generated: '2026-08-29'
method: probed
source: >-
  Live fetches of shop.tamaramellon.com/.well-known/{openid-configuration,oauth-authorization-server,
  oauth-protected-resource} on 2026-08-29.
note: >-
  Every conformance below is inherited from the Shopify platform surface mounted on Tamara Mellon's
  storefront host, not from anything Tamara Mellon authored. No first-party contract exists to assert
  conformance against, and no compliance certification (SOC 2, ISO 27001, PCI, HIPAA) is published on
  any Tamara Mellon host, so no Compliance pointer is emitted.
standards:
- id: oauth2
  conforms: true
  evidence: >-
    RFC 8414 authorization server metadata served at
    https://shop.tamaramellon.com/.well-known/oauth-authorization-server (HTTP 200), declaring
    authorization_code + refresh_token grants and client_secret_basic/post client auth.
- id: oidc
  conforms: true
  evidence: >-
    OpenID Provider configuration at
    https://shop.tamaramellon.com/.well-known/openid-configuration (HTTP 200) with issuer, jwks_uri,
    RS256 id_token signing and the standard claim set.
- id: rfc9728
  conforms: true
  evidence: >-
    OAuth 2.0 Protected Resource Metadata at
    https://shop.tamaramellon.com/.well-known/oauth-protected-resource (HTTP 200), resource
    https://shop.tamaramellon.com, bearer_methods_supported ["header"].
- id: pkce
  conforms: true
  evidence: 'code_challenge_methods_supported: ["S256"] in the authorization server metadata.'
- id: rfc9457
  conforms: false
  evidence: No first-party API and no problem+json error surface published.
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI, Swagger, GraphQL SDL, AsyncAPI, Postman collection or .proto found on
    www.tamaramellon.com (all paths 404), tamaramellon.com, shop.tamaramellon.com (password-gated,
    401 on /products.json and /llms.txt) or the github.com/TamaraMellon organization (0 public repos).
domain_standards:
- id: ucp
  conforms: false
  evidence: >-
    The storefront robots.txt advertises Shopify's Universal Commerce Protocol discovery document at
    https://www.tamaramellon.com/.well-known/ucp and a UCP/MCP endpoint at
    https://www.tamaramellon.com/api/ucp/mcp. Both were probed on 2026-08-29 and both return HTTP 404,
    because the host they name no longer serves anything. Advertised, not served.