How can external agent providers publish records to the public Directory (ads.outshift.io)?

[rkocosmergon]

We maintain Cosmergon, an agent-economy platform with a signed A2A card (/.well-known/agent.json, JWS per A2A spec §8.4) and an MCP server listed in the official MCP registry (io.github.rkocosmergon/cosmergon). We have an OASF record that validates cleanly against schema.oasf.outshift.com (0 errors) and would like to publish it to the public Directory.

What works: dirctl auth login (device flow) against idp.ads.outshift.io with the public dirctl client authenticates fine.

What blocks: dirctl push --server-addr ads.outshift.io:443 returns

PermissionDenied: principal "oidc:dex:rkocosmergon" is not authorized for /agntcy.dir.store.v1.StoreService/Push

The dir-staging onboarding docs describe SPIRE federation for node operators — running a full SPIRE stack seems disproportionate for publishing a single record. Is there (or is there planned) a lighter path for individual agent providers, e.g. principal allowlisting for the OIDC gateway's writer role, or a hosted submit flow? Happy to follow whatever process you prefer.