{
  "api_contract": "sourcey.catalog-api/v1",
  "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0",
  "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06",
  "data": {
    "revision_contract": "sourcey.agent-readiness-revision/v1alpha1",
    "agent_readiness_profile_id": "arp_01m08rqxyvw1151ymp6kaxfgcc",
    "entity_id": "ent_01kyh8jtf535570d9z2bng6j1t",
    "scope": {
      "product": {
        "key": "cloudflare-public-dns",
        "name": "Cloudflare 1.1.1.1 Public DNS"
      },
      "funnel": {
        "key": "dns-over-https-query",
        "name": "DNS over HTTPS query"
      }
    },
    "catalog_binding": {
      "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e",
      "entity_revision_digest": "sha256:cddeb11506db30b6ffb13fcff407b1931f123a1eb2cc8edf5ca023ba03c71100"
    },
    "declaration_revision_digest": "sha256:65bf30248c0a730476c82afd8471be2e33d54397a1e8a63b0e34d235315bed5f",
    "declaration": {
      "declaration_id": "declaration_cloudflare_public_dns_over_https",
      "provenance": {
        "repository": "sourcey/agent-ready-services",
        "commit": "ca383f7867c18d91567fcb8326be55f7411d9554",
        "path": "entities/cl/cloudflare.yaml",
        "git_blob_oid": "945a41470397eec65308a077818a125d882b4fb6",
        "blob_digest": "sha256:8f7c08b148f13ff27375b1eadb4dd67641c32716a13168bcf8468e3801bdcaf7"
      },
      "status": "community_declared"
    },
    "lifecycle": "active",
    "effective_from": "2026-09-06T08:47:58Z",
    "signals": [
      {
        "stage": "evaluate",
        "signal_code": "eligibility_decidability",
        "selector_group_id": "eligibility_decidability-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:23.426Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac15f97e8fd9445cbde2fe06ab8e24e8f3f22f201755179042679fd45e70fe2f",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:109a0bbccec2bc7a379364697733d6dbbb8f3f8e2759aa30256b9edf3b3142b7",
              "sha256:673eaf8df5c6bc83c24de1c4d2da3acd33432d4a4c18e6a48fe27fe652bf23c9",
              "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
              "sha256:bc5d5a8be0a1705e30933c569f6868c567a9240dc7eb5fde8f5b311552b7b217"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "public-dns-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
                "start_byte": 9870,
                "end_byte": 10669,
                "value_digest": "sha256:8e7e7b3b908c2278eaacf81fc5c44983a7632fefbcfc58f568a08f414a534f7e"
              },
              {
                "artifact_digest": "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
                "start_byte": 9054,
                "end_byte": 9869,
                "value_digest": "sha256:a97676fe5a1508d0238fe028050e322a20175829b1d6326cf2f88c3654bd3432"
              }
            ]
          }
        ],
        "note": "Cloudflare 1.1.1.1 is Cloudflare's public DNS resolver available on all plans. Setting it up takes minutes and does not require any special software."
      },
      {
        "stage": "evaluate",
        "signal_code": "pricing_decidability",
        "selector_group_id": "pricing_decidability-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:23.426Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac15f97e8fd9445cbde2fe06ab8e24e8f3f22f201755179042679fd45e70fe2f",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:109a0bbccec2bc7a379364697733d6dbbb8f3f8e2759aa30256b9edf3b3142b7",
              "sha256:34ecd12389052884274a15f41c5734c02520928ffab90274ebe043caccf28437",
              "sha256:673eaf8df5c6bc83c24de1c4d2da3acd33432d4a4c18e6a48fe27fe652bf23c9",
              "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "public-dns-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
                "start_byte": 9870,
                "end_byte": 10669,
                "value_digest": "sha256:8e7e7b3b908c2278eaacf81fc5c44983a7632fefbcfc58f568a08f414a534f7e"
              }
            ]
          }
        ],
        "note": "Cloudflare explicitly declares that 1.1.1.1 is free."
      },
      {
        "stage": "evaluate",
        "signal_code": "service_discovery",
        "selector_group_id": "service_discovery-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "doh-reference"
          },
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:57db4350cf5dfeb2dc75dc436d8d6153da78f1194ba988cfcd86b5bb594c7e1c"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-reference"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10060,
                "end_byte": 10856,
                "value_digest": "sha256:53c66d17b6c439f6d3cbc3bfa80e3416443535e382981f97fc3ead21a2443306"
              }
            ]
          }
        ],
        "note": "Cloudflare's DNS over HTTPS (DoH) resolver endpoint is located at https://cloudflare-dns.com/dns-query and requires no authentication."
      },
      {
        "stage": "evaluate",
        "signal_code": "structured_evaluation_discovery",
        "selector_group_id": "structured_evaluation_discovery-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:23.426Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "doh-reference"
          },
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac15f97e8fd9445cbde2fe06ab8e24e8f3f22f201755179042679fd45e70fe2f",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:109a0bbccec2bc7a379364697733d6dbbb8f3f8e2759aa30256b9edf3b3142b7",
              "sha256:673eaf8df5c6bc83c24de1c4d2da3acd33432d4a4c18e6a48fe27fe652bf23c9",
              "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
              "sha256:ca7f573f48e577f9d7f1a9f81e6966e2b53df4f84eb6e8bea46d0d0cf09627d0"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "public-dns-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
                "start_byte": 8264,
                "end_byte": 9053,
                "value_digest": "sha256:119ff6e3687df3bea122fb9ebb6e515293851a233532043b03281aa6a967174f"
              }
            ]
          }
        ],
        "note": "A documentation index is explicitly available at https://developers.cloudflare.com/1.1.1.1/llms.txt to discover all available pages."
      },
      {
        "stage": "evaluate",
        "signal_code": "terms_access",
        "selector_group_id": "terms_access-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:58.297Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "public-dns-terms"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:1bbb29a32cef8321cd540c15744e5096b86a687da3d8ab9a773a9137da832221",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1a85cae032b6df6c7bfffa3b9eee84542877989b41d46d86a820715e1457a60f",
              "sha256:6c45ec5e814c4eceaf9ae4e6b8f26c65caaa7fc8c9be3acc67a045ac102a1957",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "public-dns-terms"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 3964,
                "end_byte": 4764,
                "value_digest": "sha256:94bff3842bcbd936614c23b62afdf18317fdfe7ff902d13ce8bcc56dc4193486"
              },
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "Cloudflare's Website and Online Services Terms of Use apply to publicly available Online Services, explicitly including the 1.1.1.1 Public DNS Resolver service."
      },
      {
        "stage": "evaluate",
        "signal_code": "verified_web_agent_access",
        "selector_group_id": "verified_web_agent_access-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "doh-reference"
          },
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained evidence does not provide explicit web agent access rules or directives such as robots.txt rules for the assessed service."
      },
      {
        "stage": "sign_up",
        "signal_code": "access_control_operability",
        "selector_group_id": "access_control_operability-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:37.784Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-access-bootstrap"
          },
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-operation-authentication"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac2c099c7a4ba429663d7e32fa71e73f9c942f44e8f517a260bc39edd22b2421",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:15853432469b8e98fcda3633fbda47e0154efba55bb30a527228d7169cd14109",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:a67aeaa63b05338a3314855b01ecbb6a705645e347776a71ff0b9ab422319ff2",
              "sha256:e163daed9a81485942124b5f26ebe2f416bc3d54477fed65863de6fd21ace1a6",
              "sha256:e739c465f45f1d7b99693e13c13d96197338d8e5aa0503d9a57e55d0a5e64b9d",
              "sha256:f45b58f49a5eca61e8f6de2f3b78e8334a71024e8d15ed23fa1c6d8594c2e850"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-operation-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:f45b58f49a5eca61e8f6de2f3b78e8334a71024e8d15ed23fa1c6d8594c2e850",
                "start_byte": 10868,
                "end_byte": 11665,
                "value_digest": "sha256:f8878c44ced7526f3237b6d06e0c5e39368bda51882dd1c13bcfcca7cb2d8c55"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:969a16011bb677b72734ca9a0bf93ab5ef7f6cbe30fd2ae69fbd5b1d78b95983",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:1d83b7dba5d0f912f4c943a79d0e8e96f9b3524715f8c48a5f0d9a235896d430",
              "sha256:42d7ffd57ce1df726c13710ea22f1c4903ff15d0d084c42bbd97c19546364a15",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0",
              "sha256:e1518371fced0b17554e22d7fb51a833b95e73f0cdbb1db92373457bf1d17680"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-access-bootstrap"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "Cloudflare 1.1.1.1 Public DNS is an Online Service publicly available without a subscription or account, and no authentication is required to send API requests over DoH."
      },
      {
        "stage": "sign_up",
        "signal_code": "access_entrypoint_stability",
        "selector_group_id": "access_entrypoint_stability-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:06.043Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-access-bootstrap"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:969a16011bb677b72734ca9a0bf93ab5ef7f6cbe30fd2ae69fbd5b1d78b95983",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:1d83b7dba5d0f912f4c943a79d0e8e96f9b3524715f8c48a5f0d9a235896d430",
              "sha256:42d7ffd57ce1df726c13710ea22f1c4903ff15d0d084c42bbd97c19546364a15",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0",
              "sha256:e1518371fced0b17554e22d7fb51a833b95e73f0cdbb1db92373457bf1d17680"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-access-bootstrap"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "Cloudflare Terms of Use explicitly state that 1.1.1.1 Public DNS Resolver is available without a subscription or a Cloudflare account, making sign up access entrypoints non-applicable."
      },
      {
        "stage": "sign_up",
        "signal_code": "captcha_compatible_access",
        "selector_group_id": "captcha_compatible_access-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:06.043Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-access-bootstrap"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:969a16011bb677b72734ca9a0bf93ab5ef7f6cbe30fd2ae69fbd5b1d78b95983",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:1d83b7dba5d0f912f4c943a79d0e8e96f9b3524715f8c48a5f0d9a235896d430",
              "sha256:42d7ffd57ce1df726c13710ea22f1c4903ff15d0d084c42bbd97c19546364a15",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0",
              "sha256:e1518371fced0b17554e22d7fb51a833b95e73f0cdbb1db92373457bf1d17680"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-access-bootstrap"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "Cloudflare 1.1.1.1 Public DNS is publicly available without requiring an account or subscription, so sign-up CAPTCHA boundaries do not apply."
      },
      {
        "stage": "sign_up",
        "signal_code": "delegated_identity_access",
        "selector_group_id": "delegated_identity_access-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-operation-authentication"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:f886e3144e29479375251afe44fc6df111d8287793fcb09a7a5bf113b9c2ccc0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-operation-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10857,
                "end_byte": 11654,
                "value_digest": "sha256:25fdd276f87744f11a54ece7eb60035f5ba67910733dd05cf439f22435ea80f0"
              }
            ]
          }
        ],
        "note": "Cloudflare explicitly states that no authentication is required to send requests to the 1.1.1.1 DoH API."
      },
      {
        "stage": "sign_up",
        "signal_code": "phone_verification_compatible",
        "selector_group_id": "phone_verification_compatible-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:06.043Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-access-bootstrap"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:969a16011bb677b72734ca9a0bf93ab5ef7f6cbe30fd2ae69fbd5b1d78b95983",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:1d83b7dba5d0f912f4c943a79d0e8e96f9b3524715f8c48a5f0d9a235896d430",
              "sha256:42d7ffd57ce1df726c13710ea22f1c4903ff15d0d084c42bbd97c19546364a15",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0",
              "sha256:e1518371fced0b17554e22d7fb51a833b95e73f0cdbb1db92373457bf1d17680"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-access-bootstrap"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "Cloudflare 1.1.1.1 Public DNS is accessible without an account or subscription, making sign-up phone verification non-applicable."
      },
      {
        "stage": "pay",
        "signal_code": "checkout_operability",
        "selector_group_id": "checkout_operability-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:58.297Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-checkout-step"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:1bbb29a32cef8321cd540c15744e5096b86a687da3d8ab9a773a9137da832221",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:6c45ec5e814c4eceaf9ae4e6b8f26c65caaa7fc8c9be3acc67a045ac102a1957",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-checkout-step"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "The Cloudflare Terms of Use explicitly state that 1.1.1.1 Public DNS Resolver is an Online Service publicly available without a subscription or a Cloudflare account."
      },
      {
        "stage": "pay",
        "signal_code": "commitment_disclosure",
        "selector_group_id": "commitment_disclosure-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:23.426Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "public-dns-overview"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac15f97e8fd9445cbde2fe06ab8e24e8f3f22f201755179042679fd45e70fe2f",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:109a0bbccec2bc7a379364697733d6dbbb8f3f8e2759aa30256b9edf3b3142b7",
              "sha256:34ecd12389052884274a15f41c5734c02520928ffab90274ebe043caccf28437",
              "sha256:673eaf8df5c6bc83c24de1c4d2da3acd33432d4a4c18e6a48fe27fe652bf23c9",
              "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "public-dns-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:98149780ff64e0e8eec28536579ec38be4636d724723ef0911ff303ef456eded",
                "start_byte": 9870,
                "end_byte": 10669,
                "value_digest": "sha256:8e7e7b3b908c2278eaacf81fc5c44983a7632fefbcfc58f568a08f414a534f7e"
              }
            ]
          }
        ],
        "note": "Documentation explicitly declares that 1.1.1.1 is free, takes minutes to set up, and does not require any special software."
      },
      {
        "stage": "pay",
        "signal_code": "payment_authorization",
        "selector_group_id": "payment_authorization-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:58.297Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-checkout-step"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:1bbb29a32cef8321cd540c15744e5096b86a687da3d8ab9a773a9137da832221",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:3c1f003217ba7da29cea6be24d99546dcfe14cc1cec6f38819d3d67e7e0296b0",
              "sha256:6c45ec5e814c4eceaf9ae4e6b8f26c65caaa7fc8c9be3acc67a045ac102a1957",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-checkout-step"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 10380,
                "end_byte": 11184,
                "value_digest": "sha256:bfe3af35084b3ca847d383c0c07798834ae1db37c52bd59fa215a746308dfcf7"
              }
            ]
          }
        ],
        "note": "The Cloudflare Terms of Use explicitly state that 1.1.1.1 Public DNS Resolver is an Online Service publicly available without a subscription or account, so payment authorization does not apply."
      },
      {
        "stage": "pay",
        "signal_code": "self_service_purchase",
        "selector_group_id": "self_service_purchase-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:58.297Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-checkout-step"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:1bbb29a32cef8321cd540c15744e5096b86a687da3d8ab9a773a9137da832221",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:6c45ec5e814c4eceaf9ae4e6b8f26c65caaa7fc8c9be3acc67a045ac102a1957",
              "sha256:7efe682f409c95be9ac1a7d752e5807766d3afd61df13ff941570abe707597e1",
              "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
              "sha256:d740c266d6091292b036b60ec75b1f21c0157ca022a9697e5548c3bef0e687e0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-checkout-step"
            },
            "locators": [
              {
                "artifact_digest": "sha256:86aa71aa4ebc810bf819188d5a3eb280b3c8e0f82029c4ba6310f3cac5dac0e3",
                "start_byte": 4765,
                "end_byte": 5580,
                "value_digest": "sha256:f9b13ad7e475b189f91389ede716f30da710d20705af95bac03e8f820f8a4402"
              }
            ]
          }
        ],
        "note": "The Cloudflare Terms of Use explicitly state that 1.1.1.1 Public DNS Resolver is an Online Service publicly available without a subscription or a Cloudflare account."
      },
      {
        "stage": "provision",
        "signal_code": "access_material_delivery",
        "selector_group_id": "access_material_delivery-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-operation-authentication"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:f886e3144e29479375251afe44fc6df111d8287793fcb09a7a5bf113b9c2ccc0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-operation-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10857,
                "end_byte": 11654,
                "value_digest": "sha256:25fdd276f87744f11a54ece7eb60035f5ba67910733dd05cf439f22435ea80f0"
              }
            ]
          }
        ],
        "note": "Cloudflare's documentation explicitly states that no authentication is required to send requests to the DNS over HTTPS API."
      },
      {
        "stage": "provision",
        "signal_code": "provisioning_completion",
        "selector_group_id": "provisioning_completion-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-provisioning-step"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:f886e3144e29479375251afe44fc6df111d8287793fcb09a7a5bf113b9c2ccc0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-provisioning-step"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10857,
                "end_byte": 11654,
                "value_digest": "sha256:25fdd276f87744f11a54ece7eb60035f5ba67910733dd05cf439f22435ea80f0"
              }
            ]
          }
        ],
        "note": "Documentation states that no authentication is required to send requests to this API, establishing that provisioning does not apply to this public DNS over HTTPS query endpoint."
      },
      {
        "stage": "provision",
        "signal_code": "provisioning_operability",
        "selector_group_id": "provisioning_operability-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:01.791Z",
        "tested_surfaces": [
          {
            "node_kind": "endpoint",
            "node_id": "doh-endpoint"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0b211c50cee7bbf2f9a4dc71594c4c8df159522287d956a0aa8706e7e802ad09",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:0e1c476feb821a63ed4dda799c8147211ffd9ad42be48b33e7bb70ee5f5ba6f0",
              "sha256:1041f8c6d224b09653dccae534450ab5507e60ec2c61c4e193aa85cc290a9ea1",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:9c1bc85e4a003c926a32e0b521527a27e00ce262b6553a3a09c3e6b5be6cba1e"
            ],
            "source_surface": {
              "node_kind": "endpoint",
              "node_id": "doh-endpoint"
            },
            "locators": [
              {
                "artifact_digest": "sha256:9c1bc85e4a003c926a32e0b521527a27e00ce262b6553a3a09c3e6b5be6cba1e",
                "start_byte": 0,
                "end_byte": 250,
                "value_digest": "sha256:2e8bdb9215b998b084bcba2503f52c5abb4c64bee5741ad6a1ba619e78e5c2e5"
              }
            ]
          }
        ],
        "note": "The public DNS over HTTPS query endpoint responds directly without requiring a prior provisioning procedure."
      },
      {
        "stage": "operate",
        "signal_code": "agent_protocol_interface",
        "selector_group_id": "agent_protocol_interface-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:51:45.033Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "doh-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Cloudflare 1.1.1.1 Public DNS; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets."
      },
      {
        "stage": "operate",
        "signal_code": "credential_lifecycle",
        "selector_group_id": "credential_lifecycle-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-operation-authentication"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:f886e3144e29479375251afe44fc6df111d8287793fcb09a7a5bf113b9c2ccc0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-operation-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10857,
                "end_byte": 11654,
                "value_digest": "sha256:25fdd276f87744f11a54ece7eb60035f5ba67910733dd05cf439f22435ea80f0"
              }
            ]
          }
        ],
        "note": "Documentation explicitly declares that no authentication is required to send requests to the 1.1.1.1 DoH API, making credential lifecycle management not applicable."
      },
      {
        "stage": "operate",
        "signal_code": "failure_contract",
        "selector_group_id": "failure_contract-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.033Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "doh-json-contract"
          },
          {
            "node_kind": "resource",
            "node_id": "extended-errors"
          },
          {
            "node_kind": "resource",
            "node_id": "upstream-resolution"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:77ac2744fd689882848816d8ea64549efc21c39e5c716e6148ee25bace738310",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:c707420613ed53b9d354cec37e2ba6950cde7d432fe57539141346268c0735f4",
              "sha256:cdbd38c13928a07c811be242793df7acaffeffd354134884b60a93fa3e8a7c6b",
              "sha256:f43ed47b543c11ac5c01d7ccc16a812f10aebddb521c7a882fddd238b1a19540",
              "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "upstream-resolution"
            },
            "locators": [
              {
                "artifact_digest": "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f",
                "start_byte": 11938,
                "end_byte": 12270,
                "value_digest": "sha256:9a6672b90ec08f2abf12810585b3092c4420bb8de5fdfc6b18bed2a7ae8ddba8"
              },
              {
                "artifact_digest": "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f",
                "start_byte": 13916,
                "end_byte": 14088,
                "value_digest": "sha256:972a6d335176333c4a1907ddf1f0e39426c2a4dbb51c1ca37faa099745cf09c0"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:9dd68a3565ea5415765a3bd6be587e79821455071b69c8ea8950189bfd784bdf",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:22c0aa9d3ad4d493eccc8a0a75b283dac84cda4bb8ab2776e76c7bbb20102d6e",
              "sha256:6158813b0004259ed7f20c7463cbf60f4e89e9f15b5bd930bfd7ef3589778b3e",
              "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
              "sha256:c60f37e3faaef60ad8a0d1806444b1d1dcdaa0b2a0888dda867ebd3e9f2357fc"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-json-contract"
            },
            "locators": [
              {
                "artifact_digest": "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
                "start_byte": 12436,
                "end_byte": 12478,
                "value_digest": "sha256:87dcaf6ca61bce992b9689d77ba1c61bf9b12f9a661f9d8944915c987a687ac9"
              },
              {
                "artifact_digest": "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
                "start_byte": 14979,
                "end_byte": 15060,
                "value_digest": "sha256:95ed1feb3344026ea6285fe10b98ea5b7584aa3a4a452cd46eb38a786d0d5b91"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0191811a554056886cb63f6864fabac767fee7225fbd1966f6bbdc903812b263",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:089a423bf8efc8ce84ec819dc86238a4f49a8eb9b0bd2295b5011bec32c1a30e",
              "sha256:0d061e69967fa57f1d9ad87f2276b0c87218f412fe476fd508bc19f8d24af67f",
              "sha256:4aa46e85a076dc10d4d12dac82b4d1df9eb8c960f2d7f8d93a25a702ec76f2ba",
              "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "extended-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a",
                "start_byte": 10613,
                "end_byte": 10941,
                "value_digest": "sha256:f61bf2929bc651e83ede70af6689d88c3e1dbd8bb24035df09660f82093bfed0"
              }
            ]
          }
        ],
        "note": "1.1.1.1 documents the failure contract that applies to a stateless read-only resolver query: the JSON error response and DNS Status code, Extended DNS Error codes with their meaning and next steps, and the retry behaviour that returns SERVFAIL or REFUSED to the client only when every authoritative nameserver failed. Idempotency, cancellation and reconciliation semantics concern stateful operations and do not apply to a read-only query."
      },
      {
        "stage": "operate",
        "signal_code": "operation_authentication",
        "selector_group_id": "operation_authentication-primary",
        "value": "not_applicable",
        "observed_at": "2026-09-06T08:51:35.415Z",
        "tested_surfaces": [
          {
            "node_kind": "surface_exclusion",
            "node_id": "no-operation-authentication"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:f886e3144e29479375251afe44fc6df111d8287793fcb09a7a5bf113b9c2ccc0"
            ],
            "source_surface": {
              "node_kind": "surface_exclusion",
              "node_id": "no-operation-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10857,
                "end_byte": 11654,
                "value_digest": "sha256:25fdd276f87744f11a54ece7eb60035f5ba67910733dd05cf439f22435ea80f0"
              }
            ]
          }
        ],
        "note": "Documentation explicitly states that no authentication is required to send requests to the 1.1.1.1 DoH API."
      },
      {
        "stage": "operate",
        "signal_code": "operation_contract",
        "selector_group_id": "operation_contract-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.033Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "doh-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:9dd68a3565ea5415765a3bd6be587e79821455071b69c8ea8950189bfd784bdf",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:22c0aa9d3ad4d493eccc8a0a75b283dac84cda4bb8ab2776e76c7bbb20102d6e",
              "sha256:5100d45a6cd64384d959ba0e8ba301bc787adc950bdcf7d0a9d248879ad10b81",
              "sha256:6158813b0004259ed7f20c7463cbf60f4e89e9f15b5bd930bfd7ef3589778b3e",
              "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-json-contract"
            },
            "locators": [
              {
                "artifact_digest": "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
                "start_byte": 11289,
                "end_byte": 12083,
                "value_digest": "sha256:3ad7aa73fab81e6370f99557b7d198c490343284256767db74f38ed62214a3a5"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:57db4350cf5dfeb2dc75dc436d8d6153da78f1194ba988cfcd86b5bb594c7e1c"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-reference"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10060,
                "end_byte": 10856,
                "value_digest": "sha256:53c66d17b6c439f6d3cbc3bfa80e3416443535e382981f97fc3ead21a2443306"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0191811a554056886cb63f6864fabac767fee7225fbd1966f6bbdc903812b263",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:089a423bf8efc8ce84ec819dc86238a4f49a8eb9b0bd2295b5011bec32c1a30e",
              "sha256:0d061e69967fa57f1d9ad87f2276b0c87218f412fe476fd508bc19f8d24af67f",
              "sha256:3a096131d3bd82d5d318663145c81cca67c909f49b4a968a7ef04e60db602f43",
              "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "extended-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a",
                "start_byte": 10561,
                "end_byte": 11360,
                "value_digest": "sha256:18e93aa3188a3ce63ffa1843d0f2c06fea8e5e8f7c24bbb2ac372d173cae7ef7"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:77ac2744fd689882848816d8ea64549efc21c39e5c716e6148ee25bace738310",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:73498cb2beddbd607359b0b0d959c8b97f50d0a49357c060fd98450d679e797f",
              "sha256:cdbd38c13928a07c811be242793df7acaffeffd354134884b60a93fa3e8a7c6b",
              "sha256:f43ed47b543c11ac5c01d7ccc16a812f10aebddb521c7a882fddd238b1a19540",
              "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "upstream-resolution"
            },
            "locators": [
              {
                "artifact_digest": "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f",
                "start_byte": 9897,
                "end_byte": 10696,
                "value_digest": "sha256:2fedd0562e970b0a32b032eecf618e654775118a0f5c03bf1b0bde5977105eba"
              }
            ]
          }
        ],
        "note": "The essential DoH targets have stable and decidable request parameters, MIME types, GET/POST methods, response JSON schemas/wireformats, extended error codes, and upstream resolution behavior clearly documented."
      },
      {
        "stage": "operate",
        "signal_code": "target_interface_access",
        "selector_group_id": "target_interface_access-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.033Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "doh-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0191811a554056886cb63f6864fabac767fee7225fbd1966f6bbdc903812b263",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:089a423bf8efc8ce84ec819dc86238a4f49a8eb9b0bd2295b5011bec32c1a30e",
              "sha256:0d061e69967fa57f1d9ad87f2276b0c87218f412fe476fd508bc19f8d24af67f",
              "sha256:0da425c96137448a51fd9d685d061f64ca4fcd9c4445024fca13fdcb39e500ec",
              "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "extended-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b72c0acab99ab10f50818d05f2f16a267c483ff97634fc1d14e4088f1add262a",
                "start_byte": 12155,
                "end_byte": 12951,
                "value_digest": "sha256:cc76ec2a66104cde5c06ebac59730d7cec5457e86e48e6bfd23715c71c8f518e"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:4d4d7b2c1080a10856806a552eaa79b1cbb5ba59db0d9e252ce98441b538be82",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1956c9a5145cb53ff4a76397618c4ac375610113ada80051e8955328c8e7e642",
              "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
              "sha256:56402c0e12997bbac9b4889239e01bf59c60e25ff3726b537a31aac237e683e3",
              "sha256:57db4350cf5dfeb2dc75dc436d8d6153da78f1194ba988cfcd86b5bb594c7e1c"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-reference"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1a0c864ead5297a948190b0f1c5f570af0d66dfb362e23aacf09344782c6cfe3",
                "start_byte": 10060,
                "end_byte": 10856,
                "value_digest": "sha256:53c66d17b6c439f6d3cbc3bfa80e3416443535e382981f97fc3ead21a2443306"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:9dd68a3565ea5415765a3bd6be587e79821455071b69c8ea8950189bfd784bdf",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:22c0aa9d3ad4d493eccc8a0a75b283dac84cda4bb8ab2776e76c7bbb20102d6e",
              "sha256:6158813b0004259ed7f20c7463cbf60f4e89e9f15b5bd930bfd7ef3589778b3e",
              "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
              "sha256:ef1c408053e6b5381d7d8cd2426d0e57a65f0491ec402f6fa642cccef2985a2b"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "doh-json-contract"
            },
            "locators": [
              {
                "artifact_digest": "sha256:c586fca2f6a22d97f83878100bddac0d425f76ce96a213faefbc247fc792c4cf",
                "start_byte": 10538,
                "end_byte": 11288,
                "value_digest": "sha256:cdd6f45ec997155a571170bc24d40217d65869c1ad553c154c3ab2c94170eb36"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:77ac2744fd689882848816d8ea64549efc21c39e5c716e6148ee25bace738310",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:2ad303d3b0180c2d2e5a10ef94c5a40f30e26a12f8169deddbca653c906c72d4",
              "sha256:cdbd38c13928a07c811be242793df7acaffeffd354134884b60a93fa3e8a7c6b",
              "sha256:f43ed47b543c11ac5c01d7ccc16a812f10aebddb521c7a882fddd238b1a19540",
              "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "upstream-resolution"
            },
            "locators": [
              {
                "artifact_digest": "sha256:fba42eaa35a58732108546661d3d415d596959fbaa756395e4af62109181b47f",
                "start_byte": 9080,
                "end_byte": 9896,
                "value_digest": "sha256:56a78fc1ae483ff0eef369d760efcb83335a088bf2c64ccbd57859535aa3d05f"
              }
            ]
          }
        ],
        "note": "All essential targets are accessible and executable via usable HTTP endpoints (`https://cloudflare-dns.com/dns-query` and `https://one.one.one.one/dns-query`) using standard JSON or DNS wireformat interfaces."
      }
    ],
    "revision_digest": "sha256:bb60075bc7f861d12d3036e87a62c90ecf7af6d7385cdba7c530785e0ded6100"
  }
}