diff --git a/server/public/brand-builder.html b/server/public/brand-builder.html
index 5e3dbe4daf7..8e2b1f1d82a 100644
--- a/server/public/brand-builder.html
+++ b/server/public/brand-builder.html
@@ -1200,10 +1200,11 @@ <h4>brand.json for <span id="domain-display"></span></h4>
               <a id="view-brand-link" class="btn btn-view-brand" href="#" target="_blank" style="display:none;">View Brand</a>
               <button class="btn btn-secondary" onclick="copyJson()">Copy JSON</button>
               <button class="btn btn-secondary" onclick="downloadJson()">Download</button>
-              <div style="display: flex; flex-direction: column; align-items: flex-end;">
+              <div id="save-registry-group" style="display: flex; flex-direction: column; align-items: flex-end;">
                 <button class="btn" id="save-registry-btn" onclick="saveToRegistry()" disabled title="Log in to save">Save setup</button>
                 <span id="save-registry-hint" class="btn-disabled-hint">Log in as a member to save setup</span>
               </div>
+              <button class="btn hidden" id="host-with-aao-btn" onclick="hostWithAao()" title="Continue on AgenticAdvertising.org, which can host this brand.json for you">Host with AgenticAdvertising.org</button>
             </div>
           </div>
 
@@ -1658,6 +1659,17 @@ <h4>Next steps</h4>
                   <p id="next-step-2-copy">Place the file at this exact location on your server:</p>
                   <code id="deploy-path">https://example.com/.well-known/brand.json</code>
                   <p style="margin-top: var(--space-2);">Create the <code>.well-known</code> folder if it doesn't exist.</p>
+                  <details id="delegate-hosting" style="margin-top: var(--space-3);">
+                    <summary style="cursor: pointer; font-weight: var(--font-medium);">Your agency or platform hosts it instead?</summary>
+                    <p style="margin-top: var(--space-2);">Send them the brand.json above. Then publish this small pointer at the same location on your domain, so agents follow it to their copy.</p>
+                    <div class="form-group" style="margin-bottom: var(--space-2);">
+                      <label for="delegate-url">URL where they host your brand.json</label>
+                      <input type="url" id="delegate-url" placeholder="https://agency.example/brands/example.com/brand.json" oninput="updateDelegatePointer()" />
+                      <p class="hint" id="delegate-url-hint">Must be an HTTPS URL that serves the file directly, without redirects.</p>
+                    </div>
+                    <pre class="pointer-snippet" id="delegate-pointer">{}</pre>
+                    <button class="btn btn-secondary" id="delegate-download-btn" onclick="downloadDelegatePointer()" disabled style="padding: var(--space-2) var(--space-4);">Download pointer file</button>
+                  </details>
                 </div>
               </li>
               <li>
@@ -3933,6 +3945,117 @@ <h4>${escapeHtml(brand.name || brand.brand_id || 'Untitled Brand')}</h4>
           .catch(() => alert('Failed to copy instructions.'));
       }
 
+      // ============================================================================
+      // Delegated hosting (agency or platform hosts the file)
+      // ============================================================================
+
+      function getDelegatePointer() {
+        const raw = (document.getElementById('delegate-url')?.value || '').trim();
+        let url;
+        try { url = new URL(raw); } catch { return null; }
+        if (url.protocol !== 'https:') return null;
+        return {
+          "$schema": "https://adcontextprotocol.org/schemas/latest/brand.json",
+          "authoritative_location": url.href
+        };
+      }
+
+      function updateDelegatePointer() {
+        const pointer = getDelegatePointer();
+        document.getElementById('delegate-pointer').textContent = pointer ? JSON.stringify(pointer, null, 2) : '{}';
+        document.getElementById('delegate-download-btn').disabled = !pointer;
+      }
+
+      function downloadDelegatePointer() {
+        const pointer = getDelegatePointer();
+        if (!pointer) return;
+        const blob = new Blob([JSON.stringify(pointer, null, 2)], { type: 'application/json' });
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = 'brand.json';
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+      }
+
+      // ============================================================================
+      // Handoff from brandjson.org to AgenticAdvertising.org hosting
+      // ============================================================================
+      // brandjson.org has no AgenticAdvertising.org session, so hosting there
+      // continues on agenticadvertising.org. The draft travels in the URL
+      // fragment (never sent to a server) and is only loaded into the form; the
+      // user still reviews and saves it explicitly.
+
+      const HANDOFF_MAX_JSON_CHARS = 100000;
+
+      function toBase64Url(bytes) {
+        let bin = '';
+        for (const b of bytes) bin += String.fromCharCode(b);
+        return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+      }
+
+      function fromBase64Url(text) {
+        let b64 = text.replace(/-/g, '+').replace(/_/g, '/');
+        while (b64.length % 4) b64 += '=';
+        const bin = atob(b64);
+        return Uint8Array.from(bin, c => c.charCodeAt(0));
+      }
+
+      async function encodeDraft(json) {
+        const bytes = new TextEncoder().encode(JSON.stringify(json));
+        if (typeof CompressionStream === 'function') {
+          const stream = new Blob([bytes]).stream().pipeThrough(new CompressionStream('gzip'));
+          return 'v1.gz.' + toBase64Url(new Uint8Array(await new Response(stream).arrayBuffer()));
+        }
+        return 'v1.raw.' + toBase64Url(bytes);
+      }
+
+      async function decodeDraft(token) {
+        const match = /^v1\.(gz|raw)\.([A-Za-z0-9_-]+)$/.exec(token);
+        if (!match) return null;
+        let bytes = fromBase64Url(match[2]);
+        if (match[1] === 'gz') {
+          if (typeof DecompressionStream !== 'function') return null;
+          const stream = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('gzip'));
+          bytes = new Uint8Array(await new Response(stream).arrayBuffer());
+        }
+        const text = new TextDecoder().decode(bytes);
+        if (text.length > HANDOFF_MAX_JSON_CHARS) return null;
+        const data = JSON.parse(text);
+        return data && typeof data === 'object' && !Array.isArray(data) ? data : null;
+      }
+
+      function aaoOrigin() {
+        const host = window.location.hostname;
+        return host === 'localhost' || host === '127.0.0.1' ? window.location.origin : 'https://agenticadvertising.org';
+      }
+
+      async function hostWithAao() {
+        if (!currentDomain) return;
+        try {
+          const token = await encodeDraft(finalizeJson());
+          window.location.href = `${aaoOrigin()}/brand/builder?domain=${encodeURIComponent(currentDomain)}#draft=${token}`;
+        } catch {
+          alert('Could not prepare your draft. Download it instead and upload it on AgenticAdvertising.org.');
+        }
+      }
+
+      async function applyHandoffDraft(token, domain) {
+        let data = null;
+        try { data = await decodeDraft(token); } catch { data = null; }
+        history.replaceState(null, '', window.location.pathname + window.location.search);
+        if (!data) {
+          alert('The draft from brandjson.org could not be loaded. Please rebuild it here.');
+          return;
+        }
+        document.getElementById('builder-form').classList.remove('hidden');
+        populateFromBrandJson(data, domain, domain);
+        document.getElementById('file-status').textContent = 'Imported from brandjson.org. Review, then save your setup.';
+        updateRegistryButton();
+      }
+
       async function loadFromRegistry(domain) {
         try {
           const response = await fetch(`/api/brands/hosted/${encodeURIComponent(domain)}`);
@@ -3965,13 +4088,21 @@ <h4>${escapeHtml(brand.name || brand.brand_id || 'Untitled Brand')}</h4>
       // Initialize
       // ============================================================================
 
-      document.addEventListener('DOMContentLoaded', () => {
-        // Check for domain in URL params
+      document.addEventListener('DOMContentLoaded', async () => {
+        // On brandjson.org, hosting continues on AgenticAdvertising.org.
+        if (window.__ADCP_SITE__ === 'brandjson') {
+          document.getElementById('save-registry-group').style.display = 'none';
+          document.getElementById('host-with-aao-btn').classList.remove('hidden');
+        }
+
+        // Check for domain in URL params, and a draft handed off from brandjson.org
         const params = new URLSearchParams(window.location.search);
         const domain = params.get('domain');
+        const draftToken = window.location.hash.startsWith('#draft=') ? window.location.hash.slice('#draft='.length) : null;
         if (domain) {
           document.getElementById('domain-input').value = domain;
-          startBuilding();
+          await startBuilding();
+          if (draftToken) await applyHandoffDraft(draftToken, domain);
         }
       });
     </script>
diff --git a/server/public/nav.js b/server/public/nav.js
index 66409b14666..6c06b8ab5a2 100644
--- a/server/public/nav.js
+++ b/server/public/nav.js
@@ -26,6 +26,64 @@
     return;
   }
 
+  // Standalone standard sites (brandjson.org, trustjson.org) get neutral
+  // chrome: the standard's own wordmark and links, with AgenticAdvertising.org
+  // credited as steward rather than as the site owner.
+  if (window.__ADCP_SITE__ === 'brandjson' || window.__ADCP_SITE__ === 'trustjson') {
+    renderStandaloneChrome(window.__ADCP_SITE__);
+    return;
+  }
+
+  function renderStandaloneChrome(site) {
+    const sites = {
+      brandjson: {
+        name: 'brand.json',
+        links: [
+          { href: '/builder', label: 'Builder' },
+          { href: '/spec', label: 'Specification' },
+          { href: '/schemas/v3/brand.json', label: 'Schema' },
+          { href: 'https://github.com/adcontextprotocol/adcp', label: 'GitHub' },
+        ],
+      },
+      trustjson: {
+        name: 'trust.json',
+        links: [
+          { href: 'https://github.com/adcontextprotocol/adcp/issues/7809', label: 'RFC' },
+          { href: 'https://github.com/adcontextprotocol/adcp/pull/7819', label: 'Draft spec' },
+          { href: 'https://github.com/adcontextprotocol/adcp', label: 'GitHub' },
+        ],
+      },
+    };
+    const cfg = sites[site];
+    const style = `
+      .std-site-nav { position: fixed; top: 0; left: 0; right: 0; height: var(--nav-height); z-index: 100;
+        display: flex; align-items: center; justify-content: space-between; padding: 0 var(--space-5);
+        background: var(--color-bg-card); border-bottom: 1px solid var(--color-border); }
+      .std-site-nav a { color: var(--color-text-secondary); text-decoration: none; font-size: var(--text-sm); }
+      .std-site-nav a:hover { color: var(--color-text); }
+      .std-site-wordmark { font-family: var(--font-mono); font-weight: var(--font-bold); font-size: var(--text-lg); color: var(--color-text) !important; }
+      .std-site-links { display: flex; gap: var(--space-5); }
+      .std-site-footer { border-top: 1px solid var(--color-border); padding: var(--space-6) var(--space-5); background: var(--color-bg-card);
+        text-align: center; color: var(--color-text-muted); font-size: var(--text-sm); }
+      .std-site-footer a { color: var(--color-text-secondary); }
+      @media (max-width: 640px) { .std-site-links { gap: var(--space-3); } }
+    `;
+    const links = cfg.links.map(l => `<a href="${l.href}">${l.label}</a>`).join('');
+    const navHTML = `<nav class="std-site-nav" aria-label="${cfg.name}"><a class="std-site-wordmark" href="/">${cfg.name}</a><div class="std-site-links">${links}</div></nav>`;
+    const footerHTML = `<footer class="std-site-footer">${cfg.name} is an open standard stewarded by <a href="https://agenticadvertising.org">AgenticAdvertising.org</a>.</footer>`;
+    function mount() {
+      document.head.insertAdjacentHTML('beforeend', `<style>${style}</style>`);
+      const navPlaceholder = document.getElementById('adcp-nav');
+      if (navPlaceholder) navPlaceholder.outerHTML = navHTML;
+      else document.body.insertAdjacentHTML('afterbegin', navHTML);
+      const footerPlaceholder = document.getElementById('adcp-footer');
+      if (footerPlaceholder) footerPlaceholder.outerHTML = footerHTML;
+      else if (!document.querySelector('footer')) document.body.insertAdjacentHTML('beforeend', footerHTML);
+    }
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', mount);
+    else mount();
+  }
+
   function escapeHtml(str) {
     if (!str) return '';
     const div = document.createElement('div');
diff --git a/server/public/registry-nav.js b/server/public/registry-nav.js
index 07001ec0c7a..64009439a5b 100644
--- a/server/public/registry-nav.js
+++ b/server/public/registry-nav.js
@@ -9,6 +9,9 @@
 (function () {
   'use strict';
 
+  // Standalone standard sites have no registry sub-navigation.
+  if (window.__ADCP_SITE__) return;
+
   var path = window.location.pathname;
   var params = new URLSearchParams(window.location.search);
   var tab = params.get('tab');
diff --git a/server/public/sites/brandjson/index.html b/server/public/sites/brandjson/index.html
new file mode 100644
index 00000000000..0f486e776a2
--- /dev/null
+++ b/server/public/sites/brandjson/index.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>brand.json: publish your brand identity for AI agents</title>
+  <meta name="description" content="brand.json is an open standard for publishing your brand identity at /.well-known/brand.json, so AI agents can find your name, logos, colors, and voice.">
+  <link rel="canonical" href="https://brandjson.org/">
+  <link rel="icon" href="/favicon.svg" type="image/svg+xml">
+  <link rel="stylesheet" href="/design-system.css">
+  <link rel="stylesheet" href="/sites/standard-site.css">
+</head>
+<body>
+  <div id="adcp-nav"></div>
+  <script src="/nav.js"></script>
+
+  <header class="std-hero">
+    <h1>brand.json</h1>
+    <p>An open standard for publishing your brand identity where AI agents can find it: one file at <code>/.well-known/brand.json</code>.</p>
+    <div class="std-actions">
+      <a class="btn btn-primary" href="/builder">Build or check your brand.json</a>
+      <a class="btn btn-secondary-on-dark" href="/spec">Read the specification</a>
+    </div>
+  </header>
+
+  <main class="std-main">
+    <h2>What it is</h2>
+    <p>brand.json tells agents who your brand is and how it wants to be represented: names, logos, colors, fonts, tone, visual guidelines, and the properties you own. Agents read it the same way crawlers read <code>robots.txt</code>: from a well-known location on your own domain.</p>
+
+    <h2>Who hosts it</h2>
+    <div class="std-cards">
+      <div class="std-card">
+        <h3>You</h3>
+        <p>Recommended. Put the file at <code>https://yourdomain/.well-known/brand.json</code>. The builder generates it and checks it once it's live.</p>
+      </div>
+      <div class="std-card">
+        <h3>Your agency or platform</h3>
+        <p>They host the full file; you publish a small pointer on your domain with <code>authoritative_location</code>.</p>
+      </div>
+      <div class="std-card">
+        <h3>A hosting service</h3>
+        <p>AgenticAdvertising.org can host it for you. Your domain still publishes the pointer, so you stay in control.</p>
+      </div>
+    </div>
+
+    <h2>A minimal example</h2>
+<pre>{
+  "$schema": "https://brandjson.org/schemas/v3/brand.json",
+  "house": { "domain": "acme.example", "name": "Acme Corp" },
+  "brands": [
+    {
+      "id": "acme",
+      "names": [{ "en": "Acme" }],
+      "logos": [{ "url": "https://acme.example/logo.svg" }],
+      "colors": { "primary": "#1A4D8F" }
+    }
+  ]
+}</pre>
+
+    <h2>Schema</h2>
+    <p>Validate against <a href="/schemas/v3/brand.json"><code>https://brandjson.org/schemas/v3/brand.json</code></a>. The standard's agent and trust fields are moving to a separate record, <a href="https://trustjson.org">trust.json</a>, so brand.json can stay focused on identity.</p>
+  </main>
+
+  <div id="adcp-footer"></div>
+</body>
+</html>
diff --git a/server/public/sites/standard-site.css b/server/public/sites/standard-site.css
new file mode 100644
index 00000000000..d1eb42717cf
--- /dev/null
+++ b/server/public/sites/standard-site.css
@@ -0,0 +1,18 @@
+/* Shared layout for standalone standard sites (brandjson.org, trustjson.org).
+   Uses design system variables only - see /design-system.css. */
+body { padding-top: var(--nav-height); background: var(--color-bg-page); color: var(--color-text); font-family: var(--font-sans); }
+.std-hero { padding: var(--space-16) var(--space-5) var(--space-12); text-align: center; background: var(--gradient-primary-dark); color: var(--color-text-on-dark); }
+.std-hero h1 { font-family: var(--font-mono); font-size: var(--text-5xl); font-weight: var(--font-bold); margin: 0 0 var(--space-4); }
+.std-hero p { font-size: var(--text-xl); color: var(--color-text-on-dark-secondary); max-width: 640px; margin: 0 auto var(--space-6); line-height: 1.5; }
+.std-badge { display: inline-block; margin-bottom: var(--space-4); padding: var(--space-1) var(--space-3); border-radius: var(--radius-lg); background: var(--color-warning-100); color: var(--color-text); font-size: var(--text-sm); font-weight: var(--font-semibold); }
+.std-actions { display: flex; gap: var(--space-3); justify-content: center; flex-wrap: wrap; }
+.std-main { max-width: var(--container-md); margin: 0 auto; padding: var(--space-10) var(--space-5); }
+.std-main h2 { font-size: var(--text-2xl); margin: var(--space-10) 0 var(--space-3); color: var(--color-text-heading); }
+.std-main h2:first-child { margin-top: 0; }
+.std-main p, .std-main li { color: var(--color-text-secondary); line-height: 1.6; }
+.std-cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: var(--space-4); margin-top: var(--space-4); }
+.std-card { background: var(--color-bg-card); border: 1px solid var(--color-border); border-radius: var(--radius-lg); padding: var(--space-5); box-shadow: var(--shadow-sm); }
+.std-card h3 { margin: 0 0 var(--space-2); font-size: var(--text-lg); color: var(--color-text-heading); }
+.std-card p { margin: 0; font-size: var(--text-sm); }
+.std-main pre { background: var(--color-code-bg); border: 1px solid var(--color-code-border); color: var(--color-code-text); border-radius: var(--radius-lg); padding: var(--space-4); overflow-x: auto; font-family: var(--font-mono); font-size: var(--text-sm); }
+.std-main code { font-family: var(--font-mono); }
diff --git a/server/public/sites/trustjson/index.html b/server/public/sites/trustjson/index.html
new file mode 100644
index 00000000000..024c107222b
--- /dev/null
+++ b/server/public/sites/trustjson/index.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>trust.json: which agents act for your organization (draft)</title>
+  <meta name="description" content="trust.json is a draft open standard for publishing which agents an organization runs, their keys, and who may act on its behalf, at /.well-known/trust.json.">
+  <link rel="canonical" href="https://trustjson.org/">
+  <link rel="icon" href="/favicon.svg" type="image/svg+xml">
+  <link rel="stylesheet" href="/design-system.css">
+  <link rel="stylesheet" href="/sites/standard-site.css">
+</head>
+<body>
+  <div id="adcp-nav"></div>
+  <script src="/nav.js"></script>
+
+  <header class="std-hero">
+    <span class="std-badge">Draft</span>
+    <h1>trust.json</h1>
+    <p>One file at <code>/.well-known/trust.json</code> that says which agents your organization runs, which keys they sign with, and who may act on your behalf.</p>
+    <div class="std-actions">
+      <a class="btn btn-primary" href="https://github.com/adcontextprotocol/adcp/pull/7819">Read the draft</a>
+      <a class="btn btn-secondary-on-dark" href="https://github.com/adcontextprotocol/adcp/issues/7809">Join the discussion</a>
+    </div>
+  </header>
+
+  <main class="std-main">
+    <h2>What it answers</h2>
+    <div class="std-cards">
+      <div class="std-card">
+        <h3>Which agents are ours?</h3>
+        <p><code>agents[]</code>: each agent's URL, roles, and signing keys, published from your own domain.</p>
+      </div>
+      <div class="std-card">
+        <h3>Who may act for us?</h3>
+        <p><code>grants[]</code>: authority you delegate to other organizations, scoped and time-boxed. Grants never carry keys.</p>
+      </div>
+      <div class="std-card">
+        <h3>Whose grants do we accept?</h3>
+        <p><code>acknowledgements[]</code>: a pointer to a grant someone else published. The terms stay in their file.</p>
+      </div>
+    </div>
+
+    <h2>Not just for advertising</h2>
+    <p>The core is protocol-neutral. Roles and scopes are namespaced, for example <code>adcp:sales</code> for the Ad Context Protocol, so any agent protocol can define its own profile.</p>
+
+    <h2>A minimal example</h2>
+<pre>{
+  "agents": [
+    {
+      "url": "https://agents.acme.example/sales",
+      "roles": ["adcp:sales"],
+      "jwks_uri": "https://agents.acme.example/.well-known/jwks.json"
+    }
+  ]
+}</pre>
+
+    <h2>Status</h2>
+    <p>trust.json is a draft under discussion in <a href="https://github.com/adcontextprotocol/adcp/issues/7809">RFC #7809</a>. Field names may change before v1. Identity stays in <a href="https://brandjson.org">brand.json</a>.</p>
+  </main>
+
+  <div id="adcp-footer"></div>
+</body>
+</html>
diff --git a/server/src/http.ts b/server/src/http.ts
index 2ecf23db47f..13f46165639 100644
--- a/server/src/http.ts
+++ b/server/src/http.ts
@@ -54,6 +54,7 @@ import { getBrandPrimaryDomain, getBrandPrimaryDomainsForOrgs } from "./services
 import { getGitHubConnectedAccount, resolveGitHubConnectUrl, disconnectGitHub, buildPipesReturnTo } from "./services/pipes.js";
 import { BrandDatabase, HostedBrandConflictError, canSurfaceBrandForMember, resolveBrandFromJson } from "./db/brand-db.js";
 import { isDomainControlVerified, publicBrandJsonManifest } from "./services/brand-trust-fields.js";
+import { getStandaloneSite, resolveStandaloneRequest, type StandaloneSite } from "./standalone-sites.js";
 import { CatalogEventsDatabase } from "./db/catalog-events-db.js";
 import { AgentInventoryProfilesDatabase } from "./db/agent-inventory-profiles-db.js";
 import { BrandManager } from "./brand-manager.js";
@@ -1223,6 +1224,12 @@ async function getUserFromRequest(
   return null;
 }
 
+/** Marks pages served on a standalone standard site so nav.js renders neutral chrome. */
+function standaloneSiteScript(res: express.Response): string {
+  const site = res.locals.standaloneSite as StandaloneSite | undefined;
+  return site ? `\n<script>window.__ADCP_SITE__=${JSON.stringify(site)};</script>` : '';
+}
+
 function stripLegacyBrandContext(manifest: Record<string, unknown>): Record<string, unknown> {
   const { brand_context: _brandContext, ...publicManifest } = manifest;
   return publicManifest;
@@ -1332,6 +1339,32 @@ export class HTTPServer {
     mountComplianceRoutes(this.app, path.join(distPath, 'compliance'));
     mountProtocolRoutes(this.app, path.join(distPath, 'protocol'));
 
+    // Standalone standard sites (brandjson.org, trustjson.org) expose only
+    // their own pages, schemas, and public read APIs. See standalone-sites.ts.
+    this.app.use(async (req, res, next) => {
+      const site = getStandaloneSite(req.hostname);
+      if (!site) return next();
+      res.locals.standaloneSite = site;
+      const decision = resolveStandaloneRequest(site, req.hostname, req.method, req.path, req.originalUrl);
+      switch (decision.kind) {
+        case 'pass':
+          return next();
+        case 'rewrite':
+          req.url = decision.url;
+          return next();
+        case 'page':
+          return this.serveHtmlWithConfig(req, res, decision.file);
+        case 'redirect':
+          return res.redirect(decision.status, decision.location);
+        case 'text':
+          res.setHeader('Content-Type', decision.contentType);
+          res.setHeader('Cache-Control', 'public, max-age=300');
+          return res.send(decision.body);
+        case 'not_found':
+          return res.status(404).type('text/plain').send('Not found');
+      }
+    });
+
     // Track slow API responses and alert ops
     this.app.use(slowResponseTracker);
 
@@ -1550,7 +1583,7 @@ export class HTTPServer {
         await enrichUserWithAdmin(user);
 
         // Inject config
-        const configScript = getAppConfigScript(user);
+        const configScript = getAppConfigScript(user) + standaloneSiteScript(res);
 
         // Inject before </head>
         if (html.includes('</head>')) {
@@ -1741,7 +1774,7 @@ export class HTTPServer {
       // Read and inject config
       let html = await fs.readFile(filePath, 'utf-8');
       html = await this.injectHomepageMemberCount(html);
-      const configScript = getAppConfigScript(user);
+      const configScript = getAppConfigScript(user) + standaloneSiteScript(res);
 
       // Inject before </head>
       if (html.includes('</head>')) {
diff --git a/server/src/standalone-sites.ts b/server/src/standalone-sites.ts
new file mode 100644
index 00000000000..5efc9414c46
--- /dev/null
+++ b/server/src/standalone-sites.ts
@@ -0,0 +1,136 @@
+/**
+ * Standalone standard sites served from this app: brandjson.org (brand.json)
+ * and trustjson.org (trust.json). They are neutral homes for open standards
+ * stewarded by AgenticAdvertising.org, so they expose only their own pages,
+ * schemas, and the public read APIs those pages need. Everything else stays on
+ * agenticadvertising.org.
+ */
+
+export type StandaloneSite = 'brandjson' | 'trustjson';
+
+const APEX_HOSTS: Record<StandaloneSite, string> = {
+  brandjson: 'brandjson.org',
+  trustjson: 'trustjson.org',
+};
+
+const SITE_BY_HOST = new Map<string, StandaloneSite>([
+  ['brandjson.org', 'brandjson'],
+  ['www.brandjson.org', 'brandjson'],
+  ['trustjson.org', 'trustjson'],
+  ['www.trustjson.org', 'trustjson'],
+]);
+
+const AAO_ORIGIN = 'https://agenticadvertising.org';
+
+export function getStandaloneSite(hostname: string | undefined): StandaloneSite | null {
+  if (!hostname) return null;
+  return SITE_BY_HOST.get(hostname.toLowerCase()) ?? null;
+}
+
+export function standaloneSiteOrigin(site: StandaloneSite): string {
+  return `https://${APEX_HOSTS[site]}`;
+}
+
+export type StandaloneDecision =
+  /** Serve an HTML page from server/public. */
+  | { kind: 'page'; file: string }
+  /** Rewrite the request path and continue to the existing route. */
+  | { kind: 'rewrite'; url: string }
+  /** Continue unchanged (assets, schemas, allowed APIs). */
+  | { kind: 'pass' }
+  | { kind: 'redirect'; status: 301 | 302; location: string }
+  | { kind: 'text'; contentType: string; body: string }
+  | { kind: 'not_found' };
+
+const STATIC_ASSET = /^\/[A-Za-z0-9._\/-]+\.(css|js|svg|png|ico|jpg|jpeg|webp|gif|woff2?|ttf)$/;
+
+function queryOf(url: string): string {
+  const i = url.indexOf('?');
+  return i === -1 ? '' : url.slice(i);
+}
+
+function robotsTxt(site: StandaloneSite): string {
+  const origin = standaloneSiteOrigin(site);
+  return `User-agent: *\nAllow: /\n\n# ${APEX_HOSTS[site]}\nSitemap: ${origin}/sitemap.xml\n`;
+}
+
+function sitemapXml(site: StandaloneSite): string {
+  const origin = standaloneSiteOrigin(site);
+  const paths = site === 'brandjson' ? ['/', '/builder'] : ['/'];
+  const urls = paths.map((p) => `  <url><loc>${origin}${p}</loc></url>`).join('\n');
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${urls}\n</urlset>\n`;
+}
+
+function llmsTxt(site: StandaloneSite): string {
+  if (site === 'brandjson') {
+    return [
+      '# brand.json',
+      '',
+      '> An open standard for publishing brand identity at /.well-known/brand.json so AI agents can find it. Stewarded by AgenticAdvertising.org.',
+      '',
+      '- [Builder and validator](https://brandjson.org/builder): create or check a brand.json',
+      '- [Specification](https://docs.adcontextprotocol.org/docs/brand-protocol/brand-json)',
+      '- [JSON Schema](https://brandjson.org/schemas/v3/brand.json)',
+      '',
+    ].join('\n');
+  }
+  return [
+    '# trust.json',
+    '',
+    '> Draft open standard for publishing which agents an organization runs, their keys, and who may act on its behalf, at /.well-known/trust.json. Stewarded by AgenticAdvertising.org.',
+    '',
+    '- [RFC](https://github.com/adcontextprotocol/adcp/issues/7809)',
+    '- [Draft specification](https://github.com/adcontextprotocol/adcp/pull/7819)',
+    '',
+  ].join('\n');
+}
+
+/**
+ * Decide how to handle a request on a standalone site host.
+ * `path` is req.path; `url` is req.originalUrl (path + query).
+ */
+export function resolveStandaloneRequest(
+  site: StandaloneSite,
+  hostname: string,
+  method: string,
+  path: string,
+  url: string,
+): StandaloneDecision {
+  const apex = APEX_HOSTS[site];
+  if (hostname.toLowerCase() !== apex) {
+    return { kind: 'redirect', status: 301, location: `https://${apex}${url}` };
+  }
+
+  if (path === '/robots.txt') return { kind: 'text', contentType: 'text/plain; charset=utf-8', body: robotsTxt(site) };
+  if (path === '/sitemap.xml') return { kind: 'text', contentType: 'application/xml; charset=utf-8', body: sitemapXml(site) };
+  if (path === '/llms.txt' || path === '/.well-known/llms.txt') {
+    return { kind: 'text', contentType: 'text/plain; charset=utf-8', body: llmsTxt(site) };
+  }
+
+  if (STATIC_ASSET.test(path) && (method === 'GET' || method === 'HEAD')) return { kind: 'pass' };
+  if (path.startsWith('/schemas/')) return { kind: 'pass' };
+
+  if (site === 'trustjson') {
+    if (path === '/' || path === '/index.html') return { kind: 'page', file: 'sites/trustjson/index.html' };
+    return { kind: 'not_found' };
+  }
+
+  // brandjson
+  if (path === '/' || path === '/index.html') return { kind: 'page', file: 'sites/brandjson/index.html' };
+  if (path === '/builder' || path === '/builder/') {
+    return { kind: 'rewrite', url: `/brand/builder${queryOf(url)}` };
+  }
+  if (path === '/spec') {
+    return { kind: 'redirect', status: 302, location: 'https://docs.adcontextprotocol.org/docs/brand-protocol/brand-json' };
+  }
+  if (path.startsWith('/view/')) {
+    return { kind: 'redirect', status: 302, location: `${AAO_ORIGIN}/brand${url}` };
+  }
+  // Public, unauthenticated reads the builder uses. Writes and anything
+  // session-bound stay on agenticadvertising.org.
+  if ((method === 'GET' || method === 'HEAD') && path.startsWith('/api/brands/')) return { kind: 'pass' };
+  if ((method === 'GET' || method === 'HEAD') && path === '/api/config') return { kind: 'pass' };
+  if (path.startsWith('/api/')) return { kind: 'not_found' };
+
+  return { kind: 'redirect', status: 301, location: `${AAO_ORIGIN}${url}` };
+}
diff --git a/server/tests/unit/standalone-sites-route.test.ts b/server/tests/unit/standalone-sites-route.test.ts
new file mode 100644
index 00000000000..1f7e83e268a
--- /dev/null
+++ b/server/tests/unit/standalone-sites-route.test.ts
@@ -0,0 +1,99 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import request from 'supertest';
+import { HTTPServer } from '../../src/http.js';
+
+const ORIGINAL_WORKOS_ENV = vi.hoisted(() => ({
+  apiKey: process.env.WORKOS_API_KEY,
+  clientId: process.env.WORKOS_CLIENT_ID,
+}));
+
+vi.hoisted(() => {
+  process.env.WORKOS_API_KEY = process.env.WORKOS_API_KEY || 'sk_test_public_brand_json_route';
+  process.env.WORKOS_CLIENT_ID = process.env.WORKOS_CLIENT_ID || 'client_test_public_brand_json_route';
+});
+
+vi.mock('../../src/config.js', async () => {
+  const actual = await vi.importActual('../../src/config.js');
+  return {
+    ...actual,
+    getDatabaseConfig: vi.fn().mockReturnValue({
+      connectionString: 'postgresql://localhost/test',
+    }),
+  };
+});
+
+vi.mock('../../src/db/client.js', () => ({
+  initializeDatabase: vi.fn(),
+  getPool: vi.fn().mockReturnValue({ query: vi.fn() }),
+  isDatabaseInitialized: vi.fn().mockReturnValue(true),
+  closeDatabase: vi.fn(),
+  healthCheck: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('../../src/db/migrate.js', () => ({
+  runMigrations: vi.fn().mockResolvedValue(undefined),
+}));
+
+describe('standalone standard sites (real server)', () => {
+  let server: HTTPServer | undefined;
+
+  afterEach(async () => {
+    await server?.stop();
+    server = undefined;
+    if (ORIGINAL_WORKOS_ENV.apiKey === undefined) {
+      delete process.env.WORKOS_API_KEY;
+    } else {
+      process.env.WORKOS_API_KEY = ORIGINAL_WORKOS_ENV.apiKey;
+    }
+    if (ORIGINAL_WORKOS_ENV.clientId === undefined) {
+      delete process.env.WORKOS_CLIENT_ID;
+    } else {
+      process.env.WORKOS_CLIENT_ID = ORIGINAL_WORKOS_ENV.clientId;
+    }
+  });
+
+  function app() {
+    server = new HTTPServer();
+    return (server as unknown as { app: unknown }).app;
+  }
+
+  it('serves the brandjson.org landing page with neutral-chrome marker', async () => {
+    const res = await request(app()).get('/').set('Host', 'brandjson.org');
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('<link rel="canonical" href="https://brandjson.org/">');
+    expect(res.text).toContain('window.__ADCP_SITE__="brandjson"');
+  });
+
+  it('serves the builder at brandjson.org/builder', async () => {
+    const res = await request(app()).get('/builder?domain=acme.example').set('Host', 'brandjson.org');
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('id="host-with-aao-btn"');
+    expect(res.text).toContain('window.__ADCP_SITE__="brandjson"');
+  });
+
+  it('does not expose the AAO app on brandjson.org', async () => {
+    const res = await request(app()).get('/dashboard').set('Host', 'brandjson.org');
+    expect(res.status).toBe(301);
+    expect(res.headers.location).toBe('https://agenticadvertising.org/dashboard');
+  });
+
+  it('redirects www.brandjson.org to the apex', async () => {
+    const res = await request(app()).get('/builder').set('Host', 'www.brandjson.org');
+    expect(res.status).toBe(301);
+    expect(res.headers.location).toBe('https://brandjson.org/builder');
+  });
+
+  it('serves the trustjson.org landing page and 404s app paths', async () => {
+    const landing = await request(app()).get('/').set('Host', 'trustjson.org');
+    expect(landing.status).toBe(200);
+    expect(landing.text).toContain('window.__ADCP_SITE__="trustjson"');
+    const other = await request(app()).get('/registry').set('Host', 'trustjson.org');
+    expect(other.status).toBe(404);
+  });
+
+  it('leaves agenticadvertising.org pages without the standalone marker', async () => {
+    const res = await request(app()).get('/brand/builder').set('Host', 'agenticadvertising.org');
+    expect(res.status).toBe(200);
+    expect(res.text).not.toContain('window.__ADCP_SITE__=');
+  });
+});
diff --git a/server/tests/unit/standalone-sites.test.ts b/server/tests/unit/standalone-sites.test.ts
new file mode 100644
index 00000000000..64836fed2c9
--- /dev/null
+++ b/server/tests/unit/standalone-sites.test.ts
@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest';
+import { getStandaloneSite, resolveStandaloneRequest } from '../../src/standalone-sites.js';
+
+const brand = (method: string, url: string, host = 'brandjson.org') =>
+  resolveStandaloneRequest('brandjson', host, method, url.split('?')[0], url);
+const trust = (method: string, url: string, host = 'trustjson.org') =>
+  resolveStandaloneRequest('trustjson', host, method, url.split('?')[0], url);
+
+describe('getStandaloneSite', () => {
+  it('recognizes apex and www hosts only', () => {
+    expect(getStandaloneSite('brandjson.org')).toBe('brandjson');
+    expect(getStandaloneSite('WWW.BRANDJSON.ORG')).toBe('brandjson');
+    expect(getStandaloneSite('trustjson.org')).toBe('trustjson');
+    expect(getStandaloneSite('agenticadvertising.org')).toBeNull();
+    expect(getStandaloneSite('evil-brandjson.org')).toBeNull();
+    expect(getStandaloneSite(undefined)).toBeNull();
+  });
+});
+
+describe('resolveStandaloneRequest: brandjson.org', () => {
+  it('redirects www to the apex, keeping the path and query', () => {
+    expect(brand('GET', '/builder?domain=acme.example', 'www.brandjson.org')).toEqual({
+      kind: 'redirect', status: 301, location: 'https://brandjson.org/builder?domain=acme.example',
+    });
+  });
+
+  it('serves the landing page and maps /builder onto the existing builder route', () => {
+    expect(brand('GET', '/')).toEqual({ kind: 'page', file: 'sites/brandjson/index.html' });
+    expect(brand('GET', '/builder?domain=acme.example')).toEqual({ kind: 'rewrite', url: '/brand/builder?domain=acme.example' });
+  });
+
+  it('passes schemas, static assets, and public brand reads', () => {
+    expect(brand('GET', '/schemas/v3/brand.json').kind).toBe('pass');
+    expect(brand('GET', '/design-system.css').kind).toBe('pass');
+    expect(brand('GET', '/sites/standard-site.css').kind).toBe('pass');
+    expect(brand('GET', '/api/brands/resolve?domain=acme.example').kind).toBe('pass');
+  });
+
+  it('keeps writes and other APIs off the site', () => {
+    expect(brand('POST', '/api/brands/setup-my-brand').kind).toBe('not_found');
+    expect(brand('GET', '/api/me/portrait').kind).toBe('not_found');
+    expect(brand('POST', '/design-system.css').kind).not.toBe('pass');
+  });
+
+  it('sends the viewer and everything else to agenticadvertising.org', () => {
+    expect(brand('GET', '/view/acme.example')).toEqual({
+      kind: 'redirect', status: 302, location: 'https://agenticadvertising.org/brand/view/acme.example',
+    });
+    expect(brand('GET', '/registry?tab=brands')).toEqual({
+      kind: 'redirect', status: 301, location: 'https://agenticadvertising.org/registry?tab=brands',
+    });
+  });
+
+  it('answers robots.txt, sitemap.xml, and llms.txt for its own host', () => {
+    const robots = brand('GET', '/robots.txt');
+    expect(robots.kind).toBe('text');
+    expect(robots.kind === 'text' && robots.body).toContain('https://brandjson.org/sitemap.xml');
+    const llms = brand('GET', '/llms.txt');
+    expect(llms.kind === 'text' && llms.body).toContain('# brand.json');
+  });
+});
+
+describe('resolveStandaloneRequest: trustjson.org', () => {
+  it('serves only its landing page, schemas, and assets', () => {
+    expect(trust('GET', '/')).toEqual({ kind: 'page', file: 'sites/trustjson/index.html' });
+    expect(trust('GET', '/schemas/v3/brand.json').kind).toBe('pass');
+    expect(trust('GET', '/builder').kind).toBe('not_found');
+    expect(trust('GET', '/api/brands/resolve').kind).toBe('not_found');
+    expect(trust('GET', '/registry').kind).toBe('not_found');
+  });
+});