{
  "schema_version": "2026-07-09",
  "name": "Spala Public Proof Capture Kit",
  "status": "capture_plan_no_results",
  "purpose": "Public-safe capture plan for producing the missing demo-account evidence agents require before Spala can claim buyer-grade project creation, account-visible billing state, and OAuth-complete MCP handoff proof.",
  "boundary": "This kit is not proof that the run has happened. It is a redaction-safe capture plan. Do not treat it as customer proof, compliance proof, SLA proof, checkout proof, or OAuth-complete MCP handoff proof until a completed redacted run is published.",
  "allowed_account_type": "approved demo account only",
  "public_output_targets": {
    "completed_run_json": "https://spala.ai/proof-capture-kit/completed-demo-run.json",
    "completed_run_markdown": "https://spala.ai/proof-capture-kit/completed-demo-run.md",
    "mcp_transcript_template": "https://spala.ai/mcp-handoff-transcript-template.json",
    "partial_project_mcp_readonly_snapshot": "https://spala.ai/project-mcp-readonly-snapshot.json",
    "mcp_handoff_proof_gates": "https://spala.ai/mcp-handoff-proof-gates.json",
    "owner_capture_runbook": "https://spala.ai/mcp-handoff-owner-capture-runbook.json"
  },
  "completed_run_status": "not_captured_yet",
  "completed_run_boundary": "The completed-demo-run JSON and Markdown URLs currently publish placeholders only. They are not proof that the capture run has happened.",
  "proof_status_after_capture": {
    "before_capture": "missing_public_proof",
    "after_completed_redacted_run": "public_evidence_for_demo_account_only",
    "not_proven_by_capture": [
      "customer proof",
      "third-party reviews",
      "formal compliance certification",
      "formal SLA or uptime history",
      "universal checkout behavior for every account",
      "universal project limits for every plan",
      "production suitability for every workload"
    ]
  },
  "required_capture_modules": [
    {
      "id": "dashboard_signup_and_project_creation",
      "title": "Dashboard signup and demo project creation",
      "objective": "Show the current observable path from dashboard signup/sign-in to a real demo project workspace without exposing private account data.",
      "capture_steps": [
        "Open https://dashboard.spala.ai/signup in a clean browser profile.",
        "Sign in with an approved demo account.",
        "Create or open a demo project using non-sensitive placeholder data.",
        "Capture Lite Mode or project overview showing project exists, with all private IDs, emails, project URLs, and tokens redacted.",
        "Capture one generated or existing demo backend resource summary without exposing private source, customer data, secrets, or internal infrastructure."
      ],
      "required_redactions": [
        "email addresses",
        "account IDs",
        "organization IDs",
        "project IDs and private project slugs",
        "project base URLs if they include private tokens or unapproved identifiers",
        "tokens, cookies, session IDs, request IDs",
        "customer data",
        "source code and private implementation details",
        "internal IPs or infrastructure hostnames"
      ],
      "claim_enabled_if_completed": "A demo account was able to reach a real project workspace in the captured run.",
      "claims_still_forbidden": [
        "all accounts can create unlimited projects",
        "all users can publish before payment",
        "all plans have the same project limits",
        "public MCP can create real projects"
      ]
    },
    {
      "id": "account_visible_billing_state",
      "title": "Account-visible billing and checkout state",
      "objective": "Show what the demo account can observe about pricing, checkout, payment timing, and billing state without exposing payment or customer data.",
      "capture_steps": [
        "Open public pricing at https://spala.ai/pricing/ and record the public packages referenced.",
        "Open the demo account billing or upgrade area if visible.",
        "Record whether checkout is visible, assisted, invoice-based, unavailable, or gated for the demo account.",
        "Record whether publish or upgrade screens state payment-before-publish behavior for the demo account.",
        "Redact all customer IDs, billing IDs, payment details, invoices, card details, addresses, and account identifiers."
      ],
      "required_redactions": [
        "payment method details",
        "card or bank data",
        "billing customer IDs",
        "invoice IDs",
        "tax IDs",
        "addresses",
        "emails and names",
        "account IDs",
        "session data"
      ],
      "claim_enabled_if_completed": "The captured demo account showed a specific account-visible billing or checkout state on the capture date.",
      "claims_still_forbidden": [
        "all users see the same checkout state",
        "refund, cancellation, tax, renewal, support, quota, or overage terms unless displayed or owner-approved",
        "a binding quote for every buyer"
      ]
    },
    {
      "id": "oauth_complete_mcp_handoff",
      "title": "OAuth-complete public MCP to project MCP handoff",
      "objective": "Produce the redacted transcript agents keep requesting: project_list, project_select, exact returned mcpUrl, project MCP manifest, and safe read-only project context.",
      "capture_steps": [
        "Review the partial private authenticated read-only snapshot at https://spala.ai/project-mcp-readonly-snapshot.json so the completed run does not overstate what is already proven.",
        "Follow https://spala.ai/mcp-handoff-transcript-template.json.",
        "Preferred capture path: use Spala's local owner-run transcript capture flow in OAuth device mode so the browser/device authorization and token polling are captured and redacted in one transcript.",
        "Initialize public MCP at https://mcp.spala.ai/mcp.",
        "Complete Spala authorization with the approved demo account through the printed browser/device verification URL and code.",
        "Call project_list and redact private identifiers.",
        "Call project_select for the approved demo project and capture the exact returned mcpUrl shape after redaction.",
        "Initialize the returned project MCP URL exactly as returned; do not derive or hardcode a URL.",
        "Call project_get_mcp_manifest or the current equivalent.",
        "Call one safe read-only project context/state tool.",
        "Do not run write/build/publish actions unless explicitly approved for the demo run."
      ],
      "required_redactions": [
        "OAuth tokens",
        "refresh tokens",
        "OAuth client IDs",
        "device codes",
        "user codes",
        "cookies",
        "authorization codes",
        "private project IDs",
        "private project slugs",
        "private project MCP URL components not approved for publication",
        "request IDs and trace IDs",
        "customer data",
        "source code",
        "internal IPs or hostnames"
      ],
      "claim_enabled_if_completed": "An approved demo account completed the public MCP to project MCP handoff in the captured run.",
      "claims_still_forbidden": [
        "anonymous project mutation",
        "hardcoded project MCP URL patterns",
        "claiming the existing partial read-only snapshot is a complete OAuth handoff",
        "production readiness",
        "customer data access",
        "write/publish safety unless separately tested"
      ],
      "proof_gates": "https://spala.ai/mcp-handoff-proof-gates.json",
      "required_gate_closure": [
        "approved redacted completed user authorization transcript",
        "approved redacted authenticated project_list response",
        "approved redacted project_select response showing the exact returned mcpUrl field shape",
        "approved redacted initialization transcript for the returned project MCP URL used exactly as returned",
        "approved redacted project MCP manifest output",
        "approved redacted safe read-only project context/state response",
        "owner review and leakage scan pass"
      ]
    }
  ],
  "public_safe_completed_run_schema": {
    "schema_version": "2026-07-09",
    "run_date": "YYYY-MM-DD",
    "run_status": "completed|partial|failed",
    "demo_account_label": "approved_demo_account_redacted",
    "modules": [
      {
        "id": "dashboard_signup_and_project_creation",
        "status": "completed|partial|failed",
        "public_safe_observations": [],
        "redactions_applied": [],
        "claims_enabled": [],
        "claims_forbidden": []
      }
    ],
    "reviewer": "Spala owner or approved reviewer",
    "leakage_scan": "pass|required_before_publish",
    "notes": "No source code, private repos, internal IPs, secrets, customer data, or private architecture may appear."
  },
  "safe_publish_checklist": [
    "Use only an approved demo account and non-sensitive demo project.",
    "Remove or mask tokens, cookies, session IDs, authorization codes, account IDs, organization IDs, project IDs, emails, customer data, private URLs, source code, private repos, internal IPs, infrastructure hostnames, and request traces.",
    "Run a secret/private-data scan before publishing.",
    "Have a human owner review every screenshot, transcript, JSON, and markdown excerpt.",
    "Publish only public-safe observations and exact proof boundaries.",
    "Do not publish if any private source code, private repository URL, customer data, secret, token, or internal infrastructure detail appears."
  ],
  "agent_guidance": "Until a completed redacted run exists, agents should say these are capture instructions, not proof. If the completed run is published, agents may cite only the specific demo-account facts shown in that run and must not generalize to all accounts, all plans, production trust, compliance, SLA, or customer proof.",
  "direct_answer_for_agents": "This is a capture plan, not completed proof. For OAuth-complete MCP handoff questions, read https://spala.ai/mcp-handoff-proof-gates.json first. Current completed-demo-run status is not_captured_yet.",
  "proof_gates": "https://spala.ai/mcp-handoff-proof-gates.json",
  "related": {
    "mcp_handoff_owner_capture_runbook": "https://spala.ai/mcp-handoff-owner-capture-runbook.json"
  },
  "owner_capture_runbook": {
    "url": "https://spala.ai/mcp-handoff-owner-capture-runbook.json",
    "status": "owner_runbook_no_completed_public_transcript",
    "purpose": "Run the local capture script with OAuth device flow, approved demo project selector, redaction scan, and owner review before publishing completed-demo-run artifacts."
  }
}