generated: '2026-08-02'
method: derived
source: openapi/*.yml + conventions/perfect-day-conventions.yml + live probes on 2026-08-02
scope: >-
  Cross-cutting standards conformance for the WordPress REST API (wp/v2) behind perfectday.com. Each
  entry is derived from observed spec/route metadata or a live probe; absence of a standard is
  recorded honestly, not penalized. Perfect Day publishes no security or compliance program
  (no trust center, no security.txt, no named certifications were found), so NO `Compliance` and no
  `TrustCenter` pointer is emitted.
standards:
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme in any spec; the only scheme is HTTP Basic (WordPress application
    passwords). /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource
    both returned 404.
- id: oidc
  conforms: false
  evidence: No openIdConnect scheme; /.well-known/openid-configuration returned 404.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the flat WordPress error envelope (code / message / data.status), not
    application/problem+json. Observed on live 401 and 404 responses.
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses carry an RFC 8288 Link header with rel="next"/"prev" (observed on
    /wp/v2/posts), and item bodies include a _links object.
- id: pagination
  conforms: true
  evidence: >-
    Page-number pagination (page / per_page / offset) with X-WP-Total and X-WP-TotalPages response
    headers, exposed to browsers via Access-Control-Expose-Headers.
- id: idempotency
  conforms: false
  evidence: No idempotency-key header or parameter is exposed by any route.
- id: json
  conforms: true
  evidence: All operations negotiate application/json for request and response.
- id: openapi
  conforms: false
  evidence: >-
    Perfect Day publishes no OpenAPI document. The OpenAPI 3.1.0 documents in openapi/ were DERIVED
    by the API Evangelist pipeline from the site's own route metadata, not harvested from a
    provider-published spec.
- id: mcp
  conforms: partial
  evidence: >-
    A WordPress MCP Adapter endpoint is live at /wp-json/mcp/mcp-adapter-default-server, but
    anonymous initialize / tools/list return 401 rest_forbidden. Platform infrastructure, not a
    documented product MCP server.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both returned 404 (HTML body). No agent
    card is published; per pipeline policy none was authored.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404 on perfectday.com.
- id: rfc8615-well-known
  conforms: false
  evidence: No /.well-known document of any kind is served; see well-known/perfect-day-well-known.yml.
- id: llmstxt
  conforms: false
  evidence: >-
    /llms.txt returned 404. The llms/perfect-day-llms.txt in this repo is GENERATED by the pipeline,
    not published by Perfect Day.
- id: rss
  conforms: true
  evidence: https://perfectday.com/blog/feed/ returns 200 application/rss+xml.
- id: sitemaps-org
  conforms: true
  evidence: https://perfectday.com/sitemap_index.xml returns 200 and is declared in robots.txt.
- id: hsts
  conforms: false
  evidence: No Strict-Transport-Security header observed; see security/perfect-day-domain-security.yml.
- id: dnssec
  conforms: false
  evidence: No DNSSEC on perfectday.com; see security/perfect-day-domain-security.yml.
- id: spf
  conforms: true
  evidence: SPF record present on perfectday.com.
- id: dmarc
  conforms: true
  evidence: DMARC record present with policy `reject` on perfectday.com.
industry_standards:
- id: precision-fermentation-alliance
  conforms: true
  kind: industry-body membership (not an API standard)
  evidence: https://perfectday.com/precision-fermentation-alliance/ (HTTP 200)
- id: fda-gras
  conforms: unknown
  kind: regulatory
  evidence: >-
    Perfect Day's non-animal whey protein has been the subject of US FDA GRAS notices, but no
    certification document is published on perfectday.com that this pipeline fetched. Left unknown
    rather than asserted.
related:
- openapi/perfect-day-posts-openapi.yml
- conventions/perfect-day-conventions.yml
- well-known/perfect-day-well-known.yml
- security/perfect-day-domain-security.yml