{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:f94358e3c57b6e575ca58c8031b9b7552cbfdb411f937b8ecdc3b042c4980a77", "snapshot_id": "sha256:0679a3f0d41c0733e76d10ab3fb1b331811893c7d428749740ec0f21ac731d3e", "artifact_sha256": "sha256:7472396c2449279d33e7a0fb2426f02a89991501262d1db8c04c81d57bdf9021", "data": { "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea", "entity_slug": "neon", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xc6w3hq8r2f9bj5nta", "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea", "scope": { "product": { "key": "neon-api", "name": "Neon API" }, "funnel": { "key": "project-database-lifecycle", "name": "Project and database lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:cad9f851ab1bb553246eb2fb2b2803a4741814a33ccf28997014247439b9013d", "entity_revision_digest": "sha256:f7efa8be65ed9dd1e5649201793fa6c168f217b8886de5764e635ced89e485cd" }, "declaration_revision_digest": "sha256:aa7e9acb167fe90a50fff00c79fef920a5a8f831444401e6a97b73f3b922d798", "declaration": { "declaration_id": "declaration_neon_api_project_database_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "62b512f0c49352e55a399ba53866a5effa431d71", "path": "vendors/ne/neon.yaml", "git_blob_oid": "06dbd80ec662ce8f5a198d7bd50c9404cecdb3f2", "blob_digest": "sha256:4f1776434097c3e2b4fde5c0ddf8696ce4e22cf7212ac89c7d752985c13f666e" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage Neon projects and databases through the API", "interface_ids": [ "project-api" ] } ], "participants": [ { "participant_id": "neon", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea" } } ], "resources": [ { "resource_id": "api-keys", "uri": "https://neon.com/docs/manage/api-keys", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://api-docs.neon.tech/reference/getting-started-with-neon-api", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://neon.com/docs/introduction/plans", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "branch-operations", "uri": "https://neon.com/docs/manage/branches", "roles": [ "documentation", "operations", "provisioning", "recovery", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "console-signup", "uri": "https://console.neon.tech/signup", "roles": [ "access" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "create-project", "uri": "https://api-docs.neon.tech/reference/createproject", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://neon.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "project-operations", "uri": "https://neon.com/docs/manage/projects", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231", "uri": "https://neon.com/docs/manage/accounts", "roles": [ "access", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8", "uri": "https://neon.com/docs/introduction/manage-billing", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://neon.com/terms-of-service", "roles": [ "terms" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://neon.com/docs/introduction/support", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "neon-api", "uri": "https://console.neon.tech/api/v2", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "endpoint_id": "registration", "uri": "https://console.neon.tech/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "api-keys" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "interface_id": "project-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "neon-api" ], "resource_ids": [ "api-reference", "branch-operations", "create-project", "project-operations" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "projects-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "create-project" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "console-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-08-20T14:33:24.000Z", "revision_digest": "sha256:2c1379ef65b4f98e3cc5446c5e5d9836a1e3b6ec09a962398c99cc4f67eca8ab", "policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "policy_version": "service-use-2026-08-20-public-evidence-r9", "policy_as_of": "2026-08-20T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "C+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect actual Blocked stages by lifecycle severity.", "coverage_rule": "Every core graded metric must have supported, fresh, non-conflicting evidence. Barrier checks constrain the report when verified and cap an otherwise higher grade at B+ while unverified.", "outcome_rule": "Each stage takes its worst core metric or verified barrier, and the overall grade is derived from the five stage states plus the explicit unverified-barrier cap." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "evaluate", "stage_label": "Evaluate", "public_state": "limited", "finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The Product Specific Schedule for Neon Cloud Computing Platform Services is retrievable, but explicitly incorporates the then-current Databricks Master Cloud Services Agreement located at https://www.databricks.com/legal/mcsa and usage-based plan documentation located at https://neon.com/docs/introduction/plans." } }, "limitations": [ { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The Product Specific Schedule for Neon Cloud Computing Platform Services is retrievable, but explicitly incorporates the then-current Databricks Master Cloud Services Agreement located at https://www.databricks.com/legal/mcsa and usage-based plan documentation located at https://neon.com/docs/introduction/plans." }, "remediation": { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." } }, { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "The Product Specific Schedule governs Customer's use of Databricks' Neon product family. Accessing Platform Services binds the customer to the Schedule, and individuals entering into it on behalf of a company represent and warrant that they are authorized to bind that legal entity." }, "remediation": { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." } }, { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Neon supports Personal, Organization, and Project-scoped API keys with specific access scopes and immediate revocation capabilities, but creating the initial API key requires manual action in the Neon Console where the secret token is displayed only once." }, "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "When creating API keys from the Neon Console, the secret token is displayed only once and cannot be retrieved later. Users must manually copy it immediately and store it securely." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "When creating a project via API, a 201 response returns a project object with connection details, but users must wait for background operations to finish before connecting. Branch creation exposes asynchronous operation progress statuses like 'running' and 'scheduling'." }, "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Neon API exposes asynchronous operations with an explicit failure count and operational state tracking (such as running or scheduling) for branch and project actions. However, full safe retry, cancellation, idempotency, and reconciliation semantics across all failure modes are not completely detailed in the provided documentation." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Neon documents creating and revoking API keys, as well as manually rotating them by creating a replacement and revoking the old key. Revocation is immediate and permanent, and compromised keys should be revoked immediately. However, API keys do not expire or rotate on a schedule." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The Product Specific Schedule for Neon Cloud Computing Platform Services is retrievable, but explicitly incorporates the then-current Databricks Master Cloud Services Agreement located at https://www.databricks.com/legal/mcsa and usage-based plan documentation located at https://neon.com/docs/introduction/plans." }, "secondary_context": [ { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "The Product Specific Schedule governs Customer's use of Databricks' Neon product family. Accessing Platform Services binds the customer to the Schedule, and individuals entering into it on behalf of a company represent and warrant that they are authorized to bind that legal entity." }, { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Neon API reference provides the exact service endpoints and base URL (https://console.neon.tech/api/v2/), along with links to the Neon OpenAPI Specification in JSON format." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Neon pricing establishes a Free plan at $0 with specific limits (100 projects, 100 CU-hrs monthly per project, 0.5 GB storage per project) with no credit card required, as well as paid usage pricing details such as extra branches billed at $1.50 per extra branch-month ($0.002 per hour)." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:01.506Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e91204dcd8b1d965db432c583843710f6a9faac893c902b88d7d00aa1ccf2393", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1ced8032a21a6db190d7d5262c7f87f5ca61a6e6c7a579357e1973d68679dd08", "sha256:3df89f0cc9cb3acb753538c7d0c82323587ed7588944c168b3d31121fe8dbdcf", "sha256:5612fd0cf4de0bf169bca8952c02fe2fa65c5b646c7c50f1dd664f44f7af1275", "sha256:c85742301de66e30f495148e7368f428bcb785195dd756fced941b95d96ba0a5" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:3df89f0cc9cb3acb753538c7d0c82323587ed7588944c168b3d31121fe8dbdcf", "start_byte": 6970, "end_byte": 7765, "value_digest": "sha256:aaa2f6acd65d6d4d5881c7340bc81b80785e8aedacab0b55d527cf83610a7b90" } ] } ], "note": "The Product Specific Schedule governs Customer's use of Databricks' Neon product family. Accessing Platform Services binds the customer to the Schedule, and individuals entering into it on behalf of a company represent and warrant that they are authorized to bind that legal entity.", "remediation": { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." } }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:02.772Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b5b68298734ba5285afd47d7caa377c9f918a7d5ed908e95161ef8670a86890f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5786b82b544ef6468fe107ff45e8d06aaf1e8fcbdc14705dba1a19f892029763", "sha256:a563582e51e210efbb28da39d2bbdf0dec6f99ad57117a272ea562fdfb5d3e18" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "start_byte": 19484, "end_byte": 20279, "value_digest": "sha256:cb5fb60d9e654a9705eb7c3adc9ee6f40d8dd0cf35d979b87504a2e8807b5c18" }, { "artifact_digest": "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "start_byte": 7542, "end_byte": 8341, "value_digest": "sha256:c90956798355e238ae9db215cb69bf48080dac695b1298175fc9cf8d4cdbc299" } ] } ], "note": "Neon pricing establishes a Free plan at $0 with specific limits (100 projects, 100 CU-hrs monthly per project, 0.5 GB storage per project) with no credit card required, as well as paid usage pricing details such as extra branches billed at $1.50 per extra branch-month ($0.002 per hour)." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:02.068Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a038053a373b02789674a53c0c806cd42cc25b74f3dd8a036b7a01ea601ae4c1", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5b810151fabf3b8387279a40638ebc61058d6678d552a7c15837f450ce1e443a", "sha256:7bf8d57096dec5f1a4e2c599eeebf2e061bc14f306fbd5f5d0a9c7133c4e075d", "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5", "start_byte": 14841, "end_byte": 15639, "value_digest": "sha256:ad7390bf085fc610a70de9cc5ee16c91d96274d9f02f5c02ee4756038860b4ab" }, { "artifact_digest": "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5", "start_byte": 20413, "end_byte": 21215, "value_digest": "sha256:826d39045128b0c2e17c5be8cffaa2bb0e4be48470c86d9d93c3b5c836a99a5d" } ] } ], "note": "The Neon API reference provides the exact service endpoints and base URL (https://console.neon.tech/api/v2/), along with links to the Neon OpenAPI Specification in JSON format." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "terms_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:01.506Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e91204dcd8b1d965db432c583843710f6a9faac893c902b88d7d00aa1ccf2393", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1ced8032a21a6db190d7d5262c7f87f5ca61a6e6c7a579357e1973d68679dd08", "sha256:3df89f0cc9cb3acb753538c7d0c82323587ed7588944c168b3d31121fe8dbdcf", "sha256:b36a041c5d8a3a0f15a1ad59391f56a72feb9cd61cd1869b3808b0bf8af798e5", "sha256:c85742301de66e30f495148e7368f428bcb785195dd756fced941b95d96ba0a5" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:3df89f0cc9cb3acb753538c7d0c82323587ed7588944c168b3d31121fe8dbdcf", "start_byte": 6970, "end_byte": 7765, "value_digest": "sha256:aaa2f6acd65d6d4d5881c7340bc81b80785e8aedacab0b55d527cf83610a7b90" }, { "artifact_digest": "sha256:3df89f0cc9cb3acb753538c7d0c82323587ed7588944c168b3d31121fe8dbdcf", "start_byte": 8562, "end_byte": 9356, "value_digest": "sha256:daa3c3b5e35bd89e94de0fd1a97d9fac1fea200a7d2cef1b32acd55f9a23f10f" } ] } ], "note": "The Product Specific Schedule for Neon Cloud Computing Platform Services is retrievable, but explicitly incorporates the then-current Databricks Master Cloud Services Agreement located at https://www.databricks.com/legal/mcsa and usage-based plan documentation located at https://neon.com/docs/introduction/plans.", "remediation": { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." } }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] } ], "blockers": [], "remediations": [ { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." }, { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." } ] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Neon supports Personal, Organization, and Project-scoped API keys with specific access scopes and immediate revocation capabilities, but creating the initial API key requires manual action in the Neon Console where the secret token is displayed only once." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup endpoint for console.neon.tech returned an HTTP 403 Cloudflare security verification challenge page, leaving the operability of the access controls unresolved in the admissible evidence." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "A captured Cloudflare security response does not establish a mandatory CAPTCHA across the actual registration flow." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation details password changes, two-factor authentication via authenticator apps, and passkeys, but does not state phone verification requirements." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Neon documentation provides stable canonical navigation entrypoints to Log in and Sign up to begin obtaining service access." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:02.682Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The signup endpoint for console.neon.tech returned an HTTP 403 Cloudflare security verification challenge page, leaving the operability of the access controls unresolved in the admissible evidence." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.828Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:274565ca5887febf622bea4814448e97400d1f615bca3431fca128fb4f2ac478", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:3ed02d29a5ef809cb4fb6f66beef90c9c822125d1bd51ca754cef2453a99de5d", "sha256:4e6713d3308565742309bad568391d1b45990f1ec90d45d1a280574af6ef9e27", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:505ff18bc9a593dea623cf0f9837ec00d6c7b1c7a15f05bcea5e99f7d1874daa", "sha256:64fa331015cbb7d721f7614013654ba5260a05b0f6c95f49c7122bcfe4e1d3cc", "sha256:686bdaceb611712897a8496af7d7a72a134403ae8297d8fba8d5c81a744fa3e6" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" }, "locators": [ { "artifact_digest": "sha256:3ed02d29a5ef809cb4fb6f66beef90c9c822125d1bd51ca754cef2453a99de5d", "start_byte": 7332, "end_byte": 8121, "value_digest": "sha256:2ea9753f31f7176f0555fc78a3a64a62b171267aff99aaef6c9f8e37902f13bb" } ] } ], "note": "Neon documentation provides stable canonical navigation entrypoints to Log in and Sign up to begin obtaining service access." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:02.682Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "A captured Cloudflare security response does not establish a mandatory CAPTCHA across the actual registration flow." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:28.533Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:612538cbc733e7aa333ccb665242497f4c56283fce03c239dadbc3c4f6857994", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4575d79022dac37cb811b4b9706b98337b1525e3eace0f034c4459c4efc80104", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c9ff185b6523c6e54ddd28bc376258cf368d2369634a4cdc3285f4d2e5c2dea9", "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 14450, "end_byte": 15246, "value_digest": "sha256:d4507938a847ceaf6c6e7056f086cc8ef77a4d1f982a703efada38941b55cae0" }, { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 9078, "end_byte": 9868, "value_digest": "sha256:4ac4e9d2aad38bd458c340171bbd3dd494fb27c370b57f9a5ed53cfb041f1cfb" } ] } ], "note": "Neon supports Personal, Organization, and Project-scoped API keys with specific access scopes and immediate revocation capabilities, but creating the initial API key requires manual action in the Neon Console where the secret token is displayed only once.", "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.828Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The retained documentation details password changes, two-factor authentication via authenticator apps, and passkeys, but does not state phone verification requirements." } ], "blockers": [], "remediations": [ { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "Neon discloses its pricing structure on the pricing page. The Free plan is $0, while the Launch plan ($0.106 per CU-hour) and Scale plan ($0.222 per CU-hour) are usage-based ('Pay for what you use') with USD currency and specific hourly compute rates." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Admitted evidence describes plan pricing and billing management options in the Neon Console, but does not document an API, protocol, or web flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Retained evidence outlines billing methods, auto-debit on the first day of the month, and manual invoice payment by account owners/admins, but does not define a documented authorization rail for scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Neon documentation provides a direct self-service path to paid access. Users can start for free and change plans (Launch or Scale) or update payment methods directly from the Billing page in the Neon Console without a required vendor decision point." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:44.133Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "Admitted evidence describes plan pricing and billing management options in the Neon Console, but does not document an API, protocol, or web flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:02.772Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b5b68298734ba5285afd47d7caa377c9f918a7d5ed908e95161ef8670a86890f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5786b82b544ef6468fe107ff45e8d06aaf1e8fcbdc14705dba1a19f892029763", "sha256:a9948651f50d6df8ad7c86e4ba9e8331eeecc1748db5da835a107b51e38aeb0b" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "start_byte": 13898, "end_byte": 14700, "value_digest": "sha256:2123f9d154f8088e56ad82105ef5c1c8a112752d06ccab9d65f30aaa1fd52765" }, { "artifact_digest": "sha256:34b45953a0d5e7fd9ca3b8651078ea725587cd15a3d58d3bd400015715fc24cb", "start_byte": 7542, "end_byte": 8341, "value_digest": "sha256:c90956798355e238ae9db215cb69bf48080dac695b1298175fc9cf8d4cdbc299" } ] } ], "note": "Neon discloses its pricing structure on the pricing page. The Free plan is $0, while the Launch plan ($0.106 per CU-hour) and Scale plan ($0.222 per CU-hour) are usage-based ('Pay for what you use') with USD currency and specific hourly compute rates." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:44.133Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "Retained evidence outlines billing methods, auto-debit on the first day of the month, and manual invoice payment by account owners/admins, but does not define a documented authorization rail for scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:44.133Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9593e96db345228d5e17839cda051ddc039efc9c724ccfe058f59b4f560f33d9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:015976bbabe59ca31ae78042c033e8830a71975cf7e0e80b8d24a2b5603e8bee", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:814d5f44e9607ed3a9d18d5198ca4f9733100fdeb5c1f2014de3134315dae5e1", "sha256:cc5891e9a12c7b54acc58419f37f56a4ba3f49b5e7e4cb89b087fd6e1d6da6f3" ], "source_surface": { "node_kind": "resource", "node_id": "billing-checkout" }, "locators": [ { "artifact_digest": "sha256:015976bbabe59ca31ae78042c033e8830a71975cf7e0e80b8d24a2b5603e8bee", "start_byte": 8763, "end_byte": 9553, "value_digest": "sha256:12722201274e535efc144a42cc17fb51bbf7232bcc61a0c1ca05f97d5de9c812" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c137093b6eef134d39d439f213bd2aed4e262f58f7d1b6b0c6aa101f3cf4f6cf", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:60d745c4e64d67288e23b8dbff2d183d215fec918d526076f3d26040ea336fc7", "sha256:863a1a863b57724cda4aae4fadc10d06bc89d891093b3a31b9c25f863de0b21e", "sha256:98b6b5ff99db191b42d70bfd9a2754112c5126942030fdba20418f2264a9438b" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" }, "locators": [ { "artifact_digest": "sha256:98b6b5ff99db191b42d70bfd9a2754112c5126942030fdba20418f2264a9438b", "start_byte": 6544, "end_byte": 7342, "value_digest": "sha256:cb206dfa1cea7e3e3ec253d9aa6df9ba9e34fe170ec20f8f89aca5fe64df878b" } ] } ], "note": "Neon documentation provides a direct self-service path to paid access. Users can start for free and change plans (Launch or Scale) or update payment methods directly from the Billing page in the Neon Console without a required vendor decision point." } ], "blockers": [], "remediations": [] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "When creating API keys from the Neon Console, the secret token is displayed only once and cannot be retrieved later. Users must manually copy it immediately and store it securely." }, "secondary_context": [ { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "When creating a project via API, a 201 response returns a project object with connection details, but users must wait for background operations to finish before connecting. Branch creation exposes asynchronous operation progress statuses like 'running' and 'scheduling'." }, { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Provisioning can be initiated programmatically within supported agent authority via the Neon API, such as calling POST /projects to create a project or POST /projects/{project_id}/branches to create a branch." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:28.533Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:612538cbc733e7aa333ccb665242497f4c56283fce03c239dadbc3c4f6857994", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5ccd617eca3a6725a3472da5ac80d27c5d9d7fa4da6dabaa9a8fd37febb93f97", "sha256:c9ff185b6523c6e54ddd28bc376258cf368d2369634a4cdc3285f4d2e5c2dea9", "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 10670, "end_byte": 11469, "value_digest": "sha256:54a5b181a7e8c55a48fe8058276f499b5d72c8c451d50282272ebac8e046fc46" } ] } ], "note": "When creating API keys from the Neon Console, the secret token is displayed only once and cannot be retrieved later. Users must manually copy it immediately and store it securely.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:03.190Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "create-project" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a0869f49a37eefbde132dabf29b31cb1e6c9d816ed45866d07c00252aa76c3fe", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c189cd4ac5c56bfadf616f6d05c01dbe2063ddbe8ea1db39794aa6896a45ac3", "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "sha256:e2d70f407b28a2c0e180dddecbbf91e833138bf5c66b53d00cd6ab46dc122900" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "start_byte": 30430, "end_byte": 31230, "value_digest": "sha256:d55093cdda50935ef1c6986ac57caafe4369252d02cccaf51c5a545fdac34d07" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:15c932ef611dfb2cc338ae8af6cc505fe7e716c590c271caac132e3984045408", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1b796a4307f9328206ed22cb20fc1921774105a786bd0bb2cf4bf9f26ce5b3d7", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "sha256:e044d3754c1f572f1c2daa5fe09050830263066f192dbc6c5d0d7dd142cd9665" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "start_byte": 22961, "end_byte": 23760, "value_digest": "sha256:cee90e6893651e6b9a2c0c18fbcbf28899cd857769d21a1cedf99e5b8c60d1d7" } ] } ], "note": "When creating a project via API, a 201 response returns a project object with connection details, but users must wait for background operations to finish before connecting. Branch creation exposes asynchronous operation progress statuses like 'running' and 'scheduling'.", "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:03.190Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" }, { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "create-project" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a0869f49a37eefbde132dabf29b31cb1e6c9d816ed45866d07c00252aa76c3fe", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2a7a470cf651d7caca3cae8f30acb8fe5f3a47c4a7d467c340188807c7200dc3", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c189cd4ac5c56bfadf616f6d05c01dbe2063ddbe8ea1db39794aa6896a45ac3", "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "start_byte": 27307, "end_byte": 28030, "value_digest": "sha256:1d73afc80462fb0e0acd1192eadd1a9e393130ea5cad55c014730055a76ceb0f" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:15c932ef611dfb2cc338ae8af6cc505fe7e716c590c271caac132e3984045408", "capture_rung": "http" } ], "artifact_digests": [ "sha256:34b47b172a19308a01c5bab55cc498d080cfa34f987671fdd1cc4fedf5abe2d8", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "sha256:e044d3754c1f572f1c2daa5fe09050830263066f192dbc6c5d0d7dd142cd9665" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "start_byte": 22161, "end_byte": 22960, "value_digest": "sha256:36b93e26331b22de43d0d67d32ee702db1d8152278019b8cef2b50bd3a479b80" } ] } ], "note": "Provisioning can be initiated programmatically within supported agent authority via the Neon API, such as calling POST /projects to create a project or POST /projects/{project_id}/branches to create a branch." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." }, { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Neon API exposes asynchronous operations with an explicit failure count and operational state tracking (such as running or scheduling) for branch and project actions. However, full safe retry, cancellation, idempotency, and reconciliation semantics across all failure modes are not completely detailed in the provided documentation." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Neon documents creating and revoking API keys, as well as manually rotating them by creating a replacement and revoking the old key. Revocation is immediate and permanent, and compromised keys should be revoked immediately. However, API keys do not expire or rotate on a schedule." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target—including project management, branch operations, and API key management—has documented, agent-usable HTTP REST API endpoints." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Neon supports request-time API key authentication via the standard HTTP Authorization header using the Bearer scheme (`Authorization: Bearer $NEON_API_KEY`). API keys can be scoped to personal, organization, or single project access." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "The Neon API provides stable, readable endpoints, schemas, request parameters, response objects, and HTTP status code behaviors for essential operations such as managing projects, branches, and API keys." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:28.533Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:612538cbc733e7aa333ccb665242497f4c56283fce03c239dadbc3c4f6857994", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4575d79022dac37cb811b4b9706b98337b1525e3eace0f034c4459c4efc80104", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c9ff185b6523c6e54ddd28bc376258cf368d2369634a4cdc3285f4d2e5c2dea9", "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 14450, "end_byte": 15246, "value_digest": "sha256:d4507938a847ceaf6c6e7056f086cc8ef77a4d1f982a703efada38941b55cae0" }, { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 9078, "end_byte": 9868, "value_digest": "sha256:4ac4e9d2aad38bd458c340171bbd3dd494fb27c370b57f9a5ed53cfb041f1cfb" } ] } ], "note": "Neon documents creating and revoking API keys, as well as manually rotating them by creating a replacement and revoking the old key. Revocation is immediate and permanent, and compromised keys should be revoked immediately. However, API keys do not expire or rotate on a schedule.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:03.190Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "project-operations" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a0869f49a37eefbde132dabf29b31cb1e6c9d816ed45866d07c00252aa76c3fe", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c189cd4ac5c56bfadf616f6d05c01dbe2063ddbe8ea1db39794aa6896a45ac3", "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "sha256:e2d70f407b28a2c0e180dddecbbf91e833138bf5c66b53d00cd6ab46dc122900" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "start_byte": 30430, "end_byte": 31230, "value_digest": "sha256:d55093cdda50935ef1c6986ac57caafe4369252d02cccaf51c5a545fdac34d07" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e581c29c7a90132d3130f385e95784038f8286b7cf4cd5a7a4efb417e61b703b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0a355b09baafeba4018b1d844fddfdc7298324e049d69923ec7146b7405b6a52", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7a4d696df0d3d824125d864bf7fe0496b841f308bf6523d8cb979fcc1e6bb482", "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b", "start_byte": 28712, "end_byte": 29512, "value_digest": "sha256:1ec5c89b456413aef89af0bd2c037d53a438545c0383d0a1d85a103d264e0108" } ] } ], "note": "Neon API exposes asynchronous operations with an explicit failure count and operational state tracking (such as running or scheduling) for branch and project actions. However, full safe retry, cancellation, idempotency, and reconciliation semantics across all failure modes are not completely detailed in the provided documentation.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:28.533Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:612538cbc733e7aa333ccb665242497f4c56283fce03c239dadbc3c4f6857994", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c9ff185b6523c6e54ddd28bc376258cf368d2369634a4cdc3285f4d2e5c2dea9", "sha256:cf38b0f5223d4e265198ed1b32e8f45014a8c5901ed660500f57c0606804ba74", "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 12265, "end_byte": 13041, "value_digest": "sha256:e960012e810931f5333cca7cb4aadd1c8f0dff450c54561f22c9ad655327dc2b" }, { "artifact_digest": "sha256:d8d33a1a532f0cdbb163f4a817a1f9cd2fa3636eae0332f15a1aec6241e8d999", "start_byte": 9078, "end_byte": 9868, "value_digest": "sha256:4ac4e9d2aad38bd458c340171bbd3dd494fb27c370b57f9a5ed53cfb041f1cfb" } ] } ], "note": "Neon supports request-time API key authentication via the standard HTTP Authorization header using the Bearer scheme (`Authorization: Bearer $NEON_API_KEY`). API keys can be scoped to personal, organization, or single project access." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:03.190Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "project-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e581c29c7a90132d3130f385e95784038f8286b7cf4cd5a7a4efb417e61b703b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7a4d696df0d3d824125d864bf7fe0496b841f308bf6523d8cb979fcc1e6bb482", "sha256:7d00f804365b719e5080a85dda2f386fdfe44356a7407d7faab7078febd72432", "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b", "start_byte": 28179, "end_byte": 28711, "value_digest": "sha256:bf5a646e7d8afcdcca9edea39fcdeb55a7e37455fa8d86d05337d56414dc91e0" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:15c932ef611dfb2cc338ae8af6cc505fe7e716c590c271caac132e3984045408", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7263560d412450fea32171ab66c26855874501f6b2dae55caa34e106b2f483c0", "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "sha256:e044d3754c1f572f1c2daa5fe09050830263066f192dbc6c5d0d7dd142cd9665" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "start_byte": 23761, "end_byte": 24555, "value_digest": "sha256:01655e95be32212a29fb8e53b73a64046a12669721ce6c26b2047d3d6ffc1733" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a038053a373b02789674a53c0c806cd42cc25b74f3dd8a036b7a01ea601ae4c1", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5b810151fabf3b8387279a40638ebc61058d6678d552a7c15837f450ce1e443a", "sha256:71b7165007b28f8be4bf60a199acc2e68f75c92e835575bc99f72cbd46414cf7", "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5", "start_byte": 14841, "end_byte": 15639, "value_digest": "sha256:ad7390bf085fc610a70de9cc5ee16c91d96274d9f02f5c02ee4756038860b4ab" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a0869f49a37eefbde132dabf29b31cb1e6c9d816ed45866d07c00252aa76c3fe", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c189cd4ac5c56bfadf616f6d05c01dbe2063ddbe8ea1db39794aa6896a45ac3", "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "sha256:fd1fcb1ea8a4da726db443f2306280470213a5f922736fad2570dd9e0108adba" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "start_byte": 28830, "end_byte": 29630, "value_digest": "sha256:6427747cb70a77777536d0f82457606ba3a6241e71c2203b8f5711e27f49fdbf" } ] } ], "note": "The Neon API provides stable, readable endpoints, schemas, request parameters, response objects, and HTTP status code behaviors for essential operations such as managing projects, branches, and API keys." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:03.190Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "project-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a038053a373b02789674a53c0c806cd42cc25b74f3dd8a036b7a01ea601ae4c1", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5b810151fabf3b8387279a40638ebc61058d6678d552a7c15837f450ce1e443a", "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5", "sha256:f1a305894c9f1e8cc85b468ea178be238622fe3a3d2a7979a1c1045e4fb6bf20" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a041fbe2bc633f198183e4c97a6625232eb50586176477812829c1b42c96a8c5", "start_byte": 20413, "end_byte": 21215, "value_digest": "sha256:826d39045128b0c2e17c5be8cffaa2bb0e4be48470c86d9d93c3b5c836a99a5d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:15c932ef611dfb2cc338ae8af6cc505fe7e716c590c271caac132e3984045408", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "sha256:cb855734cd463fbe4219f5fac4402fcac15038d03e9ff4a1bb6364e038b4faee", "sha256:e044d3754c1f572f1c2daa5fe09050830263066f192dbc6c5d0d7dd142cd9665" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:912d95f5eef60e603e17b56c99e0788da628c6abf962d3de833aa23e087a9176", "start_byte": 17398, "end_byte": 18196, "value_digest": "sha256:99cb0a0625b5111d9439fc04da4cdb92c5b5ef0bb0fcb222ad905a308cfd64c4" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a0869f49a37eefbde132dabf29b31cb1e6c9d816ed45866d07c00252aa76c3fe", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c189cd4ac5c56bfadf616f6d05c01dbe2063ddbe8ea1db39794aa6896a45ac3", "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "sha256:a53e51d41c91da129f645398341e9674655158f051ac8a38735da19f86315d16" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:84aa82ffd46500cc8960c986e2ba6a6901ac9a25bc53c416e9f7d7b5ace7292e", "start_byte": 25711, "end_byte": 26510, "value_digest": "sha256:e092c58520a839c1912dfec0b46f542a0dc6d3c5983dfcbf53863066387e4fcb" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e581c29c7a90132d3130f385e95784038f8286b7cf4cd5a7a4efb417e61b703b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:78ad35f594721c5585f815fcf4190641fc94020213d51ac9248b3204fbc62e11", "sha256:7a4d696df0d3d824125d864bf7fe0496b841f308bf6523d8cb979fcc1e6bb482", "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:f9e2718db3cd2aabb8e34f885605e3bb97ad21bc51e6fc8e9af323548959271b", "start_byte": 12218, "end_byte": 13014, "value_digest": "sha256:d3b4f70346f94898a564e3ffc1bfd28f9307d6cddc1d4c108b18309084ed553e" } ] } ], "note": "Every essential target—including project management, branch operations, and API key management—has documented, agent-usable HTTP REST API endpoints." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 16, "covered_signals": 16, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh", "provenance": { "tier": "observed", "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "freshness_policy_digest": "sha256:00f7f2a35f37b184e57ce2cc116f6a5e3feb4813991aacd7e29e322f2d3607a8", "basis_event_ids": [ "sha256:040e77f28aa06d22172c14bb8c08978f6808137c52394b1ecbded17ff5f1f3c1", "sha256:04833ab10653d51b216e8d5f88825c5701ac38ec8ccdc404514debcbe551f772", "sha256:0b3736e03c8e3ede042e3745fdd16e9159e69945b4746904a3e45e130ed3e961", "sha256:1d5fa8289166d0b1706a2e35a4e5c268b28f95a80ab1b8bdfea30beb053faff4", "sha256:1eaa203393e4bd23fb85456fb61bc47f1726c6806cdad0a3f00cbe60dafeb65f", "sha256:1f2db5229bbaaad11d248661b483121d8096406e781b2673c6aea319f2077d4c", "sha256:222d97285549d31e3de5529dc758b47e8f5d1575a750d4616c189902a4d08f15", "sha256:3566c4171ad87bfc878cc2190387c3b7533666582384a7d65168f2f9235759a6", "sha256:463a2ce72a5dd2a158c7ca729bc887d6ba25a3f0e430aeddbf5b57be5323a8d3", "sha256:48c6cda8ae810d1900fa080f55e6268c84fa38b49ef0df00b55627e396e6f5cf", "sha256:555994cb386f2adf09419aa2ae289f42463f75e9516710a74158ebb556c6aa78", "sha256:62528518a02fbc0ea3f2c050e5521cda18aedf12e8188224b9bd4467d7cae891", "sha256:63c8ad58e992d6967283933b0ddcbdd6f61f56c7175b31a56d8f6879559ea300", "sha256:68b483edf1f0b4d0806a31a192bac3a6258d4226869be971168d934cb57af6f4", "sha256:6a2d2427d195c6fcf2090718ed53ac260ad047d11abd18838dea8bfd509350dc", "sha256:6e5298d13bb5941f790bde77f118b1b208413227b60c54b9884e5c0736b0829a", "sha256:7819c84139f4c58339ac3c5a659ddd7952a39a0b36916cc0854d9935179e6b76", "sha256:7db1f47f7b45be641e5ed382f360181f7f9eb625b6db5304ccd7a54e854f1949", "sha256:84ae20cb6a699c1c2dd7d817de4fd593d80591f5747fb6872d8e7461c78feb03", "sha256:8bf95c4e1888a3e31a3fdf5374aca9321522b1f92d761391fa61ac6aa1d08f0b", "sha256:8d59ee57929b5f3512e9b646c6565511580713d090b01e4ddcea9e09aa6f76f0", "sha256:919445cdba59cf76440f9637ae29044f802db298740899906c61760bc276e1c3", "sha256:971f7281d8ef772693c996930bff1c1cff2673a9509b4a962b4212801566257a", "sha256:a4f5750068b0cb0ae14ee3f7370edc3bdf02ef47b9eea607b9d432ef22cd146f", "sha256:a652a3e9b3ddf9cc1505748fde0aa305bd17533e84c0e4cc398e1a432f409a1c", "sha256:b1b05aaa5cfe48227124f732ef9e1e726e6809e472fabaed512d3ab4453bcc20", "sha256:b607ee9a29805c954a6b381a6b6ea15a2f61178ba5246f731a12e14942a8c357", "sha256:c281caa0aa0b2dc156865d8ea65ef80bb59c66a8f3c951af0dd1bfcf7b06fd67", "sha256:ca4b9f7c9b5f5cae9bfd5fbe1d61e5e64dcb6781b87b3ffa034670daa35b85ba", "sha256:cb3e019aff78bcb5955fdd8ec98ff5a8994dbaea7098578dd02c83fc9085e0de", "sha256:d175729bf698d4d9168100b5a7cf8c645059de1365c6698d8485d7a3e15e8cb2", "sha256:d76f3d1878a83beaca6a1db34558b87123a14ac7eb9092f12d3faea0d57e9036", "sha256:dd59001075ffa5ac48126aa10a9b207e28aaee4d6c75fdaf764517b31e5f0636", "sha256:e6bc90a92b465c6eb701d5d67b961efe3d6ca40100a3ec76c3d9d415b4cc757d", "sha256:f556a13cf779bdc96affc0a322186f8c4bcef656eed6c9f0978434eaf8626262" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:68b483edf1f0b4d0806a31a192bac3a6258d4226869be971168d934cb57af6f4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:01.506Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:6a2d2427d195c6fcf2090718ed53ac260ad047d11abd18838dea8bfd509350dc" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:02.772Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:d175729bf698d4d9168100b5a7cf8c645059de1365c6698d8485d7a3e15e8cb2" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:02.068Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:b607ee9a29805c954a6b381a6b6ea15a2f61178ba5246f731a12e14942a8c357" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:01.506Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:d76f3d1878a83beaca6a1db34558b87123a14ac7eb9092f12d3faea0d57e9036" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:02.682Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:7819c84139f4c58339ac3c5a659ddd7952a39a0b36916cc0854d9935179e6b76" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.828Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:0b3736e03c8e3ede042e3745fdd16e9159e69945b4746904a3e45e130ed3e961", "sha256:63c8ad58e992d6967283933b0ddcbdd6f61f56c7175b31a56d8f6879559ea300", "sha256:e6bc90a92b465c6eb701d5d67b961efe3d6ca40100a3ec76c3d9d415b4cc757d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:02.682Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:919445cdba59cf76440f9637ae29044f802db298740899906c61760bc276e1c3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:28.533Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:dd59001075ffa5ac48126aa10a9b207e28aaee4d6c75fdaf764517b31e5f0636" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.828Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:62528518a02fbc0ea3f2c050e5521cda18aedf12e8188224b9bd4467d7cae891", "sha256:a652a3e9b3ddf9cc1505748fde0aa305bd17533e84c0e4cc398e1a432f409a1c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:44.133Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:6e5298d13bb5941f790bde77f118b1b208413227b60c54b9884e5c0736b0829a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:02.772Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:222d97285549d31e3de5529dc758b47e8f5d1575a750d4616c189902a4d08f15", "sha256:555994cb386f2adf09419aa2ae289f42463f75e9516710a74158ebb556c6aa78" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:44.133Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:8d59ee57929b5f3512e9b646c6565511580713d090b01e4ddcea9e09aa6f76f0", "sha256:cb3e019aff78bcb5955fdd8ec98ff5a8994dbaea7098578dd02c83fc9085e0de" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:44.133Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:040e77f28aa06d22172c14bb8c08978f6808137c52394b1ecbded17ff5f1f3c1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:28.533Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:1eaa203393e4bd23fb85456fb61bc47f1726c6806cdad0a3f00cbe60dafeb65f", "sha256:8bf95c4e1888a3e31a3fdf5374aca9321522b1f92d761391fa61ac6aa1d08f0b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:48c6cda8ae810d1900fa080f55e6268c84fa38b49ef0df00b55627e396e6f5cf", "sha256:971f7281d8ef772693c996930bff1c1cff2673a9509b4a962b4212801566257a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:463a2ce72a5dd2a158c7ca729bc887d6ba25a3f0e430aeddbf5b57be5323a8d3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:28.533Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:04833ab10653d51b216e8d5f88825c5701ac38ec8ccdc404514debcbe551f772", "sha256:b1b05aaa5cfe48227124f732ef9e1e726e6809e472fabaed512d3ab4453bcc20" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:3566c4171ad87bfc878cc2190387c3b7533666582384a7d65168f2f9235759a6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:28.533Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:1f2db5229bbaaad11d248661b483121d8096406e781b2673c6aea319f2077d4c", "sha256:84ae20cb6a699c1c2dd7d817de4fd593d80591f5747fb6872d8e7461c78feb03", "sha256:ca4b9f7c9b5f5cae9bfd5fbe1d61e5e64dcb6781b87b3ffa034670daa35b85ba", "sha256:f556a13cf779bdc96affc0a322186f8c4bcef656eed6c9f0978434eaf8626262" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:1d5fa8289166d0b1706a2e35a4e5c268b28f95a80ab1b8bdfea30beb053faff4", "sha256:7db1f47f7b45be641e5ed382f360181f7f9eb625b6db5304ccd7a54e854f1949", "sha256:a4f5750068b0cb0ae14ee3f7370edc3bdf02ef47b9eea607b9d432ef22cd146f", "sha256:c281caa0aa0b2dc156865d8ea65ef80bb59c66a8f3c951af0dd1bfcf7b06fd67" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:03.190Z", "freshness": "fresh" } ] }, "canonical_url": "https://sourcey.com/catalog/neon/agent-readiness/neon-api/project-database-lifecycle", "projection_digest": "sha256:2a146c4a98d05800c8b85e274347b82a27008b3ce4ccd34440c54196be49e6ec" } } }