Skip to main content

Production audit protocols

Each protocol has a bounded observation contract. None is a vanity subscore.

Recorded protocols, not a universal score

A network failure, an intentional training opt-out, a browser-only content deficit, and invalid JSON-LD are not interchangeable. The result keeps these observations separate, preserves unknowns, and derives a verdict only from required production protocols.

Evaluating us for your agency? See the plan →

Protocol 1

Direct HTTP acquisition

Records: HTTP status, final URL, bounded redirects, declared content type, byte length, selected response headers, and artifact hash.

Does not prove: That a provider used the same network path or accepted the page downstream.

Protocol 2

Robots.txt acquisition

Records: The public /robots.txt response as a separate, hashed policy artifact.

Does not prove: That an absent policy file caused a provider to crawl the site.

Protocol 3

Raw and rendered representation

Records: Distinct raw HTTP, rendered browser, and no-JavaScript browser artifacts with mechanical hashes and byte counts.

Does not prove: Semantic equivalence or a universal crawler representation.

Protocol 4

Main-content extraction

Records: Deterministic extraction outcomes, word counts (raw, rendered, and no-JavaScript), hashes, and material deficits. A material deficit blocker is recorded when the raw and no-JavaScript extractions each carry under half the rendered main-content words (rendered ≥ 100 words), suppressed only when computed containment (≥ 90% of the no-JavaScript capture’s distinct words present in the rendered extraction, same semantic main-content scope) shows the rendered growth is additive; where containment is not computed the deficit stands and the record states why. Script-injected additive material (for example translations) can still produce a deficit under this convention. Under protocol set 2.4.0 the protocol also records a block census over the sealed no-JavaScript and rendered captures — how many text blocks were preserved, added, removed, or rewritten, with their word counts — and where the added words sit relative to the page’s main-content region; when a comparison cannot be computed the record states why instead of a count.

Does not prove: Content quality, truth, usefulness, or universal language readability.

Protocol 5

Structured-data consistency

Records: JSON-LD parse diagnostics, schema types, raw availability, and bounded consistency for selected material string properties.

Does not prove: Eligibility, correctness of every property, rich-result display, or downstream use.

Protocol 6

Machine-readable dates

Records: Strict ISO dates, supported meta fields, JSON-LD dates, time elements, and HTTP Last-Modified evidence.

Does not prove: That undated content is stale or that a declared date is factually true.

Protocol 7

llms.txt acquisition

Records: The public /llms.txt response as a separate hashed artifact: presence, bounded byte length, media type, and the required title heading.

Does not prove: That any provider fetched, parsed, or used the file.

Protocol 8

Sitemap acquisition

Records: The public /sitemap.xml response as a separate hashed artifact: presence, bounded byte length, media type, document validity, listed URL count, newest lastmod, and whether the audited URL path was listed.

Does not prove: That automated consumers can reach the audited URL only through the sitemap, or that any system fetched it.

Protocol 9

Structured-data completeness

Records: Raw-versus-rendered schema type presence and bounded Organization identity fields (name, url, logo) as booleans, without storing property values.

Does not prove: That incomplete identity fields change how any system uses the markup, or that absent markup is a defect.

Protocol 10

Content negotiation

Records: What a markdown-representation request returned: the response content type and byte length as a hashed artifact.

Does not prove: That any provider requests or consumes markdown representations.

Protocol 11

Per-actor content extraction

Records: Per-crawler-token extracted content on the rendered page: word counts, SHA-256 hashes, and material divergences, one view per token.

Does not prove: That the site changed behavior for any provider, or why a divergence occurred.

Protocol 12

Crawler identity verification

Records: The boundary of what a synthetic probe can verify about crawler identity; no verification result is claimed in either direction.

Does not prove: That traffic claiming a crawler name is that vendor's crawler.

Protocol 13

Content structure facts

Records: Heading, list, and table tag counts plus fingerprint facts (empty headings, headings introducing no content, duplicate heading texts) from the rendered document. Counts only — never page text.

Does not prove: Content quality, or that structure improvements cause any outcome.

Protocol 14

Metadata signals

Records: Canonical tag presence and self-consistency plus same-hostname link counts from the rendered document. Counts only.

Does not prove: That canonical signals change how any system indexes the page.

Protocol 15

Opt-out semantics (meta robots, X-Robots-Tag, TDM-Rep)

Records: Site-declared opt-out signals for automated consumers: meta robots directives, X-Robots-Tag tokens, and the TDM-Rep reservation, recorded as declared.

Does not prove: That any system honors the declared signals or that the page is excluded anywhere.

Protocol 16

ai.txt policy file

Records: The /ai.txt policy file state: presence, bounded byte length, media type, and a shape verdict under the declared convention.

Does not prove: That any provider fetched, parsed, or honored the file.

Protocol 17

Structured-data property depth

Records: Which convention properties the supported structured-data types carry, as counts only — never property values.

Does not prove: That richer markup changes how any system reads or ranks the page.

Protocol 18

PDF text layer

Records: Whether an acquired PDF carries a machine-readable text layer and how much of it the bounded extractor reaches.

Does not prove: That any provider reads the document or what a reader makes of its contents.

Protocol 19

Site robots coverage

Records: How many inventoried sitemap pages the robots policy disallows for each AI crawler, with example URLs — counts only.

Does not prove: That any crawler honors or ignores the policy, or what appears in any system outputs.

Protocol 20

Web Bot Auth key directory

Records: Whether a vendor operator publishes a reachable Web Bot Auth key-directory endpoint — status, shape verdict, key count and payload hash.

Does not prove: Who is actually calling a site, or that any request was cryptographically signed.

Protocol 21

AIPREF signals

Records: The site-declared AIPREF preferences, parsed under a pinned draft vocabulary, plus cross-signal conflicts enumerated without preference.

Does not prove: That any system reads or honors the preferences.

Protocol 22

CDN default-block observation

Records: When a scan denial matches a CDN vendor-documented default-block class, with the dated vendor citation inside the finding.

Does not prove: That the CDN configuration applies to the audited site, or why any specific request was denied.

Protocol 23

AI-usage header policy

Records: Site-declared x-robots-tag AI tokens and TDM reservation headers read from the captured raw HTTP response for each audited actor.

Does not prove: That a provider honored the declared signals or that the headers constrain downstream use.

Protocol 24

Actor robots policy

Records: The matching group, longest applicable allow/disallow rule, actor purpose, and policy decision for the audited path.

Does not prove: Actual access, indexing, training, or compliance by the provider.

Protocol 25

Actor access probes

Records: One HTTP probe per documented AI actor carrying its vendor-published user agent: status, byte counts, classification, the literal request user agent, and the measurement vantage.

Does not prove: What the vendor's own crawlers experience from their own networks.

Execution state is part of the result

SUCCEEDED

The protocol completed and produced its required observation.

FAILED

The protocol failed with a typed cause and retryability state.

ABSTAINED

Inputs were present but insufficient for a defensible conclusion.

NOT APPLICABLE

The protocol does not apply to this representation or actor.

The verdict and the execution state are decided separately: an open production blocker makes the verdict FAIL even while some required checks never completed (execution state PARTIAL).

Protocol and Actor Counting Facts

Every cell derived from code at render (zero literals).

Protocol and actor counting facts derived dynamically from catalog and profile
DimensionCountBreakdown / Details
Registered Actors34Actors catalogued across all registered vendors
Evaluated Actors274 REQUIRED · 23 optional
HTTP Probed Actors13Synthetic network probe sent
Robots-Only Actors14Evaluated against robots.txt policy only
Protocols in Set25Discrete protocols in current production set
Total Executions6427 robots + 1 ai-usage + 13 probes + 1 control + 22 other
Finding Codes63Closed finding code registry entries

Counting gloss: Registered actors (34) catalogued across all registered vendors; Evaluated actors (27) evaluated in the current discovery profile (4 REQUIRED · 23 optional); Protocols in set (25) yield 64 total executions across per-actor evaluations (27 robots + 1 ai-usage + 13 probes + 1 control + 22 other).