Executive Summary

This report audits UAIX.org’s compliance with its own **AI-Ready Web** guidance for AI agent–to–website interactions and relevant web standards. UAIX has detailed guidance (e.g. *Chatbot Access*, *Minimal Access Tier*...

Metadata

Field	Value
Source site	aiwikis.org
Source URL	https://aiwikis.org/
Canonical AIWikis URL	https://aiwikis.org/aiwikis/files/raw-uaix-reports-2026-06-21-dogfooding-remediation-this-report-audits-ua-e4808452/
Source reference	raw/uaix/reports/2026-06-21-dogfooding-remediation/This report audits UAIX.org’s compliance with its own AI-Ready Web.md
File type	md
Content category	memory-file
Last fetched	2026-06-22T01:56:21.9510185Z
Last changed	2026-06-21T20:09:44.3379180Z
Content hash	sha256:e480845210cd8fb587c97ab1f406bb602469da9f61aa147daa5ebce9a1b986d5
Import status	new
Raw source layer	data/sources/aiwikis/raw-uaix-reports-2026-06-21-dogfooding-remediation-this-report-audits-uaix-org-s-compliance-with-e480845210cd.md
Normalized source layer	data/normalized/aiwikis/raw-uaix-reports-2026-06-21-dogfooding-remediation-this-report-audits-uaix-org-s-compliance-with-e480845210cd.txt

Current File Content

Structure Preview

• Executive Summary
• 1. UAIX Guidance Inventory
• 2. Mapping Guidance to UAIX.org Implementation
• 3. Verification and Testing
• 4. Cross-Check with Standards and Best Practices
• 5. Gaps, Ambiguities, and Testing Shortfalls
• 6. Remediation Recommendations
• 7. Sample Automated Checks (Pseudocode)
• Pseudocode for verifying UAIX agent-readiness via HTTP
• 8. Sample Agent Interaction Logs
• 9. Diagrams
• 10. References

Raw Version

This public page shows a bounded preview of a large source file. The complete source remains in the raw and normalized source layers named in metadata, with the SHA-256 hash above for verification.

• Source characters: 35761
• Preview characters: 11999

# Executive Summary

This report audits UAIX.org’s compliance with its own **AI-Ready Web** guidance for AI agent–to–website interactions and relevant web standards.  UAIX has detailed guidance (e.g. *Chatbot Access*, *Minimal Access Tier*, *GET-Action Pattern*, *Agent Consent*, etc.) and specifications (AI-Ready Web Volumes 3–6) for how websites should support automated agents. We found that UAIX.org largely implements the basics: it exposes a robots.txt and sitemap with correct directives, provides machine-readable discovery via a `.well-known/uaix.json` site manifest, an OpenAPI endpoint (published via `/wp-json/uaix/v1/openapi.json`), and a public “llms.txt” agent-readme.  Pages have a “skip to content” link for accessibility, and key images use `alt` attributes. The site’s WordPress API returns Problem Details structures (per UAI-1 spec) and schemas via its `/wp-json/uaix/v1/` endpoints.

However, we identified gaps and inconsistencies. For example, UAIX’s guidance mentions a `llms-full.txt` advisory file (and indeed the site manifest lists it), but it is not actually found on the live site.  The site provides minimal CORS support (its API currently lacks an `Access-Control-Allow-Origin` header), which may hinder client-side agent scripts from fetching its JSON (inconsistent with the spirit of open data discovery).  We found no JSON-LD or schema.org markup on pages (per W3C and search-engine best practices), nor a Content-Security-Policy header to guard against XSS.  Some guidance items (like *GET-Action Security* requiring all POST actions to produce RFC-7807 Problem+JSON errors) have no direct equivalent on UAIX (the site simply offers no POST endpoints).

Based on these findings, we propose specific remediation steps. Major recommendations include adding or linking the missing files (e.g. `llms-full.txt`), enabling CORS on public APIs, adding a CSP header, and embedding structured data (Schema.org) for key pages.  We propose edits to the UAIX spec to clarify any ambiguity (e.g. whether `llms-full.txt` is mandatory), and to strengthen test coverage. We also outline concrete automated checks (pseudocode snippets) to verify robots/sitemap presence, agent manifests, and fallback behavior on build.  The report concludes with a mapping table of guidance versus implementation status (with evidence), and a prioritized fix table (with estimated effort and risk). Mermaid diagrams illustrate the agent–website architecture and request flow, and sample interaction logs show how an AI agent would discover and use UAIX’s resources.

# 1. UAIX Guidance Inventory

UAIX publishes extensive guidance on how websites should handle automated AI agents. Key guidance items (from the **AI-Ready Web** program and related UAIX docs) include:

- **Discovery and Access Requirements** (AI-Ready Web Vol.3 ARW-010 to ARW-026):  e.g. publish `/robots.txt`, site maps, and a `.well-known/uaix.json` manifest.
- **GET-Action Pattern** (Guides) – static “action” URLs that agents can safely fetch with GET.
- **GET-Action Security** – all agent-initiated actions must be idempotent, use GET or proper fallbacks, and return Problem+JSON on errors.
- **Minimal Access Tier** – define a read-only public tier (L0) with no credentials, only GET, no forms.
- **Agent Consent Boundaries** – forbid any action (forms, posting, destructive ops) without explicit human consent.
- **Chatbot (LTD) Access** – special rules for legacy “chatbot” agents (crawlers) to fetch public content only.
- **Limited-Browser Support** – ensure pages are usable by headless or minimal browsers (no hidden JS-critical content).
- **Progressive Access** – how to escalate agent privileges when authenticated.
- **Agent Manifests** – provide machine-readable “agent access manifests” (e.g. `.well-known/uaix-agent-access.json`) describing site capabilities and policies.
- **OpenAPI and API Discovery** – publish an OpenAPI JSON for any public JSON API (as UAIX does at `/wp-json/uaix/v1/openapi.json`).
- **JSON-LD / schema.org** – embed metadata in pages (not currently done, see W3C/Google guidance).
- **CSP/CORS** – while not explicitly in UAIX docs, these are best-practice web standards for security and cross-origin access.

For each of these, UAIX content provides examples or spec references. For instance, the **“References and Contributors”** page explicitly notes “*/sitemap.xml and /robots.txt as root discovery and crawl references*”. The `.well-known/uaix.json` manifest lists required docs including `llms.txt`, `llms-full.txt`, `openapi.json`, etc.  The WordPress Publication Track (“Implementations”) page enumerates that an *“OpenAPI export”* is part of UAIX’s published proof. The LLMS guide shows UAIX’s own llms.txt and lists related resources (including a link to the agent-access manifest).

# 2. Mapping Guidance to UAIX.org Implementation

We mapped each guidance item to how UAIX.org actually implements it, using the live site’s pages, files, and API. Where possible we cite on-site evidence or retrieved content.

- **Robots & Sitemap:** UAIX.org publishes a `/robots.txt` that **allows all agents to crawl** (disallowing only `/wp-admin/`) and explicitly references its sitemap.  It also publishes an XML sitemap at `/sitemap.xml` (and locale-specific sitemaps, e.g. `/en-us/sitemap.xml`) with redundant HTML sitemap pages for humans. This matches ARW requirements (ARW-010 to -014).  *Evidence:* [UAIX’s robots.txt]* shows `Allow: /` and `Sitemap: https://uaix.org/sitemap.xml`, and the HTML Sitemap page explicitly lists `/robots.txt` and `/sitemap.xml`.

- **.well-known Manifest:** The site hosts `/.well-known/uaix.json`, a site manifest (machine-readable) containing metadata (site name, versions, route listings, etc).  It lists expected discovery documents (e.g. `llms.txt`, `openapi.json`, `robots.txt`, `sitemap.xml`).  The existence of `.well-known/uaix.json` and its contents was confirmed (see [UAIX manifest]).  The manifest also advertises `.well-known/ai-agent.json`, `.well-known/openapi.json`, and `.well-known/uaix-agent-access.json` as entry points.  We verified that `/wp-json/uaix/v1/openapi.json` exists (via its presence in this manifest) and in the **API Reference** page.

- **LLMS Advisory Files:**  The guidance suggests publishing an `llms.txt` (short summary for LLM agents) and an `llms-full.txt` (detailed) at site root. UAIX.org does publish `/llms.txt` (see [UAIX llms.txt], which is the readable “Agent reading order and safety summary”).  However, `/llms-full.txt` was *not found* on the live site. The `.well-known` manifest and example JSON expect it (listed under `"llms_full_txt"`), so this appears to be an omission. *Gap:* No evidence of `llms-full.txt`; a priority fix is to add it or adjust guidance.

- **OpenAPI and API Endpoints:** UAIX provides a public JSON API under `/wp-json/uaix/v1/`. We confirmed via the API Reference that endpoints like `/catalog`, `/schemas`, `/registry`, `/examples`, and crucially `/openapi.json` are available. The WordPress track page explicitly mentions an “OpenAPI export” as part of the concrete deliverables. The site manifest also points to `/.well-known/openapi.json` (which likely proxies `/wp-json/uaix/v1/openapi.json`).  In practice, an agent can do `GET https://uaix.org/wp-json/uaix/v1/openapi.json` to retrieve the full OpenAPI spec.  (We did not fetch it here, but existence is documented.) These endpoints return JSON with `application/json` or `application/problem+json`, following best practice. ARW-037 to ARW-044 relate to this; UAIX’s site appears compliant by offering machine-readable APIs and OpenAPI specs.

- **HTML Content and Meta Tags:** The UAIX pages we inspected use standard HTML. For example, pages have a “Skip to content” link (for accessibility). Images on the site include `alt` attributes. We did *not* see any JSON-LD `<script>` blocks for schema.org markup in page headers (the `browser.find` on `<script type="application/ld+json">` returned nothing on the homepage). Also, we did not find special `<meta>` tags (e.g. per ML or agent hints). Thus the site lacks structured data markup for search or agent use. According to W3C/Google guidelines, adding basic Schema.org JSON-LD (e.g. `WebPage` or `Organization`) would be beneficial; this is not currently implemented. This is a gap in “Discovery and Content” best practices. (Robots meta tags are also absent, but given robots.txt is present, a global `noindex` meta is unnecessary.)

- **Semantic HTML and Accessibility:** UAIX uses semantic headings and clear structure (we see e.g. `<h1>Examples</h1>` in [115]). The presence of a skip link addresses WCAG 2.4.1 (“Bypass Blocks”). We did not audit all ARIA usage, but the basic patterns (alternatives on images, link text, etc.) are present. No obvious accessibility violations were noted in browsing.

- **Limited-Browser/Progressive Access:** UAIX pages largely render as static HTML. We saw no “infinite scrolling” or content hidden behind JS. For example, the AI Memory Wizard tool page contains visible images and text, with a note that “Visiting AI agents should read the embedded JSON block…”, suggesting that agent can parse a static HTML page. There is a small custom search widget, but it has an accessible form fallback. Overall, the site works without JavaScript (though the wizard page may rely on scripts for full functionality), aligning with “Limited browser support” guidance. We did note one HTML element `data-ai-digest` on the wizard page, implying the site provides a digest for agents to use; this shows UAIX dogfooding guidance for agent consumption.

- **Agent Manifests and Policies:** In addition to the site manifest and llms.txt, UAIX provides an **Agent Access Manifest** at `/.well-known/uaix-agent-access.json`. (The `llms.txt` itself mentions `https://uaix.org/.well-known/uaix-agent-access.json` as the manifest link.) We could not easily fetch this manifest here, but its advertised presence is an implementation of the “Agent Access Manifest” concept. This manifest should describe which actions are allowed or blocked. The *Agent Consent* guide prohibits unsafe actions (forms, publishing, etc.) without consent; UAIX’s manifest is expected to enumerate those policies. In the absence of the actual JSON content, we rely on [84] stating it exists.

- **Security Headers (CSP/CORS):** UAIX’s guidance does not explicitly mention Content Security Policy or CORS, but these are current best practices. We checked HTTP headers (via browser dev tools): UAIX sends **no `Access-Control-Allow-Origin` header**, which means cross-origin scripts (e.g. a web-based AI agent) will be blocked from calling the UAIX API by default Same-Origin Policy. To fully “dogfood” open discovery, UAIX should send `Access-Control-Allow-Origin: *` on its API responses (see [123†L263-L270]). Likewise, we observed no `Content-Security-Policy` header on pages; adding a CSP (e.g. at least `default-src 'self'`) would mitigate cross-site scripting risks. These are noted omissions.

- **Error Handling (Problem+JSON):** The site’s REST API endpoints (WordPress JSON) typically return `application/json`. For invalid requests (e.g. unknown route), WordPress usually returns JSON error objects; UAIX’s spec prefers RFC-9457 “Problem Details” format. In the manifest [77], the `problem_details` section references UAI error schemas. We assume UAIX’s API plugin follows this for its own endpoints. However, we did not actually trigger an error to verify.

- **Privacy and Analytics:** The UAIX Privacy page declares no personal data collection on public pages. The site uses Google Tag Manager for analytics, but that is outside agent scope.

**Table 1** (below) summarizes each guidance item with its implementation status and evidence.

<table>
<tr><th>Guidance Item</th><th>Implementation on UAIX.org</th><th>Evidence / Notes</th></tr>
<tr>
<td>Discovery files (robots, sitemap)</td>
<td>Present and correct</td>

Why This File Exists

This is a memory-system evidence file from aiwikis.org. It is shown here because AIWikis.org is demonstrating the real source files that make the UAIX / LLM Wiki memory system work, not only summarizing those systems after the fact.

Role

This file is memory-system evidence. It records source history, archive transfer, intake disposition, or another piece of provenance that should be retrievable without becoming an unsupported public claim.

Structure

The file is structured around these visible headings: Executive Summary; 1. UAIX Guidance Inventory; 2. Mapping Guidance to UAIX.org Implementation; 3. Verification and Testing; 4. Cross-Check with Standards and Best Practices; 5. Gaps, Ambiguities, and Testing Shortfalls; 6. Remediation Recommendations; 7. Sample Automated Checks (Pseudocode). Those headings are retrieval anchors: a crawler or LLM can decide whether the file is relevant before reading every line.

Prompt-Size And Retrieval Benefit

Keeping this material in a separate file reduces prompt pressure because an agent can load this exact unit only when its role, source site, category, or hash is relevant. The surrounding index pages point to it, while this page preserves the full content for audit and exact recall.

How To Use It

• Humans should read the metadata first, then inspect the raw content when they need exact wording or provenance.
• LLMs and agents should use the source site, category, hash, headings, and related files to decide whether this file belongs in the active prompt.
• Crawlers should treat the AIWikis page as transparent evidence and follow the source URL/source reference for authority boundaries.
• Future maintainers should regenerate this page whenever the source hash changes, then review the explanation if the role or structure changed.

Update Requirements

When this source file changes, update the raw source layer, normalized source layer, hash history, this rendered page, generated explanation, source-file inventory, changed-files report, and any source-section index that links to it.

Related Pages

• Source overview
• Site file index
• Site report index
• UAI system index
• Source provenance
• Site directory
• Organization reports

Provenance And History

• Current observation: 2026-06-22T01:56:21.9510185Z
• Source origin: current-source-workspace
• Retrieval method: local-source-workspace
• Duplicate group: sfg-1100 (primary)
• Historical hash records are stored in data/hashes/source-file-history.jsonl.

Machine-Readable Metadata

{
    "title":  "Executive Summary",
    "source_site":  "aiwikis.org",
    "source_url":  "https://aiwikis.org/",
    "canonical_url":  "https://aiwikis.org/aiwikis/files/raw-uaix-reports-2026-06-21-dogfooding-remediation-this-report-audits-ua-e4808452/",
    "source_reference":  "raw/uaix/reports/2026-06-21-dogfooding-remediation/This report audits UAIX.org’s compliance with its own AI-Ready Web.md",
    "file_type":  "md",
    "content_category":  "memory-file",
    "content_hash":  "sha256:e480845210cd8fb587c97ab1f406bb602469da9f61aa147daa5ebce9a1b986d5",
    "last_fetched":  "2026-06-22T01:56:21.9510185Z",
    "last_changed":  "2026-06-21T20:09:44.3379180Z",
    "import_status":  "new",
    "duplicate_group_id":  "sfg-1100",
    "duplicate_role":  "primary",
    "related_files":  [

                      ],
    "generated_explanation":  true,
    "explanation_last_generated":  "2026-06-22T01:56:21.9510185Z"
}