Integrate the reviewed Registry Stack 1.0 changes

[jeremi]

Summary

Consolidate the eight reviewed 1.0 implementation PRs into one merge to main:

• Bind release conformance evidence to immutable candidates #459 binds release conformance and upgrade evidence to immutable candidates.
• Harden registryctl governed live evidence validation #462 hardens Registryctl governed live-evidence validation.
• Clarify registryctl's 1.0 adopter contract #463 clarifies the Registryctl adopter contract and stable smoke report.
• Harden deployment waiver metadata #464 narrows deployment-waiver metadata and disclosure.
• Remove inert Relay consent provenance #465 removes inert Relay consent provenance.
• docs: clarify the Solmara reader gate #466 clarifies the pending Solmara reader gate.
• docs(release): add integration pilot report contract #467 adds the bounded integration-pilot report contract.
• Complete the Debian 13 tutorial builder migration #468 completes the remaining Debian 13 tutorial-builder migration.

Every source PR head is retained as an ancestor. The aggregate adds no new product scope. Two additive merge resolutions were required: Registryctl's same-purpose test keeps #462's disclosure/version assertions with #463's renamed claim, and the Notary/Relay changelogs retain both #464 and #465 entries.

This PR supersedes #459 and #462 through #468 so the reviewed 1.0 batch can land through one protected-branch CI and one merge.

Implementer impact

Implementers get one supported Registryctl authoring path, stricter and clearer live-evidence failures, a smaller honest Relay contract, reference-first waiver metadata, explicit adopter evidence templates, and a Debian 13-only maintained tutorial build path.

Checks

Completed locally on the integrated tree:

• cargo fmt --all --check
• cargo test --locked -p registry-platform-ops -p registry-notary-core -p registry-notary-server -p registry-relay -p registryctl
• conflict-focused Registryctl same-purpose live-request test
• cargo deny check (policy passes; existing unmatched-license, duplicate, and transitive spin 0.9.8 yanked warnings remain)
• python3 -m unittest discover -s release/scripts -p 'test_*.py' (297 tests, 1 environment-dependent skip)
• python3 release/scripts/check-gates-inventory.py (83 gates)
• python3 release/scripts/check-debian13-images.py
• release manifest/docset/source-model validation and OCI-label reproducibility smoke
• Notary just openapi-check
• Relay just openapi-contract origin/main with the CI-pinned oasdiff v1.23.0
• docs installation, generation, 117 tests, content/Markdown/style checks, build, and tutorial dry-run
• canonical docs diff hygiene scan
• git diff --check

The aggregate PR CI is the reference full-workspace, platform, release-source, docs, tutorial, CodeQL, and DCO gate.

Review feedback addressed

• Normalize accepted bare and sha256:-prefixed artifact coordinate and aggregate-set digests before semantic comparison while retaining strict SHA-256 grammar validation and the exact artifact-set hash. Regression tests cover mixed coordinate spelling and a bare aggregate digest.
• Use one Python import style in the new upgrade-asset test, clearing the CodeQL mixed-import alert without changing behavior.

Security and compatibility review notes

• No authentication, authorization, issuer/scope ordering, principal derivation, required-filter, nonce, config-trust, or audit-before-mutation behavior is weakened.
• Harden registryctl governed live evidence validation #462 fails closed on stale, future, expired, misbound, cross-evaluation, schema-drifted, raw-handle, mixed-disclosure, and unbound-redaction evidence.
• Harden deployment waiver metadata #464 keeps hard startup/readiness gates non-waivable, removes waiver metadata from default posture and audit surfaces, and rejects credential-like summaries.
• Remove inert Relay consent provenance #465 intentionally breaks compatibility with the pre-1.0 inert provenance.consent member. Operators must drain the 15-minute replay window or cleanly re-bootstrap the Relay state plane and must not mix old and updated binaries.
• Clarify registryctl's 1.0 adopter contract #463's Tier-C security/privacy documentation still requires maintainer source-pack sign-off before merge.
• Bind release conformance evidence to immutable candidates #459 changes release evidence tooling, but it does not publish, tag, or replace release evidence. Candidate execution and promotion remain owner-run gates.
• Complete the Debian 13 tutorial builder migration #468 only changes the maintained tutorial builder/cache boundary and explicit Debian-version guard. It does not broaden release publication behavior.

Issue status

Closes #417.
Closes #238.
Closes #84.
Closes #362.

Progresses #198, #203, #205, #357, #358, and #380. Their owner-run or immutable-candidate evidence remains required and is not claimed here.

DCO

• Every source, integration merge, and follow-up commit includes a Signed-off-by trailer.
• I reviewed the integrated changes and am responsible for the contribution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4caaaaf50

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c788d49eb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremi]

Maintainer Tier-C source-pack sign-off

I reviewed and approve the Tier-C source pack in this PR against the applicable RS-* specifications, including the evidence-versus-programme-decision boundary, Registryctl adopter and smoke contract, disclosure and minimization language, source authority, authorization, and no-match semantics.

This sign-off covers the security, trust, and privacy documentation changes in #469. It does not waive the owner-run, independent, or frozen-candidate evidence explicitly left open in the PR description and tracked issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1ec7430b13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Normalize release-input digests before comparing

When a candidate evidence record uses the accepted bare 64-hex spelling for candidate_artifact_set.artifacts.p_release_inputs or t_release_inputs, this exact comparison rejects it because release_inputs_sha256() always returns the sha256:-prefixed form. Other SHA256 coordinates in this validator are normalized before comparison, so otherwise valid upgrade evidence can fail before --require-pass; compare normalized digest strings here.

Useful? React with 👍 / 👎.