docs: update project index and contracts for agentbom (agent-trust-infra successor)

docs/org-contract-map.md

@@ -4,7 +4,7 @@ Canonical ownership of all cross-repository schemas, protocols, and trust artifa
 Update this file when ownership changes. This is the authoritative reference —
 individual repo CLAUDE.md files should agree with this table.
 
-Last updated: 2026-07-27
+Last updated: 2026-07-30
 
 ## Single source of truth
 
@@ -34,9 +34,9 @@ but the schema JSON itself lives only in `wasmagent-protocol`.
 | `TaskSpec` (`task-spec`) | `wasmagent-protocol` | `compliance/v1` | `wasmagent-js` | `wasmagent-js`, `trace-pipeline` |
 | `ComplianceEvalRecord` (`compliance-eval-record`) | `wasmagent-protocol` | `compliance-eval-record/v1` | `wasmagent-js` | `wasmagent-js`, `trace-pipeline` |
 | Rollout wire format (`rollout-wire`) | `wasmagent-protocol` | `rollout-wire/v1` | `wasmagent-js` | `wasmagent-js`, `trace-pipeline` |
-| AgentBOM (`agentbom`) | `wasmagent-protocol` | `agentbom/v0.1` | `agent-trust-infra` | `agent-trust-infra`, `open-agent-audit` |
-| MCP Posture (`mcp-posture`) | `wasmagent-protocol` | `mcp-posture/v0.1` | `agent-trust-infra` | `agent-trust-infra`, `open-agent-audit` |
-| Trust Passport (`trust-passport`) | `wasmagent-protocol` | `trust-passport/v0.1` | `open-agent-audit` | `agent-trust-infra`, `open-agent-audit` |
+| AgentBOM (`agentbom`) | `wasmagent-protocol` | `agentbom/v0.1` | `agentbom` | `agentbom`, `open-agent-audit`, `wasmagent-js` |
+| MCP Posture (`mcp-posture`) | `wasmagent-protocol` | `mcp-posture/v0.1` | `agentbom` | `agentbom`, `wasmagent-js`, `open-agent-audit` |
+| Trust Passport (`trust-passport`) | `wasmagent-protocol` | `trust-passport/v0.1` | `open-agent-audit` | `agentbom`, `open-agent-audit` |
 
 ### Repo-local schemas (single consumer — intentionally NOT centralized)
 
@@ -77,5 +77,5 @@ If any of these gains a second org consumer, it must be promoted into
    propose it upstream in `wasmagent-protocol`.
 4. Any new cross-repo schema requires promotion into `wasmagent-protocol` and an entry in
    this table before the second consumer merges.
-5. `agent-trust-infra` `specs/trust-passport/` is **frozen** — consume the canonical
+5. `agent-trust-infra` was **archived 2026-07-29**; its successor is `agentbom`. Consume the canonical
    `trust-passport` schema from `@wasmagent/protocol` instead.

docs/project-index.json

@@ -3,10 +3,10 @@
   "org": "WasmAgent",
   "description": "Machine-readable source of truth for the WasmAgent project index. Lists every repository in the organization with its category, role, status, and visibility. Consumed by the org profile (profile/README.md project table) and the living roadmap (docs/roadmap.md) so the public project matrix is rendered from a single registry instead of maintained by hand, preventing omissions. Each repo also carries a `focus` field (see focus_legend) marking its place relative to the core spine and its long-term lifecycle.",
   "source_url": "https://github.com/WasmAgent/.github/blob/main/docs/project-index.json",
-  "last_reviewed": "2026-07-23",
+  "last_reviewed": "2026-07-30",
   "consumers": [
-    "profile/README.md \u2014 Projects table",
-    "docs/roadmap.md \u2014 project layers"
+    "profile/README.md — Projects table",
+    "docs/roadmap.md — project layers"
   ],
   "status_legend": {
     "shipped": "Public repository exists and is the source of truth for its layer.",
@@ -60,7 +60,7 @@
       "in_profile": true,
       "summary": "Embedded agent runtime v1.x: WASM kernels (QuickJS, Pyodide, Wasmtime, Remote), MCP gateway + attestation, AEP emitter, capability manifests; adapters for A2A, AG-UI, AI SDK, Claude Agent SDK.",
       "url": "https://github.com/WasmAgent/wasmagent-js",
-      "latest_version": "1.20.0",
+      "latest_version": "3.1.1",
       "focus": "core-spine"
     },
     {
@@ -74,14 +74,26 @@
       "summary": "Canonical JSON Schemas for the Agent Evidence Protocol (AEP) and the compliance contract family. Single source of truth consumed by wasmagent-js and trace-pipeline; published as @wasmagent/protocol (npm) and wasmagent-protocol (PyPI).",
       "url": "https://github.com/WasmAgent/wasmagent-protocol"
     },
+    {
+      "name": "agentbom",
+      "category": "trust-artifacts",
+      "role": "Trust artifacts & BOM tooling",
+      "status": "shipped",
+      "visibility": "public",
+      "in_profile": true,
+      "summary": "AgentBOM validator, compliance checker (SOC2/ISO27001/EU AI Act), MCP Posture diff engine, CLI tools, and framework adapters (AutoGen, LangChain, LlamaIndex). Migrated from agent-trust-infra (archived 2026-07-29). Packages: @wasmagent/agentbom-core, @wasmagent/agentbom-cli.",
+      "url": "https://github.com/WasmAgent/agentbom",
+      "latest_version": "0.3.2",
+      "focus": "core-spine"
+    },
     {
       "name": "bscode",
       "category": "workload",
       "role": "Workload",
       "status": "shipped",
       "visibility": "public",
       "in_profile": true,
-      "summary": "Coding-agent workload on Cloudflare Workers \u2014 AEP evidence export, deny capabilities, output taint labels, RolloutProvenance.",
+      "summary": "Coding-agent workload on Cloudflare Workers — AEP evidence export, deny capabilities, output taint labels, RolloutProvenance.",
       "url": "https://github.com/WasmAgent/bscode",
       "focus": "reference-workload"
     },
@@ -92,21 +104,10 @@
       "status": "shipped",
       "visibility": "public",
       "in_profile": true,
-      "summary": "evomerge on PyPI \u2014 eval_trust paired statistics, AgentTrustScore stable JSON schema, training-data admission gate, wasmagent-js v1.x schema compatible.",
+      "summary": "evomerge on PyPI — eval_trust paired statistics, AgentTrustScore stable JSON schema, training-data admission gate, wasmagent-js v1.x schema compatible.",
       "url": "https://github.com/WasmAgent/trace-pipeline",
       "focus": "adjacent"
     },
-    {
-      "name": "agent-trust-infra",
-      "category": "trust-artifacts",
-      "role": "Trust artifacts",
-      "status": "shipped",
-      "visibility": "public",
-      "in_profile": true,
-      "summary": "AgentBOM, MCP Posture, and Trust Passport spec, reference impl, and CLI; EU AI Act Annex IV compliance mapping in draft (covers 20/29 sub-items, deadline 2026-08-02).",
-      "url": "https://github.com/WasmAgent/agent-trust-infra",
-      "focus": "core-spine"
-    },
     {
       "name": "open-agent-audit",
       "category": "audit",
@@ -116,7 +117,7 @@
       "in_profile": true,
       "summary": "Enterprise audit product with AEP v0.3 adapter; deployed at trustavo.com. Packages: @openagentaudit/core, adapters, schema.",
       "url": "https://github.com/WasmAgent/open-agent-audit",
-      "latest_version": "0.2.4",
+      "latest_version": "0.6.0",
       "focus": "product"
     },
     {
@@ -126,7 +127,7 @@
       "status": "shipped",
       "visibility": "public",
       "in_profile": true,
-      "summary": "Dynamic, verifiable, adversarial evaluation \u2014 FAEP schema, submit-then-test adversarial testing, Public Immunity Pool; technical paper in preparation.",
+      "summary": "Dynamic, verifiable, adversarial evaluation — FAEP schema, submit-then-test adversarial testing, Public Immunity Pool; technical paper in preparation.",
       "url": "https://github.com/WasmAgent/fresharena",
       "focus": "research"
     },
@@ -170,7 +171,7 @@
       "status": "in_progress",
       "visibility": "public",
       "in_profile": true,
-      "summary": "Go-based symbolic verification backend for the WasmAgent ecosystem: cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT satisfiability proofs. HTTP service with OPA-style request/response envelope; language-agnostic \u2014 consumed by wasmagent-js and future wasmagent-py via a thin adapter.",
+      "summary": "Go-based symbolic verification backend for the WasmAgent ecosystem: cel-go lightweight rules, wazero Wasm sandbox hard-isolation, Z3 SMT satisfiability proofs. HTTP service with OPA-style request/response envelope; language-agnostic — consumed by wasmagent-js and future wasmagent-py via a thin adapter.",
       "url": "https://github.com/WasmAgent/symkernel",
       "focus": "core-spine"
     },
@@ -181,7 +182,7 @@
       "status": "in_progress",
       "visibility": "public",
       "in_profile": true,
-      "summary": "Proxy-Wasm Rust module for Envoy, Istio, Kong, and Consul: intercepts Agent/MCP/A2A HTTP traffic, applies validation\u2192delta\u2192full recording policy, emits PROV-DM AEP records signed with Ed25519 (DSSE). Joins with wasmagent-js mcp-firewall via shared trace_id for full causal coverage from gateway to tool call.",
+      "summary": "Proxy-Wasm Rust module for Envoy, Istio, Kong, and Consul: intercepts Agent/MCP/A2A HTTP traffic, applies validation→delta→full recording policy, emits PROV-DM AEP records signed with Ed25519 (DSSE). Joins with wasmagent-js mcp-firewall via shared trace_id for full causal coverage from gateway to tool call.",
       "url": "https://github.com/WasmAgent/wasmagent-proxy",
       "focus": "adjacent"
     },
@@ -203,7 +204,7 @@
       "status": "planned",
       "visibility": "public",
       "in_profile": false,
-      "summary": "Planned Python agent runtime \u2014 sibling to wasmagent-js. Will share AEP schema, Criterion/ConstraintIR protocol, and symkernel HTTP adapter so Python agents receive the same evidence recording, MCP policy enforcement, and symbolic verification as the JS runtime.",
+      "summary": "Planned Python agent runtime — sibling to wasmagent-js. Will share AEP schema, Criterion/ConstraintIR protocol, and symkernel HTTP adapter so Python agents receive the same evidence recording, MCP policy enforcement, and symbolic verification as the JS runtime.",
       "url": "https://github.com/WasmAgent/wasmagent-py",
       "focus": "planned-core"
     }

docs/repository-boundaries.md

@@ -15,7 +15,7 @@ For per-repo maturity see `docs/maturity-matrix.md`.
 | **Tier 0** — Governance | `.github` | Org portal, Golden Path, ledgers, governance docs |
 | **Tier 1** — Core product | `wasmagent-js`, `open-agent-audit`, `trace-pipeline` | Runtime, audit, admission |
 | **Tier 2** — Reference workload | `bscode` | Real coding workload, Golden Path fixture producer |
-| **Tier 3** — Specification incubator | `agent-trust-infra` | AgentBOM, MCP Posture specs |
+| **Tier 3** — Trust BOM tooling | `agentbom` | AgentBOM validator, compliance checker, MCP Posture, CLI |
 | **Tier 4** — Research | `fresharena` | Dynamic evaluation protocol |
 | **Infrastructure** | `wasmagent-proxy`, `symkernel`, `wasmagent-train-replay` | Gateway evidence, verification, training audit |
 
@@ -29,7 +29,7 @@ The org is organized as a tree (Core → Official tooling → Evidence surfaces
 → Research → Product/Apps), captured by the `focus` field:
 
 - **⭐ Core** — `wasmagent-js`, `wasmagent-protocol`, `symkernel`,
-  `agent-trust-infra`, and planned `wasmagent-py`. Runtime, protocol,
+  `agentbom`, and planned `wasmagent-py`. Runtime, protocol,
   verification, trust. Sustained investment; these define the org's identity.
 - **🛠 Official tooling** — CLI, devtools, examples. Planned; reserved in the
   tree, no public repos yet.