Publisher onboarding

Publisher onboarding is fail-closed.

The read API remains available, but every public publisher verification and declaration write currently returns 404. We will reopen onboarding only after identity binding, server-owned audit time, OAuth state, signing, and receipt retrieval pass review.

Browse the read API ↗Review the evidence boundary

Designed proof paths

Both verification paths are currently disabled

These cards document the intended contracts, not callable production workflows. The edge returns 404 until the trust-model gates below are implemented and accepted.

DNS TXT · disabled

Domain namespaces

The intended route covers a server named io.example.com/my-server. A reviewed replacement must bind the passport to the domain proof instead of trusting caller-supplied identifiers.

  1. POST /v0/publisher-rights/dns-challenge — return record_name and an expected_value exactly equal to the supplied passport fingerprint.
  2. Publish it under _rcx-registry.<domain>:
_rcx-registry.example.com. IN TXT "fingerprint:8f2a…c0"

The replacement verify route must resolve that exact value, derive audit time on the server, bind the proof to an authenticated passport, and persist a retrievable signed artifact. The current public challenge and verify routes both return 404.

GitHub OAuth · disabled

io.github.* namespaces

The routes are implemented but production OAuth credentials are unset. The reviewed replacement must also bind state to a server-side session and prove organization ownership instead of treating a user login as org control.

  1. Provision and rotate a production OAuth app through the approved custody path.
  2. Bind state, redirect URI, namespace, and publisher identity on the server.
  3. Verify user or organization ownership explicitly, then use server-owned audit time.

The public start and callback routes return 404 today. Manual review is also absent until an authenticated, passport-attributed operator surface ships.

Fail-closed write surface

Declarations are intentionally closed

POST /v0/publishers/declare is disabled at the edge and absent from the application router. Namespace rights alone are not caller authentication: accepting a passport identifier in a JSON body would let another caller overwrite publisher metadata.

It will reopen only after the request proves control of the verified publisher identity, produces a real signature through the configured signer, and has public receipt/key retrieval. The schema and conformance vectors remain available for implementers meanwhile.

Read access is live. Publisher writes remain closed.

Existing mirror reads continue normally. Do not publish a DNS record or begin OAuth yet; no production onboarding route will accept it until the replacement is reviewed and deployed.

Browse the read API ↗How verification works