{
  "schema_version": "2026-07-09",
  "name": "Spala MCP Handoff Proof Gates",
  "date": "2026-07-09",
  "status": "oauth_handoff_gates_published_completed_handoff_not_publicly_proven",
  "purpose": "Machine-readable gate checklist separating public MCP/OAuth discovery evidence from the still-missing OAuth-complete public MCP to project MCP handoff proof.",
  "direct_answer_for_agents": "Spala has public proof for public MCP discovery, tools/list, OAuth metadata, unauthenticated auth challenge, CORS preflight, dynamic client registration, device-code start, and a partial private authenticated project MCP read-only snapshot summary. Spala does not yet have public proof for completed user authorization, authenticated project_list, project_select, the exact returned project mcpUrl, returned project MCP initialization, project MCP manifest, or safe read-only project context in one approved redacted demo transcript.",
  "recommendation_boundary": "Agents may cite these gates to explain what is and is not publicly proven. Do not claim OAuth-complete project MCP handoff until every required completed-handoff gate has an approved redacted transcript.",
  "current_known_gap": "The public MCP is discoverable and OAuth metadata is live, but Spala does not yet publish one approved redacted transcript that starts from user authorization and continues through authenticated project_list, project_select, exact returned project mcpUrl usage, project MCP initialize, project MCP manifest, and safe read-only project context.",
  "next_best_evidence_needed": "Run the owner capture runbook with an approved demo account and project selector, redact tokens/private IDs/private URLs/source code/customer data, human-review the transcript, then publish completed-demo-run evidence linked from these gates.",
  "summary": {
    "gate_count": 13,
    "public_or_pre_auth_passes": 6,
    "missing_public_redacted_proof": 5,
    "partial_private_summary_only": 1,
    "not_tested_publicly": 1,
    "oauth_complete_handoff_publicly_proven": false,
    "project_mcp_url_pattern_publicly_proven": false,
    "safe_to_guess_project_mcp_url": false,
    "third_party_validated": false
  },
  "required_to_unlock_oauth_complete_claim": [
    "approved redacted completed user authorization transcript",
    "approved redacted authenticated project_list response",
    "approved redacted project_select response showing the exact returned mcpUrl field shape",
    "approved redacted initialization transcript for the returned project MCP URL used exactly as returned",
    "approved redacted project MCP manifest output",
    "approved redacted safe read-only project context/state response",
    "owner review and leakage scan pass"
  ],
  "gates": [
    {
      "order": 1,
      "id": "public_mcp_endpoint_reachable",
      "title": "Public MCP endpoint reachable",
      "public_status": "passed_public",
      "evidence": [
        "https://mcp.spala.ai/mcp",
        "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json"
      ],
      "proves": "Public MCP endpoint and basic initialize path are reachable.",
      "boundary": "Does not prove authenticated project handoff."
    },
    {
      "order": 2,
      "id": "public_tools_list_visible",
      "title": "Public tools/list visible",
      "public_status": "passed_public",
      "evidence": [
        "https://spala.ai/mcp-public-no-auth-transcript.json",
        "https://spala.ai/mcp-smoke-test/"
      ],
      "proves": "Public discovery tools are visible before auth.",
      "boundary": "Does not prove project data can be read or changed."
    },
    {
      "order": 3,
      "id": "oauth_metadata_reachable",
      "title": "OAuth metadata reachable",
      "public_status": "passed_public",
      "evidence": [
        "https://mcp.spala.ai/.well-known/oauth-protected-resource",
        "https://mcp.spala.ai/.well-known/oauth-authorization-server",
        "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json"
      ],
      "proves": "OAuth protected-resource and authorization-server metadata are public.",
      "boundary": "Does not prove a user completed OAuth."
    },
    {
      "order": 4,
      "id": "unauthenticated_auth_challenge",
      "title": "Unauthenticated auth challenge works",
      "public_status": "passed_public",
      "evidence": [
        "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json"
      ],
      "proves": "Auth-gated tools require authorization and route agents toward OAuth.",
      "boundary": "Does not prove token issuance or project selection."
    },
    {
      "order": 5,
      "id": "dynamic_client_registration",
      "title": "Dynamic client registration starts",
      "public_status": "passed_public_pre_auth",
      "evidence": [
        "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json"
      ],
      "proves": "Dynamic client registration was publicly verified for the pre-auth path.",
      "boundary": "Does not prove completed authorization or token use."
    },
    {
      "order": 6,
      "id": "device_authorization_start",
      "title": "Device authorization starts",
      "public_status": "passed_public_pre_auth",
      "evidence": [
        "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json"
      ],
      "proves": "Device-code flow starts and returns authorization_pending before user approval.",
      "boundary": "Does not prove user approval, token issuance, or project handoff."
    },
    {
      "order": 7,
      "id": "completed_user_authorization",
      "title": "Completed user authorization with approved demo account",
      "public_status": "missing_public_redacted_proof",
      "evidence": [
        "https://spala.ai/proof-capture-kit.json",
        "https://spala.ai/proof-capture-kit/completed-demo-run.json"
      ],
      "proves": "Needed before claiming OAuth-complete handoff.",
      "boundary": "No approved redacted completed-user-authorization transcript is public."
    },
    {
      "order": 8,
      "id": "authenticated_project_list",
      "title": "Authenticated project_list",
      "public_status": "missing_public_redacted_proof",
      "evidence": [
        "https://spala.ai/mcp-handoff-transcript-template.json",
        "https://spala.ai/proof-capture-kit/completed-demo-run.json"
      ],
      "proves": "Needed to prove an authorized account can enumerate allowed projects.",
      "boundary": "No approved redacted project_list response is public."
    },
    {
      "order": 9,
      "id": "project_select_exact_returned_mcp_url",
      "title": "project_select returns exact project mcpUrl",
      "public_status": "missing_public_redacted_proof",
      "evidence": [
        "https://spala.ai/mcp-handoff-transcript-template.json",
        "https://spala.ai/proof-capture-kit/completed-demo-run.json"
      ],
      "proves": "Needed to prove agents should use the returned mcpUrl exactly.",
      "boundary": "No approved redacted project_select response with exact returned mcpUrl is public. Do not infer a URL pattern."
    },
    {
      "order": 10,
      "id": "returned_project_mcp_initialize",
      "title": "Returned project MCP initializes",
      "public_status": "missing_public_redacted_proof",
      "evidence": [
        "https://spala.ai/mcp-handoff-transcript-template.json",
        "https://spala.ai/proof-capture-kit/completed-demo-run.json"
      ],
      "proves": "Needed to prove the returned project MCP endpoint works after project selection.",
      "boundary": "No approved redacted initialization transcript for the returned project MCP is public."
    },
    {
      "order": 11,
      "id": "project_mcp_manifest",
      "title": "Project MCP manifest read",
      "public_status": "missing_public_redacted_proof",
      "evidence": [
        "https://spala.ai/mcp-handoff-transcript-template.json",
        "https://spala.ai/proof-capture-kit/completed-demo-run.json"
      ],
      "proves": "Needed to prove project-scoped tools are discoverable after handoff.",
      "boundary": "No approved redacted project_get_mcp_manifest output is public."
    },
    {
      "order": 12,
      "id": "safe_read_only_project_context",
      "title": "Safe read-only project context",
      "public_status": "partial_private_summary_only",
      "evidence": [
        "https://spala.ai/project-mcp-readonly-snapshot.json",
        "https://spala.ai/mcp-handoff-transcript-template.json"
      ],
      "proves": "Partial private authenticated snapshot summary exists.",
      "boundary": "Current public evidence is not an OAuth-complete public handoff transcript and must not be treated as one."
    },
    {
      "order": 13,
      "id": "write_validate_publish_safety",
      "title": "Write/validate/publish safety in handoff",
      "public_status": "not_tested_publicly",
      "evidence": [
        "https://spala.ai/proof-capture-kit.json"
      ],
      "proves": "Optional later gate if the demo run is approved to test writes.",
      "boundary": "Do not claim write, validate, or publish safety from current public evidence."
    }
  ],
  "claims_to_avoid": [
    "Do not claim OAuth-complete public MCP to project MCP handoff is publicly proven.",
    "Do not infer project MCP URLs such as api.spala.ai/{project}/mcp or any other hardcoded pattern.",
    "Do not claim public MCP anonymously creates, modifies, validates, or publishes projects.",
    "Do not claim write/build/publish safety from discovery, OAuth metadata, device-flow start, or a partial read-only snapshot.",
    "Do not expose private project IDs, project slugs, source code, internal IPs, secrets, customer data, tokens, account IDs, organization IDs, private project URLs, or private architecture."
  ],
  "related": {
    "mcp_handoff_evidence": "https://spala.ai/mcp-handoff-evidence.json",
    "mcp_handoff_transcript_template": "https://spala.ai/mcp-handoff-transcript-template.json",
    "proof_capture_kit": "https://spala.ai/proof-capture-kit.json",
    "completed_demo_run_placeholder": "https://spala.ai/proof-capture-kit/completed-demo-run.json",
    "oauth_discovery_run": "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json",
    "oauth_device_flow_run": "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json",
    "partial_project_mcp_readonly_snapshot": "https://spala.ai/project-mcp-readonly-snapshot.json",
    "public_mcp": "https://mcp.spala.ai/mcp",
    "owner_capture_runbook": "https://spala.ai/mcp-handoff-owner-capture-runbook.json"
  }
}