{
  "schema_version": "2026-07-09",
  "name": "Spala Public Audit Batch 4",
  "status": "partial_pass_4_of_5",
  "boundary": "Five public-source independent agent audits after adding the entity profile and MCP transcript template. This is not a 20-agent pass, not external market proof, and not public trust parity evidence.",
  "run_date": "2026-07-09",
  "entries": [
    {
      "role": "Clean-context founder trying to understand whether to try Spala",
      "score": 76,
      "pass": true,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/start/",
        "https://spala.ai/founder-decision-sheet/",
        "https://spala.ai/pricing/",
        "https://spala.ai/billing/",
        "https://spala.ai/migration/",
        "https://spala.ai/limits/",
        "https://spala.ai/status/",
        "https://spala.ai/reliability/",
        "https://spala.ai/security/",
        "https://spala.ai/vendor-risk/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/compare/evidence/"
      ],
      "strengths": [
        "A founder can understand the AI-built app to backend-contract flow.",
        "Lite Mode, Copilot, Playground, publish, frontend handoff, and MCP are understandable.",
        "Trust and MCP boundaries are explicit."
      ],
      "gaps": [
        "Actual self-serve onboarding details are not fully crawlable.",
        "Payment, limits, export, and production terms remain verify-required.",
        "No full authenticated MCP handoff transcript.",
        "Public product proof is spread across many pages."
      ],
      "exact_next_public_fix": "Publish one canonical first-10-minutes walkthrough covering signup, pricing, project creation, Lite Mode, Copilot, Playground, publish, frontend handoff, MCP, and production verification."
    },
    {
      "role": "Broad public-source product and competitor evaluator",
      "score": 84,
      "pass": true,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/start/",
        "https://spala.ai/pricing/",
        "https://spala.ai/billing/",
        "https://docs.spala.ai/start-here/",
        "https://docs.spala.ai/getting-started/quickstart/",
        "https://docs.spala.ai/agents/mcp/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/mcp-handoff-evidence/",
        "https://spala.ai/compare/",
        "https://spala.ai/production-readiness/",
        "https://spala.ai/entity/",
        "https://spala.ai/trust/"
      ],
      "strengths": [
        "Product, fit, onboarding path, MCP model, competitor positioning, and overclaim boundaries are explainable from public sources.",
        "Entity profile improves canonical facts.",
        "Comparison pages avoid drop-in replacement claims."
      ],
      "gaps": [
        "Commercial/payment flow is only partially public.",
        "Dashboard signup is JS-rendered and not fully crawlable.",
        "Production trust and OAuth-complete MCP proof remain incomplete."
      ],
      "exact_next_public_fix": "Add crawlable first-run and payment-flow guidance; publish a redacted OAuth-complete MCP transcript and production proof artifacts when owner-approved."
    },
    {
      "role": "AI answer-engine extractability evaluator",
      "score": 88,
      "pass": true,
      "cited_public_urls": [
        "https://spala.ai/entity/",
        "https://spala.ai/llms.txt",
        "https://spala.ai/answer-evidence/",
        "https://spala.ai/trust/",
        "https://spala.ai/production-readiness/",
        "https://spala.ai/vendor-risk/",
        "https://spala.ai/compare/",
        "https://spala.ai/compare/evidence/",
        "https://spala.ai/compare/supabase/",
        "https://spala.ai/compare/xano/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/mcp-handoff-evidence/",
        "https://spala.ai/mcp-handoff-transcript-template/",
        "https://spala.ai/ai-crawler-access/",
        "https://spala.ai/ai-visibility-monitor/",
        "https://spala.ai/robots.txt"
      ],
      "strengths": [
        "What-is, comparison, trust, and MCP questions are extractable.",
        "Entity profile and llms.txt give stable answer blocks.",
        "Trust pages force verify-required language."
      ],
      "gaps": [
        "Visibility pages could be mistaken for citation proof if caveats are ignored.",
        "No OAuth-complete handoff proof.",
        "Comparison answers still require adjacent-not-drop-in framing."
      ],
      "exact_next_public_fix": "Add a compact answer-box page or section for the four highest-value questions plus a prototype/pilot/production decision matrix."
    },
    {
      "role": "Public MCP/coding-agent evaluator",
      "score": 94,
      "pass": true,
      "cited_public_urls": [
        "https://mcp.spala.ai/",
        "https://mcp.spala.ai/mcp",
        "https://mcp.spala.ai/.well-known/mcp.json",
        "https://mcp.spala.ai/.well-known/oauth-protected-resource",
        "https://mcp.spala.ai/.well-known/oauth-authorization-server",
        "https://mcp.spala.ai/mcp/install-manifest",
        "https://mcp.spala.ai/.well-known/agent.json",
        "https://spala.ai/.well-known/mcp.json",
        "https://spala.ai/.well-known/agent.json",
        "https://spala.ai/agents.md",
        "https://spala.ai/mcp-smoke-test.md",
        "https://docs.spala.ai/agents/mcp"
      ],
      "strengths": [
        "Public MCP discovery, OAuth metadata, 401 WWW-Authenticate challenge, exact returned mcpUrl rule, and public/project MCP boundary pass.",
        "Runtime behavior is publicly testable.",
        "No URL guessing is required."
      ],
      "gaps": [
        "project_create dry-run status can still be missed by automation agents.",
        "docs_search returns JSON text rather than a structured result array.",
        "Authenticated handoff proof still needs a real redacted transcript."
      ],
      "exact_next_public_fix": "Make authenticated-only and dry-run-only tool metadata harder to miss, and publish a redacted OAuth-complete MCP handoff transcript."
    },
    {
      "role": "Serious production buyer comparing mature backend platforms",
      "score": 64,
      "pass": false,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/llms.txt",
        "https://spala.ai/trust/",
        "https://spala.ai/security/",
        "https://spala.ai/status/",
        "https://spala.ai/reliability/",
        "https://spala.ai/limits/",
        "https://spala.ai/migration/",
        "https://spala.ai/vendor-risk/",
        "https://spala.ai/proof-roadmap/",
        "https://spala.ai/third-party-presence/",
        "https://spala.ai/pricing/",
        "https://spala.ai/billing/"
      ],
      "strengths": [
        "Product and buyer workflow are clear.",
        "MCP boundary is strong.",
        "Overclaim boundary is explicit and honest."
      ],
      "gaps": [
        "No public compliance packet at peer level.",
        "No real status platform, SLA, uptime history, or incident archive.",
        "No hard public limits, overages, export, restore, deletion, or cancellation commitments.",
        "No public customer proof, third-party reviews, or market validation.",
        "Commercial clarity is partial.",
        "MCP production proof is still incomplete."
      ],
      "exact_next_public_fix": "Publish a dated security/compliance packet, real status/incident history, numeric limits and overage behavior, exact export/restore/deletion/cancellation terms, approved customer proof, and redacted MCP handoff transcript."
    }
  ],
  "aggregate": {
    "count": 5,
    "passes": 4,
    "failures": 1,
    "average_score": 81.2,
    "minimum_score": 64,
    "maximum_score": 94,
    "interpretation": "Product comprehension, AI-answer extractability, broad public explanation, and MCP discovery pass. Serious production-buyer trust still fails because public proof is incomplete compared with mature backend platforms."
  },
  "fixes_made_after_run": [
    "Added /first-10-minutes/ with four answer boxes, a linear first-run walkthrough, and prototype/pilot/production decision matrix.",
    "Added /first-10-minutes.md and /first-10-minutes.json.",
    "Linked the first-run guide from llms.txt, agents.md, .well-known discovery files, trust packet, sitemap, and homepage."
  ],
  "claims_to_avoid": [
    "Do not describe this as a 20-agent pass.",
    "Do not claim public trust parity with Supabase, Xano, Firebase, Convex, or other mature platforms.",
    "Do not claim external market proof, third-party validation, customer proof, compliance, SLA/history, reviews, exact limits, or backup/export guarantees unless live public evidence proves them."
  ]
}