generated: '2026-09-11'
method: searched
source: https://www.lacuna.fm/.well-known/
host: https://www.lacuna.fm
note: 'Lacuna publishes an unusually complete discovery surface: RFC 9727 api-catalog, RFC 8414 authorization
  server metadata, RFC 9728 protected resource metadata, RFC 9116 security.txt, an A2A agent card, an
  MCP server card, and a non-standard but agent-oriented /auth.md registration guide. The api-catalog
  is the entry point that leads to the OpenAPI at /api/openapi.json. Every path below was re-probed on
  2026-09-11 and every status is unchanged from the August round. Two documents changed content: the
  authorization-server metadata gained a `revocation_endpoint` (RFC 7009), a
  `revocation_endpoint_auth_methods_supported` list, the private
  `urn:lacuna:params:oauth:grant-type:apple-assertion` grant type and an `agent_auth.revocation_uri`;
  and /auth.md was substantially rewritten and expanded. security.txt Expires rolls forward
  automatically (now 2027-09-11), so the document is self-maintaining rather than stale. Both refreshed
  copies are saved here.'
checked: '2026-09-11'
non_well_known:
- path: /auth.md
  status: 200
  content_type: text/markdown
  file: lacuna-auth.md
  changed_since: '2026-08-09'
  note: >-
    Agent credential-acquisition guide, linked from the authorization-server metadata
    `agent_auth.skill`. Rewritten and expanded since August: it now walks the flow as ordered steps,
    shows the verbatim 401 WWW-Authenticate challenge, lists jwks.json in the discovery table, documents
    the Apple-assertion grant and the RFC 7009 revocation step, adds key_revoked / key_expired /
    invalid_token / insufficient_scope to the error table, and states plainly that dynamic client
    registration, ID-JAG assertions and anonymous claim ceremonies are all unsupported.
- path: /llms.txt
  status: 200
  file: ../llms/lacuna-llms.txt
- path: /robots.txt
  status: 200
  file: lacuna-robots.txt
  note: 'Carries a Content-Signal header line — `Content-Signal: search=yes, ai-input=yes, ai-train=yes`
    — an explicit machine-readable AI usage preference. /api/*, /admin/*, /playground/*, /profile/* and
    /signin are disallowed.'
- path: /api/health
  status: 200
  content_type: application/json
  note: Health endpoint listed in the api-catalog `status` link. Returns {"status":"ok"}.
hosts:
- host: https://www.lacuna.fm
  documents:
  - path: /.well-known/api-catalog
    status: 200
    file: lacuna-api-catalog.json
    standard: RFC 9727
    content_type: application/linkset+json
  - path: /.well-known/security.txt
    status: 200
    file: lacuna-security.txt
    standard: RFC 9116
    content_type: text/plain
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: lacuna-oauth-authorization-server.json
    standard: RFC 8414
    content_type: application/json
    changed_since: '2026-08-09'
    change_note: Added revocation_endpoint (RFC 7009), revocation_endpoint_auth_methods_supported, the apple-assertion grant type, and agent_auth.revocation_uri.
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: lacuna-oauth-protected-resource.json
    standard: RFC 9728
    content_type: application/json
  - path: /.well-known/agent-card.json
    status: 200
    file: ../a2a/lacuna-agent-card.json
    standard: A2A 0.3.0
    content_type: application/json
  - path: /.well-known/mcp/server-card.json
    status: 200
    file: ../mcp/lacuna-mcp-server-card.json
    standard: MCP server card
    content_type: application/json
  - path: /.well-known/jwks.json
    status: 200
    standard: RFC 7517
  - path: /.well-known/openid-configuration
    status: 404
    standard: OpenID Connect Discovery
    note: 404 body is a Next.js HTML error shell, not a document.
  - path: /.well-known/ai-plugin.json
    status: 404
    note: 404 body is a Next.js HTML error shell, not a document.
x-shape-fix:
  converted: '2026-08-20'
  from: documents
  note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served
    .well-known surface recorded in any other shape scores as absent.