A respectful, evidence-first read of Southwest Gas's public web surface and public regulatory record: what an auditor, a customer, or an AI agent can and cannot verify today, and the one layer that would change it. Baseline credited first; then five findings, each reproducible from a URL and an HTTP status.
Southwest Gas runs a real, regulated, physically-audited operation, and the public record shows it:
max-age=31536000; includeSubDomains) enabled site-wide; a real 404 handler (the soft-404 control returns a true 404).The point of this brief is not that anything is broken. It is that the records these operations already produce are trapped in formats no third party can independently verify, and that is a solvable, valuable gap.
No jargon. Southwest Gas already does the work and keeps the records; these fixes are about letting anyone, a regulator, an ESG rater, an AI agent, verify it without taking your word for it. Here's what each is worth.
Your leak surveys and COYL replacements already produce mandatory completion records, but they live in internal PDFs, so today the answer to "prove the survey happened" is "trust our file" instead of "check the chain."
Your sustainability and methane figures are prose and PDF with zero structured data, so every automated reader summarizes them inconsistently or misses them, a structured object is read once and read correctly.
Your sitemap lists each URL as a bare relative path the spec forbids, so strict crawlers drop rows and your own pages quietly go unindexed, a one-line template fix.
Every machine-discovery path is a dead 404 today, so an ESG or procurement bot landing on your domain finds nothing to act on, and a found vulnerability has no contact channel.
A leak survey and a COYL replacement are survey a specific location → find a specific defect → perform a bounded fix → record who did it, when, and where. That is, line for line, the lifecycle EcoWealth's Work Protocol already runs: bounded scope + safety framing → funded → claimed → photo + GPS + signature proof → approved → settled to a permanent on-chain receipt. PHMSA (49 CFR Part 192) and the state commissions require operators to keep the completion and leak-survey records; today those records live in internal systems and PDFs. Nothing public lets a regulator, an insurer, or a customer verify that the survey at a given address on a given date actually occurred.
civic_hazard_survey 352 · ambient_air_survey 157 · trenching_excavation_survey 34 · confined_space_entry_survey 32 · lockout_tagout_survey 30 · urban_canopy_survey 511 · stormwater_inspection 213. Re-verify: curl -s https://vealth.net/labor/statsThe 2024 Sustainability Report, the RNG/methane-reduction figures, and the $408M integrity investment are all published as prose and PDF. The sustainability landing page (swgas.com/en/sustainability, ~106 KB) carries zero application/ld+json structured data, and the homepage carries zero as well. An AI agent asked "what is Southwest Gas's methane commitment and has it been met?" has no machine-readable object to read, only text to guess at.
curl -s https://www.swgas.com/en/sustainability | grep -c 'application/ld+json' → 0; same for https://www.swgas.com/.swgas.com/sitemap.xml returns 7,049 <loc> entries, and every single one is a bare relative path, <loc>/azbusrebate</loc>, <loc>/caresrebate</loc>, with no scheme or host. The sitemaps.org protocol requires each <loc> to be a fully-qualified absolute URL. A strict crawler or agent that follows the spec cannot resolve these without guessing the base, and several major crawlers will drop non-absolute entries.
https://www.swgas.com. Until then, the single most machine-facing file on the site is technically non-conformant across 7,049 rows, a quiet drag on every crawler, search index, and agent.curl -s https://www.swgas.com/sitemap.xml | grep -oE '<loc>/[^<]*' | wc -l → 7049 (relative) vs. grep -oE '<loc>https?://' → 0 (absolute).Every standard machine-discovery path is a true 404: /llms.txt (the file AI assistants read first), /ai.txt, /.well-known/agent-card.json, /.well-known/ai-plugin.json, and /.well-known/security.txt (control path also 404, so these are genuine 404s, not a catch-all). There is also no security.txt, a security researcher who found an issue has no published contact channel. robots.txt exists but is minimal and slightly malformed (Allow: * where the standard is Allow: /).
llms.txt get represented accurately by every model; the ones who don't get paraphrased from scraped marketing copy. The agent kit in this concept drafts all four files.for p in /llms.txt /ai.txt /.well-known/agent-card.json /.well-known/security.txt; do curl -s -o /dev/null -w "%{http_code} $p\n" https://www.swgas.com$p; doneThe transport baseline is fine (HSTS with includeSubDomains, HTTPS enforced), but the response headers on the root carry no Content-Security-Policy and no X-Frame-Options, controls that peers in this set (NextEra ships X-Frame-Options: SAMEORIGIN + a CSP frame-ancestors; SCE ships a full CSP) do publish. Combined with the absent security.txt, there is no published clickjacking defense or researcher-contact path. These are configuration one-liners, not architecture problems.
security.txt is the courtesy that keeps a found vulnerability arriving by email instead of by headline.curl -sI https://www.swgas.com/ | grep -iE 'content-security|x-frame|strict-transport' → HSTS present; CSP / XFO absent.A COYL survey-and-replace task (or a periodic leak survey along a main) becomes an EWP proof-verified work packet: a bounded scope with safety framing that a crew or a contractor claims, closes with photo + GPS + signature proof scored by a deterministic proof-checker, and settles to a permanent receipt on Base. Each receipt appends to that contractor's, and that pipe segment's, verified completion history: the independently-checkable upgrade to a completion PDF, and the same rail that can attach a real ecological retirement receipt to the RNG/methane side of the story.
Live proof it's not slides: EWP contract 0x76c17C…A14B on Base mainnet (source-verified, first settled packet workId 14); the priced tool menu at vealth.net/.well-known/x402; and the end-to-end building-agent golden path.
| Step | What ships | Who owns it |
|---|---|---|
| 0 · Prove it (today) | One agent pays $0.10 to work-packet and gets a bounded packet back; one funded field-adjacent packet in AZ/NV/CA settles on-chain. | EcoWealth rail, live now |
| 1 · Machine-legible surface | llms.txt + agent card + JSON-LD on commitment pages + absolute-URL sitemap + security.txt. | SWGas web team (drafts provided) |
| 2 · Proof pilot | 10 COYL/leak-survey-adjacent packets across one district, each closed with proof + settled; verified completion history per contractor. | Joint, bounded scope |
| 3 · Standing rail | Completion receipts as the default output of field work; RNG/methane retirement receipts attached where applicable. | Operator decision |
Two figures, both pocket change against a $408M/yr field program:
work-packet endpoint and gets a bounded, safety-framed packet back, keyless. The dry-run client is at vealth.net/recipes.html.