{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea", "entity_slug": "neon", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xc6w3hq8r2f9bj5nta", "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea", "scope": { "product": { "key": "neon-api", "name": "Neon API" }, "funnel": { "key": "project-database-lifecycle", "name": "Project and database lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:f7efa8be65ed9dd1e5649201793fa6c168f217b8886de5764e635ced89e485cd" }, "declaration_revision_digest": "sha256:aa7e9acb167fe90a50fff00c79fef920a5a8f831444401e6a97b73f3b922d798", "declaration": { "declaration_id": "declaration_neon_api_project_database_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/ne/neon.yaml", "git_blob_oid": "fdf7c98599959bf86d39fc96b562a41f42128bfe", "blob_digest": "sha256:894902fd8c642c686018762230928acded4f2bc56bc166998ae52b983f8cb4ba" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage Neon projects and databases through the API", "interface_ids": [ "project-api" ] } ], "participants": [ { "participant_id": "neon", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe42ws3zbxkkaybx2ea" } } ], "resources": [ { "resource_id": "api-keys", "uri": "https://neon.com/docs/manage/api-keys", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://api-docs.neon.tech/reference/getting-started-with-neon-api", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://neon.com/docs/introduction/plans", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "branch-operations", "uri": "https://neon.com/docs/manage/branches", "roles": [ "documentation", "operations", "provisioning", "recovery", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "console-signup", "uri": "https://console.neon.tech/signup", "roles": [ "access" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "create-project", "uri": "https://api-docs.neon.tech/reference/createproject", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://neon.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "project-operations", "uri": "https://neon.com/docs/manage/projects", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231", "uri": "https://neon.com/docs/manage/accounts", "roles": [ "access", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8", "uri": "https://neon.com/docs/introduction/manage-billing", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://neon.com/terms-of-service", "roles": [ "terms" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://neon.com/docs/introduction/support", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "neon-api", "uri": "https://console.neon.tech/api/v2", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "endpoint_id": "registration", "uri": "https://console.neon.tech/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "api-keys" ], "operated_by_participant_id": "neon", "standard_bindings": [] }, { "interface_id": "project-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "neon-api" ], "resource_ids": [ "api-reference", "branch-operations", "create-project", "project-operations" ], "operated_by_participant_id": "neon", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "projects-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "create-project" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "project-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "console-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:767084f9b1fa842a33dda9a1e5b2d39adbd85d9975b5622edf5f63779517ff6d", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "C+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "evaluate", "stage_label": "Evaluate", "public_state": "limited", "finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "Discovery works but is incomplete, context-dependent, split, or unstable.", "context": "The page states that the Neon API reference has moved to https://neon.com/docs/reference/api and that api-docs.neon.tech is deprecated and will be retired soon, though the Neon API itself remains fully supported and unchanged." } }, "limitations": [ { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "Discovery works but is incomplete, context-dependent, split, or unstable.", "context": "The page states that the Neon API reference has moved to https://neon.com/docs/reference/api and that api-docs.neon.tech is deprecated and will be retired soon, though the Neon API itself remains fully supported and unchanged." }, "remediation": { "signal_code": "service_discovery", "code": "improve.evaluate.service_discovery", "instruction": "Publish and link one stable canonical service and access entrypoint." } }, { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Neon supports Personal, Organization, and Project-scoped API keys with specific roles and revocation support, but creating the first API key requires manual authentication in the console." }, "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "When creating API keys from the Neon Console, the secret token will be displayed only once and cannot be retrieved later, requiring manual copying." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "Create project returns 201 with a connection URI, database, password and role, but the same response documentation instructs callers to wait until the project's operations finish before connecting; the asynchronous completion bound is not established." }, "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "The Create project endpoint documentation details response status codes, including safe retries for GET, HEAD, OPTIONS, 503 Service Unavailable, and 423 Locked responses, as well as warning that non-idempotent methods (POST, PATCH, DELETE, PUT) are generally not safe to retry. Safe failure semantics are only partially documented across all operations." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "API keys can be listed, created, and manually rotated or immediately revoked via the Console, CLI, or API, including when a key is suspected of being compromised. However, API keys do not expire on a schedule and expiration handling is not provided." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "Discovery works but is incomplete, context-dependent, split, or unstable.", "context": "The page states that the Neon API reference has moved to https://neon.com/docs/reference/api and that api-docs.neon.tech is deprecated and will be retired soon, though the Neon API itself remains fully supported and unchanged." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence does not provide explicit declarations or policy rules regarding web agent or web crawler access permissions such as robots.txt directives." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Applicable terms are publicly accessible and retrievable via the Product Specific Schedule (Neon), which governs Customer's use of Databricks' Neon product family and incorporates the Databricks Master Cloud Services Agreement." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "The Neon terms of service establish that Databricks and Customer govern the use of Platform Services. Entering into the Schedule on behalf of a company requires representing and warranting authority to bind that entity, otherwise 'Customer' refers to the individual." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Neon explicitly details its pricing rates, variables, and currency in USD. For example, Launch plan compute is $0.106 per CU-hour, Scale plan compute is $0.222 per CU-hour, and Free plan provides 100 CU-hours of database compute per project per month scaling to zero when idle." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "The documentation explicitly references structured discovery artifacts, noting that an index of all pages formatted in Markdown and endpoints in OpenAPI is available at https://api-docs.neon.tech/llms.txt." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:26.178Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b8c6d2566ed7c9d92d4367623e23175167bc851f13411f7ea7a3d212cceac545", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5992e79ae4c605df3951e4a5a57b0f10058a57ed067cc3ff12e1715b15bd9b87", "sha256:c85742301de66e30f495148e7368f428bcb785195dd756fced941b95d96ba0a5", "sha256:f56d594f63f7303a9ea202404a908a9a4d8109feec9c48ffd76b7756e93e041f", "sha256:f75e7fb2e0f966f8bcf21e7332b013d26625639611d6dc64a6b0b13e08213e8b" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:f56d594f63f7303a9ea202404a908a9a4d8109feec9c48ffd76b7756e93e041f", "start_byte": 7055, "end_byte": 7827, "value_digest": "sha256:451139478e681bc583cd1084024e7c5a3b2ec20e194e4423fd50640ee710355f" } ] } ], "note": "The Neon terms of service establish that Databricks and Customer govern the use of Platform Services. Entering into the Schedule on behalf of a company requires representing and warranting authority to bind that entity, otherwise 'Customer' refers to the individual." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:36.862Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:45adeb6dc4775697b148d2c41069e250145d4bfa82fede2dc8326c62a34f75a0", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:99042b2f9354ae085316a5b4f6d9c6c9e9eaeee7a7b38d344692405c00ed8f88", "sha256:c7ebcc961b7b334f1f899dea489fd30bb74760bc88e36dff6ef543b8d862d1a4", "sha256:e52ac6dfcd44385b8c4b4b6785798c7b8fe638d9e4ebd67604e271fb66e9da5e" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:99042b2f9354ae085316a5b4f6d9c6c9e9eaeee7a7b38d344692405c00ed8f88", "start_byte": 14880, "end_byte": 15678, "value_digest": "sha256:885777f9143360045f2ec85316dbf0d1dc4b4020d715e00380792560969a1f1e" } ] } ], "note": "Neon explicitly details its pricing rates, variables, and currency in USD. For example, Launch plan compute is $0.106 per CU-hour, Scale plan compute is $0.222 per CU-hour, and Free plan provides 100 CU-hours of database compute per project per month scaling to zero when idle." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "Discovery works but is incomplete, context-dependent, split, or unstable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.957Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e675c72b238b95488e58497ae4798e67d1b7b7f549cdd9a4bc76e3f9546f621e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4e78d36e648f6c4ada361197138e01707c700f6b57c9e18885be6faf6f63b58a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "sha256:a0e60ee66535a3afca4491eb007f40f9460317a5ed84d16501478a17fbfef991" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "start_byte": 20507, "end_byte": 21310, "value_digest": "sha256:22f432e87cef1503d81c363c3e4b09bc06f6c8c0e0375b74dcdf5478344dceb5" }, { "artifact_digest": "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "start_byte": 0, "end_byte": 767, "value_digest": "sha256:3810d26a1522ad6f7818d9eceddcaea0b2da2491c6bb0f8755bdff43e960e11f" } ] } ], "note": "The page states that the Neon API reference has moved to https://neon.com/docs/reference/api and that api-docs.neon.tech is deprecated and will be retired soon, though the Neon API itself remains fully supported and unchanged.", "remediation": { "signal_code": "service_discovery", "code": "improve.evaluate.service_discovery", "instruction": "Publish and link one stable canonical service and access entrypoint." } }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.957Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" }, { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e675c72b238b95488e58497ae4798e67d1b7b7f549cdd9a4bc76e3f9546f621e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4e78d36e648f6c4ada361197138e01707c700f6b57c9e18885be6faf6f63b58a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "sha256:b40145026b35a7e9e3400de42f5da27c0e553cc0d7ce1dfddf2a69148b44d02a" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "start_byte": 14938, "end_byte": 15736, "value_digest": "sha256:ad7390bf085fc610a70de9cc5ee16c91d96274d9f02f5c02ee4756038860b4ab" } ] } ], "note": "The documentation explicitly references structured discovery artifacts, noting that an index of all pages formatted in Markdown and endpoints in OpenAPI is available at https://api-docs.neon.tech/llms.txt." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:26.178Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b8c6d2566ed7c9d92d4367623e23175167bc851f13411f7ea7a3d212cceac545", "capture_rung": "http" } ], "artifact_digests": [ "sha256:10c225b7f4cf5f21e91683f7404b5beb5172a15649bb5fef219dfa84ea93dcf6", "sha256:c85742301de66e30f495148e7368f428bcb785195dd756fced941b95d96ba0a5", "sha256:f56d594f63f7303a9ea202404a908a9a4d8109feec9c48ffd76b7756e93e041f", "sha256:f75e7fb2e0f966f8bcf21e7332b013d26625639611d6dc64a6b0b13e08213e8b" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:f56d594f63f7303a9ea202404a908a9a4d8109feec9c48ffd76b7756e93e041f", "start_byte": 7055, "end_byte": 7827, "value_digest": "sha256:451139478e681bc583cd1084024e7c5a3b2ec20e194e4423fd50640ee710355f" }, { "artifact_digest": "sha256:f56d594f63f7303a9ea202404a908a9a4d8109feec9c48ffd76b7756e93e041f", "start_byte": 7828, "end_byte": 8623, "value_digest": "sha256:13ac383957d599109aedc295f65e84746e7f6adfd92b27fac76a19c75c0b69ff" } ] } ], "note": "Applicable terms are publicly accessible and retrievable via the Product Specific Schedule (Neon), which governs Customer's use of Databricks' Neon product family and incorporates the Databricks Master Cloud Services Agreement." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:53.118Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" }, { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence does not provide explicit declarations or policy rules regarding web agent or web crawler access permissions such as robots.txt directives." } ], "blockers": [], "remediations": [ { "signal_code": "service_discovery", "code": "improve.evaluate.service_discovery", "instruction": "Publish and link one stable canonical service and access entrypoint." } ] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Neon supports Personal, Organization, and Project-scoped API keys with specific roles and revocation support, but creating the first API key requires manual authentication in the console." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup endpoint returned a 403 Cloudflare security verification page, leaving the operability of access controls unresolved." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup page returned a Cloudflare bot security verification page, and documentation does not explicitly declare a verified-agent alternative or CAPTCHA policy." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup page returned a 403 security verification page, and documentation describes account authentication and 2FA options without explicitly addressing phone verification." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Neon documentation confirms stable access entry points including Sign up, Log in, and Get started buttons." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:57.210Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup endpoint returned a 403 Cloudflare security verification page, leaving the operability of access controls unresolved." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:31.939Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6292cbfa00ceee6db8cbf4999676b0d09122a13b48da05a8c61ce9081bec8717", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:08ad49f8bd79823cdbdfaaa28a352d78acafb4bf8f735f1c84912643f7fb4ce6", "sha256:186cf5210da1ca90dbb9291e91bedc5f684ebd2a458fbb19aa35e0ba01cd2961", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7401b891fb76596679d38a098e57a812928ab8c191af7a820bc7af5f44ce2443", "sha256:825dd5ac96a0e0d93588fb32ff78e5b66515677adff45cbb7c9f4634b7431e71", "sha256:cfb26f05becdcfb3d0a1c8c715c16318ca2d44517581265ff7086bad2eb1b591" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" }, "locators": [ { "artifact_digest": "sha256:cfb26f05becdcfb3d0a1c8c715c16318ca2d44517581265ff7086bad2eb1b591", "start_byte": 6861, "end_byte": 7660, "value_digest": "sha256:3981edd0af3858fb2fabdc73e4927603258e17af5ea37ca196b5d5971e04f11a" } ] } ], "note": "Neon documentation confirms stable access entry points including Sign up, Log in, and Get started buttons." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:57.210Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup page returned a Cloudflare bot security verification page, and documentation does not explicitly declare a verified-agent alternative or CAPTCHA policy." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:53.118Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7dc49aee89630e5ac7cb0cbf3288769f74c41ebdb59f210a4632ac062bba8a1d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:02b30c49ea28e11b58fe299f1c57afa7c5c68bd91987e0dc3acfde653f3d9c0e", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "sha256:9fc1a18563fda5734812437fa7302fcdb0ab30b2faf116836ff10fea01f94a48" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 9404, "end_byte": 10204, "value_digest": "sha256:738cd96a2a42fa2dab75c124e8232e93615d21626a1d83421547d3f4c27bd389" }, { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 8605, "end_byte": 9403, "value_digest": "sha256:6caf7c2c0193a9f002dbfb8ecdeb8673b9d09b949d0735ea4befb053e6e4214a" } ] } ], "note": "Neon supports Personal, Organization, and Project-scoped API keys with specific roles and revocation support, but creating the first API key requires manual authentication in the console.", "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:57.210Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "console-signup" }, { "node_kind": "resource", "node_id": "readiness-5d65e00053d275dc55701ece542bb1e203f417bf461cf87ed7aca40281604231" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup page returned a 403 security verification page, and documentation describes account authentication and 2FA options without explicitly addressing phone verification." } ], "blockers": [], "remediations": [ { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "Neon discloses its plan commitment details, including a $0/month Free tier and pay-for-what-you-use pricing for Launch ($0.106 per CU-hour, $0.20 per GB-month storage) and Scale ($0.222 per CU-hour) plans." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence describes Neon's billing summary and invoice views in the console, but it does not disclose a deterministic API or web workflow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The documentation covers plan prices and paying invoices manually via the console, but it does not document a payment rail supporting scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Neon documents a direct self-service path to paid access where users can upgrade from the Free plan to Launch or Scale pay-as-you-go plans without requiring a vendor decision point or sales interaction." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:34.483Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence describes Neon's billing summary and invoice views in the console, but it does not disclose a deterministic API or web workflow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:36.862Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:45adeb6dc4775697b148d2c41069e250145d4bfa82fede2dc8326c62a34f75a0", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1b4fe5031c384b5a4518b2a7d689264f389ceb3301a0cc353e814d0f7f3fa5e0", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:99042b2f9354ae085316a5b4f6d9c6c9e9eaeee7a7b38d344692405c00ed8f88", "sha256:e52ac6dfcd44385b8c4b4b6785798c7b8fe638d9e4ebd67604e271fb66e9da5e" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:99042b2f9354ae085316a5b4f6d9c6c9e9eaeee7a7b38d344692405c00ed8f88", "start_byte": 10881, "end_byte": 11679, "value_digest": "sha256:bdde191af5103e5c4074537c812a138a66049f9cc2c6f165aaef21d092ce382c" } ] } ], "note": "Neon discloses its plan commitment details, including a $0/month Free tier and pay-for-what-you-use pricing for Launch ($0.106 per CU-hour, $0.20 per GB-month storage) and Scale ($0.222 per CU-hour) plans." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:34.483Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The documentation covers plan prices and paying invoices manually via the console, but it does not document a payment rail supporting scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:34.483Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-a75ce7955cfd5f96e15192ecd4ffb6cb37ec27d3c666eca1b31e8b3466a289d8" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:44fdf12367db4bae47808f6a94df3bce617af06cb0b6647e6f1ebd8c14fe739a", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:520ccdbdc689e4eba8d6198f2e1e65d7becf4a9fe6b574c09416af85b662370f", "sha256:9b562385d81a837dc7d019f0c684c29017b55a668aba81609acb78cbc36ba10c", "sha256:f69b924035bc4250c79f2a15aa40dee410f9f60e91a7d2ca4f50a4ebc49ed2d0" ], "source_surface": { "node_kind": "resource", "node_id": "billing-checkout" }, "locators": [ { "artifact_digest": "sha256:9b562385d81a837dc7d019f0c684c29017b55a668aba81609acb78cbc36ba10c", "start_byte": 19105, "end_byte": 19905, "value_digest": "sha256:ad0d728d476307988bcc46fd3eb90de3fe666d4f1171dca51df30c536845eda9" } ] } ], "note": "Neon documents a direct self-service path to paid access where users can upgrade from the Free plan to Launch or Scale pay-as-you-go plans without requiring a vendor decision point or sales interaction." } ], "blockers": [], "remediations": [] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "When creating API keys from the Neon Console, the secret token will be displayed only once and cannot be retrieved later, requiring manual copying." }, "secondary_context": [ { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "Create project returns 201 with a connection URI, database, password and role, but the same response documentation instructs callers to wait until the project's operations finish before connecting; the asynchronous completion bound is not established." }, { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Creating a project can be initiated directly via an HTTP POST request to the Neon API endpoint (/projects)." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:53.118Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7dc49aee89630e5ac7cb0cbf3288769f74c41ebdb59f210a4632ac062bba8a1d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "sha256:9fc1a18563fda5734812437fa7302fcdb0ab30b2faf116836ff10fea01f94a48", "sha256:faf4a8f99c3494d64f8fd0608fc335557a9baf99d8886b3aec45864189776f16" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 9404, "end_byte": 10204, "value_digest": "sha256:738cd96a2a42fa2dab75c124e8232e93615d21626a1d83421547d3f4c27bd389" }, { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 10205, "end_byte": 10997, "value_digest": "sha256:ae373420d25c5313c28282d3275b2da90232fe7664c7f5e8404ab730f77454b2" } ] } ], "note": "When creating API keys from the Neon Console, the secret token will be displayed only once and cannot be retrieved later, requiring manual copying.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:49.782Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "create-project" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:2d4d184c0b5af0bb655f0efb7c55f7137f21d525f707c4a3cea0a3b57c232a02", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "sha256:8d2e581ecd50e504b93bcafc77bc8ca42853f760778eeda9593ee43c3f0ad614", "sha256:f177eee6d936c191cba5778537dd26ee7eb0d45e1df5619c1299d057f44d0b1a" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "start_byte": 24205, "end_byte": 24983, "value_digest": "sha256:c871186be9bda6fa03e34024d571f32bfc005579066ae32098c501e38d0753f8" } ] } ], "note": "Create project returns 201 with a connection URI, database, password and role, but the same response documentation instructs callers to wait until the project's operations finish before connecting; the asynchronous completion bound is not established.", "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:49.782Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" }, { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "create-project" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:2d4d184c0b5af0bb655f0efb7c55f7137f21d525f707c4a3cea0a3b57c232a02", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "sha256:869d3247d416e1935b422b570548829e8b866388c9a12d38c5ae90d90b967c91", "sha256:8d2e581ecd50e504b93bcafc77bc8ca42853f760778eeda9593ee43c3f0ad614" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "start_byte": 23409, "end_byte": 24204, "value_digest": "sha256:3e8fb6e3ddafe081bd48d0640200d6617118bf4b15af8ac452617251ac235acf" } ] } ], "note": "Creating a project can be initiated directly via an HTTP POST request to the Neon API endpoint (/projects)." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." }, { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "The Create project endpoint documentation details response status codes, including safe retries for GET, HEAD, OPTIONS, 503 Service Unavailable, and 423 Locked responses, as well as warning that non-idempotent methods (POST, PATCH, DELETE, PUT) are generally not safe to retry. Safe failure semantics are only partially documented across all operations." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Neon API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "API keys can be listed, created, and manually rotated or immediately revoked via the Console, CLI, or API, including when a key is suspected of being compromised. However, API keys do not expire on a schedule and expiration handling is not provided." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "All essential target operations—including getting started reference, branch operations, project creation, and project management—are operable through documented HTTP API endpoints or CLI tools." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Neon API operations authenticate using HTTP request headers containing a Bearer token with a 64-bit API key (Personal, Organization, or Project-scoped)." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Essential operations across the API reference, branch operations, project creation, and project operations document request parameters, HTTP methods, endpoints, JSON schemas, response structures, and operational effects." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:51.042Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "project-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Neon API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:53.118Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7dc49aee89630e5ac7cb0cbf3288769f74c41ebdb59f210a4632ac062bba8a1d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "sha256:9fc1a18563fda5734812437fa7302fcdb0ab30b2faf116836ff10fea01f94a48", "sha256:df7c5d27ab9414a484655e0772abf63681e585549e08ca8a1bfe85c93bb13f7a" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 13393, "end_byte": 14189, "value_digest": "sha256:1b786043346d9ef967418c895306282a015d864c0c77b717583aa600bc3914f2" }, { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 14190, "end_byte": 14987, "value_digest": "sha256:c9f955e16660266639d49358c90297fb5cb48121c17cad85fa7a5ef5633727b0" } ] } ], "note": "API keys can be listed, created, and manually rotated or immediately revoked via the Console, CLI, or API, including when a key is suspected of being compromised. However, API keys do not expire on a schedule and expiration handling is not provided.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:51.042Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "branch-operations" }, { "node_kind": "resource", "node_id": "project-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:827c841ad871361927d08128988d53b32a2b9933e9d2951aad2f0caa2d48a7d6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:adc8ad3c64dbe6aa9f38e688ea75e8d7d3965d019919e6f4c17ecb711be91f93", "sha256:baa316ce6e4de1e9245068f5426a12ad36df8c91b8bb091da031995a8cd602c6" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "start_byte": 30017, "end_byte": 30817, "value_digest": "sha256:80e6a87b1d9f60c496c5af58abd367e5acf84445f066c50aa0fa3b64b8ad3149" } ] } ], "note": "The Create project endpoint documentation details response status codes, including safe retries for GET, HEAD, OPTIONS, 503 Service Unavailable, and 423 Locked responses, as well as warning that non-idempotent methods (POST, PATCH, DELETE, PUT) are generally not safe to retry. Safe failure semantics are only partially documented across all operations.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:53.118Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-keys" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7dc49aee89630e5ac7cb0cbf3288769f74c41ebdb59f210a4632ac062bba8a1d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5635ced42cb4dcbefa1e8d3125fe129220c1fa72ac2e39b7cd6923abdec1dcb1", "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "sha256:9fc1a18563fda5734812437fa7302fcdb0ab30b2faf116836ff10fea01f94a48" ], "source_surface": { "node_kind": "resource", "node_id": "api-keys" }, "locators": [ { "artifact_digest": "sha256:6c48477f961f02a1295ee87ee45010d0d5e70514a062c8c7156d573a92c62077", "start_byte": 11794, "end_byte": 12594, "value_digest": "sha256:d0a5ed858727d5835eb772e00a6e82b3b31fb0c31f6a26f0cd9ef66066f523b2" } ] } ], "note": "Neon API operations authenticate using HTTP request headers containing a Bearer token with a 64-bit API key (Personal, Organization, or Project-scoped)." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:51.042Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "project-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:dc3bfe39da17d9eabdc35887f4fb301d40427e1b7354938018cb2748a7bdf38c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1e0fa4574ff12544d1ea60b90e69a616d174328951d71641376b6d28059fb9e0", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5968d97899970bc8f2d065b330572dfb9e95c73fdcf11a606b5e3de065cf541f", "sha256:c6c31fbf28cf8f798225f54a83b2e2c00934321e8d214dac67a57a349d77a5f8" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:5968d97899970bc8f2d065b330572dfb9e95c73fdcf11a606b5e3de065cf541f", "start_byte": 24747, "end_byte": 25537, "value_digest": "sha256:b74e36f3ca58b4d7665effef37048fed2a990765c86507f3ffb93399a17ab47e" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:2d4d184c0b5af0bb655f0efb7c55f7137f21d525f707c4a3cea0a3b57c232a02", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "sha256:869d3247d416e1935b422b570548829e8b866388c9a12d38c5ae90d90b967c91", "sha256:8d2e581ecd50e504b93bcafc77bc8ca42853f760778eeda9593ee43c3f0ad614" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "start_byte": 23409, "end_byte": 24204, "value_digest": "sha256:3e8fb6e3ddafe081bd48d0640200d6617118bf4b15af8ac452617251ac235acf" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:827c841ad871361927d08128988d53b32a2b9933e9d2951aad2f0caa2d48a7d6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:baa316ce6e4de1e9245068f5426a12ad36df8c91b8bb091da031995a8cd602c6", "sha256:f22f79ad1250bc2fc640095c19b333ea11e63a4127174eba322afedd46b9b153" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "start_byte": 26811, "end_byte": 27615, "value_digest": "sha256:51b91c598ab3d70a8cefba44988462fab61cf9f306c9d2ab6ec4cc9562338093" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e675c72b238b95488e58497ae4798e67d1b7b7f549cdd9a4bc76e3f9546f621e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4e78d36e648f6c4ada361197138e01707c700f6b57c9e18885be6faf6f63b58a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "sha256:b40145026b35a7e9e3400de42f5da27c0e553cc0d7ce1dfddf2a69148b44d02a" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "start_byte": 14938, "end_byte": 15736, "value_digest": "sha256:ad7390bf085fc610a70de9cc5ee16c91d96274d9f02f5c02ee4756038860b4ab" } ] } ], "note": "Essential operations across the API reference, branch operations, project creation, and project operations document request parameters, HTTP methods, endpoints, JSON schemas, response structures, and operational effects." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:51.042Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "project-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:827c841ad871361927d08128988d53b32a2b9933e9d2951aad2f0caa2d48a7d6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:902c697da75e569915b0a0e8be446e51faedf68bc617c4e70aa8fe6dbdbbbe59", "sha256:baa316ce6e4de1e9245068f5426a12ad36df8c91b8bb091da031995a8cd602c6" ], "source_surface": { "node_kind": "resource", "node_id": "project-operations" }, "locators": [ { "artifact_digest": "sha256:0da35db5c487e97831eefce262c46373e0811bd0e5e2369ce9406452bb018241", "start_byte": 9296, "end_byte": 10093, "value_digest": "sha256:de583dd45bd2c7e50668591f0ab6fff9558e8e54b1898e98c965b1354345a2c5" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e675c72b238b95488e58497ae4798e67d1b7b7f549cdd9a4bc76e3f9546f621e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4e78d36e648f6c4ada361197138e01707c700f6b57c9e18885be6faf6f63b58a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "sha256:b40145026b35a7e9e3400de42f5da27c0e553cc0d7ce1dfddf2a69148b44d02a" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:8ea90f5e0212da789145f0a8b1d96746068e7722e45139a34ce8d540365ec2a1", "start_byte": 14938, "end_byte": 15736, "value_digest": "sha256:ad7390bf085fc610a70de9cc5ee16c91d96274d9f02f5c02ee4756038860b4ab" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:dc3bfe39da17d9eabdc35887f4fb301d40427e1b7354938018cb2748a7bdf38c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:13894e9dd4db74cb84b66b222e63492e88851cf75ed5c245e1e9b77fb3409e5c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5968d97899970bc8f2d065b330572dfb9e95c73fdcf11a606b5e3de065cf541f", "sha256:c6c31fbf28cf8f798225f54a83b2e2c00934321e8d214dac67a57a349d77a5f8" ], "source_surface": { "node_kind": "resource", "node_id": "branch-operations" }, "locators": [ { "artifact_digest": "sha256:5968d97899970bc8f2d065b330572dfb9e95c73fdcf11a606b5e3de065cf541f", "start_byte": 19188, "end_byte": 19988, "value_digest": "sha256:f489559a3f1ec7015f1673d30617f16af07fc2d7fa905efbd021a7873b3d1726" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:2d4d184c0b5af0bb655f0efb7c55f7137f21d525f707c4a3cea0a3b57c232a02", "capture_rung": "http" } ], "artifact_digests": [ "sha256:37923afef428202242ac1029db31f41786b91c16ab9f068b02d5b80d3c4afbac", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "sha256:8d2e581ecd50e504b93bcafc77bc8ca42853f760778eeda9593ee43c3f0ad614" ], "source_surface": { "node_kind": "resource", "node_id": "create-project" }, "locators": [ { "artifact_digest": "sha256:5fa32648d747ad6c0b9fb73e01384f196683fe560cc0cc4bfc15f71581a0575c", "start_byte": 20233, "end_byte": 21023, "value_digest": "sha256:96716309880b97bf1a4aad17387cbdad4bc6f0c42b19d29ab493ba866652e26a" } ] } ], "note": "All essential target operations—including getting started reference, branch operations, project creation, and project management—are operable through documented HTTP API endpoints or CLI tools." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-09-06T08:51:57.210Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:0af975d63d5785aea2773b29f5ccb85511cdc941fdb867c907b4075aeb68d221", "sha256:0df233deff17f35fbb144422634e569cca7cd653a3d0cfd7c8234f5171667f18", "sha256:0eefc96a828905640b84e8f03480a555891ebd8856bc207be956a5ada0d4c9de", "sha256:236496841541403939a3eefa3df78ad47bd8a6ad2c297b1e3cd9831fdeebc2ec", "sha256:25851009baacfbde2c60c06e2deda06ee0b29a1658ef774b74690bc0e09ef5ce", "sha256:258a5bf21c2b38f93e9ba3a77563101bf862c706552837383660e1d42769aee4", "sha256:28b9a1b0fdfa6b288901cdfb61097c299bda7609bcf04e0a825f9d8074c8593f", "sha256:39c21ce14a931a637b74bef2298696e24e126394c6e95763b361f6484eb1464d", "sha256:3b5cf212fbdba14fc5ca1bcd9a7a33be41e047f0d5f3cfe0e0cef042341fc8c8", "sha256:49f140d30bab7c07ac7a64a11729e57ed31e5a09cf4de90c267e37131201c280", "sha256:4a8223ca3abd6749e16848624074921985ea3ce046ce3862134697751e6a5c7a", "sha256:5c3c34084619d2e934270064c053f963bf557684ee76223647e50a543f85a33f", "sha256:61e36320565288345d3705b485cf4c692f4e762d78f1e04d810bd84fde639ad0", "sha256:66fcb47ca086365d87de215dd1f00e0cd3db3eb082fda16c3fdb8cc1bca1d298", "sha256:67b95d045b00a823bf04dbac493ca85bbba0dc74c877d5443f26a7f387d60e8e", "sha256:7470d244dd8f1ba4e07cabdede6b91f80f22aaa50d5702edbff86d5f1df162f1", "sha256:85dd6c3123222b95ffb1696d36e0d9f5edb6ffacda241de269e3112c03188b30", "sha256:969dbe18f8be245c755fd7e485a3c37b5bb104f2b66503a4146c7c22b0d694ce", "sha256:9e3fa569dc4694a262d8545b36097c4640bf73744069ead0d302c41c780f2592", "sha256:a2750ca869d3745d6be8df40cec8dc22e4399b5618e62c756f3dca9c4ea0fe8c", "sha256:a30cd793d7cd0414bbf7728c4315745d5a6224a4bc736a24c68757939c1c93ec", "sha256:a86247483bd5beffaebe1069a7a71ec20067978f67f0176960a511fee09e886e", "sha256:ab88e75a7bb38116fbab3b74a8e4f9ea6ba30337980711f4840f11bf968421e6", "sha256:bbe81caaced133d956021d57cd7a35c0208e359dab4e82e6396809fb8872cb4d", "sha256:bd684fe317596956b68f5396174d722996aaed5451d522a1d2358fd036146cf8", "sha256:c02214799b226d2d5dba563bd6fe2c50d9cab37eeb1d44881d2e336ff1013901", "sha256:c2f80ca1a7b8ea81c2a343fdb81cb54f70c8502d76152ebdfaf879eb4cf063b3", "sha256:c74c9a1e30c1fed188fc22adf6389867e187ff210c8ec928da6b4c3c39b26472", "sha256:c9f705152d9c93c8c2b9ed91a91deadc7755547b7617ca383d22652091ed6029", "sha256:ccf089164f0983e17ace37417ae014ffefb1f9b0f52dd5dfbaa33520d8827fe2", "sha256:ccf47cf3d0d22217c30505a0e78a61afc2c2f83dce73315bf9b69997001db353", "sha256:d256360019edcdfe8597dcab91686d7d19f69d1fd99b479ed3ab0c69491f5ef4", "sha256:dd9b906d23e507cdfb588dd96f05d57eb2f975afad8045e41d98e452aa523f5a", "sha256:eac52478995af2e870ed01d03ad87fd17a22b92d70c594cd5c26a48850d131b9", "sha256:ed44335e81e4141dded809bd1ad37bb0b9a64da7c4af28b84ead710daabd11a6", "sha256:f426505916127479e72806efd42208ff4726eba66b3b097eaf20a6a2048656b7", "sha256:f9561abfc743c29df44d06afcfa23520aa175db775cdc22b7ee5c4750ecae502", "sha256:fc704989a1ad7f43e32efc6a23082205c15d32bb1456451803cbb29e178cb51a" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:f9561abfc743c29df44d06afcfa23520aa175db775cdc22b7ee5c4750ecae502" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:26.178Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:3b5cf212fbdba14fc5ca1bcd9a7a33be41e047f0d5f3cfe0e0cef042341fc8c8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:36.862Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:25851009baacfbde2c60c06e2deda06ee0b29a1658ef774b74690bc0e09ef5ce" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.957Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:0eefc96a828905640b84e8f03480a555891ebd8856bc207be956a5ada0d4c9de" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.957Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:28b9a1b0fdfa6b288901cdfb61097c299bda7609bcf04e0a825f9d8074c8593f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:26.178Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:61e36320565288345d3705b485cf4c692f4e762d78f1e04d810bd84fde639ad0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:53.118Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:236496841541403939a3eefa3df78ad47bd8a6ad2c297b1e3cd9831fdeebc2ec" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:57.210Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:c2f80ca1a7b8ea81c2a343fdb81cb54f70c8502d76152ebdfaf879eb4cf063b3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:31.939Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:67b95d045b00a823bf04dbac493ca85bbba0dc74c877d5443f26a7f387d60e8e", "sha256:9e3fa569dc4694a262d8545b36097c4640bf73744069ead0d302c41c780f2592", "sha256:bd684fe317596956b68f5396174d722996aaed5451d522a1d2358fd036146cf8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:57.210Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:ab88e75a7bb38116fbab3b74a8e4f9ea6ba30337980711f4840f11bf968421e6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:53.118Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:39c21ce14a931a637b74bef2298696e24e126394c6e95763b361f6484eb1464d", "sha256:c02214799b226d2d5dba563bd6fe2c50d9cab37eeb1d44881d2e336ff1013901" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:57.210Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:ccf089164f0983e17ace37417ae014ffefb1f9b0f52dd5dfbaa33520d8827fe2", "sha256:ed44335e81e4141dded809bd1ad37bb0b9a64da7c4af28b84ead710daabd11a6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:34.483Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:c74c9a1e30c1fed188fc22adf6389867e187ff210c8ec928da6b4c3c39b26472" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:36.862Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:d256360019edcdfe8597dcab91686d7d19f69d1fd99b479ed3ab0c69491f5ef4", "sha256:f426505916127479e72806efd42208ff4726eba66b3b097eaf20a6a2048656b7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:34.483Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:49f140d30bab7c07ac7a64a11729e57ed31e5a09cf4de90c267e37131201c280" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:34.483Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:a86247483bd5beffaebe1069a7a71ec20067978f67f0176960a511fee09e886e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:53.118Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:85dd6c3123222b95ffb1696d36e0d9f5edb6ffacda241de269e3112c03188b30" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:49.782Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:eac52478995af2e870ed01d03ad87fd17a22b92d70c594cd5c26a48850d131b9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:49.782Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:0df233deff17f35fbb144422634e569cca7cd653a3d0cfd7c8234f5171667f18", "sha256:a30cd793d7cd0414bbf7728c4315745d5a6224a4bc736a24c68757939c1c93ec", "sha256:ccf47cf3d0d22217c30505a0e78a61afc2c2f83dce73315bf9b69997001db353", "sha256:fc704989a1ad7f43e32efc6a23082205c15d32bb1456451803cbb29e178cb51a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:51.042Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:7470d244dd8f1ba4e07cabdede6b91f80f22aaa50d5702edbff86d5f1df162f1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:53.118Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:0af975d63d5785aea2773b29f5ccb85511cdc941fdb867c907b4075aeb68d221" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:51.042Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:dd9b906d23e507cdfb588dd96f05d57eb2f975afad8045e41d98e452aa523f5a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:53.118Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:258a5bf21c2b38f93e9ba3a77563101bf862c706552837383660e1d42769aee4", "sha256:4a8223ca3abd6749e16848624074921985ea3ce046ce3862134697751e6a5c7a", "sha256:bbe81caaced133d956021d57cd7a35c0208e359dab4e82e6396809fb8872cb4d", "sha256:c9f705152d9c93c8c2b9ed91a91deadc7755547b7617ca383d22652091ed6029" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:51.042Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:5c3c34084619d2e934270064c053f963bf557684ee76223647e50a543f85a33f", "sha256:66fcb47ca086365d87de215dd1f00e0cd3db3eb082fda16c3fdb8cc1bca1d298", "sha256:969dbe18f8be245c755fd7e485a3c37b5bb104f2b66503a4146c7c22b0d694ce", "sha256:a2750ca869d3745d6be8df40cec8dc22e4399b5618e62c756f3dca9c4ea0fe8c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:51.042Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/neon/agent-readiness/neon-api/project-database-lifecycle", "projection_digest": "sha256:93204be9d7e09cf2622297df3db47e306e9b74bb18f77cfb6599eb52f41c738b" } } }