Document AgentCard checkout origin matching

[hiroTamada]

Summary

• Document optional AgentCard checkout_origin matching for non-prepared checkout authorizations, including canonical origin requirements and prepared checkout behavior.
• Add TypeScript, Python, and CLI examples, and explain the caller-supplied origin trust boundary and autopilot approval limitations.
• Add a changelog entry.

Validation

• git diff --check
• Mintlify preview started; AgentCard guide and changelog both returned HTTP 200 with the updated content rendered.

Testing

• No separate docs test or build command is configured; the Mintlify preview is the documented validation.

---

Note

Low Risk
Documentation-only updates to the AgentCard guide with no runtime or API behavior changes in this diff.

Overview
Documents the optional AgentCard card spec.checkout_origin field in the AgentCard integration guide.

Examples now include checkout_origin on create and update paths (TypeScript, Python, CLI). The item reference table lists it alongside card_id as optional.

New prose explains canonical origin formatting (HTTPS shop origins or http://localhost), that Kernel forwards the value to AgentCard for autopilot rule matching on non-prepared checkouts (not a substitute for user approval), prepared checkout’s use of merchant_origin instead, and that full spec replacement on update requires re-sending checkout_origin. It also states the trust boundary: callers must supply a validated origin; Kernel does not compare it to the browser page.

^{Reviewed by Cursor Bugbot for commit dd52b11. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 10, 2026, 1:11 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 99d998e. Configure here.}

[cursor]

Packed checkout origin caveats paragraph

Low Severity

The checkout_origin paragraph now combines origin format, non-prepared versus prepared behavior, omit semantics, full-spec replace rules, and separate autopilot-approval caveats in one run of prose. Those are distinct constraints that are hard to scan together.

 

^{Triggered by learned rule: Use bullet lists when covering multiple distinct points in guides}

^{Reviewed by Cursor Bugbot for commit 99d998e. Configure here.}