{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn", "entity_slug": "github", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4x9v5n7pd3j2gc8q1fk", "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn", "scope": { "product": { "key": "github-rest-api", "name": "GitHub REST API" }, "funnel": { "key": "repository-operations", "name": "Repository operations" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:984e9d33ce299c5093b358d8578a6892e03ca295907002f6ef6d3a48014088b2" }, "declaration_revision_digest": "sha256:c84bb9c11eeacdfee52e7c85e89a99d0bbd462c8fd8969d27dfe729d22dca84f", "declaration": { "declaration_id": "declaration_github_rest_repository_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/gi/github.yaml", "git_blob_oid": "0b83b40b4585fc06dea240cfbb0a011157466aca", "blob_digest": "sha256:0c09cbebf72bb36436c67e2fc1d2c4c20214f564b017b173073940560eeb8ff1" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage GitHub repositories through the REST API", "interface_ids": [ "repository-api" ] } ], "participants": [ { "participant_id": "github", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn" } } ], "resources": [ { "resource_id": "account-signup", "uri": "https://github.com/signup", "roles": [ "access" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "api-versions", "uri": "https://api.github.com/versions", "roles": [ "descriptor", "status" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "authentication", "uri": "https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api?apiVersion=2026-03-10", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://docs.github.com/en/billing/how-tos/manage-plan-and-licenses/upgrade-plan", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://github.com/pricing", "roles": [ "documentation", "pricing" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "rate-limits", "uri": "https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "readiness-84f7c6a9cbd0ddb3894bfc8e8f683912f976ff3f81d9c876a991c820f941f5a4", "uri": "https://docs.github.com/en/get-started/start-your-journey/creating-an-account-on-github", "roles": [ "access", "documentation" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "readiness-95d77362fd899c300c1f448b97f23506087073a3e419a630603bc05f3b89eb42", "uri": "https://docs.github.com/en/billing/concepts/impact-of-plan-changes", "roles": [ "documentation", "pricing" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf", "uri": "https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app", "roles": [ "authentication", "documentation" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d", "uri": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation", "roles": [ "authentication", "documentation" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "repository-operations", "uri": "https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "rest-api", "uri": "https://docs.github.com/en/rest", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "roles": [ "terms" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://support.github.com/", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "resource_id": "troubleshooting", "uri": "https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "github", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "github-api", "uri": "https://api.github.com", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "endpoint_id": "registration", "uri": "https://github.com/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "github", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "authentication" ], "operated_by_participant_id": "github", "standard_bindings": [] }, { "interface_id": "repository-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "github-api" ], "resource_ids": [ "rate-limits", "repository-operations", "rest-api", "troubleshooting" ], "operated_by_participant_id": "github", "standard_bindings": [] } ], "relations": [ { "relation_id": "api-versions-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-versions" }, "to": { "node_kind": "interface", "node_id": "repository-api" } }, { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "repository-api" } }, { "relation_id": "relation-describes-3bdc2359067fbad866b74feffe97cfc028acfd5b0c8af44807854b8247bd4ab1", "kind": "describes", "from": { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } }, { "relation_id": "relation-describes-b89359e774bb9820b9086ea0765f3845898f0e18b10eb3b73d4687dcdfa31509", "kind": "describes", "from": { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } }, { "relation_id": "repository-docs-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "repository-operations" }, "to": { "node_kind": "interface", "node_id": "repository-api" } }, { "relation_id": "rest-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "rest-api" }, "to": { "node_kind": "interface", "node_id": "repository-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "account-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:26ab905c0f0eb798278999e4b609a200b749c6368dbd757b47830ca564fe447b", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "B+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "provision", "stage_label": "Provision", "public_state": "limited", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "GitHub REST API documentation describes creating personal access tokens and generating user access tokens or client secrets via app settings. Delivering credentials through manual UI creation or OAuth exchange flows involves human transfer or web/device authorization handoffs." } }, "limitations": [ { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "GitHub REST API documentation describes creating personal access tokens and generating user access tokens or client secrets via app settings. Delivering credentials through manual UI creation or OAuth exchange flows involves human transfer or web/device authorization handoffs." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Troubleshooting documentation defines status codes, rate limit error handling (using x-ratelimit-remaining, x-ratelimit-reset, and retry-after headers), exponential backoff for retries, timeouts, and JSON validation errors, but idempotency, cancellation, and reconciliation semantics are not fully established." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "The documentation establishes token expiration, token refresh via refresh tokens, and token revocation via the credential revocation API, but complete agent-operable credential recovery and lifecycle automation across all credential types remain unevidenced." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The GitHub REST API and its documentation entrypoints are publicly discoverable, including versioning details and getting started documentation." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence from the API versions and REST API documentation does not contain explicit declarations or policies regarding web agent or crawler access rules." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "The GitHub Terms of Service are readable, retrievable, and complete, detailing account terms, acceptable use, definitions, and legal agreements." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "GitHub's Terms of Service state explicit eligibility requirements and inputs, such as requiring a valid email address and requiring users to be at least 13 years old (or older if required by local law). Usage is also subject to export control and sanctions laws." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "GitHub's pricing page explicitly states plan costs and conditions, such as $0 USD per month forever for the Free plan and $4 USD per user/month for the Team plan. Variable compute and storage fees for Codespaces and Git LFS are also explicitly disclosed in USD." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "GitHub explicitly documents that the REST API is fully described in an OpenAPI compliant document." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.769Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cb1549df31e61674815032fdcbf9714b7c22bceb9822f271a2b55e5a464459dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9ac6153eeaa180eabccfb197707d1a843a34a798acb2ab1d4a6eda78bfd08122", "sha256:e77e5d9823d067e7c2de497dbc2c718fc09ef44ead08d6685df5c9e3299b498a" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 20692, "end_byte": 21492, "value_digest": "sha256:ad92d6ef47999b7e97cb80ba0777774af6d5ffc1ca71605dc0de94fa5c7e8292" }, { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 23095, "end_byte": 23898, "value_digest": "sha256:26504a195863c02e150365161b8dfaede378fcc7ee831ebf6b6624f393d04c36" } ] } ], "note": "GitHub's Terms of Service state explicit eligibility requirements and inputs, such as requiring a valid email address and requiring users to be at least 13 years old (or older if required by local law). Usage is also subject to export control and sanctions laws." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:10.796Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "readiness-95d77362fd899c300c1f448b97f23506087073a3e419a630603bc05f3b89eb42" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7a50f5d2a2a680014a96df2e30617aadcf91a01e573876ee169462c5631dbcde", "capture_rung": "http" } ], "artifact_digests": [ "sha256:191cf5a22ea7f4874c04c9f250b27de358fa3bc393734ba6a550be592d4f8c81", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a7d000bda23799d880da3118ff8a63cd602fb7206619537fda537761eefd8ff3", "sha256:be305380b88f28ce6fba832f864fc26bbf997fcecdcb8d1982e4cbed5902641f" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:be305380b88f28ce6fba832f864fc26bbf997fcecdcb8d1982e4cbed5902641f", "start_byte": 12795, "end_byte": 13592, "value_digest": "sha256:e08a071d4b85c5c4f4d610ca36686b7d8e0009d5e84f87a41b2ce76e1d372614" }, { "artifact_digest": "sha256:be305380b88f28ce6fba832f864fc26bbf997fcecdcb8d1982e4cbed5902641f", "start_byte": 15185, "end_byte": 15980, "value_digest": "sha256:de9c44039e23f32275861c4cedf7174d7a4f16e380ff2929ab8d96e3e1aa1b81" } ] } ], "note": "GitHub's pricing page explicitly states plan costs and conditions, such as $0 USD per month forever for the Free plan and $4 USD per user/month for the Team plan. Variable compute and storage fees for Codespaces and Git LFS are also explicitly disclosed in USD." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:06.991Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "rest-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fd3be7e24a92ae459d06c1a03b36b03dfe969476591a6e60baa8b9de71229696", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4644902d306db16a5da7b48718beb1e9a942d64d4d62b5616d0ac01808241938", "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c05020cba21a5bf87c256b3222c0d92140041255300a7fbb373fab2f4a0e4a82" ], "source_surface": { "node_kind": "resource", "node_id": "rest-api" }, "locators": [ { "artifact_digest": "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "start_byte": 12271, "end_byte": 13068, "value_digest": "sha256:8cd2d5f3985074fa4929118e0274d8e07a4c803440576c51e169026cd885b791" }, { "artifact_digest": "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "start_byte": 16211, "end_byte": 16994, "value_digest": "sha256:0acc0d7b6d745a562b69743bde7f5f1d4e5a67b34e60702d121854253091db00" } ] } ], "note": "The GitHub REST API and its documentation entrypoints are publicly discoverable, including versioning details and getting started documentation." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:06.991Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-versions" }, { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "rest-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fd3be7e24a92ae459d06c1a03b36b03dfe969476591a6e60baa8b9de71229696", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c05020cba21a5bf87c256b3222c0d92140041255300a7fbb373fab2f4a0e4a82", "sha256:c9b3d64eb8e8d11fb2f45b006ff5baf27ead8f37bbd452add70fd44fa2c00202" ], "source_surface": { "node_kind": "resource", "node_id": "rest-api" }, "locators": [ { "artifact_digest": "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "start_byte": 16211, "end_byte": 16994, "value_digest": "sha256:0acc0d7b6d745a562b69743bde7f5f1d4e5a67b34e60702d121854253091db00" } ] } ], "note": "GitHub explicitly documents that the REST API is fully described in an OpenAPI compliant document." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:01.769Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cb1549df31e61674815032fdcbf9714b7c22bceb9822f271a2b55e5a464459dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0add3b32a1fab9337bfda057e5f40bd30306893c8d8b9c47540cdf4a99c52528", "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9ac6153eeaa180eabccfb197707d1a843a34a798acb2ab1d4a6eda78bfd08122" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 12651, "end_byte": 13446, "value_digest": "sha256:2437eceedc60d78840c78f21b0f18a7db41b8c07928f6456dd6b2f3644d32803" }, { "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042", "start_byte": 16645, "end_byte": 17454, "value_digest": "sha256:61df92d5fbe8f390eaf561741f1a2f7f7bcf9e53fc478f880ea93c30bd2e9265" } ] } ], "note": "The GitHub Terms of Service are readable, retrievable, and complete, detailing account terms, acceptable use, definitions, and legal agreements." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:19.122Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-versions" }, { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "rest-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence from the API versions and REST API documentation does not contain explicit declarations or policies regarding web agent or crawler access rules." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Documentation explicitly directs users to https://github.com/signup as the canonical route to sign up for a personal account." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup endpoint returned an unresolved 403 response requiring JS, leaving access control operability unresolved." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The direct signup endpoint returned an HTTP 403 error page, and documentation does not establish whether a CAPTCHA boundary exists during registration." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup endpoint returned an HTTP 403 error page, and documentation only specifies email verification during account creation without addressing phone verification." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "GitHub Apps support generating user access tokens with fine-grained permissions via OAuth web application or device authorization flows, and tokens can be explicitly revoked by users or application owners." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:23.651Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup endpoint returned an unresolved 403 response requiring JS, leaving access control operability unresolved." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:47.162Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" }, { "node_kind": "resource", "node_id": "readiness-84f7c6a9cbd0ddb3894bfc8e8f683912f976ff3f81d9c876a991c820f941f5a4" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0390d675eecdd77d3b6b447cf12d47a9245cef1f73b647203bae13c4c611a7c6", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:134bec0eb8d52fb33af5d1c0b398ad5eb2b3357bc369e33982cbaf39ca3edde5", "sha256:6c03d93c250e3f015e8b749e030c76f7ce8d3e303a3dff0aaf5f36dbfdf1b41e", "sha256:82d48b1d2e28cf8e2e712781f9f37b409116b73c3b1af59c3a04acbc4b27ecd3", "sha256:898fd23d09aeb5aeaf7c34fba03e0fba8eecfee7bbc1ae2daef444150f6482c2", "sha256:9097c682c97044db7bd80bf36035494303d35d7ca8f59c6da991e4cf676cc083", "sha256:f47a5defe2737848c867834f4d9125db495642d65ca91356bc063b0a7f52f532" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-84f7c6a9cbd0ddb3894bfc8e8f683912f976ff3f81d9c876a991c820f941f5a4" }, "locators": [ { "artifact_digest": "sha256:f47a5defe2737848c867834f4d9125db495642d65ca91356bc063b0a7f52f532", "start_byte": 10726, "end_byte": 11526, "value_digest": "sha256:1ed2dc7f5357998949393bc5879438fa5fb56d305d949b7e5f522d5cc4eecc57" } ] } ], "note": "Documentation explicitly directs users to https://github.com/signup as the canonical route to sign up for a personal account." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:23.651Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "account-signup" }, { "node_kind": "resource", "node_id": "readiness-84f7c6a9cbd0ddb3894bfc8e8f683912f976ff3f81d9c876a991c820f941f5a4" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The direct signup endpoint returned an HTTP 403 error page, and documentation does not establish whether a CAPTCHA boundary exists during registration." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:30.930Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1a8e8dbba00a0893a6d6fdcbe84018d7f74b9a22a326ae45c14db05a0338c665", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57e9ecf795e38c654772e8c75355a85e971b9b00407e3df89a08faa6ac8eb223", "sha256:f074290a33896fb046b07aa1ab40b30f8f5a953602d9e01959f6658a9879a09b", "sha256:f989c44871fa242cf24cc6e62c9022112adfd1697586db1a17a09e0b9746f6a4" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" }, "locators": [ { "artifact_digest": "sha256:f074290a33896fb046b07aa1ab40b30f8f5a953602d9e01959f6658a9879a09b", "start_byte": 13797, "end_byte": 14596, "value_digest": "sha256:cd3f2c387575c3c1c6f09df8a91eb078060a044b7740048f39b6907c92dc7c1a" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c2621293ff4820fd00b9bbc66bcb3c3b56dd8f5824f3c8f54d4a55e31892f5c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:284fe674c313d598bd6b21d153ab2d61a64f404348d74a5f89d280f35af51cee", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:84097c2816f39bcc11841cf7f0750689ceedffd041c7a3a9a366a50ce1f8b8a8", "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, "locators": [ { "artifact_digest": "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813", "start_byte": 17162, "end_byte": 17956, "value_digest": "sha256:506aa6ea5a3c84794b8d7b5669cce54b9aa44f24643f3d99f14268e2c284c84e" } ] } ], "note": "GitHub Apps support generating user access tokens with fine-grained permissions via OAuth web application or device authorization flows, and tokens can be explicitly revoked by users or application owners." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:23.651Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" }, { "node_kind": "resource", "node_id": "readiness-84f7c6a9cbd0ddb3894bfc8e8f683912f976ff3f81d9c876a991c820f941f5a4" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup endpoint returned an HTTP 403 error page, and documentation only specifies email verification during account creation without addressing phone verification." } ], "blockers": [], "remediations": [] }, { "stage": "pay", "stage_label": "Pay", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "GitHub explicitly discloses its pricing plans, charge status ($0 USD/month for Free), currency (USD), recurrence (monthly/yearly), and billing impact rules such as immediate prorated billing for plan upgrades and seat additions." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence describes UI steps to upgrade account plans and select payment methods, but does not state or establish deterministic checkout construction, approval handoff, and resumption mechanisms for an agent." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "While documentation lists payment method steps like credit card or PayPal submission, the retained evidence does not define a payment authorization rail with scoped delegation or explicit human confirmation with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "GitHub documents a direct self-service path to upgrade personal accounts to GitHub Pro or organization accounts to GitHub Team/Enterprise via account billing settings without requiring a vendor decision point." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:02.096Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence describes UI steps to upgrade account plans and select payment methods, but does not state or establish deterministic checkout construction, approval handoff, and resumption mechanisms for an agent." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:10.796Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "readiness-95d77362fd899c300c1f448b97f23506087073a3e419a630603bc05f3b89eb42" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7a50f5d2a2a680014a96df2e30617aadcf91a01e573876ee169462c5631dbcde", "capture_rung": "http" } ], "artifact_digests": [ "sha256:191cf5a22ea7f4874c04c9f250b27de358fa3bc393734ba6a550be592d4f8c81", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:95969c1efb5f9cfe062a05272e200bdd514c825e2bf38eea646fec183867bb26", "sha256:be305380b88f28ce6fba832f864fc26bbf997fcecdcb8d1982e4cbed5902641f" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:be305380b88f28ce6fba832f864fc26bbf997fcecdcb8d1982e4cbed5902641f", "start_byte": 12795, "end_byte": 13592, "value_digest": "sha256:e08a071d4b85c5c4f4d610ca36686b7d8e0009d5e84f87a41b2ce76e1d372614" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:26715026d2d3007a997b4df88162506ebe1d2214f3fbd846103181e575673598", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0ab72470c63d858dc1763968653e910e963e66659d668c7c02c472fd5815ca62", "sha256:24c5aa1f074bbf03fa43883a149c6dee4ecfa68e78ab24a920c74cd08e48cb59", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:eee4cae8962c432c329a9a592686f16367eba19ba9e09e6ca9fbb4d25a1ba346" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-95d77362fd899c300c1f448b97f23506087073a3e419a630603bc05f3b89eb42" }, "locators": [ { "artifact_digest": "sha256:eee4cae8962c432c329a9a592686f16367eba19ba9e09e6ca9fbb4d25a1ba346", "start_byte": 10193, "end_byte": 10992, "value_digest": "sha256:c0483e08f36942cccfc8e267f1c02a7d590722fd4e573ef69b951e9e4af2b7ae" } ] } ], "note": "GitHub explicitly discloses its pricing plans, charge status ($0 USD/month for Free), currency (USD), recurrence (monthly/yearly), and billing impact rules such as immediate prorated billing for plan upgrades and seat additions." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:02.096Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "While documentation lists payment method steps like credit card or PayPal submission, the retained evidence does not define a payment authorization rail with scoped delegation or explicit human confirmation with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:02.096Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:07148e8763841e07ea9854e9b4622de2495220c7784b7b7d3f5931c63dd7b007", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:697e8568c7295b6b47de5b7019f874e4c93c6c40e0fe0e56ca6bc93fd4f76268", "sha256:8351a818224975fbbfe5446c32828c7d6f1dd2c3b0fc93b51f6c83c8e4a1339b", "sha256:84e79960a8d80934800b240e930305c014fa4c9d71eb481775baa79fcd7a2365" ], "source_surface": { "node_kind": "resource", "node_id": "billing-checkout" }, "locators": [ { "artifact_digest": "sha256:697e8568c7295b6b47de5b7019f874e4c93c6c40e0fe0e56ca6bc93fd4f76268", "start_byte": 11087, "end_byte": 11879, "value_digest": "sha256:e76df81d798226287ff5fb764f6dd84d10aec1da004e3cacf1fa894de6689673" }, { "artifact_digest": "sha256:697e8568c7295b6b47de5b7019f874e4c93c6c40e0fe0e56ca6bc93fd4f76268", "start_byte": 11880, "end_byte": 12680, "value_digest": "sha256:148c0693cad2076d498c685b6e889d174101f95df10ba5a5473812d4bcb04d1d" } ] } ], "note": "GitHub documents a direct self-service path to upgrade personal accounts to GitHub Pro or organization accounts to GitHub Team/Enterprise via account billing settings without requiring a vendor decision point." } ], "blockers": [], "remediations": [] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "GitHub REST API documentation describes creating personal access tokens and generating user access tokens or client secrets via app settings. Delivering credentials through manual UI creation or OAuth exchange flows involves human transfer or web/device authorization handoffs." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Provisioning repository resources can be initiated directly via POST HTTP requests to the REST API endpoints (/orgs/{org}/repos and /user/repos)." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "Creating a repository returns a synchronous 201 Created HTTP response status code with the created repository object." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:44.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c2621293ff4820fd00b9bbc66bcb3c3b56dd8f5824f3c8f54d4a55e31892f5c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:282f848128eb96aebc60e921534a0efaf891376d3a4e563212643b10d9c41648", "sha256:284fe674c313d598bd6b21d153ab2d61a64f404348d74a5f89d280f35af51cee", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, "locators": [ { "artifact_digest": "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813", "start_byte": 29126, "end_byte": 29922, "value_digest": "sha256:7dc898350615e656a161d65b51f0b20888b42eea915cdb5328d8bef2f7ff51d3" }, { "artifact_digest": "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813", "start_byte": 34620, "end_byte": 35391, "value_digest": "sha256:64e4328ee167146bc17b1bd08a8a08cb43581f6ba06896f8c191e1150d2a607d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c1e36f6d8dedc87fdd161e3970b008acc9b6e283fb319a6bc393f1b56b2791c4", "capture_rung": "http" } ], "artifact_digests": [ "sha256:10c648cbcce7b71365bd3df461419a22811b773917bddf4d23b6b8b679b5d417", "sha256:33c0fee92384401366a7a22b88e9f13a4592a8b774af126f48b2cd146b747286", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:bbb07cc226a9a6c5eebe98f1f16a58a6995946c87a7379103b9687e1102a0dd7" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:bbb07cc226a9a6c5eebe98f1f16a58a6995946c87a7379103b9687e1102a0dd7", "start_byte": 19175, "end_byte": 19967, "value_digest": "sha256:e62d6e3275096512ce6e0f209410fbda76ca8bbc57a5332ba147b79386cb3c30" }, { "artifact_digest": "sha256:bbb07cc226a9a6c5eebe98f1f16a58a6995946c87a7379103b9687e1102a0dd7", "start_byte": 23945, "end_byte": 24740, "value_digest": "sha256:e4dc03c0316d2af5f279ddb8cc3fb70ba9e86056cb558872d04daeed83b60524" } ] } ], "note": "GitHub REST API documentation describes creating personal access tokens and generating user access tokens or client secrets via app settings. Delivering credentials through manual UI creation or OAuth exchange flows involves human transfer or web/device authorization handoffs.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:12.946Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "repository-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:4a45e9302f4adfbe0ddce24ca1f58414eba5f697ec492c9887a8ac1ec5a1de0e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "sha256:4250c72556935c6ea646977fb0f05a8382ec6c75c443ff5c04bb08afd3786959", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:dfac729c486c049f681ca266c7b6c6369be7172af4c35d41910643371fa7ed61" ], "source_surface": { "node_kind": "resource", "node_id": "repository-operations" }, "locators": [ { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 177047, "end_byte": 177775, "value_digest": "sha256:65698da4855059c0065f2284dcd3b087d1b66496d88c77ec56e177c323c80c0b" }, { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 219870, "end_byte": 220661, "value_digest": "sha256:120f2d402b1ec35be35a91676057c1b444c7774126b542399cca7640722cfb6f" } ] } ], "note": "Creating a repository returns a synchronous 201 Created HTTP response status code with the created repository object." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:12.946Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "repository-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:4a45e9302f4adfbe0ddce24ca1f58414eba5f697ec492c9887a8ac1ec5a1de0e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:893eb243752ff28857d5922985d6613faed73e5019ff77dae1093ee2469d0687", "sha256:dfac729c486c049f681ca266c7b6c6369be7172af4c35d41910643371fa7ed61" ], "source_surface": { "node_kind": "resource", "node_id": "repository-operations" }, "locators": [ { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 220662, "end_byte": 221459, "value_digest": "sha256:b34531ae74b54b68b056fe7e27c55576d7365b9135ecf60712a61275a3249c19" }, { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 32920, "end_byte": 33717, "value_digest": "sha256:f4bea6cbe5c1993561073450655d2c80773b25a71dc3e42398a408819b8ff8ce" } ] } ], "note": "Provisioning repository resources can be initiated directly via POST HTTP requests to the REST API endpoints (/orgs/{org}/repos and /user/repos)." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Troubleshooting documentation defines status codes, rate limit error handling (using x-ratelimit-remaining, x-ratelimit-reset, and retry-after headers), exponential backoff for retries, timeouts, and JSON validation errors, but idempotency, cancellation, and reconciliation semantics are not fully established." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence mentions an OpenAPI description for the REST API, but it does not establish a verified agent-native protocol interface such as MCP or A2A for the assessment targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "The documentation establishes token expiration, token refresh via refresh tokens, and token revocation via the credential revocation API, but complete agent-operable credential recovery and lifecycle automation across all credential types remain unevidenced." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Documented usable HTTP REST API endpoints and code examples exist for every essential target surface in the scope." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication is documented using personal access tokens, GitHub App access tokens, or GITHUB_TOKEN passed in the Authorization header as Bearer or token." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "The essential operations across the rate-limits, repository-operations, rest-api, and troubleshooting targets have documented HTTP methods, path/query parameters, request/response headers, status codes, schemas, and error structures." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:06.991Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence mentions an OpenAPI description for the REST API, but it does not establish a verified agent-native protocol interface such as MCP or A2A for the assessment targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:30.930Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1a8e8dbba00a0893a6d6fdcbe84018d7f74b9a22a326ae45c14db05a0338c665", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57e9ecf795e38c654772e8c75355a85e971b9b00407e3df89a08faa6ac8eb223", "sha256:aef3d4e7a88af82f631d9db55d21d7eb457f97bb05029b095d6d4ad3d59d848b", "sha256:f074290a33896fb046b07aa1ab40b30f8f5a953602d9e01959f6658a9879a09b" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" }, "locators": [ { "artifact_digest": "sha256:f074290a33896fb046b07aa1ab40b30f8f5a953602d9e01959f6658a9879a09b", "start_byte": 15398, "end_byte": 16195, "value_digest": "sha256:a73d1e2bb3cdf0edb0758dfda8cb8ebebf3196256b732d047459a471eb8dbdbc" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c2621293ff4820fd00b9bbc66bcb3c3b56dd8f5824f3c8f54d4a55e31892f5c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1209ea3a91548ead1bd71d35132aa8e63230f50a91b1ac99626e25200b52b8da", "sha256:284fe674c313d598bd6b21d153ab2d61a64f404348d74a5f89d280f35af51cee", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, "locators": [ { "artifact_digest": "sha256:b14cd43bef83920cff60ad42c71e0d446fd07d3baf74f9950a7132db09a21813", "start_byte": 19554, "end_byte": 20352, "value_digest": "sha256:33c65dcae4ef292b2a6ce96f0486f30d6e4646a6a402947689e712c2af81ff63" } ] } ], "note": "The documentation establishes token expiration, token refresh via refresh tokens, and token revocation via the credential revocation API, but complete agent-operable credential recovery and lifecycle automation across all credential types remain unevidenced.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:46.054Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "troubleshooting" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:8b00c23e75326de0f227b3286667d98e9227b3708453361d2d8e90ecd5b862b4", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6da88bb95530ade99e85b93719080e986d3444eeec62a65ec0a9c28a80c7e77e", "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "sha256:b5fa91db74d9250c362b4ae5cf4b274698069e26e25eea33fb8cde53a8b2e644" ], "locators": [ { "artifact_digest": "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "start_byte": 17038, "end_byte": 17837, "value_digest": "sha256:78590c366165daf20ea8c77cdc23812d936db810abc982754a1a97bda3ca87ba" }, { "artifact_digest": "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "start_byte": 17838, "end_byte": 18632, "value_digest": "sha256:92f2be204d2cac44569f28ab2b8ca40af3c585c61ff14a7a4dfd08e1b03e4355" } ] } ], "note": "Troubleshooting documentation defines status codes, rate limit error handling (using x-ratelimit-remaining, x-ratelimit-reset, and retry-after headers), exponential backoff for retries, timeouts, and JSON validation errors, but idempotency, cancellation, and reconciliation semantics are not fully established.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:19.122Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "readiness-f867e853c07445bd6dd0ae50798b4fbbc4ef188327ba924a55ea9570e8b772bf" }, { "node_kind": "resource", "node_id": "readiness-fa223501e9d5b0e1e036c133ac492ac85e4f34ddae80c84c00750d943c5df22d" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c1e36f6d8dedc87fdd161e3970b008acc9b6e283fb319a6bc393f1b56b2791c4", "capture_rung": "http" } ], "artifact_digests": [ "sha256:10c648cbcce7b71365bd3df461419a22811b773917bddf4d23b6b8b679b5d417", "sha256:12303fe165ea569bcd6eda0e4c5003759c7d4d8bc2d28b5116dd2f8a105d4316", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:bbb07cc226a9a6c5eebe98f1f16a58a6995946c87a7379103b9687e1102a0dd7" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:bbb07cc226a9a6c5eebe98f1f16a58a6995946c87a7379103b9687e1102a0dd7", "start_byte": 18375, "end_byte": 19174, "value_digest": "sha256:9f71d0d0716ba3e65c6a9f75a9b2977648cf6307c4825af1513ecf23ef93f0f7" } ] } ], "note": "Request-time authentication is documented using personal access tokens, GitHub App access tokens, or GITHUB_TOKEN passed in the Authorization header as Bearer or token." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:46.054Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:8b00c23e75326de0f227b3286667d98e9227b3708453361d2d8e90ecd5b862b4", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:72c222bd70e7b14285ee8808ec88586fce643d9e04e8b28c876ddc5eb108b86e", "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "sha256:b5fa91db74d9250c362b4ae5cf4b274698069e26e25eea33fb8cde53a8b2e644" ], "source_surface": { "node_kind": "resource", "node_id": "troubleshooting" }, "locators": [ { "artifact_digest": "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "start_byte": 28191, "end_byte": 28988, "value_digest": "sha256:50bc6e53522f5f19427c81ecf4a1741b7d6b1707e28dc983f4e090f00d160c94" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:90d409b69686f2fc98c7434a7104970895df98e155e0c3e76ecf5b61b0496928", "capture_rung": "http" } ], "artifact_digests": [ "sha256:187dc8c39799cb1649e5bd0256a93eee92bac4c2fd5e9d7e9266bd4874c8e769", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e0eee7a931a3986ffb62a920f63bec9d478f31f19ba60cad44df78a2bffa3352", "sha256:ea43d4200dd70ac8428ebce155eed9ef5944d7a31d1f7d5fad8a9f8d2be1532c" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:ea43d4200dd70ac8428ebce155eed9ef5944d7a31d1f7d5fad8a9f8d2be1532c", "start_byte": 23659, "end_byte": 24446, "value_digest": "sha256:beb7792283430a80a59581b9b368e6c0425fd945af0ef01ab800fb9cced9261b" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:4a45e9302f4adfbe0ddce24ca1f58414eba5f697ec492c9887a8ac1ec5a1de0e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:96d13887198a21f8310f84210753766be27d0919020755680ba69d47eb10058e", "sha256:dfac729c486c049f681ca266c7b6c6369be7172af4c35d41910643371fa7ed61" ], "source_surface": { "node_kind": "resource", "node_id": "repository-operations" }, "locators": [ { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 32920, "end_byte": 33717, "value_digest": "sha256:f4bea6cbe5c1993561073450655d2c80773b25a71dc3e42398a408819b8ff8ce" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fd3be7e24a92ae459d06c1a03b36b03dfe969476591a6e60baa8b9de71229696", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad57fd09089bb3aa4f9606f9ca625af9028f3cb44171857a4a009deb69c4eff8", "sha256:c05020cba21a5bf87c256b3222c0d92140041255300a7fbb373fab2f4a0e4a82" ], "source_surface": { "node_kind": "resource", "node_id": "rest-api" }, "locators": [ { "artifact_digest": "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "start_byte": 16995, "end_byte": 17793, "value_digest": "sha256:99b686f4a2ff067c0c92a6e9f81501e19571ac9488ffae204a6524962bc09152" } ] } ], "note": "The essential operations across the rate-limits, repository-operations, rest-api, and troubleshooting targets have documented HTTP methods, path/query parameters, request/response headers, status codes, schemas, and error structures." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:46.054Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "repository-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:4a45e9302f4adfbe0ddce24ca1f58414eba5f697ec492c9887a8ac1ec5a1de0e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b38175e7e230304e6ab81ba9c3549b6117bc132e6dfa238b13aebf2cb106a268", "sha256:dfac729c486c049f681ca266c7b6c6369be7172af4c35d41910643371fa7ed61" ], "source_surface": { "node_kind": "resource", "node_id": "repository-operations" }, "locators": [ { "artifact_digest": "sha256:14ec3bdc1a4d8a7bc7eb31b01347d60f3a93e73fa0b0fb9a35e35d9a3b8c9509", "start_byte": 20404, "end_byte": 21175, "value_digest": "sha256:0010e7b91f5660370e24bdfe167786a1afe4ebf994516f9e769f1ac11801d1a4" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:90d409b69686f2fc98c7434a7104970895df98e155e0c3e76ecf5b61b0496928", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e0eee7a931a3986ffb62a920f63bec9d478f31f19ba60cad44df78a2bffa3352", "sha256:e2d9a89b367514792690b7e0f160a3b8cb6555202fd47fbf514e9f01526aa8c7", "sha256:ea43d4200dd70ac8428ebce155eed9ef5944d7a31d1f7d5fad8a9f8d2be1532c" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:ea43d4200dd70ac8428ebce155eed9ef5944d7a31d1f7d5fad8a9f8d2be1532c", "start_byte": 18875, "end_byte": 19671, "value_digest": "sha256:63aa3722a2dbaefbbc4c1c3e2bf790ce2b3d9e8d39d635bb4e71e7be185baf48" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:8b00c23e75326de0f227b3286667d98e9227b3708453361d2d8e90ecd5b862b4", "capture_rung": "http" } ], "artifact_digests": [ "sha256:497464841962d077e64d1fc851d64ec3e615724d59ddedc3cf01774225c83348", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "sha256:b5fa91db74d9250c362b4ae5cf4b274698069e26e25eea33fb8cde53a8b2e644" ], "source_surface": { "node_kind": "resource", "node_id": "troubleshooting" }, "locators": [ { "artifact_digest": "sha256:a0359ef7fae42374e703170da2717f134165d35bb2626bf36ab9fabe5583c04f", "start_byte": 26591, "end_byte": 27390, "value_digest": "sha256:720090c1a54fb42a127ce9917ecce723ccd7dab8038db40625c4d1952aeaed1d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fd3be7e24a92ae459d06c1a03b36b03dfe969476591a6e60baa8b9de71229696", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad57fd09089bb3aa4f9606f9ca625af9028f3cb44171857a4a009deb69c4eff8", "sha256:c05020cba21a5bf87c256b3222c0d92140041255300a7fbb373fab2f4a0e4a82" ], "source_surface": { "node_kind": "resource", "node_id": "rest-api" }, "locators": [ { "artifact_digest": "sha256:4ba86c08fbef4230e58f8b90f763aacb5b5a3476fd6148513a6a9e3290a4c935", "start_byte": 16995, "end_byte": 17793, "value_digest": "sha256:99b686f4a2ff067c0c92a6e9f81501e19571ac9488ffae204a6524962bc09152" } ] } ], "note": "Documented usable HTTP REST API endpoints and code examples exist for every essential target surface in the scope." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-09-06T08:51:30.930Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:041343588f3fff25eaac3bd4a968c9fdec16e3198c4a5265981f5ead1d3a87c2", "sha256:0c0e8ae34fa0aed109cc910ebac7a967d70054433f7ecb46d6fd7afbc9ee8688", "sha256:1787b1ab73fa7c8b5c1238298e69ba95084fd54c420aaadcaff861991d86a9ea", "sha256:1945c439cbbebd0981306097fb3b7383924626c0f2c2a2eaac0ae6ab49a79d55", "sha256:1e4660024d1f56c54e0ab9deea233e7a0b80b97e78a44abd5419fc1c7ba74c5c", "sha256:21973fa0172cf0a717431b303c9372f6341c72f4cb339123ff3411bec3ef0977", "sha256:307fbb73b69691edfb71cc17e0b10cbe7e91fe56f66f6c9a657624cbf6f62d72", "sha256:33276c1b833b3775e988df8e66ebe9fa194c03f5c388f798a78171cb6cbe72e4", "sha256:3493f032bad8d4e4b41fb4e43e99b24783d2ab23a1835a4858bc84063cd361c4", "sha256:3929a85d4aee4432dc65c66ba1b1503ebb12304ab5cb31c796f72e3a06b6a06e", "sha256:47580fac154c43acfca40daceb0e73c5ad2d358039c5d0df87d3c75b3faf0e1b", "sha256:4e182614016436b8d89911fec51df60d00c2d91f78a2402b08eb215136a97179", "sha256:5945d1d93a673fa9d74ee43ed5a07058918e8192e2bd78f234717a603f2c3fd7", "sha256:6bd2dceacd2a358bcd091f6949e8b2751421a36210254a96d6718180bd3f7d42", "sha256:6fc7d1500c690fb491d8d279ce9cca836d4655dd9dfcec0048b707fa9c0e29f1", "sha256:8e55b0696c1ecc88094759c0b49c7a7eec83d9f895b3c7acc3406f78af67a452", "sha256:917dba1cca65508d3bc61322137c164580091d33d21acf187e420cb7ddba1186", "sha256:962f6b0254df03c35512351c3eb30234831c5e5d571bb0055f0ac6c537d7d275", "sha256:9a46a540b5a75e24d1ed31ada0b22e6e80faa88e964814a943bb83de6cbeb3ab", "sha256:a5dfd29ea1b7e5b744187ff72aeaf5edff9cd8e37e9dc568ddbb90fe2a1ace5f", "sha256:aa1f67de16af1e0ce1df350c1f691b84a7a36abf752fb83bfc9515a3c3c3bc7f", "sha256:ab9bcfae099e6c1cde6b2c61abb6b27fbdaa21f31a0f43dfbc4efc5654abd719", "sha256:ad7f4b633024232b039caf53d4f7fd1b2d25949fe4367e5c82c9925d1f179dd0", "sha256:b432e7b77e23f7ca222551548de2d4a38c33a026b6bbd79c750acaca9134433c", "sha256:b795c0c287fdfca939f53fe1d25cac40680360dcb0e4ba94cbeb9020b7084b71", "sha256:b86154b5967e2c3f5d94d3b9fcba4e8065c83a05d515b591aa31bfa865da3af7", "sha256:bc53ecacdcc487eaa2cf6335e6da855e926b95197038bd7612b31ce26d5317f4", "sha256:c6f8cff33c82c952fdc273d645ead246dd1708cde2d57a580fb07914421145a7", "sha256:cacb632e4eec356e24937db6ab07888041cf52477f903ad80dc5a217de8414f7", "sha256:d51e3d3973b09cf763904c1b452804261b27152369c1752d246209eff53f8825", "sha256:d83af98f080ae0eca3e95ec9525c303ec7dc6f62fe7bd0df321ba437742a0df5", "sha256:dbfaa0370baedc1b3146629ffc77899932e2c811a1b3979e5a722360304fe76f", "sha256:de14e54c8cd3c15233066c8cda611d1994a4b3536aa522ac1376324c402585bb", "sha256:e01a18f97f51c7061211f52b254c7b84b3227c8e19054dcd9391e4b08709e0bd", "sha256:e0df8007eb6dc55c20ce6813952356e0a3b0b0e93a785b0074f20ca9b1fe5ec4", "sha256:f198d78ff9575d9e75a62c2bb3e399007457e26d81259ea9c571f464e6c9c6ea", "sha256:f9140324b2edf48e136d2a691dbc684d2f0785623c20d3f80d85ae8812994f16", "sha256:fcc81e43242b3c0f761dd006409a9945b4ac47965cf7c5bcc7a8fbe58402b813" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:3929a85d4aee4432dc65c66ba1b1503ebb12304ab5cb31c796f72e3a06b6a06e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.769Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:041343588f3fff25eaac3bd4a968c9fdec16e3198c4a5265981f5ead1d3a87c2" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:10.796Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:ad7f4b633024232b039caf53d4f7fd1b2d25949fe4367e5c82c9925d1f179dd0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:06.991Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:5945d1d93a673fa9d74ee43ed5a07058918e8192e2bd78f234717a603f2c3fd7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:06.991Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:cacb632e4eec356e24937db6ab07888041cf52477f903ad80dc5a217de8414f7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:01.769Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:1787b1ab73fa7c8b5c1238298e69ba95084fd54c420aaadcaff861991d86a9ea", "sha256:e0df8007eb6dc55c20ce6813952356e0a3b0b0e93a785b0074f20ca9b1fe5ec4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:19.122Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:8e55b0696c1ecc88094759c0b49c7a7eec83d9f895b3c7acc3406f78af67a452" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:23.651Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:de14e54c8cd3c15233066c8cda611d1994a4b3536aa522ac1376324c402585bb" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:47.162Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:6fc7d1500c690fb491d8d279ce9cca836d4655dd9dfcec0048b707fa9c0e29f1", "sha256:b432e7b77e23f7ca222551548de2d4a38c33a026b6bbd79c750acaca9134433c", "sha256:d51e3d3973b09cf763904c1b452804261b27152369c1752d246209eff53f8825" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:23.651Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:0c0e8ae34fa0aed109cc910ebac7a967d70054433f7ecb46d6fd7afbc9ee8688", "sha256:aa1f67de16af1e0ce1df350c1f691b84a7a36abf752fb83bfc9515a3c3c3bc7f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:30.930Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:962f6b0254df03c35512351c3eb30234831c5e5d571bb0055f0ac6c537d7d275", "sha256:f198d78ff9575d9e75a62c2bb3e399007457e26d81259ea9c571f464e6c9c6ea" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:23.651Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:307fbb73b69691edfb71cc17e0b10cbe7e91fe56f66f6c9a657624cbf6f62d72" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:02.096Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:1e4660024d1f56c54e0ab9deea233e7a0b80b97e78a44abd5419fc1c7ba74c5c", "sha256:47580fac154c43acfca40daceb0e73c5ad2d358039c5d0df87d3c75b3faf0e1b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:10.796Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:917dba1cca65508d3bc61322137c164580091d33d21acf187e420cb7ddba1186" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:02.096Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:c6f8cff33c82c952fdc273d645ead246dd1708cde2d57a580fb07914421145a7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:02.096Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:b795c0c287fdfca939f53fe1d25cac40680360dcb0e4ba94cbeb9020b7084b71", "sha256:e01a18f97f51c7061211f52b254c7b84b3227c8e19054dcd9391e4b08709e0bd" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:44.386Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:33276c1b833b3775e988df8e66ebe9fa194c03f5c388f798a78171cb6cbe72e4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:12.946Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:d83af98f080ae0eca3e95ec9525c303ec7dc6f62fe7bd0df321ba437742a0df5" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:12.946Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:b86154b5967e2c3f5d94d3b9fcba4e8065c83a05d515b591aa31bfa865da3af7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:06.991Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:1945c439cbbebd0981306097fb3b7383924626c0f2c2a2eaac0ae6ab49a79d55", "sha256:a5dfd29ea1b7e5b744187ff72aeaf5edff9cd8e37e9dc568ddbb90fe2a1ace5f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:30.930Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:fcc81e43242b3c0f761dd006409a9945b4ac47965cf7c5bcc7a8fbe58402b813" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:46.054Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:3493f032bad8d4e4b41fb4e43e99b24783d2ab23a1835a4858bc84063cd361c4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:19.122Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:ab9bcfae099e6c1cde6b2c61abb6b27fbdaa21f31a0f43dfbc4efc5654abd719", "sha256:bc53ecacdcc487eaa2cf6335e6da855e926b95197038bd7612b31ce26d5317f4", "sha256:dbfaa0370baedc1b3146629ffc77899932e2c811a1b3979e5a722360304fe76f", "sha256:f9140324b2edf48e136d2a691dbc684d2f0785623c20d3f80d85ae8812994f16" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:46.054Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:21973fa0172cf0a717431b303c9372f6341c72f4cb339123ff3411bec3ef0977", "sha256:4e182614016436b8d89911fec51df60d00c2d91f78a2402b08eb215136a97179", "sha256:6bd2dceacd2a358bcd091f6949e8b2751421a36210254a96d6718180bd3f7d42", "sha256:9a46a540b5a75e24d1ed31ada0b22e6e80faa88e964814a943bb83de6cbeb3ab" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:46.054Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/github/agent-readiness/github-rest-api/repository-operations", "projection_digest": "sha256:3a41317759a471cf0c46745bf258d1a9dfc082027c87f195c14746ac2523392b" } } }