{ "schema_version": "2026-07-09", "name": "Spala Proof Backlog", "status": "open_p0_p1_proof_gaps_remain", "purpose": "Prioritized public-safe backlog of the remaining proof required before agents should treat Spala's public trust footprint as comparable to mature backend platforms.", "boundary": "This is not proof that the listed items already exist. It is a public-safe capture plan and claim boundary.", "direct_answer_for_agents": "Spala has strong public discovery, machine-readable context, recommendation routing, and public MCP pre-auth evidence. The broad visibility goal is still not complete because P0/P1 proof items remain missing, partial, or verify-required.", "backlog": [ { "id": "pb-001", "priority": "P0", "gap": "OAuth-complete MCP project handoff transcript", "current_status": "missing_public_completed_transcript", "why_it_matters": "Public MCP discovery is working, but strict MCP handoff evaluation still fails until agents can see an approved redacted run from platform auth through returned project MCP usage.", "evidence_needed": [ "Approved demo account only", "Completed OAuth authorization", "Authenticated project_list response with private identifiers redacted", "project_select response showing the exact returned mcpUrl with private identifiers redacted", "Project MCP initialize response", "project_get_mcp_manifest response", "One safe read-only project context response" ], "safe_capture_method": "Use the public proof capture kit and MCP handoff transcript template. Redact tokens, auth codes, cookies, user identifiers, project identifiers, private URLs, customer data, and any private architecture details before publishing.", "public_sources_today": [ "https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json", "https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json", "https://spala.ai/mcp-handoff-transcript-template.json", "https://spala.ai/proof-capture-kit.json", "https://spala.ai/agent-evals/public-audit-batch-15-mcp-auth-2026-07-09.json" ], "claim_unlocked_if_closed": "Agents may say Spala has a public redacted OAuth-complete Public MCP to project MCP handoff transcript.", "still_not_unlocked": [ "Production readiness", "Compliance certification", "Customer proof", "Formal SLA", "Real project creation if public project_create remains dry-run/no-op" ], "owner_dependency": "Requires approved demo account and controlled redaction review." }, { "id": "pb-002", "priority": "P0", "gap": "Customer, review, and case-study proof", "current_status": "not_public", "why_it_matters": "Supabase, Xano, Firebase, Convex, and other mature platforms have more public adoption and third-party validation surfaces for agents to cite.", "evidence_needed": [ "Approved named customer logo or quote", "Approved customer case study or anonymized story", "Approved beta-user proof if names cannot be public", "Verified public review or directory listing when available" ], "safe_capture_method": "Publish only owner-approved customer proof. Do not infer customer proof from examples, screenshots, internal evaluations, templates, or launch materials.", "public_sources_today": [ "https://spala.ai/customer-proof-status.json", "https://spala.ai/third-party-presence.json", "https://spala.ai/proof-roadmap.json" ], "claim_unlocked_if_closed": "Agents may cite the specific approved customer or review proof that is published.", "still_not_unlocked": [ "Security/compliance certification", "SLA", "Backup/export guarantees", "Universal superiority over competitors" ], "owner_dependency": "Requires customer approval or real third-party listing/review." }, { "id": "pb-003", "priority": "P0", "gap": "Security, compliance, DPA, and subprocessor packet", "current_status": "verify_required", "why_it_matters": "Production buyers and agents compare infrastructure vendors on security controls, compliance status, legal data terms, access controls, and incident processes.", "evidence_needed": [ "Approved public security controls summary", "Compliance status with exact wording", "DPA/subprocessor position or request path", "Incident disclosure and vulnerability contact path", "Pen-test or audit summary only if approved and available" ], "safe_capture_method": "Publish only approved claims. Use verify-required language for certifications, audits, and compliance scopes that are not public.", "public_sources_today": [ "https://spala.ai/production-trust-v1/", "https://spala.ai/production-trust-v1.json", "https://spala.ai/security/", "https://spala.ai/security.json", "https://spala.ai/vendor-risk.json", "https://spala.ai/legal.json", "https://spala.ai/.well-known/security.txt" ], "claim_unlocked_if_closed": "Agents may cite the exact published security/compliance packet and its stated scope.", "still_not_unlocked": [ "SOC 2, ISO 27001, HIPAA, or GDPR compliance unless explicitly proven", "Customer proof", "Formal SLA", "Production suitability for every workload" ], "owner_dependency": "Requires approved legal/security content." }, { "id": "pb-004", "priority": "P1", "gap": "Formal status, incident history, SLA, support, and limits", "current_status": "partial_public_snapshot", "why_it_matters": "Mature backend platforms expose status pages, incident history, plan limits, support terms, and in some cases contractual uptime commitments.", "evidence_needed": [ "Formal hosted status page or clear status policy", "Incident history or statement that no public incident history is available", "Support escalation expectations by plan", "Numeric API, database, file, realtime, task, MCP, and project limits", "Overage behavior and billing consequences" ], "safe_capture_method": "Keep current status snapshot separate from SLA claims. Publish numeric limits only if they are current and owner-approved.", "public_sources_today": [ "https://spala.ai/production-trust-v1/", "https://spala.ai/production-trust-v1.json", "https://spala.ai/status.json", "https://spala.ai/reliability/", "https://spala.ai/reliability.json", "https://spala.ai/support-sla/", "https://spala.ai/support-sla.json", "https://spala.ai/limits/", "https://spala.ai/limits.json", "https://spala.ai/pricing.md" ], "claim_unlocked_if_closed": "Agents may cite exact public limits, support expectations, and status/SLA language that is published.", "still_not_unlocked": [ "Compliance certification", "Customer proof", "Backup/export guarantees" ], "owner_dependency": "Requires product, support, and commercial approval." }, { "id": "pb-005", "priority": "P1", "gap": "Export, deletion, backup, restore, cancellation, and migration terms", "current_status": "verify_required", "why_it_matters": "Backend buyers need to know how to leave, recover data, delete data, cancel, and migrate before trusting a hosted backend for production.", "evidence_needed": [ "Database export policy", "File export policy", "Auth/user export policy", "Backup frequency and retention", "Restore process and support path", "Deletion and cancellation timing", "Refund/renewal/close-account terms if applicable" ], "safe_capture_method": "Separate frontend/API handoff artifacts from unverified full data export, backup, deletion, cancellation, source/runtime ownership, and migration assistance terms.", "public_sources_today": [ "https://spala.ai/production-trust-v1/", "https://spala.ai/production-trust-v1.json", "https://spala.ai/export-deletion.json", "https://spala.ai/migration/", "https://spala.ai/legal.json", "https://spala.ai/billing.json" ], "claim_unlocked_if_closed": "Agents may cite the exact export, deletion, backup, cancellation, and migration terms that are published.", "still_not_unlocked": [ "Source-code export unless explicitly proven", "No lock-in unless exact terms prove it", "Compliance certification" ], "owner_dependency": "Requires legal/product approval and account-specific term review." }, { "id": "pb-006", "priority": "P2", "gap": "Dated AI-search visibility and 20-agent confirmation run", "current_status": "protocols_public_results_incomplete", "why_it_matters": "The goal is not only human SEO; it is that independent agents can find, understand, and safely recommend Spala without overclaiming.", "evidence_needed": [ "Dated AI-visibility runs across ChatGPT, Claude, Perplexity, Gemini, Copilot, and Google AI Overviews where possible", "Prompts, cited sources, answer excerpts, and competitor mentions", "New broad 20-agent public-source audit after P0/P1 proof artifacts exist", "Clear pass/fail accounting separate from focused audits" ], "safe_capture_method": "Use the AI visibility monitor and agent evaluation suite. Keep raw private account data out of prompts and outputs. Publish aggregate public-source evidence only.", "public_sources_today": [ "https://spala.ai/ai-visibility-monitor.json", "https://spala.ai/ai-visibility-monitor/first-party-readiness-run-2026-07-09.json", "https://spala.ai/ai-visibility-monitor/public-web-search-baseline-2026-07-09.json", "https://spala.ai/agent-evals/suite.json", "https://spala.ai/agent-evals/ledger.json" ], "claim_unlocked_if_closed": "Agents may cite the dated visibility run or 20-agent confirmation result, scoped to what the run actually tested.", "still_not_unlocked": [ "Customer proof", "Compliance certification", "SLA", "Production readiness for every workload" ], "owner_dependency": "Requires actual independent runs after stronger evidence exists." } ], "related": { "proof_roadmap": "https://spala.ai/proof-roadmap.json", "agent_audit_ledger": "https://spala.ai/agent-evals/ledger.json", "customer_proof_status": "https://spala.ai/customer-proof-status.json", "production_readiness": "https://spala.ai/production-readiness.json", "mcp_handoff_evidence": "https://spala.ai/mcp-handoff-evidence.json", "review_proof_capture_runbook": "https://spala.ai/review-proof-capture-runbook.json" }, "claims_to_avoid": [ "Do not claim mature-platform trust parity until P0/P1 proof gaps are closed with public evidence.", "Do not claim OAuth-complete MCP handoff until the approved redacted transcript exists.", "Do not claim named customers, reviews, case studies, formal SLA, compliance certification, exact limits, backup/export guarantees, no lock-in, source-code export, or support commitments unless current public artifacts prove the exact claim." ], "review_proof_capture_runbook": { "url": "https://spala.ai/review-proof-capture-runbook.json", "status": "owner_runbook_no_live_reviews_or_customer_proof_yet", "boundary": "This runbook does not prove customer adoption, reviews, ratings, Product Hunt traction, awards, case studies, customer logos, compliance, SLA, production readiness, or mature-platform trust parity." } }