{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyh8fpe5dk9hex187x4g03fn", "entity_slug": "vercel", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xn2p7wd9g3a5rt8zq6", "entity_id": "ent_01kyh8fpe5dk9hex187x4g03fn", "scope": { "product": { "key": "vercel-rest-api", "name": "Vercel REST API" }, "funnel": { "key": "deployment-operations", "name": "Deployment operations" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:2ca7db4f429b3bb813bb1ac6d59c8cb5213e3c16a9096dfaa1455909f7b73e13" }, "declaration_revision_digest": "sha256:d71be82b4542d1caf53b6eef94b6c4237601920f428cc37485c128276b6db97c", "declaration": { "declaration_id": "declaration_vercel_api_deployment_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/ve/vercel.yaml", "git_blob_oid": "860880f6043e6b93357a098b2df91c7ba0e3c157", "blob_digest": "sha256:5a34c8c678d9d4d273f7ab003404b4e313d5bda811dbb2f10d4ab1f199bbeddd" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and inspect deployments through the REST API", "interface_ids": [ "deployment-api" ] } ], "participants": [ { "participant_id": "vercel", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe5dk9hex187x4g03fn" } } ], "resources": [ { "resource_id": "access-tokens", "uri": "https://vercel.com/guides/how-do-i-use-a-vercel-api-access-token", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "account-signup", "uri": "https://vercel.com/signup", "roles": [ "access" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "api-errors", "uri": "https://vercel.com/docs/rest-api/errors", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://vercel.com/docs/rest-api", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://vercel.com/docs/plans/pro-plan/billing", "roles": [ "checkout", "documentation", "pricing" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "deployment-operations", "uri": "https://vercel.com/docs/rest-api/reference/endpoints/deployments/create-a-new-deployment", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://vercel.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "readiness-54635e0ef5c0510ed84229bf9da667a7aa6eae5d7bde501e7987da45a62b4c64", "uri": "https://vercel.com/docs/plans/pro-plan", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609", "uri": "https://vercel.com/docs/cli/tokens", "roles": [ "authentication", "documentation" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877", "uri": "https://vercel.com/docs/rest-api/billing/purchase-credits", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://vercel.com/legal/terms", "roles": [ "terms" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://vercel.com/help", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "vercel", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "registration", "uri": "https://vercel.com/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "endpoint_id": "vercel-api", "uri": "https://api.vercel.com", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "vercel", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "access-tokens" ], "operated_by_participant_id": "vercel", "standard_bindings": [] }, { "interface_id": "deployment-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "vercel-api" ], "resource_ids": [ "api-errors", "api-reference", "deployment-operations" ], "operated_by_participant_id": "vercel", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "deployment-api" } }, { "relation_id": "deployments-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "deployment-operations" }, "to": { "node_kind": "interface", "node_id": "deployment-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "deployment-api" } }, { "relation_id": "relation-describes-6d02ed10c0b4e2431680d2306b1792c88939522d69d3aff8487cdc71565ad520", "kind": "describes", "from": { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "account-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:7c59a04f00102d531d6008028c0c551ded5cd1d5d0a9fb3f37d7d3172a5f1d7b", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "B", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "sign_up", "stage_label": "Sign up", "public_state": "limited", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Vercel Access Tokens can be created in account settings or via Vercel CLI (`vercel tokens add`) and scoped to specific teams or projects, but initial creation relies on manual dashboard UI interaction or copying the secret." } }, "limitations": [ { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Vercel Access Tokens can be created in account settings or via Vercel CLI (`vercel tokens add`) and scoped to specific teams or projects, but initial creation relies on manual dashboard UI interaction or copying the secret." }, "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "Vercel REST API's deployment creation returns a deployment object with a `readyState` field and indicates callers can poll `readyState` to track progress through states such as QUEUED, INITIALIZING, BUILDING, READY, or ERROR. However, current evidence leaves explicit reconciliation procedures and specific documented time bounds unresolved." }, "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "The REST API documentation describes general error codes (such as forbidden, rate_limited with reset timestamps, bad_request, internal_server_error, and not_found), but complete safe handling semantics like explicit idempotency and reconciliation are not fully detailed." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Vercel access tokens can be created, listed, and revoked via the Vercel CLI (vercel tokens add, list, rm) or account settings with project scoping. However, explicit recovery mechanisms following compromise are not fully detailed in the retained evidence." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Vercel REST API is publicly discoverable and hosted at the stable base entrypoint URL https://api.vercel.com." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Standard metadata directives appear, but retained admissible evidence does not establish an explicit web-agent or robot access policy for the assessed API documentation surface." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Structured discovery exists but covers only part of the evaluation surface.", "context": "Vercel changelog text notes automatic REST API documentation with OpenAPI, but the retained text does not provide a verified schema artifact for the complete evaluation surface." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Vercel's Terms of Service are stable, readable, retrievable online, and materially complete, covering age eligibility, license terms, payment terms, and service API conditions." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "Vercel's Terms of Service state explicit eligibility conditions, requiring users to be at least 16 years of age, have electronic devices controlled by them, and possess legal authority to bind a company or legal entity when entering into the agreement on its behalf." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Vercel discloses its pricing tiers, including a $0/month Hobby plan and a $20/month Pro plan (which includes $20 of usage credit). Prices are stated in USD and exclude applicable taxes calculated based on billing address." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:21.755Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f69b36b3d3059bf70c97bfaf012229445f9c1a6545ab53d87704814a6a051437", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "sha256:3ce5ff491b6fc70427ba9faab35d6f9781aa9e5b59c495c60022e29f82a10e68", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e518cd78c5a7164b9237499ee0f2830b4ab24f63d14bfac708f4c20a548d8d2e" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "start_byte": 9300, "end_byte": 10094, "value_digest": "sha256:89b7c06c13317b210660c52084b8f79c96ead3a733cba57d8dc9cc21ad1c1f96" }, { "artifact_digest": "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "start_byte": 6905, "end_byte": 7704, "value_digest": "sha256:5ec198c6f5a80582fdd3b3c6dde5fe6d88820f2ee80d1559ee869d083e07486e" } ] } ], "note": "Vercel's Terms of Service state explicit eligibility conditions, requiring users to be at least 16 years of age, have electronic devices controlled by them, and possess legal authority to bind a company or legal entity when entering into the agreement on its behalf." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:04.903Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0d4954350adf1117bcd27487982ca67671c2a50e559f38abe7a731c287d94465", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0b17540be2d8745404dc414b361847489896f43682b585b967f0460ee3ee3b83", "sha256:1a5f7f2b6c44919f599b90029ca25da3bf1f902e3ef6dc67ed77a3aa4068ddda", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:75f419e59aa755d822f64e9de36288834eb306a50d7dc1d3d7ba400f98d1c360" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:1a5f7f2b6c44919f599b90029ca25da3bf1f902e3ef6dc67ed77a3aa4068ddda", "start_byte": 7041, "end_byte": 7844, "value_digest": "sha256:ec7fdf1cd27cb0572efc28bf68debcec5b98a55d3ec24b611faf5b1e2f1ce16e" }, { "artifact_digest": "sha256:1a5f7f2b6c44919f599b90029ca25da3bf1f902e3ef6dc67ed77a3aa4068ddda", "start_byte": 7845, "end_byte": 8643, "value_digest": "sha256:1e4d1675c04e0c987c29b29afc79d77c992b6391f5968139bb3b5843cdf0de14" } ] } ], "note": "Vercel discloses its pricing tiers, including a $0/month Hobby plan and a $20/month Pro plan (which includes $20 of usage credit). Prices are stated in USD and exclude applicable taxes calculated based on billing address." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:943a5cf193acb7bee0816e1a05a3af1f15024c9f02f2e25c3b3fefb309fe68c6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:582d332defc5accb90ffa27aae7274e35c4873202e616f65c1f8a0880f6ffb44", "sha256:8b816e086332fb2ea249b7f60ab8f17f09520d4ab8f93df7ae1d14eaa5a834e8", "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "start_byte": 174172, "end_byte": 174968, "value_digest": "sha256:54277203aaf932da696c226383d0e3f5e0bc2758dbba64a2c469f8e23e9990c9" } ] } ], "note": "The Vercel REST API is publicly discoverable and hosted at the stable base entrypoint URL https://api.vercel.com." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Are verified structured discovery artifacts available?", "finding": "Structured discovery exists but covers only part of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:943a5cf193acb7bee0816e1a05a3af1f15024c9f02f2e25c3b3fefb309fe68c6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:582d332defc5accb90ffa27aae7274e35c4873202e616f65c1f8a0880f6ffb44", "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "sha256:c82fef36554f19acc4aac8d86a021f82efbe93c44b27b33e12be2732e39cd770" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "start_byte": 230792, "end_byte": 231599, "value_digest": "sha256:d004e41feb57627762f0035cdc1b7c5057b3184e02faa7f2b5b355aa107382a8" } ] } ], "note": "Vercel changelog text notes automatic REST API documentation with OpenAPI, but the retained text does not provide a verified schema artifact for the complete evaluation surface." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:21.755Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f69b36b3d3059bf70c97bfaf012229445f9c1a6545ab53d87704814a6a051437", "capture_rung": "http" } ], "artifact_digests": [ "sha256:063240f7aff97740036dc381946de1cbf098c31d15f6d1c7100a1a9b463e0906", "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e518cd78c5a7164b9237499ee0f2830b4ab24f63d14bfac708f4c20a548d8d2e" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "start_byte": 6112, "end_byte": 6904, "value_digest": "sha256:3959dcda0ad9cf80831fd1e7ab6e92ffd896372f1c9f3b907e04e7ceb2124cd3" }, { "artifact_digest": "sha256:3471a196b755b2d3b03be2a846f6efb5b9aa0336770fff3cc43ee031ff23cb35", "start_byte": 6905, "end_byte": 7704, "value_digest": "sha256:5ec198c6f5a80582fdd3b3c6dde5fe6d88820f2ee80d1559ee869d083e07486e" } ] } ], "note": "Vercel's Terms of Service are stable, readable, retrievable online, and materially complete, covering age eligibility, license terms, payment terms, and service API conditions." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "Standard metadata directives appear, but retained admissible evidence does not establish an explicit web-agent or robot access policy for the assessed API documentation surface." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Vercel Access Tokens can be created in account settings or via Vercel CLI (`vercel tokens add`) and scoped to specific teams or projects, but initial creation relies on manual dashboard UI interaction or copying the secret." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup page displays social login options and email entry, but does not provide complete evidence of deterministic validation, navigation, and handoffs." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup page captures do not contain an explicit declaration or verified-agent alternative regarding CAPTCHA boundaries across the signup flow." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The initial signup screen does not state whether phone verification is required, absent, or explicitly resumable." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Vercel's signup page provides a canonical entrypoint to begin account registration via OAuth providers and email." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:55.665Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup page displays social login options and email entry, but does not provide complete evidence of deterministic validation, navigation, and handoffs." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:55.665Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:31f8664c96fec256393ae837717f39881cfd022de3d0202e5b772125cb142606", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:2dce0273fc6f95c86e47e109fccdf6dc258277ced3d16ab78e13d3a5834adeca", "sha256:49684cb94dbe588f6d5b4bbdb8eefda71d6027ce5d0efba0bf4843a46da642f8", "sha256:4aa2f5cf40e9ac2786833494d98bc96c94c440f1f32c5ec581b10889a0f047ba", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8c685cb462711eaac432606206da4fe07a5f8ee9c6d8b6e4f982a1b7273968a0", "sha256:9f30c3cf3cce9c087d1e7868716c5371c4f70ca3a9410e47433fc1d4020f1fa3" ], "locators": [ { "artifact_digest": "sha256:8c685cb462711eaac432606206da4fe07a5f8ee9c6d8b6e4f982a1b7273968a0", "start_byte": 667, "end_byte": 1040, "value_digest": "sha256:bd50309f70a7ceb311148b279cd1daba0ef584608c7525e666b98a3088f9ca1f" } ] } ], "note": "Vercel's signup page provides a canonical entrypoint to begin account registration via OAuth providers and email." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:55.665Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup page captures do not contain an explicit declaration or verified-agent alternative regarding CAPTCHA boundaries across the signup flow." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:15.476Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e925eaf59fc3d2a898f2bf0046a765d9ee6e3f9e2e08485c2013a4b974dc09dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2ba251dfef3c1714fdc127c472bc92bb31f7449462918e87a317ce793cf96cd6", "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "sha256:40b42ed6ee65d7936e06ff94e339d7e60124d9a6d476a433559f75798c24948a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" }, "locators": [ { "artifact_digest": "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "start_byte": 16282, "end_byte": 17060, "value_digest": "sha256:7229ded016d0c8cda63472866c684809c40518f36814571e81c571ef004dcfae" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:08d5837c6603b7c98bab69d13a185acf7d977b138c3deac4b8712a7770e39afb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:8c6d04da457fa40f8b17d5b5de3f077b3ec7447334e53ec6706a1aa1d913e382", "sha256:9d50687a2b20b5e73630367bc84f5891d2d72433d32bb9dd9d8069242f28b0f9", "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "sha256:c891c78882d6acc1d53bd941c6daf6cd41b17359aa771d7c3def9f4f5fb45311" ], "source_surface": { "node_kind": "resource", "node_id": "access-tokens" }, "locators": [ { "artifact_digest": "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "start_byte": 8645, "end_byte": 9440, "value_digest": "sha256:f7731ef118770e55d0b5a5db53b005d800994bf85ab341a4e85b18d78a41a350" } ] } ], "note": "Vercel Access Tokens can be created in account settings or via Vercel CLI (`vercel tokens add`) and scoped to specific teams or projects, but initial creation relies on manual dashboard UI interaction or copying the secret.", "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:55.665Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The initial signup screen does not state whether phone verification is required, absent, or explicitly resumable." } ], "blockers": [], "remediations": [ { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "The evidence discloses payment timing at the start of each billing cycle, card payment methods, and USD currency charging conditions." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "An API, protocol, or accessible web flow supports deterministic checkout and resumption.", "context": "POST /v1/billing/buy lets an agent construct a credit purchase with a bearer token and returns a checkoutSessionId and checkoutSessionUrl, so approval can be handed to a person at the URL and the session resumed by id." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "A documented rail supports scoped delegation or explicit human-confirmed authorization with receipts.", "context": "Credit purchases through POST /v1/billing/buy charge the payment method on file immediately and are limited to Owner, Member, Developer, Security and Billing roles, so payment is authorized within the scoped authority of the token holder." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Vercel documents programmatic credit purchase through POST /v1/billing/buy against the payment method on file, charged immediately, alongside the self-service Pro plan upgrade; no vendor review stands in the path." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "An API, protocol, or accessible web flow supports deterministic checkout and resumption.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:17.442Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-54635e0ef5c0510ed84229bf9da667a7aa6eae5d7bde501e7987da45a62b4c64" }, { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0ea09515653dde0d4d5c7fd1f454f3c01f41c74b1649eb2c55671a6fc75a1563", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "sha256:43ddb574ecfa7d548d2c476cc408b312990a2141ef5138ca3840ddf0a257cf3c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:922fa838e4d6f8ecd2d1baad9017d8351c58e9174e85a08812d8ebb34cc60519" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" }, "locators": [ { "artifact_digest": "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "start_byte": 8673, "end_byte": 8844, "value_digest": "sha256:87a1f6e097131707a6a48557cf49c11a81ac5fa725c1c71e26bc0ddc287093f5" }, { "artifact_digest": "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "start_byte": 9479, "end_byte": 9562, "value_digest": "sha256:af0ae012e2e7a535c346cb5da467c6503296bddaaa3ac3c470d3bc187624e242" } ] } ], "note": "POST /v1/billing/buy lets an agent construct a credit purchase with a bearer token and returns a checkoutSessionId and checkoutSessionUrl, so approval can be handed to a person at the URL and the session resumed by id." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:01.429Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:3dee279471ea892efb5561a0e7dc30d5580c0ef23b0cef968a8a4e818c212681", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8542e156bf713ba3196c6460ed3c4c1520d526bf52ed8834cf9765ffdd008849", "sha256:c65b1f80062582eb9cca4c92d73354ba15e267d57260617caa7c7ddf091c51a9", "sha256:c81fc84ae8264ec1ea032ecdecc2d41dbcf1a476c0be450e9b60bc634e56ff69" ], "source_surface": { "node_kind": "resource", "node_id": "billing-checkout" }, "locators": [ { "artifact_digest": "sha256:c81fc84ae8264ec1ea032ecdecc2d41dbcf1a476c0be450e9b60bc634e56ff69", "start_byte": 14128, "end_byte": 14926, "value_digest": "sha256:25caa0694bfd1c783dc17335c55e9ed3edae2b902bc5a745b796687fdc34a8cd" } ] } ], "note": "The evidence discloses payment timing at the start of each billing cycle, card payment methods, and USD currency charging conditions." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "A documented rail supports scoped delegation or explicit human-confirmed authorization with receipts.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:17.442Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-54635e0ef5c0510ed84229bf9da667a7aa6eae5d7bde501e7987da45a62b4c64" }, { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0ea09515653dde0d4d5c7fd1f454f3c01f41c74b1649eb2c55671a6fc75a1563", "capture_rung": "http" } ], "artifact_digests": [ "sha256:243283b0b40c8fc3be74283806ffa353c101f9de54b8218d24cf738fcc9c3189", "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "sha256:43ddb574ecfa7d548d2c476cc408b312990a2141ef5138ca3840ddf0a257cf3c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" }, "locators": [ { "artifact_digest": "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "start_byte": 448, "end_byte": 528, "value_digest": "sha256:704efe39331be67f2cc8b0491532ece6ee039e08baa382ec18587bddb29b4ce6" }, { "artifact_digest": "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "start_byte": 8673, "end_byte": 8844, "value_digest": "sha256:87a1f6e097131707a6a48557cf49c11a81ac5fa725c1c71e26bc0ddc287093f5" } ] } ], "note": "Credit purchases through POST /v1/billing/buy charge the payment method on file immediately and are limited to Owner, Member, Developer, Security and Billing roles, so payment is authorized within the scoped authority of the token holder." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:17.442Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "readiness-54635e0ef5c0510ed84229bf9da667a7aa6eae5d7bde501e7987da45a62b4c64" }, { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0ea09515653dde0d4d5c7fd1f454f3c01f41c74b1649eb2c55671a6fc75a1563", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "sha256:43ddb574ecfa7d548d2c476cc408b312990a2141ef5138ca3840ddf0a257cf3c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:94c96deb63b0f080b1db7bc341063c5ceeae45a2c0f0b2831c170afdd85b61f3" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-74d9faecf8e412bdc34272487dd9c3b5ccc64ea4c6ef4f0027ebbd1f3651c877" }, "locators": [ { "artifact_digest": "sha256:2629a8bf094a36d42fbfa58a8785a471b6eef8329759ce7e72bc5becbf7a2eed", "start_byte": 8673, "end_byte": 8844, "value_digest": "sha256:87a1f6e097131707a6a48557cf49c11a81ac5fa725c1c71e26bc0ddc287093f5" } ] } ], "note": "Vercel documents programmatic credit purchase through POST /v1/billing/buy against the payment method on file, charged immediately, alongside the self-service Pro plan upgrade; no vendor review stands in the path." } ], "blockers": [], "remediations": [] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "context": "Vercel REST API's deployment creation returns a deployment object with a `readyState` field and indicates callers can poll `readyState` to track progress through states such as QUEUED, INITIALIZING, BUILDING, READY, or ERROR. However, current evidence leaves explicit reconciliation procedures and specific documented time bounds unresolved." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Deployments can be initiated programmatically via direct HTTP POST requests to `https://api.vercel.com/v13/deployments` using a bearer access token." }, { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "context": "Vercel provides an agent-usable CLI command (`vercel tokens add \"\"`) that creates personal access tokens and prints the plaintext value directly to stdout for immediate capture in CI environments or scripts." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:01.223Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e925eaf59fc3d2a898f2bf0046a765d9ee6e3f9e2e08485c2013a4b974dc09dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2ba251dfef3c1714fdc127c472bc92bb31f7449462918e87a317ce793cf96cd6", "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e451296d53c4fc5f067d2946826432ecf26555368e9499f777d7c9f258185321" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" }, "locators": [ { "artifact_digest": "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "start_byte": 17061, "end_byte": 17848, "value_digest": "sha256:c02b6465738b1b6f3faf890bce294a494ec613f041da4d12e046c86ed16c9b4c" } ] } ], "note": "Vercel provides an agent-usable CLI command (`vercel tokens add \"\"`) that creates personal access tokens and prints the plaintext value directly to stdout for immediate capture in CI environments or scripts." }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:02.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "deployment-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ff76b7bcbe9d9a363626f4a7e7c4dfc2b2cc07c1ed471ad1276efcaa5d41bc82", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "sha256:77e071b48b89081c5fd19fde8871b34fef15ec81fd1f93f0f77baec74d620bff", "sha256:7e68e1af1dd83d21689efffadd66411fcbaa4e1b56e31e42151e4e9780383e45", "sha256:cf40369b56a310b643b01700d10a9ff53442364fe26808e50cce585c38baad60" ], "source_surface": { "node_kind": "resource", "node_id": "deployment-operations" }, "locators": [ { "artifact_digest": "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "start_byte": 16867, "end_byte": 17667, "value_digest": "sha256:d7cbb3d4969a9d3120d0268f69ef7f45f56e25d76deb8ba5f3e44731be1d48be" }, { "artifact_digest": "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "start_byte": 17668, "end_byte": 18464, "value_digest": "sha256:2a4b7004ec8dbaa58974e085fa2179ea2cc387db5174dc8a300a62d3595f6431" } ] } ], "note": "Vercel REST API's deployment creation returns a deployment object with a `readyState` field and indicates callers can poll `readyState` to track progress through states such as QUEUED, INITIALIZING, BUILDING, READY, or ERROR. However, current evidence leaves explicit reconciliation procedures and specific documented time bounds unresolved.", "remediation": { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:02.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "deployment-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ff76b7bcbe9d9a363626f4a7e7c4dfc2b2cc07c1ed471ad1276efcaa5d41bc82", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "sha256:77e071b48b89081c5fd19fde8871b34fef15ec81fd1f93f0f77baec74d620bff", "sha256:cf40369b56a310b643b01700d10a9ff53442364fe26808e50cce585c38baad60", "sha256:e177178197999a6e909f5efed27d9d73cb14413c42d50582fcbfe80730871f7f" ], "source_surface": { "node_kind": "resource", "node_id": "deployment-operations" }, "locators": [ { "artifact_digest": "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "start_byte": 10586, "end_byte": 11375, "value_digest": "sha256:88d4855d46f21137730fe499f3f355dccbcaba36f51ed3a7f2e8503c0567b52a" } ] } ], "note": "Deployments can be initiated programmatically via direct HTTP POST requests to `https://api.vercel.com/v13/deployments` using a bearer access token." } ], "blockers": [], "remediations": [ { "signal_code": "provisioning_completion", "code": "improve.provision.provisioning_completion", "instruction": "Expose bounded machine-readable terminal status and reconciliation semantics." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "The REST API documentation describes general error codes (such as forbidden, rate_limited with reset timestamps, bad_request, internal_server_error, and not_found), but complete safe handling semantics like explicit idempotency and reconciliation are not fully detailed." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Vercel REST API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Vercel access tokens can be created, listed, and revoked via the Vercel CLI (vercel tokens add, list, rm) or account settings with project scoping. However, explicit recovery mechanisms following compromise are not fully detailed in the retained evidence." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Essential service operations across Vercel REST API errors, reference overview, and deployment management endpoints are documented and accessible via standard HTTP REST requests." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Requests to the Vercel REST API are authenticated using scoped Vercel Access Tokens passed via the Authorization header as a Bearer token." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Vercel defines explicit REST endpoints, parameters, request and response structures, status codes, and error formats across deployment and management operations." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "deployment-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Vercel REST API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:15.476Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e925eaf59fc3d2a898f2bf0046a765d9ee6e3f9e2e08485c2013a4b974dc09dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2ba251dfef3c1714fdc127c472bc92bb31f7449462918e87a317ce793cf96cd6", "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "sha256:40b42ed6ee65d7936e06ff94e339d7e60124d9a6d476a433559f75798c24948a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" }, "locators": [ { "artifact_digest": "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "start_byte": 16282, "end_byte": 17060, "value_digest": "sha256:7229ded016d0c8cda63472866c684809c40518f36814571e81c571ef004dcfae" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:08d5837c6603b7c98bab69d13a185acf7d977b138c3deac4b8712a7770e39afb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:8c6d04da457fa40f8b17d5b5de3f077b3ec7447334e53ec6706a1aa1d913e382", "sha256:9d50687a2b20b5e73630367bc84f5891d2d72433d32bb9dd9d8069242f28b0f9", "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "sha256:c891c78882d6acc1d53bd941c6daf6cd41b17359aa771d7c3def9f4f5fb45311" ], "source_surface": { "node_kind": "resource", "node_id": "access-tokens" }, "locators": [ { "artifact_digest": "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "start_byte": 8645, "end_byte": 9440, "value_digest": "sha256:f7731ef118770e55d0b5a5db53b005d800994bf85ab341a4e85b18d78a41a350" } ] } ], "note": "Vercel access tokens can be created, listed, and revoked via the Vercel CLI (vercel tokens add, list, rm) or account settings with project scoping. However, explicit recovery mechanisms following compromise are not fully detailed in the retained evidence.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:32.100Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-errors" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:643ca8ab3cc8c61183c4d36783d5bd866fc3f88617b681a85e14e0a06aedbe34", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14d1d9c1b347190be66cc1b03c2c6037743751d939512544ac4f4643c1ac8a84", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:71a90a377ccd0094d64e76bed4442d130b2e603b5ce57139b10d5c4d81dda243", "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "start_byte": 7871, "end_byte": 8579, "value_digest": "sha256:9499095de33134270ce727ddcc46583aa483f3dcb608971a997174e89683b05d" }, { "artifact_digest": "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "start_byte": 8580, "end_byte": 9377, "value_digest": "sha256:872f7f5c5ce144424ee6316888391eda9bfa285dd144f1f44efd8bc1678979c4" } ] } ], "note": "The REST API documentation describes general error codes (such as forbidden, rate_limited with reset timestamps, bad_request, internal_server_error, and not_found), but complete safe handling semantics like explicit idempotency and reconciliation are not fully detailed.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:15.476Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "access-tokens" }, { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:08d5837c6603b7c98bab69d13a185acf7d977b138c3deac4b8712a7770e39afb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:9d50687a2b20b5e73630367bc84f5891d2d72433d32bb9dd9d8069242f28b0f9", "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "sha256:c891c78882d6acc1d53bd941c6daf6cd41b17359aa771d7c3def9f4f5fb45311", "sha256:fbecd01b9111d36493f10ebbae4a5123b79c68525a6f221230a73deba084bb73" ], "source_surface": { "node_kind": "resource", "node_id": "access-tokens" }, "locators": [ { "artifact_digest": "sha256:c1744356e775864edddb37551dc0e6cedf967922d396d5b8b65373f115a9222f", "start_byte": 9441, "end_byte": 10216, "value_digest": "sha256:6b0e30c4180ee754ee68d49ecc9c33a8c3d63880ca64e65504c40818c2d6d102" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e925eaf59fc3d2a898f2bf0046a765d9ee6e3f9e2e08485c2013a4b974dc09dd", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2ba251dfef3c1714fdc127c472bc92bb31f7449462918e87a317ce793cf96cd6", "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "sha256:40b42ed6ee65d7936e06ff94e339d7e60124d9a6d476a433559f75798c24948a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-55d5a3246b49c5978d9cd909619ea57cb2e9a92593283460fba3bdd38e64a609" }, "locators": [ { "artifact_digest": "sha256:3225abe2ae9714c4b3c422145acd308ccd5284bd1bb158ce6c99b5393b4e506d", "start_byte": 16282, "end_byte": 17060, "value_digest": "sha256:7229ded016d0c8cda63472866c684809c40518f36814571e81c571ef004dcfae" } ] } ], "note": "Requests to the Vercel REST API are authenticated using scoped Vercel Access Tokens passed via the Authorization header as a Bearer token." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "deployment-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ff76b7bcbe9d9a363626f4a7e7c4dfc2b2cc07c1ed471ad1276efcaa5d41bc82", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "sha256:77e071b48b89081c5fd19fde8871b34fef15ec81fd1f93f0f77baec74d620bff", "sha256:cf40369b56a310b643b01700d10a9ff53442364fe26808e50cce585c38baad60", "sha256:f7789f71ca9d59d592f69434bca250a8d5336562c544325e8d464562b3a97fac" ], "source_surface": { "node_kind": "resource", "node_id": "deployment-operations" }, "locators": [ { "artifact_digest": "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "start_byte": 16867, "end_byte": 17667, "value_digest": "sha256:d7cbb3d4969a9d3120d0268f69ef7f45f56e25d76deb8ba5f3e44731be1d48be" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:943a5cf193acb7bee0816e1a05a3af1f15024c9f02f2e25c3b3fefb309fe68c6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:582d332defc5accb90ffa27aae7274e35c4873202e616f65c1f8a0880f6ffb44", "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "sha256:f52d034f0f5852e9561a768cb693e84d8bd16bfd51782603623e2b98ec320b9f" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "start_byte": 182933, "end_byte": 183754, "value_digest": "sha256:784f6a8157ce018cdce12b341840ff35975fd625e57d4f63b130cbe4074c9ac9" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:643ca8ab3cc8c61183c4d36783d5bd866fc3f88617b681a85e14e0a06aedbe34", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14d1d9c1b347190be66cc1b03c2c6037743751d939512544ac4f4643c1ac8a84", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "sha256:c454378782cb5dcf1fe291750ea8ba1696a7ae3415a1e820121ee2f71c1d21f9" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "start_byte": 8580, "end_byte": 9377, "value_digest": "sha256:872f7f5c5ce144424ee6316888391eda9bfa285dd144f1f44efd8bc1678979c4" } ] } ], "note": "Vercel defines explicit REST endpoints, parameters, request and response structures, status codes, and error formats across deployment and management operations." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:37.612Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "deployment-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:943a5cf193acb7bee0816e1a05a3af1f15024c9f02f2e25c3b3fefb309fe68c6", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:582d332defc5accb90ffa27aae7274e35c4873202e616f65c1f8a0880f6ffb44", "sha256:8b816e086332fb2ea249b7f60ab8f17f09520d4ab8f93df7ae1d14eaa5a834e8", "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:a316c4a4848a12b71d0c43b54ccf116f7a58acd85c76cdfb1200791a14285b3d", "start_byte": 174172, "end_byte": 174968, "value_digest": "sha256:54277203aaf932da696c226383d0e3f5e0bc2758dbba64a2c469f8e23e9990c9" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ff76b7bcbe9d9a363626f4a7e7c4dfc2b2cc07c1ed471ad1276efcaa5d41bc82", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "sha256:77e071b48b89081c5fd19fde8871b34fef15ec81fd1f93f0f77baec74d620bff", "sha256:cf40369b56a310b643b01700d10a9ff53442364fe26808e50cce585c38baad60", "sha256:e177178197999a6e909f5efed27d9d73cb14413c42d50582fcbfe80730871f7f" ], "source_surface": { "node_kind": "resource", "node_id": "deployment-operations" }, "locators": [ { "artifact_digest": "sha256:0968540d0673a758709776dcdcc2313471943ae4587b2f885fdd894082ec5f31", "start_byte": 10586, "end_byte": 11375, "value_digest": "sha256:88d4855d46f21137730fe499f3f355dccbcaba36f51ed3a7f2e8503c0567b52a" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:643ca8ab3cc8c61183c4d36783d5bd866fc3f88617b681a85e14e0a06aedbe34", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14d1d9c1b347190be66cc1b03c2c6037743751d939512544ac4f4643c1ac8a84", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "sha256:c0dbbfb70c5ba41d6a25323606f1288b89590106c7891f948a714a3690194a27" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:75bb6df98983fffac6f5e4ae8a5f42ce8b9c322578c63dd933dc1603be441674", "start_byte": 7077, "end_byte": 7870, "value_digest": "sha256:aa4ccb63fdb63a761afb4c42fd7fcdb3552298d1f6a09df17c5ffce6efc356a6" } ] } ], "note": "Essential service operations across Vercel REST API errors, reference overview, and deployment management endpoints are documented and accessible via standard HTTP REST requests." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 2, "barrier_ratio": 0.4 }, "last_tested_at": "2026-09-06T08:52:01.429Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:10c784075e1bdecfa5cf6b9be4f5a0506acf980c1c4eddaa730a31ff8f523f41", "sha256:127edcc5d23bf955636776a5b65d9e87244f2f54c53255066b8e050538e0f705", "sha256:228ff44b35f8ff4d413dce3cf8836ff6512af22fde043d390dcec467d9eeeed5", "sha256:2da91a77990b69aa37f7c86904245aee40c3a006b684b8e31595e61b30212884", "sha256:2f539ef443ba912b7d5cf19cb0a156d89215afc9b600d435d7fd135f9d67cd05", "sha256:360cf411956a33041800c4e170366059c6dff4ca04a2dee60ee7df873765b4b4", "sha256:4f12ea357c966fe55e606751db8e40a815c9c63b7859000941ae926c3fee7539", "sha256:5339f29748bb0e8fdb572ea2198617162ce393695726906f92d4559c90219094", "sha256:5535898cfaa5617b9e66f229e1a59a1c6d088dfa9d8f8a9f608742220c7cc3f8", "sha256:5a7e288ec741febec5c32cc09ab6cf896fb5e3494b439ee39f2d633dc2987643", "sha256:7aec33e7bf9e188da9382f0bdbe8cc28c185bad60ce1963103ba0e4b15af3124", "sha256:7fc33c6a5632408c971fdda278d4f045d38ab2369e548b470cd74fc87bc8eb7d", "sha256:85a59f7cbb312710ef111f212166143121e6238e7140eed517d105438fc7bacf", "sha256:8a497cc7bccd043de45a004726a927cad73f3896b965eaae856e1fa0016490eb", "sha256:8b200b2557ec828b465a817d6b0f321513366ac450ec73231acb8c57a62d0ac7", "sha256:8e2a90060d5712b4fc39d66ed3ecf859b0316bebdf2d850f4d8b1c8cbae606aa", "sha256:9552861f674ad9a9ab6ff46e614c69c89f3071270a9e56a69c707850311daaca", "sha256:a19504382404847ceb82d71b30ba1d94d666e77f20683c4dcd5775881ad68a17", "sha256:b18ce730542173fd69f26771c72cec20e7e754e69b03b85d0ed26361ef0ad528", "sha256:b410211acce3e121027d88e714d41e11319d5f90ee13254839f78b38004022a0", "sha256:b5e0e7e02cb03d0d595f784400ac8b6031252327458373aedafe0eb8382f5d40", "sha256:c063b4f7f6a4e8058356e7f3b1f86809d82802b4c96057d720ef06a2dc4aeeaa", "sha256:c6f6684f9ae4dc567532db2b10e31b356a2cabf09e38673175716c5e7786d4a8", "sha256:cbe185b346d0fb5cae08ee3f0905ef1fb6d6fbd32b092e081177b938fbb70848", "sha256:d0eacdefd7af4ec3420742545ad797efc7ef208c13f65de2de4ef1d667d94d74", "sha256:d9492f28879851440e1889d599b0f183e9c040429c3050a47090e62512bdc7df", "sha256:dd20ef6c71d4e3c892919ef77567c6d541d9f44113a5409c66acdb6d5d7402d5", "sha256:e4ef49f57e3edb26d7431fa5854f966acc69a86a74f65e9bc3131a81e49e704b", "sha256:e9856dabd2555a27d60b77941222323acdd1fa2c14851d7b50d768e01ca6778c", "sha256:eaa08bd80ab1069464d1acec4dcbfd196092b49533d1474cf25c8a8e782ff2e1", "sha256:ee4ea1e6429eabd5ea9359eb3d59f38751dc2dca8ff0ab4284d9d879be32359b", "sha256:f1b3eba594a12e07c7e2b2333a5c460c9008a1d4b574c50bf63882470ccc9f24", "sha256:f603238a3fcc72e2200e961a56058d323d4561c309c027de4714555f63977433", "sha256:ff1d2952a7632e401bf8d986e783261a5eb9943f0c885548f72daf8d6e20ba31" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:cbe185b346d0fb5cae08ee3f0905ef1fb6d6fbd32b092e081177b938fbb70848" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:21.755Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:e4ef49f57e3edb26d7431fa5854f966acc69a86a74f65e9bc3131a81e49e704b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:04.903Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:2da91a77990b69aa37f7c86904245aee40c3a006b684b8e31595e61b30212884" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:7fc33c6a5632408c971fdda278d4f045d38ab2369e548b470cd74fc87bc8eb7d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:4f12ea357c966fe55e606751db8e40a815c9c63b7859000941ae926c3fee7539" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:21.755Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:b18ce730542173fd69f26771c72cec20e7e754e69b03b85d0ed26361ef0ad528" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:10c784075e1bdecfa5cf6b9be4f5a0506acf980c1c4eddaa730a31ff8f523f41" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:55.665Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:f603238a3fcc72e2200e961a56058d323d4561c309c027de4714555f63977433" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:55.665Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:8e2a90060d5712b4fc39d66ed3ecf859b0316bebdf2d850f4d8b1c8cbae606aa", "sha256:b410211acce3e121027d88e714d41e11319d5f90ee13254839f78b38004022a0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:55.665Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:a19504382404847ceb82d71b30ba1d94d666e77f20683c4dcd5775881ad68a17", "sha256:eaa08bd80ab1069464d1acec4dcbfd196092b49533d1474cf25c8a8e782ff2e1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:15.476Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:8b200b2557ec828b465a817d6b0f321513366ac450ec73231acb8c57a62d0ac7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:55.665Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:e9856dabd2555a27d60b77941222323acdd1fa2c14851d7b50d768e01ca6778c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:17.442Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:360cf411956a33041800c4e170366059c6dff4ca04a2dee60ee7df873765b4b4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:01.429Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:f1b3eba594a12e07c7e2b2333a5c460c9008a1d4b574c50bf63882470ccc9f24" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:17.442Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:5a7e288ec741febec5c32cc09ab6cf896fb5e3494b439ee39f2d633dc2987643" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:17.442Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:5535898cfaa5617b9e66f229e1a59a1c6d088dfa9d8f8a9f608742220c7cc3f8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:01.223Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:b5e0e7e02cb03d0d595f784400ac8b6031252327458373aedafe0eb8382f5d40" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:02.374Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:dd20ef6c71d4e3c892919ef77567c6d541d9f44113a5409c66acdb6d5d7402d5" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:02.374Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:127edcc5d23bf955636776a5b65d9e87244f2f54c53255066b8e050538e0f705", "sha256:2f539ef443ba912b7d5cf19cb0a156d89215afc9b600d435d7fd135f9d67cd05", "sha256:d9492f28879851440e1889d599b0f183e9c040429c3050a47090e62512bdc7df" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:5339f29748bb0e8fdb572ea2198617162ce393695726906f92d4559c90219094", "sha256:85a59f7cbb312710ef111f212166143121e6238e7140eed517d105438fc7bacf" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:15.476Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:c063b4f7f6a4e8058356e7f3b1f86809d82802b4c96057d720ef06a2dc4aeeaa" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:32.100Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:7aec33e7bf9e188da9382f0bdbe8cc28c185bad60ce1963103ba0e4b15af3124", "sha256:9552861f674ad9a9ab6ff46e614c69c89f3071270a9e56a69c707850311daaca" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:15.476Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:228ff44b35f8ff4d413dce3cf8836ff6512af22fde043d390dcec467d9eeeed5", "sha256:c6f6684f9ae4dc567532db2b10e31b356a2cabf09e38673175716c5e7786d4a8", "sha256:ff1d2952a7632e401bf8d986e783261a5eb9943f0c885548f72daf8d6e20ba31" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:8a497cc7bccd043de45a004726a927cad73f3896b965eaae856e1fa0016490eb", "sha256:d0eacdefd7af4ec3420742545ad797efc7ef208c13f65de2de4ef1d667d94d74", "sha256:ee4ea1e6429eabd5ea9359eb3d59f38751dc2dca8ff0ab4284d9d879be32359b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:37.612Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/vercel/agent-readiness/vercel-rest-api/deployment-operations", "projection_digest": "sha256:067c54cc89ba4581463395948ef42812bb3c51600dbcf0f73ffde4a64543aca3" } } }