Production Accreditation

curl -X POST https://phosra-api-sandbox-production.up.railway.app/api/v1/advisors/self-register \
  -H "Content-Type: application/json" \
  -d '{"did":"did:ocss:your-assessor","public_key_b64url":"<ed25519-pub-b64url>","entry_role":"verifying-agency"}'

​

Interim production network

​

Production census coordinates

import type { LinkConfig } from "@phosra/link"

const cfg: LinkConfig = {
  // BARE origin — no /api/v1 suffix.
  censusBaseUrl:    "https://prodapi.phosra.com",
  // PUBLIC root pub X, pinned out-of-band (root key id: root-prod-bootstrap-2026-07).
  // Verified AGAINST the census — never fetched FROM it.
  trustRootXB64Url: "824vsCATBxyUiA-znpGx01N48NNs_3gPE3M7f7vIEaI",
  writerKey:        providerSenderKey,   // did:ocss:<your-slug>
  writerDid:        "did:ocss:<your-slug>",
  // ...parentKey, grant store, etc. — see the Provider Quickstart.
}

​

Look-alike hosts

​

Why the gate exists

​

Eligibility criteria

1. Real legal entity — a registered company or incorporated organisation (not an individual developer account).
2. Passing conformance harness — run @openchildsafety/provider-harness (≥ 0.1.3) against your enclave and obtain a conformance_attestation with all evaluated assertions passing. Today’s first attestation scopes to the 4 currently-passable assertions (A1, A2, A5, A7). The remaining 3 (A3 consent infra, A4 capability endpoint, A6 advocate lane) are PENDING — not failures; the infrastructure they require does not yet exist. See Server-Side Enclave Routing — Conformance Harness for the exact invocation and assertion descriptions.
3. §5.4 self-declaration — a signed conformance self-declaration filed per the Implementer lane (see OCSS Onboarding). For parties intending the Gated or Restricted bands, the Assessed or Audited lane artifact is also required.
4. Child-safety–aligned use case — intended use that aligns with the OCSS mission (protecting children, not general-purpose signal aggregation).
5. For full production accreditation (not achievable today): the conformance_attestation must be counter-signed by a real governance-designated verifying-agency — an independent organization holding role: verifying-agency on the same Trust List. The census compiler enforces this at compile time: classifier-accredited entries whose attestation is not signed by a co-present verifying-agency are excluded from the signed document. A production accreditor is pending designation.

​

Review SLA

• Initial acknowledgement: within 2 business days of submission
• Promote / decline decision: within 10 business days of submission
• If more information is needed: Phosra will email the contact address from the application; the clock pauses until a response is received.

​

Application steps

​

1. Complete the sandbox round-trip

CENSUS_URL=https://phosra-api-sandbox-production.up.railway.app \
ROOT_KEY_X_B64URL=CMHWy3vUAiEcYDdE_bDvkRuEqwxkklS0tV-TYHJTlWU \
node scripts/sandbox/verify-enclave-direct-loop.mjs

​

2. Run the conformance harness

# Generate the probe-lab Ed25519 key (keep secret — only you run this)
openssl genpkey -algorithm ed25519 -out probe-lab-key.pem

# 2a. Run the conformance suite against your live enclave base URL
#     (the harness calls GET {url}/buildinfo and POST {url}/classify).
#     Target by URL with --enclave-url (NOT --enclave); requires >= 0.1.3.
npx -p @openchildsafety/provider-harness@0.1.3 provider-harness \
  run --enclave-url https://your-enclave.example

# 2b. Build the unsigned conformance attestation
npx -p @openchildsafety/provider-harness@0.1.3 provider-harness \
  attest --enclave-url https://your-enclave.example \
  --attested-by did:ocss:probe-lab \
  --passed-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --liability-scope-ref https://ocss.example/liability#v0 \
  > attestation.json

# 2c. Sign it with the probe-lab key
npx -p @openchildsafety/provider-harness@0.1.3 provider-harness \
  sign --key probe-lab-key.pem --key-id probe-lab-2026-06 attestation.json \
  > signed-attestation.json

  [✓ pass   ] a1: closed-enum fail-closed
  [✓ pass   ] a2: content-free signal lane
  [~ pending] a3: sealed-to-consent-recipient only
  [~ pending] a4: parent-sole-control + non-suppressable monitoring_active
  [✓ pass   ] a5: minimization attestation wired (HMAC-salted leaves, self-report)
  [~ pending] a6: abuse-at-home → advocate routing
  [✓ pass   ] a7: attestation-fail → suspend (fail-closed before content)

  4 pass  ·  3 pending  ·  0 fail
  self-tested; production accreditor pending

​

3. Apply via the API

curl -X POST https://openchildsafety.org/api/accreditation-apply \
  -A "Mozilla/5.0" \
  -H "Content-Type: application/json" \
  -d '{
    "name":                    "Jane Smith",
    "email":                   "jane@yourorg.com",
    "org":                     "Your Organization",
    "provisional_did":         "did:ocss:your-slug",
    "intended_use":            "We provide parental-controls software to families and want to write signed rules to the production census.",
    "conformance_attestation": { "...": "paste the attestation JSON from step 2" }
  }'

​

4. Phosra reviews and adds the Trust List entries

1. did:ocss:probe-lab — role: verifying-agency, tier: accredited, public key = the probe-lab Ed25519 pubkey derived from the key you submitted. (One entry, shared across all sandbox applicants using the same probe-lab key.)
2. did:ocss:<your-slug> — role: classifier-accredited, accreditation_tier: standin, tier: accredited, public key = your enclave’s Ed25519 signing key, conformance_attestation = the JSON from step 2.

​

5. The Trust List compiler admits your entry

• Invariant (a) — WebPKI-CA admission gate: classifier-accredited entries are admitted ONLY if their conformance_attestation.sig verifies under an Ed25519 key from a verifying-agency entry on the same signed document. Probe-lab is on the document → your attestation must verify under probe-lab’s pubkey.
• Invariant (b) — stand-in (standin) production bar: entries with accreditation_tier: standin are excluded when PHOSRA_ENV=production. Your entry appears on sandbox Trust Lists and is absent from production Trust Lists until the stand-in (standin) tier is graduated.

curl https://phosra-api-sandbox-production.up.railway.app/.well-known/ocss/trust-list \
  | jq '.document | fromjson | .entries[] | select(.did == "did:ocss:<your-slug>")'

​

6. Confirmation

​

Honest status today (self-tested tier)

{
  "role": "classifier-accredited",
  "accreditation_tier": "standin",
  "tier": "accredited",
  "conformance_attestation": {
    "attested_by": "did:ocss:probe-lab",
    "assertions_passed": ["a1", "a2", "a5", "a7"],
    ...
  }
}

• 4/7 assertions passed (A1, A2, A5, A7) — your classifier handles the core content-safety signal flow correctly.
• 3/7 assertions pending (A3, A4, A6) — consent infra, capability endpoint, and advocate routing are not yet provable. Pending is not a failure: the infrastructure they require does not yet exist.
• Standin tier — excluded from production Trust Lists; included in sandbox.
• Verifying-agency is a SIM — did:ocss:probe-lab is a sandbox simulator, not a real independent accreditor. The honest label is self-tested; production accreditor pending.

​

Path to full production accreditation

1. A real governance-designated verifying-agency. A named independent organization on the Trust List, separate from Phosra. Phosra cannot self-accredit and keep the uniformity claim honest. A production accreditor is pending designation.
2. All 7 assertions passing. A3, A4, and A6 require:
   • A3: two-attestor consent infra (Tier 4.1)
   • A4: a GET /capabilities endpoint declaring monitoring_active
   • A6: the advocate routing lane (Tier 2.5, gated on counsel)
3. Removing the standin tier. Once a real verifying-agency counter-signs the attestation and all 7 assertions pass, the administrator promotes the entry by clearing accreditation_tier. The entry then passes compiler invariant (b) and appears on the production Trust List.

​

What changes after promotion

​

After you are accredited

1. Set LinkConfig.censusBaseUrl to the production census — https://prodapi.phosra.com (bare origin, no /api/v1). See Production census coordinates.
2. Set LinkConfig.trustRootXB64Url to the production trust root 824vsCATBxyUiA-znpGx01N48NNs_3gPE3M7f7vIEaI (root key id root-prod-bootstrap-2026-07) — distinct from sandbox, pinned out-of-band (verified against the census, never fetched from it).
3. Set LinkConfig.developerOrgId to your org_... ID for billing attribution.
4. Run phosra doctor pointed at the production census (there is no --env flag — set PHOSRA_CENSUS_URL=https://prodapi.phosra.com and PHOSRA_TRUST_ROOT_X=824vsCATBxyUiA-znpGx01N48NNs_3gPE3M7f7vIEaI, as in the go-live checklist) to confirm the production round-trip is green before your first real user connects.

​

Next

• Getting on the Trust List — sandbox self-registration (no email required)
• Server-Side Enclave Routing — enclave API, conformance harness, sandbox round-trip
• Provider Quickstart — @phosra/link integration
• Platform Quickstart — @phosra/gatekeeper integration
• Billing Model — the FamilyMeter and what is always free