An evidence-first read of Walmart's public surface: what it does exceptionally well, and the two structural seats still open: an agent front door any AI (not just Sparky) can read, and a per-place proof layer under the "regenerative company" pledge. Every finding is reproducible by anyone repeating the exact command.
Walmart is ahead of most of retail on exactly the things this brief is about. Before a single finding, the record:
/.well-known/security.txt (HTTP 200, responsible-disclosure contact) and enforced email auth (DMARC p=reject).llms.txt returns a true 404, confirmed against a control path (not a soft-200).A company that already built its own agent and hit a gigaton early is the right first buyer for the two pieces that make both legible and provable to the open web.
No jargon: here is what each fix below is worth to Walmart in plain terms.
When someone's assistant builds a cart it reads the retailers it can; a readable Walmart surface keeps those ready-to-buy baskets from quietly going elsewhere.
Today the pledge is one big self-reported number; a per-store receipt turns it into trust that survives a regulator's or a customer's scrutiny.
A single token extends the security Walmart already sets to all its subdomains, small, but exactly the kind of completeness an audit looks for.
Sparky reads Walmart's catalog from the inside. But the open agent surface every other AI needs, an llms.txt, an agent card, is absent, and the "regenerative company" outcomes exist only as aggregate, self-reported numbers, not as per-place verifiable receipts. Why it matters: the future Walmart is betting on (agents that plan, compare, and buy) runs on machine-readable surfaces; and a 50-million-acre restore pledge earns trust one provable place at a time, not one PDF at a time. Walmart already owns the hardest input: ~4,600 U.S. stores, with ~90% of Americans living within 10 miles of one (company-reported). Every store is a place a restore packet can prove. The reproducible proof (findings 2–3):
Every open-web agent front door is missing on Walmart: www.walmart.com/llms.txt and /ai.txt are 404, /.well-known/agent-card.json is 404, and the developer domain is no better (developer.walmart.com/llms.txt 404, agent-card 401). For reference, another major retailer (target.com) already serves a real llms.txt at HTTP 200 that documents its category, brand, and product-URL structure for agents, so the bar is proven achievable. Why it matters: when a shopper's agent goes to source a cookout at Walmart, it needs a surface it can actually read; without one, a ready-to-buy basket quietly slips away. The proof:
Project Gigaton's 1.19 Gt is a supplier-reported total; the 50M-acre / 1M-square-mile restore pledge and the corporate sustainability page carry zero structured data (0 ld+json in the served HTML). There is no per-project object that says "this acre, this store, this restoration, verified." Why it matters: aggregate self-reporting is exactly what regulators and rating bodies are moving away from; a per-place proof receipt is what survives scrutiny, and it's what turns a pledge into a portfolio of verifiable assets. The proof:
Walmart's hygiene is good: enforced DMARC (p=reject), a published security.txt, CSP with frame-ancestors + a report-uri, X-Frame-Options, a Permissions-Policy. The one note: the HSTS header on www.walmart.com is max-age=31536000 without includeSubDomains, a one-token addition that extends transport security to every subdomain (peer target.com already sets it). Not a vulnerability; a completeness nudge. The proof:
A restore opportunity at a specific store, a parking-lot bioswale, the creek behind the lot, a food-desert community garden, becomes a bounded work packet: scope, safety, funding path, proof requirements. It's claimed by an associate on a step-1-to-mastery ladder (Build / Grow & Cook / Restore) or by a local, closed with photo + GPS + signature proof, scored by a deterministic proof-checker, and settled to a permanent receipt on Base with its tCO2e retired. Each receipt appends to that store's verified regeneration record: the per-place proof the 50M-acre pledge is missing, and a legible asset an agent, a regulator, or a customer can read.
This maps onto Walmart without a rebrand: Gigaton proved the supply chain can decarbonize; store-restore packets prove the places regenerate. The restore lanes are live on our board today with reproducible counts (curl https://vealth.net/labor/stats): tree_planting 73, urban_canopy_survey 511, stormwater_maintenance_clearing 48, plus clean_waterway, build_rain_garden, native_planting, priced for agents at work-packet $0.10 + work-tco2e $0.005 over x402.
| Step | What happens | Who touches what |
|---|---|---|
| 1 | Walmart publishes concept llms.txt + agent-card (drafted in the Agent Kit), the open complement to Sparky | Walmart web team, static files on walmart.com |
| 2 | One store-community restore packet is authored + funded (community-giving or a single store's budget) | EcoWealth rail; no Walmart systems touched |
| 3 | The restore is proof-checked (photo+GPS+signature) and settled on Base with tCO2e; receipt appended to the store's regeneration record | EcoWealth's live contract; Walmart reads receipts |
| 4 | Regenerative commitments expressed as structured, verifiable per-place data an agent or rating body can read | Walmart publishes; EcoWealth supplies the schema |
| Claim | Source / re-verify | Observed |
|---|---|---|
walmart.com/llms.txt = true 404 (control also 404); ai.txt, agent-card 404; developer domain 404/401 | curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/llms.txt etc. | 2026-07-14 |
Reference: target.com/llms.txt = 200 (real agent map) | curl -s -o /dev/null -w '%{http_code}' https://www.target.com/llms.txt | 2026-07-14 |
Corporate sustainability page ld+json = 0 | curl -s https://corporate.walmart.com/purpose/sustainability | grep -c application/ld+json | 2026-07-14 |
DMARC p=reject; security.txt = 200; HSTS without includeSubDomains | dig +short TXT _dmarc.walmart.com · curl -sI https://www.walmart.com/ | grep -i strict-transport | 2026-07-14 |
| Project Gigaton delivered 6 yrs early (1.19 Gt, 5,900+ suppliers); regenerative pledge 2020 (50M acres / 1M sq mi by 2030, zero emissions 2040); Sparky launched June 2025 | corporate.walmart.com press + WebSearch (cited in evidence.json) | 2026-07-14 |
EWP live: 7,624 postings / $671,012; contract 0x76c17C…A14B; work-packet $0.10, work-tco2e $0.005 | curl -s https://vealth.net/labor/stats · BaseScan · /.well-known/x402 | 2026-07-14 |
work-packet call ($0.10) against our live endpoint and get back a real, bounded, place-based restore packet, no contract, no meeting: curl https://vealth.net/.well-known/x402.