A badge granted once and never re-checked becomes a sticker, so this re-verifies every conformant org.
On a schedule, never on request, the workflow re-verifies every organisation in the conformance registry against the files it publishes at its own domain — over https, with a timeout, a size cap, and redirects followed only within the same registrable domain.
That is what makes a badge revocable, and — the part that matters — makes the revocation visible: an organisation that stops publishing lapses in public with the date it was last confirmed, rather than quietly disappearing.
The registry is committed so a lapse shows up in a diff rather than only in a log nobody reads, the same reason the estate record and the adoption signal are committed.
That a listed organisation still publishes what its badge claims. Re-run the same check against any domain with `npx @flashyos/conformance <domain>`; an org that stopped serving its files lapses in the committed registry with a date, not silently.
An AI agent trust register is a neutral record, read by a party other than the transactor, of whether an organisation’s agents are authorised, revocable and audited — the difference between an agent that says it is accountable and one a stranger can confirm is.
AI agent trust register →