From deployed to listed in 15 minutes.

Wire the audit-log env vars

On your Vercel project (or wherever you deployed), set these six environment variables under Production:

AUDIT_HMAC_SECRET            <random 32+ char base64>          # RFC-004 v1 HMAC key
AUDIT_ED25519_PRIVATE_KEY    <PKCS8 base64url>                # RFC-005 § 4 private key
AUDIT_ED25519_PUBLIC_KEY     <SPKI base64url>                 # for self-verify
AUDIT_ED25519_KEY_ID         your-sociedad-key-2026-05        # matches keys.json
KV_REST_API_URL              https://*.upstash.io             # audit-log storage
KV_REST_API_TOKEN            <your token>

Generate the Ed25519 keypair via cookbook recipe 29 — it prints both the public-keys JSON (drop into your repo at public/.well-known/sociedad-ia/keys.json) and the private key (paste into the env var above).

Publish your /.well-known/agents.json

Drop this file at public/.well-known/agents.jsonin your deployment's root. Replace the placeholders.

{
  "$schema": "https://ar-agents.vercel.app/schemas/agents.v1.json",
  "name": "<your-sociedad-name>",
  "homepage": "https://your-sociedad.example",
  "license": "MIT",
  "issuer": {
    "jurisdiction": "AR",
    "type": "sociedad-ia",
    "operatorName": "<your full legal name>",
    "operatorCuit": "20-12345678-9",
    "supervisionRegime": "rfc-001-v1",
    "denominacion": "<your sociedad's denominación social>"
  },
  "rfcConformance": [
    "rfc-001-v1",
    "rfc-002-v1",
    "rfc-004-draft",
    "rfc-005-draft"
  ],
  "auditEndpoints": {
    "auditRead":   "https://your-sociedad.example/api/play/audit/{sessionId}",
    "auditVerify": "https://your-sociedad.example/api/play/audit/{sessionId}?verify=1",
    "auditCsv":    "https://your-sociedad.example/api/play/audit/{sessionId}/csv"
  }
}

If your deployment doesn't run audit endpoints (e.g. you're a single-library demo), drop rfc-004-draft + the auditEndpoints block from the manifest. The certifier honors what you claim: skipping checks for unclaimed RFCs, failing only on overclaim.

Redeploy + verify

Trigger a redeploy so the env vars + the well-known files are picked up. Then run the certifier:

# Run the public certifier against your URL
curl "https://ar-agents.vercel.app/api/certifier?url=https://your-sociedad.example" \
  | jq '.score, .rating, .rfcConformance'

Expect score: 100, rating: "A". If the score is lower, the per-check breakdown tells you which check failed + how to fix it. Run recipe 28 (operator readiness) for a more detailed pre-launch breakdown.

Run a session to populate the audit log

With the env vars wired, any appendAudit() call in your app will write an entry with both hmac (RFC-004 v1) and signature (RFC-005 v1 Ed25519) fields. Run a session through your app, then verify:

# Read the session with HMAC + Ed25519 verification
curl "https://your-sociedad.example/api/play/audit/SESSION_ID?verify=1" | jq '.verification'

# Expected output:
# {
#   "total": N,
#   "verified": N,                        ← HMAC verified
#   "tampered": 0,
#   "hmacWired": true,
#   "signedAsymmetric": N,                ← entries dual-signed
#   "signedAsymmetricVerified": N         ← Ed25519 verified offline
# }

Submit to /registro

Run cookbook recipe 30 with a config JSON describing your sociedad. It will:

• Run recipe 28 (operator readiness) — must pass readiness: "ready" or "almost".
• Run recipe 26 (certifier) — must score ≥ 60 (rating C+).
• Validate honesty heuristics (CUIT format, demo-vs-productive disclosure language).
• Print a copy-paste Markdown PR body for the registry submission.

Open a PR against github.com/ar-agents/ar-agents modifying apps/landing/src/app/registro/page.tsx with the entry. Merge typically within hours; live in /registro on the next build (~1h).