The five files
Written to be executed, not read. Hand the first four to Claude, ChatGPT, Cursor, or your developer's agent, start with ai.md, and load the vertical pack that matches the business. Then run measure.md yourself.
| File | What it does |
|---|---|
| ai.md | The execution spec. Preconditions, then seven ordered tasks — entity graph, ai.txt and agents.md, a reasoned robots.txt audit, honest sitemap lastmod, IndexNow, entity consistency, page-structure retrofit — each with a definition of done. |
| verify.md | The self-check. Forty-odd checks the agent runs against the live site, ending in a dated report you keep. This is what turns advice into a deliverable. |
| measure.md | For you, not an agent. The by-hand protocol for finding out whether any of it changed what the engines actually say: the vantage rules, how to pick questions, what to record, eight ways to fool yourself, and the thirty-day re-run. |
| profile-law-firms.md | Law firms and solo attorneys: schema types, registries, question shapes, and the state-bar boundary. |
| profile-med-spas.md | Med spas and aesthetics: schema types, licence registries, question shapes, and the medical-board and FDA boundaries. |
How the free reference fits
These files give you general instructions and checks. Applying them to a business still requires accurate source facts, judgment about priorities and verification of the result. You can do that work yourself or hire help.
The paid AI toolkit is tailored to your approved business information and the issues we find. It is part of FIX and GROW; these public reference files remain free.
What it deliberately leaves out
llms.txt is not in the task list. Ahrefs studied 137,210 domains and found 28% publish one — and that 97% of those files received no requests at all in the month measured. We publish one on this site and treat it as hygiene rather than a lever. Add one if you like; it takes ten minutes. It is out of the ordered tasks because this spec will not ask an agent to spend effort on something the evidence says is not being fetched, and because a named deliverable that does nothing is how buyers get sold packages by the item.
The hard stops, and why they are in a technical spec
Both starting verticals are regulated, and an agent left to write freely produces exactly the sentences that draw complaints. So the refusals are written into the file rather than left to judgement.
An agent running this spec will not generate clinical outcome claims, efficacy claims, comparative superiority claims, or case results. It will not touch before-and-after images. It will not publish under a named person's byline without that person's written approval. It stops and escalates on any credential, price, or guarantee. And it will not write, draft, edit, or solicit a review, a testimonial, or a third-party endorsement — not on your site, not on a directory, not on a forum, not as a draft for you to post.
We don't write anonymous third-party endorsements for regulated practices. Some of the competition ships Reddit and Quora answer drafts as a named deliverable. When a state bar or a medical board holds our client responsible for every word published on their behalf, we would rather be the vendor that says no, in writing, on a public page.
The honest limit
This spec makes a business readable. Whether it gets recommended depends on things no retrofit controls: what else exists in the market, what third parties say, and which sources each engine happens to select this week.
Our corrected cross-date benchmark records 385 first-position opportunities, with observed hold rates from 14% to 52%. It does not establish a lifetime or a managed-versus-unmanaged effect. Repeated measurement is how you find out what held.
So run the file. The site becomes legible. Whether that legibility turned into a recommendation, and whether it held past the week you bought it, is a measurement question.
Version 1.0 of this spec stopped there, and stopping there was the thing we criticise the rest of the category for. Installation is not an outcome, and a readability audit that gets read as a visibility result is worse than no report at all. So measure.md now closes it: the vantage rules, the question list you write before you look, the four events to record, eight ways to fool yourself, and the thirty-day re-run that is the only part that tells you whether you have a position or a coincidence. It is free and gives you a way to record and compare your own observations.
Versioning
This is a live document about a moving target. Crawler names change, schema vocabulary evolves, engine behaviour shifts. Every version is dated and every change is listed, because the version history is itself the evidence that someone is still watching.
| Version | Date | Change |
|---|---|---|
| 1.4 | 7 November 2026 | Corrected research definitions and cross-date counts, removed the unsupported recommendation-lifetime claim, reconciled all five files and page version metadata. The execution tasks are unchanged. |
| 1.3 | 30 August 2026 | We showed v1.2 to two independent AI engines with the authorship hidden, and they reached the same verdict within minutes: it added "reporting discipline without evidence discipline", and an agent could satisfy all of it cosmetically while still producing a misleading report. They were right. Section R is rebuilt to govern what evidence must exist before a claim may be made, rather than how the report is formatted: a requirements register that separates a quotation from the interpretation drawn out of it, retained evidence records behind every observation, declared population and sampling scope so "n=3" cannot read as site-wide, an honest-aggregation rule so a roll-up cannot show PASS over a failed instance, and a status vocabulary that finally contains UNVERIFIED - which v1.2 depended on without defining, a contradiction both reviewers caught. Repetition is now scoped to checks whose behaviour can actually vary, and forbidden on checks with side effects: the old wording told an agent to re-fire a live IndexNow submission to raise its probe count. And the limit is stated rather than papered over - an agent verifying its own audit is a consistency check, not independent verification. |
| 1.2 | 30 August 2026 | We ran this spec against two of our own sites and then had the audit reviewed. It found four requirements the spec does not contain, written by us, in the register of the standard. So v1.2 hardens the auditor rather than the site. New verify.md group R blocks publication of a report that attributes an opinion to the spec, attaches an instruction to something it could not verify, hides a skipped check, or does not say who the auditor works for. The results section is now a mandatory per-check table with a probe count, because prose lets an audit omit silently and a table does not. Also: §3 and verify.md B2 contradicted each other on content type and B2 was right; §4's crawler table is dated and gains ten agents including Claude-SearchBot; §5 now prefers publish-event dating over hand-curated maps; and "the honest limit" moved to the front of ai.md. |
| 1.1 | 27 August 2026 | Added measure.md — the by-hand protocol for measuring whether the build changed what the engines say. v1.0 stopped at "readable", which was the same gap we criticise the category for. ai.md §10 and verify.md now hand off to it. |
| 1.0 | 27 August 2026 | First public release. ai.md, verify.md, and vertical packs for law firms and med spas. |