feat: harden Registry artifact workflows

Author: a19q3

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+- Harden the unified artifact Registry boundary: default discovery now hides
+  pending/rejected releases and paginates by package coordinate; deployment
+  records and admin recovery must match the immutable CKB `hash_type` and
+  `dep_type`; generated CellDep descriptors re-query mainnet and reject spent
+  code/DepGroup Cells; RPC calls are time- and size-bounded; and deployment
+  capability use commits with the chain-verified state. Positive static-mirror
+  publication now follows database admission, while suppressive states are
+  mirrored first to fail closed; deferred sync is audited rather than
+  advertising uncommitted positive state. Add the capability-signed
+  `cellc artifact set-availability` publisher path used by Manage, defensive
+  frontend page deduplication, and complete `Artifact.toml` plus bundle
+  scaffolding for non-CellScript submissions.
 - Redesign the Registry submission and package-maintenance surfaces around
   contextual, task-first workflows: remove the public `Manage` tab and
   redundant form controls, link maintenance from package details, guide first

docs/CELLSCRIPT_GATE_POLICY.md

@@ -66,7 +66,10 @@ service coverage, not evidence
 that Cloudflare, R2, Hyperdrive, Neon, DNS, or a production deployment works.
 The CLI coverage includes the explicit first-publish admission sequence:
 `cellc auth capability submit`, `cellc auth namespace claim`, then
-`cellc publish`. Capability registration does not silently claim a namespace;
+`cellc publish`; publisher maintenance additionally uses the capability-signed
+`cellc artifact set-availability` path, and `cellc artifact cell-dep` performs a
+fresh mainnet liveness check before producing a transaction-builder descriptor.
+Capability registration does not silently claim a namespace;
 the claim response must be `active` before the write API accepts a version.
 Registry API tests pin both accepted publisher roots: JoyID signatures under
 `principal_type = joyid_ckb` and recoverable CKB message signatures under

docs/CELLSCRIPT_REGISTRY_PHASE1.md

@@ -220,7 +220,8 @@ cellc artifact verify --bundle vault-lock.bundle.json --receipt vault-lock.bundl
 cellc artifact pin acme/vault-lock@1.0.0 --output Artifacts.lock --accept-hash-bound
 cellc artifact copy acme/starter@1.0.0 --destination ./new-project --accept-hash-bound
 cellc artifact record-deployment acme/vault-lock@1.0.0 --code-hash <hash> --hash-type data1 --dep-type code --tx-hash <tx_hash> --index 0 --capability-key-id <key_id>
-cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound
+cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound --rpc-url https://mainnet.ckb.dev/rpc
+cellc artifact set-availability acme/vault-lock@1.0.0 --status yanked --reason "security advisory" --capability-key-id <key_id>
 cellc artifact commitment acme/vault-lock@1.0.0 --output RegistryCommitment.json
 ```
 
@@ -230,12 +231,20 @@ exact Registry identity and requires an explicit trust decision for
 integrity-only evidence. `copy` is no-overwrite and rejects traversal,
 platform-specific, duplicate, or unauthenticated paths. `cell-dep` requires an
 attached RPC-verified mainnet deployment and preserves the DepGroup container
-and resolved code-member identities. It never turns an `undeployed` release
-into a CellDep.
+and resolved code-member identities. Before writing `CellDep.json`, it queries
+mainnet again, rejects a spent deployment or resolved code member, checks the
+RPC chain identity, and rebinds `hash_type` / `dep_type` to the signed profile
+contract. It never turns an `undeployed` release into a CellDep.
 
 `record-deployment` derives the artifact/data identity from the signed Registry
 release, signs a mainnet-only payload with the scoped capability key, and sends
-it to the API for live-Cell verification.
+it to the API for live-Cell verification. Both publisher and recovery paths
+reject deployment modes that differ from `profile_contract.ckb`.
+
+`set-availability` is the publisher control-plane path used by the Manage UI.
+It signs a short-lived, nonce-protected capability payload; publishers may set
+`active`, `deprecated`, or `yanked`, while administrative quarantine remains a
+separate privileged action.
 
 `commitment` produces the canonical `cellscript-registry-commitment-v1`
 payload, CKB Blake2b commitment, and compact `CSREGv1 || hash` Cell data. The
@@ -245,9 +254,10 @@ hash used for chain indexing.
 
 ## Publisher Authorisation
 
-The website presents a single “Connect CKB wallet” entry. Its modal lists all
-supported CKB wallet connectors, but only connectors actually detected in the
-current browser can sign immediately; install links are shown for the rest.
+The website presents a single “Connect CKB wallet” entry. Its modal separates
+CCC-detected browser signers, which can connect immediately, from wallet
+directory entries, which open an official site and continue through the manual
+payload/signature path. A directory entry is never reported as connected.
 Network selection is not exposed because authorisation and deployment are
 mainnet-only.
 
@@ -272,10 +282,14 @@ GET  /v1/artifacts/:namespace/:name/releases/:release/commitment
 GET  /artifacts/:namespace/:name/releases/:release.json
 POST /v1/artifacts/:namespace/:name/releases
 POST /v1/artifacts/:namespace/:name/releases/:release/deployments
+POST /v1/artifacts/:namespace/:name/releases/:release/availability
 ```
 
 The list endpoint accepts `q`, `namespace`, `kind`, `verification`,
-`deployment`, `availability`, `limit`, and `offset`. Static release objects and
+`deployment`, `availability`, `limit`, and `offset`. Without an explicit
+`verification` filter, public discovery includes only accepted verification
+states and excludes `pending` / `rejected`. Pagination offsets count package
+coordinates, not version rows. Static release objects and
 immutable bundles are served separately from the write database so consumers
 can hash-verify and cache them independently.
 
@@ -300,7 +314,10 @@ that every artifact is installable.
 - Deployment evidence must match the published executable hash and a live
   mainnet Cell.
 - Quarantined releases are not returned by public detail or evidence routes.
-- Immutable bundle writes complete before release admission.
+- The database admits positive identity/state atomically before publishing its
+  mutable static mirror. Suppressive states are mirrored first to fail closed;
+  other mirror failures are audited and retried by verification sync, so an
+  uncommitted release or deployment is never advertised as current.
 - State transitions append evidence; they do not mutate hash identity.
 
 ## Validation

docs/wiki/Tutorial-12-Phase1-Registry-End-to-End.md

@@ -180,12 +180,15 @@ cellc artifact fetch acme/vault-lock@1.0.0 --output vault-lock.bundle.json
 cellc artifact verify --bundle vault-lock.bundle.json --receipt vault-lock.bundle.json.receipt.json
 cellc artifact pin acme/vault-lock@1.0.0 --output Artifacts.lock --accept-hash-bound
 cellc artifact record-deployment acme/vault-lock@1.0.0 --code-hash <hash> --hash-type data1 --dep-type code --tx-hash <tx_hash> --index 0 --capability-key-id <key_id>
-cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound
+cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound --rpc-url https://mainnet.ckb.dev/rpc
+cellc artifact set-availability acme/vault-lock@1.0.0 --status yanked --reason "security advisory" --capability-key-id <key_id>
 cellc artifact commitment acme/vault-lock@1.0.0 --output RegistryCommitment.json
 ```
 
-The last two commands fail until mainnet deployment evidence has been verified.
-The commitment file contains canonical `CSREGv1` Cell data; attestation still
+`cell-dep` fails until mainnet deployment evidence has been verified, then
+rechecks that the deployment (and resolved DepGroup code member) is still live
+at consumption time. Deployment mode must equal the immutable profile
+contract. The commitment file contains canonical `CSREGv1` Cell data; attestation still
 requires the API to read a live mainnet Cell and match its Type/Lock identities.
 
 ## 6. Other artifact kinds

services/registry-api/src/domain.ts

@@ -9,6 +9,8 @@ export const PUBLISH_PROTOCOL = "cellscript-registry-publish-v1";
 export const PUBLISH_ACTION = "publish";
 export const DEPLOYMENT_PROTOCOL = "cellscript-registry-deployment";
 export const DEPLOYMENT_ACTION = "record_deployment";
+export const AVAILABILITY_PROTOCOL = "cellscript-registry-availability-v1";
+export const AVAILABILITY_ACTION = "set_availability";
 export const REGISTRY_SCHEMA_VERSION = 1;
 export const ARTIFACT_PROFILE_CONTRACT_SCHEMA = "cellscript-registry-profile-contract-v1";
 export const CELLSCRIPT_EDITION = "2026";
@@ -124,6 +126,22 @@ export interface DeploymentPayload {
   cli_version: string;
 }
 
+export interface AvailabilityPayload {
+  protocol: typeof AVAILABILITY_PROTOCOL;
+  action: typeof AVAILABILITY_ACTION;
+  registry_origin: string;
+  namespace: string;
+  name: string;
+  release: string;
+  availability_status: Exclude<AvailabilityStatus, "quarantined">;
+  reason?: string;
+  capability_key_id: string;
+  nonce: string;
+  issued_at: string;
+  expires_at: string;
+  cli_version: string;
+}
+
 export interface RegistryVersionEntry {
   version: string;
   tag: string;
@@ -419,6 +437,60 @@ export function validateDeploymentPayload(
   };
 }
 
+export function validateAvailabilityPayload(
+  input: unknown,
+  registryOrigin: string,
+  now: Date,
+): AvailabilityPayload {
+  const value = assertPlainObject(input, "invalid_availability_payload");
+  if (requireString(value, "protocol") !== AVAILABILITY_PROTOCOL || requireString(value, "action") !== AVAILABILITY_ACTION) {
+    throw new ApiError(400, "invalid_availability_action", "availability payload has the wrong protocol or action");
+  }
+  if (requireString(value, "registry_origin") !== registryOrigin) {
+    throw new ApiError(400, "invalid_registry_origin", "availability payload registry_origin does not match this API");
+  }
+  const availabilityStatus = requireString(value, "availability_status");
+  if (!(availabilityStatus === "active" || availabilityStatus === "deprecated" || availabilityStatus === "yanked")) {
+    throw new ApiError(400, "invalid_publisher_availability_status", "publishers may set availability_status to active, deprecated, or yanked");
+  }
+  const reason = value["reason"] === undefined ? undefined : requireString(value, "reason").trim();
+  if (availabilityStatus === "yanked" && !reason) {
+    throw new ApiError(400, "availability_reason_required", "yanking a release requires a reason");
+  }
+  if (reason && reason.length > 500) {
+    throw new ApiError(400, "invalid_availability_reason", "availability reason must be no longer than 500 characters");
+  }
+  const capabilityKeyId = requireString(value, "capability_key_id");
+  if (!/^cap_[0-9a-f]{32}$/.test(capabilityKeyId)) {
+    throw new ApiError(400, "invalid_capability_key_id", "capability_key_id is malformed");
+  }
+  const nonce = requireString(value, "nonce");
+  if (!/^0x[0-9a-fA-F]{16,}$/.test(nonce)) {
+    throw new ApiError(400, "invalid_nonce", "nonce must be hex and at least 8 bytes");
+  }
+  const issuedAt = requireString(value, "issued_at");
+  const expiresAt = requireString(value, "expires_at");
+  parseTimestamp(issuedAt, "issued_at");
+  if (parseTimestamp(expiresAt, "expires_at").getTime() <= now.getTime()) {
+    throw new ApiError(401, "availability_payload_expired", "availability payload has expired");
+  }
+  return {
+    protocol: AVAILABILITY_PROTOCOL,
+    action: AVAILABILITY_ACTION,
+    registry_origin: registryOrigin,
+    namespace: validatePackageIdent(requireString(value, "namespace"), "namespace"),
+    name: validatePackageIdent(requireString(value, "name"), "name"),
+    release: validateVersion(requireString(value, "release")),
+    availability_status: availabilityStatus,
+    ...(reason ? { reason } : {}),
+    capability_key_id: capabilityKeyId,
+    nonce,
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    cli_version: requireString(value, "cli_version"),
+  };
+}
+
 export function sameCkbHash(left: string, right: string): boolean {
   return left.replace(/^0x/, "").toLowerCase() === right.replace(/^0x/, "").toLowerCase();
 }