Skip to main content
Notable, developer-facing changes to the Phosra API, the platform conventions, and the published SDKs — newest first. API version v1 is additive: entries here add capability or documentation, they do not break existing v1 calls.
Version and date facts on this page are drawn from the public npm registry and the live sandbox census. For how versions pin together, see Versioning. For the SDK packages, see the SDK overview.
​
Shared-profile disconnect evidence
  • Partial removal is now explicit — Link 0.7.53 wires signed v2 platform release events through the Golden provider server. Removing one child from a shared platform profile acknowledges that child with nativeRestored: false; the remaining children and the profile’s effective controls stay active.
  • Final release stays distinct — only removing the last authorized child may complete the aggregate release with nativeRestored: true. Provider applications receive and persist the signed platform result without adding app-specific release parsing.
  • Recovery replays proof, not policy — Gatekeeper 0.8.65 lets a later signed parent recovery check resend the identical immutable release event if its original delivery exhausted. It does not reopen the child, recompute the shared profile, or disturb retained siblings.
  • Hosted qualification — the candidate was verified against the Custo ↔ Notflix two-children-to-one-profile lifecycle, including terminal delivery history and retry recovery.
​
Crash-safe durable Link endpoint minting
  • Durable endpoint minting — POST /api/v1/enforcement-endpoints now honors the Link SDK’s canonical request_id lane. A retry with the same request authority returns 200 plus OCSS-Replay: original and the byte-identical initial result without creating a second binding; changed authority under the same ID returns 409.
  • Encrypted recovery — endpoint labels and connect secrets used for durable recovery are protected with a dedicated AES-256-GCM key and bound to the caller, request ID, and request digest. They are never stored as plaintext and the legacy cleartext-once lane remains compatible.
  • Hosted qualification fix — resolves the post-consent MINT_PHASE_ERROR observed in the real Custo → Notflix parent-linking walkthrough. The hosted browser ceremony is requalified after the authority deployment.
​
Production Link authority and hosted qualification
  • Production Link discovery is live — the signed environment manifest, trust material, and public client-directory lookup are deployed at prodapi.phosra.com. Registration and environment-bound credential issuance remain restricted operator operations, not public self-service.
  • Hosted qualification candidates — Link 0.7.10, Gatekeeper 0.8.7, and OCSS 0.1.6 are exact private artifacts for the Railway qualification fleet; public npm remains Link 0.6.1, Gatekeeper 0.7.0, and OCSS 0.1.5.
  • Human release gate — hosted qualification uses real Mailosaur-backed accounts, the Notflix six-digit verification flow, Playwright screenshots and traces, topology evidence for every operation, and the required two-children to one-shared-profile lifecycle.
​
SDK releases — gatekeeper 0.3.0 + ocss 0.1.4
  • @phosra/gatekeeper 0.3.0 — EXT-04 §3.6 connect state-machine: a new ConnectSessionStore + gk.mintConnectState() let handleConnect validate the connect state (single-use / TTL / session-binding) and atomically bind each endpoint_id_label to the right child (unknown/expired state → 404; a label already bound to a different child → 409). Breaking: handleConnect now fails closed (503) when connectSecret is unset — set allowUnauthenticatedConnect: true for a trusted-network deployment to restore the prior passthrough.
  • @openchildsafety/ocss 0.1.4 — new receiptToWire() export: decodes a Receipt’s Uint8Array body to nested JSON so a hand-rolled §8.3.8 confirmation POST is accepted (the raw confirm path works with one extra call; verdict.confirm() already did this internally).
Pin exact (0.x minors may break) — see SDK versioning.
​
Platform-conventions reference
New reference pages for the cross-cutting platform contracts, each verified against the live sandbox:
  • Rate limits — the 100 req/min default, the X-RateLimit-* + Retry-After headers, and copy-paste backoff in four languages.
  • Pagination — the two list shapes (offset arrays on the product plane, next_cursor envelopes on the census rails) and how to walk each.
  • Idempotency — where the key lives (there is no Idempotency-Key header), the 200 + OCSS-Replay: original faithful-replay contract, and the 409 replay pitfall.
  • Versioning — the API path, OCSS-v1.0-pre, dated Annex B editions, ETag/If-None-Match, and exact SDK pinning.
​
SDK releases
  • @openchildsafety/ocss 0.1.3 — the OCSS protocol + RFC 9421 request signer (signRequest) used across the signed examples in these docs.
  • @phosra/link 0.1.2 — parent-facing connect flow.
  • @phosra/gatekeeper 0.2.2 — tighten-only enforcement overlay.
Pin exact (0.x minors may break) — see SDK versioning.
​
Developer platform + first SDK line
  • Self-serve developer orgs — sign up, auto-provision a dev org, and mint a phosra_test_ key with no sales call. See Create an account.
  • @phosra/sdk 0.1.0 — the first published server SDK line.
  • @phosra/cli 0.2.0 and @phosra/mcp 0.4.0 published.
  • Free-tier orgs default to 100 requests/minute (Rate limits).
​
MCP server
  • First release of the @phosra/mcp MCP server, exposing Phosra tools to agents. See the MCP server SDK.

​
Current platform conventions

These are the standing contracts of the v1 surface, not point-in-time releases. They are documented and verified on their own pages:
Looking for infrastructure status and incidents rather than API changes? That lives on the status page.