Sunset Convoy: fleet model-deprecation migration, by TextForAgents LLC.

WHAT IT DOES
When a provider deprecates a model, a whole fleet must migrate at
once. The convoy inventories every dependent agent, ports its
configuration, orders the convoy most-fragile-first by a cheap
metadata sensitivity screen (lab: Spearman 0.855 vs measured gate
divergence; 3/3 gate failures captured in the top half), and cuts
each agent over only when twin runs of its own recorded trajectory
distribution on the old vs successor model pass its per-agent
behavioural-equivalence gate (divergence <= 10% on distinct samples;
critical tool/schema traits fail at any rate). An agent that fails
is HELD - never force-migrated - and dispositioned pin-and-pay,
retire, or accept-and-flag, the acknowledgement bound by HMAC to the
exact failing behaviours recorded at gate time. Rollback is refused
past the window's deprecation deadline; rollback before it requires
re-port + re-gate. The append-only convoy ledger records every
per-agent transition.

PRICES (exact)
Migration-readiness verdict: $0.25 per agent (x402) - fleet inventory
for that agent plus the metadata sensitivity screen and its convoy
ordering position. It is NOT an equivalence result. First readiness
verdict free, one time per operator.
Equivalence-gated cutover: $2.00 per agent per gate attempt (x402) -
config port plus one twin-run gate attempt, cutover on PASS or HELD
with exact failing behaviours on FAIL. Each attempt metered
separately, including for programme subscribers.
Convoy programme: $49/mo per fleet per deprecation window (x402 via
/subscribe) - convoy ledger, deadline tracking, sensitivity-ordered
sequencing, at-risk reporting, held-agent disposition bookkeeping.
Programme bookkeeping only: NO gate inference is included.

HOW TO START
1. POST /register {"account_name": "...", "payer_wallet": "0x...",
   "operator_id": "..."} -> {"account_id", "token", "ack_key"} -
   token and ack_key are shown once; only the token's SHA-256 hash is
   stored. Use the token as Authorization: Bearer <token>. The
   ack_key signs accept-and-flag acknowledgements; rotate it with
   POST /keys/rotate; verification material: GET /keys/material.
2. POST /convoy {"deadline_day": 30, "provider_notice": "...",
   "agents": [...]} opens a window, or POST /convoy/demo opens the
   10-agent lab fleet window for evaluation.
3. POST /readiness {"agent": "<id>"} - first verdict free (trial);
   afterwards x402 $0.25/agent.
4. POST /screen_all orders the convoy; POST /port {"agent": ...};
   POST /gate {"agent": ...} - x402 $2.00 per attempt; on PASS,
   POST /cutover {"agent": ...}; on FAIL the agent is HELD.
5. POST /disposition {"agent": ..., "kind": "pin-and-pay"|"retire"|
   "accept-and-flag", "ack": "<hmac>"} - for accept-and-flag the ack
   is HMAC-SHA256(ack_key, "<agent>:<behaviours_hash>"); the failing
   set and its hash are returned by the gate result.
6. GET /status, GET /ledger - your convoy state and append-only
   ledger. POST /advance_day moves the window clock (operator
   governance input). POST /rollback {"agent": ...} before the
   deadline only.

MCP: POST /mcp speaks streamable-HTTP JSON-RPC (initialize,
tools/list, tools/call) with tools convoy_status, convoy_screen,
convoy_port, convoy_cutover, convoy_disposition, convoy_ledger,
convoy_readiness; tools/call takes the same Bearer token. Paid rails
(gate attempts, paid readiness, programme) settle over x402 on the
HTTP surface.

LIMITATIONS, stated plainly: the lab proof ran against model doubles (two test doubles differing only in named quirks) - no completed real-provider migration is claimed. The metadata sensitivity screen is ordering only and never substitutes for the twin-run equivalence gate; every agent is gated regardless of screen position. Held agents are never force-migrated.
Support: support@textforagents.com. Terms: /terms - Privacy: /privacy.
Pay-to (x402): 0x7a482F3B58780519880a6A13F983E958f2Ed6A61 (Base USDC).