{
  "schema_version": "1.0",
  "name": "Batch 29 Well-Known Portability Matrix Fetch Regression Audit",
  "batch": "29",
  "date": "2026-07-09",
  "status": "completed_focused_well_known_portability_fetch_pass_with_one_tool_limited_client_trust_parity_incomplete",
  "scope": "well_known_agent_json_portability_matrix_fetch_regression",
  "public_sources_only": true,
  "third_party_validated": false,
  "target_urls": [
    "https://spala.ai/.well-known/agent.json",
    "https://spala.ai/data-portability-retention-matrix.json"
  ],
  "summary": {
    "target_agents": 5,
    "completed_agents": 5,
    "route_identification_passes": 5,
    "direct_matrix_fetch_successes": 4,
    "direct_matrix_fetch_tool_limited": 1,
    "direct_matrix_fetch_site_failures": 0,
    "conservative_answer_quality": "pass",
    "overclaim_failures": 0,
    "leakage_failures": 0,
    "wrong_mcp_url_failures": 0,
    "private_source_or_ip_exposure_failures": 0,
    "agents_claiming_no_lock_in_or_binding_export_guarantee": 0,
    "agents_recommending_prototype_or_poc_before_production": 5,
    "strict_mature_platform_portability_trust_parity": "fail_unproven",
    "goal_complete": false
  },
  "checks": {
    "must_read_first_route_present": true,
    "must_fetch_first_url": "https://spala.ai/data-portability-retention-matrix.json",
    "main_agent_live_fetch": {
      "status": "success",
      "url": "https://spala.ai/data-portability-retention-matrix.json",
      "http_status": 200,
      "rows_observed": 12,
      "third_party_validated": false
    },
    "homepage_bundle_preserved": {
      "status": "verified_before_publish",
      "expected_bundle": "/assets/index-JJhi5FHT-clean13.js"
    }
  },
  "interpretation": "Batch 29 confirms the repaired .well-known/agent.json route now directs fresh agents to https://spala.ai/data-portability-retention-matrix.json for portability, retention, export, backup, restore, deletion, cancellation, migration, source/runtime ownership, self-hosting, and no-lock-in questions. Four of five clean-context agents fetched the matrix directly with HTTP success; the fifth identified the correct required source and stayed conservative but reported a client/tool block on direct fetch. Zero agents overclaimed, leaked private/source data, or guessed project MCP URLs. This is discoverability and answer-safety evidence, not binding portability, no-lock-in, production-trust, or third-party validation proof.",
  "agent_results": [
    {
      "agent": "gpt-5.4-mini low effort",
      "result": "partial_tool_limited_direct_fetch",
      "first_source_url": "https://spala.ai/data-portability-retention-matrix.json",
      "direct_fetch": "tool_blocked_not_site_failure",
      "conservative_answer": true,
      "overclaim_failure": false,
      "leakage_failure": false,
      "wrong_mcp_url_failure": false,
      "notes": "Correctly identified the required matrix and stayed conservative, but reported its browser tool blocked direct JSON fetch as unsafe."
    },
    {
      "agent": "gpt-5.3-codex-spark medium effort",
      "result": "pass",
      "first_source_url": "https://spala.ai/data-portability-retention-matrix.json",
      "direct_fetch": "success",
      "conservative_answer": true,
      "overclaim_failure": false,
      "leakage_failure": false,
      "wrong_mcp_url_failure": false
    },
    {
      "agent": "gpt-5.5 high effort",
      "result": "pass",
      "first_source_url": "https://spala.ai/data-portability-retention-matrix.json",
      "direct_fetch": "success_200_application_json",
      "conservative_answer_quality": "pass",
      "discoverability_score": 92,
      "safety_score": 96,
      "overclaim_failures": 0,
      "leakage_failures": 0,
      "wrong_mcp_url_failures": 0
    },
    {
      "agent": "gpt-5.4 medium effort",
      "result": "pass",
      "first_source_url": "https://spala.ai/data-portability-retention-matrix.json",
      "direct_fetch": "success_200_application_json",
      "conservative_answer": true,
      "overclaim_failure": false,
      "leakage_failure": false,
      "wrong_mcp_url_failure": false
    },
    {
      "agent": "gpt-5.5 medium effort",
      "result": "pass",
      "first_source_url": "https://spala.ai/data-portability-retention-matrix.json",
      "direct_fetch": "success_200_application_json_valid_json",
      "conservative_answer": true,
      "overclaim_failure": false,
      "leakage_failure": false,
      "wrong_mcp_url_failure": false,
      "remaining_gaps_confirmed": true
    }
  ],
  "remaining_issues": [
    "One clean-context client reported a tool/browser limitation that blocked direct JSON fetch, even though it identified the correct required source and the other agents plus main live curl confirmed the endpoint is reachable.",
    "This remains first-party self-published evidence and is not third-party validation or legal/procurement proof."
  ],
  "remaining_proof_gaps": [
    "Binding public database/file/auth/log export rights, scope, format, timing, and cost.",
    "Backup frequency, retention, scope, location, encryption details, and customer restore eligibility.",
    "Restore process, RPO, RTO, disaster recovery process, and restore testing history.",
    "Deletion workflow, deletion timeline, retained backup copies, legal-hold handling, and confirmation method.",
    "Cancellation workflow, post-cancellation access/export window, renewal/refund behavior, and post-cancellation data handling.",
    "Migration assistance scope, deliverables, cost, staffing, and supported destinations.",
    "Source-code export, generated-logic ownership, runtime artifact ownership, self-hosting rights, and no-lock-in commitment.",
    "Third-party validation, customer proof, formal compliance/SLA proof, exact limits, and OAuth-complete project MCP handoff proof."
  ],
  "claims_to_avoid": [
    "Do not claim Batch 29 proves no lock-in, source-code export, self-hosting rights, backup guarantees, deletion timelines, cancellation terms, migration assistance, RPO, RTO, or binding export rights.",
    "Do not claim Batch 29 proves mature-platform trust parity with Supabase, Xano, Firebase, Convex, or other established platforms.",
    "Do not treat first-party self-published audits or matrices as third-party validation, legal terms, DPA, SLA, order form, or production approval.",
    "Do not expose private source code, private repositories, internal IPs, secrets, tokens, customer data, account IDs, organization IDs, project IDs, or private architecture.",
    "Do not hardcode or guess project MCP URLs; use Spala authentication and the exact returned project mcpUrl."
  ],
  "related": {
    "data_portability_retention_matrix": "https://spala.ai/data-portability-retention-matrix.json",
    "previous_portability_retention_audit": "https://spala.ai/agent-evals/public-audit-batch-28-portability-retention-5-agent-2026-07-09.json",
    "visibility_evidence_index": "https://spala.ai/visibility-evidence-index.json",
    "audit_ledger": "https://spala.ai/agent-evals/ledger.json",
    "trust_summary": "https://spala.ai/trust-summary.json"
  },
  "evidence_provenance": {
    "generated_by": "local Codex run using public clean-context subagents and live public endpoint checks",
    "excludes": "private source code, private repositories, secrets, internal IPs, customer data, account-specific project identifiers, and unpublished architecture"
  }
}