~150 million developers coordinate work on GitHub through a loop it perfected: Issue → claim → pull request → review → merge. Five findings below, hardest evidence first: every one re-checkable in a single command. Baseline credited first, because it's strong.
curl header/file GETs of standard public paths (llms.txt, robots.txt, sitemap.xml, /.well-known/*), a soft-404 control on a random path, and WebSearch/WebFetch of GitHub's own docs/blog for product facts. No authentication, no scanning, no endpoint enumeration. Captured 2026-07-14. GitHub served its normal status on every request. Not affiliated with or endorsed by GitHub.github.com and docs.github.com) that routes machines to structured docs APIs and to the GitHub MCP server. It publishes a real security.txt (HackerOne program, bounty.github.com). Its security headers are exemplary: strict-transport-security: max-age=31536000; includeSubdomains; preload, content-security-policy: default-src 'none', x-frame-options: deny, x-content-type-options: nosniff. This brief is not "GitHub is behind." It's "GitHub already built the loop and the proof primitive: here's where they don't yet reach."Agents that read GitHub can find the docs but not the one file that says "here's what I can do and how to transact"; adding it lets the Copilot, MCP, and Sponsors capabilities GitHub already runs actually get used by the agents looking for them.
Sponsors already moves real money to people, but only as a recurring tip; letting funds release when a specific result is proven adds the auditable "pay only when it's done" semantic that ecological and civic buyers need, same rail, new revenue lane.
Open → claim → prove → review → settle is exactly how GitHub already runs code; the hard part (trusting a signed, logged receipt over a promise) is already won, so extending it to watersheds and buildings is a short step, not a new bet.
The llms.txt front door is real and content-typed. The A2A agent-card.json (the file an agent reads to learn "who am I talking to, what can they do, how do I pay") is a true 404, confirmed against a soft-404 control (a random path 404s the same way, so this is a real 404, not a catch-all).
curl -sI https://github.com/.well-known/agent-card.jsonGitHub's own documentation describes the Copilot coding agent: it "can research a repository, create an implementation plan, and make code changes on a branch. You can review the diff, iterate, and create a pull request when you're ready." Issue in → autonomous work in an Actions sandbox → PR out → human review. That is structurally identical to EcoWealth's Ecological Work Protocol: place + problem → bounded packet → claim → proof → approval → settlement.
curl -s https://docs.github.com/llms.txt | grep -A1 "cloud agent"Artifact attestations (GA June 2024) bind an artifact's digest to a SLSA build-provenance predicate, signed with a short-lived Sigstore certificate and recorded in the Rekor transparency log: an independently verifiable receipt that "this artifact came from this build." EWP produces the same shape of receipt for physical work: a proof bundle (photo + GPS + signature) checked deterministically, then settled to a public chain.
curl -sI https://docs.github.com/en/actions/concepts/security/artifact-attestations · WebSearch "GitHub artifact attestations Sigstore Rekor GA"GitHub Sponsors is a live, at-scale payment rail: GitHub's own materials report 49,148 developers funded and $50M+ facilitated (reported public figures, cited, not fabricated). But Sponsors funds a person or project on a recurring/tip basis; it has no concept of "pay only when this specific outcome is proven." EWP's settlement is exactly that: funding is escrowed against a packet and released on approved proof: pay follows proof, never a promise.
github.com/sponsors · GitHub Blog "Announcing GitHub Sponsors" + 2026 Sponsors totals (reported).(a) github.com/ai.txt and github.com/sitemap.xml return 406 Not Acceptable rather than a clean 200/404: a content-negotiation quirk on two agent-relevant paths. (b) robots.txt deliberately disallows /copilot/ and /copilot/c/ (Copilot chat URLs), a sensible, intentional choice, noted for completeness, not as a flaw.
ai.txt is the kind of thing a 30-line diff fixes, and it's the sort of detail a machine-legibility pass would sweep up alongside the agent-card.curl -sI https://github.com/ai.txt0x76c17C…A14B, first settled packet workId 14), a 1,007-definition work library, 7,624 postings / $671,012 posted value at capture (live counter), agent-payable over x402 (work-packet $0.10 · work-proof-check $0.01). A Copilot coding agent that already ships a PR could, in the same session, fund and verify a Restore-ladder packet in the physical world, and get a receipt back that looks just like an attestation.Have any GitHub-hosted agent (a Copilot coding agent already has the shape) make a single x402 POST to vealth.net/.well-known/vealth/work-packet: $0.10, keyless, no account, no integration. It returns a bounded, proof-required ecological work packet as a real object; on approved proof it settles on Base. The deliverable is the on-chain proof receipt.
Or fund one Restore-ladder packet in GitHub's own community (a watershed or urban-canopy survey near the San Francisco HQ) for under $25. It ties directly to the open-source-sustainability ethos GitHub already funds through Sponsors, but produces a verified physical outcome instead of a recurring tip. Same rail, new semantic.
