{"ok":true,"report":{"product":"Aqelya Bridge Preflight","created_at":"2026-09-23T18:52:32.161Z","source_title":"Sample Scheduling API","source_version":"1.0.0","analysis_scope":{"status":"in_scope","confidence":"high","evidence":["API title/description contains scheduling-domain language","GET /services","GET /team-members","POST /availability/search","POST /bookings"],"reason":"The specification contains direct scheduling-domain evidence for both availability and booking plus supporting service/resource semantics."},"target_protocol":{"name":"Universal Scheduling Protocol","version":"2026-08-20","status":"draft"},"score":86,"decision":"strong_candidate","findings":[{"id":"catalog","label":"Service catalog","weight":12,"score":12,"status":"pass","evidence":["GET /services"],"action":"Expose stable service identifiers, names, duration, price and policy metadata."},{"id":"resources","label":"Staff / resource model","weight":10,"score":10,"status":"pass","evidence":["GET /team-members"],"action":"Expose bookable staff/resources and service-resource eligibility."},{"id":"availability","label":"Real-time availability","weight":16,"score":16,"status":"pass","evidence":["POST /availability/search"],"action":"Provide a bounded availability query that returns source-authoritative bookable slots."},{"id":"booking_create","label":"Booking creation","weight":16,"score":16,"status":"pass","evidence":["POST /bookings"],"action":"Provide booking creation with deterministic validation, source-system confirmation and replay protection."},{"id":"booking_change","label":"Cancel / reschedule lifecycle","weight":10,"score":10,"status":"pass","evidence":["POST /bookings/{id}/cancel"],"action":"Expose explicit cancellation and rescheduling semantics with version/conflict handling."},{"id":"authentication","label":"Authentication model","weight":10,"score":5,"status":"partial","evidence":["Security scheme is defined but enforcement on privileged operations is not explicit"],"action":"Define scoped machine authentication and demonstrate enforcement on privileged operations."},{"id":"idempotency","label":"Idempotency / replay protection","weight":10,"score":5,"status":"partial","evidence":["POST /bookings"],"action":"Require a concrete idempotency header/parameter on create and mutation operations and persist results across retries."},{"id":"webhooks","label":"Event / webhook support","weight":8,"score":4,"status":"partial","evidence":["POST /webhooks/subscriptions"],"action":"Expose lifecycle events or a reconciled polling mechanism so out-of-band changes cannot silently drift."},{"id":"customer","label":"Customer / guest identity","weight":8,"score":8,"status":"pass","evidence":["POST /customers"],"action":"Define minimal customer identity requirements and keep PII out of agent/model context where possible."}],"blockers":[],"recommended_sequence":["Confirm source-system authentication, tenant boundaries and credential custody.","Map service catalog and staff/resources into normalized Bridge objects.","Map real-time availability, source-authoritative slot identifiers, time zones and durations.","Implement sandbox booking create/cancel/reschedule with durable idempotency and concurrency handling.","Normalize protocol errors, business outcomes and cursor pagination at the Bridge edge.","Add reconciliation/webhook verification and immutable mutation audit events.","Implement USP-Agent identity binding and request integrity controls before privileged production writes.","Run USP 2026-08-20 REST conformance and security regression before advertising production compatibility."],"mapped_capabilities":["Service catalog","Staff / resource model","Real-time availability","Booking creation","Cancel / reschedule lifecycle","Customer / guest identity"],"usp_migration_checks":[{"id":"usp_catalog","label":"USP service catalog mapping","requirement":"USP core requires machine-readable service catalog operations and stable service identifiers.","status":"source_native","source_evidence":["GET /services"],"bridge_action":"Map source services, durations, pricing, locations, policies and resource eligibility into USP Service objects."},{"id":"usp_availability","label":"USP availability mapping","requirement":"USP core requires bounded availability queries and authoritative bookable slot identifiers.","status":"source_native","source_evidence":["POST /availability/search"],"bridge_action":"Normalize source availability into USP slots, preserve source authority, and define date/time query limits."},{"id":"usp_booking","label":"USP booking lifecycle mapping","requirement":"USP core requires booking creation and a coherent post-confirmation lifecycle.","status":"source_native","source_evidence":["POST /bookings","POST /bookings/{id}/cancel"],"bridge_action":"Map create/retrieve/cancel/reschedule semantics and normalize business outcome errors."},{"id":"usp_https","label":"HTTPS transport","requirement":"USP REST endpoints must be served over HTTPS.","status":"review","source_evidence":[],"bridge_action":"Terminate USP traffic at an HTTPS-only Bridge edge even if the source spec omits a servers declaration."},{"id":"usp_json","label":"JSON media type","requirement":"USP REST operations use application/json payloads.","status":"review","source_evidence":[],"bridge_action":"Normalize source payloads to application/json at the Bridge edge."},{"id":"usp_auth","label":"Privileged-operation authentication","requirement":"Privileged USP operations must enforce an advertised authorization mechanism.","status":"bridge_required","source_evidence":[],"bridge_action":"Bind agent/platform identity to scoped Bridge authorization; never expose source credentials to the agent."},{"id":"usp_agent_header","label":"USP-Agent identity binding","requirement":"USP REST requests support the USP-Agent profile header; privileged requests bind presented authority to that profile.","status":"bridge_required","source_evidence":[],"bridge_action":"Implement USP-Agent parsing, trust/binding policy and mismatch rejection at the Bridge edge."},{"id":"usp_idempotency","label":"Idempotency and replay protection","requirement":"State-changing scheduling operations should support Idempotency-Key and safe replay behavior.","status":"bridge_required","source_evidence":[],"bridge_action":"Add durable idempotency storage and bind idempotency to the normalized mutation before source writes."},{"id":"usp_problem_details","label":"RFC 9457 protocol errors","requirement":"USP REST protocol errors use RFC 9457 Problem Details.","status":"bridge_required","source_evidence":[],"bridge_action":"Translate source transport/protocol failures into application/problem+json while preserving business outcome messages separately."},{"id":"usp_pagination","label":"Cursor pagination","requirement":"USP collection surfaces should support cursor-based pagination.","status":"review","source_evidence":[],"bridge_action":"Wrap source offset/page/list semantics behind stable cursor pagination where collection size requires it."},{"id":"usp_webhook_integrity","label":"Webhook integrity","requirement":"Implementations that emit USP webhooks must sign outbound webhook payloads.","status":"bridge_required","source_evidence":[],"bridge_action":"Verify source webhooks, then sign normalized outbound USP events at the Bridge edge."},{"id":"usp_time_semantics","label":"Time-zone and duration semantics","requirement":"Scheduling interoperability needs unambiguous start/end/duration and time-zone behavior.","status":"review","source_evidence":[],"bridge_action":"Define canonical timezone, DST and duration transforms and test edge cases across source locations."},{"id":"usp_concurrency","label":"Mutation concurrency","requirement":"Booking changes need deterministic conflict/version behavior when source state changes concurrently.","status":"bridge_required","source_evidence":[],"bridge_action":"Add version/ETag/source-revision checks or a deterministic conflict policy before update/cancel writes."},{"id":"usp_holds","label":"Temporary slot holds","requirement":"USP can advertise availability holds; only advertise them when the source or Bridge can enforce expiry safely.","status":"review","source_evidence":[],"bridge_action":"Do not advertise holds unless Bridge can reserve the source slot and enforce expiry without overselling."},{"id":"usp_correlation","label":"Request correlation","requirement":"Correlation is optional in USP but materially improves money-path and booking incident investigation.","status":"review","source_evidence":[],"bridge_action":"Add a Bridge correlation identifier across agent request, policy decision, source call and audit record."}],"usp_gap_count":6,"usp_review_count":6}}