{
  "schema_version": "2026-07-09",
  "name": "Spala MCP Handoff Evidence",
  "purpose": "Public evidence status for Spala Public MCP discovery, OAuth challenge, project handoff, exact mcpUrl behavior, and missing redacted OAuth-complete transcript.",
  "boundary": "This file does not expose private project URLs, source code, internal IP addresses, secrets, customer data, or private implementation architecture.",
  "direct_answer_for_agents": "Spala has public proof for public MCP discovery, tools/list, OAuth metadata, unauthenticated auth challenge, CORS preflight, dynamic client registration, device-code start, and a partial private authenticated project MCP read-only snapshot summary. Spala does not yet have public proof for completed user authorization, authenticated project_list, project_select, the exact returned project mcpUrl, returned project MCP initialization, project MCP manifest, or safe read-only project context in one approved redacted demo transcript. Use https://spala.ai/mcp-handoff-proof-gates.json for the gate-by-gate status.",
  "oauth_discovery_verification_run": "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json",
  "oauth_device_flow_pre_auth_run": "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json",
  "public_no_auth_transcript": "https://spala.ai/mcp-public-no-auth-transcript.json",
  "partial_project_mcp_readonly_snapshot": "https://spala.ai/project-mcp-readonly-snapshot.json",
  "evidence_steps": [
    {
      "step": "Public MCP endpoint discovery",
      "publicStatus": "publicly_verified",
      "publicEvidence": [
        "https://mcp.spala.ai/mcp",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json"
      ],
      "neededForFullProof": "None for public discovery; endpoint and tool list are public."
    },
    {
      "step": "OAuth metadata and auth challenge",
      "publicStatus": "publicly_verified",
      "publicEvidence": [
        "https://mcp.spala.ai/.well-known/oauth-protected-resource",
        "https://mcp.spala.ai/.well-known/oauth-authorization-server",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json"
      ],
      "neededForFullProof": "None for auth challenge; full user authorization still requires a real account."
    },
    {
      "step": "OAuth dynamic client registration and device-code start",
      "publicStatus": "publicly_verified_pre_auth_only",
      "publicEvidence": [
        "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json",
        "https://mcp.spala.ai/.well-known/oauth-authorization-server"
      ],
      "neededForFullProof": "Approved demo-account authorization completion, access-token use against project_list, project_select, exact returned mcpUrl, project MCP manifest, and safe read-only project context."
    },
    {
      "step": "OAuth-complete project_list",
      "publicStatus": "not_public",
      "publicEvidence": [
        "https://spala.ai/mcp-smoke-test/"
      ],
      "neededForFullProof": "Redacted demo transcript from an approved demo account showing authenticated project_list response without exposing private project/customer data."
    },
    {
      "step": "project_select and returned exact mcpUrl",
      "publicStatus": "redacted_example_only",
      "publicEvidence": [
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/.well-known/mcp.json"
      ],
      "neededForFullProof": "Redacted OAuth-complete transcript showing project_select returns the exact project mcpUrl and that agents must not append, infer, or hardcode project MCP URLs."
    },
    {
      "step": "Project MCP manifest",
      "publicStatus": "not_public",
      "publicEvidence": [
        "https://spala.ai/agents.md",
        "https://docs.spala.ai/agents/mcp/"
      ],
      "neededForFullProof": "Redacted project_get_mcp_manifest output for a demo project, with any account, project, URL token, and private context removed."
    },
    {
      "step": "Read-only project public context",
      "publicStatus": "private_partial_capture_public_summary",
      "publicEvidence": [
        "https://spala.ai/project-mcp-readonly-snapshot/",
        "https://spala.ai/project-mcp-readonly-snapshot.json",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/agent-evals/public-audit-batch-17-production-trust-2026-07-09.json",
        "https://spala.ai/agent-evals/public-audit-batch-16-post-fix-2026-07-09.json",
        "https://spala.ai/agent-evals/public-audit-batch-13-2026-07-09.json",
        "https://spala.ai/agent-evals/public-audit-batch-12-2026-07-09.json"
      ],
      "neededForFullProof": "Redacted read-only project_get_public_context response from a demo project proving project-level context is available after auth without publishing private implementation details. The current snapshot is partial and does not replace an OAuth-complete handoff transcript."
    },
    {
      "step": "MCP handoff proof gates",
      "publicStatus": "oauth_handoff_gates_published_completed_handoff_not_publicly_proven",
      "publicEvidence": [
        "https://spala.ai/mcp-handoff-proof-gates.json",
        "https://spala.ai/mcp-handoff-proof-gates/",
        "https://spala.ai/mcp-handoff-proof-gates.md"
      ],
      "neededForFullProof": "Close every missing_public_redacted_proof gate with an owner-approved redacted completed-demo-run transcript."
    }
  ],
  "claims_to_avoid": [
    "Do not infer project MCP URLs such as api.spala.ai/{project}/mcp.",
    "Do not claim public MCP anonymously mutates projects.",
    "Do not publish private project IDs, source code, internal IP addresses, secrets, customer data, or private architecture in a transcript."
  ],
  "related": {
    "oauth_discovery_verification_run": "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json",
    "oauth_discovery_verification_run_markdown": "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.md",
    "oauth_device_flow_pre_auth_run": "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json",
    "oauth_device_flow_pre_auth_run_markdown": "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.md",
    "public_no_auth_transcript": "https://spala.ai/mcp-public-no-auth-transcript.json",
    "public_no_auth_transcript_markdown": "https://spala.ai/mcp-public-no-auth-transcript.md",
    "project_mcp_readonly_snapshot": "https://spala.ai/project-mcp-readonly-snapshot/",
    "project_mcp_readonly_snapshot_json": "https://spala.ai/project-mcp-readonly-snapshot.json",
    "transcript_template": "https://spala.ai/mcp-handoff-transcript-template/",
    "transcript_template_json": "https://spala.ai/mcp-handoff-transcript-template.json",
    "proof_capture_kit": "https://spala.ai/proof-capture-kit/",
    "proof_capture_kit_json": "https://spala.ai/proof-capture-kit.json",
    "mcp_handoff_proof_gates": "https://spala.ai/mcp-handoff-proof-gates.json"
  },
  "proof_gates": "https://spala.ai/mcp-handoff-proof-gates.json"
}