# Spala Post-Hardening Fresh-Agent Retest

Generated: 2026-07-10

Status: start/pricing improved; MCP handoff stable; project-auth proof still pending.

## Boundary

This is a two-scope retest after the pricing and MCP profile hardening. It is not a broad 20-agent pass, not Search Console proof, not production trust parity, and not OAuth-complete project MCP proof.

## Summary

| Scope | Before | After | Result |
| --- | ---: | ---: | --- |
| Onboarding/start/pay/create | 6/10 | 8/10 | Agent understood Spala, dashboard signup, project creation, pricing tiers, and service-led pricing clarification. |
| MCP handoff | 8/10 | 8/10 | Agent understood public MCP entrypoint, public/project MCP boundary, auth requirement, and exact returned project MCP URL rule. |

Average score after hardening: 8/10.

## Remaining Gaps

Onboarding/start/pay/create:

- Exact checkout flow for the current account remains account/owner-specific.
- Accepted payment methods, billing currency, taxes, renewal, cancellation, refund, upgrade/downgrade, overages, quotas, and support tier still require confirmation.
- Payment timing relative to publish or managed-build work still requires account-specific confirmation.
- Project-specific proof still requires a live project API base URL, generated docs/OpenAPI, Playground test, CORS origin setup, and auth/session behavior.

MCP handoff:

- No live `project_select` response body was verified from public pages.
- Exact auth-failure payload/string was not verified from a live unauthenticated project-tool call in the retest.
- `api.spala.ai/mcp` legacy alias/redirect behavior was not confirmed; public guidance correctly says the public MCP is `https://mcp.spala.ai/mcp`.

## Verified Hardening Pages

- Pricing: https://spala.ai/pricing/
- MCP profile: https://spala.ai/mcp-profile/
- Public indexability check: https://spala.ai/public-indexability-check-2026-07-10.json

## Next Owner Or Authenticated Actions

- Capture a redacted OAuth/project_select/project_get_mcp_manifest transcript from a real test account.
- Publish current billing/checkout mechanics if Spala wants agents to answer payment flow questions without caveats.
- Publish owner-approved DPA/subprocessors/SLA/quotas/backup-restore/cancellation-refund/compliance details if procurement-grade trust answers are desired.

Machine-readable JSON: https://spala.ai/agent-evals/public-audit-batch-2026-07-10-post-hardening-retest.json