site: move agentmiddleware.dev homepage here (+ #852 changes)

site/.gitignore

@@ -0,0 +1,4 @@
+.vercel/
+dist/
+.env.local
+.env.*.local

site/.well-known/agent.json

@@ -0,0 +1,107 @@
+{
+  "schema_version": "1.0",
+  "name": "agent-middleware-api",
+  "description": "This marketing host points machines to the Agent Middleware API transaction-integrity boundary for consequential autonomous actions on the configured upstream-MCP path: one logical action, bounded authority consumption, at-most-one gateway dispatch and debit, explicit delivery uncertainty, and linked gateway evidence for required external reconciliation.",
+  "primary_audience": "autonomous_agents",
+  "buyer_audience": [
+    "platform_engineering",
+    "ai_infrastructure",
+    "security_teams_operating_internal_mcp_tools",
+    "teams_operating_consequential_autonomous_actions"
+  ],
+  "positioning": {
+    "schema_version": "1.0",
+    "effective_date": "2026-08-28",
+    "id": "transaction_integrity_for_consequential_autonomous_actions",
+    "label": "Transaction integrity for consequential autonomous actions",
+    "tagline": "Make consequential agent actions transactional.",
+    "legacy_aliases": [
+      "governed_mcp_trust_plane"
+    ],
+    "legacy_protocol_identifiers": {
+      "mcp_server_name": "Agent Middleware MCP Trust Plane"
+    },
+    "supersedes": [
+      "product_wedge",
+      "product_loop"
+    ],
+    "scope": {
+      "transaction_state_machine": "configured_upstream_mcp_tool_only",
+      "local_and_dogfood_tools": "not_covered_by_dispatch_uncertainty_semantics"
+    },
+    "semantics": [
+      "logical_action_identity",
+      "bounded_authority_consumption",
+      "at_most_one_gateway_dispatch_and_debit",
+      "delivery_uncertain_no_automatic_redispatch",
+      "linked_gateway_evidence",
+      "authoritative_external_reconciliation_required"
+    ],
+    "canonical_loop": [
+      "logical_action_identity",
+      "authorize",
+      "reserve_configured_allowance",
+      "debit",
+      "claim_gateway_dispatch",
+      "confirmed_outcome_or_delivery_uncertain",
+      "linked_receipt_and_audit",
+      "authoritative_external_reconciliation_required"
+    ],
+    "claim_boundary": "gateway_state_machine_not_distributed_acid_or_downstream_effect_proof"
+  },
+  "product_wedge": "governed_mcp_trust_plane",
+  "thesis": "Before an autonomous agent acts, it needs bounded authority and portable proof.",
+  "product_loop": [
+    "discover",
+    "authenticate",
+    "authorize",
+    "invoke",
+    "meter",
+    "receipt",
+    "audit",
+    "govern"
+  ],
+  "canonical_api": "https://api.thisisatest.tech",
+  "human_site": "https://www.agentmiddleware.dev/",
+  "github": "https://github.com/agentmiddleware/agent-middleware",
+  "github_access": "public",
+  "discovery": {
+    "agent_manifest": "https://api.thisisatest.tech/.well-known/agent.json",
+    "llm_txt": "https://api.thisisatest.tech/llm.txt",
+    "llms_txt": "https://api.thisisatest.tech/llms.txt",
+    "mcp_tools": "https://api.thisisatest.tech/mcp/tools.json",
+    "openapi": "https://api.thisisatest.tech/openapi.json",
+    "capability_index": "https://api.thisisatest.tech/v1/discover",
+    "dependency_truth": "https://api.thisisatest.tech/health/dependencies"
+  },
+  "bootstrap_sequence": [
+    "https://api.thisisatest.tech/.well-known/agent.json",
+    "https://api.thisisatest.tech/llms.txt",
+    "https://api.thisisatest.tech/mcp/tools.json",
+    "https://api.thisisatest.tech/openapi.json"
+  ],
+  "simulation_and_dependency_truth": "https://api.thisisatest.tech/health/dependencies",
+  "try_it": {
+    "mode": "local_self_hosted",
+    "repository": "https://github.com/agentmiddleware/agent-middleware",
+    "repository_access": "public",
+    "command": "make prove-trust-plane",
+    "live_access": "operator_issued",
+    "requires_live_credentials": false,
+    "proves": [
+      "scoped_permit",
+      "metered_mcp_invoke",
+      "signed_receipt",
+      "replay_without_second_charge",
+      "out_of_scope_denial",
+      "offline_receipt_verification"
+    ],
+    "note": "Runs the real FastAPI transaction-integrity path against a throwaway local SQLite database. This is a reproducible proof, not a production or settlement claim. The source repository is public and can be cloned to run the proof locally without live API credentials."
+  },
+  "authentication": {
+    "type": "api_key",
+    "header": "X-API-Key",
+    "note": "Free sandbox demo keys are self-serve on this marketing host. Live keys are operator-issued to design partners."
+  },
+  "note": "This file is a pointer only. Do not treat this marketing origin as the API base URL."
+}

site/.well-known/security.txt

@@ -0,0 +1,22 @@
+# Rendered by site/build_site.py. The contact address comes from
+# PUBLIC_CONTACT_EMAIL and Expires is set one year past each build, so a
+# deployed site never serves a lapsed file.
+
+Contact: mailto:@@PUBLIC_CONTACT_EMAIL@@
+Expires: @@SECURITY_TXT_EXPIRES@@
+Preferred-Languages: en
+Canonical: https://www.agentmiddleware.dev/.well-known/security.txt
+
+# The source repository is public. The canonical API also serves product
+# boundary and limitation documents at the URLs below.
+#
+# Scope
+#   www.agentmiddleware.dev: this static marketing and proof site
+#   api.thisisatest.tech  — the governed gateway
+#
+# Known and already-published limitations are listed in
+# https://api.thisisatest.tech/SECURITY_LIMITATIONS.md
+# Please read that first; anything it already covers is not a new finding.
+#
+# This site is operated by a single accountable person, not a staffed security
+# team. Expect a human acknowledgement rather than an automated triage SLA.

site/404.html

@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Page not found | Agent Middleware API</title>
+    <meta name="description" content="That page does not exist on this site." />
+    <meta name="robots" content="noindex, follow" />
+    <meta name="theme-color" content="#ffffff" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <link rel="stylesheet" href="/fonts.css?v=@@FONTS_CSS_VERSION@@" />
+    <link rel="stylesheet" href="/styles.css?v=@@STYLES_CSS_VERSION@@" />
+    <script src="/a11y-preload.js?v=gateway-19"></script>
+    @@VERCEL_ANALYTICS_SCRIPTS@@
+    <script defer src="/analytics.js?v=gateway-19"></script>
+    <script defer src="/utm-capture.js?v=utm-1"></script>
+    <script defer src="/a11y.js?v=gateway-19"></script>
+  </head>
+  <body class="site-light">
+    <a class="skip-link" href="#main">Skip to content</a>
+    @@SITE_NAV@@
+
+    <main id="main">
+      <section class="section" aria-labelledby="notfound-title">
+        <p class="section-kicker">404 / Not found</p>
+        <h1 id="notfound-title">That page is not here.</h1>
+        <p>
+          The URL you asked for does not exist on this site. Nothing was
+          denied and nothing failed.
+        </p>
+        <div class="machine-links">
+          <a href="/"><span>Overview</span><code>/</code></a>
+          <a href="/proof/"
+            ><span>Receipt proof and offline verifier</span><code>/proof/</code></a
+          >
+          <a href="/#quickstart"
+            ><span>Quickstart</span><code>/#quickstart</code></a
+          >
+          <a href="/llms.txt"
+            ><span>Agent instructions</span><code>/llms.txt</code></a
+          >
+        </div>
+      </section>
+    </main>
+
+    @@SITE_FOOTER@@
+  </body>
+</html>