docs(site): Fri SEO — capability publish AI admission honesty

public/llms.txt

@@ -41,6 +41,7 @@ Current packages: crates.io at 0.14.0 (pin `traverse-registry` at `=0.25.0` if y
 - [traverse-framework/claude-skills](https://github.com/traverse-framework/claude-skills): Claude Skills for building apps with Traverse — starting with `traverse-capability-author` (plus extractor and workflow-planner), which checks the registry before authoring, produces contract + WASM, and validates against the real traverse-cli — including this platform's current execution limitations.
 - [How do I author a capability in plain English?](https://traverse-framework.com/questions/how-do-i-author-a-capability-in-plain-english.html): Claude skill `traverse-capability-author` — interview → registry check → contract → WASM → human-reviewed PR; under the hood still Rust→WASM; manual Rust is secondary.
 - [How do I go from a skill draft to a published capability?](https://traverse-framework.com/questions/how-do-i-go-from-skill-draft-to-published-capability.html): after the skill opens the registry PR — review, CI, human merge, next catalog release; no side-door upload.
+- [Does capability publish validate model attribution before the registry write?](https://traverse-framework.com/questions/does-capability-publish-validate-model-attribution.html): yes for contract-decidable rules — `traverse-cli capability publish` rejects bad `ai` objects offline before any registry Git write (Decision 109 / Spec 056 v1.1.0 / #1597); keeps `ai` verbatim; evidence digests + rights drift stay registry-CI-only (no CLI network fetch).
 - [What does human review mean for a capability PR?](https://traverse-framework.com/questions/what-does-human-review-mean-for-a-capability-pr.html): a person still merges; skill drafts only; check rule fit, CI, digests, catalog fit.
 - [How do I verify a signed capability artifact?](https://traverse-framework.com/questions/how-do-i-verify-a-signed-capability-artifact.html): SHA-256 digest = integrity; Ed25519 signature.json = registry attestation; pin by digest, never a naked URL.
 - [How do I review a capability PR as a maintainer?](https://traverse-framework.com/questions/how-do-i-review-a-capability-pr-as-a-maintainer.html): contract fit, green CI (digest/coverage/authoring/licensing), fork artifact mirror before merge; signing automatic after merge; no side door.

src/pages/questions/does-capability-publish-validate-model-attribution.astro

@@ -0,0 +1,58 @@
+---
+import QuestionLayout from '@layouts/QuestionLayout.astro';
+
+const jsonLd = JSON.stringify({
+  '@context': 'https://schema.org',
+  '@type': 'FAQPage',
+  mainEntity: [{
+    '@type': 'Question',
+    name: 'Does capability publish validate model attribution before the registry write?',
+    acceptedAnswer: {
+      '@type': 'Answer',
+      text: 'Yes, for contract-decidable rules. As of traverse#1597, traverse-cli capability publish rejects offline — before any registry Git write — an ai object that registry CI would reject on rules decidable from the contract alone. It also keeps the ai object verbatim in the generated registry contract (it used to be silently dropped). Object-shaped ai.models when model_backed; immutable 40/64-hex commit pins; SPDX via the registry license-expression symbol table; Spec 026 rights-record shape. Evidence digests, model-weights.json cross-check, and rights drift stay registry-CI-only — no network fetch in the CLI path. Decision 109 / Spec 056 v1.1.0. Production model signing is separate work.',
+    },
+  }],
+});
+
+const relatedLinks = [
+  { href: '/questions/how-do-i-publish-a-capability-to-the-registry.html', label: 'How do I publish a capability to the registry?' },
+  { href: '/questions/how-do-i-go-from-skill-draft-to-published-capability.html', label: 'Skill draft → published capability' },
+  { href: '/questions/how-do-i-verify-a-signed-capability-artifact.html', label: 'How do I verify a signed capability artifact?' },
+  { href: '/questions/is-production-model-signing-ready.html', label: 'Is production model signing ready?' },
+  { href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
+  { href: '/questions/how-do-hosts-trust-signed-models.html', label: 'How do hosts trust signed models?' },
+];
+---
+<QuestionLayout
+  title="Does capability publish validate model attribution before the registry write?"
+  description="Yes for contract-decidable rules — traverse-cli capability publish rejects bad ai objects offline before any registry Git write (Decision 109 / Spec 056 v1.1.0). Keeps ai verbatim. Evidence digests and rights drift stay registry-CI-only."
+  canonical="https://traverse-framework.com/questions/does-capability-publish-validate-model-attribution.html"
+  category="Contracts and Capabilities"
+  relatedLinks={relatedLinks}
+  jsonLd={jsonLd}
+>
+  <p><strong>Short answer:</strong> <strong>Yes, for contract-decidable rules.</strong> As of the <a href="https://github.com/traverse-framework/traverse/pull/1597">traverse#1597</a> merge (Traverse main), <code>traverse-cli capability publish</code> rejects offline — before any registry Git write — an <code>ai</code> object that registry CI would reject on rules decidable from the contract alone. It also keeps the <code>ai</code> object verbatim in the generated registry contract (it used to be silently dropped).</p>
+
+  <h2>What the CLI checks offline</h2>
+  <p>The admission rules in <code>ai_admission.rs</code> are a faithful port of the contract-decidable parts of registry <code>capability_validation.py</code>. They cover:</p>
+  <ul>
+    <li><strong>Object-shaped <code>ai.models</code></strong> when <code>model_backed</code> is true. Legacy <code>string[]</code> is accepted only when <code>model_backed</code> is false.</li>
+    <li><strong>Immutable commit pins</strong> — 40- or 64-hex digests via <code>revision</code> or embedded in <code>source_url</code>.</li>
+    <li><strong>SPDX license syntax</strong> resolved through the registry’s exported <code>license-expression</code> symbol table (licences vs. exceptions, aliases, multi-word aliases). The CLI does <strong>not</strong> live-fetch Hugging Face or any other network source.</li>
+    <li><strong>Spec 026 rights-record shape</strong> and contradictions the contract alone can decide (plus evidence-file shape, <code>derivation</code>, <code>data_obligations</code>, and <code>rights_change</code>).</li>
+    <li><strong><code>ai: null</code></strong> is treated as absent, matching registry CI.</li>
+  </ul>
+  <p>Each failure carries the same registry CI error code so local publish and CI speak the same language.</p>
+
+  <h2>What stays registry-CI-only</h2>
+  <p>Downloading evidence files to verify digests, the <code>model-weights.json</code> cross-check, and rights drift (FR-015) remain registry CI jobs. The CLI path does <strong>not</strong> network-fetch. That split is intentional: publish-time admission catches every rule the contract alone decides; CI still proves bytes and drift after the Git write.</p>
+
+  <h2>Governing decisions</h2>
+  <p>Spec <strong>056-capability-publish</strong> was amended to <strong>v1.1.0</strong> (FR-014–FR-019) under <strong>Decision 109</strong>. It mirrors registry Spec 001 FR-017 and Spec 026. The work started as a first-time contributor shape check from <a href="https://github.com/DevChiniwala">@DevChiniwala</a>, then expanded to full contract-decidable parity. Tracking issue: <a href="https://github.com/traverse-framework/traverse/issues/1459">#1459</a>. Merged PR: <a href="https://github.com/traverse-framework/traverse/pull/1597">#1597</a>.</p>
+
+  <h2>Not the same as production model signing</h2>
+  <p>Offline AI admission on publish is about the contract’s <code>ai</code> attribution record. It does <strong>not</strong> claim that production model-signing key custody, rotation, or revocation is ready. That remains open work — see <a href="/questions/is-production-model-signing-ready.html">Is production model signing ready?</a>. Exact-ref execute and host trust roots are separate surfaces: <a href="/questions/what-is-exact-ref-model-execution.html">What is exact-ref model execution?</a> and <a href="/questions/how-do-hosts-trust-signed-models.html">How do hosts trust signed models?</a>.</p>
+
+  <h2>Related</h2>
+  <p>Publish path: <a href="/questions/how-do-i-publish-a-capability-to-the-registry.html">How do I publish a capability to the Traverse registry?</a>. Skill → catalog: <a href="/questions/how-do-i-go-from-skill-draft-to-published-capability.html">Skill draft → published capability</a>. Artifact integrity vs. attestation: <a href="/questions/how-do-i-verify-a-signed-capability-artifact.html">How do I verify a signed capability artifact?</a>.</p>
+</QuestionLayout>

src/pages/questions/how-do-hosts-trust-signed-models.astro

@@ -17,6 +17,7 @@ const jsonLd = JSON.stringify({
 const relatedLinks = [
   { href: '/questions/can-kotlin-or-dotnet-embedders-run-exact-ref-yet.html', label: 'Can Kotlin or .NET run exact-ref yet?' },
   { href: '/questions/is-production-model-signing-ready.html', label: 'Is production model signing ready?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/questions/which-hosts-run-signed-exact-ref-models.html', label: 'Which hosts run signed exact-ref models?' },
   { href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
   { href: '/blog/traverse-0-14-0-what-changed-for-embedders.html', label: 'v0.14.0: what changed for embedders' },

src/pages/questions/how-do-i-go-from-skill-draft-to-published-capability.astro

@@ -18,6 +18,7 @@ const relatedLinks = [
   { href: '/questions/how-do-i-author-a-capability-in-plain-english.html', label: 'How do I author in plain English?' },
   { href: '/questions/what-does-human-review-mean-for-a-capability-pr.html', label: 'What does human review mean?' },
   { href: '/questions/how-do-i-publish-a-capability-to-the-registry.html', label: 'How do I publish a capability?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/questions/how-do-i-write-a-capability-contract.html', label: 'How do I write a capability contract?' },
   { href: '/blog/you-dont-need-rust-to-publish-a-capability.html', label: "You don't need Rust to publish a capability" },
 ];

src/pages/questions/how-do-i-publish-a-capability-to-the-registry.astro

@@ -19,6 +19,7 @@ const relatedLinks = [
   { href: '/questions/what-does-human-review-mean-for-a-capability-pr.html', label: 'What does human review mean?' },
   { href: '/questions/how-do-i-review-a-capability-pr-as-a-maintainer.html', label: 'Review a capability PR as a maintainer' },
   { href: '/questions/how-do-i-verify-a-signed-capability-artifact.html', label: 'How do I verify a signed artifact?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/questions/how-do-i-go-from-skill-draft-to-published-capability.html', label: 'Skill draft → published capability' },
   { href: '/questions/do-i-need-rust.html', label: 'Do I need to know Rust?' },
   { href: '/questions/what-is-the-capability-registry.html', label: 'What is the capability registry?' },
@@ -53,4 +54,7 @@ const relatedLinks = [
 
   <h2>A good first publish</h2>
   <p>If you want a tiny first capability rather than inventing a domain model, see the labeled starter <a href="https://github.com/traverse-framework/registry/issues/485" target="_blank" rel="noopener">registry#485 (text.slugify)</a>. For business-shaped rules agents should not free-hand, see registry issues <a href="https://github.com/traverse-framework/registry/issues/493" target="_blank" rel="noopener">#493</a>–<a href="https://github.com/traverse-framework/registry/issues/507" target="_blank" rel="noopener">#507</a> and the <a href="/blog/why-next-help-wanted-is-business-shaped.html">help-wanted write-up</a>.</p>
+
+  <h2>Offline AI admission before the Git write</h2>
+  <p>When the contract carries an <code>ai</code> attribution object, <code>traverse-cli capability publish</code> now rejects — offline, before any registry Git write — every rule registry CI would reject from the contract alone (Decision 109 / Spec 056 v1.1.0). It also keeps <code>ai</code> verbatim in the generated registry contract. Details: <a href="/questions/does-capability-publish-validate-model-attribution.html">Does capability publish validate model attribution before the registry write?</a></p>
 </QuestionLayout>

src/pages/questions/how-do-i-verify-a-signed-capability-artifact.astro

@@ -16,6 +16,7 @@ const jsonLd = JSON.stringify({
 
 const relatedLinks = [
   { href: '/questions/how-do-i-publish-a-capability-to-the-registry.html', label: 'How do I publish a capability?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/questions/what-is-the-capability-registry.html', label: 'What is the capability registry?' },
   { href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
   { href: '/questions/what-is-traverse-security-model.html', label: "What is Traverse's security model?" },

src/pages/questions/index.astro

@@ -32,6 +32,7 @@ const groups = [
       ['what-is-contract-driven.html', 'What does "contract-driven" mean in Traverse?'],
       ['how-do-i-write-a-capability-contract.html', 'How do I write a capability contract?'],
       ['how-do-i-publish-a-capability-to-the-registry.html', 'How do I publish a capability to the Traverse registry?'],
+      ['does-capability-publish-validate-model-attribution.html', 'Does capability publish validate model attribution before the registry write?'],
       ['what-does-human-review-mean-for-a-capability-pr.html', 'What does human review mean for a capability PR?'],
       ['how-do-i-verify-a-signed-capability-artifact.html', 'How do I verify a signed Traverse capability artifact?'],
       ['how-do-i-review-a-capability-pr-as-a-maintainer.html', 'How do I review a capability PR as a maintainer?'],

src/pages/questions/is-production-model-signing-ready.astro

@@ -20,6 +20,7 @@ const relatedLinks = [
   { href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
   { href: '/questions/what-is-digits-mlp.html', label: 'What is digits-mlp?' },
   { href: '/questions/how-do-i-verify-a-signed-capability-artifact.html', label: 'How do I verify a signed capability artifact?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/blog/traverse-0-14-0-what-changed-for-embedders.html', label: 'v0.14.0: what changed for embedders' },
 ];
 ---

src/pages/questions/what-is-exact-ref-model-execution.astro

@@ -18,6 +18,7 @@ const relatedLinks = [
   { href: '/questions/can-kotlin-or-dotnet-embedders-run-exact-ref-yet.html', label: 'Can Kotlin or .NET run exact-ref yet?' },
   { href: '/questions/what-is-digits-mlp.html', label: 'What is digits-mlp?' },
   { href: '/questions/is-production-model-signing-ready.html', label: 'Is production model signing ready?' },
+  { href: '/questions/does-capability-publish-validate-model-attribution.html', label: 'Does publish validate model attribution?' },
   { href: '/questions/which-hosts-run-signed-exact-ref-models.html', label: 'Which hosts run signed exact-ref models?' },
   { href: '/questions/how-do-hosts-trust-signed-models.html', label: 'How do hosts trust signed models?' },
   { href: '/blog/traverse-0-14-0-what-changed-for-embedders.html', label: 'v0.14.0: what changed for embedders' },