@muretai/agent-entry 1.2.1 → 1.4.0

package/muretai-agent-entry.mjs

@@ -65,6 +65,274 @@ export const AGENT_CARD_PATH = '/.well-known/agent-card.json';
 export const AGENT_CARD_PATH_LEGACY = '/.well-known/agent.json';
 export const AGENT_CARD_SIG_PATH = '/.well-known/agent-card.sig.json';
 
+/** The name of the ONE way in this door accepts today — the card's `securitySchemes` key,
+ *  its `type`, and the `scheme` of the refusal's `accepts[]` entry are all this string. The
+ *  card and the refusal MUST name the same scheme or a visitor learns one thing from the
+ *  menu and another from the door. Must match `SIGNED_ENVELOPE_SCHEME` in
+ *  examples/agent_entry_reference.py. */
+export const SIGNED_ENVELOPE_SCHEME = 'did-key-ed25519';
+
+/** The stable link relation that names an agent door, emitted on the notice route (and the
+ *  one line a SITE adds to its own front page to coexist with an entry — see
+ *  docs/AGENT_ENTRY.md). An ABSOLUTE URI on purpose: RFC 8288 §2.1.2 allows a bare token
+ *  only for an IANA-registered relation, so `rel="agent-entry"` would be non-conformant and
+ *  a strict parser is entitled to drop it. Must match `AGENT_ENTRY_REL` in
+ *  examples/agent_entry_reference.py. */
+export const AGENT_ENTRY_REL = 'https://muretai.net/rel/agent-entry';
+
+/** Where a keyless visitor is sent to learn how to mint an identity and sign. It rides in
+ *  the card AND in the refusal, so an agent that has only one of the two still has the URL.
+ *
+ *  EMPTY MEANS OMITTED, and that is the safe default. NEVER EMIT A URL THAT DOES NOT
+ *  RESOLVE: a real third-party agent (2026-08-18 proof run) received the complete
+ *  requirement object, printed every field of it, went straight to `howTo`, hit a 404 and
+ *  stopped — "since the provided 'howTo' link is broken, I have no way to get this
+ *  information" — while holding `identity`, `signedFields`, `canonicalization`,
+ *  `signature`, `timestamp` and `recipient` in the object it had just printed. A dangling
+ *  pointer OUT-COMPETES the data beside it and reads as terminal. So the field is emitted
+ *  only when this constant is set, and it is set only AFTER the page is live: ship the page
+ *  first, or ship no pointer. Verified live before this value was set (200 at the URL
+ *  below, 404 at a control path under the same prefix); `entry-howto-resolves` in
+ *  .claude/skills/ship-check/checks.py re-checks it on every ship report. Must match
+ *  `FIRST_KNOCK_URL` in examples/agent_entry_reference.py. */
+export const FIRST_KNOCK_URL = 'https://docs.muretai.com/guides/first-knock/';
+
+/** `Allow:` per RESOURCE, not per server. RFC 9110 §10.2.1 makes `Allow` a statement about
+ *  the target resource, and §15.5.6 REQUIRES it on a 405 — a generic list is a wrong answer
+ *  to a right question, and on a guest mount it would also claim verbs on addresses the SITE
+ *  owns. HEAD is listed wherever GET is (RFC 9110 §9.3.2 makes it mandatory alongside GET,
+ *  and both twins have always answered it). Wherever `Allow` is emitted,
+ *  `Access-Control-Allow-Methods` is set to the SAME value (`allowHeaders`) — the two are
+ *  one fact for two readers, and a response carrying `Allow: POST, OPTIONS` beside the
+ *  origin-wide `Access-Control-Allow-Methods: GET, POST, OPTIONS` contradicts itself in one
+ *  message. Everywhere else (a card GET, a signed reply, a 404) the CORS default stands.
+ *  Must match the `ALLOW_*` constants in examples/agent_entry_reference.py. */
+export const ALLOW_CARD = 'GET, HEAD, OPTIONS';
+/** A guest mount's door: the entry owns the POST and nothing else there. */
+export const ALLOW_DOOR = 'POST, OPTIONS';
+/** A site-owning mount: ONE address that is both the human notice (GET) and the door (POST),
+ *  so the truthful Allow is the union — listing only the GET half would hide the very door
+ *  the card names. */
+export const ALLOW_MOUNT = 'GET, HEAD, POST, OPTIONS';
+
+/**
+ * The machine-readable terms of THIS door, in one object used on BOTH surfaces: the card's
+ * `securitySchemes` entry (before the knock) and the `accepts[]` array of the no-envelope
+ * refusal (after it). One object, two surfaces, so the two can never drift apart — the
+ * property a visitor's test can assert without knowing what the scheme string is.
+ *
+ * The shape is x402's lesson turned into an identity vocabulary: a refusal that is the
+ * SPECIFICATION of what to do next, as an ARRAY so "sign", "arrive with an introduction"
+ * and later "pay" are siblings in one frame rather than three bespoke refusals.
+ *
+ * Everything a keyless visitor needs is here on purpose — the acceptance bar is that an
+ * agent holding ONLY this object, plus the crypto tooling on any machine, can mint a
+ * did:key, sign correctly and be answered on its NEXT post. That is why `recipient` is
+ * present (nobody can address a message without it) and why the canonicalization rule is
+ * spelled out rather than merely named.
+ *
+ * IT IS WRITTEN IN THE IMPERATIVE, and that is the fix a proof run bought (2026-08-18).
+ * Every field above was already correct and complete, and a real third-party agent read
+ * them, restated them accurately, and STOPPED: "since I don't have a way to generate
+ * cryptographic keys within this environment, I am stuck" — with `node` and `python3`
+ * both installed. A requirement object that describes a FORMAT tells a keyless visitor
+ * what it lacks; it does not tell it to ACT. So `instruction` leads with the sentence
+ * that unblocks a general-purpose agent — MAKE A KEY NOW, nobody's permission is needed,
+ * any crypto library will do — and every descriptive string below gained an imperative
+ * PREFIX. The old value of each is still a SUBSTRING of the new one, so a client that
+ * substring-matched on the format text keeps matching; no field was removed or renamed,
+ * and `howTo` is the only one whose presence is conditional (see FIRST_KNOCK_URL).
+ *
+ * IT TEACHES THE CARRIER AS WELL AS THE SIGNATURE, and that is the fix proof run 3 bought
+ * (2026-08-18, `exampleRequest`). The recipe was walked end to end — a third-party agent ran
+ * `identityCode`, minted a computed DID, signed the six canonical fields — and TWO runs were
+ * still refused, holding a correct key, a correct DID and correct signed bytes, on the A2A
+ * ENVELOPE: "not an A2A message object", "messageId must be a non-empty string". `in`
+ * ("params.message.metadata") plus six `signedFields` reads as "put these six in metadata",
+ * which is exactly what they built. One of them named the gap precisely: "the agent card is
+ * ambiguous on the precise nesting of messageId… This is a guess at a format, which goes
+ * against the rules." So the complete body a door accepts is emitted BESIDE `in` — the
+ * counter-example on the very next line of the object whose reading caused the mistake.
+ *
+ * `exampleRequest` IS A NESTED OBJECT, NOT A JSON STRING, and the choice is the same law
+ * again. A string of JSON arrives on the wire as `{\"jsonrpc\":\"2.0\",…}` — every quote
+ * escaped — and every agent in every proof run met this door through `curl`, i.e. reading
+ * the RAW response. An escaped document has to be UNESCAPED before it can be copied, which
+ * is one more transformation performed in the model's head, which is the precise failure
+ * mode base58-as-a-formula already cost two runs. A nested object IS the artifact: it
+ * renders as the thing to send, and `JSON.stringify(way.exampleRequest)` is a body. Nesting
+ * costs nothing here — the block already sits two levels deep under `securitySchemes`, and
+ * `signedFields` is already a non-string value, so no consumer needs a new capability.
+ *
+ * A copier fills FIVE `<…>` blanks (messageId, text, from, timestamp, sig); `to` is already
+ * this door's DID, `contextId` is already `null`, and `id`/`kind`/`role`/`parts` are already
+ * correct. `contextId: null` is deliberate and doubles as the answer to "what do I send when
+ * I have no conversation yet" — the same clause `canonicalization` now states in words.
+ *
+ * Must match `signed_envelope_requirement` in examples/agent_entry_reference.py field for
+ * field, string for string: the card and the refusal are one object, and two twins that
+ * teach a keyless visitor differently are two doors.
+ */
+export function signedEnvelopeRequirement(did) {
+  const requirement = {
+    scheme: SIGNED_ENVELOPE_SCHEME,
+    instruction: 'Generate an Ed25519 keypair NOW, locally, and knock again with it. You '
+      + 'need no account, no registration and no permission from this site: any crypto '
+      + 'library on the machine you are already running on will do (node:crypto '
+      + 'generateKeyPairSync("ed25519"), Python cryptography or PyNaCl, Go crypto/ed25519, '
+      + 'libsodium). Then work down the fields below in order - derive your did:key '
+      + '(identity), build the canonical bytes over signedFields (canonicalization), sign '
+      + 'them (signature), address the message to recipient with a fresh timestamp - and '
+      + 'POST the same request again. Having no key yet is the normal starting state, not '
+      + 'a refusal: minting one is step 1, and it is a few lines of code. The COMPLETE '
+      + 'request body to POST is exampleRequest below: copy it and fill in its five <...> '
+      + 'blanks. The A2A envelope AROUND your signature is checked too, so send that shape '
+      + 'and do not improvise one.',
+    in: 'params.message.metadata',
+    // THE CARRIER, not just the signature. `in` tells you where the six envelope fields go
+    // and says nothing about the message that carries them, and two proof-run agents read it
+    // as the whole answer: they put the six in `metadata` and were refused on the A2A object
+    // itself ("not an A2A message object", "messageId must be a non-empty string") while
+    // holding a correct key and correct signed bytes. This is the body, whole, next to the
+    // line that misled them. A NESTED OBJECT on purpose (see the note above): a JSON string
+    // of JSON arrives escaped, and an agent reading a raw curl response would have to
+    // unescape it in its head before it could copy it.
+    exampleRequest: {
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'message/send',
+      params: {
+        message: {
+          kind: 'message',
+          role: 'user',
+          messageId: '<a fresh unique string, e.g. a UUID>',
+          // Already filled in, and it is the answer to "what if I have no conversation
+          // yet": null. It is still one of the six signed fields; never omit it.
+          contextId: null,
+          parts: [{ kind: 'text', text: '<your message>' }],
+          metadata: {
+            from: '<your did:key>',
+            to: did,
+            timestamp: '<integer epoch seconds - a JSON number, not this string>',
+            sig: '<base64 signature over the canonical six fields>',
+          },
+        },
+      },
+    },
+    recipient: did,
+    identity: 'Derive your DID from the public key you just generated and send it as '
+      + 'metadata.from: did:key:z + base58btc(0xed01 || <32-byte Ed25519 public key>)',
+    // RUN this, do not write the address by hand. Measured 2026-08-18: a real agent minted a
+    // correct keypair, then "converted" the bytes in its head and produced the DOOR'S OWN DID
+    // with two characters changed — three times — and signed correct bytes under an address
+    // that was never its own. base58btc was the one step in this recipe stated as a formula
+    // instead of made runnable, and it is exactly the step a language model fabricates.
+    identityCode: 'Run this; do not encode base58btc by hand. node, no packages, `pub` = the '
+      + '32 raw public-key bytes: '
+      + "const A='123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'; "
+      + 'let n=0n; for (const b of Buffer.concat([Buffer.from([0xed,0x01]),pub])) '
+      + 'n=n*256n+BigInt(b); '
+      + "let s=''; while (n>0n) { s=A[Number(n%58n)]+s; n/=58n; } "
+      + "const did='did:key:z'+s;   // 0xed leads, so no leading-zero '1' case can arise",
+    signedFields: ['contextId', 'from', 'messageId', 'text', 'timestamp', 'to'],
+    // The trailing clause is proof run 3's third fix: the verifier has always signed
+    // `contextId ?? null`, and "exactly those six fields" never said what a visitor with no
+    // conversation yet is supposed to put there. One run spent an entire refusal deducing
+    // it. The previous value is still a PREFIX of this one, so a substring matcher on the
+    // format text keeps matching.
+    canonicalization: 'Build the bytes to sign as a JSON object of exactly those six '
+      + 'fields, keys sorted by Unicode code point, separators "," and ":", no whitespace, '
+      + 'non-ASCII literal, UTF-8. When you have no conversation yet, contextId is JSON '
+      + 'null - it is still one of the six and is still signed, so never omit it (see '
+      + 'exampleRequest, which already has it right)',
+    signature: 'Sign those bytes with your private key and set metadata.sig = base64 '
+      + '(standard alphabet, padded) of the 64-byte Ed25519 signature over those bytes',
+    timestamp: 'Set metadata.timestamp = integer epoch seconds, within 300 s of this '
+      + 'entry\'s clock',
+  };
+  // Emitted ONLY when it is known to resolve — an unresolvable pointer out-competes every
+  // field beside it (see FIRST_KNOCK_URL). Appended last so the object's other bytes and
+  // their positions do not move when a site turns the pointer off.
+  if (FIRST_KNOCK_URL) requirement.howTo = FIRST_KNOCK_URL;
+  return requirement;
+}
+
+/** The User-Agent FAMILY table — OBSERVATION AND SIGNPOSTING, NEVER IDENTITY. A UA string
+ *  is written by the client, so nothing here may ever affect `verified`, a ledger row, a
+ *  rate lane or any refusal verdict (that is the Web Bot Auth / signed-envelope layer's
+ *  job). What it buys: an owner-facing count of who is knocking (`stats()`), and a `Link`
+ *  signpost on the notice route for the families that are AI agents.
+ *
+ *  Ordered, FIRST MATCH WINS, and the order is load-bearing twice: real crawler UAs start
+ *  with "Mozilla/5.0 …" so every bot needle must come before `mozilla`, and GPTBot's UA
+ *  contains "openai.com/gptbot" so `gptbot` must come before `openai`. Needles are matched
+ *  as substrings after an ASCII-ONLY lowercase fold (`asciiLower`, not `toLowerCase()` —
+ *  Unicode case folding differs between runtimes and none of these needles needs it).
+ *  FIXED table, deliberately not an option: an option would invite making UA matter, and
+ *  the fixed table is what bounds the stats keyspace — an attacker-chosen UA string must
+ *  never become a key. Must match `UA_FAMILIES` in examples/agent_entry_reference.py:
+ *  one contract, two implementations, one verdict per string. */
+export const UA_FAMILIES = [
+  ['claude-user', 'claude-user'],
+  ['claudebot', 'claudebot'],
+  ['gptbot', 'gptbot'],
+  ['chatgpt-user', 'openai'],
+  ['openai', 'openai'],
+  ['perplexity', 'perplexity'],
+  ['google-extended', 'google-extended'],
+  ['muretai-node', 'muretai-node'],
+  ['curl', 'curl'],
+  ['mozilla', 'browser'],
+];
+
+/** The families that read as an AI agent — the ones the notice route signposts with a
+ *  `Link` header. `muretai-node` is deliberately absent: its Outbox already walks the
+ *  well-known card paths, so a signpost buys it nothing. Must match the same set in
+ *  examples/agent_entry_reference.py. */
+export const AI_AGENT_FAMILIES = new Set([
+  'claude-user', 'claudebot', 'gptbot', 'openai', 'perplexity', 'google-extended',
+]);
+
+/** ASCII-only lowercase fold. NOT `toLowerCase()`: Unicode casing is runtime- and
+ *  locale-shaped (the Turkish-I class of surprise), and no needle in the table needs it —
+ *  folding only A-Z is what makes the same UA string classify identically in both twins. */
+function asciiLower(s) {
+  let out = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const c = s.charCodeAt(i);
+    out += (c >= 65 && c <= 90) ? String.fromCharCode(c + 32) : s[i];
+  }
+  return out;
+}
+
+/** UA string -> family. Absent/empty/non-string -> 'none'; no needle matched -> 'other'.
+ *  Total on untrusted input, and the RETURN VALUE is always one of the twelve fixed
+ *  family names — never a substring of the input (bounded stats keyspace). */
+export function uaFamily(ua) {
+  if (typeof ua !== 'string' || !ua) return 'none';
+  const folded = asciiLower(ua);
+  for (const [needle, family] of UA_FAMILIES) {
+    if (folded.includes(needle)) return family;
+  }
+  return 'other';
+}
+
+/** The FIRST User-Agent value out of a headers mapping, or null. Case-insensitive key
+ *  scan so an in-process host can pass any casing; Node's own `req.headers` already
+ *  lowercases keys and keeps only the FIRST user-agent of a duplicated pair — the Python
+ *  twin's `email.Message.get` does the same, which is the parity this relies on. A
+ *  non-string value (an array, a number) reads as absent, never coerced. */
+function uaOf(headers) {
+  if (!headers || typeof headers !== 'object') return null;
+  for (const key of Object.keys(headers)) {
+    if (asciiLower(key) === 'user-agent') {
+      const v = headers[key];
+      return typeof v === 'string' ? v : null;
+    }
+  }
+  return null;
+}
+
 const CARD_ENVELOPE_VERSION = 1;
 const CARD_ENVELOPE_TYPE = 'agentcard';
 
@@ -438,6 +706,382 @@ export function verifyEnvelope(fields, opts = {}) {
   }
 }
 
+// ================================================================ Web Bot Auth (RFC 9421 subset, verify-only) — T107
+//
+// The INBOUND half only: did the holder of one of the keys this entry was GIVEN sign
+// THIS request, for THIS authority, as a `web-bot-auth` request? It mirrors EXACTLY the
+// subset shared/webbotauth.py::verify_request implements — no more (content digests,
+// @query-param, per-item parameters and every other RFC 9421 feature are refused, not
+// ignored) and no less. The two are pinned to one fixture, testdata/wba_vectors.json:
+// a vector one twin accepts and the other refuses is a red suite. Verification is
+// BYTE-FAITHFUL, not canonical: the signature base is rebuilt from the RECEIVED
+// `@signature-params` text, so a peer who orders or spaces parameters differently still
+// verifies (signing is canonical, verifying is byte-faithful — the shared/jws.py split).
+//
+// One rule governs every caller in this file: WBA never changes a verdict — it only
+// ever ADDS identity (`wba_did` on the backend envelope, a `wbaVisits` count). Absent,
+// invalid, expired, unknown-key and tampered all behave exactly like "no WBA".
+
+const WBA_TAG_REQUEST = 'web-bot-auth';
+/** RFC 9421's HTTP-signature-registry name — NOT JOSE's "EdDSA". Same curve, two
+ *  registries; mixing the spellings is a silent interop failure. */
+const WBA_ALG = 'ed25519';
+/** Tolerance for the peer's clock being ahead, applied to `created` only. */
+const WBA_CLOCK_SKEW = 300;
+/** The loosest accepted `expires - created`: these headers are a bearer credential
+ *  while they live (webbotauth.REQUEST_SIG_WINDOW + CLOCK_SKEW). */
+const WBA_MAX_REQUEST_LIFETIME = 600;
+/** Refuse to even tokenize an absurd header — bounds parser work on hostile input. */
+const WBA_MAX_HEADER_CHARS = 8192;
+/** Standard base64, padded — what Python's base64.b64decode(validate=True) accepts.
+ *  Node's Buffer.from(s, 'base64') silently IGNORES invalid characters and tolerates
+ *  any padding, which is the classic twin-divergence; pre-validating is what keeps one
+ *  Signature value from being two different byte strings. */
+const WBA_B64_STANDARD = /^[A-Za-z0-9+/]*={0,2}$/;
+/** Unpadded base64url — what shared/jws.unb64url accepts for a JWK `x` ("+", "/" and
+ *  "=" refused; a length ≡ 1 (mod 4) has no byte decoding). */
+const WBA_B64URL = /^[A-Za-z0-9_-]*$/;
+
+/** Serialize an RFC 8941 sf-string: quoted, `\` and `"` escaped — the only two escapes
+ *  the RFC defines. */
+function wbaSfString(s) {
+  return '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+}
+
+/** Python str.strip()'s default whitespace set, exactly — NOT String.prototype.trim().
+ *  The two runtimes disagree at the edges (Python also strips \x1c-\x1f and \x85; JS
+ *  also strips U+FEFF), and a covered header value the twins trim differently is a
+ *  signature base only one of them can rebuild. */
+const WBA_PY_WS_CLASS = '[\\t\\n\\v\\f\\r \\x1c-\\x1f\\x85\\xa0\\u1680'
+  + '\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000]+';
+const WBA_PY_WS = new RegExp(`^${WBA_PY_WS_CLASS}|${WBA_PY_WS_CLASS}$`, 'g');
+function wbaPyStrip(s) {
+  return s.replace(WBA_PY_WS, '');
+}
+
+function wbaIsKeyFirst(ch) { return (ch >= 'a' && ch <= 'z') || ch === '*'; }
+function wbaIsKeyRest(ch) {
+  return (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9')
+    || ch === '_' || ch === '-' || ch === '.' || ch === '*';
+}
+
+/** An RFC 8941 key (a dictionary label or a parameter name) -> [key, next] or null. */
+function wbaParseKey(s, i) {
+  if (i >= s.length || !wbaIsKeyFirst(s[i])) return null;
+  let j = i + 1;
+  while (j < s.length && wbaIsKeyRest(s[j])) j += 1;
+  return [s.slice(i, j), j];
+}
+
+/** A quoted sf-string. Only `\"` and `\\` are escapes; every other character must be
+ *  printable ASCII — rejecting the rest is what keeps one byte string from having two
+ *  spellings. */
+function wbaParseSfString(s, i) {
+  if (i >= s.length || s[i] !== '"') return null;
+  i += 1;
+  let out = '';
+  while (i < s.length) {
+    const ch = s[i];
+    if (ch === '\\') {
+      i += 1;
+      if (i >= s.length || (s[i] !== '"' && s[i] !== '\\')) return null;
+      out += s[i];
+      i += 1;
+    } else if (ch === '"') {
+      return [out, i + 1];
+    } else if (ch >= ' ' && ch <= '~') {
+      out += ch;
+      i += 1;
+    } else {
+      return null;
+    }
+  }
+  return null;
+}
+
+/** An sf-integer: optional `-`, at most 15 ASCII digits (safely inside 2^53). */
+function wbaParseInteger(s, i) {
+  let j = i;
+  if (j < s.length && s[j] === '-') j += 1;
+  let k = j;
+  while (k < s.length && s[k] >= '0' && s[k] <= '9') k += 1;
+  if (k === j || (k - j) > 15) return null;
+  return [parseInt(s.slice(i, k), 10), k];
+}
+
+/** The only parameter value types in this profile: sf-string and sf-integer. */
+function wbaParseBareItem(s, i) {
+  if (i < s.length && s[i] === '"') return wbaParseSfString(s, i);
+  return wbaParseInteger(s, i);
+}
+
+/** `*( ";" *SP key [ "=" bare-item ] )`. A repeated name is REFUSED rather than
+ *  last-wins; a valueless parameter is boolean true. */
+function wbaParseParams(s, i) {
+  const params = new Map();
+  while (i < s.length && s[i] === ';') {
+    i += 1;
+    while (i < s.length && s[i] === ' ') i += 1;
+    const gotKey = wbaParseKey(s, i);
+    if (gotKey === null) return null;
+    const name = gotKey[0];
+    i = gotKey[1];
+    if (params.has(name)) return null;
+    if (i < s.length && s[i] === '=') {
+      const val = wbaParseBareItem(s, i + 1);
+      if (val === null) return null;
+      params.set(name, val[0]);
+      i = val[1];
+    } else {
+      params.set(name, true);
+    }
+  }
+  return [params, i];
+}
+
+/** The covered components: `"(" *SP [ sf-string *( 1*SP sf-string ) *SP ] ")"`.
+ *  Per-item parameters are refused — they change what a component MEANS, and a profile
+ *  that does not implement them must not silently ignore them. */
+function wbaParseInnerList(s, i) {
+  if (i >= s.length || s[i] !== '(') return null;
+  i += 1;
+  const items = [];
+  for (;;) {
+    while (i < s.length && s[i] === ' ') i += 1;
+    if (i >= s.length) return null;
+    if (s[i] === ')') return [items, i + 1];
+    const got = wbaParseSfString(s, i);
+    if (got === null) return null;
+    i = got[1];
+    if (i < s.length && s[i] !== ' ' && s[i] !== ')') return null;  // incl. ';' per-item
+    items.push(got[0]);
+  }
+}
+
+function wbaSkipOws(s, i) {
+  while (i < s.length && (s[i] === ' ' || s[i] === '\t')) i += 1;
+  return i;
+}
+
+/** Parse a `Signature-Input` value into entries, PRESERVING the raw text of each
+ *  entry's value — RFC 9421 signs that text, so rebuilding it from the parsed
+ *  structure would only work for peers who serialize exactly as we do. */
+function wbaParseSignatureInput(value) {
+  const s = value;
+  const n = s.length;
+  let i = wbaSkipOws(s, 0);
+  if (i >= n) return null;
+  const entries = [];
+  for (;;) {
+    const gotKey = wbaParseKey(s, i);
+    if (gotKey === null) return null;
+    const label = gotKey[0];
+    i = gotKey[1];
+    if (i >= n || s[i] !== '=') return null;
+    i += 1;
+    const start = i;
+    const gotList = wbaParseInnerList(s, i);
+    if (gotList === null) return null;
+    const components = gotList[0];
+    i = gotList[1];
+    const gotParams = wbaParseParams(s, i);
+    if (gotParams === null) return null;
+    const params = gotParams[0];
+    i = gotParams[1];
+    entries.push({ label, components, params, signatureParams: s.slice(start, i) });
+    i = wbaSkipOws(s, i);
+    if (i >= n) return entries;
+    if (s[i] !== ',') return null;
+    i = wbaSkipOws(s, i + 1);
+    if (i >= n) return null;                 // trailing comma
+  }
+}
+
+/** Parse a `Signature` value: `label=:<standard base64>:` entries. */
+function wbaParseSignature(value) {
+  const s = value;
+  const n = s.length;
+  let i = wbaSkipOws(s, 0);
+  if (i >= n) return null;
+  const out = [];
+  for (;;) {
+    const got = wbaParseKey(s, i);
+    if (got === null) return null;
+    const label = got[0];
+    i = got[1];
+    if (i + 1 >= n || s[i] !== '=' || s[i + 1] !== ':') return null;
+    i += 2;
+    const end = s.indexOf(':', i);
+    if (end < 0) return null;
+    const b64 = s.slice(i, end);
+    if (!WBA_B64_STANDARD.test(b64) || b64.length % 4 !== 0) return null;
+    const raw = Buffer.from(b64, 'base64');
+    i = end + 1;
+    if (i < n && s[i] === ';') return null;   // parameters on a signature member
+    out.push([label, raw]);
+    i = wbaSkipOws(s, i);
+    if (i >= n) return out;
+    if (s[i] !== ',') return null;
+    i = wbaSkipOws(s, i + 1);
+    if (i >= n) return null;
+  }
+}
+
+/** The `(Signature-Input, Signature)` pair as verifiable entries, or null. Duplicate
+ *  labels, a label present in one header but not the other, and every unexpected byte
+ *  return null — each is a case where two implementations could disagree about what
+ *  was signed. Never throws. */
+function wbaParseSignatureHeaders(sigInput, sig) {
+  try {
+    if (typeof sigInput !== 'string' || typeof sig !== 'string') return null;
+    if (sigInput.length > WBA_MAX_HEADER_CHARS || sig.length > WBA_MAX_HEADER_CHARS) {
+      return null;
+    }
+    const entries = wbaParseSignatureInput(sigInput);
+    const sigs = wbaParseSignature(sig);
+    if (entries === null || sigs === null) return null;
+    const labels = entries.map((e) => e.label);
+    if (new Set(labels).size !== labels.length) return null;
+    const byLabel = new Map();
+    for (const [label, raw] of sigs) {
+      if (byLabel.has(label)) return null;
+      byLabel.set(label, raw);
+    }
+    if (byLabel.size !== labels.length) return null;
+    for (const label of labels) { if (!byLabel.has(label)) return null; }
+    for (const e of entries) e.sig = byLabel.get(e.label);
+    return entries;
+  } catch {
+    return null;
+  }
+}
+
+/** Case-insensitive header lookup over a plain mapping. A non-string value (an array,
+ *  a number) reads as absent, never coerced. */
+function wbaHeaderGet(headers, name) {
+  if (!headers || typeof headers !== 'object') return null;
+  for (const key of Object.keys(headers)) {
+    if (asciiLower(key) === name) {
+      const v = headers[key];
+      return typeof v === 'string' ? v : null;
+    }
+  }
+  return null;
+}
+
+/** The 32 raw key bytes of an Ed25519 OKP JWK, or null — the strict gate every
+ *  untrusted key passes through (mirrors shared/webbotauth.public_from_jwk). */
+function wbaPublicFromJwk(jwk) {
+  try {
+    if (!jwk || typeof jwk !== 'object' || Array.isArray(jwk)) return null;
+    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') return null;
+    const x = jwk.x;
+    if (typeof x !== 'string') return null;
+    if (!WBA_B64URL.test(x) || x.length % 4 === 1) return null;
+    const raw = Buffer.from(x, 'base64url');
+    return raw.length === 32 ? raw : null;
+  } catch {
+    return null;
+  }
+}
+
+/** RFC 7638 thumbprint of an Ed25519 public key — the `keyid` on the wire. Built from
+ *  the CANONICAL re-encoding of the key bytes, so a differently-spelled (but valid) `x`
+ *  still names the same key. The literal member order crv,kty,x IS Python's
+ *  sort_keys+compact form (x is base64url, so no JSON escaping can differ). */
+function wbaThumbprint(publicRaw) {
+  const payload = `{"crv":"Ed25519","kty":"OKP","x":"${publicRaw.toString('base64url')}"}`;
+  return createHash('sha256').update(payload, 'utf8').digest('base64url');
+}
+
+/** Resolve each covered component to the value to re-sign over, or null. `@authority`
+ *  comes from the VERIFIER (our canonical baseUrl) — never from the message; every
+ *  other derived component is refused; header values are stripped with Python's set. */
+function wbaComponentValues(components, authority, headers) {
+  const out = [];
+  const seen = new Set();
+  for (const name of components) {
+    if (typeof name !== 'string' || name !== asciiLower(name) || seen.has(name)) {
+      return null;
+    }
+    seen.add(name);
+    if (name === '@authority') {
+      out.push([name, authority]);
+    } else if (name.startsWith('@')) {
+      return null;
+    } else {
+      const value = wbaHeaderGet(headers, name);
+      if (value === null) return null;
+      out.push([name, wbaPyStrip(value)]);
+    }
+  }
+  return out;
+}
+
+/** The exact bytes covered by the signature (RFC 9421 §2.5): one `"name": value` line
+ *  per component, then `"@signature-params": <received text>`, LF-joined, no trailing
+ *  newline. */
+function wbaSignatureBase(pairs, paramsText) {
+  const lines = pairs.map(([name, value]) => `${wbaSfString(asciiLower(name))}: ${value}`);
+  lines.push(`${wbaSfString('@signature-params')}: ${paramsText}`);
+  return Buffer.from(lines.join('\n'), 'utf8');
+}
+
+/** One parsed entry, checked end to end against one key. Order matters only for cost:
+ *  the cheap policy checks run before the Ed25519 verification. */
+function wbaEntryVerifies(entry, { keyid, publicRaw, authority, headers, now }) {
+  const params = entry.params;
+  if (params.get('keyid') !== keyid || params.get('tag') !== WBA_TAG_REQUEST) return false;
+  const alg = params.get('alg');
+  if (alg !== undefined && alg !== WBA_ALG) return false;
+  const created = params.get('created');
+  const expires = params.get('expires');
+  if (!Number.isInteger(created) || !Number.isInteger(expires)) return false;
+  if (created > now + WBA_CLOCK_SKEW || now >= expires) return false;
+  if (expires <= created || (expires - created) > WBA_MAX_REQUEST_LIFETIME) return false;
+  const components = entry.components || [];
+  // Without @authority the signature says nothing about WHERE it was served.
+  if (!components.includes('@authority')) return false;
+  const pairs = wbaComponentValues(components, authority, headers);
+  if (pairs === null) return false;
+  return verifyBytes(publicRaw, entry.sig, wbaSignatureBase(pairs, entry.signatureParams));
+}
+
+/** The DID that signed this inbound request, or null. Never throws. `jwks` is a
+ *  directory document ({keys:[…]}) already established as trustworthy — who the keys
+ *  belong to was decided before this was called (DECISION 2: keys are GIVEN, never
+ *  fetched on the hot path). Mirrors shared/webbotauth.verify_request exactly;
+ *  testdata/wba_vectors.json holds the two to one verdict per input. */
+export function wbaVerifyRequest(headers, { authority, jwks, now } = {}) {
+  try {
+    const entries = wbaParseSignatureHeaders(
+      wbaHeaderGet(headers, 'signature-input') || '',
+      wbaHeaderGet(headers, 'signature') || '');
+    if (!entries || !entries.length) return null;
+    const keys = (jwks && typeof jwks === 'object' && !Array.isArray(jwks))
+      ? jwks.keys : null;
+    if (!Array.isArray(keys)) return null;
+    const auth = wbaPyStrip(String(authority || '')).toLowerCase();
+    if (!auth) return null;
+    const moment = Math.floor(
+      (now === undefined || now === null) ? Date.now() / 1000 : now);
+    for (const jwk of keys) {
+      const publicRaw = wbaPublicFromJwk(jwk);
+      if (publicRaw === null) continue;
+      const keyid = wbaThumbprint(publicRaw);
+      for (const entry of entries) {
+        if (wbaEntryVerifies(entry, { keyid, publicRaw, authority: auth,
+                                      headers, now: moment })) {
+          return didFromPublicKeyHex(publicRaw);
+        }
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // ================================================================ device-key binding v2 (T102)
 //
 // The ACCOUNT layer: a message may carry a countersigned DeviceKeyBinding v2 in
@@ -903,7 +1547,9 @@ function wireShapeError(msg) {
 
 /** Every response carries these. An agent entry reads NO cookie, header credential or session —
  *  authority comes only from an Ed25519 signature inside the body — so `*` grants a browser
- *  agent exactly what curl already had, and nothing more. Never add Allow-Credentials. */
+ *  agent exactly what curl already had, and nothing more. Never add Allow-Credentials.
+ *  `Access-Control-Allow-Methods` is the ORIGIN-WIDE default and is overridden per resource
+ *  on any response that also carries `Allow` (see `allowHeaders`). */
 const CORS_HEADERS = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
@@ -1477,6 +2123,15 @@ export function canonicalMount(canonUrl, basePath) {
  *                  /.well-known/did-configuration.json, and a verifier requires both halves.
  *   basePath       ONLY for a proxy that strips the prefix: '' or exactly baseUrl's path.
  *                  See canonicalMount for why this is not a general knob.
+ *   guest          GUEST MOUNT: the SITE keeps its own front page and this entry claims
+ *                  only its card paths and the POST door (default false). It requires a
+ *                  baseUrl WITH a path — the door — because a guest entry at a bare origin
+ *                  would claim `/`, which is the one thing this mode exists to give back.
+ *                  Three differences from the ordinary (site-owning) mount, and no others:
+ *                  the GET notice is not served (the entry never shadows a page the site
+ *                  owns), the card is ALSO served at the ORIGIN's well-known paths (where a
+ *                  stranger's agent looks — RFC 8615), and `Allow` on the door names POST
+ *                  only. `GET /` and `POST /` are not this entry's contract in this mode.
  *   responder      (envelope) => string | {text, contextId?, timestamp?} | Promise<…>
  *   openDoor       advertise `muretai.open_door` (default true) — the flag that tells a
  *                  visiting agent it may contact you without an introduction.
@@ -1486,6 +2141,13 @@ export function canonicalMount(canonUrl, basePath) {
  *                  oracle. Signed senders are not rate-bound here: they are attributable,
  *                  and every one of them is already in the ledger.
  *   anonRatePerMin anonymous replies per minute for the WHOLE agent entry (default 30).
+ *   wbaVerifiers   OPTIONAL inbound Web Bot Auth (T107): a JWKS document {keys:[…]} of
+ *                  Ed25519 keys whose holders this entry should RECOGNISE — the body of
+ *                  a key directory you verified out of band. Absent (the default) the
+ *                  feature is entirely off: no header is read, bytes are unchanged.
+ *                  Recognition only ever ADDS identity (env.wba_did, the wbaVisits
+ *                  count); it never changes verified, a ledger row, a rate lane or any
+ *                  refusal verdict.
  */
 export function createAgentEntry({
   seedHex,
@@ -1500,7 +2162,9 @@ export function createAgentEntry({
   skills = [],
   domains = null,
   basePath = null,
+  guest = false,
   maxAccounts = 50000,
+  wbaVerifiers = null,
 } = {}) {
   if (!seedHex) throw new TypeError('createAgentEntry: seedHex is required');
   if (!baseUrl) throw new TypeError('createAgentEntry: baseUrl is required (it is signed into the card)');
@@ -1512,10 +2176,27 @@ export function createAgentEntry({
   // the signed card cannot disagree. '' for a bare origin — every route below is then the
   // byte-identical string this module always matched.
   const mount = canonicalMount(canonUrl, basePath);
+  const guestMount = Boolean(guest);
+  // A guest entry with NO path would claim the origin — `isMountPath('/')` is the door and
+  // the notice both — which is exactly the front page this mode exists to leave alone.
+  // Refuse to start rather than take it: an operator who asked for coexistence and silently
+  // got occupation finds out from their own home page.
+  if (guestMount && !mount) {
+    refuseBaseUrl(canonUrl, 'a guest mount needs a door path, and this url has none.',
+      'A guest entry leaves GET / to the site and answers at a path beside it, so the '
+      + 'address it publishes must name that path — the mount, the card url and the POST '
+      + 'door are then one string by construction. Give the door in baseUrl (the card names '
+      + 'it, so a visitor that read the card posts to the right place with no other '
+      + 'knowledge), or drop `guest` and let this entry own its origin.',
+      `${canonUrl}/agent`);
+  }
   // The agent half of a T88 domain binding. Refuses to start on anything that is not a
   // bare domain: a name the domain's credential can never bind is not worth publishing.
   const canonDomains = canonicalDomains(domains);
   const did = didFromSeedHex(seedHex);
+  // The terms of this door, built ONCE: the card publishes it (E1, before the knock) and
+  // the no-envelope refusal returns the same object (E2, after it).
+  const requirement = signedEnvelopeRequirement(did);
 
   const card = {
     protocolVersion: PROTOCOL_VERSION,
@@ -1538,22 +2219,184 @@ export function createAgentEntry({
   // Deliberately NO `relay`/`enc_pub` on the card: those advertise a store-and-forward
   // mailbox, and an agent entry has no listener draining one. Advertising a mailbox nobody
   // reads is worse than advertising none — mail would queue at the relay forever.
+  //
+  // THE DOOR'S TERMS, IN STANDARD A2A SHAPE (E1). `securitySchemes` + `security` are the
+  // fields A2A has for exactly this, and until now both were absent — so a card that
+  // advertised a skill said nothing at all about HOW to call it, and the only way to learn
+  // the requirement was to knock and be refused. That is the discovery step an HTTP-402
+  // style protocol structurally cannot have and a card CAN; publishing it is what turns the
+  // refusal below into a fallback instead of the only teacher.
+  //
+  // APPENDED LAST so every field an already-deployed entry publishes keeps its bytes AND
+  // its position. `type` is deliberately NOT one of OpenAPI's five: `http` would claim an
+  // `Authorization` header this door never reads, and a standard-but-wrong type makes a
+  // conformant client do the wrong thing, where an unknown one makes it read the block
+  // beside it. The scheme is named three times (key, `type`, `muretai.scheme`) and every
+  // spelling is the same string the refusal returns.
+  //
+  // The description is IMPERATIVE for the same reason the requirement object is: a real
+  // agent that started here read the terms, concluded correctly that it could not sign,
+  // and stopped — "the card does not offer an alternative communication method". A card
+  // that states a requirement and nothing about how to come to meet it is a locked door
+  // with the lock documented. The worked-example clause appears only when the page it
+  // names is known to resolve (see FIRST_KNOCK_URL); a 404 here would out-compete the
+  // block beside it.
+  card.securitySchemes = {
+    [SIGNED_ENVELOPE_SCHEME]: {
+      type: SIGNED_ENVELOPE_SCHEME,
+      description: 'Generate an Ed25519 keypair if you do not have one - no account, no '
+        + 'registration, any crypto library will do - then sign every message/send with '
+        + 'the did:key you present as metadata.from. The step-by-step instruction, the '
+        + 'signed fields, the canonical bytes and the address to send to are in `muretai` '
+        + 'beside this line'
+        + (FIRST_KNOCK_URL ? `; a worked example is at ${FIRST_KNOCK_URL}` : ''),
+      muretai: requirement,
+    },
+  };
+  card.security = [{ [SIGNED_ENVELOPE_SCHEME]: [] }];
 
   const cardBytes = Buffer.from(JSON.stringify(card), 'utf8');   // identical bytes on both paths
   // ACCOUNT DID -> {first_seen, last_seen, messages}. Keyed by the RESOLVED account (T102):
   // the OWNER DID when a valid v2 binding rides along, else the device DID — so an owner's
-  // sibling devices are ONE customer row.
+  // sibling devices are ONE customer row. The entry never reads it back to gate, greet, or
+  // rate-limit, so it runs fine unpersisted — but keeping it in the site's own store is
+  // RECOMMENDED: it is the customer list (recognise a returning account, contact it again
+  // later). An analytics sink records visits too, but can never be read back.
   const ledger = new Map();
   // device DID -> owner DID, the in-process TOFU pin (T102). The first VALID binding pins a
   // device to its owner; a later binding for the same device naming a DIFFERENT owner is
-  // refused. Per-process on purpose for v1.5 — a real site PERSISTS this (and the fold), or
-  // the conflict rule resets to trust-on-first-use every restart.
+  // refused. Per-process on purpose for v1.5 — persisting it (and the fold) is RECOMMENDED,
+  // not required: without it the conflict rule resets to trust-on-first-use every restart.
+  // Unlike the ledger it is READ on every message, so only a real store can carry it.
   const deviceOwner = new Map();
   const replay = new ReplayGuard();
   const anonRate = new RateBound(anonRatePerMin);
   let sigEnvelope = null;
   let sigMintedAt = 0;
 
+  // T107: inbound Web Bot Auth, verify-only, against keys GIVEN at construction — the
+  // entry never fetches a directory on the hot path (network-free while answering).
+  // Refuse-to-start posture, house style: a key the entry can never match is config the
+  // operator believes protects them and does not.
+  let wbaKeys = null;
+  let wbaAuthority = null;
+  // DID -> count of WBA-verified GET/HEAD fetches. DECISION 1: a signed GET IDENTIFIES
+  // but never ENROLS — a crawler fetching 10,000 pages mints zero ledger rows; this
+  // count is bounded by the configured key list, never by attacker choice. Exposed on
+  // the returned object like `ledger` (in-process sample state, never on the wire).
+  const wbaVisits = new Map();
+  if (wbaVerifiers !== null && wbaVerifiers !== undefined) {
+    const keys = (wbaVerifiers && typeof wbaVerifiers === 'object'
+      && !Array.isArray(wbaVerifiers)) ? wbaVerifiers.keys : null;
+    if (!Array.isArray(keys) || keys.length === 0) {
+      throw new TypeError('createAgentEntry: wbaVerifiers must be a JWKS document '
+        + '{keys:[…]} — the key-directory body you verified out of band');
+    }
+    if (keys.length > 64) {
+      throw new TypeError(`createAgentEntry: wbaVerifiers holds ${keys.length} keys — `
+        + 'more than 64 is not a verifier list, it is a directory dump');
+    }
+    keys.forEach((jwk, i) => {
+      if (wbaPublicFromJwk(jwk) === null) {
+        throw new TypeError(`createAgentEntry: wbaVerifiers.keys[${i}] is not an `
+          + 'Ed25519 OKP JWK (kty "OKP", crv "Ed25519", x = unpadded base64url of '
+          + '32 bytes)');
+      }
+    });
+    wbaKeys = { keys: keys.map((k) => ({ kty: k.kty, crv: k.crv, x: k.x })) };
+    // @authority derives from the CANONICAL baseUrl, NEVER a Host header — a header a
+    // client can set is not a fact about where we were reached. canonUrl already
+    // lowercased the host and stripped the scheme's default port, so URL.host IS the
+    // RFC 9421 authority (shared/webbotauth.authority_of computes the same string).
+    wbaAuthority = new URL(canonUrl).host;
+  }
+
+  /** The WBA-verified caller DID for this request's headers, or null. Total on hostile
+   *  input; costs one keyid comparison per configured key and an Ed25519 verify only on
+   *  a keyid match. */
+  function wbaIdentify(headers) {
+    if (!wbaKeys) return null;
+    return wbaVerifyRequest(headers, { authority: wbaAuthority, jwks: wbaKeys });
+  }
+
+  function wbaObserve(headers) {
+    const did = wbaIdentify(headers);
+    if (did) wbaVisits.set(did, (wbaVisits.get(did) || 0) + 1);
+  }
+
+  // family -> stage -> count. OBSERVATION ONLY, and out-of-contract sample state like the
+  // ledger's row shape: `stats()` is how a site owner sees who is knocking, it is never
+  // served on the wire (a stats route would be new unauthenticated surface leaking traffic
+  // composition to any stranger). Keyspace bounded by the fixed UA_FAMILIES table times
+  // five stage names — an attacker choosing UA strings cannot grow it.
+  const uaStats = new Map();
+
+  function tally(family, stage) {
+    let row = uaStats.get(family);
+    if (!row) { row = new Map(); uaStats.set(family, row); }
+    row.set(stage, (row.get(stage) || 0) + 1);
+  }
+
+  /** A plain JSON-able copy of the counters: { family: { stage: n } }. */
+  function stats() {
+    const out = {};
+    for (const [family, row] of uaStats) {
+      out[family] = {};
+      for (const [stage, n] of row) out[family][stage] = n;
+    }
+    return out;
+  }
+
+  /** The `Link` header the notice route carries. TWO relations with different audiences,
+   *  in ONE header field (RFC 8288 allows several link-values in one field, and one field
+   *  is what keeps the two twins' bytes identical through their single-header plumbing):
+   *
+   *    - the DOOR pointer, `rel="https://muretai.net/rel/agent-entry"`, for EVERY caller.
+   *      This is the coexistence primitive (E4): an agent that fetched a page finds the
+   *      machine-readable door in the RESPONSE, with no HTML to parse and no prose to
+   *      read, and a browser ignores it — which is what lets a site keep its own front
+   *      page and add ONE header instead of migrating. An absolute URI because RFC 8288
+   *      §2.1.2 permits a bare token only for an IANA-registered relation.
+   *    - `rel="service-desc"` (RFC 8631's registered relation for "service description …
+   *      primarily intended for consumption by machines"), FIRST and only for the UA
+   *      families that read as an AI agent — the T119 signpost, unchanged in meaning.
+   *
+   *  HEADER-ONLY on purpose: the notice BODY is byte-identical for every caller, so what
+   *  the UA changes is still only this one additive relation and never a verdict. */
+  function steerHeaders(family) {
+    const door = `<${mount}${AGENT_CARD_PATH}>; rel="${AGENT_ENTRY_REL}"`;
+    if (!AI_AGENT_FAMILIES.has(family)) return { Link: door };
+    return { Link: `<${mount}${AGENT_CARD_PATH}>; rel="service-desc", ${door}` };
+  }
+
+  /** Which stage a finished POST was, from OBSERVABLES only — the request bytes and the
+   *  response we are about to return — so the refusal ladder in `handlePost` stays
+   *  byte-untouched by observation. A signed reply whose REQUEST carried metadata.sig is
+   *  a signed_post; a signed reply for a request without one is the anonymous lane; every
+   *  other outcome (413/400/any JSON-RPC error) is refused_post. Must decide identically
+   *  to `_post_stage` in examples/agent_entry_reference.py. */
+  function postStage(bodyBuffer, out) {
+    let signedReplyOut = false;
+    try {
+      const body = JSON.parse(out.body.toString('utf8'));
+      const result = (body && typeof body === 'object') ? body.result : null;
+      const meta = (result && typeof result === 'object') ? result.metadata : null;
+      signedReplyOut = Boolean(meta && typeof meta === 'object' && typeof meta.sig === 'string');
+    } catch { signedReplyOut = false; }
+    if (!signedReplyOut) return 'refused_post';
+    let hadSig = false;
+    try {
+      const req = JSON.parse(bodyBuffer.toString('utf8'));
+      const params = (req && typeof req === 'object' && !Array.isArray(req)) ? req.params : null;
+      const msg = (params && typeof params === 'object' && !Array.isArray(params))
+        ? params.message : null;
+      const meta = (msg && typeof msg === 'object' && !Array.isArray(msg)) ? msg.metadata : null;
+      hadSig = Boolean(meta && typeof meta === 'object'
+        && typeof meta.sig === 'string' && meta.sig);
+    } catch { hadSig = false; }
+    return hadSig ? 'signed_post' : 'anon_post';
+  }
+
   /** The signed card, re-minted at most hourly. A CONSUMER REJECTS AN ENVELOPE OLDER THAN
    *  6h (and one dated in the FUTURE), so this is a freshness window, not a cache tweak:
    *  without it a saved copy would still "prove" ownership to whoever holds the origin next. */
@@ -1662,7 +2505,7 @@ export function createAgentEntry({
   /** The FROZEN backend-handoff shape (agent/webhookwake.py::_envelope). The site's own
    *  code consumes this, so the key set must not drift: a webhook push, a drive-API read
    *  and an agent entry callback all parse with ONE schema. */
-  function backendEnvelope(msg, { verified, peerDid, ownerDid = null }) {
+  function backendEnvelope(msg, { verified, peerDid, ownerDid = null, wbaDid = null }) {
     const meta = msg.metadata || {};
     return {
       to_agent: name,
@@ -1674,6 +2517,12 @@ export function createAgentEntry({
       // belongs to an owner, else null. `peer_did` STAYS the device that signed; sibling
       // devices share one owner_did, which is how a merchant reads them as one account.
       owner_did: ownerDid,
+      // T107: the DID whose Web Bot Auth signature covered this REQUEST's transport
+      // (@authority + signature-agent), or null. TRANSPORT-LEVEL identification only: it
+      // does not prove the DID wrote `text` — `verified`/`peer_did` do that — and a WBA
+      // header set is replayable until it expires, so it must never be read as
+      // authorship. Additive; null whenever no verifier is configured.
+      wba_did: wbaDid,
       peer_name: null,
       context_id: msg.contextId ?? null,
       text: messageText(msg),
@@ -1721,7 +2570,7 @@ export function createAgentEntry({
    * size checks come BEFORE any parsing or crypto — a check placed after the signature is
    * a check the attacker simply skips.
    */
-  function handlePost(rawBody) {
+  function handlePost(rawBody, reqHeaders) {
     // RAW BYTES, always. A host app that hands us a decoded string has already destroyed
     // the evidence the strict decode below exists to find, so normalise once and measure
     // the SIZE in bytes rather than in UTF-16 code units.
@@ -1806,6 +2655,23 @@ export function createAgentEntry({
     if (!from || !to || !sig) {
       const bare = !from && !to && !sig;
       if (!(anonymousLane && bare)) {
+        // THE REFUSAL TEACHES (E2) — but only the keyless walk-in. `data` keeps the human
+        // string it always carried, under `detail`, and gains `accepts[]`: the ways in,
+        // as an array, each naming its scheme. A visitor that has only this can mint a
+        // did:key, sign the six fields and be answered on its next POST — which is the
+        // whole point, because refusing an agent for not having a key it was never told
+        // how to make is the error, not the key.
+        //
+        // A PARTIAL envelope (from/to present, sig stripped) gets the old refusal
+        // unchanged. It is a DOWNGRADE ATTEMPT, not a walk-in: whoever sent it already
+        // holds a key and already knows the shape, so there is nothing to teach and no
+        // reason to hand a prober a machine-readable map of what to try next.
+        if (bare) {
+          return rpcError(reqId, ERRORS.UNAUTHENTICATED, {
+            detail: 'missing signing envelope (from/to/sig)',
+            accepts: [requirement],
+          });
+        }
         return rpcError(reqId, ERRORS.UNAUTHENTICATED, 'missing signing envelope (from/to/sig)');
       }
       // Anonymous: answer, signed by us, addressed to nobody. NO ledger row — an
@@ -1826,8 +2692,13 @@ export function createAgentEntry({
       if (!replay.checkAndRemember(msg.messageId)) {
         return rpcError(reqId, ERRORS.REPLAY_REJECTED, 'duplicate messageId (replay) detected');
       }
-      return respond(backendEnvelope(msg, { verified: false, peerDid: null }),
-        reqId, msg, '');
+      // T107: the interesting case — an anonymous inquiry whose TRANSPORT a known key
+      // signed. `verified` STAYS false (the WBA signature covers @authority +
+      // signature-agent, not the text), no ledger row is minted (the header set is a
+      // bearer credential and replayable while it lives), and the anon rate bound
+      // above already applied. Identify, don't enrol.
+      return respond(backendEnvelope(msg, { verified: false, peerDid: null,
+        wbaDid: wbaIdentify(reqHeaders) }), reqId, msg, '');
     }
     // 5. addressed to someone else. Checked BEFORE decoding `from`, so a junk DID in a
     //    misaddressed message never reaches the base58 decoder.
@@ -1874,8 +2745,10 @@ export function createAgentEntry({
     const ownerDid = account !== from ? account : null;
 
     noteContact(account);
-    return respond(backendEnvelope(msg, { verified: true, peerDid: from, ownerDid }),
-      reqId, msg, from);
+    // T107: `wba_did` may legitimately differ from `peer_did` (the transport signer vs
+    // the message signer) — both facts are honest, and the schema says which is which.
+    return respond(backendEnvelope(msg, { verified: true, peerDid: from, ownerDid,
+      wbaDid: wbaIdentify(reqHeaders) }), reqId, msg, from);
   }
 
   function respond(env, reqId, msg, toDid) {
@@ -1904,7 +2777,48 @@ export function createAgentEntry({
     return pathname === mount || pathname === `${mount}/`;
   }
 
-  function route(method, path, bodyBuffer) {
+  /** The GET routes this entry owns, built ONCE from the mount so a request path is a
+   *  lookup and never string arithmetic. On a GUEST mount the card is served at the
+   *  ORIGIN's well-known paths TOO — that is the only address a stranger's agent knows to
+   *  try (RFC 8615), and a door nobody can find is not a door. The card's `url` still names
+   *  the DOOR, which is ordinary A2A: the well-known location is where a card is
+   *  DISCOVERED, not the endpoint it describes. */
+  const CARD_ROUTES = new Set([mount + AGENT_CARD_PATH, mount + AGENT_CARD_PATH_LEGACY]);
+  const SIG_ROUTES = new Set([mount + AGENT_CARD_SIG_PATH]);
+  if (guestMount) {
+    CARD_ROUTES.add(AGENT_CARD_PATH).add(AGENT_CARD_PATH_LEGACY);
+    SIG_ROUTES.add(AGENT_CARD_SIG_PATH);
+  }
+
+  /** What `Allow:` may truthfully say about THIS path, or null when the entry does not own
+   *  it at all. RFC 9110 §10.2.1 makes `Allow` a statement about the target RESOURCE, so a
+   *  single server-wide list is a wrong answer to a right question — and on a guest mount
+   *  it would be worse than wrong: answering for `/` at all, even with a 204 and a header,
+   *  is speaking for the site's own front page, which is the one thing a guest mount must
+   *  never do. Whatever the GET route does for an address we do not own (404), OPTIONS and
+   *  the method table do the same. */
+  function allowFor(pathname) {
+    if (CARD_ROUTES.has(pathname) || SIG_ROUTES.has(pathname)) return ALLOW_CARD;
+    if (isMountPath(pathname)) return guestMount ? ALLOW_DOOR : ALLOW_MOUNT;
+    return null;
+  }
+
+  /** The headers that state a resource's methods — BOTH spellings, always the same value.
+   *  `Allow` and `Access-Control-Allow-Methods` answer the same question for two different
+   *  readers, and a response that says `Allow: POST, OPTIONS` beside
+   *  `Access-Control-Allow-Methods: GET, POST, OPTIONS` contradicts itself in one message:
+   *  a browser-resident agent preflighting the guest door was told GET was on the menu at
+   *  the exact address whose GET is 405. `CORS_HEADERS` stays the origin-wide default
+   *  everywhere else (a card GET, a signed reply, a 404); it is narrowed only where the
+   *  resource's real method list is known, which is exactly where `Allow` is emitted. */
+  function allowHeaders(allow) {
+    return { Allow: allow, 'Access-Control-Allow-Methods': allow };
+  }
+
+  function route(method, path, bodyBuffer, headers) {
+    // Classified ONCE per request, used only to count and to signpost. Everything the
+    // ladder decides is decided exactly as if this line did not exist.
+    const family = uaFamily(uaOf(headers));
     const target = String(path || '/');
     // ORIGIN FORM ONLY, and SAY SO. HTTP/1.1 lets a client write the request-target in
     // absolute form (`POST http://elsewhere.example/support HTTP/1.1`) and RFC 9112 §3.2.2
@@ -1922,15 +2836,29 @@ export function createAgentEntry({
     // appends a well-known path), so this is not a new convention; it is the one the
     // fetcher already follows. With mount === '' these are the original constants.
     if (method === 'GET' || method === 'HEAD') {
-      if (pathname === mount + AGENT_CARD_PATH || pathname === mount + AGENT_CARD_PATH_LEGACY) {
-        // Byte-identical on both paths: the current A2A path and the legacy alias.
+      if (CARD_ROUTES.has(pathname)) {
+        // Byte-identical on every path: the current A2A path, the legacy alias, and (on a
+        // guest mount) the origin's well-known copy of both. Which address a client
+        // happened to fetch must never change what it believes about this DID.
+        tally(family, 'card_get');
+        // T107: identify (count), never enrol, never change a byte. Runs only after a
+        // route MATCHED, so refused/404 paths never pay for crypto.
+        wbaObserve(headers);
         return { status: 200, headers: cardHeaders(cardBytes.length), body: cardBytes };
       }
-      if (pathname === mount + AGENT_CARD_SIG_PATH) {
+      if (SIG_ROUTES.has(pathname)) {
         const env = cardEnvelopeBytes();
+        tally(family, 'card_get');
+        wbaObserve(headers);
         return { status: 200, headers: cardHeaders(env.length), body: env };
       }
-      if (isMountPath(pathname)) {
+      // The human notice — NOT served on a guest mount, where GET belongs to the site (E3).
+      // Falling through to 404 is deliberate and is the same non-disclosure the POST route
+      // already makes: an entry beside other agents does not confirm what lives at an
+      // address it was not given.
+      if (!guestMount && isMountPath(pathname)) {
+        tally(family, 'notice_get');
+        wbaObserve(headers);
         const body = Buffer.from(
           // "This ADDRESS", not "this origin": once an entry can be mounted under a
           // path, the origin may hold several agents and this notice speaks for exactly
@@ -1941,9 +2869,28 @@ export function createAgentEntry({
           'utf8');
         return { status: 200,
           headers: { 'Content-Type': 'text/plain; charset=utf-8',
-            'Content-Length': String(body.length) },
+            'Content-Length': String(body.length),
+            // The ONE wire-visible thing observation adds: an AI-agent UA is pointed at
+            // the machine-readable door. The body above is byte-identical either way.
+            ...steerHeaders(family) },
           body };
       }
+      // A GUEST MOUNT'S DOOR ANSWERS GET WITH 405, NOT 404 (proof run 3, 2026-08-18).
+      // Run A guessed the door path CORRECTLY, GET it, and was told nothing was there —
+      // its one correct guess, refuted. This is NOT the
+      // DECISION(non-door-post-answers-404-not-405) non-disclosure case, and the
+      // difference is where the address came from: that decision protects a path a caller
+      // GUESSED AT RANDOM, where a 405 would confirm a door it has no right to know about.
+      // The door's address is PUBLISHED, in the card, signed, at a well-known path — so
+      // hiding it from a GET conceals nothing from anyone and costs a visitor the one
+      // thing it got right. `allowFor` is non-null here only for the guest door: card and
+      // signature routes matched above, and a site-owning mount already returned its
+      // notice. A path this entry does not own still falls through to 404, and a guest
+      // mount still answers nothing it does not own.
+      const getAllow = allowFor(pathname);
+      if (getAllow !== null) {
+        return jsonResponse(405, { error: 'method not allowed' }, allowHeaders(getAllow));
+      }
       return jsonResponse(404, { error: 'not found' });
     }
     if (method === 'POST') {
@@ -1951,14 +2898,33 @@ export function createAgentEntry({
       // and when this entry is mounted under a path, "anywhere else" INCLUDES the bare
       // host, which belongs to the site (or to the neighbour agent) and not to us.
       if (!isMountPath(pathname)) return jsonResponse(404, { error: 'not found' });
-      return handlePost(bodyBuffer || Buffer.alloc(0));
+      const buf = bodyBuffer || Buffer.alloc(0);
+      const out = handlePost(buf, headers);
+      // The stage is read off the finished answer, so an async responder tallies when it
+      // resolves. Known micro-skew, accepted: in the misconfigured sync-caller-with-async-
+      // responder case `handleRequest` replaces the thenable with -32603 AFTER this wrap,
+      // so a stage is tallied for a reply that was then replaced. Sample state only.
+      if (isThenable(out)) return out.then((o) => { tally(family, postStage(buf, o)); return o; });
+      tally(family, postStage(buf, out));
+      return out;
     }
+    // Everything below answers for a RESOURCE, so an address this entry does not own is a
+    // 404 first — the same answer GET and POST give it. Before this, OPTIONS 204'd for
+    // EVERY path (a guest mount would have spoken for the site's front page one verb over)
+    // and the 405 carried no `Allow` at all, which RFC 9110 §15.5.6 REQUIRES.
+    const allow = allowFor(pathname);
+    if (allow === null) return jsonResponse(404, { error: 'not found' });
     if (method === 'OPTIONS') {
+      // The CORS PREFLIGHT lands here: a browser-resident agent POSTing application/json
+      // is not a simple request, so this answer is what decides whether the POST is ever
+      // sent. BOTH method statements narrow to the resource: `Allow` and
+      // `Access-Control-Allow-Methods` are the same fact for two readers, and this is the
+      // one response where the browser reader acts on it.
       return { status: 204,
-        headers: { Allow: 'GET, POST, OPTIONS', 'Content-Length': '0', ...CORS_HEADERS },
+        headers: { 'Content-Length': '0', ...CORS_HEADERS, ...allowHeaders(allow) },
         body: Buffer.alloc(0) };
     }
-    return jsonResponse(405, { error: 'method not allowed' });
+    return jsonResponse(405, { error: 'method not allowed' }, allowHeaders(allow));
   }
 
   function cardHeaders(length) {
@@ -1975,7 +2941,7 @@ export function createAgentEntry({
    *  If `responder` returned a Promise, this answers -32603 rather than serializing
    *  "[object Promise]" into a signed reply — use `handleRequestAsync` for an async responder. */
   function handleRequest(method, path, headers, bodyBuffer) {
-    const out = route(method, path, bodyBuffer);
+    const out = route(method, path, bodyBuffer, headers);
     if (isThenable(out)) {
       return rpcError(null, ERRORS.INTERNAL_ERROR,
         'responder is async — serve this agent entry through listen()/handleRequestAsync()');
@@ -1985,7 +2951,7 @@ export function createAgentEntry({
 
   /** Same contract, awaiting an async responder. This is what `listen()` uses. */
   async function handleRequestAsync(method, path, headers, bodyBuffer) {
-    return route(method, path, bodyBuffer);
+    return route(method, path, bodyBuffer, headers);
   }
 
   /**
@@ -2063,7 +3029,10 @@ export function createAgentEntry({
 
   // `mount` is exported so a host app can route exactly what this entry answers (and log
   // it): it is derived, so reading it here can never disagree with the signed card.
-  return { did, card, ledger, mount, handleRequest, handleRequestAsync, listen,
+  // `stats` is the owner-facing UA-family counters and `wbaVisits` the DID->count of
+  // WBA-verified fetches — both in-process only, like `ledger`.
+  return { did, card, ledger, mount, stats, wbaVisits,
+    handleRequest, handleRequestAsync, listen,
     cardEnvelope: () => JSON.parse(cardEnvelopeBytes().toString('utf8')) };
 }