Changelog

• Partial removal is now explicit — Link 0.7.53 wires signed v2 platform release events through the Golden provider server. Removing one child from a shared platform profile acknowledges that child with nativeRestored: false; the remaining children and the profile's effective controls stay active.
• Final release stays distinct — only removing the last authorized child may complete the aggregate release with nativeRestored: true. Provider applications receive and persist the signed platform result without adding app-specific release parsing.
• Recovery replays proof, not policy — Gatekeeper 0.8.65 lets a later signed parent recovery check resend the identical immutable release event if its original delivery exhausted. It does not reopen the child, recompute the shared profile, or disturb retained siblings.
• Synthetic qualification — the candidate was exercised against the Custo ↔ Notflix reference-fixture lifecycle, including terminal test-delivery history and retry recovery. This is not customer or production-network evidence.

• Durable endpoint minting — POST /api/v1/enforcement-endpoints now honors the Link SDK's canonical request_id lane. A retry with the same request authority returns 200 plus OCSS-Replay: original and the byte-identical initial result without creating a second binding; changed authority under the same ID returns 409.
• Encrypted recovery — endpoint labels and connect secrets used for durable recovery are protected with a dedicated AES-256-GCM key and bound to the caller, request ID, and request digest. They are never stored as plaintext and the legacy cleartext-once lane remains compatible.
• Reference-fixture fix — resolves the post-consent MINT_PHASE_ERROR observed in the synthetic Custo → Notflix walkthrough. The sandbox browser ceremony was rerun after the change.

• Evaluation manifest work — signed-manifest and client-directory shapes were exercised internally. This is not a public production routing endpoint.
• Private evaluation candidates — Link 0.7.10, Gatekeeper 0.8.7, and OCSS 0.1.6 were private test artifacts; public npm remained Link 0.6.1, Gatekeeper 0.7.0, and OCSS 0.1.5.
• Synthetic release gate — qualification used test accounts, reference applications, screenshots, traces, and a shared-profile fixture. No customer deployment or real-platform adoption is implied.

• @phosra/gatekeeper 0.3.0 — EXT-04 §3.6 connect state-machine: a new ConnectSessionStore + gk.mintConnectState() let handleConnect validate the connect state (single-use / TTL / session-binding) and atomically bind each endpoint_id_label to the right child (unknown/expired state → 404; a label already bound to a different child → 409). Breaking: handleConnect now fails closed (503) when connectSecret is unset — set allowUnauthenticatedConnect: true for a trusted-network deployment to restore the prior passthrough.
• @openchildsafety/ocss 0.1.4 — new receiptToWire() export: decodes a Receipt's Uint8Array body to nested JSON so a hand-rolled §8.3.8 confirmation POST is accepted (the raw confirm path works with one extra call; verdict.confirm() already did this internally).

Pin exact (0.x minors may break) — see SDK versioning.

New reference pages for the cross-cutting platform contracts, each verified against the live sandbox:

• Rate limits — the 100 req/min default, the X-RateLimit-* + Retry-After headers, and copy-paste backoff in four languages.
• Pagination — the two list shapes (offset arrays on the product plane, next_cursor envelopes on the census rails) and how to walk each.
• Idempotency — where the key lives (there is no Idempotency-Key header), the 200 + OCSS-Replay: original faithful-replay contract, and the 409 replay pitfall.
• Versioning — the API path, OCSS-v1.0-pre, dated Annex B editions, ETag/If-None-Match, and exact SDK pinning.

• @openchildsafety/ocss 0.1.3 — the OCSS protocol + RFC 9421 request signer (signRequest) used across the signed examples in these docs.
• @phosra/link 0.1.2 — parent-facing connect flow.
• @phosra/gatekeeper 0.2.2 — tighten-only enforcement overlay.

Pin exact (0.x minors may break) — see SDK versioning.

• Self-serve developer orgs — sign up, auto-provision a dev org, and mint a phosra_test_ key with no sales call. See Create an account.
• @phosra/sdk 0.1.0 — the first published server SDK line.
• @phosra/cli 0.2.0 and @phosra/mcp 0.4.0 published.
• Free-tier orgs default to 100 requests/minute (Rate limits).

• First release of the @phosra/mcp MCP server, exposing Phosra tools to agents. See the MCP server SDK.