A respectful, evidence-first read of NextEra Energy's public web surface and public company record: what a green-bond auditor or an AI agent can and cannot verify today, and the one layer that would change it. Baseline credited first; then four findings, each reproducible from a URL and an HTTP status.
NextEra runs a genuinely strong estate, and unlike some peers, a strong security baseline:
max-age=31536000; includeSubDomains; preload), X-Frame-Options: SAMEORIGIN, a CSP frame-ancestors 'self', and Referrer-Policy: strict-origin-when-cross-origin on the root: a clickjacking/transport baseline stronger than several peers in this set.The gap is not the build quality or the security posture. It is that the enormous green-investment story has no per-project object anyone outside NextEra can verify.
No jargon. NextEra's whole story is a green-investment story, and every fix below makes that story something an investor, a regulator, or an AI can verify instead of take on faith. Here is what each one is worth.
Every safe build and restored acre lives in a PDF today, so an ESG investor or regulator takes your impact on faith; a verifiable receipt per project lets your green bonds be priced on proof, not promises.
Your /.well-known/ door returns an access-denied wall, which reads as hostile to the very assistants ESG raters now use; lifting it and publishing the files means research about you gets read right, from you, instead of paraphrased from scraped copy.
The homepage ships zero structured data, so an AI comparing your build against your targets works from marketing prose; structured facts get read once and read right: no wrong numbers circulating in your name.
There's no security.txt and the 403 blocks even a future one; a single file, once that block lifts, is the courtesy that keeps a critical-infrastructure vulnerability out of the news.
Every project is built by EPC and subcontractor crews (proof-of-safe-completion, the Build ladder) and sits on land under solar/wind easement (habitat and revegetation obligations, the Restore ladder). Those are exactly the two work-packet families EcoWealth already runs. Today the safety sign-offs and the restoration records live in project files and PDFs; a green-bond investor, a landowner, or a regulator has no independent way to confirm a specific task was completed at a specific place and time.
construction_site_safety_walk 44 · trenching_excavation_survey 34 · crane_rigging_survey 35 · biodiversity_survey 178 · soil_carbon_baseline 129 · native_planting/tree_planting. Re-verify: curl -s https://vealth.net/labor/statsThe entire /.well-known/ tree: agent-card.json (the file that lets an AI assistant use a site correctly), ai-plugin.json, security.txt, even the directory itself, returns HTTP 403 (WAF-blocked). /llms.txt (the file AI assistants read first) and /ai.txt are true 404s (soft-404 control confirms). So an A2A or MCP client that follows the standard and probes /.well-known/agent-card.json doesn't get a clean "not here": it gets an access-denied wall. That is a worse signal than a 404: it reads as hostile to agents rather than merely silent.
/.well-known/ path prefix (so agent cards and a future security.txt can be read at all), then publish the files. Right now the standard agent-discovery handshake fails closed against NextEra.for p in /.well-known/agent-card.json /.well-known/security.txt /llms.txt; do curl -s -o /dev/null -w "%{http_code} $p\n" https://www.nexteraenergy.com$p; done → 403 / 403 / 404.The homepage (Adobe Experience Manager) carries 0 application/ld+json blocks and 5 og: tags. The renewables leadership story, the 81 GW target, and the ESG narrative are delivered as prose and PDF. An AI agent asked to compare NextEra's verified renewable build against its stated targets has no structured object to read.
Organization + Dataset object, and better, per-project outcome receipts, gets read once and read right, instead of paraphrased from scraped marketing copy.curl -s https://www.nexteraenergy.com/ | grep -c 'application/ld+json' → 0.There is no security.txt at the root or under /.well-known/, and because the whole /.well-known/ tree 403s, a researcher can't even reach the standard location where one would live. For a critical-infrastructure operator, a published, machine-findable disclosure channel is table stakes.
security.txt (once the path block is lifted) is the courtesy that keeps a found vulnerability arriving by email instead of by headline, and it pairs naturally with publishing the agent card at the same location.curl -s -o /dev/null -w '%{http_code}' https://www.nexteraenergy.com/.well-known/security.txt → 403; /security.txt → 404.A single project's safety sign-off and its habitat-restoration obligation each become an EWP proof-verified work packet: bounded scope with safety framing, claimed by an EPC crew or a restoration contractor, closed with photo + GPS + signature proof scored by a deterministic proof-checker, and settled to a permanent receipt on Base. Each receipt appends to that contractor's, and that project's, verified completion history: the independently-checkable upgrade to an impact-report PDF, and the same rail that can attach a real ecological retirement receipt to the megawatt.
Live proof it's not slides: EWP contract 0x76c17C…A14B on Base mainnet (source-verified, first settled packet workId 14); the priced tool menu at vealth.net/.well-known/x402; and the end-to-end building-agent golden path.
| Step | What ships | Who owns it |
|---|---|---|
| 0 · Prove it (today) | One agent pays $0.10 to work-packet; one funded restore/safety packet on one project settles on-chain. | EcoWealth rail, live now |
| 1 · Machine-legible surface | Lift the /.well-known/ 403; publish llms.txt + agent card + JSON-LD + security.txt. | NextEra web/security team (drafts provided) |
| 2 · Proof pilot | 10 build + restore packets on one project site, each closed with proof + settled; verified completion history per contractor. | Joint, bounded scope |
| 3 · Standing rail | Per-project completion + restoration receipts as the default output; retirement receipts attached to the megawatt. | Operator decision |
Two figures, both pocket change against a ~$184B company:
work-packet endpoint and gets a bounded, safety-framed packet back, keyless. Dry-run client: vealth.net/recipes.html.