Agentic Resource Discovery manifest. Registries crawl this path; without it there is nothing for them to index, however healthy the endpoint is.

The CORS header is required, not decorative: the ARD publishing guide calls it crucial for crawlers, and a browser-context crawler is blocked before it ever sees the body. That fails silently, since the file looks correct to curl. A public document with no credentials, so the wildcard carries nothing.