Align public repo with final Passpod architecture

ADOPTION.md

@@ -3,3 +3,17 @@
 Passpod TASK Core is a public draft standard proposal for Sensitive Action Control.
 
 Vocabulary: Sensitive Action Control, Trust Action Receipt, No receipt, no sensitive action, Passpod TASK Core.
+
+## Reader paths
+
+- Developer: inspect the schema, examples, OpenAPI reference, and validator to understand the public receipt model.
+- Security reviewer: review the demo-vs-production boundary, threat model, and public/private exclusions.
+- Pilot buyer: use the public repo to evaluate the standard, then request scoped Passpod Hub access through the Pilot Access Engine.
+- Standards/community reader: evaluate Sensitive Action Control, Trust Action Receipt semantics, and Passpod Protocol doctrine without relying on private product internals.
+
+## Boundary
+
+This repository proves the public standard and test layer. It does not expose
+the full Passpod Hub product, production issuer logic, scoped key generation,
+customer workflows, private commercial logic, Sentinel/Ops internals, or an
+exit roadmap.

COMMERCIAL_BOUNDARY.md

@@ -0,0 +1,38 @@
+# Commercial Boundary
+
+This repository is public proof for Passpod TASK Core.
+
+It helps developers and reviewers inspect the public standard/test layer:
+
+- Trust Action Receipt schema;
+- public demo receipts;
+- local validator;
+- public OpenAPI reference shape;
+- basic doctrine for Sensitive Action Control.
+
+## Product stack
+
+Passpod TASK Core -> Passpod Hub -> Control Packs -> Pilot Access -> paid pilot / Team / Enterprise.
+
+- Passpod TASK Core is the public standard/test layer in this repo.
+- Passpod Hub is the paid hosted product layer and is not included here.
+- Control Packs are AgentTrust and Remote Worker Trust.
+- Pilot Access Engine is the scoped access path for authorized hosted access.
+- DIDX is the company, legal, and registry anchor.
+
+## Not in this repo
+
+This repo does not expose:
+
+- production issuer logic;
+- production signing internals;
+- scoped key generation;
+- Passpod Hub internals;
+- customer workflows;
+- private commercial strategy;
+- Sentinel/Ops internals;
+- exit roadmap.
+
+Public demo receipts are not production-valid receipts. Production-valid
+receipts require authorized issuer access through Passpod Hub and the Pilot
+Access Engine.

LAUNCH_READINESS.md

@@ -9,18 +9,31 @@ Day-1 checks:
 - main branch is protected
 - v0.1.0 release exists
 - Pilot Access path is visible
+- public demo receipts are clearly not production-valid receipts
+- README links to SPEC, schema, OpenAPI, examples, validator, Pilot Access, and commercial boundary docs
 - no private customer data, production keys, scoped key internals, Passpod Hub backend logic, or buyer-specific workflows are exposed
 
 Public repo purpose:
+- prove the Passpod TASK Core public standard/test layer
 - understand Passpod TASK Core
 - inspect Trust Action Receipt schema
 - validate sanitized examples
+- inspect the public OpenAPI reference shape
 - discuss Sensitive Action Control as a public draft standard proposal
 
+Public repo non-purpose:
+- full Passpod Hub product workflow
+- production issuer logic
+- scoped key generation
+- customer workflows
+- private commercial strategy
+- Sentinel/Ops internals
+- exit roadmap
+
 Pilot Access purpose:
 - scoped pilot keys
 - signed pilot receipts
 - hosted verification
 - scenario mapping
 - security review material
-- commercial pilot/license path
+- paid pilot / Team / Enterprise evaluation path

PILOT_ACCESS.md

@@ -1,7 +1,16 @@
 # Pilot Access
 
-The public repo helps you understand and test Passpod TASK Core.
+The public repo helps you understand and validate Passpod TASK Core.
 
-Pilot Access helps you apply TASK to a real sensitive-action workflow.
+Upgrade path:
+
+1. Use the public schema, examples, OpenAPI reference, and validator to test the Trust Action Receipt model locally.
+2. Request pilot access for a real sensitive-action workflow.
+3. If accepted, use scoped Passpod Hub access through the Pilot Access Engine.
+
+Pilot Access is the path from public validation to authorized hosted access.
+It may support paid pilot, Team, or Enterprise evaluation, but this repo does
+not contain production issuer logic, scoped key generation, customer workflows,
+commercial strategy, or Passpod Hub internals.
 
 Contact: pilots@passpod.io

README.md

@@ -5,6 +5,8 @@
 **Sensitive actions should not execute silently.**
 
 Passpod TASK Core is a public draft standard proposal for **Sensitive Action Control**.
+It is the public standard/test layer of the Passpod ecosystem, not the full
+Passpod Hub product.
 
 Every decision returns a **Trust Action Receipt**.
 
@@ -13,6 +15,16 @@ Every decision returns a **Trust Action Receipt**.
 Public demo receipts in this repository are not production-valid receipts.
 Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine.
 
+## Stack position
+
+Passpod TASK Core -> Passpod Hub -> Control Packs -> Pilot Access -> paid pilot / Team / Enterprise.
+
+- Passpod TASK Core: public schema, examples, validator, and OpenAPI reference.
+- Passpod Hub: paid hosted product layer, not included in this repo.
+- Control Packs: AgentTrust and Remote Worker Trust.
+- Pilot Access Engine: scoped pilot access path for authorized hosted access.
+- DIDX: company, legal, and registry anchor for the ecosystem.
+
 ## Start here
 
 - [Specification](SPEC.md): public v0.1 TASK Core semantics and boundaries.
@@ -21,6 +33,7 @@ Production-valid receipts require authorized issuer access through Passpod Hub a
 - [Example receipts](examples/README.md): walkthrough for the demo receipts.
 - [Validator](validator/README.md): install and run local receipt validation.
 - [Pilot Access](PILOT_ACCESS.md): path for real workflow review and hosted pilot access.
+- [Commercial boundary](COMMERCIAL_BOUNDARY.md): what this public repo does and does not expose.
 
 ## Public test vs Pilot Access
 

SPEC.md

@@ -48,7 +48,7 @@ The public v0.1 schema requires these fields:
 
 The public schema also allows optional fields:
 
-- `module`: names a public module or example context, such as Remote Worker TrustPass or AgentTrust.
+- `module`: names a public module or example context, such as AgentTrust or Remote Worker Trust.
 - `signature`: allowed in public examples only as a demo marker.
 - `receipt_id`: allowed by the schema as a response or lookup identifier, but public examples must not claim production receipt IDs.
 - `policy_ref`: conceptually points to a policy or rule set used in a real workflow. Production workflow mapping belongs to Pilot Access.
@@ -104,6 +104,7 @@ signature verification, commercial authorization, or hosted receipt lookup.
 - Passpod Protocol: governance, doctrine, and receipt-backed control principles.
 - Passpod TASK Core: public schema, examples, validator, and OpenAPI reference in this repo.
 - Passpod Hub: hosted production layer; not included in this repo.
+- Control Packs: AgentTrust and Remote Worker Trust.
 - Pilot Access Engine: scoped pilot access path; not included in this repo.
 - DIDX: steward and company source of truth for the ecosystem.
 

docs/glossary.md

@@ -3,3 +3,19 @@
 Sensitive Action Control: checking and recording risky actions before execution.
 
 Trust Action Receipt: portable output of a TASK decision.
+
+Passpod TASK Core: public standard/test layer for schemas, examples, validation, and reference API shape.
+
+Passpod Protocol: governance and doctrine for receipt-backed control of sensitive actions.
+
+Passpod Hub: paid hosted product layer. Hub internals are not included in this public repo.
+
+Control Packs: focused product workflows powered by Passpod Hub. The canonical public Control Packs are AgentTrust and Remote Worker Trust.
+
+AgentTrust: Control Pack for agent and automated-action control scenarios.
+
+Remote Worker Trust: Control Pack for remote-work trust and work-reference scenarios.
+
+Pilot Access Engine: scoped pilot access path for authorized hosted access. Scoped key generation is not included in this public repo.
+
+DIDX: company, legal, and registry anchor for the Passpod ecosystem.

tools/check-public-task-repo.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 fail() { echo "❌ $1" >&2; exit 1; }
 
-required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json examples/README.md openapi/passpod-task.public.yaml openapi/README.md validator/README.md cli/README.md worker-reference/README.md docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py)
+required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md COMMERCIAL_BOUNDARY.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json examples/README.md openapi/passpod-task.public.yaml openapi/README.md validator/README.md cli/README.md worker-reference/README.md docs/glossary.md docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py)
 
 for f in "${required_files[@]}"; do
   [ -f "$f" ] || fail "Missing required file: $f"
@@ -21,7 +21,8 @@ for link in \
   "openapi/passpod-task.public.yaml" \
   "examples/README.md" \
   "validator/README.md" \
-  "PILOT_ACCESS.md"
+  "PILOT_ACCESS.md" \
+  "COMMERCIAL_BOUNDARY.md"
 do
   grep -q "$link" README.md || fail "README missing launch navigation link: $link"
 done
@@ -30,14 +31,38 @@ grep -q "Public demo receipts in this repository are not production-valid receip
   || fail "README must state that public demo receipts are not production-valid"
 grep -q "Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine" README.md \
   || fail "README must state the production-valid receipt access boundary"
+grep -q "Passpod TASK Core -> Passpod Hub -> Control Packs -> Pilot Access -> paid pilot / Team / Enterprise" README.md \
+  || fail "README missing canonical product stack"
+
+for term in \
+  "Passpod TASK Core" \
+  "Passpod Hub" \
+  "Control Packs" \
+  "AgentTrust" \
+  "Remote Worker Trust" \
+  "Pilot Access Engine" \
+  "Trust Action Receipt" \
+  "Sensitive Action Control" \
+  "DIDX"
+do
+  grep -R "$term" README.md SPEC.md docs/glossary.md PILOT_ACCESS.md ADOPTION.md LAUNCH_READINESS.md COMMERCIAL_BOUNDARY.md >/dev/null \
+    || fail "Canonical term missing from public docs: $term"
+done
+
+grep -R "Passpod Hub is the paid hosted product layer" README.md COMMERCIAL_BOUNDARY.md >/dev/null \
+  || fail "Public docs must distinguish TASK Core from Passpod Hub"
+grep -R "production issuer logic" README.md SPEC.md ADOPTION.md LAUNCH_READINESS.md COMMERCIAL_BOUNDARY.md cli/README.md worker-reference/README.md openapi/README.md >/dev/null \
+  || fail "Public docs must exclude production issuer logic"
+grep -R "Sentinel/Ops internals" ADOPTION.md LAUNCH_READINESS.md COMMERCIAL_BOUNDARY.md >/dev/null \
+  || fail "Public docs must exclude Sentinel/Ops internals"
 
 for readme in examples/README.md openapi/README.md validator/README.md cli/README.md worker-reference/README.md; do
   if grep -Eiq 'placeholder|skeleton placeholder|TODO|TBD|coming soon|lorem|fixme' "$readme"; then
     fail "Public directory README still contains placeholder-only language: $readme"
   fi
 done
 
-dangerous_patterns='SECRET=|PRIVATE_KEY=|BEGIN PRIVATE KEY|real customer receipt:|production signing key:|scoped key value|sk_live_|pk_live_|AKIA[0-9A-Z]{16}'
+dangerous_patterns='SECRET=|PRIVATE_KEY=|BEGIN PRIVATE KEY|real customer receipt:|production signing key:|scoped key value|sk_live_|pk_live_|AKIA[0-9A-Z]{16}|production-valid receipt issuance|production-valid issuance|full monetization workflow|exit roadmap:'
 if grep -R -E "$dangerous_patterns" . \
   --exclude-dir=.git \
   --exclude="check-public-task-repo.sh" \