Document AgentCard checkout origin matching

[hiroTamada]

Summary

• Document optional AgentCard checkout_origin matching for non-prepared checkout authorizations, including canonical origin requirements and prepared checkout behavior.
• Add TypeScript, Python, and CLI examples, and explain the caller-supplied origin trust boundary and autopilot approval limitations.
• Add a changelog entry.

Validation

• git diff --check
• Mintlify preview started; AgentCard guide and changelog both returned HTTP 200 with the updated content rendered.

Testing

• No separate docs test or build command is configured; the Mintlify preview is the documented validation.

---

Note

Low Risk
Documentation-only changes with no runtime or API behavior modified in this PR.

Overview
Documents the optional checkout_origin field on AgentCard vault card specs and how it affects non-prepared checkout authorizations.

The AgentCard guide now shows checkout_origin in create/update examples (TypeScript, Python, CLI), adds canonical origin rules (HTTPS shop origin or http://localhost), and clarifies that Kernel forwards the caller-supplied value to AgentCard for autopilot rule matching—not as payment approval—and that prepared checkout still uses preparation merchant_origin. It also notes full-spec updates must re-include the field, autopilot matches can still fall back to user approval, and Kernel does not verify the origin against the browser page (apps must set it from trusted checkout context).

The changelog gets a September 30 entry for the product capability and these doc updates.

^{Reviewed by Cursor Bugbot for commit 99d998e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 1, 2026, 2:23 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 99d998e. Configure here.}

[cursor]

Packed checkout origin caveats paragraph

Low Severity

The checkout_origin paragraph now combines origin format, non-prepared versus prepared behavior, omit semantics, full-spec replace rules, and separate autopilot-approval caveats in one run of prose. Those are distinct constraints that are hard to scan together.

 

^{Triggered by learned rule: Use bullet lists when covering multiple distinct points in guides}

^{Reviewed by Cursor Bugbot for commit 99d998e. Configure here.}