{
  "service": "AI Web Signals API",
  "status": "online",
  "version": "1.1.0",
  "endpoints": {
    "health": "/health",
    "scanner_app": "/app",
    "scan": "/scan?domain=example.com",
    "report": "/report?domain=example.com",
    "stored_report": "/report/{scan_id}",
    "history": "/history?domain=example.com&limit=10",
    "monitoring": "/monitoring?domain=example.com",
    "monitoring_configuration_create": "/monitoring/configurations",
    "monitoring_configuration_manage": "/monitoring/configurations/{config_id}"
  },
  "public_api": {
    "presentation_version": "1",
    "history_version": "4",
    "change_version": "1",
    "insight_version": "1",
    "history_scope_version": "1",
    "history_scope": "exact_requested_url",
    "browser_origins": [
      "https://aiwebsignals.com",
      "https://www.aiwebsignals.com"
    ],
    "scanner_app_path": "/app",
    "monitoring_version": "2",
    "monitoring_config_version": "1",
    "vantage_observation_version": "1",
    "corroboration_interface_version": "1",
    "corroboration_endpoint": "/corroboration/{scan_id}",
    "scheduler_security_version": "1",
    "public_write_abuse_version": "1",
    "network_security_version": "1",
    "execution_authorization_version": "1",
    "claim_idempotency_version": "1",
    "execution_budget_version": "1",
    "final_execution_recheck_version": "1",
    "due_work_version": "1",
    "scheduler_runner_version": "2",
    "execution_finalization_version": "1",
    "execution_result_linkage_version": "1",
    "scheduled_scan_persistence_version": "1",
    "scheduler_activation_version": "3",
    "production_monitoring_policy_version": "1",
    "alert_intelligence_version": "1",
    "alert_aware_scheduler_version": "1",
    "monitoring_alert_history_endpoint": "/monitoring/configurations/{config_id}/alerts",
    "notification_preferences_version": "1",
    "monitoring_notification_preferences_endpoint": "/monitoring/configurations/{config_id}/notifications",
    "browser_secure_storage_version": "1",
    "report_intelligence_version": "1"
  },
  "persistence": {
    "schema_version": "3",
    "table": "report_scans",
    "monitoring_config_table": "monitoring_configs",
    "domain_scan_cooldown_seconds": 60,
    "history_default_limit": 10,
    "history_max_limit": 50,
    "history_scope": "exact_requested_url",
    "monitoring_configuration_persistence": true,
    "monitoring_management_token_storage": "sha256_hash_only",
    "monitoring_management_token_revoked_on_delete": true,
    "stores_page_bodies": false,
    "stores_requester_identity": false
  },
  "corroboration": {
    "authenticated": true,
    "authentication_methods": [
      "github_actions_oidc",
      "optional_shared_secret"
    ],
    "github_oidc_audience": "aiwebsignals-corroboration-v1",
    "persistence": false,
    "scoring_effect": "none_contract_only"
  },
  "public_write_abuse_control": {
    "public_write_abuse_version": "1",
    "enforced": true,
    "fail_closed": true,
    "policy": {
      "edge_requests_per_minute": 6,
      "global_accepted_creations_per_hour": 60,
      "maximum_live_configurations": 1000,
      "maximum_live_configurations_per_target": 5,
      "request_body_max_bytes": 8192,
      "quota_retention_hours": 48,
      "stores_requester_identity": false,
      "actor_key_storage": "cloudflare_rate_limit_binding_only_sha256",
      "quota_scope": "global_and_exact_requested_url"
    },
    "edge_rate_limiter_configured": true,
    "persistent_quota_database_configured": true
  },
  "network_ssrf_tocou": {
    "network_security_version": "1",
    "gate": "network_ssrf_tocou",
    "enforced": true,
    "fail_closed": true,
    "platform_boundary": "cloudflare_global_fetch_strictly_public",
    "application_boundary": "public_dns_before_and_after_every_outbound_hop",
    "policy": {
      "strict_public_global_fetch_required": true,
      "direct_ip_targets_allowed": false,
      "custom_ports_allowed": [
        80,
        443
      ],
      "private_hostname_suffixes_blocked": true,
      "dns_preflight_each_hop": true,
      "dns_post_response_revalidation_each_hop": true,
      "redirects_manual_and_revalidated": true,
      "maximum_redirects_bounded": true,
      "request_timeout_bounded": true,
      "response_bytes_bounded": true,
      "connection_ip_override_used": false,
      "raw_tcp_origin_fetch_used": false
    },
    "note": "The application does not claim to pin the origin connection to a DNS preflight address. Instead, unattended fetches require Cloudflare public-only egress plus fail-closed public DNS validation on both sides of each hop."
  },
  "execution_authorization": {
    "execution_authorization_version": "1",
    "policy_version": "1",
    "ready": true,
    "fail_closed": true,
    "policy": {
      "default_state": "denied_absent_authorization",
      "user_enabled_is_authorization": false,
      "public_mutation_allowed": false,
      "authorization_owner": "server_policy",
      "scheduler_requires_enabled_configuration": true,
      "scheduler_requires_explicit_authorization": true
    },
    "persistence": {
      "database_configured": true,
      "schema_ready": true,
      "table": "monitoring_execution_authorizations"
    },
    "public_grant_endpoint": false,
    "public_revoke_endpoint": false
  },
  "claim_and_idempotency": {
    "claim_idempotency_version": "1",
    "ready": true,
    "fail_closed": true,
    "policy": {
      "lease_seconds": 600,
      "lease_renewal_allowed": false,
      "one_active_lease_per_configuration": true,
      "deterministic_execution_key": true,
      "completed_execution_reclaim_allowed": false,
      "expired_lease_recovery_allowed": true,
      "public_claim_endpoint": false,
      "public_complete_endpoint": false,
      "public_release_endpoint": false
    },
    "persistence": {
      "database_configured": true,
      "schema_ready": true,
      "lease_table": "monitoring_execution_leases",
      "execution_run_table": "monitoring_execution_runs"
    }
  },
  "bounded_execution_budget": {
    "execution_budget_version": "1",
    "ready": true,
    "fail_closed": true,
    "scheduler_execution_enabled": false,
    "policy": {
      "max_targets_per_invocation": 10,
      "max_parallel_scans": 2,
      "max_attempts_per_target": 1,
      "max_scheduler_retry_attempts_per_target": 0,
      "per_target_wall_time_ms": 45000,
      "invocation_wall_time_ms": 240000,
      "minimum_remaining_ms_to_start_target": 15000,
      "per_request_timeout_ms": 5000,
      "max_redirects_per_request": 5,
      "max_sitemaps_to_fetch": 5,
      "max_bounded_body_bytes_per_target": 13631488,
      "task_abort_signal_required": true,
      "over_budget_behavior": "fail_closed",
      "retry_policy": "no_scheduler_retry"
    },
    "invariants": {
      "invocation_budget_below_cloudflare_cron_wall_limit": true,
      "invocation_budget_below_execution_lease": true,
      "scheduler_retries_disabled": true,
      "bounded_network_reads_inherited_from_scanner": true
    }
  },
  "disabled_deleted_recheck": {
    "final_execution_recheck_version": "1",
    "ready": true,
    "fail_closed": true,
    "scheduler_execution_enabled": false,
    "policy": {
      "required_after_claim": true,
      "required_immediately_before_network_execution": true,
      "single_database_snapshot": true,
      "require_configuration_present": true,
      "require_configuration_not_deleted": true,
      "require_configuration_enabled": true,
      "require_automated_cadence": true,
      "minimum_automated_interval_hours": 24,
      "require_current_server_authorization": true,
      "require_exact_current_lease": true,
      "require_unexpired_lease": true,
      "fail_closed": true,
      "public_recheck_endpoint": false
    },
    "dependencies": {
      "database_configured": true,
      "authorization_and_claim_state_ready": true
    },
    "invariants": {
      "fresh_snapshot_after_claim": true,
      "deleted_rows_are_observed_and_denied": true,
      "disabled_rows_are_denied": true,
      "revoked_or_stale_authorization_is_denied": true,
      "replaced_or_expired_lease_is_denied": true,
      "manual_only_cadence_is_denied": true
    },
    "public_recheck_endpoint": false
  },
  "scheduler_security": {
    "scheduler_security_version": "1",
    "scheduler_execution_allowed": false,
    "blocking_gate_count": 0,
    "policy": {
      "execution_enabled": false,
      "cron_trigger_configured": true,
      "notification_delivery_enabled": false,
      "minimum_automated_interval_hours": 24,
      "maximum_targets_per_invocation": 10,
      "maximum_parallel_scans": 2
    },
    "gates": [
      {
        "key": "public_write_abuse_control",
        "status": "pass",
        "blocking": true,
        "requirement": "Apply abuse controls before anonymous monitoring configurations can create background work.",
        "rationale": "Anonymous configuration creation is protected by an edge burst limiter plus fail-closed persistent global and target-capacity quotas without storing requester identity."
      },
      {
        "key": "network_ssrf_tocou",
        "status": "pass",
        "blocking": true,
        "requirement": "Bind unattended network execution to public-only egress and validate public DNS immediately before and after every outbound hop.",
        "rationale": "Worker egress uses Cloudflare strict-public global fetch, direct IP/private targets remain rejected, every redirect hop is validated before fetch, and each established response is followed by a second fail-closed public-DNS validation."
      },
      {
        "key": "execution_authorization",
        "status": "pass",
        "blocking": true,
        "requirement": "Separate a user's persisted monitoring preference from server authorization to execute background scans.",
        "rationale": "User-controlled enabled state is not execution authority. A separate server-owned authorization record defaults absent configurations to denied, has no public grant/revoke endpoint, and eligibility requires both enabled=true and current server-policy authorization."
      },
      {
        "key": "claim_and_idempotency",
        "status": "pass",
        "blocking": true,
        "requirement": "Require atomic due-work claiming, bounded leases, expiry recovery, and deterministic execution keys before scheduled execution.",
        "rationale": "D1 transactional batch claims enforce one active lease per configuration, completed deterministic execution keys cannot be reclaimed, expired leases can be recovered, and claim/complete/release primitives have no public endpoints."
      },
      {
        "key": "bounded_execution_budget",
        "status": "pass",
        "blocking": true,
        "requirement": "Enforce hard per-run target, concurrency, timeout, and retry budgets.",
        "rationale": "The scheduler execution envelope caps each invocation at 10 targets and 2 concurrent scans, permits one attempt per target with no scheduler retries, applies per-target and invocation wall-time deadlines, and inherits bounded request, redirect, and body-read limits from the scanner."
      },
      {
        "key": "disabled_deleted_recheck",
        "status": "pass",
        "blocking": true,
        "requirement": "Re-read job state immediately before execution and skip disabled, deleted, deauthorized, manual-only, stale-lease, or otherwise ineligible configurations.",
        "rationale": "Immediately before any unattended network request, a fresh D1 snapshot must confirm the configuration remains enabled and undeleted, retains current server-policy authorization, uses an automated cadence, and is still owned by the exact unexpired execution lease."
      },
      {
        "key": "notification_boundary",
        "status": "pass",
        "blocking": false,
        "requirement": "Keep outbound notification delivery disabled while scheduler execution is being validated.",
        "rationale": "v0.2.7 does not send email, SMS, webhook, or push notifications."
      },
      {
        "key": "management_token_hygiene",
        "status": "pass",
        "blocking": false,
        "requirement": "Continue one-time capability-token return, SHA-256 hash-only persistence, and verifier revocation on delete.",
        "rationale": "This behavior remains a release invariant from v0.2.5."
      }
    ]
  },
  "monitoring": {
    "scheduled_scans": false,
    "schedule_execution": false,
    "notification_delivery": false,
    "scheduler_execution_allowed": false,
    "due_work_calculation_ready": true,
    "scheduler_runner_ready": true,
    "durable_execution_result_recovery_ready": true,
    "scheduler_activation_controller_ready": true,
    "scheduler_execution_flag_enabled": true,
    "scheduler_database_control_enabled": false,
    "scheduler_execution_gates_open": false,
    "cron_trigger_configured": true,
    "cron_expression": "*/10 * * * *",
    "production_monitoring_admission": true,
    "scheduler_runtime_validated": true
  },
  "due_work": {
    "due_work_version": "1",
    "ready": true,
    "scheduler_execution_enabled": false,
    "cron_trigger_configured": true,
    "policy": {
      "minimum_interval_hours": 24,
      "maximum_candidates_per_invocation": 10,
      "manual_retry_is_automated": false,
      "requires_current_server_authorization": true,
      "active_lease_is_due": false,
      "cadence_anchor": "max(last_enabled_or_created, latest_completed_due_slot)",
      "advances_on_completed_due_slot_not_completion_time": true,
      "scheduler_execution_enabled": false,
      "cron_trigger_configured": true
    }
  },
  "scheduler_runner": {
    "scheduler_runner_version": "2",
    "ready": true,
    "automatic_invocation_enabled": false,
    "cron_trigger_configured": false,
    "public_endpoint": false,
    "policy": {
      "public_endpoint": false,
      "cron_trigger_configured": false,
      "automatic_invocation_enabled": false,
      "requires_due_work_selection": true,
      "requires_atomic_claim": true,
      "requires_durable_result_reservation": true,
      "recovery_checked_before_network_execution": true,
      "requires_final_recheck": true,
      "requires_execution_budget": true,
      "maximum_parallel_targets": 2,
      "maximum_targets_per_invocation": 10,
      "scheduler_retries_per_target": 0,
      "failure_releases_lease": true,
      "success_completes_execution_key": true,
      "conditional_lease_finalization": true,
      "persisted_result_prevents_rescan_after_crash": true
    }
  },
  "execution_result_linkage": {
    "execution_result_linkage_version": "1",
    "ready": true,
    "public_endpoint": false,
    "policy": {
      "deterministic_execution_key_primary_key": true,
      "preallocated_scan_id_unique": true,
      "reservation_required_before_network_execution": true,
      "persisted_report_recovery_before_rescan": true,
      "public_endpoint": false,
      "fail_closed": true
    },
    "database_configured": true,
    "schema_ready": true,
    "recovery_ready": true
  },
  "scheduler_activation": {
    "scheduler_activation_version": "3",
    "ready": true,
    "execution_flag_enabled": true,
    "database_control_enabled": false,
    "database_control_required": true,
    "production_trigger_configured": true,
    "blocked_heartbeat_persistence": true,
    "public_activation_endpoint": false,
    "expected_cron_expression": "*/10 * * * *",
    "wake_interval_minutes": 10,
    "single_flight_lock_seconds": 300,
    "invocation_wall_time_ms": 240000,
    "notifications_enabled": false,
    "database_configured": true,
    "schema_ready": true,
    "activation_controller_ready": true,
    "execution_gates_open": false
  },
  "production_monitoring": {
    "production_monitoring_policy_version": "1",
    "ready": true,
    "fail_closed": true,
    "policy": {
      "authorization_owner": "server_policy",
      "authorization_policy_version": "1",
      "automatic_cadences": [
        "daily",
        "weekly"
      ],
      "minimum_interval_hours": 24,
      "public_grant_endpoint": false,
      "public_revoke_endpoint": false,
      "user_enabled_is_authorization": false
    },
    "scheduler_runtime_validated": true,
    "scheduler_execution_flag_enabled": true,
    "scheduler_database_control_enabled": false,
    "scheduler_execution_gates_open": false,
    "notification_delivery_enabled": false
  },
  "alert_intelligence": {
    "version": "1",
    "runtime_ready": true,
    "schema_ready": true,
    "scheduled_scan_evaluation": true,
    "durable_alert_history": true,
    "alert_states": [
      "open",
      "acknowledged",
      "resolved"
    ],
    "notification_delivery_enabled": false
  },
  "notification_preferences": {
    "version": "1",
    "runtime_ready": true,
    "schema_ready": true,
    "supported_minimum_priorities": [
      "high",
      "critical"
    ],
    "external_delivery_enabled": false,
    "contact_destination_storage_enabled": false,
    "channels": {
      "in_app": true,
      "email": false,
      "webhook": false,
      "push": false
    }
  },
  "browser_secure_storage": {
    "version": "1",
    "usebetter_secure_store_version": "1",
    "guest_device_vault": true,
    "algorithm": "AES-256-GCM",
    "key_extractable": false,
    "key_usages": [
      "encrypt",
      "decrypt"
    ],
    "key_storage": "IndexedDB structured-cloned CryptoKey",
    "record_storage": "IndexedDB ciphertext",
    "per_write_iv_bytes": 12,
    "authenticated_context": [
      "format_version",
      "namespace",
      "record_key"
    ],
    "plaintext_browser_mirror": false,
    "legacy_sensitive_browser_datasets": 0,
    "cloud_backup_enabled": false,
    "multi_device_sync_enabled": false
  },
  "report_intelligence": {
    "version": "1",
    "mode": "deterministic_presentation_only",
    "separates_observation_interruptions": true,
    "comparable_regression_evidence": true,
    "ranked_next_actions": true,
    "scoring_effect": "none",
    "alert_candidacy_effect": "none",
    "scheduler_effect": "none",
    "notification_delivery_effect": "none"
  },
  "growth": {
    "version": "1",
    "landing_path": "/ai-readiness",
    "sitemap_path": "/sitemap.xml",
    "analytics": "google_tag_manager",
    "analytics_payload_policy": "categorical_no_target_or_capability_values"
  }
}