demo workload
+
+  - name: trace-pipeline
+    url: https://github.com/WasmAgent/trace-pipeline
+    category: public-product
+    public_product: true
+    purpose: Trace ingestion, audit, and claim/eval pipeline
+
+  - name: open-agent-audit
+    url: https://github.com/WasmAgent/open-agent-audit
+    category: public-product
+    public_product: true
+    purpose: Open evidence format and Cloudflare-native audit toolkit
+
+  - name: fresharena
+    url: https://github.com/WasmAgent/fresharena
+    category: public-product
+    public_product: true
+    purpose: Sister project — agent evaluation arena
+
+  # --- Public infrastructure / project home ---------------------------------
+  - name: .github
+    url: https://github.com/WasmAgent/.github
+    category: infrastructure
+    public_product: true
+    purpose: Org-wide public ledgers (media, releases, claims)
+
+  - name: wasmagent
+    url: https://github.com/WasmAgent/wasmagent
+    category: project-home
+    public_product: true
+    purpose: Project home, roadmap, and repository index (this repository)
+
+  # --- Internal tooling (hidden from the public product table) --------------
+  - name: claude-bot
+    url: https://github.com/WasmAgent/claude-bot
+    category: internal-tool
+    public_product: false
+    purpose: Automated GitHub issue/PR bot (internal operations)
+
+  - name: wasmagent-ops
+    url: https://github.com/WasmAgent/wasmagent-ops
+    category: internal-tool
+    public_product: false
+    purpose: Internal operations and automation tooling