Rights verification supports three paths in v1.0: GitHub OAuth for io.github.<owner>, DNS TXT for io.<domain>, and manual review for edge cases.
Begin with GET /v0/publisher-rights/github/start. The deployed service must provide GitHub OAuth app credentials before this path can complete against live GitHub.
Request the challenge via POST /v0/publisher-rights/dns-challenge, publish the TXT record, then complete verification with POST /v0/publisher-rights/dns-verify.
Use POST /v0/publisher-rights/manual-verify for operator-mediated edge cases. Anonymous namespaces remain accepted but unverified in v1.0.