generated: '2026-08-23'
method: derived
source: >-
  openapi/_original/juvenescence-content-openapi.yml, observed response headers from
  https://juvlabs.com/wp-json, and a search of juvlabs.com for published compliance or certification
  claims — all 2026-08-23
summary: >-
  The Juvenescence machine-readable surface is a WordPress content API. It conforms to a small set of
  generic web conventions and to none of the health-sector domain standards, which is the honest and
  expected result for a corporate CMS rather than a clinical data surface.
standards:
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses return a Link header carrying rel="next" / rel="prev"; observed on
    GET /wp/v2/posts?per_page=2.
- id: rfc9116-security-txt
  conforms: false
  evidence: GET https://juvlabs.com/.well-known/security.txt returned 404.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: GET https://juvlabs.com/.well-known/oauth-authorization-server returned 404.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme in the contract; the site index at https://juvlabs.com/wp-json/ returns
    "authentication": [].
- id: oidc
  conforms: false
  evidence: GET https://juvlabs.com/.well-known/openid-configuration returned 404.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are returned as application/json with the WordPress { code, message, data.status } envelope,
    not application/problem+json, and no problem-type URI registry is published.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header observed on any response.
- id: json-api
  conforms: false
  evidence: Responses are plain JSON resource objects with HAL-style `_links`; no JSON:API media type or envelope.
- id: hal
  conforms: partial
  evidence: >-
    Every resource carries a `_links` object with self / collection / about / author / replies /
    wp:featuredmedia / wp:term relations and a `curies` block — HAL-shaped hypermedia, but served as
    application/json rather than application/hal+json.
- id: oembed-1.0
  conforms: true
  evidence: >-
    GET /oembed/1.0/embed?url=https://juvlabs.com/ returned a valid oEmbed 1.0 rich response with
    version, provider_name "Juvenescence" and provider_url.
- id: pagination
  conforms: true
  evidence: >-
    Page-number pagination with page / per_page / offset, plus X-WP-Total and X-WP-TotalPages response
    headers.
- id: idempotency
  conforms: na
  evidence: Read-only API; no write surface and therefore no idempotency contract. See conventions/.
- id: cors
  conforms: true
  evidence: >-
    Access-Control-Allow-Headers and Access-Control-Expose-Headers are returned, exposing X-WP-Total,
    X-WP-TotalPages and Link to browser clients.
- id: llms-txt
  conforms: true
  evidence: >-
    https://juvlabs.com/llms.txt returns 200 with a 44 KB llms.txt generated by All in One SEO Pro
    v4.9.6.1, carrying the sitemap plus a linked, described index of every post and page. Saved
    verbatim to llms/juvenescence-llms.txt.
- id: a2a-agent-card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both returned 404 on juvlabs.com. The
    200s observed on ro5.ai are the blanket 301 to the juvlabs.com homepage and were rejected.
domain_standard:
  regime: health
  regime_basis: >-
    Matched on the Kin Score `health` regulatory regime, whose tag list includes "life sciences" and
    "pharma".
  declared: false
  candidates_probed:
  - id: fhir
    found: false
  - id: hl7-v2
    found: false
  - id: dicom
    found: false
  - id: smart-on-fhir
    found: false
  - id: us-core
    found: false
  - id: cds-hooks
    found: false
  evidence: >-
    No FHIR resource shape, HL7 message type, DICOM surface, SMART launch sequence or any other
    health-sector standard appears anywhere in the contract. The only machine-readable API
    Juvenescence exposes serves press releases, corporate pages and a media library; it is not a
    clinical, patient or research-data surface, so no domain standard applies. This check is
    reward-only, so nothing is invented to fill the slot.
  note: >-
    Juvenescence's actual domain identifiers do exist in the content — its publications reference DOIs
    such as 10.26434/chemrxiv-2023-gwm1s-v2 — but they appear as prose inside rendered post bodies,
    not as a declared identifier scheme in the contract. That is a content fact, not conformance, and
    is deliberately not counted here.
compliance_program:
  published: false
  certifications: []
  trust_center: null
  evidence: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim appears on juvlabs.com; trust.juvlabs.com does
    not resolve; probe-security-programs.py returned vdp=none trust=none. No `Compliance` and no
    `TrustCenter` pointer is emitted in apis.yml.
  note: >-
    Juvenescence is a clinical-stage drug developer, so its real regulatory posture is GxP and
    competent-authority clinical-trial oversight, which is not published as an API-facing compliance
    artifact and is not something this rubric can read.