# Platphorm Ready

> Canonical evidence-backed conformity, compliance, drift, legibility, and execution verification for PlatPhorm surfaces.

## Public resources
- Standard controls: /api/v1/controls
- Profile registry: /api/v1/profiles and /api/profiles
- Probe registry: /api/probes
- Test and assertion registry: /api/tests and /api/assertions
- Standard references: /api/standards
- Specialist adapter registry: /api/v1/adapters
- Adapter capability discovery is source-labeled and bounded: PlatPhorm registry, /.well-known/platphorm.json, MCP tools/list, OpenAPI, documented metadata, then configured fallback.
- UI/API/MCP capability parity is evaluated from a target's declared /.well-known/platphorm.json capabilities against observed OpenAPI operations, input/output shapes, auth, side effects, risk, errors, MCP tools/list, documentation routes, and safe live public behavior. Browser-mode runs also reconcile declared UI action labels with BrowserOps action/journey results; UI execution gaps remain UNKNOWN or UI_EXECUTION_DRIFT. Declared UI, browser action, and live coverage are surfaced as primary metrics and undeclared targets remain UNKNOWN.
- API surfaces also receive platphorm.api-conformity@1, comparing the available OpenAPI document with bounded live API routes, operation IDs, documented missing routes, undocumented live routes, anonymous auth boundaries, and response content types. Protected or mutating operations are not invoked automatically.
- Versioned assessment contracts: /api/v1/verification/contracts
- Verification plan: /api/v1/verification/plan
- Verification schema: /api/v1/verification/schema
- OpenAPI: /api/docs
- MCP: /api/mcp
- Self-assessment: GET /api/self-assessment (versioned alias: /api/v1/self-assessment; MCP: get_self_assessment). This is public, bounded, read-only evidence of Ready's own published routes, registries, and contracts.
- Migration comparison: POST /api/comparisons and GET /api/comparisons/{id}
- Network assessment: POST /api/network-assessments (also /api/v1/network/assessments) and GET /api/network-assessments/{id}; results include applicability-aware gap queries.
- Evidence graph: protected assessment evidence views return observations, source-preserving edges, non-averaged evidence clusters, scanner contributions, scanner coverage, and requirement coverage.

## Durable queue and history
The public dashboard exposes /queue and /completed. These pages show only scans submitted from the current browser requester: /api/v1/verification/ui/runs?view=queue reads queued/running D1 records and /api/v1/verification/ui/runs?view=completed reads completed/failed terminal records. Protected API clients can list durable run summaries with GET /api/v1/verification/runs?status=...&requested_by=...; MCP clients can use ready.verification.list. Full reports remain in R2 and are retrieved by run ID.

## URL verification
Submit a public HTTPS URL through the public UI, authenticated POST /api/assessments or /api/v1/verification/runs, the assess_surface MCP tool, or the platphormready CLI. Select scan_level QUICK, STANDARD, FULL, MIGRATION, REPOSITORY, or NETWORK; the plan explains local probes, specialist lanes, supplied evidence, repository/provider checks, browser sessions, bounded request estimates, exclusions, and whether execution is ready, conditional, or unsupported. NETWORK runs through protected POST /api/network-assessments or /api/v1/network/assessments (or ready.network.assess), discovers trusted targets from the canonical graph and sitemap index, and returns a parent/child result matrix plus applicability-aware network gap queries from GET /api/network-assessments/{id} or ready.network.get. The server invokes applicable specialist lanes with the server-side PLATPHORM_API_KEY. Retrieve asynchronous results with GET /api/assessments/{id}; use /api/assessments/{id}/result or ready.verification.result for the compact versioned result with test pass/fail states, readiness gates, receipts, and evidence references. Use GET /api/assessments/{id}/report?format=html for the protected escaped human report, or the public UI report route. Use idempotency_key to safely retry a submission. Repository evidence is API/MCP/CLI-only.

## Repository verification
Submit a GitHub owner/repository or GitHub URL through authenticated POST /api/v1/repository-assessments or the ready.repository.assess MCP tool. The server performs bounded source, open-source, developer-experience, dependency, workflow, and supply-chain checks. Raw source is never returned; only metadata, digests, derived checks, and honest unknowns are exposed.

## Federation
Requests and results use platphorm.assessment.request@1 and platphorm.assessment.result@1. Orchestration modes are AUTO, LOCAL_ONLY, SPECIALISTS_ONLY, and CONSUME_SUPPLIED. Results expose scanner health, coverage, provenance, bounded budgets, DAG lineage, reuse, receipt integrity, and honest unavailable states.
Assessment lifecycle events are accepted through the protected event API and MCP. Ingestion returns a durable storage_id; protected event retrieval and evidence replay do not refetch the target.

## Provider readiness
AGENT_PROVIDER and FULL can use server-side Vercel and Cloudflare read-only adapters. Pass provider_project, cloudflare_zone_id, or cloudflare_account_id only through API/MCP; provider tokens remain in Vercel.

## Control-plane trust
Targets at api.platphormnews.com receive explicit reliability evidence for degraded persistence/cache/export, trace acceptance and propagation, route/observability compliance, MCP metadata, registry counts, and integration/gateway state. Catalog integration checks health, protection enforcement, MCP methods, validation counts, freshness, and repository matches; stale catalog generation is degraded.

## Security model
Direct API and MCP mutations require PLATPHORM_API_KEY in the server environment. The dashboard uses a public dashboard and never asks the browser to handle or transmit the shared key. Private findings and credentials are never exposed in public discovery.