docs: update architecture for 2026-07 — agentbom, mcp-posture, archived repos

profile/README.md

@@ -43,10 +43,10 @@ platform's identity.
 
 | Repository | Role |
 | --- | --- |
-| [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | **Runtime** · Embedded agent runtime v1.x — WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; adapters for A2A, AG-UI, AI SDK, and Claude Agent SDK. This is where signed evidence is born. |
+| [wasmagent-js](https://github.com/WasmAgent/wasmagent-js) | **Runtime** · Embedded agent runtime v1.x — WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; `@wasmagent/mcp-posture` (migrated from `agent-trust-infra`), `@wasmagent/mcp-firewall`; adapters for A2A, AG-UI, AI SDK, and Claude Agent SDK. This is where signed evidence is born. |
 | [wasmagent-protocol](https://github.com/WasmAgent/wasmagent-protocol) | **Protocol** · Canonical AEP + compliance JSON Schemas — the single source of truth every repo agrees on. Published as `@wasmagent/protocol` (npm) and `wasmagent-protocol` (PyPI). |
 | [symkernel](https://github.com/WasmAgent/symkernel) | **Verification** 🚧 · Go symbolic verification backend — cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT proofs; HTTP service consumed by wasmagent-js and wasmagent-py. "Proving it ran correctly" is the mission itself. |
-| [agent-trust-infra](https://github.com/WasmAgent/agent-trust-infra) | **Trust tooling** · AgentBOM and MCP Posture validators, `@wasmagent/trust-cli` developer CLI, EU AI Act Annex IV compliance mapping (draft, deadline **2026-08-02**). Trust Passport spec → [wasmagent-protocol](https://github.com/WasmAgent/wasmagent-protocol). |
+| [agentbom](https://github.com/WasmAgent/agentbom) | **Trust & BOM tooling** · `@wasmagent/agentbom-core`, `@wasmagent/agentbom-cli` — Agent Bill of Materials, validator, compliance checker, CLI tools. Migrated from `agent-trust-infra` (now archived). Trust Passport spec → [wasmagent-protocol](https://github.com/WasmAgent/wasmagent-protocol). |
 
 > **`wasmagent-py`** *(planned)* joins Core as the Python runtime sibling — same
 > AEP schema, Criterion/ConstraintIR protocol, and symkernel adapter — so
@@ -142,12 +142,12 @@ GPU training jobs: it reads PyTorch Flight Recorder dumps, builds a cross-rank
 PROV-DM causal graph, and produces tamper-evident `EpochEvidenceBundle` records,
 enabling tensor-origin tracing and deterministic replay.
 
-`agent-trust-infra` produces trust artifacts — AgentBOM and MCP Posture — giving every
-agent run a machine-readable identity and policy posture. Trust Passport spec lives in
-`wasmagent-protocol`; the Trust Passport product (issuance, signing, revocation) lives in
-`open-agent-audit`.
-An EU AI Act Annex IV compliance mapping (Article 11 / Annex IV, effective 2026-08-02)
-is in draft, covering 20 of 29 Annex IV sub-items.
+`agentbom` (`@wasmagent/agentbom-core`, `@wasmagent/agentbom-cli`) produces trust
+artifacts — Agent Bill of Materials, validator, compliance checker — giving every agent run
+a machine-readable identity. `agent-trust-infra` is archived; `agentbom` is its successor.
+`@wasmagent/mcp-posture` (MCP Posture validator) is now part of `wasmagent-js` alongside
+`@wasmagent/mcp-firewall`. Trust Passport spec lives in `wasmagent-protocol`; the Trust
+Passport product lives in `open-agent-audit`.
 
 `open-agent-audit` turns the full evidence chain into enterprise-readable audit
 reports with AEP v0.2 adapter support — deployed at **[trustavo.com](https://trustavo.com)**.
@@ -176,7 +176,7 @@ sustained track record.
 - **Verification** — `symkernel`, cel-go rules, wazero sandbox, Z3 SMT integration (Go)
 - **Pipelines** — `trace-pipeline` / `evomerge` (measurement trust, admission, training audit)
 - **Training evidence** — `wasmagent-train-replay`, PyTorch Flight Recorder, PROV-DM, GPU training causal graphs
-- **Trust tooling** — `agent-trust-infra` (AgentBOM/MCP Posture validators + CLI); Trust Passport spec → `wasmagent-protocol`; Trust Passport product → `open-agent-audit`
+- **Trust tooling** — `agentbom` (`@wasmagent/agentbom-core`, `@wasmagent/agentbom-cli`; migrated from archived `agent-trust-infra`); `@wasmagent/mcp-posture` now in `wasmagent-js`; Trust Passport spec → `wasmagent-protocol`; Trust Passport product → `open-agent-audit`
 - **Audit product** — `open-agent-audit` / Trustavo (evidence reports, Cloudflare Workers)
 - **Evaluation** — `fresharena` (dynamic, verifiable, adversarial evaluation; paper preparation)
 - **Adapters** — OpenTelemetry GenAI, Langfuse, LangSmith ingestion