oleg-bk · Oct 20, 2026 · Oct 20, 2026
diff --git a/LICENSING.md b/LICENSING.md
@@ -36,6 +36,13 @@ commercial risk scoring, billing, private customer integrations, and other
 AgentVeil commercial control-plane services are not included in the MIT SDK
 license unless explicitly stated in a separate written license.
 
+Public CLI code may include clients for pairing, hosted summary reporting and
+conditional provider delivery. That client code does not include the hosted
+service implementation or grant a workspace entitlement. A software license,
+Console access and an additional provider's availability are separate matters;
+see the [package scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional)
+and [plans and pricing](https://agentveil.dev/#pricing).
+
 ## Packaging Boundary
 
 The `agentveil` PyPI package is MIT licensed and must not ship the

diff --git a/README.md b/README.md
@@ -13,7 +13,7 @@
 
 **Stop risky AI agent actions. Not the work.**
 
-Independent AI agent security. For supported actions on configured routes, risky actions get a safe alternative or your approval before they run, so the task still gets done. Works with Cursor, Claude Code, Codex, Gemini CLI, Hermes CLI, and MCP tools.
+Independent AI agent security. On configured routes, AgentVeil checks supported actions and applies policy: allow, request approval, provide redirect guidance to a controlled path, or block. Safe alternatives require an available controlled path. Works with Cursor, Claude Code, Codex, Gemini CLI, Hermes CLI, and MCP tools.
 
 [Quick Start](#quick-start) · [Console](#start-from-the-console) · [The Loop](#the-agentveil-loop) · [Connectors](#connectors-available-today) · [Evidence](#bounded-evidence) · [Scope](#scope) · [Design Basis](#design-basis) · [Docs](docs/)
 
@@ -23,7 +23,7 @@ Independent AI agent security. For supported actions on configured routes, risky
 pip install agentveil-mcp-proxy
 ```
 
-**Packages**: [agentveil-mcp-proxy](https://pypi.org/project/agentveil-mcp-proxy/) · [agentveil](https://pypi.org/project/agentveil/) | **Website**: [agentveil.dev](https://agentveil.dev) | **Console**: [agentveil.dev/console](https://agentveil.dev/console/auth) | **Package source**: [`packages/agentveil-mcp-proxy/`](packages/agentveil-mcp-proxy/)
+**Packages**: [agentveil-mcp-proxy](https://pypi.org/project/agentveil-mcp-proxy/) · [agentveil](https://pypi.org/project/agentveil/) | **Website**: [agentveil.dev](https://agentveil.dev) | **Console**: [agentveil.dev/console](https://agentveil.dev/console/auth) | **Plans**: [agentveil.dev/#pricing](https://agentveil.dev/#pricing) | **Package source**: [`packages/agentveil-mcp-proxy/`](packages/agentveil-mcp-proxy/)
 
 > **Agent action boundary:** AI runtimes execute agents. AgentVeil mediates
 > configured action paths around them. When a native or risky action hits the
@@ -55,7 +55,8 @@ AgentVeil is one product loop, not a pile of separate components:
 Approval fixes actions that need human review. Redirect tells the agent to
 retry through the controlled MCP route when one is available. Hard-block means
 approval will not help for that action. Local proof is available now through
-the CLI—not a future dashboard page.
+the CLI. Console summaries complement those local records; they do not replace
+local evidence export or offline verification.
 
 ## What AgentVeil Adds
 
@@ -85,7 +86,17 @@ When you run a connector's `setup` command, AgentVeil opens the Console in your
 browser so you can approve this machine. The Console then shows what your
 connected projects report: project connection status, decision summaries and
 approval summaries. Raw prompts, source code and file contents stay on your
-machine. Local protection works without the Console.
+machine in this connector-summary flow. This is not a blanket statement about
+content supplied to hosted SDK/API workflows; see [Data Handling](docs/DATA_HANDLING.md).
+Local connector and proxy control do not require Console pairing; backend-backed
+SDK and Runtime Gate workflows have their own service requirements.
+
+Successful connector setup and explicit status checks can also attempt browser
+pairing and, for an eligible Console workspace, download and install an additional
+local provider package. Availability depends on the workspace capability and
+provider checks; installing the public proxy alone does not grant that capability.
+See [the package's Console scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional)
+for the distinction between pairing, reporting, and provider installation.
 
 If the browser did not open (for example on a headless machine) or you closed
 it, connect later:
@@ -194,7 +205,8 @@ In this profile:
 
 ### Core MCP Proxy path
 
-For lower-level MCP routing without an IDE connector:
+For lower-level MCP routing without an IDE connector (an alternative to the
+connector setup above, not an additional required step after connector setup):
 
 ```bash
 pip install agentveil-mcp-proxy
@@ -204,6 +216,8 @@ agentveil-mcp-proxy run
 ```
 
 This starts the core route: MCP tool calls explicitly pointed at `agentveil-mcp-proxy`.
+For manual identity registration, backend readiness and signer-pinned offline
+verification, follow the [Core MCP Proxy quickstart](docs/MCP_PROXY_QUICKSTART.md).
 
 ### Verify your setup works
 
@@ -248,6 +262,11 @@ runtime-agnostic for MCP clients that are explicitly configured to call it.
 | Hermes CLI profile | AgentVeil launcher + project-local Hermes MCP route | Routed MCP approval/evidence, sandbox boundaries, redirect guidance inside the AgentVeil route | Available |
 | Core MCP Proxy | MCP transport boundary | Routed MCP policy, approval, redirect / policy-stop outcomes, bounded evidence | Available |
 
+Here, **Available** identifies a shipped integration mechanism, not control of
+unlisted client modes or a guarantee that a project's connection is active. Required
+reloads, trust prompts, route configuration and observed hook evidence still
+apply. Check the connector instructions above and local setup status.
+
 The Python SDK also includes framework examples and optional helper modules for
 CrewAI, LangGraph, AutoGen, PydanticAI, OpenAI, Gemini, and AWS Bedrock. Those
 examples are not the same as a project connector: they show how agent workflows
@@ -270,6 +289,13 @@ Current connector checks have been run with:
 | Hermes CLI | live controlled MCP route path |
 | Python package metadata | Python 3.10-3.13 |
 
+Compatibility is scoped to the versions and client paths listed here. It does
+not establish support for other client modes or later releases. Python metadata
+states the declared interpreter range; runtime checks remain environment-specific.
+Where a row omits an exact version
+or check date, it is not a version-pinned compatibility guarantee. For project
+readiness, use the connector-specific instructions and local status.
+
 Other versions may work, but are not listed here until verified.
 
 ## What AgentVeil Controls
@@ -382,6 +408,14 @@ agentveil-mcp-proxy setup remove gemini-cli --yes
 
 ## Scope
 
+| Component | Availability and boundary |
+|---|---|
+| Public local packages | Project connectors, explicitly routed MCP calls and local evidence; Console pairing is optional. Backend-backed flows still need the configured backend. |
+| Hosted Console | Device pairing and bounded connection/decision/approval summaries; visibility depends on what the connected project reports. |
+| Additional local provider capabilities | Separate package, workspace eligibility and activation checks; they are not granted by installing the public proxy. See the [package scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). |
+| SDK primitives | APIs and examples for application-owned integrations, distinct from ready-to-use project connectors. |
+| Preview / design-partner flows | The limited-release patterns listed below; they are not general public connector coverage. |
+
 Available today:
 
 - MCP Proxy for routed MCP tool calls;
@@ -414,7 +448,9 @@ Not included in the public connector:
 - global Cursor / Claude / Codex / Gemini / Hermes lock;
 - automatic control of unrelated chats;
 - private enterprise policy packs;
-- hosted auth, licensing, telemetry, or enterprise custody logic.
+- hosted service implementations for auth, licensing, telemetry, or enterprise
+  custody. Public clients may still contain pairing, summary upload and provider
+  installation code; this exclusion concerns the hosted implementation.
 
 ## Example Risk Patterns
 
@@ -493,6 +529,12 @@ The root SDK is MIT-licensed.
 
 `agentveil-mcp-proxy` is a separately packaged source-available component under BUSL-1.1. See [Licensing](LICENSING.md) before using it in commercial or competing hosted services.
 
+**Hosted Console and plans.** Local connector and proxy control do not require
+Console pairing. Hosted services and additional capabilities have their own
+availability and terms; see [plans and pricing](https://agentveil.dev/#pricing).
+A software license describes rights to the package, not a hosted subscription
+or entitlement.
+
 ## Python SDK and advanced protocol primitives
 
 Advanced Python SDK package: `agentveil`.

diff --git a/README_PYPI.md b/README_PYPI.md
@@ -14,7 +14,15 @@ pip install agentveil-mcp-proxy
 
 ## Quick Start
 
-Route MCP tool calls through AgentVeil:
+For a project connector, start at the [Console](https://agentveil.dev/console/auth)
+and follow the command for your agent, or use the
+[connector instructions](https://github.com/agentveil-protocol/agentveil-sdk#start-from-the-console).
+Console pairing is optional for local connector/proxy control. Connector
+setup/status can also attempt browser pairing and, for eligible workspaces,
+install an additional provider; see the
+[package scope](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional).
+
+For manual routing of one downstream MCP server, use the Core MCP Proxy path:
 
 ```bash
 pip install agentveil-mcp-proxy
@@ -26,7 +34,12 @@ agentveil-mcp-proxy run
 MCP Proxy gates only tool calls routed through the proxy. It does not control
 host shell, IDE-native edits, direct git/pip commands, or other actions that
 bypass the proxy. Actions not routed through AgentVeil are not classified or
-logged.
+logged by that proxy. Project hooks add only their documented native-tool coverage.
+Backend-backed actions still require the configured service; see the
+[manual quickstart](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/docs/MCP_PROXY_QUICKSTART.md).
+
+Console summaries and direct hosted SDK/API calls have different data boundaries;
+see [Data Handling](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/docs/DATA_HANDLING.md).
 
 ## Python SDK and advanced protocol primitives
 
@@ -81,3 +94,5 @@ print("scope:", verification["scope"][0]["value"])
 The `agentveil` package is MIT licensed. The separate `agentveil-mcp-proxy`
 package is source-available under Business Source License 1.1. See the
 [licensing boundary](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/LICENSING.md).
+Hosted Console and additional capabilities have separate availability and terms;
+see [plans and pricing](https://agentveil.dev/#pricing).
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -3,9 +3,13 @@
 ## Source Of Truth
 
 - Current public Python SDK package: `agentveil 0.7.23`.
-- Current public MCP Proxy package: `agentveil-mcp-proxy 0.7.44`.
+- Current public MCP Proxy package: `agentveil-mcp-proxy 0.7.49`.
 - Package metadata and PyPI are the version source of truth. This roadmap tracks
   product direction only; release history belongs in `CHANGELOG.md`.
+- Versions above were checked against PyPI on 2026-10-20; consult package
+  metadata for later releases. Planned items have no promised dates.
+- A shipped command does not establish that a workspace has the optional
+  provider, entitlement or configuration. See [product scope](README.md#scope).
 
 ## Available Today
 
@@ -14,37 +18,29 @@
 - [x] Project connector setup for Cursor, Claude Code, Codex, and Gemini CLI
 - [x] Hermes CLI controlled MCP launch profile
 - [x] Core MCP Proxy route for configured downstream MCP tool calls
-- [x] W3C DID identity (`did:key`, Ed25519)
-- [x] AVP-Sig request signing for authenticated protocol calls
+- [x] Advanced SDK identity and request-signing primitives; see the
+  [SDK section](README.md#python-sdk-and-advanced-protocol-primitives)
 - [x] Posture/setup readiness checks with `integration_preflight()`
 - [x] Runtime Gate controlled-action flow with `controlled_action(...)`
 - [x] Local DelegationReceipt v1 issuance with `issue_delegation_receipt(...)`
 - [x] Signed runtime receipts and proof packet verification
 - [x] MCP Proxy evidence export and offline verification:
   `agentveil-mcp-proxy export-evidence` and `agentveil-mcp-proxy verify`
 
+- [x] Console sign-in and machine pairing with `agentveil-mcp-proxy login`
+- [x] Bounded project connection and decision/approval summary reporting
+- [x] Explicit filesystem CA policy preview/apply with `upgrade-ca-policy`;
+  execution still requires the configured controlled path and available provider
+
 ## Preview / Active Rollout
 
 - [ ] Broader controlled-action rollout for customer workflows
 - [ ] Operator-facing documentation for production adoption
-- [ ] Customer-facing DelegationReceipt issuance UX and examples
 - [ ] Deployment documentation for approved customer environments
-- [ ] Execution boundary and gateway adapter contract
 
 ## Planned
 
-- [ ] Public agent reputation dashboard
-- [ ] Expanded hosted MCP catalog metadata and recrawl
-- [ ] Formal protocol specification v1.0
 - [ ] Expanded Runtime Gate examples for common agent stacks
 - [ ] Dedicated root SDK CLI demo command: `agentveil demo controlled-action`
 - [ ] Dedicated root SDK proof commands:
   `agentveil proof export` and `agentveil proof verify --offline`
-- [ ] Posture Check report for risky tools, write access, credentials location,
-  and bypass paths
-
-## Research / Future
-
-- [ ] Runtime proof and offline verification publication
-- [ ] ERC-8004 bridge exploration
-- [ ] Federation between AVP nodes
diff --git a/docs/DATA_HANDLING.md b/docs/DATA_HANDLING.md
@@ -21,6 +21,25 @@ Lurkr, the separate pre-runtime scanner, is also local-only: it does not upload
 source code, scan reports, findings, or usage telemetry to AgentVeil and does
 not make network calls during scan.
 
+Console-connected setup/status is not a purely local inspection: it can attempt
+browser pairing and contact hosted services, and eligible workspaces can receive
+an additional local provider package. Those network/install paths are distinct
+from the local evidence store. See the
+[package Console scope](../packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional).
+
+The reporting channels have different content boundaries:
+
+| Channel | What crosses the boundary | When |
+|---|---|---|
+| Local evidence and offline verification | Local artifacts are read or written; offline verification does not upload the bundle. | Local inspection/export/verification commands. |
+| Routed Runtime Gate decisions | Privacy-filtered action metadata, resource/payload hashes and policy context. | A routed decision requires the configured backend. |
+| Console reporting | Bounded project connection and decision/approval summaries, including local provider status; not raw prompts, source code or file contents in this summary flow. | Accepted pairing credential plus the relevant connection or action-reporting path. |
+| Console pairing and provider delivery | Pairing/credential requests, eligibility requests and provider package download. | Setup/status or explicit login as described in the package scope; installation is eligibility-dependent. |
+| Direct hosted SDK/API and support workflows | User-supplied content or execution parameters may be processed as workflow input. | The caller invokes that hosted content workflow; see Hosted Content Surfaces below. |
+
+Do not extend the privacy properties of one row to every AgentVeil API or to an
+unrelated downstream server's own data handling.
+
 ## Hosted AgentVeil Ledger
 
 Runtime Gate, receipts, approvals, delegation, reputation, governance, and audit

diff --git a/docs/MCP_PROXY_QUICKSTART.md b/docs/MCP_PROXY_QUICKSTART.md
@@ -1,12 +1,22 @@
 # MCP Proxy Quickstart
 
-This is the cold customer path for wrapping one downstream MCP server with the
-AgentVeil MCP Proxy and producing an evidence bundle that is verifiable offline
-in strict/proof-grade mode with an externally pinned signer DID. Every
-step describes behavior that is implemented and locally verifiable. Anything
-this quickstart does not cover yet is listed under
+This guide is the manual Core MCP Proxy path for wrapping one downstream MCP
+server and producing an evidence bundle for offline verification with an
+externally pinned signer DID. It is intended for operators configuring a
+specific downstream, identity and backend. For ordinary project connector setup,
+start with the [Console and connector instructions](../README.md#start-from-the-console);
+do not repeat this manual sequence on top of an existing connector setup unless
+that is the intended configuration.
+
+Follow the steps in order for a new manual route. Completing an individual step
+does not establish the end-to-end result. The evidence limits are listed under
 [What this quickstart does NOT prove](#what-this-quickstart-does-not-prove).
 
+Console pairing is distinct from `register`: pairing connects the machine to
+Console reporting, while `register` registers the proxy identity with its configured
+backend. Console-integrated connector setup/status can also attempt an eligible
+provider installation; see the [package scope](../packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional).
+
 For day-2 operations, headless mode, multi-IDE deployment, evidence vacuum, and
 identity migration, see [`MCP_PROXY_OPERATIONS.md`](MCP_PROXY_OPERATIONS.md).