Capability brief · Independent · Evidenced · Passive recon only

Target already opened the door. Here's the next commit.

An evidence-first read of Target's public surface, starting with genuine credit (it ships the agent front door its peers don't), then the two things that complete it: the Target Forward commitments made machine-readable, and a per-store proof layer. Every finding is reproducible by anyone repeating the exact command.

Independent concept. Not requested, reviewed, or endorsed by Target. Observations from public web pages + public DNS only, no authentication, no probing. Findings are framed as opportunity, not fault. Every EcoWealth capability described is live at capture and cited with a re-verify command.

Credit first: Target is ahead where it counts

Target has done the thing most retailers haven't even started. Before a single finding, the record:

A retailer that already ships an llms.txt is the easiest first buyer we've found: the work isn't a rebuild, it's the next commit on a file the team already maintains.

The bottom line, in plain English

No jargon: here is what each fix below is worth to Target in plain terms.

Add the act-and-verify layer to the door you already opened → the shopping agents that can read Target can also be handed a task

Today an AI can read Target's catalog but can't do or confirm anything against it; closing that gap keeps Target in the basket as assistants start transacting, not just browsing.

Make Target Forward's goals machine-verifiable → "evolving" reads very differently next to proven store restorations

Structured, checkable commitments turn a graded-in-prose pledge into trust a rating body or a guest can confirm, instead of a claim they have to take on faith.

Publish the one missing contact file → a found issue reaches Target by email, not by headline

A five-line static file gives a security researcher somewhere to report to, cheap protection for a brand this size.

Four findings, each with its receipt

Finding 1 · The through-line

Target shipped the door, and stopped at shopping. The two missing pieces are the whole opportunity.

The live llms.txt is a shopping catalog map. It contains zero references to Target Forward, sustainability, or climate, and its own section header calls the owned-brand list "Phase 1", Target itself frames this file as a work in progress. Meanwhile there is no agent card (404), so an agent can read what to buy but has nothing to do or verify. Why it matters: Target's two public commitments, "regenerative" and "inclusive", are exactly the things a proof-verified work layer makes legible and provable: restore work (regenerative) done by team members climbing a step-1-to-mastery ladder (inclusive). The head start is real; the finish is one file and one proof layer away. The reproducible proof:

$ curl -s https://www.target.com/llms.txt | grep -icE 'target forward|sustainab|climate|regenerat|ESG|carbon' 0 $ curl -s https://www.target.com/llms.txt | grep -E '^## ' ## Core Shopping Categories ## Services & Fulfillment ## Owned Brands (Phase 1) ## Optional $ curl -s -o /dev/null -w '%{http_code}' https://www.target.com/.well-known/agent-card.json 404
Finding 2 · Read vs. act

The map lists pages to read; it gives an agent nothing to do or verify.

The llms.txt is genuinely useful for discovery, but the action/verification layer is absent: no /.well-known/agent-card.json (404), no ai.txt (404), no payment or MCP tool schema, no verifiable-outcome endpoint. Why it matters: the next wave of retail agents don't just read, they transact and they cite proof. An agent that can read Target's catalog still can't be handed a task it can complete and settle against Target. The proof:

$ curl -s -o /dev/null -w '%{http_code}' https://www.target.com/.well-known/agent-card.json 404 $ curl -s -o /dev/null -w '%{http_code}' https://www.target.com/ai.txt 404 # llms.txt lists pages; no agent-card, no tool schema, no payment/verification surface # opportunity: add agent-card + x402/MCP tools -> agents can act and verify, not just browse
Finding 3 · Machine-verifiable commitments

Target Forward is real and honestly graded, but PDF/prose-bound, not machine-verifiable.

The Target Forward strategy page (HTTP 200) carries a single ld+json (structured data machines can read) block whose only @type is WebPage, site chrome, not the goals. The 2025 report grades goals in prose (achieved / progressing / evolving), and some 2025 packaging goals are now graded "evolving." Why it matters: honest grading is a credibility asset, and it's exactly the case where a per-place proof receipt rebuilds trust faster than a re-worded goal. "Evolving" reads very differently next to a ledger of verified store restorations. The proof:

$ curl -s .../strategy-target-forward | grep -c 'application/ld+json' 1 └─ @type present: WebPage (site chrome, not commitment data) # 2025 report grades goals achieved / progressing / evolving — prose, no structured, verifiable object # opportunity: express commitments as Dataset/Claim + back each with per-place proof receipts
Finding 4 · One small hygiene note

Strong posture, with a single easy add.

Target's hygiene is good: HSTS includeSubDomains, CSP, XFO, nosniff, DMARC p=reject. The one note: no /.well-known/security.txt (404), so there's no published channel for a security researcher, while peer walmart.com serves one (HTTP 200). A five-line static file. Not a vulnerability; a completeness nudge. The proof:

$ curl -s -o /dev/null -w '%{http_code}' https://www.target.com/.well-known/security.txt 404 $ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/.well-known/security.txt 200 $ curl -sI https://www.target.com/ | grep -i strict-transport max-age=31536000; includeSubDomains

The concept: complete the door with store-community restore packets

A restore opportunity at a specific store, a native planting strip, a community garden, the swale at the edge of the lot, becomes a bounded work packet: scope, safety, funding path, proof requirements. It's claimed by a team member on a step-1-to-mastery ladder (Build / Grow & Cook / Restore) or by a local, closed with photo + GPS + signature proof, scored by a deterministic proof-checker, and settled to a permanent receipt on Base with its tCO2e retired. Each receipt appends to that store's verified Target Forward record, the per-place proof a graded-in-prose goal is missing, and a legible asset an agent, a rating body, or a guest can read.

This maps onto Target Forward without a rebrand: "regenerative" is the restore work; "inclusive" is the step-1 ladder that lets any team member start today. The restore lanes are live on our board with reproducible counts (curl https://vealth.net/labor/stats): tree_planting 73, urban_canopy_survey 511, garden_bed_planting 64, plus clean_waterway, native_planting, priced for agents at work-packet $0.10 + work-tco2e $0.005 over x402. And the llms.txt extension is a static-file change Target's team already knows how to ship.

Integration path: the next commit, not a rebuild

StepWhat happensWho touches what
1Extend the llms.txt Target already ships (Phase 2 draft in the Agent Kit): add Target Forward + a verified-outcomes section + an agent-cardTarget web team, a file they already maintain
2One store-community restore packet is authored + funded (community-giving or a single store's budget)EcoWealth rail; no Target systems touched
3The restore is proof-checked (photo+GPS+signature) and settled on Base with tCO2e; receipt appended to the store's Target Forward recordEcoWealth's live contract; Target reads receipts
4Target Forward commitments expressed as structured, verifiable per-place data an agent or rating body can readTarget publishes; EcoWealth supplies the schema

Evidence log

ClaimSource / re-verifyObserved
target.com/llms.txt = 200 (real agent map); 0 Target Forward/sustainability matches; header says "Phase 1"curl -s https://www.target.com/llms.txt | grep -icE 'target forward|sustainab|climate'2026-07-14
No agent-card (404), no ai.txt (404), no security.txt (404)curl -s -o /dev/null -w '%{http_code}' https://www.target.com/.well-known/agent-card.json etc.2026-07-14
Target Forward strategy page ld+json = 1 (@type WebPage)curl -s .../strategy-target-forward | grep -c application/ld+json2026-07-14
DMARC p=reject; HSTS includeSubDomains; peer walmart.com serves security.txt (200)dig +short TXT _dmarc.target.com · curl -sI https://www.target.com/ | grep -i strict-transport2026-07-14
Target Forward launched 2021 ("regenerative and inclusive"); 2025 report grades goals achieved/progressing/evolving; 76% renewable electricity 2024; ~400,000 team memberscorporate.target.com + WebSearch (cited in evidence.json)2026-07-14
EWP live: 7,624 postings / $671,012; contract 0x76c17C…A14B; work-packet $0.10, work-tco2e $0.005curl -s https://vealth.net/labor/stats · BaseScan · /.well-known/x4022026-07-14

The ask: proof first, then one small step

See the proof before you decide anything. Any one of your agents can make a single keyless x402 work-packet call ($0.10) against our live endpoint and get back a real, bounded, place-based restore packet: a POST to vealth.net/.well-known/vealth/work-packet returns HTTP 402 with the standard schema; a runnable dry-run client is at vealth.net/recipes.html. No contract, no meeting.

Then the first funded step: fund one Target Forward store-community restore packet at a single store, a native-tree planting or a community-garden build, roughly $150–250 plus cents of settlement. For a company with ~400,000 team members and an enterprise sustainability strategy, that is a rounding error; what it buys is the one thing a graded-in-prose goal can't yet produce: a permanent on-chain receipt that this place was actually restored, with its tCO2e retired. The deliverable is that receipt, appended to the store's verified Target Forward record. Verified place, verified restored, verified funded, the next commit on a door you already opened.
Provisioned by EcoWealth · Digital Provisioning Protocol · provenance‑sealed