diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..79fed98
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+bin/
+dist/
+tmp/
diff --git a/Makefile b/Makefile
index 24111fb..fecca82 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,8 @@ test:
 validate: build
 	python3 tools/validate_carry_refs.py
 	bin/$(BIN) carry validate --refs examples
+	bin/$(BIN) validate --refs examples
+	bin/$(BIN) list --refs examples
 	bin/$(BIN) doctor --refs examples
 	bin/$(BIN) self-test --refs examples
 	bin/$(BIN) emit-evidence --refs examples >/tmp/sourceos-ai-evidence.json
diff --git a/cmd/sourceos-ai/main.go b/cmd/sourceos-ai/main.go
index 8e1c93a..a429480 100644
--- a/cmd/sourceos-ai/main.go
+++ b/cmd/sourceos-ai/main.go
@@ -85,6 +85,8 @@ func usage() {
 Usage:
   sourceos-ai --version
   sourceos-ai doctor [--refs examples]
+  sourceos-ai list [--refs examples]
+  sourceos-ai validate [--refs examples]
   sourceos-ai self-test [--refs examples]
   sourceos-ai emit-evidence [--refs examples]
   sourceos-ai carry list [--refs examples]
@@ -109,6 +111,16 @@ func main() {
 	case "doctor":
 		refs := parseRefs(os.Args[2:])
 		runDoctor(refs)
+	case "list":
+		refs := parseRefs(os.Args[2:])
+		runList(refs)
+	case "validate":
+		refs := parseRefs(os.Args[2:])
+		results := validateDir(refs)
+		printJSON(results)
+		if hasFailures(results) {
+			os.Exit(1)
+		}
 	case "self-test":
 		refs := parseRefs(os.Args[2:])
 		runSelfTest(refs)
diff --git a/docs/SOURCEOS_AI_CLI.md b/docs/SOURCEOS_AI_CLI.md
index 2cd55c5..9bdcb11 100644
--- a/docs/SOURCEOS_AI_CLI.md
+++ b/docs/SOURCEOS_AI_CLI.md
@@ -9,6 +9,8 @@ It validates signed-reference-shaped service carry manifests, lists available go
 ```bash
 sourceos-ai --version
 sourceos-ai doctor --refs examples
+sourceos-ai list --refs examples
+sourceos-ai validate --refs examples
 sourceos-ai self-test --refs examples
 sourceos-ai emit-evidence --refs examples
 sourceos-ai carry list --refs examples
@@ -16,6 +18,8 @@ sourceos-ai carry validate --refs examples
 sourceos-ai carry doctor --refs examples
 ```
 
+The `list` and `validate` commands are top-level aliases that match the `carry list` and `carry validate` subcommands respectively, provided for ergonomic CLI use and Homebrew formula testing.
+
 ## Build and validation
 
 ```bash
diff --git a/repo.maturity.yaml b/repo.maturity.yaml
new file mode 100644
index 0000000..fef31a9
--- /dev/null
+++ b/repo.maturity.yaml
@@ -0,0 +1,64 @@
+schemaVersion: repo-maturity.v1
+repository: SourceOS-Linux/sourceos-model-carry
+plane: carry
+status: active
+canonicality: canonical
+owners:
+  - SourceOS-Linux
+maturity:
+  level: M2
+  targetLevel: M3
+  evidence:
+    - README.md defines purpose, carry-only doctrine, product boundary, and integration path.
+    - docs/SOURCEOS_AI_CLI.md documents the sourceos-ai CLI contract covering --version, doctor, list, validate, and emit-evidence.
+    - docs/ON_DEVICE_ARCHITECTURE.md defines the on-device architecture and carry boundary.
+    - examples/ contains signed-reference-shaped carry refs for all required surfaces (speech, OCR, image, video, translation, embedding).
+    - tools/validate_carry_refs.py validates carry-only invariants for all example refs.
+    - cmd/sourceos-ai/main.go implements the sourceos-ai CLI carrying only clients, launch profiles, cache policy, signed service references, and evidence collectors.
+    - Makefile provides make validate that proves all carry refs conform to the carry-only contract.
+    - .github/workflows/validate.yml enforces validation on every PR and push to main.
+validation:
+  commands:
+    - make validate
+  ciRequired: true
+  lastKnownStatus: passing
+carryBoundary:
+  sourceosRole: carry-only
+  sourceosRefuses:
+    - mutable model update authority
+    - model lifecycle state ownership
+    - service promotion from local workstation state
+    - ad-hoc artifact replacement
+    - unmanaged artifact downloads at boot
+    - agent-controlled model lifecycle changes
+    - system-plane mutation for model updates
+  sourceosCarries:
+    - service clients
+    - launch profiles
+    - signed service references
+    - local cache policy
+    - fallback references
+    - ReleaseSet and BootReleaseSet bindings
+    - evidence collectors
+    - workstation integration hints
+integrations:
+  - repository: SocioProphet/functional-model-surfaces
+    relationship: functional AI standards and maturity schema source
+    required: true
+  - repository: SocioProphet/prophet-platform
+    relationship: governed platform service runtime
+    required: true
+  - repository: SourceOS-Linux/sourceos-spec
+    relationship: normative OS object models
+    required: true
+  - repository: SourceOS-Linux/sourceos-shell
+    relationship: command palette, shell, and user workflow surface
+    required: false
+  - repository: SourceOS-Linux/sourceos-boot
+    relationship: ReleaseSet and BootReleaseSet integration
+    required: false
+nextActions:
+  - Graduate to M3 by adding schema fixtures and negative-case validation tests.
+  - Register this repo in workspace-inventory/sociosphere scorecard.
+  - Publish a Homebrew formula that installs sourceos-ai and runs sourceos-ai self-test.
+  - Add per-surface capability index to the evidence output.