Capability brief · Independent · Evidenced · Passive recon only

Walmart shipped the agent. The open door and the proof are still open.

An evidence-first read of Walmart's public surface: what it does exceptionally well, and the two structural seats still open: an agent front door any AI (not just Sparky) can read, and a per-place proof layer under the "regenerative company" pledge. Every finding is reproducible by anyone repeating the exact command.

Independent concept. Not requested, reviewed, or endorsed by Walmart. Observations from public web pages + public DNS only: no authentication, no probing. Findings are framed as opportunity, not fault. Every EcoWealth capability described is live at capture and cited with a re-verify command.

Credit first: this baseline is strong

Walmart is ahead of most of retail on exactly the things this brief is about. Before a single finding, the record:

A company that already built its own agent and hit a gigaton early is the right first buyer for the two pieces that make both legible and provable to the open web.

The bottom line, in plain English

No jargon: here is what each fix below is worth to Walmart in plain terms.

Open the agent front door → shoppers whose AI does the buying can still find Walmart

When someone's assistant builds a cart it reads the retailers it can; a readable Walmart surface keeps those ready-to-buy baskets from quietly going elsewhere.

A verifiable receipt per store → the 50-million-acre restore pledge becomes provable one place at a time

Today the pledge is one big self-reported number; a per-store receipt turns it into trust that survives a regulator's or a customer's scrutiny.

One-line transport-security add → complete protection across every walmart.com subdomain, at no cost

A single token extends the security Walmart already sets to all its subdomains, small, but exactly the kind of completeness an audit looks for.

Four findings, each with its receipt

Finding 1 · The through-line

Walmart taught its own agent to shop, but shipped no open door, and no per-place proof.

Sparky reads Walmart's catalog from the inside. But the open agent surface every other AI needs, an llms.txt, an agent card, is absent, and the "regenerative company" outcomes exist only as aggregate, self-reported numbers, not as per-place verifiable receipts. Why it matters: the future Walmart is betting on (agents that plan, compare, and buy) runs on machine-readable surfaces; and a 50-million-acre restore pledge earns trust one provable place at a time, not one PDF at a time. Walmart already owns the hardest input: ~4,600 U.S. stores, with ~90% of Americans living within 10 miles of one (company-reported). Every store is a place a restore packet can prove. The reproducible proof (findings 2–3):

$ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/llms.txt 404 $ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/this-is-a-soft404-control-xyz123.txt 404 (control, real 404s, credited) $ curl -s https://corporate.walmart.com/purpose/sustainability | grep -c 'application/ld+json' 0
Finding 2 · Agent legibility

No open agent surface, on the consumer OR the developer domain, while the standard is already proven achievable in retail.

Every open-web agent front door is missing on Walmart: www.walmart.com/llms.txt and /ai.txt are 404, /.well-known/agent-card.json is 404, and the developer domain is no better (developer.walmart.com/llms.txt 404, agent-card 401). For reference, another major retailer (target.com) already serves a real llms.txt at HTTP 200 that documents its category, brand, and product-URL structure for agents, so the bar is proven achievable. Why it matters: when a shopper's agent goes to source a cookout at Walmart, it needs a surface it can actually read; without one, a ready-to-buy basket quietly slips away. The proof:

$ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/llms.txt 404 $ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/.well-known/agent-card.json 404 $ curl -s -o /dev/null -w '%{http_code}' https://developer.walmart.com/llms.txt 404 $ curl -s -o /dev/null -w '%{http_code}' https://www.target.com/llms.txt 200 (a major retailer already ships a real agent map)
Finding 3 · Machine-verifiable outcomes

The regenerative outcomes are self-reported and aggregate: not verifiable per place.

Project Gigaton's 1.19 Gt is a supplier-reported total; the 50M-acre / 1M-square-mile restore pledge and the corporate sustainability page carry zero structured data (0 ld+json in the served HTML). There is no per-project object that says "this acre, this store, this restoration, verified." Why it matters: aggregate self-reporting is exactly what regulators and rating bodies are moving away from; a per-place proof receipt is what survives scrutiny, and it's what turns a pledge into a portfolio of verifiable assets. The proof:

$ curl -s https://corporate.walmart.com/purpose/sustainability | grep -c 'application/ld+json' 0 # Project Gigaton = supplier-reported aggregate (1.19 Gt, 5,900+ suppliers) # 50M-acre / 1M-sq-mi pledge = prose commitment, no per-place verifiable receipt # opportunity: a per-store restore receipt (place + proof + tCO2e) settled on-chain
Finding 4 · One small hardening note

Strong security posture, with a single easy tightening.

Walmart's hygiene is good: enforced DMARC (p=reject), a published security.txt, CSP with frame-ancestors + a report-uri, X-Frame-Options, a Permissions-Policy. The one note: the HSTS header on www.walmart.com is max-age=31536000 without includeSubDomains, a one-token addition that extends transport security to every subdomain (peer target.com already sets it). Not a vulnerability; a completeness nudge. The proof:

$ curl -sI https://www.walmart.com/ | grep -i strict-transport strict-transport-security: max-age=31536000 (no includeSubDomains) $ curl -sI https://www.target.com/ | grep -i strict-transport strict-transport-security: max-age=31536000; includeSubDomains $ curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/.well-known/security.txt 200

The concept: store-community restore packets

A restore opportunity at a specific store, a parking-lot bioswale, the creek behind the lot, a food-desert community garden, becomes a bounded work packet: scope, safety, funding path, proof requirements. It's claimed by an associate on a step-1-to-mastery ladder (Build / Grow & Cook / Restore) or by a local, closed with photo + GPS + signature proof, scored by a deterministic proof-checker, and settled to a permanent receipt on Base with its tCO2e retired. Each receipt appends to that store's verified regeneration record: the per-place proof the 50M-acre pledge is missing, and a legible asset an agent, a regulator, or a customer can read.

This maps onto Walmart without a rebrand: Gigaton proved the supply chain can decarbonize; store-restore packets prove the places regenerate. The restore lanes are live on our board today with reproducible counts (curl https://vealth.net/labor/stats): tree_planting 73, urban_canopy_survey 511, stormwater_maintenance_clearing 48, plus clean_waterway, build_rain_garden, native_planting, priced for agents at work-packet $0.10 + work-tco2e $0.005 over x402.

Integration path: zero Walmart system access required

StepWhat happensWho touches what
1Walmart publishes concept llms.txt + agent-card (drafted in the Agent Kit), the open complement to SparkyWalmart web team, static files on walmart.com
2One store-community restore packet is authored + funded (community-giving or a single store's budget)EcoWealth rail; no Walmart systems touched
3The restore is proof-checked (photo+GPS+signature) and settled on Base with tCO2e; receipt appended to the store's regeneration recordEcoWealth's live contract; Walmart reads receipts
4Regenerative commitments expressed as structured, verifiable per-place data an agent or rating body can readWalmart publishes; EcoWealth supplies the schema

Evidence log

ClaimSource / re-verifyObserved
walmart.com/llms.txt = true 404 (control also 404); ai.txt, agent-card 404; developer domain 404/401curl -s -o /dev/null -w '%{http_code}' https://www.walmart.com/llms.txt etc.2026-07-14
Reference: target.com/llms.txt = 200 (real agent map)curl -s -o /dev/null -w '%{http_code}' https://www.target.com/llms.txt2026-07-14
Corporate sustainability page ld+json = 0curl -s https://corporate.walmart.com/purpose/sustainability | grep -c application/ld+json2026-07-14
DMARC p=reject; security.txt = 200; HSTS without includeSubDomainsdig +short TXT _dmarc.walmart.com · curl -sI https://www.walmart.com/ | grep -i strict-transport2026-07-14
Project Gigaton delivered 6 yrs early (1.19 Gt, 5,900+ suppliers); regenerative pledge 2020 (50M acres / 1M sq mi by 2030, zero emissions 2040); Sparky launched June 2025corporate.walmart.com press + WebSearch (cited in evidence.json)2026-07-14
EWP live: 7,624 postings / $671,012; contract 0x76c17C…A14B; work-packet $0.10, work-tco2e $0.005curl -s https://vealth.net/labor/stats · BaseScan · /.well-known/x4022026-07-14

The ask: proof first, then one small step

See the proof before you decide anything. Any one of your agents, Sparky included, can make a single keyless x402 work-packet call ($0.10) against our live endpoint and get back a real, bounded, place-based restore packet, no contract, no meeting: curl https://vealth.net/.well-known/x402.

Then the first funded step: fund one store-community restore packet at a single Supercenter: a native-tree planting or a creek cleanup, roughly $150–250 of labor plus cents of settlement. Against ~$680B in annual revenue and a 50-million-acre restore pledge, that is a rounding error; what it buys is the one thing the pledge can't yet produce: a permanent on-chain receipt that this place was actually restored, with its tCO2e retired. The deliverable is that receipt, appended to the store's verified regeneration record. Verified place, verified restored, verified funded.
Provisioned by EcoWealth · Digital Provisioning Protocol · provenance‑sealed