Changelog

Added per-field provenance (field_provenance) to all seven sample records and to the JSON Schema — auth_model, scoped_tokens, sandbox_url, openapi_spec, rate_limit and api_available now each carry their own source_url, verification_status, last_checked and note, all citing primary registrar documentation. No capability values changed. Two facts were re-verified live on 2026-06-28: Porkbun's v3 API (its public pricing endpoint returned SUCCESS on an unauthenticated request, marking api_available independently_tested) and GoDaddy's production-access tiers (the Get Started page states the Availability API requires 50+ domains while the Management and DNS APIs require 1+ domain or a Domain Pro Plan — the rate_limit note was corrected to reflect this). This brings api_available provenance coverage to four of the agent-facing datasets (registrars, dns_capabilities, registrar_api_capabilities, plus rdap_metadata and security_contacts).

Expanded the sample from 3 to 7 registrars (added GoDaddy, Dynadot, Spaceship, Squarespace Domains) and published the first JSON Schema for the dataset (rdap-metadata.schema.json), wired into validate.mjs. Added per-field provenance (field_provenance) to every record. All seven RDAP base URLs were live-probed and aligned to the IANA registrar-ids registry — this also corrected porkbun (the previous rdap.porkbun.com returns 404; cart-before.porkbun.horse/rdap/ is the working IANA value) and brought the dataset into agreement with the registrars dataset rdap_base.

Expanded the sample from 3 to 7 registrars and published the first JSON Schema (security-contacts.schema.json), wired into validate.mjs. Added per-field provenance. The new registrars' abuse contacts were read from registry RDAP records (the ICANN RDDS abuse field) and are independently_tested where the sponsoring registrar IANA ID matched; Squarespace Domains' abuse contact is left unknown rather than guessed because its namesake domains are sponsored by another registrar. security.txt presence is verified where reachable and left unknown where the .well-known path is anti-bot blocked.

Expanded the dns_capabilities sample from 3 to 7 registrars so it covers the same set as the rest of the catalog (added GoDaddy, Dynadot, Spaceship and Squarespace Domains). Added a field_provenance object to the schema and every record: DNSSEC, CAA, API record management and record-type values now each carry their own source_url, verification_status, last_checked and note. Recorded the precise nuances rather than rounding them off — Dynadot's DNSSEC is partial because its own nameservers are not DNSSEC-configured, and Squarespace Domains has no public DNS-management API. Added a cross-dataset coverage check to scripts/validate.mjs so the sample registrar sets can no longer drift apart silently.

Published the first JSON Schema for this dataset (agent-capability-signals.schema.json) and wired it into CI validation — the signals are now schema-checked on every PR. Added per-field provenance (field_provenance) to all seven sample records: each signal carries its own source_url, verification_status, last_checked and a note on how it was checked. No signal values changed. Re-verified the standout signals against primary sources: Cloudflare scoped API tokens (permission groups + resource scopes) and account-level audit logs, Cloudflare's published OpenAPI schema, and GoDaddy's official read-only Domains MCP server (search + availability).

Added per-field provenance (field_provenance) to the registrar schema and sample records: each field carries its own source_url, verification_status, last_checked and a note on how it was checked. IANA-registry fields (iana_id, name, status) are public_sources; rdap_base is resolved from IANA and independently_tested via a live RDAP probe. Corrected rdap_base for every sample registrar against the IANA registry, filled in Spaceship's rdap_base (rdap.spaceship.com), and added scripts/verify-rdap.mjs to make the RDAP verification reproducible and to fail on drift from IANA.

Added 412 TLDs across 38 registrars; normalized promotional pricing flags into a dedicated field.

Re-checked 2,841 records against RDAP. Corrected 14 RDAP base URLs flagged in community PR #208.

New dataset published describing programmatic-access signals. No scoring or ranking is included.

Added rate_limit and sandbox_url fields to the schema. Backfilled for 612 records.

Added RFC 9116 security.txt presence detection across 2,610 records.