1 · What the demo proves
All of this runs end to end against real Phosra SDKs (@phosra/gatekeeper 0.8.73,
@phosra/link 0.7.80) on a local Phosra network, with real signed credentials, consent, delivery and receipts.
- Zero-code platform onboardingOption 1: Chirp only exposes who is signed in and each post's rating. The Worker hosts Gatekeeper, runs the Phosra Link ceremony, signs the platform's receipts, and filters HTML and JSON. Maya goes from 12 posts to 8; Dana, her parent, keeps all 12. See it →
- The Trusted Agent Protocol shapeOption 2: the Worker strips spoofed headers, adds
Phosra-Content-Rating-Max, and forwards to an origin that only accepts the Worker. Chirp filters in its own query (about 40 lines) and acknowledges. If the acknowledgement is missing, the Worker filters anyway. See it → - A small ask of the platformTwo things: a session endpoint (who is signed in, which profile is active) and a rating attribute on rated content. That data stays inside the platform's own Cloudflare boundary; requests through Phosra carry an opaque child reference, never a name or birthday.
Maya, linked8 postsratings 0 · 7 · 13 only
Dana, parent12 postsunchanged
Origin bypass (option 2)403locked to the Worker
2 · The Trusted Agent Protocol parallel
Both put a trusted signal at the edge so the site can act on it without rebuilding its stack. The difference today is how the edge-to-site hop is trusted.
| Visa Trusted Agent Protocol | Phosra at the edge (option 2) | |
|---|---|---|
| Problem | Tell trusted AI shopping agents from malicious bots | Apply a parent's rules on a platform the parent doesn't control |
| The signal | Agent intent, consumer recognition, optional payment data | The active profile's policy, e.g. Phosra-Content-Rating-Max: 13 |
| How it's trusted | Agent-specific cryptographic signatures (HTTP Message Signatures), aligned with Web Bot Auth | Phosra's own traffic is RFC 9421-signed. The Worker → site hop is trusted because the origin only accepts the Worker; it is not signed in this demo |
| What the site changes | “No-code functionality for merchants”; minimal UX changes | Option 1: nothing beyond a session endpoint and ratings. Option 2: about 40 lines |
| Who enforces | The merchant, using verified signals | The platform first; the Worker as backstop if the platform doesn't acknowledge |
| Cloudflare's role | Developed in collaboration with Cloudflare | Runs the Worker, Hyperdrive, cron, and the origin lock (Tunnel, mTLS, Access) |
| Status | Announced Oct 14, 2025; spec on Visa Developer Center and GitHub | Working demo; not a Phosra product |
Natural next step: sign the Worker → site hop with HTTP Message Signatures, the way TAP and Web Bot Auth do, so the platform can verify the policy cryptographically instead of relying on the origin lock alone.
3 · Why it strengthens the Cloudflare story
- Upgrades ship as Worker deploysGatekeeper upgrades, key rotation and new rule categories ship without a platform release — the same “no-code for merchants” promise Visa led with.
- Built from products Cloudflare already sellsWorkers, HTMLRewriter, Hyperdrive and Cron Triggers in the demo; Cloudflare Tunnel, Authenticated Origin Pulls and Access for the origin lock.
- One integration, many platformsEverything site-specific is configuration; the protocol, signing, retries and receipts are written once.
4 · Open questions
What a platform or Cloudflare team will reasonably ask first.
| Question | Where it stands |
|---|---|
| Is the origin lock required? | Yes — it's load-bearing. Without it, option 1 can be bypassed by going straight to the origin, and option 2 can't trust the header. |
| Which option for real platforms? | Option 2. Option 1 depends on page selectors and only covers endpoints listed in the Worker config. |
| What about apps, not just the web? | Option 2 covers API clients because the platform enforces in its own queries. Native mobile protocols and WebSockets at large chat-platform scale aren't covered yet. |
| Who runs the Worker? | Open: the platform's own Cloudflare account, or a Phosra-managed deployment (for example Workers for Platforms). That is the business-model question. |
| Which rules work end to end? | Only content_rating. OCSS defines DM rules, but @phosra/link 0.7.80 can't request them yet, which is why TockTick is labeled a mockup. |
5 · In one line
“Web Bot Auth for child safety.” A policy header delivered by Cloudflare's edge, enforced by the platform, with the edge as the backstop. Today the header is trusted through the origin lock; signing it is the next step.