@phosra/cli

The phosra command-line tool — the fastest way to verify a Phosra OCSS integration and prove a signed round-trip against the hosted census, with zero provisioning.

Status: not yet published to npm. Until then, run from the monorepo (packages/cli) after npm run build, or contact [email protected]. Full guide: https://docs.phosra.com/integration/cli

What it does (and doesn't)

The CLI is a thin, §12.3-clean wrapper over the SDKs (@openchildsafety/ocss, @phosra/link, @phosra/gatekeeper). It verifies signed artifacts to the Ed25519 trust root and drives the census — it holds no authority: it never mints a grant, accepts a rule, publishes the trust list, or carries billing. Keys are generated client-side only. The census is the sole safety authority.

Quickstart

phosra init --role provider   # scaffold .phosra.env against the shared sandbox DID (zero backend)
phosra doctor                 # verify the whole setup end-to-end → a green signed round-trip

phosra doctor runs five ordered, fail-closed checks (honest WARN/SKIP, never a false green):

1. census_reachable — /health
2. trust_list_verified — /.well-known/ocss/trust-list verified to root
3. caps_verified — /.well-known/ocss/capabilities (the self-describing rule + version doc) verified to root
4. version_negotiates — spec-version range negotiation
5. sandbox_round_trip — a full §8.3.2 consent + §8.3.1 rule write (consent 201 / rule 201)

Commands

| Command | What it does | |---|---| | phosra init --role provider\|platform | Scaffold a working .phosra.env against the shared sandbox | | phosra doctor | The five end-to-end checks above | | phosra caps | Fetch + verify + pretty-print the capabilities doc | | phosra link write | Provider: sign + write a rule (a real census write) | | phosra gatekeeper check | Platform: verify a profile + evaluate a decision |

Every command supports --json for CI and agent use.

Configuration

Resolution order: environment variable → .phosra.env → baked-in sandbox default. Point at a different census with PHOSRA_CENSUS_URL + PHOSRA_TRUST_ROOT_X.

All baked-in keys are sandbox-only, deterministic test keys — never production material.