{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn", "entity_slug": "github", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01m0ewej9qyk04qypr2mvmwmh1", "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn", "scope": { "product": { "key": "github-enterprise-server-3-21", "name": "GitHub Enterprise Server 3.21" }, "funnel": { "key": "repository-operations", "name": "Repository operations" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:984e9d33ce299c5093b358d8578a6892e03ca295907002f6ef6d3a48014088b2" }, "declaration_revision_digest": "sha256:f80d143253c99b4aef0ea4f747461a772f76950176b5c97759cc7ddc798ecd8a", "declaration": { "declaration_id": "declaration_github_enterprise_server_repository_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/gi/github.yaml", "git_blob_oid": "0b83b40b4585fc06dea240cfbb0a011157466aca", "blob_digest": "sha256:0c09cbebf72bb36436c67e2fc1d2c4c20214f564b017b173073940560eeb8ff1" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage repositories on an authorized GitHub Enterprise Server instance through the REST API", "interface_ids": [ "enterprise-repository-api" ] } ], "participants": [ { "participant_id": "github-enterprise", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn" } } ], "resources": [ { "resource_id": "enterprise-authentication", "uri": "https://docs.github.com/en/enterprise-server@3.21/rest/authentication/authenticating-to-the-rest-api", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-billing", "uri": "https://docs.github.com/en/enterprise-server@3.21/billing/concepts/enterprise-billing/billing-for-enterprises", "roles": [ "pricing" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-combined-use", "uri": "https://docs.github.com/en/enterprise-server@3.21/billing/concepts/enterprise-billing/combined-enterprise-use", "roles": [ "eligibility", "pricing" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-errors", "uri": "https://docs.github.com/en/enterprise-server@3.21/rest/using-the-rest-api/troubleshooting-the-rest-api", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-license-acquisition", "uri": "https://docs.github.com/en/enterprise-server@3.21/billing/how-tos/manage-server-licenses/download-your-license", "roles": [ "access", "checkout", "documentation" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-license-upload", "uri": "https://docs.github.com/en/enterprise-server@3.21/billing/how-tos/manage-server-licenses/upload-new-license", "roles": [ "documentation", "provisioning", "status" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-limits", "uri": "https://docs.github.com/en/enterprise-server@3.21/rest/using-the-rest-api/rate-limits-for-the-rest-api", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-overview", "uri": "https://docs.github.com/en/enterprise-server@3.21/admin/overview/about-github-enterprise-server", "roles": [ "discovery", "documentation" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-pricing", "uri": "https://github.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-repositories", "uri": "https://docs.github.com/en/enterprise-server@3.21/rest/repos/repos", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-rest", "uri": "https://docs.github.com/en/enterprise-server@3.21/rest", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-terms", "uri": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "roles": [ "terms" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-token-lifecycle", "uri": "https://docs.github.com/en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation", "roles": [ "authentication", "documentation", "recovery" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "resource_id": "enterprise-trial", "uri": "https://docs.github.com/en/enterprise-server@3.21/admin/overview/setting-up-a-trial-of-github-enterprise-server", "roles": [ "access", "documentation" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] } ], "endpoints": [], "interfaces": [ { "interface_id": "enterprise-api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "enterprise-authentication", "enterprise-token-lifecycle" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] }, { "interface_id": "enterprise-repository-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [], "resource_ids": [ "enterprise-errors", "enterprise-limits", "enterprise-repositories", "enterprise-rest" ], "operated_by_participant_id": "github-enterprise", "standard_bindings": [] } ], "relations": [ { "relation_id": "enterprise-authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "enterprise-api-authentication" }, "to": { "node_kind": "interface", "node_id": "enterprise-repository-api" } }, { "relation_id": "enterprise-license-precedes-api", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "enterprise-license-upload" }, "to": { "node_kind": "interface", "node_id": "enterprise-repository-api" } }, { "relation_id": "enterprise-repositories-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "enterprise-repositories" }, "to": { "node_kind": "interface", "node_id": "enterprise-repository-api" } }, { "relation_id": "enterprise-rest-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "enterprise-rest" }, "to": { "node_kind": "interface", "node_id": "enterprise-repository-api" } }, { "relation_id": "enterprise-trial-precedes-license", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "enterprise-trial" }, "to": { "node_kind": "resource", "node_id": "enterprise-license-upload" } } ], "surface_exclusions": [] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:cb882c0c88dcf753770efa06cc6a0e6fcc08500c8ed9546801124e3fa6078b6e", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "grade": "D", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "pay", "stage_label": "Pay", "public_state": "blocked", "finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Paid access requires opaque or unbounded sales intervention.", "context": "GitHub Enterprise Server license documentation explicitly states that purchasing, renewing, adding user licenses, or upgrading requires contacting GitHub's Sales team." }, "blocker": { "signal_code": "self_service_purchase", "code": "pay.self_service_purchase", "explanation": "Paid access requires opaque or unbounded sales intervention." } }, "first_blocked_stage": { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Paid access requires opaque or unbounded sales intervention.", "context": "GitHub Enterprise Server license documentation explicitly states that purchasing, renewing, adding user licenses, or upgrading requires contacting GitHub's Sales team." }, "blocker": { "signal_code": "self_service_purchase", "code": "pay.self_service_purchase", "explanation": "Paid access requires opaque or unbounded sales intervention." } }, "limitations": [ { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "context": "Setting up a trial of GitHub Enterprise Server involves submitting a trial request, following prompts via an emailed link, downloading a license file, and uploading it to install the instance." }, "remediation": { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } }, { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "GitHub Enterprise billing documentation discloses usage-based (metered) and volume/subscription billing models, noting that usage-based billing is billed monthly based on active users, but volume agreements and specific commercial commitments require manual setup via GitHub Sales." }, "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "GitHub Enterprise Server REST API authentication tokens can be generated (such as personal access tokens or GitHub App tokens) or created by app owners on an app settings page, where client IDs and client secrets are displayed and used to create access tokens." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Documentation establishes rate limit error codes (403 Forbidden, 429 Too Many Requests), headers (retry-after, x-ratelimit-remaining, x-ratelimit-reset), retry guidelines with exponential backoff, and timeouts (terminated after 10 seconds). Full idempotency, cancellation, and reconciliation semantics across all operations remain partially documented." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "First-party documentation establishes that tokens can expire or be revoked, and access tokens created by a GitHub App expire after eight hours and can be regenerated using a refresh token. However, a full programmatically automated credential lifecycle covering compromise response and recovery without manual intervention is not fully established." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "GitHub Enterprise Server and its REST API documentation are explicitly discoverable, including REST API overview and quickstart entrypoints." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation addresses API authentication methods and rate limits but does not declare a specific web agent access or crawler policy for the assessed resources." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "GitHub Enterprise Server combined use requires an enterprise account on GitHub Enterprise Cloud or contacting GitHub Sales to create one. For metered usage-based licensing, users must first be assigned to a GitHub Enterprise Cloud organization, and Server version 3.13+ with GitHub Connect is required." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Applicable GitHub Terms of Service are stable, readable, and retrievable, covering Account Terms, Acceptable Use, Payment, and Supplemental Terms." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "GitHub Enterprise Server can be set up at no additional cost with an enterprise account. Under metered usage-based licensing, Cloud users automatically receive a right to use Server and billing is based on active monthly users." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "Documentation explicitly states that the GitHub REST API is fully described in an OpenAPI compliant document." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:35.937Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-combined-use" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211", "capture_rung": "http" } ], "artifact_digests": [ "sha256:25b4c0e61508bcc24188aae8013b0389cba977e0a9cdf64aa2faae6a2b96f071", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-combined-use" }, "locators": [ { "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "start_byte": 10017, "end_byte": 10817, "value_digest": "sha256:0f9868a556869d8ba342063c329897fdc9f00d9ec04c600e1f1524ac81202ee6" }, { "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "start_byte": 7630, "end_byte": 8426, "value_digest": "sha256:90573e2f34ff6e840f43386c71479fcc8d26d2d26f47d5cd99860cb7ae8c9539" } ] } ], "note": "GitHub Enterprise Server combined use requires an enterprise account on GitHub Enterprise Cloud or contacting GitHub Sales to create one. For metered usage-based licensing, users must first be assigned to a GitHub Enterprise Cloud organization, and Server version 3.13+ with GitHub Connect is required." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:35.937Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-billing" }, { "node_kind": "resource", "node_id": "enterprise-combined-use" }, { "node_kind": "resource", "node_id": "enterprise-pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:90484c2bb698649cb3afdb6923ed27c5747703b6cc91b017d45f14e5f676fcee", "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-combined-use" }, "locators": [ { "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "start_byte": 10017, "end_byte": 10817, "value_digest": "sha256:0f9868a556869d8ba342063c329897fdc9f00d9ec04c600e1f1524ac81202ee6" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:194238bc96b8e61e73bc1e1285e393ecde36c266c9c0a661848ca598285fca08", "capture_rung": "http" } ], "artifact_digests": [ "sha256:41b34d86ebec3b76d92b215f2ef01c4dc3759d8e85c72b9f883b8803366d56e2", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6af8c8ba64ebe33d3350198cc2ea15e618e86309e590df0ddc13e38685eba312", "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-billing" }, "locators": [ { "artifact_digest": "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394", "start_byte": 0, "end_byte": 785, "value_digest": "sha256:7d9185ae9342a32bed3740e7b4c93bf9545bcb5d5069fef5efa8d3c81263e4b9" } ] } ], "note": "GitHub Enterprise Server can be set up at no additional cost with an enterprise account. Under metered usage-based licensing, Cloud users automatically receive a right to use Server and billing is based on active monthly users." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:34.509Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-overview" }, { "node_kind": "resource", "node_id": "enterprise-rest" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4a11590075cf4e3046a2e82233928501ba6c386772c3c9e607344d4b3658208a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65", "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-rest" }, "locators": [ { "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f", "start_byte": 16511, "end_byte": 17302, "value_digest": "sha256:0b92119d71979464ec7ec509b83ecec540de10f3fc34b14143f07e8421fceeee" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b8f602fb7f4e30cf8882a00bd091beb92e627f0809d99b8bffd8f068a800b12b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7071fb2d371b4f89f2be06a8fa2de023fb5676465fecd12d4801cff0f6e1d97d", "sha256:aac056e74b8f6e493ea69f0ba305269b8bb763e49206768b70be758b1832be28" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-overview" }, "locators": [ { "artifact_digest": "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8", "start_byte": 0, "end_byte": 797, "value_digest": "sha256:f0f45e8637e91992488d2a84b9d413d6532ea6ca9bc03b7bdf483e4816e6129f" } ] } ], "note": "GitHub Enterprise Server and its REST API documentation are explicitly discoverable, including REST API overview and quickstart entrypoints." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:10.295Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-overview" }, { "node_kind": "resource", "node_id": "enterprise-rest" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b8f602fb7f4e30cf8882a00bd091beb92e627f0809d99b8bffd8f068a800b12b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:54e2ddc32d5f6f0ad555aaf5f447d04a2ffa21b400e54d881345b48216cb9180", "sha256:7071fb2d371b4f89f2be06a8fa2de023fb5676465fecd12d4801cff0f6e1d97d" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-overview" }, "locators": [ { "artifact_digest": "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8", "start_byte": 52865, "end_byte": 53663, "value_digest": "sha256:2b646eb2899e73b46f727784d83bc9d178826ce25548ae731049ec7a04091f54" } ] } ], "note": "Documentation explicitly states that the GitHub REST API is fully described in an OpenAPI compliant document." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.769Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cb1549df31e61674815032fdcbf9714b7c22bceb9822f271a2b55e5a464459dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9ac6153eeaa180eabccfb197707d1a843a34a798acb2ab1d4a6eda78bfd08122", "sha256:f0a71675c8b95bd02fa5f079d8464619d2822e4ff47526a7c3399598688a366d" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-terms" }, "locators": [ { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 12651, "end_byte": 13446, "value_digest": "sha256:2437eceedc60d78840c78f21b0f18a7db41b8c07928f6456dd6b2f3644d32803" }, { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 38259, "end_byte": 39055, "value_digest": "sha256:7a00637cecadc781e49decd903df62050324bfe1f277e937f142f8caec52f9f0" } ] } ], "note": "Applicable GitHub Terms of Service are stable, readable, and retrievable, covering Account Terms, Acceptable Use, Payment, and Supplemental Terms." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-overview" }, { "node_kind": "resource", "node_id": "enterprise-rest" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained documentation addresses API authentication methods and rate limits but does not declare a specific web agent access or crawler policy for the assessed resources." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "context": "Setting up a trial of GitHub Enterprise Server involves submitting a trial request, following prompts via an emailed link, downloading a license file, and uploading it to install the instance." }, "secondary_context": [ { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence does not contain explicit first-party declarations or direct observations regarding CAPTCHA requirements or verified-agent alternatives." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence does not state whether phone verification is required, absent, or supported through a safe resumable boundary." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "A stable canonical trial path is documented for setting up a trial of GitHub Enterprise Server, where users submit a trial request and complete installation." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "Scoped access tokens, fine-grained personal access tokens, GitHub App tokens, and OAuth tokens can be generated and authenticated against the REST API. Tokens can expire and can be revoked by the user or application." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.722Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-license-acquisition" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" }, { "node_kind": "resource", "node_id": "enterprise-trial" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:276919b311eac6773a9d6fe97d9b97647c86130c3f5211a02cf8c3bf1db13679", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:4120ba1c59f6a9dffb8272919e2c98e80eb27c6d0a435815b1d9c4b390cdc398", "sha256:4971b68544a736457dbd1a2c5af572ff9efa33ab240a31418c4dc624d4db96c5", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8968d89976232db8fcb194f1a1cda3f9e833e20fbe75c0ffb81971e4f6cc11c1", "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "sha256:b2b31774308b97296d39e06b523661636396867f5fc9b650a1d2baa6d5c12cd5" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-trial" }, "locators": [ { "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "start_byte": 53866, "end_byte": 54663, "value_digest": "sha256:992c1b83763f89dd6f1d610c6c63253cac562aa740bf4b6aefda1a10967d9309" }, { "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "start_byte": 54664, "end_byte": 55464, "value_digest": "sha256:3c46686128f0aafc8bc8cc01b591938fa98c9f7944b6a1cdc7410b6bcbc541fb" } ] } ], "note": "Setting up a trial of GitHub Enterprise Server involves submitting a trial request, following prompts via an emailed link, downloading a license file, and uploading it to install the instance.", "remediation": { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.722Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" }, { "node_kind": "resource", "node_id": "enterprise-trial" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:276919b311eac6773a9d6fe97d9b97647c86130c3f5211a02cf8c3bf1db13679", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:4120ba1c59f6a9dffb8272919e2c98e80eb27c6d0a435815b1d9c4b390cdc398", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8968d89976232db8fcb194f1a1cda3f9e833e20fbe75c0ffb81971e4f6cc11c1", "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "sha256:b2b31774308b97296d39e06b523661636396867f5fc9b650a1d2baa6d5c12cd5", "sha256:ca4d7bdef289be5091a941f30e3d2e6d342cc075657462d064e7e427a32e9581" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-trial" }, "locators": [ { "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "start_byte": 48309, "end_byte": 49099, "value_digest": "sha256:e742bd2f2b605832d2b4742e78eca2073a5e0effc84c5eef18ffc44da9308372" }, { "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d", "start_byte": 0, "end_byte": 781, "value_digest": "sha256:36c09294f879b71aa1e86963d5f84d980b0b0acb87d73f7f53341a31cb6d90d4" } ] } ], "note": "A stable canonical trial path is documented for setting up a trial of GitHub Enterprise Server, where users submit a trial request and complete installation." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.722Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" }, { "node_kind": "resource", "node_id": "enterprise-trial" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence does not contain explicit first-party declarations or direct observations regarding CAPTCHA requirements or verified-agent alternatives." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:08.909Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b5ad11e6c6a776a4feda588acfe543b20c5c49e3df33d3c41d8ea93fb6d7799f", "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-authentication" }, "locators": [ { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 21768, "end_byte": 22568, "value_digest": "sha256:23c9393be2178b971b12748f8968600270406339f5709ca5236fd2442d6bdbd1" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:24cb763354edf851f3570178e581c1c365bd081708dca281d001d6e8cbc148bd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:81c0b21b6bbf4f6e4ee11ca54c38176ed8e2d95ee8d6f4a0a2034ad4eab63cb1", "sha256:9cd014fb119c5ddf48114de223b6097501b4e49d5016c8e559e34219ce064afb", "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" }, "locators": [ { "artifact_digest": "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35", "start_byte": 12221, "end_byte": 13011, "value_digest": "sha256:70298c048ae1e08f673d2b2aa1abd92dbf108f951c6765b8a7dcfda72fc7df39" } ] } ], "note": "Scoped access tokens, fine-grained personal access tokens, GitHub App tokens, and OAuth tokens can be generated and authenticated against the REST API. Tokens can expire and can be revoked by the user or application." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.722Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" }, { "node_kind": "resource", "node_id": "enterprise-trial" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence does not state whether phone verification is required, absent, or supported through a safe resumable boundary." } ], "blockers": [], "remediations": [ { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "primary_finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Paid access requires opaque or unbounded sales intervention.", "context": "GitHub Enterprise Server license documentation explicitly states that purchasing, renewing, adding user licenses, or upgrading requires contacting GitHub's Sales team." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence for GitHub Enterprise Server describes license acquisition and upgrades via GitHub's Sales team or downloading license files after order completion, but does not document an automated or protocol-driven checkout construction, handoff approval, and resumption flow." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation notes that licenses are acquired or upgraded through GitHub's Sales team or generated via Enterprise account settings, but does not document a delegated payment authorization rail with explicit human-confirmed authority or receipts." }, { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "GitHub Enterprise billing documentation discloses usage-based (metered) and volume/subscription billing models, noting that usage-based billing is billed monthly based on active users, but volume agreements and specific commercial commitments require manual setup via GitHub Sales." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:05.099Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence for GitHub Enterprise Server describes license acquisition and upgrades via GitHub's Sales team or downloading license files after order completion, but does not document an automated or protocol-driven checkout construction, handoff approval, and resumption flow." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:35.937Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-billing" }, { "node_kind": "resource", "node_id": "enterprise-combined-use" }, { "node_kind": "resource", "node_id": "enterprise-pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:194238bc96b8e61e73bc1e1285e393ecde36c266c9c0a661848ca598285fca08", "capture_rung": "http" } ], "artifact_digests": [ "sha256:27469581b47af5bf46cdcd2a6c81bbe87c20e5e90c355bd8f4696fb0ffc522c8", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6af8c8ba64ebe33d3350198cc2ea15e618e86309e590df0ddc13e38685eba312", "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-billing" }, "locators": [ { "artifact_digest": "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394", "start_byte": 7332, "end_byte": 8132, "value_digest": "sha256:4e3861bd8462b622dad7684ea6881514dcf44f4bf2f9011a41b7caef4f3b1712" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:77a062d583b1cb2bf10429560ab64a1ef0a42400675cefd1c7c41ff72b9e5718", "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-combined-use" }, "locators": [ { "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d", "start_byte": 10818, "end_byte": 11612, "value_digest": "sha256:8d567765c373246a61aea796a562cd9192da1a22de4b245f7ba293333aa35d7d" } ] } ], "note": "GitHub Enterprise billing documentation discloses usage-based (metered) and volume/subscription billing models, noting that usage-based billing is billed monthly based on active users, but volume agreements and specific commercial commitments require manual setup via GitHub Sales.", "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:05.099Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained documentation notes that licenses are acquired or upgraded through GitHub's Sales team or generated via Enterprise account settings, but does not document a delegated payment authorization rail with explicit human-confirmed authority or receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "no", "value_label": "Blocked", "outcome": "fail", "public_state": "blocked", "condition": "Is a direct self-service path to paid access documented?", "finding": "Paid access requires opaque or unbounded sales intervention.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:05.099Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-acquisition" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ac3ec6e8758d40799c047ba2b882780ae4a1b1a52adedaccfec0eec46e5f9c65", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b0c89bf9fc56c731b699a4b9b9a42a7401c3af022cf2f35fc0483ef2a2c6bb50", "sha256:be05c6fee9ceb4e8831aa693bed68b5857510e1e38e1c6a82c9e7a5e72436b70", "sha256:fd44756187d965a4442841f98217a1372e0b2db57190b85e31fc6c00d2ec830c" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-license-acquisition" }, "locators": [ { "artifact_digest": "sha256:be05c6fee9ceb4e8831aa693bed68b5857510e1e38e1c6a82c9e7a5e72436b70", "start_byte": 7322, "end_byte": 8121, "value_digest": "sha256:233bccb7a32ca123849fa9bf9f216bd4e6c8a49ab2257c5e07c31586e8372a4a" } ] } ], "note": "GitHub Enterprise Server license documentation explicitly states that purchasing, renewing, adding user licenses, or upgrading requires contacting GitHub's Sales team.", "blocker": { "signal_code": "self_service_purchase", "code": "pay.self_service_purchase", "explanation": "Paid access requires opaque or unbounded sales intervention." }, "remediation": { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } } ], "blockers": [ { "signal_code": "self_service_purchase", "code": "pay.self_service_purchase", "explanation": "Paid access requires opaque or unbounded sales intervention." } ], "remediations": [ { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." }, { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "GitHub Enterprise Server REST API authentication tokens can be generated (such as personal access tokens or GitHub App tokens) or created by app owners on an app settings page, where client IDs and client secrets are displayed and used to create access tokens." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Repository creation can be triggered via a REST API POST request to /orgs/{org}/repos, which returns a 201 Created response containing the repository resource details." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "Creating an organization repository via the REST API returns a synchronous 201 Created HTTP response status code upon successful resource creation." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:768cb4ce04ae25001799f4a684aa156480df25128912cd20cdd7c5b16f44f279", "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-authentication" }, "locators": [ { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 21768, "end_byte": 22568, "value_digest": "sha256:23c9393be2178b971b12748f8968600270406339f5709ca5236fd2442d6bdbd1" }, { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 26546, "end_byte": 27330, "value_digest": "sha256:02409c289d743e46dcce6071ac30935808935baa468bab680a8e28c1ccdb5ee3" } ] } ], "note": "GitHub Enterprise Server REST API authentication tokens can be generated (such as personal access tokens or GitHub App tokens) or created by app owners on an app settings page, where client IDs and client secrets are displayed and used to create access tokens.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:16.960Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-license-upload" }, { "node_kind": "resource", "node_id": "enterprise-repositories" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6910530249700d705917a36b5275078df57a8fad06ef04691b38a62921ff5d6d", "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579", "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-repositories" }, "locators": [ { "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b", "start_byte": 36518, "end_byte": 37317, "value_digest": "sha256:3508e3b78eb69b14d8201c77c284402893b5e65b8a6ad98b656a158412690775" } ] } ], "note": "Creating an organization repository via the REST API returns a synchronous 201 Created HTTP response status code upon successful resource creation." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:16.960Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-license-upload" }, { "node_kind": "resource", "node_id": "enterprise-repositories" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8d49e033275edc02f31b165cce3adecfeef1f528ffa24e5105afb84417ebdfea", "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579", "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-repositories" }, "locators": [ { "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b", "start_byte": 37318, "end_byte": 38118, "value_digest": "sha256:0e9267e5f0f1e867f42ac0fd32d09bfdd5a3d959f4529af5e1a09041cb6cf180" } ] } ], "note": "Repository creation can be triggered via a REST API POST request to /orgs/{org}/repos, which returns a 201 Created response containing the repository resource details." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Documentation establishes rate limit error codes (403 Forbidden, 429 Too Many Requests), headers (retry-after, x-ratelimit-remaining, x-ratelimit-reset), retry guidelines with exponential backoff, and timeouts (terminated after 10 seconds). Full idempotency, cancellation, and reconciliation semantics across all operations remain partially documented." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Current admissible evidence does not resolve an agent-native protocol interface such as MCP or A2A for the targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "First-party documentation establishes that tokens can expire or be revoked, and access tokens created by a GitHub App expire after eight hours and can be regenerated using a refresh token. However, a full programmatically automated credential lifecycle covering compromise response and recovery without manual intervention is not fully established." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target documented across the REST API has a stable, usable machine interface alternative via documented HTTP REST endpoints." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication to the REST API is documented and usable via the Authorization header using Bearer tokens (including GitHub Actions GH_TOKEN) or fine-grained tokens with explicit scoped permissions." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Essential target endpoints and REST API operations have stable, readable request parameters, HTTP methods, response schemas, status codes, rate-limit point calculations, error formats, and documented OpenAPI description accessibility." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:34.509Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "enterprise-repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "Current admissible evidence does not resolve an agent-native protocol interface such as MCP or A2A for the targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:08.909Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:24cb763354edf851f3570178e581c1c365bd081708dca281d001d6e8cbc148bd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:81c0b21b6bbf4f6e4ee11ca54c38176ed8e2d95ee8d6f4a0a2034ad4eab63cb1", "sha256:9cd014fb119c5ddf48114de223b6097501b4e49d5016c8e559e34219ce064afb", "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" }, "locators": [ { "artifact_digest": "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35", "start_byte": 12221, "end_byte": 13011, "value_digest": "sha256:70298c048ae1e08f673d2b2aa1abd92dbf108f951c6765b8a7dcfda72fc7df39" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2700acb2e5ba89b2081a1ccd897c14b9c9e199e2ff885ab4169dacdbcbf5f254", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-authentication" }, "locators": [ { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 22569, "end_byte": 23367, "value_digest": "sha256:0e0dd5796cf760104e36aab10e95f1f3a4469480e3086011d65576768ac22a0f" } ] } ], "note": "First-party documentation establishes that tokens can expire or be revoked, and access tokens created by a GitHub App expire after eight hours and can be regenerated using a refresh token. However, a full programmatically automated credential lifecycle covering compromise response and recovery without manual intervention is not fully established.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:38.888Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-errors" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed", "capture_rung": "http" } ], "artifact_digests": [ "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "sha256:4c2d496977f43031d2a015357ea25e9e09651080c13bdf9a87106092b8f2bbdc", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-errors" }, "locators": [ { "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "start_byte": 22166, "end_byte": 22960, "value_digest": "sha256:fdcf0c49d45c279ac96dc63a2f197159470b81a23082bd5407d853231c7dc8f5" }, { "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "start_byte": 29354, "end_byte": 30152, "value_digest": "sha256:255f9620f5948562f9a2e7d828937ece86da301b567b112f5349385be3c61950" } ] } ], "note": "Documentation establishes rate limit error codes (403 Forbidden, 429 Too Many Requests), headers (retry-after, x-ratelimit-remaining, x-ratelimit-reset), retry guidelines with exponential backoff, and timeouts (terminated after 10 seconds). Full idempotency, cancellation, and reconciliation semantics across all operations remain partially documented.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "enterprise-authentication" }, { "node_kind": "resource", "node_id": "enterprise-token-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2600991f10fb233231f4c113eb1cdae53423f73038d97539252fb8f93ffa08fa", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-authentication" }, "locators": [ { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 22569, "end_byte": 23367, "value_digest": "sha256:0e0dd5796cf760104e36aab10e95f1f3a4469480e3086011d65576768ac22a0f" }, { "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75", "start_byte": 29718, "end_byte": 30515, "value_digest": "sha256:0619daf73ba96c77ab2c04ff73f1e9489afe694670b9125cedd1fbec40c0dad9" } ] } ], "note": "Request-time authentication to the REST API is documented and usable via the Authorization header using Bearer tokens (including GitHub Actions GH_TOKEN) or fine-grained tokens with explicit scoped permissions." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.577Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "enterprise-repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470", "capture_rung": "http" } ], "artifact_digests": [ "sha256:19dff18331d755458d3ad939c643ed506031e55bbd0b0030cebc92497b61abd1", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65", "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-rest" }, "locators": [ { "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f", "start_byte": 21266, "end_byte": 22068, "value_digest": "sha256:7a08dc344f3e49d82ff261fc7132ed173b41a81a67d30f45ed5704baee833e02" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:3a63a63651a4b701989d19e579cb47a0af50e1bb53c8dab359fc7e7a0ad8ee13", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1dedfcfd452db8373f88f8e5a935248c2ef306df86cb34285a46c6a8b446773c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7c0eb0c607825e8354fdde957317e910a1ca79e4b4d968e39c5898eb3f5bbc25", "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-limits" }, "locators": [ { "artifact_digest": "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53", "start_byte": 22453, "end_byte": 23187, "value_digest": "sha256:1cf69eb23c4aaf01f531bda160e4f7fb6f14967f473e9b63bce2385563cc05e3" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed", "capture_rung": "http" } ], "artifact_digests": [ "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9", "sha256:97f4ab1b8e6857e0e774f9f0ada8b39287f059b5b7d56308462a18fd95accad2" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-errors" }, "locators": [ { "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "start_byte": 31746, "end_byte": 32544, "value_digest": "sha256:75f0efc2c15322eb8d5d56e9d79013debe13acc609db432e1c7f7f5e39084d33" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8d49e033275edc02f31b165cce3adecfeef1f528ffa24e5105afb84417ebdfea", "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579", "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-repositories" }, "locators": [ { "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b", "start_byte": 37318, "end_byte": 38118, "value_digest": "sha256:0e9267e5f0f1e867f42ac0fd32d09bfdd5a3d959f4529af5e1a09041cb6cf180" } ] } ], "note": "Essential target endpoints and REST API operations have stable, readable request parameters, HTTP methods, response schemas, status codes, rate-limit point calculations, error formats, and documented OpenAPI description accessibility." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:45.577Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "enterprise-repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed", "capture_rung": "http" } ], "artifact_digests": [ "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9", "sha256:e9a670c3fd5c759853ec3bb947b6414d1223e8b78e9514abb1ed609adb585c06" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-errors" }, "locators": [ { "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd", "start_byte": 17455, "end_byte": 18248, "value_digest": "sha256:882edea84be04b487ba287f386156d8d720e25d77d26fc93f034f2f776a9c95d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:3a63a63651a4b701989d19e579cb47a0af50e1bb53c8dab359fc7e7a0ad8ee13", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1dedfcfd452db8373f88f8e5a935248c2ef306df86cb34285a46c6a8b446773c", "sha256:423671e71f4fa8a5bb3d018a3d2434eb85250f61ad027bf8f078707d09baade0", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-limits" }, "locators": [ { "artifact_digest": "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53", "start_byte": 16154, "end_byte": 16943, "value_digest": "sha256:184a1ecfe691a14b118b088966fd71a08a48c3d014593b1f71b1b444c090f534" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470", "capture_rung": "http" } ], "artifact_digests": [ "sha256:263f3eb080e14c3c96a34eb4f8ebedd0f9934ba573d3a8ee411a17b20b131da0", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65", "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-rest" }, "locators": [ { "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f", "start_byte": 0, "end_byte": 774, "value_digest": "sha256:02967728e02f0fa16496896521fcf0df9273089e117edec148f6af4884fcd397" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093", "capture_rung": "http" } ], "artifact_digests": [ "sha256:37349552a3f6fcce4ab4c2e8d569ce8f948866890226941076efe3f6c4d2d1c8", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579", "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b" ], "source_surface": { "node_kind": "resource", "node_id": "enterprise-repositories" }, "locators": [ { "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b", "start_byte": 120322, "end_byte": 121119, "value_digest": "sha256:22810db28ee6d61e94e6da7aa88addf3aef92545b2092721bb72ca35eabeeab8" } ] } ], "note": "Every essential target documented across the REST API has a stable, usable machine interface alternative via documented HTTP REST endpoints." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 1, "barrier_ratio": 0.2 }, "last_tested_at": "2026-09-06T08:51:45.722Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:0a61a4ce48e18113eb474e97a9c3c30bcf4b90d2d0ddfc29601893a075c586a7", "sha256:1efe3ea5ddd534362942b4e840e6fb24b14c81034c9e09fbc84ddde1030ca134", "sha256:231b1d0401ed903b87df04a97cebf2b51d612b5e62f748060b2580d651181ceb", "sha256:240310e6b82ecfe82f7158726132d129218b8297bb654771fde9f0f91ed3854d", "sha256:2a7835c314d784c918930e5db45528ddbcf28f0344c5e391012ccfdafe22fc20", "sha256:2ead3689159b7279d95986130e8d04019968ad2229251eb57c39c35e40beb72c", "sha256:31c6df1f2c5d56bbcebb8ba94e89375effb78586da1da6649d0e565e42cd6c47", "sha256:3f1ceffb99432d34e7be951a7d1db52eb4f9becbdf6a788e0e9988db241dd76a", "sha256:456337096a9e56d0bb6b4a4e672ed9430833dda831179f5b4fa16e21d7f6bfa5", "sha256:4b7e862bdcda4d12ba99da07f12454a833b98cc6821b2b146edbd48e1cf284ce", "sha256:520a0138b35e59a19d0d5a7d817835ca48201b3b8aad295047d4ea12c4de1bfe", "sha256:52894d10ddc1105a524173c662fed488c42248b06b594497b63df3a5c064ade3", "sha256:550d7a752342281aee7b38d1dec859f7da7582ff34bda1d58d9041b565d1e4ed", "sha256:62ab85088e1d30b6ebf1ba0dd18a7b3b2b9cf98d407afe765205816945b3d89c", "sha256:6588bd48ecb40fa77c170a52145bea752e3392924387f80d2d42527fb1c1b579", "sha256:68aa8c885ef412e1cf5cd78cd89f002c0898556c3a3ffc617125c4cb70579235", "sha256:6f22df73f0068ff4f309394ef38e6d9430701c048abb09069f96b888d1dad2a3", "sha256:7499b4ff78dbb45d7859adf3046a5afe4f018784c57e0a41c0aa0104ce8a34fd", "sha256:76d7268be453d8cdd7ca514bd6d2fcb408964177c64277c158f96e5a1df6dc3d", "sha256:85dcd31fe10adf8b784134bbede7253daa749b84dd34b793469dcdb02b9c4189", "sha256:911c27d80b08d5f0bdb7e54bd84c1c3406af8cbc08b5e8fa1204f51b25646ec9", "sha256:9854af44c304c86e5bb37fa3f3caad1e675419b4c64e39ae2617acc4cc05e6eb", "sha256:a28b90b7a66de5e0d9aa835582ee4ee1718acb504fbdd148b9c07cae94971632", "sha256:a2b23d1d0ebdebb9696d1998afff8f27146551166cb286501c4eb9ae9fa30b6b", "sha256:a57650cd0597cafa9b126dcce98f86927d7dbe73251736f068f22b9e55b5d0ef", "sha256:a9e2f59ae379fabb304fea3bf200ee1a7463200b59f7d5352e9fa7d3d2a486ce", "sha256:ad3e87ccc5e8b40cdb1310d073dbb67cbb48a3c1ca2274f8a5263bf6747f048d", "sha256:b12a968f0bda1fa7bbb97004acc17b63819f859ca66e573b6c0608d4ddb3a8e6", "sha256:b50760aaa32bd5f6ad24e115ce09673e5ba2a266096a893922d3843da808ceee", "sha256:bac43ab963430a7a38ff764743049c1c91b0a8ac43d753009f7cd25cc04efdef", "sha256:c5eaa14026f205e2eb445acf1448be39db66573d7649aa7594cd0dd2ca42da2f", "sha256:c8b9837a657827001fa1b55493e9daed6c23a32dfac37a412fb0c6786e724e54", "sha256:d8436c1f67696470a8f91feffea1305f99708addeec0c3bc58579c43a2829185", "sha256:dac1ae08e8c6c52570176ff4b7b505b8a8746907e2a411557bff87a1a190992a", "sha256:ded1571378506c77e5fec6fbe3c289f69bb074eca0449c008c143a9066f9e365", "sha256:e063cde1946cfdc980fb9a0135ae694735a8b11a45b6ff0196915d88af138e11", "sha256:ea609420b0e27e3efc71b6c6530610d57532233b511345f743aecb1ff660debf" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:456337096a9e56d0bb6b4a4e672ed9430833dda831179f5b4fa16e21d7f6bfa5" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:35.937Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:62ab85088e1d30b6ebf1ba0dd18a7b3b2b9cf98d407afe765205816945b3d89c", "sha256:e063cde1946cfdc980fb9a0135ae694735a8b11a45b6ff0196915d88af138e11" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:35.937Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:68aa8c885ef412e1cf5cd78cd89f002c0898556c3a3ffc617125c4cb70579235", "sha256:a9e2f59ae379fabb304fea3bf200ee1a7463200b59f7d5352e9fa7d3d2a486ce" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:34.509Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:2ead3689159b7279d95986130e8d04019968ad2229251eb57c39c35e40beb72c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:10.295Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:240310e6b82ecfe82f7158726132d129218b8297bb654771fde9f0f91ed3854d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.769Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:76d7268be453d8cdd7ca514bd6d2fcb408964177c64277c158f96e5a1df6dc3d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.386Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:231b1d0401ed903b87df04a97cebf2b51d612b5e62f748060b2580d651181ceb" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.722Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:4b7e862bdcda4d12ba99da07f12454a833b98cc6821b2b146edbd48e1cf284ce" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.722Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:31c6df1f2c5d56bbcebb8ba94e89375effb78586da1da6649d0e565e42cd6c47", "sha256:7499b4ff78dbb45d7859adf3046a5afe4f018784c57e0a41c0aa0104ce8a34fd" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.722Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:ad3e87ccc5e8b40cdb1310d073dbb67cbb48a3c1ca2274f8a5263bf6747f048d", "sha256:b12a968f0bda1fa7bbb97004acc17b63819f859ca66e573b6c0608d4ddb3a8e6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:08.909Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:52894d10ddc1105a524173c662fed488c42248b06b594497b63df3a5c064ade3", "sha256:a57650cd0597cafa9b126dcce98f86927d7dbe73251736f068f22b9e55b5d0ef" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.722Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:911c27d80b08d5f0bdb7e54bd84c1c3406af8cbc08b5e8fa1204f51b25646ec9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:05.099Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:c8b9837a657827001fa1b55493e9daed6c23a32dfac37a412fb0c6786e724e54", "sha256:ded1571378506c77e5fec6fbe3c289f69bb074eca0449c008c143a9066f9e365" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:35.937Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:ea609420b0e27e3efc71b6c6530610d57532233b511345f743aecb1ff660debf" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:05.099Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:1efe3ea5ddd534362942b4e840e6fb24b14c81034c9e09fbc84ddde1030ca134" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:05.099Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:bac43ab963430a7a38ff764743049c1c91b0a8ac43d753009f7cd25cc04efdef" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.386Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:85dcd31fe10adf8b784134bbede7253daa749b84dd34b793469dcdb02b9c4189" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:16.960Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:b50760aaa32bd5f6ad24e115ce09673e5ba2a266096a893922d3843da808ceee" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:16.960Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:6f22df73f0068ff4f309394ef38e6d9430701c048abb09069f96b888d1dad2a3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:34.509Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:6588bd48ecb40fa77c170a52145bea752e3392924387f80d2d42527fb1c1b579", "sha256:c5eaa14026f205e2eb445acf1448be39db66573d7649aa7594cd0dd2ca42da2f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:08.909Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:9854af44c304c86e5bb37fa3f3caad1e675419b4c64e39ae2617acc4cc05e6eb" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:38.888Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:520a0138b35e59a19d0d5a7d817835ca48201b3b8aad295047d4ea12c4de1bfe" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.386Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:0a61a4ce48e18113eb474e97a9c3c30bcf4b90d2d0ddfc29601893a075c586a7", "sha256:550d7a752342281aee7b38d1dec859f7da7582ff34bda1d58d9041b565d1e4ed", "sha256:a2b23d1d0ebdebb9696d1998afff8f27146551166cb286501c4eb9ae9fa30b6b", "sha256:d8436c1f67696470a8f91feffea1305f99708addeec0c3bc58579c43a2829185" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.577Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:2a7835c314d784c918930e5db45528ddbcf28f0344c5e391012ccfdafe22fc20", "sha256:3f1ceffb99432d34e7be951a7d1db52eb4f9becbdf6a788e0e9988db241dd76a", "sha256:a28b90b7a66de5e0d9aa835582ee4ee1718acb504fbdd148b9c07cae94971632", "sha256:dac1ae08e8c6c52570176ff4b7b505b8a8746907e2a411557bff87a1a190992a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:45.577Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/github/agent-readiness/github-enterprise-server-3-21/repository-operations", "projection_digest": "sha256:9ce56e92fd056bf6e396f908920196f5e5ae85a98f55ad85696913a0d88db92d" } } }