{
  "schema": "davisville-agent-analytics.security-posture.v1",
  "product": {
    "id": "ai-agent-analytics",
    "name": "AI Agent Analytics",
    "publisher": {
      "id": "davisville-labs",
      "legal_name": "Davisville Labs LLC",
      "canonical_url": "https://davisvillelabs.com/",
      "publisher_manifest": "https://davisvillelabs.com/.well-known/davisville-labs.json",
      "github": "https://github.com/davisvillelabs"
    },
    "canonical_url": "https://analytics.davisvillelabs.com/"
  },
  "posture": {
    "data_minimization": "raw prompts, request/response bodies, authentication tokens, payment credentials, wallet secrets, full paid results, and long-term raw IP addresses are prohibited by default; new actor identifiers use property-scoped keyed pseudonyms",
    "data_retention": {
      "analytics_engine_events": "up_to_three_months_platform_retention",
      "dashboard_window": "previous_24_hours",
      "snapshot_momentum_points": 7
    },
    "tenant_isolation": "organization-scoped authorization is enforced server-side",
    "delegated_agent_authority": "short-lived, revocable, organization-scoped, least-privilege tokens",
    "mcp_oauth": "OAuth authorization code flow with PKCE S256, RFC 9728 protected-resource metadata, issuer identification, Client ID Metadata Documents, read-only scopes, and one-time authorization codes",
    "delegated_token_maximum_lifetime_hours": 24,
    "ingestion_credentials": "newly issued credentials are property-scoped, revocable, hash-only at rest, and write-only for telemetry ingestion; legacy credentials remain backward-compatible for reads until rotated",
    "browser_sessions": "high-entropy opaque secrets stored by hash; Secure HttpOnly __Host- cookie",
    "customer_writes": "same-origin browser requests required",
    "owner_access": "Cloudflare Access plus application allowlist",
    "payment_card_data_handling": "not handled by AI Agent Analytics",
    "stripe_webhooks": "HMAC signature verified with bounded timestamp tolerance and idempotent processing",
    "machine_payment_replay_defense": "durable payment and receipt state blocks duplicate charging when settlement state is uncertain",
    "machine_purchase_approval": "short-lived HMAC-signed artifact bound to exact email and Founder terms; one payment challenge per artifact",
    "analytics_failure_mode": "fail_open_for_merchant_product",
    "public_readiness_scan": "fixed HTTPS surfaces only; no credentials; no redirects; private-style targets rejected; public DNS checked before and after each target fetch; no security score",
    "installation_validation": "active credential plus accepted customer_test evidence; no payment or synthetic customer activity",
    "unknown_external_promoted_to_real_agent": false,
    "invasive_fingerprinting": false
  },
  "evidence": {
    "schema": "davisville-agent-analytics.security-evidence.v1",
    "evidence_kind": "publisher_declared_implementation_and_test_references",
    "status_semantics": "implemented describes code enforcement, not a passing CI result or proof of production configuration; partial identifies a stated limitation",
    "repository": "https://github.com/davisvillelabs/agentanalytics",
    "ci": "https://github.com/davisvillelabs/agentanalytics/actions/workflows/quality.yml",
    "independent_verification": "With repository access, check out the deployment commit, install dependencies and run the listed commands. Public users can inspect interfaces and runtime binding status, but cannot verify private source or infer passing CI from this response.",
    "controls": [
      {
        "id": "tenant_isolation",
        "status": "implemented",
        "enforcement_layer": "server_authorization_and_database_predicates",
        "implementation": [
          "src/agent-authorization.js: readDelegatedAnalytics",
          "src/customer-auth.js: authorizeCustomerProperty"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/agent-authorization.test.js",
            "tests/customer-auth.test.js"
          ],
          "command": "node --test tests/agent-authorization.test.js tests/customer-auth.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/products/{id}/daily-pulse",
          "/mcp"
        ],
        "limitation": null
      },
      {
        "id": "delegated_least_privilege",
        "status": "implemented",
        "enforcement_layer": "server_scope_checks_and_separate_credential_stores",
        "implementation": [
          "src/agent-authorization.js: authenticateAgentAuthorization",
          "src/worker.js: authenticateProperty"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/agent-authorization.test.js",
            "tests/security-boundaries.test.js"
          ],
          "command": "node --test tests/agent-authorization.test.js tests/security-boundaries.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/products",
          "/v1/events",
          "/v1/billing/stripe/webhook"
        ],
        "limitation": "Delegated tokens do not authorize billing or payment. products:create is a separate opt-in mutation scope outside MCP."
      },
      {
        "id": "ingestion_credential_scoping",
        "status": "partial",
        "enforcement_layer": "credential_format_plus_property_key_lookup",
        "implementation": [
          "src/customer-auth.js: createIngestionApiKey, propertyCredentialAccess",
          "src/worker.js: authenticateProperty"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/customer-auth.test.js",
            "tests/property-credential-scope.test.js",
            "tests/security-boundaries.test.js"
          ],
          "command": "node --test tests/customer-auth.test.js tests/property-credential-scope.test.js tests/security-boundaries.test.js"
        },
        "machine_interfaces": [
          "/v1/events",
          "/v1/report",
          "/v1/daily-pulse"
        ],
        "limitation": "New aaa_ingest_ property credentials are write-only for telemetry ingestion. Legacy aaa_key_ credentials still permit property reads as well as ingestion until they are rotated, but neither credential class grants organization administration."
      },
      {
        "id": "secure_browser_session",
        "status": "implemented",
        "enforcement_layer": "hashed_session_store_and_cookie_attributes",
        "implementation": [
          "src/customer-auth.js: loadCustomerContext, sessionCookie"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/customer-auth.test.js"
          ],
          "command": "node --test tests/customer-auth.test.js"
        },
        "machine_interfaces": [
          "/workspace"
        ],
        "limitation": null
      },
      {
        "id": "same_origin_mutations",
        "status": "implemented",
        "enforcement_layer": "browser_origin_check_before_mutation",
        "implementation": [
          "src/customer-app.js: sameOriginPost",
          "src/customer-onboarding.js: sameOriginPost",
          "src/purchase-approval.js"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/security-boundaries.test.js",
            "tests/purchase-approval.test.js"
          ],
          "command": "node --test tests/security-boundaries.test.js tests/purchase-approval.test.js"
        },
        "machine_interfaces": [
          "/workspace/credentials/rotate",
          "/workspace/agent-authorizations",
          "/purchase-approval"
        ],
        "limitation": "Origin checks protect browsers from cross-site writes; they are not caller identity authentication."
      },
      {
        "id": "payment_replay_protection",
        "status": "implemented",
        "enforcement_layer": "durable_receipt_and_challenge_state",
        "implementation": [
          "src/machine-entitlement.js: claimMachinePaymentChallenge",
          "src/mpp-founder-access.js",
          "src/x402-founder-access.js"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/machine-payment-reconciliation-state.test.js",
            "tests/x402-founder-access.test.js"
          ],
          "command": "node --test tests/machine-payment-reconciliation-state.test.js tests/x402-founder-access.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/founder-access"
        ],
        "limitation": "Depends on durable database state and provider reconciliation; this is not a blanket guarantee against every duplicate payment."
      },
      {
        "id": "intent_bound_purchase_approval",
        "status": "implemented",
        "enforcement_layer": "server_hmac_validation_and_durable_one_use_claim",
        "implementation": [
          "src/purchase-approval.js: validateFounderApprovalArtifact, bindFounderApprovalChallenge",
          "src/mpp-founder-access.js"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/purchase-approval.test.js",
            "tests/mpp-runtime.test.js"
          ],
          "command": "node --test tests/purchase-approval.test.js tests/mpp-runtime.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/founder-approval-intent",
          "/purchase-approval",
          "/api/agent/v1/founder-access"
        ],
        "limitation": "Purchase approval authenticates server-issued exact terms, not a human identity or presence. A scripted client can imitate a browser confirmation; agents must not self-approve. HMAC approval signatures are verified by this service, not independently verifiable using a public key."
      },
      {
        "id": "uncertain_payment_duplicate_block",
        "status": "implemented",
        "enforcement_layer": "durable_pending_receipt_gate",
        "implementation": [
          "src/machine-entitlement.js: loadBlockingMachinePaymentReceipt",
          "src/mpp-founder-access.js: machinePurchaseEligibility"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/machine-payment-reconciliation-state.test.js"
          ],
          "command": "node --test tests/machine-payment-reconciliation-state.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/founder-access"
        ],
        "limitation": "Unresolved payments require reconciliation; do not initiate another payment to test recovery."
      },
      {
        "id": "stripe_webhook_verification",
        "status": "implemented",
        "enforcement_layer": "hmac_and_timestamp_verification_before_persistence",
        "implementation": [
          "src/stripe-webhook.js: verifyStripeSignature, handleStripeWebhook"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/stripe-webhook.test.js",
            "tests/security-boundaries.test.js"
          ],
          "command": "node --test tests/stripe-webhook.test.js tests/security-boundaries.test.js"
        },
        "machine_interfaces": [
          "/v1/billing/stripe/webhook"
        ],
        "limitation": "Fails closed when the webhook secret is absent."
      },
      {
        "id": "abuse_rate_limiting",
        "status": "implemented",
        "enforcement_layer": "cloudflare_rate_limiter_bindings",
        "implementation": [
          "src/abuse-controls.js: applyAbuseControls"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/abuse-controls.test.js"
          ],
          "command": "node --test tests/abuse-controls.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/security"
        ],
        "limitation": "Missing bindings skip application rate limiting. Binding presence is observable; global enforcement and dashboard WAF configuration are not attested here."
      },
      {
        "id": "privacy_data_minimization",
        "status": "partial",
        "enforcement_layer": "telemetry_field_allowlist_and_property_scoped_pseudonymization",
        "implementation": [
          "src/event-standard.js: minimalSafeEvent",
          "src/worker.js: ingest",
          "src/pseudonym.js"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/event-standard.test.js",
            "tests/pseudonym.test.js"
          ],
          "command": "node --test tests/event-standard.test.js tests/pseudonym.test.js"
        },
        "machine_interfaces": [
          "/v1/events"
        ],
        "limitation": "Telemetry uses an allowlist, not semantic secret detection. Sensitive text placed in allowed metadata fields may be retained; merchants must minimize those fields. Founder Pulse telemetry is written to Cloudflare Workers Analytics Engine during the day. Only the previous 24 hours are queried for the 6 PM Pacific snapshot; the current compact dashboard snapshot is stored in D1."
      },
      {
        "id": "privacy_data_retention",
        "status": "implemented",
        "enforcement_layer": "analytics_engine_platform_retention_and_snapshot_window",
        "implementation": [
          "src/worker.js: writeAnalyticsEngine",
          "src/founder-dashboard.js: refreshFounderDashboardSnapshots",
          "src/worker-entry.js: scheduled"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/worker-entry.test.js"
          ],
          "command": "node --test tests/worker-entry.test.js"
        },
        "machine_interfaces": [
          "/privacy",
          "/api/agent/v1/trust",
          "/api/agent/v1/security"
        ],
        "limitation": "Workers Analytics Engine telemetry follows the platform retention period. The Founder Pulse queries only the previous 24 hours and stores only the compact current snapshot in D1."
      },
      {
        "id": "mcp_read_only_boundary",
        "status": "implemented",
        "enforcement_layer": "registered_read_tools_and_delegated_get_routes",
        "implementation": [
          "src/mcp-server.js: buildAnalyticsMcpServer, delegatedRead"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/mcp-server.test.js"
          ],
          "command": "node --test tests/mcp-server.test.js"
        },
        "machine_interfaces": [
          "/mcp"
        ],
        "limitation": "No customer configuration, billing or ingestion mutations. Token last-used timestamps and coarse operational counters may update; readiness scanning makes public HTTPS requests."
      },
      {
        "id": "live_payment_test_prohibition",
        "status": "partial",
        "enforcement_layer": "operating_policy",
        "implementation": [
          "AGENTS.md",
          "src/agent-skill.js"
        ],
        "verification": {
          "method": "operating_policy_review",
          "test_files": [],
          "command": null
        },
        "machine_interfaces": [
          "/.well-known/skills/ai-agent-analytics/SKILL.md"
        ],
        "limitation": "Internal live-payment testing is prohibited by operating policy; the service cannot independently identify every internal caller."
      },
      {
        "id": "credential_revocation",
        "status": "implemented",
        "enforcement_layer": "revocation_predicates_and_scoped_updates",
        "implementation": [
          "src/credential-lifecycle.js",
          "src/agent-authorization.js: revokeAgentAuthorization, authenticateAgentAuthorization"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/credential-lifecycle.test.js",
            "tests/agent-authorization.test.js"
          ],
          "command": "node --test tests/credential-lifecycle.test.js tests/agent-authorization.test.js"
        },
        "machine_interfaces": [
          "/workspace/credentials/revoke",
          "/workspace/agent-authorizations/revoke"
        ],
        "limitation": "Revocation does not cancel a subscription or undo an in-flight request."
      },
      {
        "id": "owner_access_separation",
        "status": "implemented",
        "enforcement_layer": "cloudflare_access_jwt_verification_and_email_allowlist",
        "implementation": [
          "src/owner-access.js: authorizeOwnerRequest"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/owner-access.test.js",
            "tests/security-boundaries.test.js"
          ],
          "command": "node --test tests/owner-access.test.js tests/security-boundaries.test.js"
        },
        "machine_interfaces": [
          "/app"
        ],
        "limitation": "Application checks fail closed; external Cloudflare Access policy is not independently attested here."
      },
      {
        "id": "economic_evidence_integrity",
        "status": "partial",
        "enforcement_layer": "traffic_exclusions_and_settlement_stage_requirement",
        "implementation": [
          "src/classify.js: classifyTraffic",
          "src/metrics.js: deriveSixMetrics"
        ],
        "verification": {
          "method": "repository_regression_tests",
          "test_files": [
            "tests/metrics.test.js"
          ],
          "command": "node --test tests/metrics.test.js"
        },
        "machine_interfaces": [
          "/api/agent/v1/products/{id}/daily-pulse"
        ],
        "limitation": "External-agent classification and merchant revenue rely on authenticated merchant evidence, not independent identity or payment-provider verification."
      }
    ]
  },
  "abuse_controls": {
    "window_seconds": 60,
    "login_and_activation": "configured",
    "public_agent_planning": "configured",
    "readiness_scan": "configured",
    "machine_payment": "configured",
    "mcp": "configured",
    "ingestion": "configured",
    "identity_handling": "ingestion uses a portfolio-global capacity bucket; other authenticated controls hash credentials and unauthenticated controls hash the Cloudflare-provided client address without persisting raw identifiers"
  },
  "machine_interfaces": {
    "capabilities": "https://analytics.davisvillelabs.com/api/agent/v1",
    "trust_contract": "https://analytics.davisvillelabs.com/api/agent/v1/trust",
    "security_posture": "https://analytics.davisvillelabs.com/api/agent/v1/security",
    "mcp": "https://analytics.davisvillelabs.com/mcp",
    "oauth_protected_resource": "https://analytics.davisvillelabs.com/.well-known/oauth-protected-resource",
    "oauth_authorization_server": "https://analytics.davisvillelabs.com/.well-known/oauth-authorization-server",
    "openapi": "https://analytics.davisvillelabs.com/openapi.json",
    "agent_skill": "https://analytics.davisvillelabs.com/.well-known/skills/ai-agent-analytics/SKILL.md",
    "security_txt": "https://analytics.davisvillelabs.com/.well-known/security.txt"
  },
  "verification": {
    "public_claims_are_runtime_or_repository_backed": true,
    "known_limitations_are_published": true,
    "self_awarded_security_score": false,
    "public_agent_acquisition_signal_capture": "coarse route-stage counters only; no IP, URL, prompt, body, user-agent, or fingerprint stored by this instrumentation"
  },
  "known_limitations": [
    "Purchase approval authenticates server-issued exact terms, not a human identity or presence. A scripted client can imitate a browser confirmation; agents must not self-approve.",
    "HMAC approval signatures are verified by this service, not independently verifiable using a public key.",
    "MCP OAuth supports read-only authorization-code access with PKCE S256 and Client ID Metadata Documents; OAuth does not grant product creation, ingestion, billing or purchase authority.",
    "New aaa_ingest_ property credentials are write-only for telemetry ingestion. Legacy aaa_key_ credentials still permit property reads as well as ingestion until they are rotated, but neither credential class grants organization administration.",
    "Telemetry uses an allowlist, not semantic secret detection. Sensitive text placed in allowed metadata fields may be retained; merchants must minimize those fields.",
    "External-agent classification and merchant revenue rely on authenticated merchant evidence, not independent identity or payment-provider verification.",
    "Internal live-payment testing is prohibited by operating policy; the service cannot independently identify every internal caller.",
    "Source and CI references require repository access. This document is a publisher declaration, not an independent audit or deployment attestation.",
    "Readiness scanning verifies public A/AAAA records immediately before and after each target fetch, but cannot pin the connection itself to those addresses; DNS rebinding remains a residual limitation.",
    "Founder Pulse telemetry is written to Cloudflare Workers Analytics Engine during the day. Only the previous 24 hours are queried for the 6 PM Pacific snapshot; the current compact dashboard snapshot is stored in D1."
  ]
}