docs(specs): platform ceremony versions come from the Distribution

[xgreenx]

The Application selects platform ceremony versions from the Distribution's versions.json; the Bridge publishes one OAuth registration per configured platform. Base: #13.

Revised 2026-09-29: per-version override clients dropped at the reviewer's request; one registration per platform, independent of versions.

Changes

• ccdp-distribution.md: versions.json is a protocol resource the Application fetches cross-origin: boundary, resources table row with Access-Control-Allow-Origin: * and Cross-Origin-Resource-Policy: cross-origin, activation order, REQ-DIST-06 / TEST-DIST-06.
• ccdp.md: the resource in Documents and Routes, read by the Application before Prefetch.
• oauth-bridge.md: one public client ID per enabled platform, clientCredential exactly when the platform's ceremony sends one, no version list; PlatformConfig { clientId, clientCredential? }; the Bridge enumerates no versions and retrieves only the artifact.
• oauth-bridge.md: the Application's resolution rule: a platform is enabled when the record configures it and the list names a version it implements; every enabled version runs the platform's one registration; highest by default; a failed read of either resource enables nothing.
• oauth-bridge.md: TEST-BRIDGE-03 covers the record and the resolution.

Verified

• lint_spec.py specs/*.md: 31 errors / 100 warnings on the base and on the branch, identical findings.
• Every REQ has a TEST line; REQ-DIST-06 has TEST-DIST-06.
• Diff against the base: 3 files, +92/-38 (oauth-bridge.md +38/-27).

Not verified / known issues

• The record changes under v1 while Compatibility says a breaking response changes the API version; the in-place change is the rollout decision.

Implementations: #53 (Distribution and client), libid-org/libID-bridge-rs#23 (Bridge).

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		5946af7	2026-09-29T10:34:44.523Z	View logs ↗
Build: Failed ❌ View logs ↗		fae8fa3	2026-09-28T21:12:31.301Z	View logs ↗
Build: Failed ❌ View logs ↗		e8c0bee	2026-09-28T11:03:02.485Z	View logs ↗

[Wondertan]

Updated review of fae8fa3: keeping CCDP's version advertisement and fetching it directly from the Client is the agreed direction. The Client automatically selects the highest version supported both locally and by CCDP. This supersedes my earlier request to remove the version list or move selection into Prefetch.

Please remove versionOverrides entirely for now. There is no concrete need for per-version OAuth registrations yet; the override schema, validation, and selection rules are speculative complexity.

Keep one OAuth registration per configured platform (clientId and clientCredential where required), independent of the advertised ceremony versions. Remove the corresponding override prose and tests. We can add overrides when an actual platform/version requires a different registration.

[xgreenx]

Reworked to the design agreed offline with Wondertan on 2026-09-28: the Application reads the Distribution's version list and applies the Bridge's per-version overrides; the Bridge publishes registrations only. The Prefetch exact-version check from the review is not part of this change.

[Wondertan]

Following up on the latest revision: keeping CCDP's version advertisement and fetching it directly from the Client is the agreed direction. The Client automatically selects the highest version supported both locally and by CCDP. This supersedes my earlier requests to remove the version list or move selection into Prefetch.

Please remove versionOverrides entirely for now. We have no concrete need for per-version OAuth registrations yet; the schema, validation, and selection rules are speculative complexity.

Keep one OAuth registration per configured platform (clientId and clientCredential where required), independent of the advertised ceremony versions. Remove the corresponding override prose and tests. We can add overrides when an actual platform/version requires a different registration.

[xgreenx]

Removed in 5946af7: one OAuth registration per configured platform, clientId and clientCredential exactly when the ceremony sends one; no versionOverrides, no override prose or test clauses. The version list, its cross-origin read by the Application, the intersection with what it implements and highest-by-default stay. Lint 31/100 unchanged; the diff against the base is now +92/−38. The matching removals in #53 and libid-org/libID-bridge-rs#23 follow shortly.

[Wondertan]

Re-reviewed 5946af7. The requested simplification is complete: one OAuth registration per platform, with no version overrides. CCDP continues advertising its supported versions directly to the Client, which selects the highest locally supported advertised version. No remaining specification findings.