{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyyts97tdz1rtzzt919cthny", "entity_slug": "slack", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xj3k8sa6c2w9nq4vf7", "entity_id": "ent_01kyyts97tdz1rtzzt919cthny", "scope": { "product": { "key": "slack-web-api", "name": "Slack Web API" }, "funnel": { "key": "workspace-app-operations", "name": "Workspace app operations" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:6bf818ed8305ea50197752914eecaa92ffd3a14f68afe01712b18be0cb13a2eb" }, "declaration_revision_digest": "sha256:f3bb080b1f1ccd9b33d2c66000ce4bed9c7f7cfaad35a873ade0d539884631cf", "declaration": { "declaration_id": "declaration_slack_web_api_workspace_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/sl/slack.yaml", "git_blob_oid": "7c7a8df73b2d7f6b1f9e148697f3ac8803cd9418", "blob_digest": "sha256:70989ffd1ab68687fdf0643c1ed55f12e8a6746593d5e57cfcfdbf0634370e8b" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Install an app and post messages through the Web API", "interface_ids": [ "workspace-api" ] } ], "participants": [ { "participant_id": "slack", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyyts97tdz1rtzzt919cthny" } } ], "resources": [ { "resource_id": "authentication", "uri": "https://docs.slack.dev/authentication/", "roles": [ "descriptor", "documentation" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://slack.com/help/articles/218915087-Manage-your-Slack-plan-and-billing-details", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "message-operations", "uri": "https://docs.slack.dev/reference/methods/chat.postMessage/", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "oauth", "uri": "https://docs.slack.dev/authentication/installing-with-oauth/", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "slack", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "describes" } ] }, { "resource_id": "pricing", "uri": "https://slack.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "rate-limits", "uri": "https://docs.slack.dev/apis/web-api/rate-limits/", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "readiness-5cf60e6ed44cb7227b1e801c24793d749277f1ac820a2a2d1a2e3aaea9e3ae94", "uri": "https://slack.com/help/articles/202035138-Slack-plans-and-features", "roles": [ "documentation", "eligibility" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://slack.com/terms-of-service", "roles": [ "terms" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://slack.com/help", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "web-api", "uri": "https://docs.slack.dev/apis/web-api/", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "resource_id": "workspace-signup", "uri": "https://slack.com/get-started", "roles": [ "access" ], "operated_by_participant_id": "slack", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "oauth-token", "uri": "https://slack.com/api/oauth.v2.access", "transport": "http", "roles": [ "authorization", "token" ], "operated_by_participant_id": "slack", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "implements" } ] }, { "endpoint_id": "registration", "uri": "https://slack.com/get-started", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "slack", "standard_bindings": [] }, { "endpoint_id": "slack-api", "uri": "https://slack.com/api", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "slack", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "app-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [ "oauth-token" ], "resource_ids": [ "authentication", "oauth" ], "operated_by_participant_id": "slack", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "uses" } ] }, { "interface_id": "workspace-api", "modality": "network_api", "functions": [ "events", "service_operation" ], "endpoint_ids": [ "slack-api" ], "resource_ids": [ "message-operations", "rate-limits", "web-api" ], "operated_by_participant_id": "slack", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "app-authentication" }, "to": { "node_kind": "interface", "node_id": "workspace-api" } }, { "relation_id": "messages-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "message-operations" }, "to": { "node_kind": "interface", "node_id": "workspace-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "workspace-signup" }, "to": { "node_kind": "interface", "node_id": "app-authentication" } }, { "relation_id": "web-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "web-api" }, "to": { "node_kind": "interface", "node_id": "workspace-api" } } ], "surface_exclusions": [] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:fea89fefd481e69c20f5c55d1e4556d9fe7f98bd8b037b6dbbae9d954aaaced6", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "B+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "pay", "stage_label": "Pay", "public_state": "limited", "finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "context": "Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team." } }, "limitations": [ { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "context": "Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team." }, "remediation": { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Slack documents rate-limiting error conditions, returning an HTTP 429 Too Many Requests response with a Retry-After header indicating the retry delay in seconds. However, the evidence leaves idempotency, cancellation, and reconciliation semantics unaddressed." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Slack OAuth documentation establishes token revocation via auth.revoke and token rotation with expiring access tokens, but does not document an end-to-end programmatic process for handling token compromise recovery or secret rotation within delegated authority." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Slack Web API is publicly documented with stable HTTPS RPC-style endpoints in the form https://slack.com/api/METHOD_FAMILY.method." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation fragments discuss OAuth authentication, tokens, and API usage, but do not contain explicit web agent or crawler access policies (such as robots.txt rules or web bot user-agent directives)." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Slack provides retrievable, readable, and stable applicable legal terms including the Main Services Agreement, User Terms of Service, Slack Supplemental Terms, and API Terms of Service." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "Slack workspace members can install apps by default, and workspace owners can enable app approval. The features are available on all subscriptions and supported for all members." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Slack provides an explicit Free plan forever at $US0, which includes 90 days of message history, up to 10 apps, 1:1 huddles, and direct messages." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "Slack developer documentation explicitly points to an llms.txt structured evaluation artifact ('LLM? Read llms.txt')." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:50.277Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "readiness-5cf60e6ed44cb7227b1e801c24793d749277f1ac820a2a2d1a2e3aaea9e3ae94" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:554cd3f856dd0b2351b3a3a7706f737b32dacffc621070a51fdef03b694ebf20", "capture_rung": "http" } ], "artifact_digests": [ "sha256:582a993f51388d974b61feaf0830e8a2c1b8a944e05b4f9cc1903ce8a29ae042", "sha256:6bcb22b2d17b49bc88f322a88c706ad4613bf6035751f36676aa275e0823a092", "sha256:9e6b42d34b8c86882330ef4b7936cf3e4f3968ffea59b5cdcc49dcbf874982a4", "sha256:ed5373bb2bb84638dbd0d650fc9bec60d985d8d610df3d47ff09ca43e3b2a2af" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-5cf60e6ed44cb7227b1e801c24793d749277f1ac820a2a2d1a2e3aaea9e3ae94" }, "locators": [ { "artifact_digest": "sha256:9e6b42d34b8c86882330ef4b7936cf3e4f3968ffea59b5cdcc49dcbf874982a4", "start_byte": 13091, "end_byte": 13891, "value_digest": "sha256:2474be0837078c98ebce543faddbf82e97d52e0783dd382d30fc7c60417f5df5" }, { "artifact_digest": "sha256:9e6b42d34b8c86882330ef4b7936cf3e4f3968ffea59b5cdcc49dcbf874982a4", "start_byte": 17120, "end_byte": 17921, "value_digest": "sha256:041484c26c9b22a01f7c61b62f142c3f625921cac92e31377df8b338d01563fc" } ] } ], "note": "Slack workspace members can install apps by default, and workspace owners can enable app approval. The features are available on all subscriptions and supported for all members." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:47.953Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f708b6c5130f6de2a76cdbeedab673e233b40904faede4500d00834b349e42fa", "capture_rung": "http" } ], "artifact_digests": [ "sha256:239202d1dbae954bd9b1827e3b55e6fa2d5e7baa2eea674de952932154e40f91", "sha256:2d87358e7a6238584230dff0ef8efce21dbe19ac02ea3b19cbf809327fc84f16", "sha256:39a37adf7e76d079bcd42e6c777d9219277f236fd3805569556eb4680a79fa63", "sha256:8f795a82163e6458b049f6db91e88c20ddd624795897f796ddd32135e5933bfb" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:39a37adf7e76d079bcd42e6c777d9219277f236fd3805569556eb4680a79fa63", "start_byte": 15932, "end_byte": 16733, "value_digest": "sha256:d0db4a2fd18749cacf4eb2396f8891efc21dfdeac081f7054bf019047bdef507" } ] } ], "note": "Slack provides an explicit Free plan forever at $US0, which includes 90 days of message history, up to 10 apps, 1:1 huddles, and direct messages." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:38.501Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "web-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:69430c3dbc5e5ed60d040aa04a7bb537e954cbc15cdfa87fb624fe1ff268d9a6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4d21e854f82ebc598f1b3dbbbada4efa88daa961a2144f6a19b68a9a8353787c", "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "sha256:a6caaf77f6da7d9065bc7a1298b62881017f5c162c59d064d355d55a27498f97", "sha256:e9cb82fce86c25085a43cd869b293927bb4159beaeeb682d5926ac349072c006" ], "source_surface": { "node_kind": "resource", "node_id": "web-api" }, "locators": [ { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 4635, "end_byte": 5445, "value_digest": "sha256:f5997b60bb404232b5e649949c1da533072b7d23d5e9c3156651500096835aae" }, { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 5446, "end_byte": 6226, "value_digest": "sha256:595645c001279fbc2b31cfb50bbfbd89a8461fda23de95fe72c09ca8223b249f" } ] } ], "note": "The Slack Web API is publicly documented with stable HTTPS RPC-style endpoints in the form https://slack.com/api/METHOD_FAMILY.method." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:38.501Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "web-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f2877154321866804126a3c2dfb0ecd91f2fde5c45b133957580c5df1b696346", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0ac72fc4063dabd7423280a1319e5e63ee5407aeafd15265f29314271df21722", "sha256:9990e1e1b26f0bc1ff0f19a661caadb6c7bbc426583e8b3e7affacfacc3a6f8f", "sha256:f5cf356b522d63bc576d3c2aebbcd7ace3c74ce0d727e2ea50f971b33cc4271c", "sha256:f63fd476148d4aa97b5888715efdf809a61cb6a0386a4fd7beb8055e57bcd87a" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:f63fd476148d4aa97b5888715efdf809a61cb6a0386a4fd7beb8055e57bcd87a", "start_byte": 6133, "end_byte": 6926, "value_digest": "sha256:59f2633950398aa6ec4c625da86f11dde500d87f186816e2a1be6f75cf391eb7" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:69430c3dbc5e5ed60d040aa04a7bb537e954cbc15cdfa87fb624fe1ff268d9a6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3b9124f13acd24509405dd91458184605c7b2f4dd2a08b39ab3c3dc8903832e5", "sha256:4d21e854f82ebc598f1b3dbbbada4efa88daa961a2144f6a19b68a9a8353787c", "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "sha256:a6caaf77f6da7d9065bc7a1298b62881017f5c162c59d064d355d55a27498f97" ], "source_surface": { "node_kind": "resource", "node_id": "web-api" }, "locators": [ { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 12430, "end_byte": 13228, "value_digest": "sha256:564c15c2c69dbfbd4010c082b5cc8d894f34aa3d7d73be5ec2b8561b7e716461" } ] } ], "note": "Slack developer documentation explicitly points to an llms.txt structured evaluation artifact ('LLM? Read llms.txt')." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:31.098Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5bc1d323e350f287857ab2db473e43621e9c5c8d03ddd2c63c5e120c5226dd09", "capture_rung": "http" } ], "artifact_digests": [ "sha256:090121b83bd196d3868da7b714a1306dbf9f3db3e37f356a28be527a4b25d5c0", "sha256:245753e9dd8ec62ed8c33ed51b26ade172371d6d6ec1858c6e7f8d777e8458a3", "sha256:40d209009d8f1e24d07fb8e173b0d42126e1d4264523711b030fb4dd61643f7e", "sha256:b3d53ff279199e8a0f4763c84cbfb50233415224ad6fed0ea9d266631e0730c8" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:245753e9dd8ec62ed8c33ed51b26ade172371d6d6ec1858c6e7f8d777e8458a3", "start_byte": 16115, "end_byte": 16913, "value_digest": "sha256:616766d0cf802f3ab203b015ae11be53db0e1edbe2ce7d4cb347dc7609dbacb2" }, { "artifact_digest": "sha256:245753e9dd8ec62ed8c33ed51b26ade172371d6d6ec1858c6e7f8d777e8458a3", "start_byte": 16914, "end_byte": 17713, "value_digest": "sha256:0106f8fba3dd567cd5ce8af4313e1a903518e895c46024a86ec8e1376b69e9f3" } ] } ], "note": "Slack provides retrievable, readable, and stable applicable legal terms including the Main Services Agreement, User Terms of Service, Slack Supplemental Terms, and API Terms of Service." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:43.073Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "web-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained documentation fragments discuss OAuth authentication, tokens, and API usage, but do not contain explicit web agent or crawler access policies (such as robots.txt rules or web bot user-agent directives)." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Slack explicitly declares a stable route to get started with an email address at https://slack.com/get-started." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence for https://slack.com/get-started provides metadata and title text ('Login | Slack') but does not contain actionable controls, forms, fields, or validation details needed to demonstrate agent operability." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained captures for https://slack.com/get-started do not contain explicit declarations or observed page content regarding CAPTCHAs or bot verification challenges." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence for https://slack.com/get-started does not mention phone or SMS verification requirements." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "Slack documents an OAuth flow where apps request scoped permissions, users grant consent, temporary authorization codes are exchanged for tokens, and API access tokens can be revoked via the auth.revoke method." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:07.953Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence for https://slack.com/get-started provides metadata and title text ('Login | Slack') but does not contain actionable controls, forms, fields, or validation details needed to demonstrate agent operability." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:07.953Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:92e59b9d46ab920e22b0ad51a878cd1a9c8fde3fc8f3864e504f54cc7cbcfd63", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:105ecba982e92e1ff9b798f5278873867ad795d36e8d0827f0755ee08a66a1c6", "sha256:114bbf22a905833a596b629367771663f1a5ceb8d00710882451880fa7450440", "sha256:3878570f4a62a0d65f57cf1754e0269e56ec797f4e36e26b44c172eb6e800401", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7fdd9e307207fb8e5e92b069626aa5d3c209187ed97b4d220f9a78d2d19d861e", "sha256:bc0a4186de442d335bcdc2fb7bf4409c8435cb4399650f1db062a2fca5ab9ad3" ], "source_surface": { "node_kind": "resource", "node_id": "workspace-signup" }, "locators": [ { "artifact_digest": "sha256:bc0a4186de442d335bcdc2fb7bf4409c8435cb4399650f1db062a2fca5ab9ad3", "start_byte": 0, "end_byte": 532, "value_digest": "sha256:faf62c7f58088bfcad5af4e1971f0b67405c77edcf6547df3a5ba48fbcaeb28e" } ] } ], "note": "Slack explicitly declares a stable route to get started with an email address at https://slack.com/get-started." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:07.953Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained captures for https://slack.com/get-started do not contain explicit declarations or observed page content regarding CAPTCHAs or bot verification challenges." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:03.961Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:959337c3f516e36d8496730490780ca65c72f36133568fd35927dc65f4e2767b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "sha256:9943983a6a1a0a5b5cd996f2a1e8065052b0f29eaf77ef1a1bd5de0ec2e6e5c8", "sha256:ad0a67d9dad7bf9fe0facf31d6973f6bfd174eb2e18a3739614c7d0adf7812ea", "sha256:df7a8a5d2af7018243ae911d0fecd1555123829caa463907d852e6ef01e7dd46" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 21462, "end_byte": 22262, "value_digest": "sha256:230be4f43cc5959a9df38ff6089ab2293b7eecd9ac9a2f170a5fd743eae1bf9e" }, { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 8314, "end_byte": 9105, "value_digest": "sha256:043ff276a9ff6c6e00dd365bb6b150905ea5fab7fa4939f9d68cb8886ee80153" } ] } ], "note": "Slack documents an OAuth flow where apps request scoped permissions, users grant consent, temporary authorization codes are exchanged for tokens, and API access tokens can be revoked via the auth.revoke method." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:07.953Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence for https://slack.com/get-started does not mention phone or SMS verification requirements." } ], "blockers": [], "remediations": [] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "context": "Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained text mentions a checkout option when changing subscription details or payment methods, but it does not establish deterministic checkout construction, approval handoff, and resumption." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation describes managing payment methods like credit cards and ACH bank transfers, but it does not document scoped delegation or explicit human authorization rails with receipts." }, { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "Slack explicitly discloses the commercial commitment details on its pricing page, including price points ($US8.75 and $US18 per user/month monthly, or $US7.25 and $US15 per user/month annually) and currency." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:10.604Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained text mentions a checkout option when changing subscription details or payment methods, but it does not establish deterministic checkout construction, approval handoff, and resumption." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:47.953Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f708b6c5130f6de2a76cdbeedab673e233b40904faede4500d00834b349e42fa", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2d87358e7a6238584230dff0ef8efce21dbe19ac02ea3b19cbf809327fc84f16", "sha256:39a37adf7e76d079bcd42e6c777d9219277f236fd3805569556eb4680a79fa63", "sha256:8f795a82163e6458b049f6db91e88c20ddd624795897f796ddd32135e5933bfb", "sha256:bf5098b7959447c25174302afdce402989d7c56834842c6e352198fcea846d2b" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:39a37adf7e76d079bcd42e6c777d9219277f236fd3805569556eb4680a79fa63", "start_byte": 16734, "end_byte": 17525, "value_digest": "sha256:60b26115aeb786cce05334ce19161798b026e0832289bd76bc9a27cc17dd4e47" }, { "artifact_digest": "sha256:39a37adf7e76d079bcd42e6c777d9219277f236fd3805569556eb4680a79fa63", "start_byte": 17526, "end_byte": 18315, "value_digest": "sha256:8805b1871b2a4e41edb7e82daa4d4e6f29114418246291321f293ba39118ec91" } ] } ], "note": "Slack explicitly discloses the commercial commitment details on its pricing page, including price points ($US8.75 and $US18 per user/month monthly, or $US7.25 and $US15 per user/month annually) and currency." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:10.604Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained documentation describes managing payment methods like credit cards and ACH bank transfers, but it does not document scoped delegation or explicit human authorization rails with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:10.604Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1a2eabd78f65db116755ba31a3146278c2b4e6046b4f9654b0b193fec48b60e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:00698f0312e6044275fea7dbf77a43640f8715ff990989316e6ddba1ea3040df", "sha256:085a125a1f9a4100ccb17b7b15d3acd3b9d9b22372b3306d77ac3288428b7d2e", "sha256:41052326a88d5110ddd51fb64c5bf515f68559baf782d8c1be61f182c1d6f58d", "sha256:58f95f844c48da9831588e68357080c228562812dc9a989551aac5b39e41c3f4" ], "source_surface": { "node_kind": "resource", "node_id": "billing-checkout" }, "locators": [ { "artifact_digest": "sha256:41052326a88d5110ddd51fb64c5bf515f68559baf782d8c1be61f182c1d6f58d", "start_byte": 12950, "end_byte": 13751, "value_digest": "sha256:89e50afde44957ac87a71b2e607929d647ead76eee1e5c235fdda0475450343e" }, { "artifact_digest": "sha256:41052326a88d5110ddd51fb64c5bf515f68559baf782d8c1be61f182c1d6f58d", "start_byte": 13752, "end_byte": 14536, "value_digest": "sha256:7ca7178e26f80ab1ce87d5daa5a5a66833ff18caae5dde00d9c6378472410379" } ] } ], "note": "Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team.", "remediation": { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } } ], "blockers": [], "remediations": [ { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Message posting can be initiated synchronously via the chat.postMessage API endpoint. Workspace app installation follows a machine-triggerable OAuth flow initiated by redirecting users with requested scopes." }, "secondary_context": [ { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "context": "Slack's OAuth flow allows an app to obtain an access token by requesting scopes, receiving user approval, and exchanging a temporary authorization code by calling oauth.v2.access, which returns an HTTP response containing an access token." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "A synchronous postMessage API call returns an ok: true response along with the created message object and timestamp ID (ts). Callers should check the ok parameter in the response, which returns explicit error codes like too_many_attachments on failure." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:03.961Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:959337c3f516e36d8496730490780ca65c72f36133568fd35927dc65f4e2767b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "sha256:6d166533d6722e1054d4b42fb4a743a7c7ff525d0a17fae5a4b9e189e405b857", "sha256:9943983a6a1a0a5b5cd996f2a1e8065052b0f29eaf77ef1a1bd5de0ec2e6e5c8", "sha256:ad0a67d9dad7bf9fe0facf31d6973f6bfd174eb2e18a3739614c7d0adf7812ea" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 15237, "end_byte": 15885, "value_digest": "sha256:c8f4440d3c3d46f6844e357eabc8b269261713468fe30134efcc4b571b3777ae" }, { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 8314, "end_byte": 9105, "value_digest": "sha256:043ff276a9ff6c6e00dd365bb6b150905ea5fab7fa4939f9d68cb8886ee80153" } ] } ], "note": "Slack's OAuth flow allows an app to obtain an access token by requesting scopes, receiving user approval, and exchanging a temporary authorization code by calling oauth.v2.access, which returns an HTTP response containing an access token." }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:46.022Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "message-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b6d174cdd41dc4b687bcda9c281f0277f559f7961e738feb49c7bb8983f6795e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:8a603596adbde6e8eb4d24b5bf75fb88eeebd3a5cc268c3519d7a5adfbde3ced", "sha256:d23cecf7ec34ce75a590647be478993cb40aa394e0ea015ceee481ce5a185d08", "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "sha256:ed0293dae9d873c78079eac45e11a887f18d67bae5dcef4102aa8b1e0cc2c208" ], "source_surface": { "node_kind": "resource", "node_id": "message-operations" }, "locators": [ { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 19928, "end_byte": 20730, "value_digest": "sha256:ad47b942bb80e789ed20d4c5f9536f096590c1af8d9bb15e001af9504ff12342" }, { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 20731, "end_byte": 21533, "value_digest": "sha256:724cac23a213fca5f2288fe4d1c9c80fb50119a2dfe90c4fe35176ed63768852" } ] } ], "note": "A synchronous postMessage API call returns an ok: true response along with the created message object and timestamp ID (ts). Callers should check the ok parameter in the response, which returns explicit error codes like too_many_attachments on failure." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:03.961Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "message-operations" }, { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:959337c3f516e36d8496730490780ca65c72f36133568fd35927dc65f4e2767b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "sha256:51b7ea72943fa052ae3b6bac83cc6f88bf6a73de8044428ceb3fb97e8f563d24", "sha256:9943983a6a1a0a5b5cd996f2a1e8065052b0f29eaf77ef1a1bd5de0ec2e6e5c8", "sha256:ad0a67d9dad7bf9fe0facf31d6973f6bfd174eb2e18a3739614c7d0adf7812ea" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 6782, "end_byte": 7510, "value_digest": "sha256:d5436cf55f97dbbc5128655f3427f3df390275ba1526d20c52238c26444acf1b" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b6d174cdd41dc4b687bcda9c281f0277f559f7961e738feb49c7bb8983f6795e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:8a603596adbde6e8eb4d24b5bf75fb88eeebd3a5cc268c3519d7a5adfbde3ced", "sha256:b6a4d96d88abaaede7cdf4514607f659c8b551a546173d237d2ade8040a869ae", "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "sha256:ed0293dae9d873c78079eac45e11a887f18d67bae5dcef4102aa8b1e0cc2c208" ], "source_surface": { "node_kind": "resource", "node_id": "message-operations" }, "locators": [ { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 10334, "end_byte": 11133, "value_digest": "sha256:bc5b183f51e27c1b1e87a988eb385026b6c94a004cb29ec7288735c34e955bb2" } ] } ], "note": "Message posting can be initiated synchronously via the chat.postMessage API endpoint. Workspace app installation follows a machine-triggerable OAuth flow initiated by redirecting users with requested scopes." } ], "blockers": [], "remediations": [] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Slack documents rate-limiting error conditions, returning an HTTP 429 Too Many Requests response with a Retry-After header indicating the retry delay in seconds. However, the evidence leaves idempotency, cancellation, and reconciliation semantics unaddressed." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Slack Web API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Slack OAuth documentation establishes token revocation via auth.revoke and token rotation with expiring access tokens, but does not document an end-to-end programmatic process for handling token compromise recovery or secret rotation within delegated authority." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target is accessible through documented machine-usable HTTP RPC endpoints and SDKs/CLIs, such as POST https://slack.com/api/chat.postMessage." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Slack Web API request-time authentication is documented using OAuth 2.0 bearer tokens, passed via the Authorization HTTP header (Authorization: Bearer xoxb-...) or as POST parameters, under scoped authority requested during the OAuth flow." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Essential operations and parameters are documented across the targets: chat.postMessage defines required token and channel arguments with expected JSON response format and error table; rate-limits defines tiers, HTTP 429 status, and Retry-After header behavior; and Web API specifies HTTP POST URL-encoded and JSON body formats with top-level ok boolean response structures." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:38.501Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "workspace-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Slack Web API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:03.961Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:959337c3f516e36d8496730490780ca65c72f36133568fd35927dc65f4e2767b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "sha256:9943983a6a1a0a5b5cd996f2a1e8065052b0f29eaf77ef1a1bd5de0ec2e6e5c8", "sha256:ad0a67d9dad7bf9fe0facf31d6973f6bfd174eb2e18a3739614c7d0adf7812ea", "sha256:db9ba95950610355cf28e167764568ee46b20f499c271a0d408b775f698c0498" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 21462, "end_byte": 22262, "value_digest": "sha256:230be4f43cc5959a9df38ff6089ab2293b7eecd9ac9a2f170a5fd743eae1bf9e" }, { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 22263, "end_byte": 23066, "value_digest": "sha256:d4253ab461a02145474c0a3218e9f30abdd9d59b450033dff8c5a0939c4d6b23" } ] } ], "note": "Slack OAuth documentation establishes token revocation via auth.revoke and token rotation with expiring access tokens, but does not document an end-to-end programmatic process for handling token compromise recovery or secret rotation within delegated authority.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:07.263Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "rate-limits" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:93e40d4ed2b469461338b08e886a9d8ace8b8f4f06ee2bdea517e4c8cfc574c2", "capture_rung": "http" } ], "artifact_digests": [ "sha256:6669c6e7f0dbd71bfd04628be8ff5394eb07153f615f3a0b6111d802875199f3", "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "sha256:d70e11453fca966ffaab92c07d4749f6bb2341bb4c4ccbc68a6f4573eafadc98", "sha256:f958012f91fee388474094db65df22eadac6c793e51e2dafd3b6fe40d39c6399" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "start_byte": 10751, "end_byte": 11547, "value_digest": "sha256:c4f6b95c3a31f0fbc34f09f5baefd009a1d3dba8e55dc1c470044fd31c96e245" } ] } ], "note": "Slack documents rate-limiting error conditions, returning an HTTP 429 Too Many Requests response with a Retry-After header indicating the retry delay in seconds. However, the evidence leaves idempotency, cancellation, and reconciliation semantics unaddressed.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:03.961Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:959337c3f516e36d8496730490780ca65c72f36133568fd35927dc65f4e2767b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "sha256:72149eda11891b9d1594bac4fce62084a044b1625edffd48ad4a01a1675b6b18", "sha256:9943983a6a1a0a5b5cd996f2a1e8065052b0f29eaf77ef1a1bd5de0ec2e6e5c8", "sha256:ad0a67d9dad7bf9fe0facf31d6973f6bfd174eb2e18a3739614c7d0adf7812ea" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 20676, "end_byte": 21461, "value_digest": "sha256:9774455917f6bbf7a989c72cdd083929f102ccdc43f00f9fbdcc48ebe765a5e7" }, { "artifact_digest": "sha256:12c2138846bea176c66eebc7619f78de9817615ef9f4ea220b88cd812f4df53b", "start_byte": 6782, "end_byte": 7510, "value_digest": "sha256:d5436cf55f97dbbc5128655f3427f3df390275ba1526d20c52238c26444acf1b" } ] } ], "note": "Slack Web API request-time authentication is documented using OAuth 2.0 bearer tokens, passed via the Authorization HTTP header (Authorization: Bearer xoxb-...) or as POST parameters, under scoped authority requested during the OAuth flow." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:38.501Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "workspace-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:69430c3dbc5e5ed60d040aa04a7bb537e954cbc15cdfa87fb624fe1ff268d9a6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4d21e854f82ebc598f1b3dbbbada4efa88daa961a2144f6a19b68a9a8353787c", "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "sha256:a6caaf77f6da7d9065bc7a1298b62881017f5c162c59d064d355d55a27498f97", "sha256:fbf1864d8276c8e773620b04d270a58b54d6ee7e3077589ffac60a395973be04" ], "source_surface": { "node_kind": "resource", "node_id": "web-api" }, "locators": [ { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 10109, "end_byte": 10826, "value_digest": "sha256:117fa7152d727de47cf189531faa832045e2fce0ff0e9bdc429f575c2934ac39" }, { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 5446, "end_byte": 6226, "value_digest": "sha256:595645c001279fbc2b31cfb50bbfbd89a8461fda23de95fe72c09ca8223b249f" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b6d174cdd41dc4b687bcda9c281f0277f559f7961e738feb49c7bb8983f6795e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:8a603596adbde6e8eb4d24b5bf75fb88eeebd3a5cc268c3519d7a5adfbde3ced", "sha256:9750161bf3bc299b5ea3582e05c6a62142eb46afb4c0310e2bfe3a67459adb42", "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "sha256:ed0293dae9d873c78079eac45e11a887f18d67bae5dcef4102aa8b1e0cc2c208" ], "source_surface": { "node_kind": "resource", "node_id": "message-operations" }, "locators": [ { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 20731, "end_byte": 21533, "value_digest": "sha256:724cac23a213fca5f2288fe4d1c9c80fb50119a2dfe90c4fe35176ed63768852" }, { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 7932, "end_byte": 8735, "value_digest": "sha256:e327db5df94e067c936f41cb49e9af84be11bc05cf1716f4bcfb36171b9c5313" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:93e40d4ed2b469461338b08e886a9d8ace8b8f4f06ee2bdea517e4c8cfc574c2", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3319c7eabbf5f4ce9477fccc448fac89fa50cca55fb509e0e7d1d95c9fcbccc4", "sha256:6669c6e7f0dbd71bfd04628be8ff5394eb07153f615f3a0b6111d802875199f3", "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "sha256:d70e11453fca966ffaab92c07d4749f6bb2341bb4c4ccbc68a6f4573eafadc98" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "start_byte": 10751, "end_byte": 11547, "value_digest": "sha256:c4f6b95c3a31f0fbc34f09f5baefd009a1d3dba8e55dc1c470044fd31c96e245" }, { "artifact_digest": "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "start_byte": 6748, "end_byte": 7549, "value_digest": "sha256:e9aaa5b38b81ff995e2ab19d21b3794707fa053d9df228dc4419597f0440cc7e" } ] } ], "note": "Essential operations and parameters are documented across the targets: chat.postMessage defines required token and channel arguments with expected JSON response format and error table; rate-limits defines tiers, HTTP 429 status, and Retry-After header behavior; and Web API specifies HTTP POST URL-encoded and JSON body formats with top-level ok boolean response structures." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:38.501Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "workspace-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:93e40d4ed2b469461338b08e886a9d8ace8b8f4f06ee2bdea517e4c8cfc574c2", "capture_rung": "http" } ], "artifact_digests": [ "sha256:6669c6e7f0dbd71bfd04628be8ff5394eb07153f615f3a0b6111d802875199f3", "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "sha256:d70e11453fca966ffaab92c07d4749f6bb2341bb4c4ccbc68a6f4573eafadc98", "sha256:ecf0ee01f8ac9ac704ff5961d978e9b73744da830561838c597419eac85ea17f" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:970822ebdca9456b1e6cac24f254d98df500019301b1e20b39d1ee2d427c1313", "start_byte": 5141, "end_byte": 5949, "value_digest": "sha256:81ee017f1a6346db2784e4e0032053e77c12f317ff4c9c6eeb266945a69c6257" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:69430c3dbc5e5ed60d040aa04a7bb537e954cbc15cdfa87fb624fe1ff268d9a6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4706bad2970515b7e829a320cf0345d08cbbddd2fe5b1691ca67f54d2d4288a4", "sha256:4d21e854f82ebc598f1b3dbbbada4efa88daa961a2144f6a19b68a9a8353787c", "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "sha256:a6caaf77f6da7d9065bc7a1298b62881017f5c162c59d064d355d55a27498f97" ], "source_surface": { "node_kind": "resource", "node_id": "web-api" }, "locators": [ { "artifact_digest": "sha256:83b36cf5f2e20c6e20944ae114497a4b2babeec4f5084980c872b31b7356341f", "start_byte": 6227, "end_byte": 6964, "value_digest": "sha256:1d44cbcb398e0cc77b51302ed6716463888475bf173ec250f335856271e02e2b" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b6d174cdd41dc4b687bcda9c281f0277f559f7961e738feb49c7bb8983f6795e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4d1193419564bacd883d3f5747ec1bf6ee6401d030a23fd369d2be99bda88c46", "sha256:8a603596adbde6e8eb4d24b5bf75fb88eeebd3a5cc268c3519d7a5adfbde3ced", "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "sha256:ed0293dae9d873c78079eac45e11a887f18d67bae5dcef4102aa8b1e0cc2c208" ], "source_surface": { "node_kind": "resource", "node_id": "message-operations" }, "locators": [ { "artifact_digest": "sha256:e967c0424cb8043523914d27b01dcc8c3895d362a96afd3e19bf96a3cd146519", "start_byte": 7932, "end_byte": 8735, "value_digest": "sha256:e327db5df94e067c936f41cb49e9af84be11bc05cf1716f4bcfb36171b9c5313" } ] } ], "note": "Every essential target is accessible through documented machine-usable HTTP RPC endpoints and SDKs/CLIs, such as POST https://slack.com/api/chat.postMessage." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-09-06T08:52:07.953Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:002e064a3aacba09dd188ebe54cd0af59f33875323b24126afba3c8ee31013a7", "sha256:06395daa2810c6b721a8e44e9b87d4799a7b922cf2b5de39ff9aa2ec099e6444", "sha256:09e4d4beae4bdcc11c2b802100d63668b3ba206d7f962031d70afb0ecc2cda0a", "sha256:0e2c335d36d0956480326eb6453655959a0f886f03c960c35554bf3cbfe0c05e", "sha256:25c15358ce44114850568a1b23c52b1b05f31403b695f9805645cfb03405791a", "sha256:27c881134a4f4f5d7c335d7d28594a97bf5a01bded622f814a054de00de5108d", "sha256:3a6eee91814307153105a27c05d14fbfc8129f946403f26d909d38fa4003888e", "sha256:44c6839f4cbf793a31926d170fff8a757ef2eaf4a1c98b6cf43606ea09847b9f", "sha256:46b03219b4a4bc303b2357f81de3f3859ec943b84eb5ad02bc77f5b300588853", "sha256:498caf708e288204026793e404acc90ad54d2ae4fdf05c4f618bb657f40783f9", "sha256:55e9fb48a545ed2c4be7d6c8146f8b4f1daeee780e5aa4584a414bdbb0a2bae3", "sha256:57f683a3b571923614cca71ce7b5b5926fa33faedd9a6a16b97310e00964d345", "sha256:73227f51ef0c8c833f0b99fe59cf412c07c1f4f26fc5afc4a7172cd4d4b0e55b", "sha256:742e16ff65fcb31d3c5689b148f9adf54f1e8b69234743ae54b0f40f66da245c", "sha256:7eb5e5c04b294adbc9640bda6b3de030e7dc85d833f0ebc5cfcae5aa423079da", "sha256:80c7cf0a075ebd791a51e63833bf9688a94185408d79611fe6bb7b3415f8a768", "sha256:852d7cc90ccc164838ca6070603cb392217248ae26c2e968213059f700262d80", "sha256:8575e2db342652cf05beb6552779254a8c1d095e7564e8591ab10dfe08f3be82", "sha256:a19027a09625ade27a3aaec03fb0cf15194e6d0933d53dc8b17a1c91fe0beb1b", "sha256:a2935a236e08bb7565c01c87fb238d95029f32e999894f330de46132e14b14bc", "sha256:a65c76a1538afcf555fd9c4be67e4f67a85209f387e31d356f09cfcc4a0f556a", "sha256:a8be7a955859f84bceccc1389f8b55a1fcfa65fc303c3ed327708b780e9f68d4", "sha256:acdf73ec8f02566ca303cdcbd568649a53c614ff45b9a81754ae9b5aa5fed959", "sha256:b050078084481bb5c03a9b263795e5b90dad432afaeaabb92245b433f74cc5e0", "sha256:bae8f6e140dc3f46e65b50c5a5db584e16d7230c5ed8a1db3618330ffd18cc54", "sha256:d0cd8d7aa71042516ff8a7e289d9c53d8ae8c1a4c309a2a6f44c4e573e98b3bb", "sha256:d2579ff44efd678b2174c7b747692946e40acdc9963badec1577befc99431eff", "sha256:d55dfa455e2ff0487c7d6bd7a2ddbdf2ef9280731e1b81372d322dd226c5d7a1", "sha256:dfe1b27e887928cc0c058e07fb77312be1740b81ce579afe6333074a6a81bdee", "sha256:ea3b0e03c01d11cb9c823efa4439625a59ef95c18d35072599ebaba37d127302", "sha256:f11dcde7a29f38ac4228e0eeea9e020dd4d38c56bd27518c4de8459cbe2623f1", "sha256:f200e4a3f0a8b174b1aea56975323ddd5d8871b6927cf465d1161e33abb1be12", "sha256:f3f39dbcaeb4fafe624cd127355168dccb4e8af542eaf12ac2f575c7c337f94a" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:a8be7a955859f84bceccc1389f8b55a1fcfa65fc303c3ed327708b780e9f68d4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:50.277Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:27c881134a4f4f5d7c335d7d28594a97bf5a01bded622f814a054de00de5108d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:47.953Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:7eb5e5c04b294adbc9640bda6b3de030e7dc85d833f0ebc5cfcae5aa423079da" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:38.501Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:09e4d4beae4bdcc11c2b802100d63668b3ba206d7f962031d70afb0ecc2cda0a", "sha256:742e16ff65fcb31d3c5689b148f9adf54f1e8b69234743ae54b0f40f66da245c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:38.501Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:46b03219b4a4bc303b2357f81de3f3859ec943b84eb5ad02bc77f5b300588853" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:31.098Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:8575e2db342652cf05beb6552779254a8c1d095e7564e8591ab10dfe08f3be82" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:43.073Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:acdf73ec8f02566ca303cdcbd568649a53c614ff45b9a81754ae9b5aa5fed959" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:07.953Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:d55dfa455e2ff0487c7d6bd7a2ddbdf2ef9280731e1b81372d322dd226c5d7a1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:07.953Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:06395daa2810c6b721a8e44e9b87d4799a7b922cf2b5de39ff9aa2ec099e6444", "sha256:bae8f6e140dc3f46e65b50c5a5db584e16d7230c5ed8a1db3618330ffd18cc54" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:07.953Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:55e9fb48a545ed2c4be7d6c8146f8b4f1daeee780e5aa4584a414bdbb0a2bae3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:03.961Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:d0cd8d7aa71042516ff8a7e289d9c53d8ae8c1a4c309a2a6f44c4e573e98b3bb" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:07.953Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:002e064a3aacba09dd188ebe54cd0af59f33875323b24126afba3c8ee31013a7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:10.604Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:0e2c335d36d0956480326eb6453655959a0f886f03c960c35554bf3cbfe0c05e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:47.953Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:d2579ff44efd678b2174c7b747692946e40acdc9963badec1577befc99431eff" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:10.604Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:f11dcde7a29f38ac4228e0eeea9e020dd4d38c56bd27518c4de8459cbe2623f1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:10.604Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:a19027a09625ade27a3aaec03fb0cf15194e6d0933d53dc8b17a1c91fe0beb1b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:03.961Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:3a6eee91814307153105a27c05d14fbfc8129f946403f26d909d38fa4003888e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:46.022Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:498caf708e288204026793e404acc90ad54d2ae4fdf05c4f618bb657f40783f9", "sha256:f200e4a3f0a8b174b1aea56975323ddd5d8871b6927cf465d1161e33abb1be12" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:03.961Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:44c6839f4cbf793a31926d170fff8a757ef2eaf4a1c98b6cf43606ea09847b9f", "sha256:73227f51ef0c8c833f0b99fe59cf412c07c1f4f26fc5afc4a7172cd4d4b0e55b", "sha256:ea3b0e03c01d11cb9c823efa4439625a59ef95c18d35072599ebaba37d127302" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:38.501Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:852d7cc90ccc164838ca6070603cb392217248ae26c2e968213059f700262d80" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:03.961Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:a2935a236e08bb7565c01c87fb238d95029f32e999894f330de46132e14b14bc" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:07.263Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:25c15358ce44114850568a1b23c52b1b05f31403b695f9805645cfb03405791a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:03.961Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:b050078084481bb5c03a9b263795e5b90dad432afaeaabb92245b433f74cc5e0", "sha256:dfe1b27e887928cc0c058e07fb77312be1740b81ce579afe6333074a6a81bdee", "sha256:f3f39dbcaeb4fafe624cd127355168dccb4e8af542eaf12ac2f575c7c337f94a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:38.501Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:57f683a3b571923614cca71ce7b5b5926fa33faedd9a6a16b97310e00964d345", "sha256:80c7cf0a075ebd791a51e63833bf9688a94185408d79611fe6bb7b3415f8a768", "sha256:a65c76a1538afcf555fd9c4be67e4f67a85209f387e31d356f09cfcc4a0f556a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:38.501Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/slack/agent-readiness/slack-web-api/workspace-app-operations", "projection_digest": "sha256:8836d33f10e32c36dbe4d9ad70f348904e790adeb8989febe5df11d8c50f2347" } } }