The deprecated SDK is still the spine of the integration guide, and a fourth offline variant

blog/op-crossrail/index.html

@@ -81,7 +81,7 @@ <h2>One credential, three rails, and a payment that never existed</h2>
 
   <p>OP Crossrail is a buyer-side enforcement layer for agent payments: one signed, portable mandate, enforced natively at each rail's own boundary, before the payment exists.</p>
 
-  <p>Here is the launch demo, committed as a transcript in the repo. A principal signs one delegation: $5.00 per rolling 24 hours, across every rail the agent operates on. Conversion rates are attested inside the credential itself, no oracle, no runtime dependency on us. Then the agent goes shopping.</p>
+  <p>Here is the launch demo, committed as a transcript in the repo. A principal signs one delegation: $5.00 per rolling 24 hours, across every rail the agent operates on. <span data-shared-copy="offline-scope">Conversion rates are attested inside the credential itself, no oracle, no runtime dependency on us.</span> Then the agent goes shopping.</p>
 
   <p>It buys an API call from a seller running Cloudflare's x402-proxy-template, unmodified, exactly as Cloudflare ships it: 402, sign, pay, 200. It runs a 5,940-sat L402 invoice through the engine's pre-payment hook, called in-process on a synthetic invoice: no LND node, and the engine ships no payment path. It moves 2 USDT on TRON through the policy engine running on the WDK's policy hook (Tether's PR #55). Two more x402 calls, and the budget sits at exactly $5.00, spent to the cent across three rails under one credential.</p>
 

docs.html

@@ -225,10 +225,10 @@ <h2>Choose your path.</h2>
       </a>
       <a href="https://github.com/observer-protocol/aip/tree/master/sdk/python" target="_blank" class="qs-card">
         <div class="qs-icon">🐍</div>
-        <div class="qs-tag">PIP INSTALL · v0.2.0</div>
+        <div class="qs-tag">DEPRECATED · v0.2.0, April 2026</div>
         <div class="qs-name">Python SDK</div>
         <div class="qs-meta">pip install observer-protocol</div>
-        <div class="qs-desc">Full Python SDK: agent identity, delegation, x402 verification, magic link authorization, chargeback prevention, ERC-8004 integration. Type-hinted throughout.</div>
+        <div class="qs-desc">Agent identity, delegation, x402 verification, magic link authorization, chargeback prevention, ERC-8004 integration. <strong>Deprecated and unmaintained since April 2026</strong>, and marked so on the registry. It still installs and anything pinned to it keeps working, but do not start here — see the SDK page for what replaces which part.</div>
       </a>
       <a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/network-operator-guide.md" target="_blank" class="qs-card">
         <div class="qs-icon">🏗️</div>

institutional/index.html

@@ -310,7 +310,10 @@ <h3>ALREADY LIVE</h3>
         <li>AIP refusal and remediation grammar</li>
         <li>Delegation scope enforced before signing</li>
         <li>x402, Lightning, TRON settlement</li>
-        <li>TypeScript + Python SDKs (npm + PyPI)</li>
+        <li><code>@observer-protocol/policy-engine</code> and the per-rail adapters on npm. The
+        older <code>@observer-protocol/sdk</code> and PyPI <code>observer-protocol</code> packages
+        are deprecated on the registry and unmaintained since April 2026 &mdash; they still install,
+        but do not start an integration on them.</li>
       </ul>
     </div>
     <div class="codesign-col">

integrate/index.html

@@ -74,7 +74,7 @@ <h1>Add Chargeback Prevention to Your <span class="accent">AI Infrastructure</sp
 
   <h2>What you get</h2>
 
-  <p>Observer Protocol adds one artifact to every agent transaction on your infrastructure: a cryptographically signed authorization proof that shows the purchase was within a valid delegation's scope. The authorization proof is independently verifiable by any third party. No runtime dependency on OP or your backend.</p>
+  <p>Observer Protocol adds one artifact to every agent transaction on your infrastructure: a cryptographically signed authorization proof that shows the purchase was within a valid delegation's scope. <span data-shared-copy="offline-scope">The authorization proof is independently verifiable by any third party: no API key, and no Observer Protocol API in the path. Verifying it fetches the issuer's DID document over ordinary HTTPS, or nothing at all if you supply that document yourself.</span></p>
 
   <ul>
     <li>Cryptographic delegation credentials (W3C Verifiable Credentials)</li>
@@ -93,6 +93,15 @@ <h2>Reference integration: Hyperbolic</h2>
   <!-- STEP 1 -->
   <div class="step">
     <div class="step-num">Step 1 - Install the SDK</div>
+    <p style="border-left:3px solid #6b5210; background:#2a1f0a; padding:0.9rem 1.1rem; margin:0 0 1rem;">
+      <strong>Deprecated, and this guide has not been rewritten off it.</strong>
+      <code>@observer-protocol/sdk</code> and the PyPI package <code>observer-protocol</code> were
+      last released in April 2026, are unmaintained, and carry a deprecation notice on the registry
+      itself. Everything below still installs and still runs. For <em>verifying</em> a credential use
+      <code>@observer-protocol/policy-engine</code> instead; for the register/attest flows in Steps 2
+      and 3 there is no replacement package yet, which is why this page still names the old one. See
+      <a href="/sdk.html">the SDK page</a> for what replaces which part.
+    </p>
     <h3>TypeScript</h3>
     <pre>npm install @observer-protocol/sdk</pre>
 
@@ -178,15 +187,15 @@ <h3>Python</h3>
   <div class="step">
     <div class="step-num">Step 4 - Verify authorization proofs (any third party can do this)</div>
 
-    <p>Verification requires only the authorization-proof JSON and the issuer's published public key. No API key. No runtime dependency on OP.</p>
+    <p data-shared-copy="offline-scope">Verification requires only the authorization-proof JSON and the issuer's published public key. No API key, no token, no Observer Protocol API in the path. Note that <code>resolve_did</code> below fetches the issuer's DID document over ordinary HTTPS from the origin the credential names &mdash; supply the document yourself and it makes no network call at all.</p>
 
     <pre>from observer_protocol import verify_receipt, resolve_did
 
 issuer_key = resolve_did(receipt_json['issuer']['id'])
 result = verify_receipt(receipt_json, issuer_key)
 assert result.valid  # cryptographic proof verified</pre>
 
-    <p>Four lines. No API key. No runtime dependency on OP or the counterparty. Any third party can verify.</p>
+    <p>Four lines, no API key, and nothing either OP or the counterparty can withhold to stop it verifying. Any third party can verify.</p>
   </div>
 
   <!-- PROOF -->

scripts/shared-copy.json

@@ -35,7 +35,9 @@
       "sdk.html",
       "docs.html",
       "trading.html",
-      "verify.html"
+      "verify.html",
+      "integrate/index.html",
+      "blog/op-crossrail/index.html"
     ],
     "phrases": [],
     "claimPatterns": [
@@ -50,7 +52,8 @@
       "no Observer Protocol API in the path",
       "makes no network call at all",
       "our uptime",
-      "permission from us"
+      "permission from us",
+      "runtime dependency on (OP|us|Observer)"
     ],
     "claimPatternsAreRegex": "Case-insensitive regexes, matched by check-shared-copy.mjs. Written from the site's own examples rather than from one remembered sentence: the claim is spelled 'call back to us' on index.html and 'callback to Observer' on docs.html, and a literal lower-case list saw neither the capitalised heading nor the Observer variant. Four assertions were invisible to this block on 2026-08-09 for exactly that reason. When you add a home for the claim, add its WORDING here, not just its file.",
     "claimPatternNote": "Any occurrence of these in an HTML file MUST sit inside an element tagged data-shared-copy=\"offline-scope\". That is what makes a tenth instance a build failure rather than a discovery. Add the tag, or add the file to mustAppearIn if it is a new home for the claim. Some tagged instances REFER to the claim rather than asserting it (docs.html's resolution-hosting rationale is one). They are tagged anyway: the enumeration's job is to know everywhere the phrase appears, and a human scoping the claim decides per instance."