<?xml version="1.0" encoding="UTF-8"?>
<!-- kya.trulioo.com - the public documents, for a crawler.

     Hand-maintained, and short on purpose. Every <loc> here is Allowed by robots.txt and
     has a row in .gitlab/access-posture.tsv; check-robots-discovery.py fails on a URL
     that is in one file and not the others, because a sitemap that advertises what the
     crawl policy refuses is a self-contradiction we would fail any third party for.

     NO per-agent attestation page is listed. /attestation/<dap> is public and citable and
     is not an index: the entries would be a list of the agents we have attested, which is
     not ours to publish, and a crawler walking it would be enumerating identifiers.

     No <lastmod>. These pages ship with the SPA, so a truthful lastmod is the deploy time
     of a build this file cannot see - and a stale date is worse than no date.

     The three /portal/ developer artifacts robots.txt Allows are NOT listed, and the
     omission is deliberate rather than an oversight: they document mcp.trulioo.com, and a
     crawler that indexed them from here would surface another host's connection and auth
     instructions under this one. They are reachable, named by /llms.txt, and not offered
     for indexing - which is exactly what an Allow without a <loc> says. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://kya.trulioo.com/</loc></url>
  <url><loc>https://kya.trulioo.com/readiness</loc></url>
  <url><loc>https://kya.trulioo.com/standards</loc></url>
  <url><loc>https://kya.trulioo.com/agent-readiness.md</loc></url>
  <url><loc>https://kya.trulioo.com/llms.txt</loc></url>
  <url><loc>https://kya.trulioo.com/.well-known/ai-catalog.json</loc></url>
  <url><loc>https://kya.trulioo.com/sitemap.xml</loc></url>
</urlset>
