[madeinplutofabio]

Summary

• add a documentation-reviewed PIC Standard profile in Frameworks & Standards
• classify it as agent-enabling: PIC specifies a contract an agent submits before a high-impact tool call (intent, impact, provenance, claims, evidence) and a verifier that blocks the call when verification fails. It governs whether a proposed action may run, not how agents communicate, so agent-internet-protocol would overstate it.
• add the matching tool-submitters.json entry via npm run sync:tool-submitters

Disclosure

I am the maintainer of PIC Standard. Per the editorial standards, all evidence is first-party and every material claim is cited; limitations and unknowns are stated in their fields rather than omitted.

Qualification rationale

• Specification: RFC-0001 and spec-core.md define the Action Proposal and the verification checks, including fail-closed outcomes and tool binding before dispatch.
• Independent implementations: a Python reference verifier and a separate TypeScript verifier that passes the shared conformance vectors for the canonicalization, core and trust-sanitization modes.
• Agent-facing integrations: MCP tool guards (with live-argument binding as of v0.9.1), a LangGraph tool node, and an HTTP bridge with an OpenAPI contract.

Category: I used the existing agent-frameworks-standards category, since the standard defines agent-facing behavior and interfaces. Open PRs #63 and #103 propose new security and verification categories; if one of those lands, I'm happy to move this listing.

First-party evidence

Re-read on 2026-10-21:

• https://github.com/pic-standard/pic-standard
• https://github.com/pic-standard/pic-standard/blob/main/docs/RFC-0001-pic-standard.md
• https://github.com/pic-standard/pic-standard/blob/main/docs/spec-core.md
• https://github.com/pic-standard/pic-standard/releases/tag/v0.9.1
• https://github.com/pic-standard/pic-standard/blob/main/docs/mcp-integration.md
• https://github.com/pic-standard/pic-standard-ts
• https://pypi.org/project/pic-standard/
• https://github.com/pic-standard/pic-standard/blob/main/LICENSE

Verification

• npm run validate:content -- --require-submitters: passed for 17 categories, 67 tools, and 1 redirect/retirement
• npm test: 103/140 passed locally on Windows. The 36 failures are identical on clean upstream main (d5a6bbd) without this change; they come from Windows path separators in assertions (for example, expected tools/paperclip.md, got tools\paperclip.md). No failure references pic-standard.
• git diff --check: passed
• all listing URLs: HTTP 200
• duplicate sweep across current tools and open PRs: no existing PIC listing

Uncertainties and limits

• limitationsMd states that live-argument binding is in the MCP guard and HTTP bridge (not yet the LangGraph node), that HTTP bridge callers enforce the decision, and that the TypeScript verifier does not yet implement evidence mode.
• No third-party adoption figures are claimed.
• verificationLevel is set to documentation-reviewed; editors may change it.

[foo-bender]

Outcome: changes-requested

Policy assessment

@madeinplutofabio The complete initial diff supports agent-enabling / agent-frameworks-standards / protocol. PIC has a substantive schema, verifier and execution-boundary implementation: agents supply intent, provenance and evidence, while configured policy/trusted keys gate the proposed call. The Python MCP guard binds the exact tool and arguments. This is not a marketing-only specification or a claim that every integration has identical enforcement. The separate TypeScript repository is correctly identified as narrower; Apache-2.0, self-hosting, draft/core specification status and historical v0.9.1 conformance counts were checked against current Python 0.9.2 and TypeScript 0.1.0 metadata. No published or open-PR duplicate was found.

Please address both source/link issues:

• Replace websiteUrl https://madeinpluto.com/pic with its declared canonical product URL https://madeinpluto.com/pic/; the submitted non-slash URL returns HTTP 301, while the slash URL returns the actual PIC product page.
• Correct or replace the unverifiable PyPI evidence item below. A first-party metadata URL such as https://pypi.org/pypi/pic-standard/json is readable and supports the package facts, but must be submitted as its own exact claim-level item rather than silently substituted by a reviewer.

The complete policy/taxonomy/schema/frontmatter pass found no other material actionable issue. The contradiction pass covered the product site, RFC/core/evidence/MCP docs, source/README, licences, Python and TypeScript package/release channels. No integration, security benchmark or production deployment was exercised.

Evidence checked

• https://github.com/pic-standard/pic-standard — Exact URL HTTP 200: substantive Apache-2.0 Python implementation verifies action proposals and evidence before execution and publishes CLI, MCP and HTTP integrations.
• https://github.com/pic-standard/pic-standard/blob/main/docs/RFC-0001-pic-standard.md — Exact URL HTTP 200: RFC defines the PIC/1.0 action proposal, intent, impact, provenance, claims, evidence, verifier outcomes and language-independent conformance approach.
• https://github.com/pic-standard/pic-standard/blob/main/docs/spec-core.md — Exact URL HTTP 200: core specification defines implementation-independent schema/verifier acceptance, including trust and impact constraints rather than relying on prose assertions.
• https://github.com/pic-standard/pic-standard/releases/tag/v0.9.1 — Exact URL HTTP 200: explicitly historical v0.9.1 release documents 91 Python conformance vectors, 84 passing TypeScript vectors and the stated evidence/attestation and intent-binding work; current Python 0.9.2 is a separate later channel.
• https://github.com/pic-standard/pic-standard/blob/main/docs/mcp-integration.md — Exact URL HTTP 200: MCP guide documents synchronous/asynchronous guards, evidence checking and exact tool-name/argument binding; no broader integration parity is inferred.
• https://github.com/pic-standard/pic-standard-ts — Exact URL HTTP 200: separate Apache-2.0 TypeScript implementation has Ajv CLI/SDK, core conformance scope and explicit lack of Python MCP/Ed25519 feature parity.
• https://pypi.org/project/pic-standard/ — Exact URL returned an HTTP-200 Client Challenge page, including on a same-URL browser-user-agent retry, rather than the package metadata claimed. The separate PyPI JSON API corroborates Python >=3.10, installation extras and current version but cannot substitute for validation of this exact submitted URL.
• https://github.com/pic-standard/pic-standard/blob/main/LICENSE — Exact URL HTTP 200: repository LICENSE is Apache License 2.0, consistent with the source implementation and package metadata.

Evidence requiring correction or removal

• https://pypi.org/project/pic-standard/ — Exact URL returned an HTTP-200 Client Challenge page, including on a same-URL browser-user-agent retry, rather than the package metadata claimed. The separate PyPI JSON API corroborates Python >=3.10, installation extras and current version but cannot substitute for validation of this exact submitted URL.

Please correct or remove each evidence item above.

Checks run

Exact final head 438b475 merged without committing with current main d5a6bbd in an isolated temporary clone:

• npm run validate:content: passed (17 categories, 67 tools, 1 redirect/retirement).
• npm test: 139 passed, 0 failed, 1 skipped (companion website migration checkout unavailable).
• git diff --check: passed. Node 26.7.0; Bash 5.3.20.
  GitHub enrichment was successful at readback; no completed GitHub content-validation check was returned at inspection. No workflow approval, PR approval, merge or deployment was performed. SEO was not evaluated and no reviewer commit was made.

[madeinplutofabio]

Thanks for the thorough review. Both items are fixed in the latest commit:

• websiteUrl is now the canonical https://madeinpluto.com/pic/.
• The PyPI project-page item is replaced with the PyPI JSON API (https://pypi.org/pypi/pic-standard/json) as its own claim-level evidence item, accessed 2026-10-22.

One note for the record: the current published versions are pic-standard 0.9.1 on PyPI and @pic-standard/pic-standard-ts 0.9.1 on npm. There is no Python 0.9.2 or TypeScript 0.1.0 release yet, so the listing's 0.9.1 claims are current.

[foo-bender]

Outcome: meets-policy

Policy assessment

Incremental re-review: both requested link/source changes are resolved. websiteUrl is the canonical https://madeinpluto.com/pic/; the replacement PyPI JSON evidence now substantiates its own package claim. Settled taxonomy remains agent-enabling / agent-frameworks-standards / protocol. Correction to my previous version statements: current PyPI, npm, repository manifests and latest GitHub releases show Python and TypeScript 0.9.1, not Python 0.9.2 or TypeScript 0.1.0. The listing is correct. Cross-channel inspection preserves the important narrower TypeScript scope, policy/trusted-key prerequisites, LangGraph argument-binding limitation and caller-owned HTTP enforcement; no universal integration parity or production-security guarantee is inferred.

Product fit

• tools/pic-standard.md: pass-fit (owner-isolated stage preserved). The described protocol and local verifier operate directly in the agent tool-call execution path. Their core purpose is to govern agent actions, rather than provide secondary agent access to a human-first application.
• Intended user: Developers and operators building agent systems that need controls over high-impact tool calls.
• Core job: Verify an agent's proposed action against intent, trusted provenance, and supporting evidence before allowing a high-impact tool call to run.
• The fit-bound description and opening operating model are unchanged. No published or competing open-PR duplicate was found.

Evidence checked

• https://github.com/pic-standard/pic-standard — HTTP 200, claim validated. Real Python verifier/source documents CLI, MCP guards, LangGraph node and HTTP/OpenAPI bridge.
• https://github.com/pic-standard/pic-standard/blob/main/docs/RFC-0001-pic-standard.md — HTTP 200, claim validated. RFC defines intent, impact, provenance, claims and cryptographic evidence in the local-first fail-closed protocol.
• https://github.com/pic-standard/pic-standard/blob/main/docs/spec-core.md — HTTP 200, claim validated. Core specification defines verification/tool-binding checks and fail-closed outcomes.
• https://github.com/pic-standard/pic-standard/releases/tag/v0.9.1 — HTTP 200, claim validated. Historical v0.9.1 release documents MCP/HTTP argument binding, optional pre-execution hook and 84-to-91 corpus growth.
• https://github.com/pic-standard/pic-standard/blob/main/docs/mcp-integration.md — HTTP 200, claim validated. MCP guide documents verification before execution and live-argument binding.
• https://github.com/pic-standard/pic-standard-ts — HTTP 200, claim validated. Separate real TypeScript implementation supports shared canonicalization/core/trust-sanitization conformance, not Python evidence-mode parity.
• https://pypi.org/pypi/pic-standard/json — HTTP 200, claim validated. Exact PyPI JSON returns current 0.9.1, Python >=3.10 and langgraph/mcp/crypto extras, consistent with current channels.
• https://github.com/pic-standard/pic-standard/blob/main/LICENSE — HTTP 200, claim validated. Exact LICENSE is Apache-2.0.

All submitted evidence items were checked at their exact URLs without substituting redirected/canonical sources. The independent contradiction pass covered the official product site, docs, repository/README and implementation, release/package channels, and applicable pricing/licensing/linked first-party surfaces. Verification remains documentation-reviewed; no live agent integration, security benchmark or production execution was exercised.

Reviewer-owned SEO metadata

tools/pic-standard.md

• agentSummary: accepted. Final value: PIC Standard lets an agent submit an Action Proposal before a high-impact tool call: what it intends to do, how much is at stake, which inputs it relied on, and evidence such as SHA-256 hashes or Ed25519-signed approvals. A local verifier checks the proposal against the operator's policy and trusted keys, and the call is blocked if verification fails.
  RFC, core/MCP documentation and Python implementation support operator-owned policy, proposal fields, SHA-256/Ed25519 evidence and pre-dispatch gating for this workflow; profile limitations distinguish narrower integrations.
• seoTitle: accepted. Final value: PIC Standard: Verify AI Agent Tool Calls Before They Run
  Names PIC Standard and its supported pre-execution agent-tool-call verification, without implying output moderation or runtime sandboxing.
• seoDescription: accepted. Final value: Open, local-first protocol and verifier that checks an agent's intent, provenance and signed evidence before a tool call runs, and blocks calls that fail.
  Complements the title with local protocol/verifier, provenance and signed-evidence checks supported by Python evidence mode and the scoped MCP workflow.

Reviewer commit: 2d4ce7d
2d4ce7d
All three contributor suggestions were accepted as the complementary set. The existing description, body and all other non-editorial bytes were preserved exactly; the focused commit adds only reviewedBy and reviewedAt (2026-10-23). Both Git identities resolve to foo-bender, and the commit is the live PR head and a direct child of the submitted head.

Checks run

Final head 2d4ce7d merged without committing with current main 6fe956f in an isolated detached worktree:

• npm run validate:content: passed (17 categories, 67 tools, 1 redirect/retirement).
• npm test: 143 passed, 0 failed, 1 skipped (companion website migration checkout unavailable).
• git diff --check and staged-diff whitespace check: passed.
  Node 26.7.0; Bash 5.3.20. The initial test attempt exposed macOS Bash 3.2 lacking mapfile; the unchanged suite passed after selecting the installed Bash 5.3.20. No workflow/PR approval, merge or deployment was performed.

@bradvin This meets the directory policy and is ready for your inclusion decision.