Credential lane milestone — starting brief (v1)

Status: brief for the design session (2026-06-12) Decisions this builds on: ADR-0013 (person-rooted identity bindings), ADR-0014 (erasure is anonymization — signed documents are un-erasable by construction), ADR-0015 (per-org issuer Profiles, platform-custodial keys, evidence by reference, sign-on-export), ADR-0016 (VC-JOSE/JWT proofs with Ed25519, Data Integrity deferred), ADR-0017 (Supabase Vault custody behind a KeySigner seam, OpenBao as the named upgrade trigger)

This brief is the handoff into the design session. The strategic decisions are made; the session designs the concrete slice and starts implementation.

The v1 slice (decided 2026-06-12)

One OB 3.0 AchievementCredential per granted qualification_award, learner-pulled (sign-on-export — nothing signed is ever stored), verified externally via the per-issuer JWKS endpoint only (no first-party verify page). The CLR 2.0 assembler comes after signing is proven. Revocation / credentialStatus infrastructure is deferred, but identifier slots are reserved at issuance (ADR-0015).

Already in place

• qualification_definition / qualification_award schema with the proposed → granted state machine and issuer_organization_id already encoding per-org issuer intent (packages/db/src/schema/qualification-portability.ts).
• Contracts: @conform-ed/contracts open-badges/v3_0, clr/v2_0, vc-data-model/v2_0.
• supabase_vault deployed and live (CNPG ImageVolume extensions image, infra/utils/cloudnativepg/supabase/; extension created in infra/utils/cloudnativepg/supabase/db/z_after.sql).
• identity_binding as the home for pairwise credential-subject identifiers (ADR-0013/0015); key custody is a property of the binding.
• Erasure registry CI gate for any new person-linked table (packages/db/src/erasure-registry.ts).

What the design session must produce

1. Issuer-profile model: per-organization Profile rows plus the platform default profile; preserved issuer reference surviving org archival (replaces the set null on qualification_award.issuer_organization_id, per ADR-0015).
2. Key provisioning: Ed25519 generation, the dedicated vault scope, and the dedicated signing DB role (only the signing path reads the decrypted view — never the general app role; ADR-0017 guardrail 1).
3. KeySigner seam: the apps/api interface every signature goes through; custody is an implementation detail behind it (guardrail 2).
4. JWKS surface: per-issuer endpoint layout, kid scheme, rotation policy (rotation is additive — old kids keep verifying).
5. Sign-event audit log (guardrail 3).
6. Export endpoint: authz (the authenticated learner pulls their own granted awards), pairwise subject identifier minting as identity bindings, assembly via the OB 3.0 contracts, compact JWS output (alg: EdDSA).
7. Conformance wiring: the 1EdTech OB conformance harness runs against the export surface from the first slice (suite runner follows the conform-ed suites pattern alongside lrs/cmi5/lti13) — not endgame QA.
8. Achievement mapping: qualification_definition → OB Achievement, with alignment slots reserved for CASE node URIs (see cross-lane note).

Constraints to keep honoring

• Evidence by reference only — achievement claims plus provenance references; never xAPI excerpts or response content frozen into a signed, un-erasable document (ADR-0014/0015).
• Sign-on-export — no stored signed artifacts anywhere.
• No RDF canonicalization enters the platform in v1 (ADR-0016).
• One-vocabulary rule: OB/VC terms stay at the @conform-ed/contracts boundary.

Cross-lane touchpoint

The CASE lane (case-competency-v1-brief.md) delivers durable Competency Node URIs for Achievement.alignment. Alignment is additive per credential — do not block the first signed credential on it; coordinate the qualification_definition alignment field shape only.