[yawboakye]

Closes #466.

Why

Meaningful DevCongress participation should be portable without being reduced to a generic, unverifiable badge. This adds an issuer-backed credential flow: DevCongress reviews evidence, the recipient explicitly consents, and Connect publishes a stable verification record that continues to show whether the credential is active, expired, or revoked.

LinkedIn displays the credential under Licenses & certifications, but DevCongress remains the verifier. The flow deliberately does not claim a LinkedIn verification badge or LinkedIn endorsement.

What changed

• define reusable credential types with explicit eligibility, evidence, approver, version, lifecycle, and non-claim copy
• seed the first credential as DevCongress Community Contributor
• add authorized single and batch issuance with a non-mutating preview and explicit confirmation
• require recipient consent before publication and notify recipients by email
• generate non-sequential public credential IDs with database-level duplicate protection
• publish permanent verification pages with Schema.org credential metadata
• provide branded light/dark SVG badges and a downloadable certificate
• expose copyable LinkedIn fields and the official Add to Profile handoff
• support search, correction, revocation, expiry, reissue, scheduled expiry, and audit CSV export

Trust model

• LinkedIn does not independently validate this credential.
• The recipient selects the official DevCongress LinkedIn Page as the issuing organization and supplies the credential ID and URL.
• Anyone reviewing the LinkedIn entry follows the credential URL to the DevCongress-controlled verification page.
• Revoked and expired records remain resolvable and visibly carry their current status.
• No LinkedIn account connection or API permission is required.

Acceptance criteria

Definition and design

• The first credential has a specific name, purpose, eligibility criteria, evidence requirements, approvers, and lifecycle rules.
• Badge and certificate assets follow the DevCongress visual identity and have light/dark variants.
• Public copy states both what the credential recognizes and what it does not prove.
• Badge alt text and contrast-conscious status treatments are included.

Issuance and verification

• Recipients explicitly consent before issuance and public display.
• Credentials receive unique 24-character random Base58 IDs and stable verification routes.
• Verification pages show the credential, recipient, criteria, issuer, dates, evidence summary, ID, and current status.
• Service-level idempotency and a partial unique database index prevent duplicate current credentials.
• Admins can correct, revoke, expire, and reissue with required reasons and audit events.
• Revoked and expired credential URLs remain resolvable.
• Tests cover authorization, evidence requirements, duplicate issuance, consent, lifecycle changes, privacy, assets, and verification URLs.

LinkedIn experience

• The official DevCongress LinkedIn Page is linked as the issuing organization.
• Every LinkedIn credential field is presented as a copyable value.
• Add to LinkedIn opens LinkedIn's supported Add to Profile flow.
• Copy explicitly disclaims LinkedIn verification and endorsement.
• Receipt and verification require no LinkedIn connection or API permission.
• The DevCongress verification URL and downloadable assets remain useful independently of LinkedIn.

Privacy and operations

• Pending credentials return 404 from public verification and asset routes.
• Public verification omits account email and internal administration details.
• Preview and batch dry-run operations create no credentials and send no notifications.
• Issuance and lifecycle events are recorded and exportable.

Implementation references

• Issuance, consent, lifecycle, and audit workflow
• Public verification, badge, certificate, and LinkedIn experience
• Credential model
• Admin issuance workflow
• Public verifier

Screenshots

Public verification

Admin issuance

Verification

• Focused credential suite: 16 tests, 105 assertions, 0 failures, 0 errors
• StandardRB: passed for the changed Ruby files
• Brakeman: 0 security warnings
• The broader suite reaches the repository's existing local libvips blocker in OG-card tests; no credential test fails.