{
  "api_contract": "sourcey.catalog-api/v1",
  "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0",
  "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06",
  "data": {
    "revision_contract": "sourcey.agent-readiness-revision/v1alpha1",
    "agent_readiness_profile_id": "arp_01m0ewej9qyk04qypr2mvmwmh1",
    "entity_id": "ent_01kyh8fpe3xgjjktffez1t34rn",
    "scope": {
      "product": {
        "key": "github-enterprise-server-3-21",
        "name": "GitHub Enterprise Server 3.21"
      },
      "funnel": {
        "key": "repository-operations",
        "name": "Repository operations"
      }
    },
    "catalog_binding": {
      "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e",
      "entity_revision_digest": "sha256:984e9d33ce299c5093b358d8578a6892e03ca295907002f6ef6d3a48014088b2"
    },
    "declaration_revision_digest": "sha256:f80d143253c99b4aef0ea4f747461a772f76950176b5c97759cc7ddc798ecd8a",
    "declaration": {
      "declaration_id": "declaration_github_enterprise_server_repository_operations",
      "provenance": {
        "repository": "sourcey/agent-ready-services",
        "commit": "ca383f7867c18d91567fcb8326be55f7411d9554",
        "path": "entities/gi/github.yaml",
        "git_blob_oid": "0b83b40b4585fc06dea240cfbb0a011157466aca",
        "blob_digest": "sha256:0c09cbebf72bb36436c67e2fc1d2c4c20214f564b017b173073940560eeb8ff1"
      },
      "status": "community_declared"
    },
    "lifecycle": "active",
    "effective_from": "2026-09-06T08:47:58Z",
    "signals": [
      {
        "stage": "evaluate",
        "signal_code": "eligibility_decidability",
        "selector_group_id": "eligibility_decidability-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:51:35.937Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-combined-use"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:25b4c0e61508bcc24188aae8013b0389cba977e0a9cdf64aa2faae6a2b96f071",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
              "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-combined-use"
            },
            "locators": [
              {
                "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
                "start_byte": 10017,
                "end_byte": 10817,
                "value_digest": "sha256:0f9868a556869d8ba342063c329897fdc9f00d9ec04c600e1f1524ac81202ee6"
              },
              {
                "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
                "start_byte": 7630,
                "end_byte": 8426,
                "value_digest": "sha256:90573e2f34ff6e840f43386c71479fcc8d26d2d26f47d5cd99860cb7ae8c9539"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise Server combined use requires an enterprise account on GitHub Enterprise Cloud or contacting GitHub Sales to create one. For metered usage-based licensing, users must first be assigned to a GitHub Enterprise Cloud organization, and Server version 3.13+ with GitHub Connect is required."
      },
      {
        "stage": "evaluate",
        "signal_code": "pricing_decidability",
        "selector_group_id": "pricing_decidability-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:35.937Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-billing"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-combined-use"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-pricing"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:90484c2bb698649cb3afdb6923ed27c5747703b6cc91b017d45f14e5f676fcee",
              "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
              "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-combined-use"
            },
            "locators": [
              {
                "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
                "start_byte": 10017,
                "end_byte": 10817,
                "value_digest": "sha256:0f9868a556869d8ba342063c329897fdc9f00d9ec04c600e1f1524ac81202ee6"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:194238bc96b8e61e73bc1e1285e393ecde36c266c9c0a661848ca598285fca08",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:41b34d86ebec3b76d92b215f2ef01c4dc3759d8e85c72b9f883b8803366d56e2",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:6af8c8ba64ebe33d3350198cc2ea15e618e86309e590df0ddc13e38685eba312",
              "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-billing"
            },
            "locators": [
              {
                "artifact_digest": "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394",
                "start_byte": 0,
                "end_byte": 785,
                "value_digest": "sha256:7d9185ae9342a32bed3740e7b4c93bf9545bcb5d5069fef5efa8d3c81263e4b9"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise Server can be set up at no additional cost with an enterprise account. Under metered usage-based licensing, Cloud users automatically receive a right to use Server and billing is based on active monthly users."
      },
      {
        "stage": "evaluate",
        "signal_code": "service_discovery",
        "selector_group_id": "service_discovery-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:34.509Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-overview"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-rest"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4a11590075cf4e3046a2e82233928501ba6c386772c3c9e607344d4b3658208a",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65",
              "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-rest"
            },
            "locators": [
              {
                "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f",
                "start_byte": 16511,
                "end_byte": 17302,
                "value_digest": "sha256:0b92119d71979464ec7ec509b83ecec540de10f3fc34b14143f07e8421fceeee"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:b8f602fb7f4e30cf8882a00bd091beb92e627f0809d99b8bffd8f068a800b12b",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:7071fb2d371b4f89f2be06a8fa2de023fb5676465fecd12d4801cff0f6e1d97d",
              "sha256:aac056e74b8f6e493ea69f0ba305269b8bb763e49206768b70be758b1832be28"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8",
                "start_byte": 0,
                "end_byte": 797,
                "value_digest": "sha256:f0f45e8637e91992488d2a84b9d413d6532ea6ca9bc03b7bdf483e4816e6129f"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise Server and its REST API documentation are explicitly discoverable, including REST API overview and quickstart entrypoints."
      },
      {
        "stage": "evaluate",
        "signal_code": "structured_evaluation_discovery",
        "selector_group_id": "structured_evaluation_discovery-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:10.295Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-overview"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-rest"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:b8f602fb7f4e30cf8882a00bd091beb92e627f0809d99b8bffd8f068a800b12b",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:54e2ddc32d5f6f0ad555aaf5f447d04a2ffa21b400e54d881345b48216cb9180",
              "sha256:7071fb2d371b4f89f2be06a8fa2de023fb5676465fecd12d4801cff0f6e1d97d"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-overview"
            },
            "locators": [
              {
                "artifact_digest": "sha256:040a5cd1fe702ca84cdc09e1ecbc32b509e3b550032a2fca83fcbdcfbfadf9f8",
                "start_byte": 52865,
                "end_byte": 53663,
                "value_digest": "sha256:2b646eb2899e73b46f727784d83bc9d178826ce25548ae731049ec7a04091f54"
              }
            ]
          }
        ],
        "note": "Documentation explicitly states that the GitHub REST API is fully described in an OpenAPI compliant document."
      },
      {
        "stage": "evaluate",
        "signal_code": "terms_access",
        "selector_group_id": "terms_access-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:01.769Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-terms"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:cb1549df31e61674815032fdcbf9714b7c22bceb9822f271a2b55e5a464459dd",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:9ac6153eeaa180eabccfb197707d1a843a34a798acb2ab1d4a6eda78bfd08122",
              "sha256:f0a71675c8b95bd02fa5f079d8464619d2822e4ff47526a7c3399598688a366d"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-terms"
            },
            "locators": [
              {
                "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042",
                "start_byte": 12651,
                "end_byte": 13446,
                "value_digest": "sha256:2437eceedc60d78840c78f21b0f18a7db41b8c07928f6456dd6b2f3644d32803"
              },
              {
                "artifact_digest": "sha256:1e52a79d1f8a550c870fe881bafa24724c2acec14d52bb0d8429a7511dd5f042",
                "start_byte": 38259,
                "end_byte": 39055,
                "value_digest": "sha256:7a00637cecadc781e49decd903df62050324bfe1f277e937f142f8caec52f9f0"
              }
            ]
          }
        ],
        "note": "Applicable GitHub Terms of Service are stable, readable, and retrievable, covering Account Terms, Acceptable Use, Payment, and Supplemental Terms."
      },
      {
        "stage": "evaluate",
        "signal_code": "verified_web_agent_access",
        "selector_group_id": "verified_web_agent_access-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:50:01.386Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-overview"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-rest"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained documentation addresses API authentication methods and rate limits but does not declare a specific web agent access or crawler policy for the assessed resources."
      },
      {
        "stage": "sign_up",
        "signal_code": "access_control_operability",
        "selector_group_id": "access_control_operability-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:51:45.722Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-trial"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:276919b311eac6773a9d6fe97d9b97647c86130c3f5211a02cf8c3bf1db13679",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:4120ba1c59f6a9dffb8272919e2c98e80eb27c6d0a435815b1d9c4b390cdc398",
              "sha256:4971b68544a736457dbd1a2c5af572ff9efa33ab240a31418c4dc624d4db96c5",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:8968d89976232db8fcb194f1a1cda3f9e833e20fbe75c0ffb81971e4f6cc11c1",
              "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
              "sha256:b2b31774308b97296d39e06b523661636396867f5fc9b650a1d2baa6d5c12cd5"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-trial"
            },
            "locators": [
              {
                "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
                "start_byte": 53866,
                "end_byte": 54663,
                "value_digest": "sha256:992c1b83763f89dd6f1d610c6c63253cac562aa740bf4b6aefda1a10967d9309"
              },
              {
                "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
                "start_byte": 54664,
                "end_byte": 55464,
                "value_digest": "sha256:3c46686128f0aafc8bc8cc01b591938fa98c9f7944b6a1cdc7410b6bcbc541fb"
              }
            ]
          }
        ],
        "note": "Setting up a trial of GitHub Enterprise Server involves submitting a trial request, following prompts via an emailed link, downloading a license file, and uploading it to install the instance."
      },
      {
        "stage": "sign_up",
        "signal_code": "access_entrypoint_stability",
        "selector_group_id": "access_entrypoint_stability-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.722Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-trial"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:276919b311eac6773a9d6fe97d9b97647c86130c3f5211a02cf8c3bf1db13679",
                "capture_rung": "headless"
              }
            ],
            "artifact_digests": [
              "sha256:4120ba1c59f6a9dffb8272919e2c98e80eb27c6d0a435815b1d9c4b390cdc398",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:8968d89976232db8fcb194f1a1cda3f9e833e20fbe75c0ffb81971e4f6cc11c1",
              "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
              "sha256:b2b31774308b97296d39e06b523661636396867f5fc9b650a1d2baa6d5c12cd5",
              "sha256:ca4d7bdef289be5091a941f30e3d2e6d342cc075657462d064e7e427a32e9581"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-trial"
            },
            "locators": [
              {
                "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
                "start_byte": 48309,
                "end_byte": 49099,
                "value_digest": "sha256:e742bd2f2b605832d2b4742e78eca2073a5e0effc84c5eef18ffc44da9308372"
              },
              {
                "artifact_digest": "sha256:a3e33bc7e5f576e98b5d96c73ae21f12b425d12c31e0379cf0b9c82398c1a90d",
                "start_byte": 0,
                "end_byte": 781,
                "value_digest": "sha256:36c09294f879b71aa1e86963d5f84d980b0b0acb87d73f7f53341a31cb6d90d4"
              }
            ]
          }
        ],
        "note": "A stable canonical trial path is documented for setting up a trial of GitHub Enterprise Server, where users submit a trial request and complete installation."
      },
      {
        "stage": "sign_up",
        "signal_code": "captcha_compatible_access",
        "selector_group_id": "captcha_compatible_access-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:51:45.722Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-trial"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained evidence does not contain explicit first-party declarations or direct observations regarding CAPTCHA requirements or verified-agent alternatives."
      },
      {
        "stage": "sign_up",
        "signal_code": "delegated_identity_access",
        "selector_group_id": "delegated_identity_access-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:08.909Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:b5ad11e6c6a776a4feda588acfe543b20c5c49e3df33d3c41d8ea93fb6d7799f",
              "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
              "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 21768,
                "end_byte": 22568,
                "value_digest": "sha256:23c9393be2178b971b12748f8968600270406339f5709ca5236fd2442d6bdbd1"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:24cb763354edf851f3570178e581c1c365bd081708dca281d001d6e8cbc148bd",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:81c0b21b6bbf4f6e4ee11ca54c38176ed8e2d95ee8d6f4a0a2034ad4eab63cb1",
              "sha256:9cd014fb119c5ddf48114de223b6097501b4e49d5016c8e559e34219ce064afb",
              "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-token-lifecycle"
            },
            "locators": [
              {
                "artifact_digest": "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35",
                "start_byte": 12221,
                "end_byte": 13011,
                "value_digest": "sha256:70298c048ae1e08f673d2b2aa1abd92dbf108f951c6765b8a7dcfda72fc7df39"
              }
            ]
          }
        ],
        "note": "Scoped access tokens, fine-grained personal access tokens, GitHub App tokens, and OAuth tokens can be generated and authenticated against the REST API. Tokens can expire and can be revoked by the user or application."
      },
      {
        "stage": "sign_up",
        "signal_code": "phone_verification_compatible",
        "selector_group_id": "phone_verification_compatible-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:51:45.722Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-trial"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained evidence does not state whether phone verification is required, absent, or supported through a safe resumable boundary."
      },
      {
        "stage": "pay",
        "signal_code": "checkout_operability",
        "selector_group_id": "checkout_operability-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:50:05.099Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained evidence for GitHub Enterprise Server describes license acquisition and upgrades via GitHub's Sales team or downloading license files after order completion, but does not document an automated or protocol-driven checkout construction, handoff approval, and resumption flow."
      },
      {
        "stage": "pay",
        "signal_code": "commitment_disclosure",
        "selector_group_id": "commitment_disclosure-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:51:35.937Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-billing"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-combined-use"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-pricing"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:194238bc96b8e61e73bc1e1285e393ecde36c266c9c0a661848ca598285fca08",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:27469581b47af5bf46cdcd2a6c81bbe87c20e5e90c355bd8f4696fb0ffc522c8",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:6af8c8ba64ebe33d3350198cc2ea15e618e86309e590df0ddc13e38685eba312",
              "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-billing"
            },
            "locators": [
              {
                "artifact_digest": "sha256:c67d31cba278f8d994038e5f5d826756a8a1fa99963b29472cde8d217dfff394",
                "start_byte": 7332,
                "end_byte": 8132,
                "value_digest": "sha256:4e3861bd8462b622dad7684ea6881514dcf44f4bf2f9011a41b7caef4f3b1712"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:fbebc8d33eab76e5fcd69b7e58220d4780da19500d551da5ac1fca2adc067211",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:77a062d583b1cb2bf10429560ab64a1ef0a42400675cefd1c7c41ff72b9e5718",
              "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
              "sha256:b1076da450d01a652028cbc9242c76fdb86bce6533136e8dea954a85e37c25de"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-combined-use"
            },
            "locators": [
              {
                "artifact_digest": "sha256:af5d53799b181d6b281efca99db9bdd5dc5f3d3dbe2b7c2f1ba265584415c55d",
                "start_byte": 10818,
                "end_byte": 11612,
                "value_digest": "sha256:8d567765c373246a61aea796a562cd9192da1a22de4b245f7ba293333aa35d7d"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise billing documentation discloses usage-based (metered) and volume/subscription billing models, noting that usage-based billing is billed monthly based on active users, but volume agreements and specific commercial commitments require manual setup via GitHub Sales."
      },
      {
        "stage": "pay",
        "signal_code": "payment_authorization",
        "selector_group_id": "payment_authorization-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:50:05.099Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "The retained documentation notes that licenses are acquired or upgraded through GitHub's Sales team or generated via Enterprise account settings, but does not document a delegated payment authorization rail with explicit human-confirmed authority or receipts."
      },
      {
        "stage": "pay",
        "signal_code": "self_service_purchase",
        "selector_group_id": "self_service_purchase-primary",
        "value": "no",
        "observed_at": "2026-09-06T08:50:05.099Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-acquisition"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:ac3ec6e8758d40799c047ba2b882780ae4a1b1a52adedaccfec0eec46e5f9c65",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:b0c89bf9fc56c731b699a4b9b9a42a7401c3af022cf2f35fc0483ef2a2c6bb50",
              "sha256:be05c6fee9ceb4e8831aa693bed68b5857510e1e38e1c6a82c9e7a5e72436b70",
              "sha256:fd44756187d965a4442841f98217a1372e0b2db57190b85e31fc6c00d2ec830c"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-license-acquisition"
            },
            "locators": [
              {
                "artifact_digest": "sha256:be05c6fee9ceb4e8831aa693bed68b5857510e1e38e1c6a82c9e7a5e72436b70",
                "start_byte": 7322,
                "end_byte": 8121,
                "value_digest": "sha256:233bccb7a32ca123849fa9bf9f216bd4e6c8a49ab2257c5e07c31586e8372a4a"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise Server license documentation explicitly states that purchasing, renewing, adding user licenses, or upgrading requires contacting GitHub's Sales team."
      },
      {
        "stage": "provision",
        "signal_code": "access_material_delivery",
        "selector_group_id": "access_material_delivery-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:50:01.386Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:768cb4ce04ae25001799f4a684aa156480df25128912cd20cdd7c5b16f44f279",
              "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
              "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 21768,
                "end_byte": 22568,
                "value_digest": "sha256:23c9393be2178b971b12748f8968600270406339f5709ca5236fd2442d6bdbd1"
              },
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 26546,
                "end_byte": 27330,
                "value_digest": "sha256:02409c289d743e46dcce6071ac30935808935baa468bab680a8e28c1ccdb5ee3"
              }
            ]
          }
        ],
        "note": "GitHub Enterprise Server REST API authentication tokens can be generated (such as personal access tokens or GitHub App tokens) or created by app owners on an app settings page, where client IDs and client secrets are displayed and used to create access tokens."
      },
      {
        "stage": "provision",
        "signal_code": "provisioning_completion",
        "selector_group_id": "provisioning_completion-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:16.960Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-upload"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-repositories"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:6910530249700d705917a36b5275078df57a8fad06ef04691b38a62921ff5d6d",
              "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579",
              "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-repositories"
            },
            "locators": [
              {
                "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b",
                "start_byte": 36518,
                "end_byte": 37317,
                "value_digest": "sha256:3508e3b78eb69b14d8201c77c284402893b5e65b8a6ad98b656a158412690775"
              }
            ]
          }
        ],
        "note": "Creating an organization repository via the REST API returns a synchronous 201 Created HTTP response status code upon successful resource creation."
      },
      {
        "stage": "provision",
        "signal_code": "provisioning_operability",
        "selector_group_id": "provisioning_operability-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:16.960Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-license-upload"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-repositories"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:8d49e033275edc02f31b165cce3adecfeef1f528ffa24e5105afb84417ebdfea",
              "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579",
              "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-repositories"
            },
            "locators": [
              {
                "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b",
                "start_byte": 37318,
                "end_byte": 38118,
                "value_digest": "sha256:0e9267e5f0f1e867f42ac0fd32d09bfdd5a3d959f4529af5e1a09041cb6cf180"
              }
            ]
          }
        ],
        "note": "Repository creation can be triggered via a REST API POST request to /orgs/{org}/repos, which returns a 201 Created response containing the repository resource details."
      },
      {
        "stage": "operate",
        "signal_code": "agent_protocol_interface",
        "selector_group_id": "agent_protocol_interface-primary",
        "value": "unknown",
        "observed_at": "2026-09-06T08:50:34.509Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "enterprise-repository-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [],
        "note": "Current admissible evidence does not resolve an agent-native protocol interface such as MCP or A2A for the targets."
      },
      {
        "stage": "operate",
        "signal_code": "credential_lifecycle",
        "selector_group_id": "credential_lifecycle-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:50:08.909Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:24cb763354edf851f3570178e581c1c365bd081708dca281d001d6e8cbc148bd",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:81c0b21b6bbf4f6e4ee11ca54c38176ed8e2d95ee8d6f4a0a2034ad4eab63cb1",
              "sha256:9cd014fb119c5ddf48114de223b6097501b4e49d5016c8e559e34219ce064afb",
              "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-token-lifecycle"
            },
            "locators": [
              {
                "artifact_digest": "sha256:fcf9012a3bb5abcbc94407aa2bf43789b96814493ec7716dcb8ced19d4cb5d35",
                "start_byte": 12221,
                "end_byte": 13011,
                "value_digest": "sha256:70298c048ae1e08f673d2b2aa1abd92dbf108f951c6765b8a7dcfda72fc7df39"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:2700acb2e5ba89b2081a1ccd897c14b9c9e199e2ff885ab4169dacdbcbf5f254",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
              "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 22569,
                "end_byte": 23367,
                "value_digest": "sha256:0e0dd5796cf760104e36aab10e95f1f3a4469480e3086011d65576768ac22a0f"
              }
            ]
          }
        ],
        "note": "First-party documentation establishes that tokens can expire or be revoked, and access tokens created by a GitHub App expire after eight hours and can be regenerated using a refresh token. However, a full programmatically automated credential lifecycle covering compromise response and recovery without manual intervention is not fully established."
      },
      {
        "stage": "operate",
        "signal_code": "failure_contract",
        "selector_group_id": "failure_contract-primary",
        "value": "partial",
        "observed_at": "2026-09-06T08:50:38.888Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-errors"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
              "sha256:4c2d496977f43031d2a015357ea25e9e09651080c13bdf9a87106092b8f2bbdc",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
                "start_byte": 22166,
                "end_byte": 22960,
                "value_digest": "sha256:fdcf0c49d45c279ac96dc63a2f197159470b81a23082bd5407d853231c7dc8f5"
              },
              {
                "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
                "start_byte": 29354,
                "end_byte": 30152,
                "value_digest": "sha256:255f9620f5948562f9a2e7d828937ece86da301b567b112f5349385be3c61950"
              }
            ]
          }
        ],
        "note": "Documentation establishes rate limit error codes (403 Forbidden, 429 Too Many Requests), headers (retry-after, x-ratelimit-remaining, x-ratelimit-reset), retry guidelines with exponential backoff, and timeouts (terminated after 10 seconds). Full idempotency, cancellation, and reconciliation semantics across all operations remain partially documented."
      },
      {
        "stage": "operate",
        "signal_code": "operation_authentication",
        "selector_group_id": "operation_authentication-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:50:01.386Z",
        "tested_surfaces": [
          {
            "node_kind": "resource",
            "node_id": "enterprise-authentication"
          },
          {
            "node_kind": "resource",
            "node_id": "enterprise-token-lifecycle"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:042cb9601376aa89b499b120a1b2f9e58d3d04d5f037a8c974556bfeb072d379",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:2600991f10fb233231f4c113eb1cdae53423f73038d97539252fb8f93ffa08fa",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
              "sha256:bf32887c715414a16eee5d31ed439afd60b27595dd4c031a923d95480a2a9e9a"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-authentication"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 22569,
                "end_byte": 23367,
                "value_digest": "sha256:0e0dd5796cf760104e36aab10e95f1f3a4469480e3086011d65576768ac22a0f"
              },
              {
                "artifact_digest": "sha256:b8db55265839920b295c4c226028424099e6bf10a4671bc895dd7a8656efde75",
                "start_byte": 29718,
                "end_byte": 30515,
                "value_digest": "sha256:0619daf73ba96c77ab2c04ff73f1e9489afe694670b9125cedd1fbec40c0dad9"
              }
            ]
          }
        ],
        "note": "Request-time authentication to the REST API is documented and usable via the Authorization header using Bearer tokens (including GitHub Actions GH_TOKEN) or fine-grained tokens with explicit scoped permissions."
      },
      {
        "stage": "operate",
        "signal_code": "operation_contract",
        "selector_group_id": "operation_contract-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.577Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "enterprise-repository-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:19dff18331d755458d3ad939c643ed506031e55bbd0b0030cebc92497b61abd1",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65",
              "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-rest"
            },
            "locators": [
              {
                "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f",
                "start_byte": 21266,
                "end_byte": 22068,
                "value_digest": "sha256:7a08dc344f3e49d82ff261fc7132ed173b41a81a67d30f45ed5704baee833e02"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:3a63a63651a4b701989d19e579cb47a0af50e1bb53c8dab359fc7e7a0ad8ee13",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1dedfcfd452db8373f88f8e5a935248c2ef306df86cb34285a46c6a8b446773c",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:7c0eb0c607825e8354fdde957317e910a1ca79e4b4d968e39c5898eb3f5bbc25",
              "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-limits"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53",
                "start_byte": 22453,
                "end_byte": 23187,
                "value_digest": "sha256:1cf69eb23c4aaf01f531bda160e4f7fb6f14967f473e9b63bce2385563cc05e3"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9",
              "sha256:97f4ab1b8e6857e0e774f9f0ada8b39287f059b5b7d56308462a18fd95accad2"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
                "start_byte": 31746,
                "end_byte": 32544,
                "value_digest": "sha256:75f0efc2c15322eb8d5d56e9d79013debe13acc609db432e1c7f7f5e39084d33"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:8d49e033275edc02f31b165cce3adecfeef1f528ffa24e5105afb84417ebdfea",
              "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579",
              "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-repositories"
            },
            "locators": [
              {
                "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b",
                "start_byte": 37318,
                "end_byte": 38118,
                "value_digest": "sha256:0e9267e5f0f1e867f42ac0fd32d09bfdd5a3d959f4529af5e1a09041cb6cf180"
              }
            ]
          }
        ],
        "note": "Essential target endpoints and REST API operations have stable, readable request parameters, HTTP methods, response schemas, status codes, rate-limit point calculations, error formats, and documented OpenAPI description accessibility."
      },
      {
        "stage": "operate",
        "signal_code": "target_interface_access",
        "selector_group_id": "target_interface_access-primary",
        "value": "yes",
        "observed_at": "2026-09-06T08:51:45.577Z",
        "tested_surfaces": [
          {
            "node_kind": "interface",
            "node_id": "enterprise-repository-api"
          }
        ],
        "assessment_method": {
          "name": "public-semantic-assessment",
          "version": "2026-09-06",
          "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4"
        },
        "determination_bases": [
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:185759dda97b097d0cd586a51d63da8765b2a46a08bf2ad952910a0dd08087ed",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:72d2ea10df5883a0dfe370afc9a98d1688dce2db9197198dcfe662b04a86c2e9",
              "sha256:e9a670c3fd5c759853ec3bb947b6414d1223e8b78e9514abb1ed609adb585c06"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-errors"
            },
            "locators": [
              {
                "artifact_digest": "sha256:000451c3632133c83f25b5f1ce51ddfee467c94df8484c0e249ed443a009b9bd",
                "start_byte": 17455,
                "end_byte": 18248,
                "value_digest": "sha256:882edea84be04b487ba287f386156d8d720e25d77d26fc93f034f2f776a9c95d"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:3a63a63651a4b701989d19e579cb47a0af50e1bb53c8dab359fc7e7a0ad8ee13",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:1dedfcfd452db8373f88f8e5a935248c2ef306df86cb34285a46c6a8b446773c",
              "sha256:423671e71f4fa8a5bb3d018a3d2434eb85250f61ad027bf8f078707d09baade0",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-limits"
            },
            "locators": [
              {
                "artifact_digest": "sha256:b78be3392c1fa7964a87fb1ee30bb19f6a9d6d8a1de972f1d52eb90fce3a7d53",
                "start_byte": 16154,
                "end_byte": 16943,
                "value_digest": "sha256:184a1ecfe691a14b118b088966fd71a08a48c3d014593b1f71b1b444c090f534"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:0aa1e88de7ddf0127fd71b7d6eedfb4ecc9a39fe0ea1ee2c6979a3c8880d5470",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:263f3eb080e14c3c96a34eb4f8ebedd0f9934ba573d3a8ee411a17b20b131da0",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:76716c48f5b927d3f15bb2e9ad622addfbe27ef8bdc5dfcac06a675cf8945c65",
              "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-rest"
            },
            "locators": [
              {
                "artifact_digest": "sha256:8bdcdcc15cc3dc2d538a4079bfd74aa6ff29682ca92c12a61a33afe7aa292c4f",
                "start_byte": 0,
                "end_byte": 774,
                "value_digest": "sha256:02967728e02f0fa16496896521fcf0df9273089e117edec148f6af4884fcd397"
              }
            ]
          },
          {
            "kind": "explicit_first_party_declaration",
            "captures": [
              {
                "retained_capture_digest": "sha256:d72da62a7e62eb6512e4df1888109b6a7d9870f5e095454649b6be0059741093",
                "capture_rung": "http"
              }
            ],
            "artifact_digests": [
              "sha256:37349552a3f6fcce4ab4c2e8d569ce8f948866890226941076efe3f6c4d2d1c8",
              "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
              "sha256:a54660ae9f62120ad854543f3c989460c19850c55b0d8ce35e973e7532b3c579",
              "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b"
            ],
            "source_surface": {
              "node_kind": "resource",
              "node_id": "enterprise-repositories"
            },
            "locators": [
              {
                "artifact_digest": "sha256:e6f7376c2db4efb6878f4214c65e31a2cb7b2d63bfb135c3a8a1d8b99acc8d5b",
                "start_byte": 120322,
                "end_byte": 121119,
                "value_digest": "sha256:22810db28ee6d61e94e6da7aa88addf3aef92545b2092721bb72ca35eabeeab8"
              }
            ]
          }
        ],
        "note": "Every essential target documented across the REST API has a stable, usable machine interface alternative via documented HTTP REST endpoints."
      }
    ],
    "revision_digest": "sha256:cb882c0c88dcf753770efa06cc6a0e6fcc08500c8ed9546801124e3fa6078b6e"
  }
}