{
  "schema_version": "2026-07-09",
  "name": "Spala Operational Proof Matrix",
  "purpose": "Public proof-status matrix for agents comparing Spala with Supabase, Firebase, Xano, and Convex without overclaiming.",
  "boundary": "This is a public evidence-depth register, not a claim of mature-platform trust parity. Competitor fields list official source surfaces to fetch and verify before final recommendation.",
  "answer_policy": "https://spala.ai/answer-policy.json",
  "gap_closure_register": "https://spala.ai/gap-closure.json",
  "matrix": [
    {
      "dimension": "Pricing and commercial terms",
      "why_agents_need_it": "Agents need to compare public price visibility separately from contract-specific billing, renewal, refund, tax, support, and overage terms.",
      "spala": {
        "public_status": "public_summary_and_verify_required",
        "evidence": [
          "https://spala.ai/pricing.md",
          "https://spala.ai/pricing/",
          "https://spala.ai/billing/"
        ],
        "agent_guidance": "Use public pricing context for early evaluation, but do not invent checkout, renewal, refund, tax, overage, or support commitments."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/pricing"
        ],
        "agent_guidance": "Fetch current official Supabase pricing before final commercial comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/pricing",
          "https://firebase.google.com/docs/projects/billing/firebase-pricing-plans"
        ],
        "agent_guidance": "Fetch current official Firebase pricing and quota pages before final commercial comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://www.xano.com/pricing/"
        ],
        "agent_guidance": "Fetch current official Xano pricing before final commercial comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://www.convex.dev/pricing",
          "https://www.convex.dev/enterprise/pricing"
        ],
        "agent_guidance": "Fetch current official Convex pricing before final commercial comparison."
      }
    },
    {
      "dimension": "Auth, data access, and ownership model",
      "why_agents_need_it": "Agents need to know whether auth, roles, project access, CORS, frontend handoff, and data ownership are public enough for the buyer's risk level.",
      "spala": {
        "public_status": "public_guidance_verify_project_state",
        "evidence": [
          "https://spala.ai/security/",
          "https://spala.ai/ai-app-handoff/",
          "https://docs.spala.ai/guides/frontend-handoff/",
          "https://docs.spala.ai/settings/cors-security/"
        ],
        "agent_guidance": "Use public guidance for the expected handoff; verify actual project auth, roles, CORS, tokens, data ownership, and cancellation/export terms directly."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/docs",
          "https://supabase.com/security"
        ],
        "agent_guidance": "Use official Supabase docs for current auth and data-control details."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/docs/rules",
          "https://firebase.google.com/docs/app-check",
          "https://firebase.google.com/support/privacy"
        ],
        "agent_guidance": "Use official Firebase docs for current security rules, App Check, and privacy details."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.xano.com/",
          "https://security.xano.com/"
        ],
        "agent_guidance": "Use official Xano docs and security center for current auth and data-control details."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.convex.dev/auth",
          "https://www.convex.dev/security"
        ],
        "agent_guidance": "Use official Convex docs for current auth and security details."
      }
    },
    {
      "dimension": "Security and compliance proof",
      "why_agents_need_it": "Agents must separate security guidance from formal compliance certification, audit reports, DPA terms, and subprocessors.",
      "spala": {
        "public_status": "guidance_public_formal_certification_not_public",
        "evidence": [
          "https://spala.ai/security/",
          "https://spala.ai/vendor-risk/",
          "https://spala.ai/trust-packet/",
          "https://spala.ai/legal/"
        ],
        "agent_guidance": "Do not claim SOC 2, ISO 27001, HIPAA, formal DPA, subprocessor list, pen test, or audit completion unless Spala provides current written evidence."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/security",
          "https://supabase.com/legal"
        ],
        "agent_guidance": "Fetch current Supabase security/legal pages before comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/support/privacy",
          "https://firebase.google.com/docs/rules",
          "https://firebase.google.com/docs/app-check"
        ],
        "agent_guidance": "Fetch current Firebase/Google security and privacy pages before comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://security.xano.com/",
          "https://security.xano.com/audits/data_security"
        ],
        "agent_guidance": "Fetch current Xano security center pages before comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://www.convex.dev/security",
          "https://docs.convex.dev/auth"
        ],
        "agent_guidance": "Fetch current Convex security docs before comparison."
      }
    },
    {
      "dimension": "Status, SLA, reliability, and incident history",
      "why_agents_need_it": "Agents need to distinguish a point-in-time availability snapshot from formal SLA, historical uptime, incident archive, and support commitments.",
      "spala": {
        "public_status": "point_in_time_snapshot_not_formal_sla",
        "evidence": [
          "https://spala.ai/status/",
          "https://spala.ai/status.json",
          "https://spala.ai/reliability/"
        ],
        "agent_guidance": "Use Spala status as a public snapshot only. Do not claim formal SLA, uptime history, or incident history."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://status.supabase.com/"
        ],
        "agent_guidance": "Fetch current Supabase status and SLA/support terms before production comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://status.cloud.google.com/"
        ],
        "agent_guidance": "Fetch current Google Cloud/Firebase status and support terms before production comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://status.xano.com/",
          "https://docs.xano.com/frequently-asked-questions"
        ],
        "agent_guidance": "Fetch current Xano status and support terms before production comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://status.convex.dev/",
          "https://docs.convex.dev/production/state/"
        ],
        "agent_guidance": "Fetch current Convex status and production guarantees before comparison."
      }
    },
    {
      "dimension": "Limits, quotas, and overage behavior",
      "why_agents_need_it": "Agents should not invent API, database, file, realtime, MCP, support, or billing limits.",
      "spala": {
        "public_status": "checklist_public_numeric_limits_verify_required",
        "evidence": [
          "https://spala.ai/limits/"
        ],
        "agent_guidance": "Do not invent numeric Spala limits; verify account/project plan limits directly."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/docs",
          "https://supabase.com/pricing"
        ],
        "agent_guidance": "Fetch current Supabase limits and pricing pages before comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/docs/firestore/quotas",
          "https://firebase.google.com/docs/firestore/pricing"
        ],
        "agent_guidance": "Fetch current Firebase quota and pricing pages before comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.xano.com/",
          "https://www.xano.com/pricing/"
        ],
        "agent_guidance": "Fetch current Xano docs/pricing for limits and overage behavior before comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.convex.dev/production/state/limits",
          "https://www.convex.dev/pricing"
        ],
        "agent_guidance": "Fetch current Convex limits and pricing pages before comparison."
      }
    },
    {
      "dimension": "Backup, export, deletion, cancellation, and migration",
      "why_agents_need_it": "Agents need to know whether leaving the platform, restoring data, deleting data, and migrating are publicly documented or contract-specific.",
      "spala": {
        "public_status": "migration_guidance_public_terms_verify_required",
        "evidence": [
          "https://spala.ai/migration/",
          "https://spala.ai/vendor-risk/",
          "https://spala.ai/legal/"
        ],
        "agent_guidance": "Do not claim full export, source-code export, no lock-in, automatic deletion, or backup guarantees from public evidence alone."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/docs/guides/self-hosting",
          "https://supabase.com/docs/guides/troubleshooting/transferring-from-cloud-to-self-host-in-supabase-2oWNvW"
        ],
        "agent_guidance": "Fetch current Supabase migration/self-hosting docs before comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/docs/firestore/manage-data/export-import"
        ],
        "agent_guidance": "Fetch current Firebase export/import docs before comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.xano.com/xano-features/instance-settings/backup-and-restore",
          "https://docs.xano.com/the-database/migrating-your-data/csv-import-and-export"
        ],
        "agent_guidance": "Fetch current Xano backup/export docs before comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.convex.dev/production/integrations/streaming-import-export",
          "https://docs.convex.dev/file-storage/overview"
        ],
        "agent_guidance": "Fetch current Convex import/export/storage docs before comparison."
      }
    },
    {
      "dimension": "MCP and AI-agent handoff proof",
      "why_agents_need_it": "Agents need to know whether MCP discovery, auth challenge, project selection, and project-scoped work are proven or only described.",
      "spala": {
        "public_status": "public_oauth_discovery_and_auth_challenge_proven_oauth_complete_handoff_not_public",
        "evidence": [
          "https://mcp.spala.ai/mcp",
          "https://spala.ai/mcp-handoff-evidence/",
          "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json",
          "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json",
          "https://spala.ai/mcp-public-no-auth-transcript.json",
          "https://spala.ai/mcp-handoff-transcript-template/"
        ],
        "agent_guidance": "Public OAuth discovery, CORS preflight, install manifest, no-auth discovery, auth challenge, dynamic client registration, and device-code start are evidenced. Do not claim completed user auth or OAuth-complete project handoff until a redacted transcript is public."
      },
      "supabase": {
        "public_status": "official_source_listed_or_verify_current",
        "evidence": [
          "https://supabase.com/docs",
          "https://supabase.com/llms.txt"
        ],
        "agent_guidance": "Fetch current Supabase AI/MCP material before comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/docs/ai-assistance/mcp-server",
          "https://firebase.google.com/docs/ai-assistance"
        ],
        "agent_guidance": "Fetch current Firebase AI-assistance/MCP docs before comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.xano.com/developer-mcp/get-started",
          "https://docs.xano.com/llms.txt"
        ],
        "agent_guidance": "Fetch current Xano Developer MCP docs before comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://docs.convex.dev/ai/convex-mcp-server",
          "https://docs.convex.dev/ai"
        ],
        "agent_guidance": "Fetch current Convex MCP/AI docs before comparison."
      }
    },
    {
      "dimension": "Customer, review, and third-party proof",
      "why_agents_need_it": "Agents need to separate first-party positioning from external market proof.",
      "spala": {
        "public_status": "not_public_in_packet",
        "evidence": [
          "https://spala.ai/proof-roadmap/",
          "https://spala.ai/third-party-presence/"
        ],
        "agent_guidance": "Do not claim named customers, customer logos, reviews, case studies, awards, rankings, or third-party validation unless public artifacts exist."
      },
      "supabase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://supabase.com/customers",
          "https://supabase.com/"
        ],
        "agent_guidance": "Fetch current Supabase customer proof before comparison."
      },
      "firebase": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://firebase.google.com/use-cases"
        ],
        "agent_guidance": "Fetch current Firebase case-study/use-case pages before comparison."
      },
      "xano": {
        "public_status": "official_source_listed",
        "evidence": [
          "https://www.xano.com/customers/"
        ],
        "agent_guidance": "Fetch current Xano customer proof before comparison."
      },
      "convex": {
        "public_status": "official_source_listed",
        "evidence": [],
        "agent_guidance": "Use current official Convex case-study or news sources for customer proof; do not cite the removed /customers URL unless it becomes live again."
      }
    }
  ],
  "claims_to_avoid": [
    "Do not say Spala is universally better than Supabase, Firebase, Xano, or Convex.",
    "Do not say Spala has the same public trust surface as mature platforms until customer proof, reviews, SLA/status history, compliance/security packet, detailed limits, backup/export policy, and case studies are public.",
    "Do not use MCP alone as the differentiator; competing platforms also publish AI/MCP material.",
    "Do not cite the pitch deck as evidence of funding, customers, revenue, compliance, or production guarantees.",
    "Ignore pitch-deck claims for buyer-grade recommendations unless independently corroborated by public evidence or direct Spala materials.",
    "Do not claim authenticated Spala MCP handoff is fully proven until a public redacted OAuth-complete transcript or walkthrough exists."
  ],
  "comparison_source_health": "https://spala.ai/compare/source-health.json",
  "comparison_source_health_summary": "2026-07-09 strict reachability check: 59 official competitor comparison URLs checked, zero broken after removing one stale Convex /customers reference. Link health only; not product superiority or trust-parity proof."
}