From 090ca399f2456286c7e31ba389c675606c717460 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Mon, 20 Jul 2026 00:11:08 +0700 Subject: [PATCH 1/5] chore(release): prepare Registry Stack v0.12.0 beta-14 Signed-off-by: Jeremi Joslin --- CONTRIBUTING.md | 2 +- Cargo.lock | 52 +++---- Cargo.toml | 48 +++---- SECURITY.md | 10 +- crates/registry-relay/CHANGELOG.md | 7 + crates/registry-relay/docs/release-notes.md | 4 + .../openapi/registry-relay.openapi.json | 2 +- crates/registryctl/CHANGELOG.md | 16 +-- crates/registryctl/README.md | 10 +- .../bounded-http/registry-stack.yaml | 4 +- crates/registryctl/install.sh | 4 +- .../dhis2-tracker/registry-stack.yaml | 4 +- .../registry-stack.yaml | 4 +- .../opencrvs/registry-stack.yaml | 4 +- .../snapshot-exact/registry-stack.yaml | 4 +- crates/registryctl/tests/project_authoring.rs | 2 +- .../scripts/check-registryctl-tutorials.sh | 4 +- docs/site/src/content/docs/changelog.mdx | 16 +++ .../docs/operate/upgrade-and-rollback.mdx | 8 +- .../content/docs/reference/api-stability.mdx | 2 +- .../docs/reference/apis/registry-notary.mdx | 2 +- .../docs/reference/apis/registry-relay.mdx | 2 +- .../src/content/docs/reference/errors.mdx | 6 +- .../content/docs/reference/registryctl.mdx | 8 +- .../docs/security/report-a-vulnerability.mdx | 2 +- .../content/docs/security/support-window.mdx | 2 +- .../tutorials/author-registry-project.mdx | 2 +- .../deploy-standalone-with-own-data.mdx | 6 +- ...blish-spreadsheet-secured-registry-api.mdx | 12 +- .../tutorials/verify-claim-registry-api.mdx | 6 +- .../docs/tutorials/verify-opencrvs-claims.mdx | 2 +- docs/site/src/data/contracts.yaml | 16 +-- docs/site/src/data/docsets.yaml | 38 ++++- docs/site/src/data/generated/contracts.json | 16 +-- docs/site/src/data/generated/docsets.json | 48 ++++++- docs/site/src/data/generated/projects.json | 18 +-- docs/site/src/data/generated/standards.json | 98 ++++++------- docs/site/src/data/projects.yaml | 18 +-- docs/site/src/data/repo-docs.yaml | 80 +++++------ docs/site/src/data/standards.yaml | 98 ++++++------- editors/tests/install_test.sh | 6 +- products/manifest/CHANGELOG.md | 4 + products/manifest/docs/release-notes.md | 4 + products/manifest/fuzz/Cargo.lock | 6 +- products/notary/CHANGELOG.md | 4 + products/notary/docs/release-notes.md | 8 ++ products/notary/fuzz/Cargo.lock | 130 ++++++++++++++---- .../openapi/registry-notary.openapi.json | 4 +- products/platform/CHANGELOG.md | 10 ++ products/platform/fuzz/Cargo.lock | 18 +-- release/VERIFY.md | 2 +- release/manifests/registry-stack-beta-14.yaml | 31 +++++ release/notes/v0.12.0.md | 113 +++++++++++++++ release/scripts/test_registry_release.py | 2 +- 54 files changed, 687 insertions(+), 342 deletions(-) create mode 100644 release/manifests/registry-stack-beta-14.yaml create mode 100644 release/notes/v0.12.0.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 76656a08..4fdfdcef 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -145,7 +145,7 @@ These checks require Python 3.11 or later. ```bash python3 -m unittest release/scripts/test_registry_release.py python3 -m unittest release/scripts/test_openid_conformance_runner.py -release/scripts/registry-release validate release/manifests/registry-stack-beta-13.yaml +release/scripts/registry-release validate release/manifests/registry-stack-beta-14.yaml release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh python3 -m unittest release/scripts/test_check_release_source_model.py diff --git a/Cargo.lock b/Cargo.lock index c2457e0d..e45c84ba 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5192,7 +5192,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4" [[package]] name = "registry-config-report" -version = "0.11.0" +version = "0.12.0" dependencies = [ "jsonschema 0.46.6", "serde", @@ -5201,7 +5201,7 @@ dependencies = [ [[package]] name = "registry-language-server" -version = "0.11.0" +version = "0.12.0" dependencies = [ "anyhow", "serde_json", @@ -5214,7 +5214,7 @@ dependencies = [ [[package]] name = "registry-manifest-cli" -version = "0.11.0" +version = "0.12.0" dependencies = [ "registry-manifest-core", "serde", @@ -5225,7 +5225,7 @@ dependencies = [ [[package]] name = "registry-manifest-core" -version = "0.11.0" +version = "0.12.0" dependencies = [ "oxiri", "oxjsonld", @@ -5240,7 +5240,7 @@ dependencies = [ [[package]] name = "registry-notary" -version = "0.11.0" +version = "0.12.0" dependencies = [ "axum", "axum-test", @@ -5277,7 +5277,7 @@ dependencies = [ [[package]] name = "registry-notary-client" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "axum", @@ -5305,7 +5305,7 @@ dependencies = [ [[package]] name = "registry-notary-core" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "humantime-serde", @@ -5333,7 +5333,7 @@ dependencies = [ [[package]] name = "registry-notary-server" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "aws-lc-rs", @@ -5391,7 +5391,7 @@ dependencies = [ [[package]] name = "registry-notary-worker-harness" -version = "0.11.0" +version = "0.12.0" dependencies = [ "libc", "serde", @@ -5403,7 +5403,7 @@ dependencies = [ [[package]] name = "registry-platform-audit" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "hmac 0.13.0", @@ -5424,7 +5424,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.11.0" +version = "0.12.0" dependencies = [ "proptest", "serde", @@ -5438,7 +5438,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "sha2 0.11.0", @@ -5449,7 +5449,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.11.0" +version = "0.12.0" dependencies = [ "ryu-js", "serde", @@ -5459,7 +5459,7 @@ dependencies = [ [[package]] name = "registry-platform-config" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "registry-platform-crypto", @@ -5474,7 +5474,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "aws-lc-rs", @@ -5497,7 +5497,7 @@ dependencies = [ [[package]] name = "registry-platform-httpsec" -version = "0.11.0" +version = "0.12.0" dependencies = [ "axum", "http", @@ -5512,7 +5512,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.11.0" +version = "0.12.0" dependencies = [ "axum", "base64", @@ -5539,7 +5539,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "registry-platform-crypto", @@ -5554,7 +5554,7 @@ dependencies = [ [[package]] name = "registry-platform-oidc" -version = "0.11.0" +version = "0.12.0" dependencies = [ "axum", "base64", @@ -5570,7 +5570,7 @@ dependencies = [ [[package]] name = "registry-platform-ops" -version = "0.11.0" +version = "0.12.0" dependencies = [ "fs2", "jsonschema 0.46.6", @@ -5587,14 +5587,14 @@ dependencies = [ [[package]] name = "registry-platform-pdp" -version = "0.11.0" +version = "0.12.0" dependencies = [ "serde", ] [[package]] name = "registry-platform-replay" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -5606,7 +5606,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "base64", @@ -5623,7 +5623,7 @@ dependencies = [ [[package]] name = "registry-platform-testing" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "axum", @@ -5649,7 +5649,7 @@ dependencies = [ [[package]] name = "registry-relay" -version = "0.11.0" +version = "0.12.0" dependencies = [ "arc-swap", "assert-json-diff", @@ -5730,7 +5730,7 @@ dependencies = [ [[package]] name = "registryctl" -version = "0.11.0" +version = "0.12.0" dependencies = [ "anyhow", "base64", diff --git a/Cargo.toml b/Cargo.toml index 1bfa5590..f70d0253 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -40,7 +40,7 @@ exclude = [ resolver = "2" [workspace.package] -version = "0.11.0" +version = "0.12.0" edition = "2021" rust-version = "1.95" license = "Apache-2.0" @@ -51,29 +51,29 @@ repository = "https://github.com/registrystack/registry-stack" unsafe_code = "forbid" [workspace.dependencies] -registry-config-report = { path = "crates/registry-config-report", version = "0.11.0" } -registry-language-server = { path = "crates/registry-language-server", version = "0.11.0" } -registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.11.0" } -registry-notary-client = { path = "crates/registry-notary-client", version = "0.11.0" } -registry-notary-core = { path = "crates/registry-notary-core", version = "0.11.0" } -registry-relay = { path = "crates/registry-relay", version = "0.11.0" } -registry-notary-server = { path = "crates/registry-notary-server", version = "0.11.0", default-features = false } -registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.11.0" } -registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.11.0" } -registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.11.0" } -registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.11.0" } -registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.11.0" } -registry-platform-config = { path = "crates/registry-platform-config", version = "0.11.0" } -registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.11.0" } -registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.11.0" } -registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.11.0" } -registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.11.0" } -registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.11.0" } -registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.11.0" } -registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.11.0" } -registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.11.0" } -registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.11.0" } -registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.11.0" } +registry-config-report = { path = "crates/registry-config-report", version = "0.12.0" } +registry-language-server = { path = "crates/registry-language-server", version = "0.12.0" } +registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.12.0" } +registry-notary-client = { path = "crates/registry-notary-client", version = "0.12.0" } +registry-notary-core = { path = "crates/registry-notary-core", version = "0.12.0" } +registry-relay = { path = "crates/registry-relay", version = "0.12.0" } +registry-notary-server = { path = "crates/registry-notary-server", version = "0.12.0", default-features = false } +registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.12.0" } +registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.12.0" } +registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.12.0" } +registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.12.0" } +registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.12.0" } +registry-platform-config = { path = "crates/registry-platform-config", version = "0.12.0" } +registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.12.0" } +registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.12.0" } +registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.12.0" } +registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.12.0" } +registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.12.0" } +registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.12.0" } +registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.12.0" } +registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.12.0" } +registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.12.0" } +registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.12.0" } crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" } crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" } diff --git a/SECURITY.md b/SECURITY.md index 0bf45e2e..166f51b3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance. For each signed release asset, download three files from the GitHub Release: -- The asset, for example `registryctl-v0.11.0-linux-amd64` -- The matching signature, for example `registryctl-v0.11.0-linux-amd64.sig` -- The matching certificate, for example `registryctl-v0.11.0-linux-amd64.pem` +- The asset, for example `registryctl-v0.12.0-linux-amd64` +- The matching signature, for example `registryctl-v0.12.0-linux-amd64.sig` +- The matching certificate, for example `registryctl-v0.12.0-linux-amd64.pem` Then verify the asset: ```bash -asset=registryctl-v0.11.0-linux-amd64 +asset=registryctl-v0.12.0-linux-amd64 cosign verify-blob \ --certificate "${asset}.pem" \ @@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the artifact against the release tag: ```bash -tag=v0.11.0 +tag=v0.12.0 asset=registryctl-${tag}-linux-amd64 provenance=registry-stack-${tag}-release-provenance.intoto.jsonl diff --git a/crates/registry-relay/CHANGELOG.md b/crates/registry-relay/CHANGELOG.md index 1c418007..8213f01d 100644 --- a/crates/registry-relay/CHANGELOG.md +++ b/crates/registry-relay/CHANGELOG.md @@ -2,11 +2,18 @@ ## Unreleased +## 0.12.0 - 2026-07-19 + - Align the 1.0 standards roster with the canonical no-optional-feature release build. OpenAPI and problem contracts, portable metadata, CSV and XLSX input, and JSON aggregate output are stable. Optional standards adapters and the shipped non-gated Parquet, CSV aggregate, and SDMX-JSON surfaces are experimental and feature-frozen, outside the 1.0 compatibility promise. +- Surface protected per-resource last-good refresh health through Prometheus + metrics and restricted admin posture without failing readiness while a valid + last-good table remains available. +- Move maintained Relay runtime images and the release image to Debian 13 and + enforce the matching image-base and vulnerability policy in release gates. ## 0.11.0 - 2026-07-18 diff --git a/crates/registry-relay/docs/release-notes.md b/crates/registry-relay/docs/release-notes.md index 01d4e77d..2a65b871 100644 --- a/crates/registry-relay/docs/release-notes.md +++ b/crates/registry-relay/docs/release-notes.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.12.0 + - Relay now surfaces per-resource last-good refresh health through protected Prometheus gauges and restricted admin posture. Failed refreshes preserve a valid last-good table and `/ready` remains healthy, while consecutive failure @@ -14,6 +16,8 @@ excluded from the canonical release binary while their source and all-feature tests remain available. Non-feature-gated experimental formats remain shipped but outside the 1.0 compatibility promise. +- Maintained Relay runtime images now use Debian 13. Release checks enforce the + expected base and vulnerability policy before publication. ## 0.11.0 diff --git a/crates/registry-relay/openapi/registry-relay.openapi.json b/crates/registry-relay/openapi/registry-relay.openapi.json index 79bffe16..b33ac6d8 100644 --- a/crates/registry-relay/openapi/registry-relay.openapi.json +++ b/crates/registry-relay/openapi/registry-relay.openapi.json @@ -2903,7 +2903,7 @@ }, "summary": "Read-only data gateway exposing entity records, catalog metadata, and SHACL/DCAT-AP shapes for governed datasets.", "title": "Registry Relay API", - "version": "0.11.0" + "version": "0.12.0" }, "openapi": "3.1.0", "paths": { diff --git a/crates/registryctl/CHANGELOG.md b/crates/registryctl/CHANGELOG.md index 0b9542c5..7d55c040 100644 --- a/crates/registryctl/CHANGELOG.md +++ b/crates/registryctl/CHANGELOG.md @@ -6,8 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +## [0.12.0] - 2026-07-19 + ### Changed +- Interactive report commands now print concise human-readable results by + default. This covers project initialization, Notary add-on setup, offline + tests, checks, editor setup, builds, doctor validation, Config Bundle + operations, and trust-anchor operations. Add `--format json` for versioned + machine-readable reports. Artifact and protocol streams keep their existing + formats. - Registryctl now uses the workspace-pinned `serde_norway` YAML parser and serializer, consistent with the supported configuration boundary used by Relay and Notary. @@ -52,14 +60,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). catalog now drives documentation and tests for additional maintained and conformance workspaces without turning them into public starters. -### Changed - -- Interactive report commands now print concise human-readable results by default. This covers - project initialization, Notary add-on setup, offline tests, checks, editor setup, builds, - doctor validation, Config Bundle operations, and trust-anchor operations. Add `--format json` - for versioned machine-readable reports. Artifact and protocol streams keep their existing - formats. - ### Removed - BREAKING: project authoring no longer accepts credential profiles or OID4VCI diff --git a/crates/registryctl/README.md b/crates/registryctl/README.md index 7b2222cf..ca9915d3 100644 --- a/crates/registryctl/README.md +++ b/crates/registryctl/README.md @@ -5,7 +5,7 @@ Install a pinned release without cloning this repo: ```sh -curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | bash +curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.12.0/crates/registryctl/install.sh | bash ``` The quick installer verifies downloaded release assets against `SHA256SUMS` @@ -99,7 +99,7 @@ workers need a platform-specific process limit. The Notary default remains 128 MiB. The maximum 1 GiB value supports emulated local runtimes and is a per-worker data/address-space ceiling, not reserved memory. -The installer defaults to `v0.11.0`. To install a different pinned release, set +The installer defaults to `v0.12.0`. To install a different pinned release, set `REGISTRYCTL_VERSION`: ```sh @@ -110,10 +110,10 @@ Fetch the installer from the same pinned tag selected by `REGISTRYCTL_VERSION`. An older installer does not know the asset contract of a newer release. -Prebuilt binaries are published for the `v0.11.0` stack release on Linux x86_64, +Prebuilt binaries are published for the `v0.12.0` stack release on Linux x86_64, Linux arm64, and macOS arm64. On other platforms, install from source with -`cargo install --git https://github.com/registrystack/registry-stack --tag v0.11.0 registryctl --locked`. -Intel macOS has no prebuilt binary for `v0.11.0`, so the installer stops after +`cargo install --git https://github.com/registrystack/registry-stack --tag v0.12.0 registryctl --locked`. +Intel macOS has no prebuilt binary for `v0.12.0`, so the installer stops after printing that Cargo command. It does not run the source build automatically. ## Release image lock (`v0.9.0` and later) diff --git a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml index dae5cb20..9b265de8 100644 --- a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml +++ b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: http - release: 0.11.0 - content_digest: sha256:c349257d84d442318969452fd79c82d92a9fa43798758291dc7dba30dbf02ec7 + release: 0.12.0 + content_digest: sha256:144f56e2f56c5c4d5e197347b11c074b75fa63ce39ec76da275ab4d1ae87e7f7 registry: id: fictional-citizen-registry diff --git a/crates/registryctl/install.sh b/crates/registryctl/install.sh index 63dc625a..c4023c9d 100755 --- a/crates/registryctl/install.sh +++ b/crates/registryctl/install.sh @@ -2,7 +2,7 @@ set -euo pipefail repo="registrystack/registry-stack" -default_version="v0.11.0" +default_version="v0.12.0" version="${REGISTRYCTL_VERSION:-$default_version}" install_dir="${REGISTRYCTL_INSTALL_DIR:-$HOME/.local/bin}" verify_url="https://github.com/${repo}/blob/main/release/VERIFY.md" @@ -19,7 +19,7 @@ unsigned. Follow the canonical release verification guide: $verify_url Environment: - REGISTRYCTL_VERSION Pinned release tag to install. Defaults to v0.11.0. + REGISTRYCTL_VERSION Pinned release tag to install. Defaults to v0.12.0. REGISTRYCTL_INSTALL_DIR Install directory. Defaults to ~/.local/bin. EOF } diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml index ea71708a..a58304d0 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: dhis2-tracker - release: 0.11.0 - content_digest: sha256:49a811e0d70e4a0b3d75cb293bd6fb000b83e31b495d0f4dcdc1ed772f92d99d + release: 0.12.0 + content_digest: sha256:4cba0beae68665bfc0bd4362d136b49dbf9ac592d0f5fa7951ed6958e95a8d41 registry: { id: fictional-health-registry } integrations: health-record: { file: integrations/health-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml index 071c06e8..cdffcffb 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: fhir-r4 - release: 0.11.0 - content_digest: sha256:2708d485e48785d045c25e895179e651019d48baf23d98e4383c87188ba753f6 + release: 0.12.0 + content_digest: sha256:c024a3b77b0468af927dba986a9787a714ff67d5d590a887a9d7371ab553ad6d registry: { id: fictional-fhir-registry } integrations: coverage: { file: integrations/coverage/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml index b15d899f..8cf84bcb 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: opencrvs-dci - release: 0.11.0 - content_digest: sha256:4d1be45915d5130540771bfd067344ef8b377988d441b736da4b6f4fcd062e36 + release: 0.12.0 + content_digest: sha256:750441a1a72b01aeb98485e2fc9afb25ecc0545a403b79cdb43cc43db963f069 registry: { id: fictional-civil-registry } integrations: birth-record: { file: integrations/birth-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml index ecb21f27..d8feaa3d 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: snapshot - release: 0.11.0 - content_digest: sha256:de0b3bfc64823e5f8bbf10554427ec838602a700a03409a080ad70bde03d3fe5 + release: 0.12.0 + content_digest: sha256:8a41ad6dbd6603da449ba9cf44d30406214ea4256bbc36c4892a43953640d38a registry: { id: fictional-population-registry } integrations: person-snapshot: { file: integrations/person-snapshot/integration.yaml } diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs index ae2468c9..b6b25428 100644 --- a/crates/registryctl/tests/project_authoring.rs +++ b/crates/registryctl/tests/project_authoring.rs @@ -4308,7 +4308,7 @@ fn check_and_build_produce_deterministic_product_inputs() { assert_eq!(first_closure, directory_closure(&output)); assert_eq!( closure_digest(&first_closure), - "2a85af0238a9a3606e34bc66cad4d5e21b93832809ee2fd2c0101f1bcfffc76b", + "a2b871f191e463b9948fb79607a2f7a1c271aa2120d92b181d8ab99e7bc2a8c2", "project inputs must match the cross-machine golden digest" ); } diff --git a/docs/site/scripts/check-registryctl-tutorials.sh b/docs/site/scripts/check-registryctl-tutorials.sh index 9e2a1508..8c0c2754 100644 --- a/docs/site/scripts/check-registryctl-tutorials.sh +++ b/docs/site/scripts/check-registryctl-tutorials.sh @@ -301,7 +301,7 @@ run_relay_tutorial() { '["Install registryctl","Create the sample project","Start the local stack","Run the smoke check","Load local demo keys","Make one denied request","Make one allowed request","Read one protected record","Read one protected record","Read restricted identity fields","Read restricted identity fields","Inspect the generated contract","Inspect the generated contract","Run an aggregate","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Stop the stack"]' node "$HELPER" extract-shell "$RELAY_TUTORIAL" "$blocks" - expected_install=$'curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.11.0 bash\nregistryctl --version' + expected_install=$'curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.12.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.12.0 bash\nregistryctl --version' if [[ "$(cat "$blocks/01.sh")" != "$expected_install" ]]; then printf 'release-only install block changed; update the explicit source-under-test boundary\n' >&2 exit 1 @@ -316,7 +316,7 @@ run_relay_tutorial() { cd "$tutorial_root" printf '\nrelease installer skipped: this gate uses the checked-out registryctl; GH#198 verifies release assets\n' run_block 'Relay 1: source registryctl version' "$version_block" success - assert_contains "$LAST_OUTPUT" 'registryctl 0.11.0' + assert_contains "$LAST_OUTPUT" 'registryctl 0.12.0' run_block 'Relay 2: Create the sample project' "$blocks/02.sh" success CURRENT_SECRET_FILE="$PWD/secrets/local.env" run_block 'Relay 3: Start the local stack' "$blocks/03.sh" success diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx index 52167d56..fa314b2d 100644 --- a/docs/site/src/content/docs/changelog.mdx +++ b/docs/site/src/content/docs/changelog.mdx @@ -18,6 +18,22 @@ relevant product pages on this site rather than duplicating release notes. ## 2026-07-19 +Documentation updates for the v0.12.0 beta-14 release: + +- Advanced current source citations, install commands, verification examples, + contracts, projects, and standards links to Registry Stack `v0.12.0`. +- Added the `v0.12.0` archived docset while retaining the v0.11.0 and earlier + archives. +- Documented Registry Notary's issuer-initiated pre-authorized-code profile, + bounded batch evaluation, generated runtime configuration schema, and + fail-closed credential-status verification. +- Documented Registry Relay's intended 1.0 support roster and protected + per-resource last-good refresh health. +- Updated Registryctl tutorials for human-readable report defaults and the + matching v0.12.0 binary, image lock, and image generation. +- Recorded the Debian 13 runtime transition and kept candidate-only lifecycle, + external integration, OpenID, Solmara, hosted, and pilot evidence held. + - Documented Relay's protected per-resource refresh-health metrics, restricted posture observation, last-good availability behavior, and default alert at three consecutive failures. - Documented the source installer for the optional VS Code and Zed semantic-navigation diff --git a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx index 6ac6daec..4a9e5345 100644 --- a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx +++ b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx @@ -32,7 +32,7 @@ release evidence. ## Prerequisites -- Your deployment pins a version tag (`v0.11.0`) or an image digest, never `latest`. +- Your deployment pins a version tag (`v0.12.0`) or an image digest, never `latest`. - You know where your deployment keeps its persistent state. At minimum: the audit log directory of each product, the anti-rollback state file if `config_trust` is enabled (`antirollback_state_path`), each PostgreSQL database backing Relay consultation or Registry @@ -42,7 +42,7 @@ release evidence. before changing the running containers. Store each release's config and anti-rollback state as a separate restore set; do not overwrite an older set with a newer file. - You can run the release-verification steps in - [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md) + [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.12.0/SECURITY.md) (cosign, and slsa-verifier for releases with provenance). ## Upgrade @@ -124,14 +124,14 @@ release evidence. - Metrics are flowing to your monitoring. This procedure has been partially exercised against a real topology: the - [v0.8.3 -> v0.8.4 exercise record](https://github.com/registrystack/registry-stack/blob/v0.11.0/release/exercises/upgrade-v0.8.3-to-v0.8.4.md) + [v0.8.3 -> v0.8.4 exercise record](https://github.com/registrystack/registry-stack/blob/v0.12.0/release/exercises/upgrade-v0.8.3-to-v0.8.4.md) covers the upgrade and roll-back steps above; release-artifact verification, credential issuance, metrics, the historical Redis replay/nonce path used by that release, and anti-rollback monotonicity were not exercised by that run. Current Registry Notary releases keep replay and nonce correctness state in PostgreSQL. The current - [v0.10.0 -> v0.11.0 -> v0.10.0 release-gate procedure](https://github.com/registrystack/registry-stack/blob/v0.11.0/release/exercises/upgrade-v0.10.0-to-v0.11.0.md) + [v0.10.0 -> v0.11.0 -> v0.10.0 release-gate procedure](https://github.com/registrystack/registry-stack/blob/v0.12.0/release/exercises/upgrade-v0.10.0-to-v0.11.0.md) adds old-evaluation rejection and re-evaluation before issuance, candidate-neutral multiple-credential rejection, and retained audit-chain recovery. It is a prepared procedure and does not claim a successful run diff --git a/docs/site/src/content/docs/reference/api-stability.mdx b/docs/site/src/content/docs/reference/api-stability.mdx index ff02191a..941c2c89 100644 --- a/docs/site/src/content/docs/reference/api-stability.mdx +++ b/docs/site/src/content/docs/reference/api-stability.mdx @@ -52,7 +52,7 @@ The enforcement column names the repository CI checks so the mechanism is audita | Registry Manifest schema and rendered artifacts | `registry-manifest/v1` and the rendered artifact schema versions, governed by [RS-DM-MANIFEST](../../spec/rs-dm-manifest/) | `validate_manifest` accepts only `registry-manifest/v1`; REQ-DM-MANIFEST-013 requires strict unknown-key rejection at parse time | | Source-adaptation integration surfaces | Registry Relay's compiled `http`, `script`, and `snapshot` consultation plans, including the Rhai `consult(ctx)` host API and versioned protocol helpers | Registry Stack project-authoring schemas and fixtures; Relay source-plan compiler and consultation contract tests | | Command-line interfaces | Documented commands and flags of `registryctl`, `registry-relay`, `registry-notary`, and `registry-manifest`, and their machine-readable output modes (`--format json`, `openapi`, `schema`) | CLI reference pages; `registryctl` version test | -| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`, `ghcr.io/registrystack/registry-notary`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md) | +| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`, `ghcr.io/registrystack/registry-notary`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.12.0/SECURITY.md) | | Selected Prometheus metrics | Family name, type, label keys, and label meaning in `release/contracts/selected-metrics.json` | `release/scripts/check-stable-surface-compatibility.py` permits additive families and rejects incompatible changes; product tests verify bounded labels and rendering | Metric help text, output ordering, and corrections to observed values are not covered. diff --git a/docs/site/src/content/docs/reference/apis/registry-notary.mdx b/docs/site/src/content/docs/reference/apis/registry-notary.mdx index d77cd197..f0812a62 100644 --- a/docs/site/src/content/docs/reference/apis/registry-notary.mdx +++ b/docs/site/src/content/docs/reference/apis/registry-notary.mdx @@ -128,7 +128,7 @@ or execute direct registry source connectors. `registry.admin.capability.not_supported`; key and configuration changes require a service restart. - Admin posture: `GET /admin/v1/posture` returns the shared versioned operations observation. - [RS-OP-POSTURE](../../spec/rs-op-posture/) defines its envelope, tiers, and consumer rules. + [RS-OP-POSTURE](../../../spec/rs-op-posture/) defines its envelope, tiers, and consumer rules. ## Behavior the schema cannot express diff --git a/docs/site/src/content/docs/reference/apis/registry-relay.mdx b/docs/site/src/content/docs/reference/apis/registry-relay.mdx index a1f7d00e..f43cc660 100644 --- a/docs/site/src/content/docs/reference/apis/registry-relay.mdx +++ b/docs/site/src/content/docs/reference/apis/registry-relay.mdx @@ -74,7 +74,7 @@ For setup steps, scope strings, and credential configuration, see - **Admin routes.** Reload and metrics routes are mounted on a separate, optional admin listener, require `registry_relay:admin` for reload/config mutation, `registry_relay:metrics_read` for metrics, and `registry_relay:ops_read` for operational posture reads. They do not appear in the - public OpenAPI document. [RS-OP-POSTURE](../../spec/rs-op-posture/) defines the versioned + public OpenAPI document. [RS-OP-POSTURE](../../../spec/rs-op-posture/) defines the versioned posture document returned by `GET /admin/v1/posture`. - **Evidence-offering discovery.** Relay publishes evidence-offering metadata at `GET /metadata/evidence-offerings` and `GET /metadata/evidence-offerings/{offering_id}`. diff --git a/docs/site/src/content/docs/reference/errors.mdx b/docs/site/src/content/docs/reference/errors.mdx index af0ab45b..60d5afad 100644 --- a/docs/site/src/content/docs/reference/errors.mdx +++ b/docs/site/src/content/docs/reference/errors.mdx @@ -345,10 +345,10 @@ Registry Relay returns namespaced codes from its error taxonomy. Codes in the co ## Source The codes above are transcribed from the error taxonomies in the owning crates. -For the v0.11.0 source definitions, read the -[Registry Notary `EvidenceError` taxonomy](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/error.rs) +For the v0.12.0 source definitions, read the +[Registry Notary `EvidenceError` taxonomy](https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/error.rs) and the -[Registry Relay error taxonomy](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/error.rs). +[Registry Relay error taxonomy](https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/error.rs). The Notary server-layer codes (federation, credential status, configuration, admin, readiness, posture, and request handling) are defined in the `registry-notary-server` crate, principally `src/federation/errors.rs`, `src/federation/mod.rs`, and `src/api.rs`. The release compatibility gate compares this registry to its base reference and verifies that every diff --git a/docs/site/src/content/docs/reference/registryctl.mdx b/docs/site/src/content/docs/reference/registryctl.mdx index 65404c13..03803d20 100644 --- a/docs/site/src/content/docs/reference/registryctl.mdx +++ b/docs/site/src/content/docs/reference/registryctl.mdx @@ -281,7 +281,7 @@ default and accept `--format json` for automation. ## Project setup The legacy `init relay` command creates a local spreadsheet project. -In registryctl `v0.11.0`, this generation command requires the strict +In registryctl `v0.12.0`, this generation command requires the strict `registryctl-vX.Y.Z-image-lock.json` from the same release beside the running binary. Set `REGISTRYCTL_IMAGE_LOCK` only when an operator has verified the same file at a separate explicit path. Registryctl does not search the current @@ -308,7 +308,7 @@ Notary-only project contains source-free or self-attested evaluation-only claims ### Local Notary add-on -Registryctl `v0.11.0` adds `registryctl add notary`. From a generated `benefits` spreadsheet +Registryctl `v0.12.0` includes `registryctl add notary`. From a generated `benefits` spreadsheet project, it creates an editable authored project under `notary/project/`, adds a private consultation Relay and local Notary services, and generates local-only evaluator and workload credentials. It refuses an existing Notary directory or a second invocation instead of @@ -379,6 +379,6 @@ Related environment variables are listed in the [environment variable reference] ## Source -The released command tree comes from the registryctl source at `v0.11.0`. +The released command tree comes from the registryctl source at `v0.12.0`. For its canonical definitions, read the -[registryctl command tree in `src/main.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registryctl/src/main.rs). +[registryctl command tree in `src/main.rs`](https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registryctl/src/main.rs). diff --git a/docs/site/src/content/docs/security/report-a-vulnerability.mdx b/docs/site/src/content/docs/security/report-a-vulnerability.mdx index 0806e641..57459601 100644 --- a/docs/site/src/content/docs/security/report-a-vulnerability.mdx +++ b/docs/site/src/content/docs/security/report-a-vulnerability.mdx @@ -62,7 +62,7 @@ For each signed release asset, download the asset, its `.sig` signature, and its certificate from the GitHub Release, then verify: ```bash -asset=registryctl-v0.11.0-linux-amd64 # replace with the asset you downloaded +asset=registryctl-v0.12.0-linux-amd64 # replace with the asset you downloaded cosign verify-blob \ --certificate "${asset}.pem" \ diff --git a/docs/site/src/content/docs/security/support-window.mdx b/docs/site/src/content/docs/security/support-window.mdx index aeecd3cf..359534e9 100644 --- a/docs/site/src/content/docs/security/support-window.mdx +++ b/docs/site/src/content/docs/security/support-window.mdx @@ -53,7 +53,7 @@ maintenance moves to the successor's latest minor. - A security fix ships as a release with signed artifacts and provenance, verifiable as documented in - [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md). + [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.12.0/SECURITY.md). - Release notes identify security-relevant changes. When a fix required tightening covered surface, the notes say so explicitly, per the security exception in the [deprecation policy](../../reference/deprecation-policy/). diff --git a/docs/site/src/content/docs/tutorials/author-registry-project.mdx b/docs/site/src/content/docs/tutorials/author-registry-project.mdx index 7e268190..8ac145c9 100644 --- a/docs/site/src/content/docs/tutorials/author-registry-project.mdx +++ b/docs/site/src/content/docs/tutorials/author-registry-project.mdx @@ -58,7 +58,7 @@ The human-readable result confirms the project, starter provenance, and next com ```text Initialized Registry Stack project "fictional-citizen-registry". Directory: registry-project - Starter: http (Registry Stack 0.11.0) + Starter: http (Registry Stack 0.12.0) Starter content: matches bundled digest Editor support: VS Code and Zed (registry-project/.registry-stack-editor/manifest.json) diff --git a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx index 09e38425..421fc473 100644 --- a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx +++ b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx @@ -44,7 +44,7 @@ credentials, or production records in commands or source control. Pull a release tag or verified digest rather than `latest`: ```sh -docker pull ghcr.io/registrystack/registry-relay:v0.11.0 +docker pull ghcr.io/registrystack/registry-relay:v0.12.0 ``` Review the release verification evidence before promoting an image into an institutional @@ -89,7 +89,7 @@ Generate an API key and store only its fingerprint in the environment named by t ```sh docker run --rm \ - ghcr.io/registrystack/registry-relay:v0.11.0 \ + ghcr.io/registrystack/registry-relay:v0.12.0 \ generate-api-key --id program-system ``` @@ -111,7 +111,7 @@ docker run --rm \ -v "$(pwd)/data:/var/lib/registry-relay/data:ro" \ -v "$(pwd)/cache:/var/lib/registry-relay/cache" \ --env-file \ - ghcr.io/registrystack/registry-relay:v0.11.0 \ + ghcr.io/registrystack/registry-relay:v0.12.0 \ --config /etc/registry-relay/config.yaml ``` diff --git a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx index 22b1bf41..d6757f10 100644 --- a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx @@ -25,14 +25,14 @@ identity reads, and inspect the contract Registry Stack generated. outcome="A protected local API over a benefits workbook, with operational and restricted identity reads separated, one canonical birth date retained, and an edited disclosure rule enforced." time="About 15 minutes after Docker is installed" level="Local single-node" - prerequisites={['registryctl 0.11.0', 'A Docker Compose provider', 'curl']} + prerequisites={['registryctl 0.12.0', 'A Docker Compose provider', 'curl']} /> This tutorial uses synthetic data and local demo credentials. Do not use the generated local keys in production. :::note[Current first-run route] -The v0.11.0 source beta and this local tutorial can be used while hosted credential publication is +The v0.12.0 source beta and this local tutorial can be used while hosted credential publication is held by [GH#330](https://github.com/registrystack/registry-stack/issues/330) and the incomplete [GH#198](https://github.com/registrystack/registry-stack/issues/198) fresh-reader run. ::: @@ -42,7 +42,7 @@ held by [GH#330](https://github.com/registrystack/registry-stack/issues/330) and Install `registryctl` without cloning the repository: The quick installer verifies downloaded release assets against the release's -`SHA256SUMS`. The pinned `v0.11.0` installer installs the binary and matching +`SHA256SUMS`. The pinned `v0.12.0` installer installs the binary and matching release image lock beside each other. It does not authenticate the installer script or release. Before running it, review the available signature and provenance evidence in the @@ -50,7 +50,7 @@ canonical [`release/VERIFY.md`](https://github.com/registrystack/registry-stack/ guide. Evidence availability varies by release, and `v0.8.0` is unsigned. ```sh -curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.11.0 bash +curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.12.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.12.0 bash registryctl --version ``` @@ -61,7 +61,7 @@ Prebuilt `registryctl` assets exist for Linux x86_64, Linux arm64, and macOS arm On Intel macOS, the installer stops after printing the pinned `cargo install` command. It does not run the source build automatically. After installing a Rust toolchain, run the command printed by the installer. For -`v0.11.0`, also checksum-verify the matching release image lock and +`v0.12.0`, also checksum-verify the matching release image lock and place it beside the Cargo-installed binary, as described in the troubleshooting table. ## Create the sample project @@ -483,7 +483,7 @@ Relay refused to start when the floor dropped under 2 on personal data. | `registryctl` is not found | The install directory is not on `PATH`. | Add the directory printed by the installer, usually `~/.local/bin`, to `PATH`. | | The installer reports an unsupported platform | No binary is published for that OS or CPU. | Run the pinned `cargo install` command printed by the installer. For `v0.9.0` or later, also checksum-verify the matching `registryctl-vX.Y.Z-image-lock.json` release asset and place it beside the installed binary. | | `registryctl start` cannot find Docker | Docker or another Compose provider is not installed or running. | Start Docker Desktop, OrbStack, Colima, Podman, or your supported provider, then run `registryctl start` again. | -| Docker reports no `linux/arm64` manifest for a Registry Stack image | The v0.11.0 Relay and Notary images are published for `linux/amd64` only. | Start with `DOCKER_DEFAULT_PLATFORM=linux/amd64 registryctl start`. | +| Docker reports no `linux/arm64` manifest for a Registry Stack image | The v0.12.0 Relay and Notary images are published for `linux/amd64` only. | Start with `DOCKER_DEFAULT_PLATFORM=linux/amd64 registryctl start`. | | `registryctl start` fails and the container log shows `failed to parse config YAML ... unknown field` | The locally cached container image does not match the digest-pinned image in the generated `compose.yaml`. | Run `docker compose pull` in the project directory (on Apple silicon, prefix it with `DOCKER_DEFAULT_PLATFORM=linux/amd64`), then `registryctl start` again. | | `registryctl start` times out and the container log shows `missing field \`commitment\`` | registryctl v0.8.4 pins a service image older than its own generated config format ([GH#278](https://github.com/registrystack/registry-stack/issues/278)). | Pin the project's `compose.yaml` to the published v0.8.4 release digests: `ghcr.io/registrystack/registry-relay@sha256:93e194500a3500ba3f6331d5a0a9a3069127c48a709beccb083a5fcbdbc3ec61` and, when present, `ghcr.io/registrystack/registry-notary@sha256:0cf05184885d7ed17dd9889e20f3797eb2a9ad07517f4ac7c05c03b774a00b8f`. Then run `docker compose pull`; reapply the pins after a generation command rewrites `compose.yaml`. | | `registryctl init` reports that its image lock is missing or invalid | The binary was moved or built without the strict image lock from the same release, or the file failed its release, source, platform, or digest checks. | Rerun the installer from the same pinned target tag so it checksum-verifies and installs both files. For an operator-managed or source-test location, set `REGISTRYCTL_IMAGE_LOCK` to the checksum-verified lock from that exact release. Do not substitute a lock from another version or a mutable image tag. | diff --git a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx index 5bde9e4f..027daf7d 100644 --- a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx @@ -31,7 +31,7 @@ claim. outcome="A live registry-backed boolean claim, matched without a national identifier, with a meaningful policy edit exercised end to end." time="About 10 minutes after completing the first tutorial" level="Local single-node" - prerequisites={['The my-first-api project from the first tutorial', 'Matching Registry Stack v0.11.0 registryctl, release images, and image lock', 'A Docker Compose provider', 'curl']} + prerequisites={['The my-first-api project from the first tutorial', 'Matching Registry Stack v0.12.0 registryctl, release images, and image lock', 'A Docker Compose provider', 'curl']} /> This tutorial uses synthetic data and local demo credentials. Do not use the generated keys or @@ -39,7 +39,7 @@ database settings in production. :::note[Release status] This tutorial requires `registryctl`, immutable Relay and Notary images, and the image lock from -the same Registry Stack `v0.11.0` release. Do not combine a source-built CLI with images or an +the same Registry Stack `v0.12.0` release. Do not combine a source-built CLI with images or an image lock from another release. This is an evaluation-only local tutorial. It does not issue a credential or @@ -392,7 +392,7 @@ answer. | Symptom | Cause | Resolution | | --- | --- | --- | -| `registryctl add notary` is unknown | The CLI predates Registry Stack v0.11.0 or does not match the installed release image lock. | Install `registryctl`, the immutable Relay and Notary images, and the image lock from the same Registry Stack v0.11.0 release. Do not substitute an ad hoc source build or a lock from another release. | +| `registryctl add notary` is unknown | The CLI predates Registry Stack v0.11.0 or does not match the installed release image lock. | Install `registryctl`, the immutable Relay and Notary images, and the image lock from the same Registry Stack v0.12.0 release. Do not substitute an ad hoc source build or a lock from another release. | | `registryctl add notary` says the project already has a Notary add-on | The command has already completed for this project. | Continue with `registryctl start`; do not run the add command twice. | | Notary returns `401` | The evaluator key was not loaded or is from another generated project. | Source `secrets/local.env` again in the current shell. | | Notary returns `403` | The key lacks the evidence scope or the purpose does not match the authored service. | Use `TUTORIAL_EVALUATOR_RAW` and the tutorial purpose shown above. | diff --git a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx index f87240cf..d7259564 100644 --- a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx +++ b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx @@ -57,7 +57,7 @@ The result confirms the initialized project and next command: ```text Initialized Registry Stack project "fictional-civil-registry". Directory: opencrvs-project - Starter: opencrvs-dci (Registry Stack 0.11.0) + Starter: opencrvs-dci (Registry Stack 0.12.0) Starter content: matches bundled digest Editor support: VS Code and Zed (opencrvs-project/.registry-stack-editor/manifest.json) diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml index bf5b1d77..9f44ce93 100644 --- a/docs/site/src/data/contracts.yaml +++ b/docs/site/src/data/contracts.yaml @@ -5,7 +5,7 @@ surface: Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures. source_of_truth: label: Registry Platform crates - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates consumer_note: Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally. - id: registry-platform.ops-posture-v1 name: Registry Ops Posture v1 @@ -27,7 +27,7 @@ surface: "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI)." source_of_truth: label: Registry Relay abstract OpenAPI contract - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json consumer_note: Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling. - id: registry-notary.openapi name: Registry Notary OpenAPI @@ -36,7 +36,7 @@ surface: Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance. source_of_truth: label: Registry Notary OpenAPI generator - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs consumer_note: Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure. - id: registry-notary.oid4vci name: Registry Notary OID4VCI surface @@ -45,7 +45,7 @@ surface: OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate. source_of_truth: label: Registry Notary OID4VCI routes - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs consumer_note: >- Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations @@ -64,7 +64,7 @@ surface: Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields. source_of_truth: label: Registry Notary federation module - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-notary-server/src/federation + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-notary-server/src/federation consumer_note: This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP. - id: registry-manifest.metadata-yaml name: Metadata Manifest @@ -73,7 +73,7 @@ surface: Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata. source_of_truth: label: Registry Manifest core - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-core + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-core consumer_note: Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests. - id: registry-manifest.cpsv-ap-service-catalogue name: CPSV-AP Service Catalogue Render Contract @@ -82,7 +82,7 @@ surface: CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas. source_of_truth: label: Registry Manifest CPSV-AP fixture - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap consumer_note: Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives. - id: registry-manifest.static-publication name: Static Metadata Publication Bundle @@ -91,5 +91,5 @@ surface: Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes. source_of_truth: label: Registry Manifest CLI - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-cli + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-cli consumer_note: The bundle can be hosted as static files without running Registry Relay. diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml index d495e132..afa447af 100644 --- a/docs/site/src/data/docsets.yaml +++ b/docs/site/src/data/docsets.yaml @@ -9,17 +9,47 @@ docsets: description: Current RegistryStack monorepo documentation build. products: registry-stack: - version: v0.11.0 + version: v0.12.0 ref: HEAD registry-relay: - version: v0.11.0 + version: v0.12.0 ref: HEAD registry-notary: - version: v0.11.0 + version: v0.12.0 ref: HEAD registry-manifest: - version: v0.11.0 + version: v0.12.0 ref: HEAD + - id: v0.12.0 + label: v0.12.0 + path: /v/0.12.0/ + status: archived + source: registry-stack-v0.12.0 + repo_docs_source: monorepo + published_at: 2026-07-19 + description: RegistryStack v0.12.0 beta-14 documentation set. + products: + registry-stack: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + registry-platform: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + registry-manifest: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + registry-notary: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + registry-relay: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + registry-registryctl: + version: v0.12.0 + ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + crosswalk: + version: crosswalk-core-v0.2.0 + ref: 1d44ec735fdc8a7c719264b339574371e8330337 - id: v0.11.0 label: v0.11.0 path: /v/0.11.0/ diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json index 8a1256cb..3987f1dd 100644 --- a/docs/site/src/data/generated/contracts.json +++ b/docs/site/src/data/generated/contracts.json @@ -7,7 +7,7 @@ "surface": "Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.", "source_of_truth": { "label": "Registry Platform crates", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates" }, "consumer_note": "Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally." }, @@ -31,7 +31,7 @@ "surface": "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI).", "source_of_truth": { "label": "Registry Relay abstract OpenAPI contract", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json" }, "consumer_note": "Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling." }, @@ -43,7 +43,7 @@ "surface": "Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.", "source_of_truth": { "label": "Registry Notary OpenAPI generator", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs" }, "consumer_note": "Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure." }, @@ -55,7 +55,7 @@ "surface": "OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.", "source_of_truth": { "label": "Registry Notary OID4VCI routes", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" }, "consumer_note": "Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations accept non-delegated registry-backed claims only, and issuance verifies the stored transaction plus exact dependency-closure Relay execution provenance before signing. Transaction code is required by default. An explicit no-PIN profile has a maximum 300-second bearer-offer window. There is no wallet-facing authorization-code grant, public nonce route, response next nonce, source-free issuance, ES256 holder proof, PAR, DPoP, wallet attestation, EUDI, or HAIP claim. External wallet and verifier evidence is candidate-only until recorded against a frozen artifact." }, @@ -67,7 +67,7 @@ "surface": "Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.", "source_of_truth": { "label": "Registry Notary federation module", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-notary-server/src/federation" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-notary-server/src/federation" }, "consumer_note": "This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP." }, @@ -79,7 +79,7 @@ "surface": "Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.", "source_of_truth": { "label": "Registry Manifest core", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-core" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-core" }, "consumer_note": "Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests." }, @@ -91,7 +91,7 @@ "surface": "CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.", "source_of_truth": { "label": "Registry Manifest CPSV-AP fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" }, "consumer_note": "Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives." }, @@ -103,7 +103,7 @@ "surface": "Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.", "source_of_truth": { "label": "Registry Manifest CLI", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-cli" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-cli" }, "consumer_note": "The bundle can be hosted as static files without running Registry Relay." } diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json index 79ae65a8..0e5f882f 100644 --- a/docs/site/src/data/generated/docsets.json +++ b/docs/site/src/data/generated/docsets.json @@ -11,23 +11,63 @@ "description": "Current RegistryStack monorepo documentation build.", "products": { "registry-stack": { - "version": "v0.11.0", + "version": "v0.12.0", "ref": "HEAD" }, "registry-relay": { - "version": "v0.11.0", + "version": "v0.12.0", "ref": "HEAD" }, "registry-notary": { - "version": "v0.11.0", + "version": "v0.12.0", "ref": "HEAD" }, "registry-manifest": { - "version": "v0.11.0", + "version": "v0.12.0", "ref": "HEAD" } } }, + { + "id": "v0.12.0", + "label": "v0.12.0", + "path": "/v/0.12.0/", + "status": "archived", + "source": "registry-stack-v0.12.0", + "repo_docs_source": "monorepo", + "published_at": "2026-07-19", + "description": "RegistryStack v0.12.0 beta-14 documentation set.", + "products": { + "registry-stack": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "registry-platform": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "registry-manifest": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "registry-notary": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "registry-relay": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "registry-registryctl": { + "version": "v0.12.0", + "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc" + }, + "crosswalk": { + "version": "crosswalk-core-v0.2.0", + "ref": "1d44ec735fdc8a7c719264b339574371e8330337" + } + } + }, { "id": "v0.11.0", "label": "v0.11.0", diff --git a/docs/site/src/data/generated/projects.json b/docs/site/src/data/generated/projects.json index 53a78aa2..41ebf27f 100644 --- a/docs/site/src/data/generated/projects.json +++ b/docs/site/src/data/generated/projects.json @@ -19,11 +19,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/platform/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/platform/README.md" }, { "label": "Registry Platform crates", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates" } ], "rename_status": "New shared workspace; not part of the 2026-05-23 rename wave." @@ -48,11 +48,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Local examples", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/examples/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/examples/README.md" } ], "rename_status": "Already using the target repo name locally." @@ -81,15 +81,15 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Local API docs", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/api.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/api.md" }, { "label": "Local metadata docs", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/metadata.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/metadata.md" } ], "rename_status": "Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence." @@ -123,11 +123,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md" }, { "label": "OpenAPI source", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs" } ], "rename_status": "Already using the target repo name locally." diff --git a/docs/site/src/data/generated/standards.json b/docs/site/src/data/generated/standards.json index 66b2be05..0b291f89 100644 --- a/docs/site/src/data/generated/standards.json +++ b/docs/site/src/data/generated/standards.json @@ -20,15 +20,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Relay DCAT catalog tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -54,15 +54,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Relay BRegDCAT-AP route tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -88,7 +88,7 @@ "evidence_docs": [ { "label": "Registry Manifest CPSV-AP fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" } ], "last_checked": "2026-05-25", @@ -114,15 +114,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Relay OGC records API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_records_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_records_api.rs" } ], "last_checked": "2026-07-19", @@ -147,11 +147,11 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Relay OGC Features API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_api.rs" } ], "last_checked": "2026-07-19", @@ -176,7 +176,7 @@ "evidence_docs": [ { "label": "Registry Relay OGC EDR API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_edr_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_edr_api.rs" } ], "last_checked": "2026-07-19", @@ -202,19 +202,19 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Notary README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md" }, { "label": "Registry Relay generated OpenAPI document (pinned)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json" }, { "label": "Registry Notary generated OpenAPI document (pinned)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/openapi/registry-notary.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/openapi/registry-notary.openapi.json" } ], "last_checked": "2026-07-19", @@ -240,15 +240,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Relay SHACL document structure tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -274,11 +274,11 @@ "evidence_docs": [ { "label": "Registry Manifest codelist renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/src/lib.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/src/lib.rs" }, { "label": "Registry Manifest codelist tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/tests/metadata_core.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/tests/metadata_core.rs" } ], "last_checked": "2026-06-20", @@ -304,15 +304,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Manifest form schema fixture (Draft 2020-12)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json" } ], "last_checked": "2026-06-13", @@ -341,15 +341,15 @@ "evidence_docs": [ { "label": "Registry Relay JSON-LD renderers", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/metadata/shacl.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/metadata/shacl.rs" }, { "label": "Registry Notary CCCEV renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs" }, { "label": "Registry Manifest CPSV-AP JSON-LD fixture", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld" } ], "last_checked": "2026-06-13", @@ -376,15 +376,15 @@ "evidence_docs": [ { "label": "Registry Notary SD-JWT VC conformance profile", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/docs/sd-jwt-vc-conformance-profile.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/docs/sd-jwt-vc-conformance-profile.md" }, { "label": "Registry Notary format constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" }, { "label": "Registry Platform SD-JWT crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-sdjwt" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-sdjwt" } ], "last_checked": "2026-06-13", @@ -409,7 +409,7 @@ "evidence_docs": [ { "label": "Registry Notary README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md" } ], "last_checked": "2026-05-23", @@ -438,15 +438,15 @@ "evidence_docs": [ { "label": "Registry Manifest grouped evidence fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" }, { "label": "Registry Notary CCCEV renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs" }, { "label": "Registry Notary media type constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" } ], "last_checked": "2026-05-25", @@ -474,23 +474,23 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" }, { "label": "Registry Relay catalog tests (ODRL offer assertions)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" }, { "label": "Registry Platform PDP ODRL enforcement profile constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-platform-pdp/src/lib.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-platform-pdp/src/lib.rs" }, { "label": "Registry Relay governed evidence PDP path", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/api/governed.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/api/governed.rs" } ], "last_checked": "2026-07-09", @@ -515,11 +515,11 @@ "evidence_docs": [ { "label": "Registry Relay client integration guide", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/client-integration.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/client-integration.md" }, { "label": "Registry Relay aggregates tests (schema-validated SDMX-JSON output)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/aggregates_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/aggregates_entity.rs" } ], "last_checked": "2026-07-19", @@ -544,7 +544,7 @@ "evidence_docs": [ { "label": "Registry Notary claim model", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" } ], "last_checked": "2026-05-23", @@ -598,7 +598,7 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" } ], "last_checked": "2026-05-23", @@ -650,7 +650,7 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" }, { "label": "Registry Stack OpenCRVS project-authoring fixture", @@ -684,11 +684,11 @@ "evidence_docs": [ { "label": "Registry Notary OID4VCI routes", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" }, { "label": "Registry Platform OID4VCI crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-oid4vci" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-oid4vci" }, { "label": "Registry Notary wallet facade specification", @@ -719,11 +719,11 @@ "evidence_docs": [ { "label": "Registry Notary did:jwk handling", - "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" }, { "label": "Registry Platform crypto crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-crypto" + "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-crypto" } ], "last_checked": "2026-06-13", diff --git a/docs/site/src/data/projects.yaml b/docs/site/src/data/projects.yaml index b2ab5696..7e052bda 100644 --- a/docs/site/src/data/projects.yaml +++ b/docs/site/src/data/projects.yaml @@ -14,9 +14,9 @@ - Product-level authorization policy, tenant isolation, audit retention, secret provisioning, or deployment configuration. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/platform/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/platform/README.md - label: Registry Platform crates - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates rename_status: New shared workspace; not part of the 2026-05-23 rename wave. - id: registry-manifest name: Registry Manifest @@ -34,9 +34,9 @@ - Production source configuration. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Local examples - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/examples/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/examples/README.md rename_status: Already using the target repo name locally. - id: registry-relay name: Registry Relay @@ -58,11 +58,11 @@ - Storage table ids or arbitrary SQL in public APIs. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Local API docs - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/api.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/api.md - label: Local metadata docs - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/metadata.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/metadata.md rename_status: Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence. - id: registry-notary name: Registry Notary @@ -89,9 +89,9 @@ - Credential issuance from source-free or self-attested evidence. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md - label: OpenAPI source - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs rename_status: Already using the target repo name locally. - id: solmara-lab name: Solmara Lab diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml index da07016c..314d9dd9 100644 --- a/docs/site/src/data/repo-docs.yaml +++ b/docs/site/src/data/repo-docs.yaml @@ -8,7 +8,7 @@ repos: registry-relay: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.11.0 + version: v0.12.0 local: ../.. openapi: crates/registry-relay/openapi/registry-relay.openapi.json archive_remote: https://github.com/jeremi/registry-relay @@ -23,7 +23,7 @@ repos: last_reviewed: unreviewed standards_referenced: [openapi, ogc-api-records, ogc-api-features, ogc-api-edr, odrl, sp-dci] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [openapi, ogc-api-records, ogc-api-features, ogc-api-edr, odrl, sp-dci] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] @@ -39,7 +39,7 @@ repos: last_reviewed: unreviewed standards_referenced: [openapi, sdmx, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [openapi, sdmx, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] @@ -54,7 +54,7 @@ repos: last_reviewed: unreviewed standards_referenced: [openapi, ogc-api-features, ogc-api-edr, odrl, sp-dci, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [openapi, ogc-api-features, ogc-api-edr, odrl, sp-dci, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] @@ -68,7 +68,7 @@ repos: last_reviewed: unreviewed standards_referenced: [dcat, bregdcat-ap, ogc-api-records, ogc-api-features, ogc-api-edr, openapi, shacl, json-schema, sdmx, sp-dci, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [dcat, bregdcat-ap, ogc-api-records, ogc-api-features, ogc-api-edr, openapi, shacl, json-schema, sdmx, sp-dci, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1] @@ -84,7 +84,7 @@ repos: standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, ogc-api-features, shacl, json-schema, json-ld, odrl, sp-dci, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, ogc-api-features, shacl, json-schema, json-ld, odrl, sp-dci, w3c-did] last_reviewed: unreviewed - src: crates/registry-relay/docs/ops.md @@ -95,7 +95,7 @@ repos: last_reviewed: unreviewed standards_referenced: [dcat, bregdcat-ap, ogc-api-edr, sp-dci, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [dcat, bregdcat-ap, ogc-api-edr, sp-dci, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1] @@ -110,7 +110,7 @@ repos: last_reviewed: unreviewed standards_referenced: [json-ld, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [json-ld, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1] @@ -126,7 +126,7 @@ repos: standards_referenced: [] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [] last_reviewed: unreviewed - src: crates/registry-relay/docs/standards-adapter-operator-guide.md @@ -137,7 +137,7 @@ repos: last_reviewed: unreviewed standards_referenced: [ogc-api-records, ogc-api-features, ogc-api-edr, sp-dci] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [ogc-api-records, ogc-api-features, ogc-api-edr, sp-dci] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1] @@ -153,7 +153,7 @@ repos: standards_referenced: [] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [] last_reviewed: unreviewed - src: crates/registry-relay/STANDARDS_ASSUMPTIONS.md @@ -165,7 +165,7 @@ repos: standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, odrl, sp-dci, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, odrl, sp-dci, w3c-did] last_reviewed: unreviewed - src: crates/registry-relay/docs/relay-scenario-catalog.md @@ -177,7 +177,7 @@ repos: standards_referenced: [dcat, ogc-api-records, ogc-api-features, openapi, shacl, sp-dci] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [dcat, ogc-api-records, ogc-api-features, openapi, shacl, sp-dci] last_reviewed: unreviewed - src: crates/registry-relay/docs/release-notes.md @@ -188,7 +188,7 @@ repos: last_reviewed: unreviewed standards_referenced: [dcat, ogc-api-edr, openapi, shacl, json-ld, sdmx, sp-dci, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [dcat, ogc-api-edr, openapi, shacl, json-ld, sdmx, sp-dci, w3c-did] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1] @@ -198,7 +198,7 @@ repos: registry-notary: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.11.0 + version: v0.12.0 local: ../.. openapi: products/notary/openapi/registry-notary.openapi.json archive_remote: https://github.com/jeremi/registry-notary @@ -216,7 +216,7 @@ repos: - docsets: [beta-2026-06-12] standards_referenced: [sd-jwt-vc, oid4vci] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] standards_referenced: [sd-jwt-vc, oid4vci, fhir-r4] last_reviewed: unreviewed description: Integrator and operator documentation for Registry Notary. @@ -232,7 +232,7 @@ repos: - docsets: [beta-4, beta-3, beta-2026-06-12] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did, fhir-r4] last_reviewed: unreviewed - src: products/notary/docs/client-sdk-guide.md @@ -247,7 +247,7 @@ repos: - docsets: [beta-2026-06-12] standards_referenced: [sd-jwt-vc, oid4vci] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/identity-and-record-matching.md @@ -259,7 +259,7 @@ repos: last_reviewed: unreviewed standards_referenced: [sd-jwt-vc, verifiable-credentials] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] standards_referenced: [sd-jwt-vc, verifiable-credentials] last_reviewed: unreviewed - src: products/notary/docs/source-claim-modeling-guide.md @@ -274,7 +274,7 @@ repos: - docsets: [beta-4, beta-3, beta-2026-06-12] standards_referenced: [sd-jwt-vc] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5] standards_referenced: [sd-jwt-vc, fhir-r4] last_reviewed: unreviewed - src: products/notary/docs/operator-config-reference.md @@ -286,7 +286,7 @@ repos: last_reviewed: unreviewed standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0] standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4] last_reviewed: unreviewed - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] @@ -303,7 +303,7 @@ repos: last_reviewed: unreviewed standards_referenced: [] docset_overrides: - - docsets: [v0.11.0, v0.10.0] + - docsets: [v0.12.0, v0.11.0, v0.10.0] standards_referenced: [] last_reviewed: unreviewed exclude_docsets: [v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] @@ -316,7 +316,7 @@ repos: last_reviewed: unreviewed standards_referenced: [sd-jwt-vc, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] standards_referenced: [sd-jwt-vc, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/credential-issuance-migration.md @@ -327,7 +327,7 @@ repos: last_reviewed: "2026-07-17" standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] docset_overrides: - - docsets: [v0.11.0] + - docsets: [v0.12.0, v0.11.0] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] last_reviewed: "2026-07-17" exclude_docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] @@ -340,7 +340,7 @@ repos: last_reviewed: unreviewed standards_referenced: [sd-jwt-vc, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] standards_referenced: [sd-jwt-vc, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/sd-jwt-vc-conformance-profile.md @@ -352,7 +352,7 @@ repos: last_reviewed: unreviewed standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/notary-capability-matrix.md @@ -364,7 +364,7 @@ repos: standards_referenced: [sd-jwt-vc, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [sd-jwt-vc, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/notary-scenario-patterns.md @@ -376,7 +376,7 @@ repos: standards_referenced: [sd-jwt-vc, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [sd-jwt-vc, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/federated-evaluation-operator-guide.md @@ -388,7 +388,7 @@ repos: standards_referenced: [w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [w3c-did] last_reviewed: unreviewed - src: products/notary/docs/self-attestation-operator-guide.md @@ -400,7 +400,7 @@ repos: standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/deployment-hardening-runbook.md @@ -412,7 +412,7 @@ repos: standards_referenced: [sd-jwt-vc, oid4vci] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [sd-jwt-vc, oid4vci] last_reviewed: unreviewed - src: products/notary/docs/api-reference.md @@ -424,7 +424,7 @@ repos: standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4] last_reviewed: unreviewed - src: products/notary/docs/oid4vci-wallet-interop.md @@ -436,7 +436,7 @@ repos: standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [sd-jwt-vc, oid4vci, w3c-did] last_reviewed: unreviewed - src: products/notary/docs/release-notes.md @@ -448,13 +448,13 @@ repos: standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4] last_reviewed: unreviewed registry-manifest: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.11.0 + version: v0.12.0 local: ../.. archive_remote: https://github.com/jeremi/registry-manifest docs: @@ -467,7 +467,7 @@ repos: last_reviewed: unreviewed standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries] last_reviewed: unreviewed - docsets: [beta-2026-06-12] @@ -486,7 +486,7 @@ repos: - docsets: [beta-2026-06-12] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, odrl] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl] last_reviewed: unreviewed - src: products/manifest/docs/profile-fixtures.md @@ -498,7 +498,7 @@ repos: last_reviewed: unreviewed standards_referenced: [sp-dci] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12] standards_referenced: [sp-dci] last_reviewed: unreviewed - src: products/manifest/docs/reference.md @@ -513,7 +513,7 @@ repos: - docsets: [beta-2026-06-12] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, cccev, odrl, w3c-did] last_reviewed: unreviewed - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3] standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, cccev, odrl, w3c-did] last_reviewed: unreviewed - src: products/manifest/docs/itb-semic-validation.md @@ -525,6 +525,6 @@ repos: standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld] exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12] docset_overrides: - - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] + - docsets: [v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1] standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld] last_reviewed: unreviewed diff --git a/docs/site/src/data/standards.yaml b/docs/site/src/data/standards.yaml index ba399722..94f8d92b 100644 --- a/docs/site/src/data/standards.yaml +++ b/docs/site/src/data/standards.yaml @@ -15,11 +15,11 @@ - access service metadata evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Relay DCAT catalog tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Relay and Manifest emit DCAT-shaped metadata; the emitted catalog structure is asserted by Relay's catalog tests. Profile conformance claims still require profile-specific validation evidence (no DCAT validator output is pinned). - id: bregdcat-ap @@ -38,11 +38,11 @@ - embedded SHACL entity shapes evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Relay BRegDCAT-AP route tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Manifest and Relay emit BRegDCAT-shaped registry and data-service metadata; the `/metadata/dcat/bregdcat-ap` route output is asserted by Relay's catalog tests. CPSV-AP is now the service-discovery layer; BRegDCAT-AP remains the registry and data-service discovery layer. Later BRegDCAT-AP releases require a separate renderer review. - id: cpsv-ap @@ -61,7 +61,7 @@ - competent authority and requirement links evidence_docs: - label: Registry Manifest CPSV-AP fixture - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap last_checked: 2026-05-25 notes: Registry Manifest emits CPSV-AP service catalogues. Registry Relay does not expose a current CPSV-AP runtime route. - id: ogc-api-records @@ -80,11 +80,11 @@ - OGC records item bodies evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Relay OGC records API tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_records_api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_records_api.rs last_checked: 2026-07-19 notes: The link-free Records metadata artifacts are stable for 1.0. The live Relay adapter behind ogcapi-records is a separate experimental, feature-frozen surface outside the 1.0 compatibility promise. Manifest renders and publishes static OGC Records item collections. - id: ogc-api-features @@ -102,9 +102,9 @@ - dataset-scoped feature items evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Relay OGC Features API tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_api.rs last_checked: 2026-07-19 notes: Relay exposes OGC API Features routes behind the ogcapi-features feature. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the profiled route output tested in Registry Relay, not full OGC conformance. - id: ogc-api-edr @@ -122,7 +122,7 @@ - EDR collection discovery evidence_docs: - label: Registry Relay OGC EDR API tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_edr_api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_edr_api.rs last_checked: 2026-07-19 notes: Relay exposes OGC API EDR area routes behind the ogcapi-edr feature for configured spatial aggregates. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the tested adapter surface, not full OGC conformance. - id: openapi @@ -141,13 +141,13 @@ - native OpenAPI publication evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Notary README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md - label: Registry Relay generated OpenAPI document (pinned) - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json - label: Registry Notary generated OpenAPI document (pinned) - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/openapi/registry-notary.openapi.json + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/openapi/registry-notary.openapi.json last_checked: 2026-07-19 notes: Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages. - id: shacl @@ -166,11 +166,11 @@ - entity node shapes evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Relay SHACL document structure tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Relay emits SHACL/JSON-LD documents whose structure is asserted by its catalog tests, and Manifest renders SHACL. No SHACL validator run against the emitted shapes is pinned. - id: skos @@ -189,9 +189,9 @@ - BRegDCAT/DCAT dataset codelist references evidence_docs: - label: Registry Manifest codelist renderer - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/src/lib.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/src/lib.rs - label: Registry Manifest codelist tests - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/tests/metadata_core.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/tests/metadata_core.rs last_checked: 2026-06-20 notes: Registry Manifest emits flat SKOS-shaped `skos:ConceptScheme` and `skos:Concept` nodes for manifest codelists inside SHACL and BRegDCAT/DCAT-shaped outputs. It does not yet publish a standalone SKOS artifact or claim full SKOS conformance. - id: json-schema @@ -210,11 +210,11 @@ - static discovery bundle evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Manifest form schema fixture (Draft 2020-12) - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json last_checked: 2026-06-13 notes: Manifest renders entity JSON Schemas (the pinned fixture declares Draft 2020-12) and Relay exposes entity schema endpoints. - id: json-ld @@ -236,11 +236,11 @@ - CCCEV render output evidence_docs: - label: Registry Relay JSON-LD renderers - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/metadata/shacl.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/metadata/shacl.rs - label: Registry Notary CCCEV renderer - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs - label: Registry Manifest CPSV-AP JSON-LD fixture - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld last_checked: 2026-06-13 notes: The projects emit JSON-LD artifacts and contexts; a pinned JSON-LD fixture is cited as a concrete emitted artifact. No broad RDF dataset conformance claim is made here. - id: sd-jwt-vc @@ -260,11 +260,11 @@ - shared SD-JWT VC issuance and holder-proof helpers evidence_docs: - label: Registry Notary SD-JWT VC conformance profile - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/docs/sd-jwt-vc-conformance-profile.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/docs/sd-jwt-vc-conformance-profile.md - label: Registry Notary format constants - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs - label: Registry Platform SD-JWT crate - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-sdjwt + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-sdjwt last_checked: 2026-06-13 notes: >- Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers. @@ -289,7 +289,7 @@ - SD-JWT VC credential issuance evidence_docs: - label: Registry Notary README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md last_checked: 2026-05-23 notes: Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts. - id: cccev @@ -311,11 +311,11 @@ - evidence node JSON-LD evidence_docs: - label: Registry Manifest grouped evidence fixture - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap - label: Registry Notary CCCEV renderer - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs - label: Registry Notary media type constants - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs last_checked: 2026-05-25 notes: Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed. - id: odrl @@ -336,15 +336,15 @@ - governed evidence PDP constraint terms evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md - label: Registry Relay catalog tests (ODRL offer assertions) - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs - label: Registry Platform PDP ODRL enforcement profile constants - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-platform-pdp/src/lib.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-platform-pdp/src/lib.rs - label: Registry Relay governed evidence PDP path - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/api/governed.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/api/governed.rs last_checked: 2026-07-09 notes: Relay catalog JSON-LD can include dataset-scoped ODRL Offers, and Manifest renders ODRL policy metadata. That publication surface is descriptive and is not itself an access grant. The shared governed Evidence Gateway profile vocabulary includes `odrl:purpose` and `odrl:spatial`, but Relay's governed runtime path currently enforces `odrl:purpose` only; `odrl:spatial` and other unsupported ODRL terms are denied fail-closed rather than treated as enforced. - id: sdmx @@ -362,9 +362,9 @@ - content negotiation delivery evidence_docs: - label: Registry Relay client integration guide - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/client-integration.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/client-integration.md - label: Registry Relay aggregates tests (schema-validated SDMX-JSON output) - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/aggregates_entity.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/aggregates_entity.rs last_checked: 2026-07-19 notes: >- Relay serves configured aggregates as SDMX-JSON 2.1 data messages via @@ -391,7 +391,7 @@ - provenance-shaped claim fields evidence_docs: - label: Registry Notary claim model - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs last_checked: 2026-05-23 notes: The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped. - id: fhir-r4 @@ -429,7 +429,7 @@ - capability boundary evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md last_checked: 2026-05-23 notes: Relay explores a protected consultation gateway model rather than the current single uniform CRUD platform. - id: universal-dpi-safeguards @@ -472,7 +472,7 @@ - authored Relay source integration evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md - label: Registry Stack OpenCRVS project-authoring fixture url: https://github.com/registrystack/registry-stack/tree/2dfcf2ddf22e2c0fa4bf5fd84eb06b8736057605/crates/registryctl/tests/fixtures/project-authoring/opencrvs last_checked: 2026-07-19 @@ -497,9 +497,9 @@ - registry-backed holder-wallet issuance evidence_docs: - label: Registry Notary OID4VCI routes - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs - label: Registry Platform OID4VCI crate - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-oid4vci + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-oid4vci - label: Registry Notary wallet facade specification url: https://github.com/registrystack/registry-stack/blob/37ce044567f05f8b3088b54f5bd4dbf389fd2ddb/products/notary/specs/openid4vci-wallet-facade-spec.md last_checked: 2026-07-19 @@ -533,8 +533,8 @@ - shared DID validation and Ed25519 JWK helpers evidence_docs: - label: Registry Notary did:jwk handling - url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs - label: Registry Platform crypto crate - url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-crypto + url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-crypto last_checked: 2026-06-13 notes: Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk. diff --git a/editors/tests/install_test.sh b/editors/tests/install_test.sh index 764d5095..4b253e83 100755 --- a/editors/tests/install_test.sh +++ b/editors/tests/install_test.sh @@ -57,7 +57,7 @@ readonly FAKE_OPEN_CANONICAL printf '%s\n' \ '[workspace]' \ '[workspace.package]' \ - 'version = "0.11.0"' \ + 'version = "0.12.0"' \ > "${FAKE_REPO_ROOT}/Cargo.toml" printf '{}\n' > "${FAKE_REPO_ROOT}/editors/vscode/package.json" printf '[package]\nname = "registry-stack-zed"\n' \ @@ -79,7 +79,7 @@ command_name="$(basename -- "$0")" case "${command_name}" in registryctl) if [[ "${1:-}" == "--version" ]]; then - printf 'registryctl %s\n' "${FAKE_REGISTRYCTL_VERSION:-0.11.0}" + printf 'registryctl %s\n' "${FAKE_REGISTRYCTL_VERSION:-0.12.0}" fi ;; node) @@ -176,7 +176,7 @@ if FAKE_REGISTRYCTL_VERSION=0.10.0 "${INSTALLER}" vscode \ > "${mismatch_output}" 2>&1; then fail 'version mismatch should fail' fi -assert_contains 'this checkout is 0.11.0 but registryctl is 0.10.0' "${mismatch_output}" +assert_contains 'this checkout is 0.12.0 but registryctl is 0.10.0' "${mismatch_output}" assert_not_contains 'npm <' "${COMMAND_LOG}" reset_log diff --git a/products/manifest/CHANGELOG.md b/products/manifest/CHANGELOG.md index 390b9cc2..9b1556fe 100644 --- a/products/manifest/CHANGELOG.md +++ b/products/manifest/CHANGELOG.md @@ -7,6 +7,10 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm ## [Unreleased] +## [0.12.0] - 2026-07-19 + +- No user-visible Registry Manifest changes. + ## [0.11.0] - 2026-07-18 - No user-visible Registry Manifest changes. diff --git a/products/manifest/docs/release-notes.md b/products/manifest/docs/release-notes.md index c8d392d6..58d088e6 100644 --- a/products/manifest/docs/release-notes.md +++ b/products/manifest/docs/release-notes.md @@ -2,6 +2,10 @@ ## Unreleased +## 0.12.0 + +- No user-visible Registry Manifest changes. + ## 0.11.0 - Registry Manifest has no user-visible changes in this release. diff --git a/products/manifest/fuzz/Cargo.lock b/products/manifest/fuzz/Cargo.lock index a448bd7b..99b34c19 100644 --- a/products/manifest/fuzz/Cargo.lock +++ b/products/manifest/fuzz/Cargo.lock @@ -188,7 +188,7 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "registry-manifest-cli" -version = "0.11.0" +version = "0.12.0" dependencies = [ "registry-manifest-core", "serde", @@ -199,7 +199,7 @@ dependencies = [ [[package]] name = "registry-manifest-core" -version = "0.11.0" +version = "0.12.0" dependencies = [ "oxiri", "registry-platform-canonical-json", @@ -223,7 +223,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.11.0" +version = "0.12.0" dependencies = [ "ryu-js", "serde", diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md index a3e7dcbf..9b559fef 100644 --- a/products/notary/CHANGELOG.md +++ b/products/notary/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.12.0] - 2026-07-19 + ### Added - Added a complete source-tested registry-backed OID4VCI journey for EdDSA and @@ -45,6 +47,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - OID4VCI remains limited to EdDSA or ES256 issuer signing and EdDSA `did:jwk` holder proof. No EUDI, HAIP, PAR, DPoP, wallet-attestation, ES256-holder, or external conformance claim is made without frozen candidate evidence. +- Maintained Notary runtime images now use Debian 13 distroless. Release checks + enforce the expected base and vulnerability policy before publication. ## [0.11.0] - 2026-07-18 diff --git a/products/notary/docs/release-notes.md b/products/notary/docs/release-notes.md index 0826723b..165265f5 100644 --- a/products/notary/docs/release-notes.md +++ b/products/notary/docs/release-notes.md @@ -2,6 +2,8 @@ ## Unreleased +## 0.12.0 + - BREAKING: The 1.0 wallet facade supports only issuer-initiated pre-authorized code backed by a stored registry transaction. The former credential-offer and public nonce routes are removed, and the credential @@ -25,6 +27,12 @@ selectively disclosable. - External wallet, verifier, OIDF, EUDI, or HAIP evidence remains candidate-only until recorded against a frozen release artifact. +- Batch evaluation now has a fixed 100-member platform ceiling with lower + operator limits and pre-side-effect `batch.too_large` rejection. +- Registry Notary publishes a generated Draft 2020-12 runtime configuration + schema derived from the production deserialization graph. +- Maintained Notary runtime images now use Debian 13 distroless. Release checks + enforce the expected base and vulnerability policy before publication. ## 0.11.0 diff --git a/products/notary/fuzz/Cargo.lock b/products/notary/fuzz/Cargo.lock index 1b3a7b02..729c91a3 100644 --- a/products/notary/fuzz/Cargo.lock +++ b/products/notary/fuzz/Cargo.lock @@ -16,7 +16,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -318,7 +318,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -379,7 +379,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -388,6 +388,12 @@ version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" +[[package]] +name = "dyn-clone" +version = "1.0.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" + [[package]] name = "ecdsa" version = "0.16.9" @@ -545,7 +551,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -1016,7 +1022,7 @@ dependencies = [ "quote", "rustc_version", "simd_cesu8", - "syn", + "syn 2.0.118", ] [[package]] @@ -1035,7 +1041,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264" dependencies = [ "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -1481,9 +1487,29 @@ dependencies = [ "bitflags", ] +[[package]] +name = "ref-cast" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d" +dependencies = [ + "ref-cast-impl", +] + +[[package]] +name = "ref-cast-impl" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.0", +] + [[package]] name = "registry-notary-core" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "humantime-serde", @@ -1495,6 +1521,7 @@ dependencies = [ "registry-platform-oid4vci", "registry-platform-ops", "registry-platform-sdjwt", + "schemars", "serde", "serde_json", "sha2 0.11.0", @@ -1516,7 +1543,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.11.0" +version = "0.12.0" dependencies = [ "serde", "sha2 0.11.0", @@ -1527,7 +1554,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "sha2 0.11.0", @@ -1537,7 +1564,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.11.0" +version = "0.12.0" dependencies = [ "ryu-js", "serde", @@ -1547,7 +1574,7 @@ dependencies = [ [[package]] name = "registry-platform-config" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "registry-platform-crypto", @@ -1561,7 +1588,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "aws-lc-rs", @@ -1582,7 +1609,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "bytes", @@ -1605,7 +1632,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "registry-platform-crypto", @@ -1618,7 +1645,7 @@ dependencies = [ [[package]] name = "registry-platform-ops" -version = "0.11.0" +version = "0.12.0" dependencies = [ "fs2", "registry-platform-config", @@ -1633,7 +1660,7 @@ dependencies = [ [[package]] name = "registry-platform-replay" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -1644,7 +1671,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "getrandom 0.4.3", @@ -1837,6 +1864,31 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "schemars" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc" +dependencies = [ + "dyn-clone", + "ref-cast", + "schemars_derive", + "serde", + "serde_json", +] + +[[package]] +name = "schemars_derive" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f" +dependencies = [ + "proc-macro2", + "quote", + "serde_derive_internals", + "syn 2.0.118", +] + [[package]] name = "scopeguard" version = "1.2.0" @@ -1913,7 +1965,18 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", +] + +[[package]] +name = "serde_derive_internals" +version = "0.29.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.118", ] [[package]] @@ -2060,6 +2123,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "syn" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2fac314a64dc9a36e61a9eb4261a5e9bbfbc922b27e518af97bc32b926cf967" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + [[package]] name = "sync_wrapper" version = "1.0.2" @@ -2077,7 +2151,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2124,7 +2198,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2206,7 +2280,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2361,7 +2435,7 @@ checksum = "6ba0b99ee52df3028635d93840c797102da61f8a7bb3cf751032455895b52ef8" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2457,7 +2531,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn", + "syn 2.0.118", "wasm-bindgen-shared", ] @@ -2684,7 +2758,7 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", "synstructure", ] @@ -2705,7 +2779,7 @@ checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2725,7 +2799,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", "synstructure", ] @@ -2746,7 +2820,7 @@ checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] @@ -2779,7 +2853,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 2.0.118", ] [[package]] diff --git a/products/notary/openapi/registry-notary.openapi.json b/products/notary/openapi/registry-notary.openapi.json index 457b25db..a6392824 100644 --- a/products/notary/openapi/registry-notary.openapi.json +++ b/products/notary/openapi/registry-notary.openapi.json @@ -1787,7 +1787,7 @@ }, "summary": "Standalone evidence evaluation, rendering, and credential issuance service.", "title": "Registry Notary API", - "version": "0.11.0" + "version": "0.12.0" }, "openapi": "3.1.0", "paths": { @@ -3185,7 +3185,7 @@ "example": { "info": { "title": "Registry Notary API", - "version": "0.11.0" + "version": "0.12.0" }, "openapi": "3.1.0", "paths": { diff --git a/products/platform/CHANGELOG.md b/products/platform/CHANGELOG.md index 735fae6c..4b7ca7fa 100644 --- a/products/platform/CHANGELOG.md +++ b/products/platform/CHANGELOG.md @@ -2,6 +2,16 @@ ## Unreleased +## v0.12.0 - 2026-07-19 + +### Added + +- `registry-platform-ops` now carries the restricted per-resource Relay + refresh-health posture contract and a matching reference fixture. +- `CredentialFingerprintProvider`, `KeyProviderKind`, and `KeyStatus` expose + declaration-ordered `ALL` rosters so config-schema generation consumes the + same closed labels as runtime parsing and diagnostics. + ## v0.11.0 - 2026-07-18 - BREAKING: shared configuration `${VAR}` expansion now rejects environment diff --git a/products/platform/fuzz/Cargo.lock b/products/platform/fuzz/Cargo.lock index d47e8475..5d5ec0ce 100644 --- a/products/platform/fuzz/Cargo.lock +++ b/products/platform/fuzz/Cargo.lock @@ -1433,7 +1433,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.11.0" +version = "0.12.0" dependencies = [ "serde", "sha2 0.11.0", @@ -1444,7 +1444,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "sha2 0.11.0", @@ -1454,7 +1454,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.11.0" +version = "0.12.0" dependencies = [ "ryu-js", "serde", @@ -1464,7 +1464,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "aws-lc-rs", @@ -1504,7 +1504,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "bytes", @@ -1527,7 +1527,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "registry-platform-crypto", @@ -1540,7 +1540,7 @@ dependencies = [ [[package]] name = "registry-platform-oidc" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "jsonwebtoken", @@ -1555,7 +1555,7 @@ dependencies = [ [[package]] name = "registry-platform-replay" -version = "0.11.0" +version = "0.12.0" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -1566,7 +1566,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.11.0" +version = "0.12.0" dependencies = [ "base64", "getrandom 0.4.3", diff --git a/release/VERIFY.md b/release/VERIFY.md index b1c037cf..62ca4a57 100644 --- a/release/VERIFY.md +++ b/release/VERIFY.md @@ -89,7 +89,7 @@ working directory rather than the `verify-v0.8.4` directory above. ### Download The v0.9.0+ Assets ```bash -tag=v0.11.0 +tag=v0.12.0 asset=registryctl-${tag}-linux-amd64 image_lock=registryctl-${tag}-image-lock.json image_lock_sbom=${image_lock}.spdx.json diff --git a/release/manifests/registry-stack-beta-14.yaml b/release/manifests/registry-stack-beta-14.yaml new file mode 100644 index 00000000..d463c7a8 --- /dev/null +++ b/release/manifests/registry-stack-beta-14.yaml @@ -0,0 +1,31 @@ +stack: + release: beta-14 + version: 0.12.0 + source_repo: registrystack/registry-stack + source_ref: 865921f0d8e874e3cefe548d000e8915c4abecbc + source_tag: v0.12.0 + status: release-candidate + +artifacts: + registry-notary: 0.12.0 + registry-notary-cel-worker: 0.12.0 + registry-relay: 0.12.0 + registry-relay-rhai-worker: 0.12.0 + registry-manifest-cli: 0.12.0 + registryctl: 0.12.0 + registryctl-image-lock: 0.12.0 + registry-docs: 0.12.0 + +external: + crosswalk: + repo: PublicSchema/crosswalk + ref: 1d44ec735fdc8a7c719264b339574371e8330337 + status: tested external input + +warnings: + - code: hosted-publication-held + classification: hosted-gate-held + detail: Source beta may ship; hosted/public announcement remains held until Solmara Lab is atomically repinned to the published v0.12.0 digests and its adopter smoke passes. + - code: solmara-adopter-repin-pending + classification: adopter-gate-pending + detail: Solmara Lab consumes released images and will be repinned and validated only after immutable v0.12.0 digests exist. diff --git a/release/notes/v0.12.0.md b/release/notes/v0.12.0.md new file mode 100644 index 00000000..89c080e7 --- /dev/null +++ b/release/notes/v0.12.0.md @@ -0,0 +1,113 @@ +# Registry Stack v0.12.0 + +Registry Stack v0.12.0 is the beta-14 technical release after v0.11.0. It is a +pre-1.0 release for evaluation, integration pilots, and public review. It does +not declare the 1.0 compatibility freeze or claim completed external +integration, OpenID conformance, lifecycle exercise, hosted promotion, or an +independent pilot. + +## Highlights + +- Registry Notary's OID4VCI wallet facade now supports issuer-initiated + pre-authorized code backed by a stored registry transaction. The public + credential-offer and nonce routes are removed. Token responses provide the + transaction-bound proof nonce used for credential issuance. +- Source-tested OID4VCI coverage now includes EdDSA and ES256 issuer profiles, + EdDSA `did:jwk` holder proof, exact generated metadata, replay protection, + registry-backed provenance, and fail-closed status verification. External + wallet, verifier, OIDF, EUDI, and HAIP evidence remains candidate-only. +- Registry Notary adds a bounded batch-evaluation contract with an immutable + 100-member platform ceiling, lower operator limits, and pre-side-effect HTTP + 413 rejection. It also publishes a generated Draft 2020-12 runtime + configuration schema derived from the production deserialization graph. +- Registry Relay records the intended 1.0 support roster. OpenAPI and problem + contracts, portable metadata, CSV and XLSX input, and JSON aggregate output + are stable candidates. Optional standards adapters and the shipped + non-gated Parquet, CSV aggregate, and SDMX-JSON surfaces remain experimental + and outside the 1.0 compatibility promise. +- Registry Relay exposes protected per-resource last-good refresh health in + metrics and restricted posture. Failed refreshes retain a valid last-good + table while reporting consecutive failures and the last successful load. +- Maintained Registry Relay and Registry Notary runtime images move to Debian + 13. The release workflow pins the Debian 13 builder and enforces image-base + and vulnerability-policy checks before publication. +- Registryctl interactive report commands now use concise human-readable + output by default. Automation must request `--format json`. Registryctl also + uses the workspace YAML parser and stages editor setup before publishing a + new project, avoiding partial output when initialization fails. +- Candidate-neutral upgrade, external-integration, and Relay OIDC harnesses + now bind exact release identifiers and immutable candidate assets. These + harnesses are preparation only until run and reviewed against the published + beta-14 artifacts. + +## Migration from v0.11.0 + +### Update OID4VCI clients and issuer configuration + +- Remove calls to `GET /oid4vci/credential-offer` and `POST /oid4vci/nonce`. + Start with `GET /oid4vci/offer/start`, complete the identity-provider + callback, redeem the rendered offer at `POST /oid4vci/token`, and use the + token response's proof nonce. +- Keep transaction codes enabled unless an explicit no-PIN profile is + required. A no-PIN profile must retain a pre-authorized-code lifetime no + longer than 300 seconds. +- Configure EdDSA or ES256 issuer signing with EdDSA `did:jwk` holder proof. + Do not infer support for other issuer or holder profiles from source tests. +- Re-run `registry-notary state install` and `registry-notary state doctor` + offline before admitting traffic. Do not start an older Notary binary + against state written by v0.12.0. + +### Update batch callers and configuration validation + +- Keep each Notary batch at or below the configured per-claim and global + limits and the fixed 100-member platform ceiling. Handle `batch.too_large` + as a pre-side-effect rejection. +- Validate Notary configuration against + `schemas/registry-notary.config.schema.json`, then run the v0.12.0 product + doctor. Schema validity proves structure, not deployability or security + posture. + +### Update Registryctl automation + +- Add `--format json` to scripts that consume Registryctl report output. + Interactive commands now default to human output; artifact and protocol + streams keep their native formats. +- Regenerate project outputs with Registryctl v0.12.0 and its matching + `registryctl-v0.12.0-image-lock.json`. Run `registryctl test`, `check`, and + `build` before signing or deploying the result. + +### Review Relay features and runtime images + +- Build the canonical release feature set unless an explicitly reviewed + experimental adapter is required. Experimental surfaces remain outside the + 1.0 compatibility promise even when their source or format ships. +- Repin deployments to the v0.12.0 Debian 13 image digests. Do not rely on + packages or paths inherited from the previous Debian 12 runtime. + +### Exercise the release boundary + +- Keep complete, version-matched v0.11.0 and v0.12.0 recovery sets. Populate + and validate `release/exercises/upgrade-exercise-v1.template.json` only + against exact published candidate artifacts. The committed template is not + evidence of a successful upgrade or rollback. +- Fix forward after v0.12.0 accepts writes or issues credentials unless a + reviewed recovery record proves a safe conversion back to the earlier + release. + +## Release evidence + +The release workflow retains the eight-artifact public inventory: Registry +Notary, the Notary CEL worker, Registry Relay, the Relay Rhai worker, Registry +Manifest CLI, Registryctl, the Registryctl image lock, and Registry Docs. The +workflow also publishes images, checksums, Software Bill of Materials files, +vulnerability reports, a release capsule, signatures, and provenance. + +Crosswalk remains pinned at +`1d44ec735fdc8a7c719264b339574371e8330337`. Registry Manifest has no +user-visible change in this train. + +The committed evidence harnesses have not yet been run against published +v0.12.0 assets. Solmara Lab repinning, the complete upgrade and rollback +exercise, OpenCRVS and DHIS2 E2 results, OpenID conformance, external wallet or +verifier interoperability, hosted publication, and the independent pilot +remain held. This source note does not claim any of those results. diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py index e352bfe8..ac653497 100755 --- a/release/scripts/test_registry_release.py +++ b/release/scripts/test_registry_release.py @@ -305,7 +305,7 @@ def test_validate_docsets_matches_release_manifests(self) -> None: result = run_tool("validate-docsets") self.assertEqual(0, result.returncode, result.stderr) - self.assertIn("validated 7 versioned docsets", result.stdout) + self.assertIn("validated 8 versioned docsets", result.stdout) def test_validate_docsets_rejects_external_ref_drift(self) -> None: with tempfile.TemporaryDirectory() as tmp: From d1542dbef558a826637c88238e06fcec8b5c9b53 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Mon, 20 Jul 2026 04:18:37 +0700 Subject: [PATCH 2/5] fix(docs): use canonical Relay justfile path Signed-off-by: Jeremi Joslin --- docs/site/scripts/relay-release-contract.test.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/site/scripts/relay-release-contract.test.mjs b/docs/site/scripts/relay-release-contract.test.mjs index 01421e19..6c1468c2 100644 --- a/docs/site/scripts/relay-release-contract.test.mjs +++ b/docs/site/scripts/relay-release-contract.test.mjs @@ -177,7 +177,7 @@ test('canonical Relay release, local image, and OpenAPI use the same feature set 'stable link-free OGC Records metadata must remain in the pinned OpenAPI', ); - const justfile = await readRepo('crates/registry-relay/Justfile'); + const justfile = await readRepo('crates/registry-relay/justfile'); assert.match(justfile, /^\s*cargo test --all-features$/m, 'all-feature tests must remain enabled'); }); From a668f40917a14b47e2c25fc3bebfef9cebc251b7 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Mon, 20 Jul 2026 04:33:33 +0700 Subject: [PATCH 3/5] fix(docs): pin pre-tag evidence to frozen source Signed-off-by: Jeremi Joslin --- docs/site/src/data/contracts.yaml | 16 ++-- docs/site/src/data/generated/contracts.json | 16 ++-- docs/site/src/data/generated/standards.json | 98 ++++++++++----------- docs/site/src/data/standards.yaml | 98 ++++++++++----------- 4 files changed, 114 insertions(+), 114 deletions(-) diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml index 9f44ce93..7dffd0a7 100644 --- a/docs/site/src/data/contracts.yaml +++ b/docs/site/src/data/contracts.yaml @@ -5,7 +5,7 @@ surface: Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures. source_of_truth: label: Registry Platform crates - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates consumer_note: Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally. - id: registry-platform.ops-posture-v1 name: Registry Ops Posture v1 @@ -27,7 +27,7 @@ surface: "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI)." source_of_truth: label: Registry Relay abstract OpenAPI contract - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json consumer_note: Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling. - id: registry-notary.openapi name: Registry Notary OpenAPI @@ -36,7 +36,7 @@ surface: Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance. source_of_truth: label: Registry Notary OpenAPI generator - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/openapi.rs consumer_note: Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure. - id: registry-notary.oid4vci name: Registry Notary OID4VCI surface @@ -45,7 +45,7 @@ surface: OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate. source_of_truth: label: Registry Notary OID4VCI routes - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs consumer_note: >- Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations @@ -64,7 +64,7 @@ surface: Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields. source_of_truth: label: Registry Notary federation module - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-notary-server/src/federation + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/federation consumer_note: This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP. - id: registry-manifest.metadata-yaml name: Metadata Manifest @@ -73,7 +73,7 @@ surface: Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata. source_of_truth: label: Registry Manifest core - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-core + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core consumer_note: Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests. - id: registry-manifest.cpsv-ap-service-catalogue name: CPSV-AP Service Catalogue Render Contract @@ -82,7 +82,7 @@ surface: CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas. source_of_truth: label: Registry Manifest CPSV-AP fixture - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap consumer_note: Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives. - id: registry-manifest.static-publication name: Static Metadata Publication Bundle @@ -91,5 +91,5 @@ surface: Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes. source_of_truth: label: Registry Manifest CLI - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-cli + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-cli consumer_note: The bundle can be hosted as static files without running Registry Relay. diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json index 3987f1dd..fcb86652 100644 --- a/docs/site/src/data/generated/contracts.json +++ b/docs/site/src/data/generated/contracts.json @@ -7,7 +7,7 @@ "surface": "Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.", "source_of_truth": { "label": "Registry Platform crates", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates" }, "consumer_note": "Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally." }, @@ -31,7 +31,7 @@ "surface": "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI).", "source_of_truth": { "label": "Registry Relay abstract OpenAPI contract", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json" }, "consumer_note": "Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling." }, @@ -43,7 +43,7 @@ "surface": "Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.", "source_of_truth": { "label": "Registry Notary OpenAPI generator", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/openapi.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/openapi.rs" }, "consumer_note": "Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure." }, @@ -55,7 +55,7 @@ "surface": "OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.", "source_of_truth": { "label": "Registry Notary OID4VCI routes", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs" }, "consumer_note": "Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations accept non-delegated registry-backed claims only, and issuance verifies the stored transaction plus exact dependency-closure Relay execution provenance before signing. Transaction code is required by default. An explicit no-PIN profile has a maximum 300-second bearer-offer window. There is no wallet-facing authorization-code grant, public nonce route, response next nonce, source-free issuance, ES256 holder proof, PAR, DPoP, wallet attestation, EUDI, or HAIP claim. External wallet and verifier evidence is candidate-only until recorded against a frozen artifact." }, @@ -67,7 +67,7 @@ "surface": "Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.", "source_of_truth": { "label": "Registry Notary federation module", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-notary-server/src/federation" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/federation" }, "consumer_note": "This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP." }, @@ -79,7 +79,7 @@ "surface": "Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.", "source_of_truth": { "label": "Registry Manifest core", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-core" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core" }, "consumer_note": "Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests." }, @@ -91,7 +91,7 @@ "surface": "CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.", "source_of_truth": { "label": "Registry Manifest CPSV-AP fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap" }, "consumer_note": "Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives." }, @@ -103,7 +103,7 @@ "surface": "Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.", "source_of_truth": { "label": "Registry Manifest CLI", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-manifest-cli" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-cli" }, "consumer_note": "The bundle can be hosted as static files without running Registry Relay." } diff --git a/docs/site/src/data/generated/standards.json b/docs/site/src/data/generated/standards.json index 0b291f89..de51252f 100644 --- a/docs/site/src/data/generated/standards.json +++ b/docs/site/src/data/generated/standards.json @@ -20,15 +20,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Relay DCAT catalog tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -54,15 +54,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Relay BRegDCAT-AP route tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -88,7 +88,7 @@ "evidence_docs": [ { "label": "Registry Manifest CPSV-AP fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap" } ], "last_checked": "2026-05-25", @@ -114,15 +114,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Relay OGC records API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_records_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_records_api.rs" } ], "last_checked": "2026-07-19", @@ -147,11 +147,11 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Relay OGC Features API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_api.rs" } ], "last_checked": "2026-07-19", @@ -176,7 +176,7 @@ "evidence_docs": [ { "label": "Registry Relay OGC EDR API tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_edr_api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_edr_api.rs" } ], "last_checked": "2026-07-19", @@ -202,19 +202,19 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Notary README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md" }, { "label": "Registry Relay generated OpenAPI document (pinned)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json" }, { "label": "Registry Notary generated OpenAPI document (pinned)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/openapi/registry-notary.openapi.json" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/openapi/registry-notary.openapi.json" } ], "last_checked": "2026-07-19", @@ -240,15 +240,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Relay SHACL document structure tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs" } ], "last_checked": "2026-06-13", @@ -274,11 +274,11 @@ "evidence_docs": [ { "label": "Registry Manifest codelist renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/src/lib.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/src/lib.rs" }, { "label": "Registry Manifest codelist tests", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/tests/metadata_core.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/tests/metadata_core.rs" } ], "last_checked": "2026-06-20", @@ -304,15 +304,15 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Manifest form schema fixture (Draft 2020-12)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json" } ], "last_checked": "2026-06-13", @@ -341,15 +341,15 @@ "evidence_docs": [ { "label": "Registry Relay JSON-LD renderers", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/metadata/shacl.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/metadata/shacl.rs" }, { "label": "Registry Notary CCCEV renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs" }, { "label": "Registry Manifest CPSV-AP JSON-LD fixture", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld" } ], "last_checked": "2026-06-13", @@ -376,15 +376,15 @@ "evidence_docs": [ { "label": "Registry Notary SD-JWT VC conformance profile", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/docs/sd-jwt-vc-conformance-profile.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/docs/sd-jwt-vc-conformance-profile.md" }, { "label": "Registry Notary format constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs" }, { "label": "Registry Platform SD-JWT crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-sdjwt" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-sdjwt" } ], "last_checked": "2026-06-13", @@ -409,7 +409,7 @@ "evidence_docs": [ { "label": "Registry Notary README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md" } ], "last_checked": "2026-05-23", @@ -438,15 +438,15 @@ "evidence_docs": [ { "label": "Registry Manifest grouped evidence fixture", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap" }, { "label": "Registry Notary CCCEV renderer", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs" }, { "label": "Registry Notary media type constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs" } ], "last_checked": "2026-05-25", @@ -474,23 +474,23 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Manifest README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md" }, { "label": "Registry Relay catalog tests (ODRL offer assertions)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs" }, { "label": "Registry Platform PDP ODRL enforcement profile constants", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-platform-pdp/src/lib.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-pdp/src/lib.rs" }, { "label": "Registry Relay governed evidence PDP path", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/api/governed.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/api/governed.rs" } ], "last_checked": "2026-07-09", @@ -515,11 +515,11 @@ "evidence_docs": [ { "label": "Registry Relay client integration guide", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/client-integration.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/docs/client-integration.md" }, { "label": "Registry Relay aggregates tests (schema-validated SDMX-JSON output)", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/aggregates_entity.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/aggregates_entity.rs" } ], "last_checked": "2026-07-19", @@ -544,7 +544,7 @@ "evidence_docs": [ { "label": "Registry Notary claim model", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs" } ], "last_checked": "2026-05-23", @@ -598,7 +598,7 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" } ], "last_checked": "2026-05-23", @@ -650,7 +650,7 @@ "evidence_docs": [ { "label": "Registry Relay README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md" }, { "label": "Registry Stack OpenCRVS project-authoring fixture", @@ -684,11 +684,11 @@ "evidence_docs": [ { "label": "Registry Notary OID4VCI routes", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs" }, { "label": "Registry Platform OID4VCI crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-oid4vci" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-oid4vci" }, { "label": "Registry Notary wallet facade specification", @@ -719,11 +719,11 @@ "evidence_docs": [ { "label": "Registry Notary did:jwk handling", - "url": "https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs" + "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs" }, { "label": "Registry Platform crypto crate", - "url": "https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-crypto" + "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-crypto" } ], "last_checked": "2026-06-13", diff --git a/docs/site/src/data/standards.yaml b/docs/site/src/data/standards.yaml index 94f8d92b..fd1627e0 100644 --- a/docs/site/src/data/standards.yaml +++ b/docs/site/src/data/standards.yaml @@ -15,11 +15,11 @@ - access service metadata evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Relay DCAT catalog tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Relay and Manifest emit DCAT-shaped metadata; the emitted catalog structure is asserted by Relay's catalog tests. Profile conformance claims still require profile-specific validation evidence (no DCAT validator output is pinned). - id: bregdcat-ap @@ -38,11 +38,11 @@ - embedded SHACL entity shapes evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Relay BRegDCAT-AP route tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Manifest and Relay emit BRegDCAT-shaped registry and data-service metadata; the `/metadata/dcat/bregdcat-ap` route output is asserted by Relay's catalog tests. CPSV-AP is now the service-discovery layer; BRegDCAT-AP remains the registry and data-service discovery layer. Later BRegDCAT-AP releases require a separate renderer review. - id: cpsv-ap @@ -61,7 +61,7 @@ - competent authority and requirement links evidence_docs: - label: Registry Manifest CPSV-AP fixture - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap last_checked: 2026-05-25 notes: Registry Manifest emits CPSV-AP service catalogues. Registry Relay does not expose a current CPSV-AP runtime route. - id: ogc-api-records @@ -80,11 +80,11 @@ - OGC records item bodies evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Relay OGC records API tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_records_api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_records_api.rs last_checked: 2026-07-19 notes: The link-free Records metadata artifacts are stable for 1.0. The live Relay adapter behind ogcapi-records is a separate experimental, feature-frozen surface outside the 1.0 compatibility promise. Manifest renders and publishes static OGC Records item collections. - id: ogc-api-features @@ -102,9 +102,9 @@ - dataset-scoped feature items evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Relay OGC Features API tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_api.rs last_checked: 2026-07-19 notes: Relay exposes OGC API Features routes behind the ogcapi-features feature. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the profiled route output tested in Registry Relay, not full OGC conformance. - id: ogc-api-edr @@ -122,7 +122,7 @@ - EDR collection discovery evidence_docs: - label: Registry Relay OGC EDR API tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/ogc_edr_api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_edr_api.rs last_checked: 2026-07-19 notes: Relay exposes OGC API EDR area routes behind the ogcapi-edr feature for configured spatial aggregates. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the tested adapter surface, not full OGC conformance. - id: openapi @@ -141,13 +141,13 @@ - native OpenAPI publication evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Notary README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md - label: Registry Relay generated OpenAPI document (pinned) - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/openapi/registry-relay.openapi.json + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json - label: Registry Notary generated OpenAPI document (pinned) - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/openapi/registry-notary.openapi.json + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/openapi/registry-notary.openapi.json last_checked: 2026-07-19 notes: Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages. - id: shacl @@ -166,11 +166,11 @@ - entity node shapes evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Relay SHACL document structure tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs last_checked: 2026-06-13 notes: Relay emits SHACL/JSON-LD documents whose structure is asserted by its catalog tests, and Manifest renders SHACL. No SHACL validator run against the emitted shapes is pinned. - id: skos @@ -189,9 +189,9 @@ - BRegDCAT/DCAT dataset codelist references evidence_docs: - label: Registry Manifest codelist renderer - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/src/lib.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/src/lib.rs - label: Registry Manifest codelist tests - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-manifest-core/tests/metadata_core.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/tests/metadata_core.rs last_checked: 2026-06-20 notes: Registry Manifest emits flat SKOS-shaped `skos:ConceptScheme` and `skos:Concept` nodes for manifest codelists inside SHACL and BRegDCAT/DCAT-shaped outputs. It does not yet publish a standalone SKOS artifact or claim full SKOS conformance. - id: json-schema @@ -210,11 +210,11 @@ - static discovery bundle evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Manifest form schema fixture (Draft 2020-12) - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json last_checked: 2026-06-13 notes: Manifest renders entity JSON Schemas (the pinned fixture declares Draft 2020-12) and Relay exposes entity schema endpoints. - id: json-ld @@ -236,11 +236,11 @@ - CCCEV render output evidence_docs: - label: Registry Relay JSON-LD renderers - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/metadata/shacl.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/metadata/shacl.rs - label: Registry Notary CCCEV renderer - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs - label: Registry Manifest CPSV-AP JSON-LD fixture - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld last_checked: 2026-06-13 notes: The projects emit JSON-LD artifacts and contexts; a pinned JSON-LD fixture is cited as a concrete emitted artifact. No broad RDF dataset conformance claim is made here. - id: sd-jwt-vc @@ -260,11 +260,11 @@ - shared SD-JWT VC issuance and holder-proof helpers evidence_docs: - label: Registry Notary SD-JWT VC conformance profile - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/docs/sd-jwt-vc-conformance-profile.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/docs/sd-jwt-vc-conformance-profile.md - label: Registry Notary format constants - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs - label: Registry Platform SD-JWT crate - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-sdjwt + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-sdjwt last_checked: 2026-06-13 notes: >- Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers. @@ -289,7 +289,7 @@ - SD-JWT VC credential issuance evidence_docs: - label: Registry Notary README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md last_checked: 2026-05-23 notes: Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts. - id: cccev @@ -311,11 +311,11 @@ - evidence node JSON-LD evidence_docs: - label: Registry Manifest grouped evidence fixture - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/products/manifest/fixtures/cpsv-ap + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap - label: Registry Notary CCCEV renderer - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/runtime.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs - label: Registry Notary media type constants - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs last_checked: 2026-05-25 notes: Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed. - id: odrl @@ -336,15 +336,15 @@ - governed evidence PDP constraint terms evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Manifest README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md - label: Registry Relay catalog tests (ODRL offer assertions) - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/catalog_entity.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs - label: Registry Platform PDP ODRL enforcement profile constants - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-platform-pdp/src/lib.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-pdp/src/lib.rs - label: Registry Relay governed evidence PDP path - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/src/api/governed.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/api/governed.rs last_checked: 2026-07-09 notes: Relay catalog JSON-LD can include dataset-scoped ODRL Offers, and Manifest renders ODRL policy metadata. That publication surface is descriptive and is not itself an access grant. The shared governed Evidence Gateway profile vocabulary includes `odrl:purpose` and `odrl:spatial`, but Relay's governed runtime path currently enforces `odrl:purpose` only; `odrl:spatial` and other unsupported ODRL terms are denied fail-closed rather than treated as enforced. - id: sdmx @@ -362,9 +362,9 @@ - content negotiation delivery evidence_docs: - label: Registry Relay client integration guide - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/docs/client-integration.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/docs/client-integration.md - label: Registry Relay aggregates tests (schema-validated SDMX-JSON output) - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/tests/aggregates_entity.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/aggregates_entity.rs last_checked: 2026-07-19 notes: >- Relay serves configured aggregates as SDMX-JSON 2.1 data messages via @@ -391,7 +391,7 @@ - provenance-shaped claim fields evidence_docs: - label: Registry Notary claim model - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-core/src/model.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs last_checked: 2026-05-23 notes: The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped. - id: fhir-r4 @@ -429,7 +429,7 @@ - capability boundary evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md last_checked: 2026-05-23 notes: Relay explores a protected consultation gateway model rather than the current single uniform CRUD platform. - id: universal-dpi-safeguards @@ -472,7 +472,7 @@ - authored Relay source integration evidence_docs: - label: Registry Relay README - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md - label: Registry Stack OpenCRVS project-authoring fixture url: https://github.com/registrystack/registry-stack/tree/2dfcf2ddf22e2c0fa4bf5fd84eb06b8736057605/crates/registryctl/tests/fixtures/project-authoring/opencrvs last_checked: 2026-07-19 @@ -497,9 +497,9 @@ - registry-backed holder-wallet issuance evidence_docs: - label: Registry Notary OID4VCI routes - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs - label: Registry Platform OID4VCI crate - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-oid4vci + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-oid4vci - label: Registry Notary wallet facade specification url: https://github.com/registrystack/registry-stack/blob/37ce044567f05f8b3088b54f5bd4dbf389fd2ddb/products/notary/specs/openid4vci-wallet-facade-spec.md last_checked: 2026-07-19 @@ -533,8 +533,8 @@ - shared DID validation and Ed25519 JWK helpers evidence_docs: - label: Registry Notary did:jwk handling - url: https://github.com/registrystack/registry-stack/blob/v0.12.0/crates/registry-notary-server/src/api.rs + url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs - label: Registry Platform crypto crate - url: https://github.com/registrystack/registry-stack/tree/v0.12.0/crates/registry-platform-crypto + url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-crypto last_checked: 2026-06-13 notes: Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk. From bb5c16a600850fe5d78cb220a41b38c7626312d7 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Mon, 20 Jul 2026 05:00:46 +0700 Subject: [PATCH 4/5] fix(registryctl): align local Notary listener Signed-off-by: Jeremi Joslin --- crates/registryctl/src/lib.rs | 15 +++++++++++++++ .../notary_addon/compose-fragment.yaml.tmpl | 3 +++ 2 files changed, 18 insertions(+) diff --git a/crates/registryctl/src/lib.rs b/crates/registryctl/src/lib.rs index ec26fd3c..e580fb65 100644 --- a/crates/registryctl/src/lib.rs +++ b/crates/registryctl/src/lib.rs @@ -4700,6 +4700,14 @@ mod tests { services["registry-notary"]["network_mode"], "service:registry-notary-jwks" ); + assert_eq!( + services["registry-notary"]["environment"]["REGISTRY_NOTARY_BIND"], + "0.0.0.0:8081" + ); + assert_eq!( + services["registry-notary"]["environment"]["REGISTRY_NOTARY_HEALTHCHECK_URL"], + "http://127.0.0.1:8081/healthz" + ); assert!(consultation_mounts.iter().any(|mount| { mount == "./notary/project/.registry-stack/build/local/private/relay/config:/etc/registry-relay:ro" @@ -4783,6 +4791,7 @@ mod tests { assert!(notary_config_text.contains("person-registration-accepted")); assert!(notary_config_text.contains("pending")); let notary_config: Value = serde_norway::from_str(¬ary_config_text).unwrap(); + assert_eq!(notary_config["server"]["bind"], "0.0.0.0:8081"); assert_eq!(notary_config["state"]["storage"], "in_memory"); assert!(notary_config["evidence"]["credential_profiles"] .as_mapping() @@ -4801,6 +4810,12 @@ mod tests { assert_eq!(signing_keys.len(), 1); assert!(signing_keys.contains_key("relay-workload")); + let consultation_relay_config: Value = serde_norway::from_str( + &fs::read_to_string(project.join(CONSULTATION_RELAY_CONFIG_PATH)).unwrap(), + ) + .unwrap(); + assert_eq!(consultation_relay_config["server"]["bind"], "0.0.0.0:8082"); + let error = add_notary_to_project(&project, &image_lock).unwrap_err(); assert!(format!("{error:#}").contains("already has a Notary")); } diff --git a/crates/registryctl/src/templates/notary_addon/compose-fragment.yaml.tmpl b/crates/registryctl/src/templates/notary_addon/compose-fragment.yaml.tmpl index 97208139..bec0401d 100644 --- a/crates/registryctl/src/templates/notary_addon/compose-fragment.yaml.tmpl +++ b/crates/registryctl/src/templates/notary_addon/compose-fragment.yaml.tmpl @@ -74,6 +74,9 @@ services: user: "${REGISTRY_STACK_RUNTIME_UID:-65532}:${REGISTRY_STACK_RUNTIME_GID:-65532}" env_file: - ./secrets/local.env + environment: + REGISTRY_NOTARY_BIND: 0.0.0.0:8081 + REGISTRY_NOTARY_HEALTHCHECK_URL: http://127.0.0.1:8081/healthz command: [--config, /etc/registry-notary/notary.yaml] network_mode: service:registry-notary-jwks volumes: From c8e071db1f15c8444d97ff854a8690884017cf22 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Mon, 20 Jul 2026 05:28:21 +0700 Subject: [PATCH 5/5] fix(ci): provision OpenAPI compatibility gate Signed-off-by: Jeremi Joslin --- .github/workflows/ci.yml | 15 +++++ .../notary/openapi/oasdiff-1.0-err-ignore.txt | 9 --- .../notary/scripts/check-openapi-contract.sh | 56 +------------------ release/scripts/check-gates-inventory.py | 6 ++ 4 files changed, 22 insertions(+), 64 deletions(-) delete mode 100644 products/notary/openapi/oasdiff-1.0-err-ignore.txt diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2199f6c3..ae895808 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,8 @@ env: CARGO_LLVM_COV_VERSION: "0.8.7" GITLEAKS_VERSION: "8.30.1" GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" + OASDIFF_VERSION: "1.23.0" + OASDIFF_LINUX_X64_SHA256: "972b10535c3db4366b9dc3ebc11ca021279af3095267c3cffdca854a3a3c4f89" jobs: changes: @@ -341,6 +343,19 @@ jobs: with: tool: cargo-deny@0.19.8,just@1.51.0 + - name: Install pinned oasdiff + shell: bash + run: | + set -euo pipefail + mkdir -p "${RUNNER_TEMP}/bin" + curl --fail --silent --show-error --location \ + --output "${RUNNER_TEMP}/oasdiff.tar.gz" \ + "https://github.com/oasdiff/oasdiff/releases/download/v${OASDIFF_VERSION}/oasdiff_${OASDIFF_VERSION}_linux_amd64.tar.gz" + echo "${OASDIFF_LINUX_X64_SHA256} ${RUNNER_TEMP}/oasdiff.tar.gz" | sha256sum -c - + tar -xzf "${RUNNER_TEMP}/oasdiff.tar.gz" -C "${RUNNER_TEMP}/bin" oasdiff + chmod +x "${RUNNER_TEMP}/bin/oasdiff" + echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}" + - name: Cargo metadata run: cargo metadata --locked --format-version 1 >/tmp/registry-stack-cargo-metadata.json diff --git a/products/notary/openapi/oasdiff-1.0-err-ignore.txt b/products/notary/openapi/oasdiff-1.0-err-ignore.txt deleted file mode 100644 index c93a49de..00000000 --- a/products/notary/openapi/oasdiff-1.0-err-ignore.txt +++ /dev/null @@ -1,9 +0,0 @@ -# One-time accepted Registry Stack 1.0 break. The wallet facade now exposes -# registry-backed, issuer-initiated pre-authorized issuance only. The contract -# check also requires every line below to remain present in the raw diff, so this -# file must be removed after the comparison baseline includes the new contract. -GET /oid4vci/credential-offer api path removed without deprecation -POST /oid4vci/nonce api path removed without deprecation -GET /.well-known/openid-credential-issuer removed the optional property 'nonce_endpoint' from the response with the '200' status -POST /oid4vci/credential removed the optional property 'c_nonce' from the response with the '200' status -POST /oid4vci/credential removed the optional property 'c_nonce_expires_in' from the response with the '200' status diff --git a/products/notary/scripts/check-openapi-contract.sh b/products/notary/scripts/check-openapi-contract.sh index f48d480b..832b8a6b 100755 --- a/products/notary/scripts/check-openapi-contract.sh +++ b/products/notary/scripts/check-openapi-contract.sh @@ -9,8 +9,6 @@ BASE_REF="${1:-${OPENAPI_CONTRACT_BASE_REF:-}}" WORK_DIR="target/openapi-contract" GENERATED="$WORK_DIR/generated.openapi.json" BASELINE="$WORK_DIR/base.openapi.json" -RAW_BREAKING_DIFF="$WORK_DIR/breaking.singleline.txt" -BREAKING_IGNORE="openapi/oasdiff-1.0-err-ignore.txt" mkdir -p "$WORK_DIR" @@ -62,56 +60,4 @@ if ! git cat-file -e "$BASE_REF:$SPEC_PATH_FROM_ROOT" 2>/dev/null; then fi git show "$BASE_REF:$SPEC_PATH_FROM_ROOT" > "$BASELINE" - -# Keep the one-time 1.0 exception exact and self-expiring. An added allowlist -# line fails this check, and an accepted line that disappears from the raw diff -# also fails so the exception cannot silently survive a baseline advance. -oasdiff breaking --format singleline "$BASELINE" "$GENERATED" > "$RAW_BREAKING_DIFF" -python3 - "$BREAKING_IGNORE" "$RAW_BREAKING_DIFF" <<'PY' -import sys -from pathlib import Path - -expected = { - "GET /oid4vci/credential-offer api path removed without deprecation", - "POST /oid4vci/nonce api path removed without deprecation", - "GET /.well-known/openid-credential-issuer removed the optional property 'nonce_endpoint' from the response with the '200' status", - "POST /oid4vci/credential removed the optional property 'c_nonce' from the response with the '200' status", - "POST /oid4vci/credential removed the optional property 'c_nonce_expires_in' from the response with the '200' status", -} - -ignore_path = Path(sys.argv[1]) -raw_path = Path(sys.argv[2]) -allowed = { - line.strip() - for line in ignore_path.read_text(encoding="utf-8").splitlines() - if line.strip() and not line.lstrip().startswith("#") -} -if allowed != expected: - missing = sorted(expected - allowed) - extra = sorted(allowed - expected) - raise SystemExit( - f"Notary OpenAPI 1.0 allowlist is not exact; missing={missing}, extra={extra}" - ) - -observed = set() -for raw_line in raw_path.read_text(encoding="utf-8").splitlines(): - marker = "in API " - if marker not in raw_line: - continue - change = raw_line.split(marker, 1)[1] - if " [" in change: - change = change.rsplit(" [", 1)[0] - observed.add(change.strip().removesuffix(".").rstrip()) - -if observed != allowed: - missing = sorted(allowed - observed) - extra = sorted(observed - allowed) - raise SystemExit( - f"Notary OpenAPI 1.0 raw diff is not exactly allowlisted; " - f"missing={missing}, extra={extra}" - ) -PY - -oasdiff breaking --fail-on ERR --err-ignore "$BREAKING_IGNORE" \ - --warn-ignore "$BREAKING_IGNORE" \ - "$BASELINE" "$GENERATED" +oasdiff breaking --fail-on ERR "$BASELINE" "$GENERATED" diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py index 80b1cb73..611c56c3 100644 --- a/release/scripts/check-gates-inventory.py +++ b/release/scripts/check-gates-inventory.py @@ -71,6 +71,12 @@ ("Gitleaks archive checksum", "GITLEAKS_LINUX_X64_SHA256:"), ("Gitleaks root config", "--config .gitleaks.toml"), ("Gitleaks redaction", "--redact"), + ("oasdiff version pin", 'OASDIFF_VERSION: "1.23.0"'), + ("oasdiff archive checksum", "OASDIFF_LINUX_X64_SHA256:"), + ( + "oasdiff pinned install", + '"https://github.com/oasdiff/oasdiff/releases/download/v${OASDIFF_VERSION}/oasdiff_${OASDIFF_VERSION}_linux_amd64.tar.gz"', + ), ("Platform fuzz job", "platform-fuzz:"), ("Platform fuzz version pin", 'CARGO_FUZZ_VERSION: "0.13.2"'), ("Platform fuzz bounded runtime", "-max_total_time=60"),