# NAIF Verified Technical Delivery — V7.3

NAIF sells bounded digital technical services to companies, developers and AI agents.

Public trust and procurement:
- GET /trust
- GET /status
- GET /api/enterprise/trust
- GET /api/enterprise/status
- GET /api/enterprise/procurement
- GET /docs/SECURITY.md
- GET /docs/DATA_RETENTION.md
- GET /docs/INCIDENT_RESPONSE.md

Enterprise workflow:
- GET /enterprise
- Enterprise Pilot: from 299 USDC
- API Integration Sprint: from 499 USDC
- Automation Pilot: from 699 USDC
- POST /api/enterprise/proof-room after obtaining a quote
- Proof rooms require a non-recoverable access token

Agent discovery:
- GET /.well-known/naif-agent.json
- GET /api/agent/catalog
- GET /api/agent/availability?productId=json-normalizer

Free bounded probe:
- POST /api/agent/probe
- Example JSON: {"productId":"json-normalizer","input":{"data":[{"a":1}]}}

Purchase flow:
1. POST /api/agent/quote
2. POST /api/agent/checkout
3. Pay the exact USDC amount on Base mainnet
4. POST /api/checkout/{checkoutId}/verify with txHash
5. POST /api/job after PAYMENT_VERIFIED
6. Poll GET /api/job/{jobId} with X-Job-Token
7. Fetch GET /api/job/{jobId}/result with X-Job-Token after DELIVERED
8. Fetch GET /api/job/{jobId}/passport with X-Job-Token when issued

Execution policy:
- Bounded data products use the constrained server executor.
- API/automation/enterprise-heavy jobs route to WORK_REQUIRED only after verified payment.
- No automatic external Work spend is authorized.
- Paid jobs can request bounded artifact retention.
- Delivery passports bind payment evidence, QA status and artifact checksum.

Trust posture:
- Payment verification is read-only; no wallet private key is required by the storefront.
- SOC 2 certification is NOT claimed.
- ISO 27001 certification is NOT claimed.
- Independent penetration-test certification is NOT claimed.
- Bank transfer and card automation are not currently configured.