For site owners
01
CiteFleet audits the origin: live routes, robots.txt, sitemap, llms.txt, and owner control. Search consoles and CMS logins stay there. BotCentral never signs into Bing or Google.
02
Place DNS TXT botcentral-verify=<token>, or serve the same token as plain text at https://{domain}/.well-known/botcentral.txt. An SPA that returns HTML 200 for that path is rejected. Off-host URLs are rejected.
03
Retrieve, train, and act are separate. The 1.1 default is retrieve yes, train no, act no, TDM reserved. Compile robots.txt from that card so named training crawlers are Disallow: / and user-fetches stay allowed.
04
The live robots.txt must allow the agents named on the card. A later Disallow: / unpublishes the record on revalidation. Control tokens (Google-Extended, Applebot-Extended) belong in robots.txt even though they are not HTTP User-Agents.
05
The private channel writes the catalog only after proof. Bots never publish. Mentions, social posts, and press are out of scope.
What a listing costs
What will not list as verified
Probe the origin before you talk to CiteFleet. After publish, bots discover the site through the public contract. The ops desk is the same pipe CiteFleet calls. A product that lists many client sites uses the publisher API: prove origin, then PUT /v1/publisher/sites/{domain}.