The Foundation Spec — Free, Agent-Executable AI Visibility Build

The four files

Written to be executed, not read. Hand the first four to Claude, ChatGPT, Cursor, or your developer's agent, start with ai.md, and load the vertical pack that matches the business. Then run measure.md yourself.

File	What it does
ai.md	The execution spec. Preconditions, then seven ordered tasks — entity graph, `ai.txt` and `agents.md`, a reasoned `robots.txt` audit, honest sitemap `lastmod`, IndexNow, entity consistency, page-structure retrofit — each with a definition of done.
verify.md	The self-check. Forty-odd checks the agent runs against the live site, ending in a dated report you keep. This is what turns advice into a deliverable.
measure.md	For you, not an agent. The by-hand protocol for finding out whether any of it changed what the engines actually say: the vantage rules, how to pick questions, what to record, eight ways to fool yourself, and the thirty-day re-run.
profile-law-firms.md	Law firms and solo attorneys: schema types, registries, question shapes, and the state-bar boundary.
profile-med-spas.md	Med spas and aesthetics: schema types, licence registries, question shapes, and the medical-board and FDA boundaries.

Why we published it

The honest reason first: the file was never the valuable part. A technical retrofit is a known quantity. Schema, crawler access, a sitemap that tells the truth, pages structured so a passage can be lifted — none of that is a secret, and charging five thousand dollars for it depends on the buyer not knowing that.

The second reason is a conflict we did not want to be in. If we sell you the build and then grade the build, we are marking our own homework. When the spec is public and free, grading against it is clean. You can check our work against the same file we handed you, and so can anyone else.

And it answers the question we previously had no good answer to. Couldn't I just do this myself? Yes. Here is the file. The part you cannot do yourself is knowing whether it worked.

Others publish playbooks too. Most are lead magnets pointing at a build. This one is the boundary of our product: everything on the near side is yours for free, and we are explicit about what sits on the far side.

What it deliberately leaves out

llms.txt is not in the task list. Ahrefs studied 137,210 domains and found 28% publish one — and that 97% of those files received no requests at all in the month measured. We publish one on this site and treat it as hygiene rather than a lever. Add one if you like; it takes ten minutes. It is out of the ordered tasks because this spec will not ask an agent to spend effort on something the evidence says is not being fetched, and because a named deliverable that does nothing is how buyers get sold packages by the item.

The hard stops, and why they are in a technical spec

Both starting verticals are regulated, and an agent left to write freely produces exactly the sentences that draw complaints. So the refusals are written into the file rather than left to judgement.

An agent running this spec will not generate clinical outcome claims, efficacy claims, comparative superiority claims, or case results. It will not touch before-and-after images. It will not publish under a named person's byline without that person's written approval. It stops and escalates on any credential, price, or guarantee. And it will not write, draft, edit, or solicit a review, a testimonial, or a third-party endorsement — not on your site, not on a directory, not on a forum, not as a draft for you to post.

We don't write anonymous third-party endorsements for regulated practices. Some of the competition ships Reddit and Quora answer drafts as a named deliverable. When a state bar or a medical board holds our client responsible for every word published on their behalf, we would rather be the vendor that says no, in writing, on a public page.

The honest limit

This spec makes a business readable. Whether it gets recommended depends on things no retrofit controls: what else exists in the market, what third parties say, and which sources each engine happens to select this week.

Two numbers we publish because they cut against selling you a build. In our own cross-panel measurement — 383 first-position transition pairs across six engines — an unmanaged #1 AI recommendation had an expected lifetime of roughly one to two days. And SISTRIX, across 82,619 prompts over 17 weeks, found ChatGPT replacing up to 74% of its cited sources every week.

So run the file. The site becomes legible. Whether that legibility turned into a recommendation, and whether it held past the week you bought it, is a measurement question.

Version 1.0 of this spec stopped there, and stopping there was the thing we criticise the rest of the category for. Installation is not an outcome, and a readability audit that gets read as a visibility result is worse than no report at all. So measure.md now closes it: the vantage rules, the question list you write before you look, the four events to record, eight ways to fool yourself, and the thirty-day re-run that is the only part that tells you whether you have a position or a coincidence. It is free, it is by hand, and running it will teach you more about your own position than most people learn from a five-thousand-dollar build.

Versioning

This is a live document about a moving target. Crawler names change, schema vocabulary evolves, engine behaviour shifts. Every version is dated and every change is listed, because the version history is itself the evidence that someone is still watching.

Version	Date	Change
1.1	27 August 2026	Added `measure.md` — the by-hand protocol for measuring whether the build changed what the engines say. v1.0 stopped at "readable", which was the same gap we criticise the category for. `ai.md` §10 and `verify.md` now hand off to it.
1.0	27 August 2026	First public release. `ai.md`, `verify.md`, and vertical packs for law firms and med spas.

Questions

Is it really free?

Yes, and free in the way that matters: no email, no form, no card, no licence-back. The four files are public URLs you can fetch, fork, and hand to any agent you like. We ask for nothing in return and we do not know you downloaded it.

Why would you publish the thing you could sell?

Because the file was never the valuable part, and pretending otherwise would have cost us more than the tier earned. A competitor sells a comparable one-time build for around five thousand dollars. Publishing the spec makes that deliverable a commodity and leaves us selling the part nobody can fork: repeated, logged, per-engine measurement of whether it actually worked. It also resolves a conflict we would otherwise be in — if we sell the build and then grade the build, we are marking our own homework.

Can I just run this myself and not hire anyone?

Yes, and measure.md now tells you how to check your own result too — the vantage rules, the question list, what to record, and the thirty-day re-run. Run all five files and you will know more about your own position than most people who paid five thousand dollars for a build. What we sell is doing it repeatedly, across six engines, logged, every month, and handing you the log so you can check us. Doing it once yourself is free and you should.

Will this get my business recommended by AI?

It makes your business readable, which is a precondition, not a cause. We will not tell you a technical retrofit produces a recommendation. Our own measurement — 383 first-position transition pairs across six engines — puts the expected lifetime of an unmanaged #1 AI recommendation at roughly one to two days, so even a recommendation you earn is not a thing you own. Anyone promising you otherwise is selling something they cannot deliver.

Why is llms.txt not in it?

Because the evidence says it is not being read. Ahrefs studied 137,210 domains and found 28% publish an llms.txt — and that 97% of those files received no requests at all in the month measured. We publish one on this site and treat it as hygiene rather than a lever. Add one if you like; it takes ten minutes. We left it out of the ordered tasks because a named deliverable that does nothing is how buyers get sold packages by the item.

Why is measure.md written for a person instead of an agent?

Because anything convenient enough to automate is measuring something your customers do not see. Scripting these questions means calling an API, and an API is a different product from the app — different model versions, different search behaviour, different citations. In our field study across four local verticals the bare OpenAI API recommended the same businesses as the consumer app only about 8% of the time. One in twelve. So measure.md asks for your afternoon instead of your API key, and that trade is the single most important thing in the file.

Will you write my reviews or post on forums for me?

No, and the spec makes an agent refuse to as well. We do not write anonymous third-party endorsements for regulated practices — not reviews, not testimonials, not Reddit answers under someone else’s name. Some of the competition ships exactly that. In a category where a state bar or a medical board holds our client responsible for every word published on their behalf, we would rather be the vendor that says no in writing.

Who maintains it?

We do, because it decays. Crawler names change, schema vocabulary moves, engine behaviour shifts. Every version is dated with a changelog, and the version history is itself the evidence that someone is still watching the terrain. If a future study shows llms.txt being fetched, that section changes and the number moves.

Give away the build. Sell the proof.