feat(relay): promote attribute release to default by jeremi · Pull Request #488 · registrystack/registry-stack

jeremi · 2026-07-25T15:22:31Z

What

promote governed attribute release and Crosswalk runtime to the canonical Relay feature set
remove inert or misleading pre-1.0 config fields and require purpose, subject type, and the exact release scope
apply governed redaction before release CEL, hide unauthorized profiles, and make every response non-storable
publish Cargo-derived compiled feature evidence in admin capabilities and validated Relay image labels
align Registryctl authoring, generated schemas and OpenAPI, the support roster, docs, and release checks
derive exposure stability and canonical OpenAPI coverage from the release feature profile and Cargo effective feature graph
constrain profile versions to portable URL path segments and normalize JSON extraction failures to Relay Problem Details

Why

Attribute release is the maintained Notary/Relay integration path. Shipping it as an optional variant would create multiple production profiles and leave the official image unable to exercise that path. The hardening in this change closes the gaps found while reviewing promotion readiness.

The initial CI run exposed a stale assurance invariant that treated every feature-gated route as optional and experimental. The checker now permits stable routes only behind Cargo features in the canonical release profile, while preserving the experimental requirement for optional feature gates.

Security

release scope and purpose remain mandatory before source reads
unauthorized known profiles return the same public 404 as unknown profiles
release predicates and computed claims see only the governed-redacted row
CEL expressions are parsed and limited to the projected source authority
subject identifiers remain keyed audit hashes and never appear in responses
PDP provenance survives profile-purpose denials
release responses, including JSON extractor failures, are private, no-store
optional feature gates remain fail-closed as experimental in the exposure manifest

Verification

just ci in Registry Relay
cargo test --locked -p registryctl project_authoring
python3 -m unittest release/scripts/test_registry_release.py
python3 -m unittest release/scripts/test_check_release_relay_features.py release/scripts/test_check_release_image_oci_labels.py
node --test scripts/relay-release-contract.test.mjs in docs/site
root and Relay cargo deny ... check bans
cargo tree --locked -p registry-relay --all-features -i cel
intentional incomplete feature-profile build rejection

Refs #487

Follow-ups: #493, #494

Follow-up release evidence

After the next Registry Stack version is published, Solmara Lab still needs to pin the official Relay image by digest and record the live journey evidence. This PR prepares and verifies the canonical binary and image contract but cannot produce that future release digest.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbd9f2f5d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e796a9fc2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ce6d9c04e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 277595685d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83a96d06cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2912d383a8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi · 2026-07-26T08:51:58Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e15035894

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-26T09:18:45Z

            );
        }
-        validate_token(&profile.version, "attribute release profile version", 64)?;
+        validate_release_version(&profile.version, "attribute release profile version")?;


Align the authoring schema with the version validator

The shipped editor schema still accepts any bounded token for version (crates/registryctl/schemas/project-authoring/project.schema.json:164), so values such as v1/preview pass editor/schema validation but are rejected here during compilation. Update the schema pattern to [A-Za-z0-9][A-Za-z0-9._-]{0,63} so adopters receive consistent validation before invoking the compiler.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T09:18:45Z

+        validate_header_token(
+            &profile.purpose,
+            "attribute release profile purpose",
+            256,
+        )?;


Reflect the ASCII purpose restriction in the editor schema

The new header-safe validator rejects non-ASCII purposes, but the project authoring schema still references $defs.token for purpose (crates/registryctl/schemas/project-authoring/project.schema.json:167), whose pattern permits Unicode. An authored value such as identité_verification therefore appears valid in editor/schema tooling and fails only later during compilation; constrain this schema field to visible ASCII as well.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T09:18:45Z

@@ -1,7 +1,10 @@
 # syntax=docker/dockerfile:1.7

+ARG REGISTRY_RELAY_FEATURES="attribute-release,crosswalk-runtime"


Preserve an explicit empty feature override

After making the Docker ARG non-empty by default, REGISTRY_RELAY_FEATURES= can no longer select the Dockerfile's explicit minimal build path through scripts/build-image.sh: that helper only adds --build-arg when the value is non-empty (lines 75–77), so an explicitly empty value is indistinguishable from an unset variable and silently builds the canonical features instead. Detect whether the variable is set rather than whether it is non-empty so operators can still request a no-feature image.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T09:18:45Z

+relay_feature_profile="${repo_root}/crates/registry-relay/canonical-release-features.txt"
+relay_release_features="$(<"${relay_feature_profile}")"
+sh "${repo_root}/crates/registry-relay/scripts/validate-feature-profile.sh" \
+  "${relay_release_features}"


Split the change along owning-area boundaries

This change couples Relay and Registryctl code with public-docs and release-pipeline modifications, including the release feature selection added here. The repository requires each change to stay within one owning area, so split the crates/, docs/site/, and release/ work into independently reviewable changes rather than landing this cross-area unit.

AGENTS.md reference: AGENTS.md:L76-L78

Useful? React with 👍 / 👎.

jeremi marked this pull request as ready for review July 25, 2026 15:27

chatgpt-codex-connector Bot reviewed Jul 25, 2026

View reviewed changes

Comment thread crates/registry-relay/src/attribute_release/mod.rs Outdated

Comment thread .github/workflows/release.yml Outdated

Comment thread crates/registry-relay/src/api/openapi.rs

chatgpt-codex-connector Bot reviewed Jul 25, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Comment thread crates/registry-relay/src/config/validate.rs

Comment thread crates/registry-relay/src/config/validate.rs

Comment thread crates/registry-relay/scripts/check_security_assurance.py Outdated

jeremi added 5 commits July 26, 2026 11:00

feat(relay): promote attribute release to default

5e20ddf

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): align assurance with default features

fce408d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): address promotion review feedback

ad7fad5

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): complete promotion review contracts

b663f1d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): address latest promotion review

3740ebe

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi force-pushed the agent/issue-487-relay-default branch from 8ce6d9c to 3740ebe Compare July 26, 2026 04:23

test(docs): follow canonical Relay release profile

2775956

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

Comment thread .github/workflows/release-candidate.yml

Comment thread crates/registry-relay/src/attribute_release/mod.rs Outdated

Comment thread crates/registry-relay/Cargo.toml

fix(relay): address final promotion review

83a96d0

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

Comment thread .github/workflows/release-candidate.yml

Comment thread crates/registry-relay/src/attribute_release/mod.rs Outdated

Comment thread crates/registry-relay/src/api/attribute_release.rs Outdated

Comment thread crates/registry-relay/Cargo.toml

fix(relay): close final release invariants

2912d38

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

Comment thread .github/workflows/release-candidate.yml

Comment thread crates/registry-relay/Cargo.toml

Comment thread crates/registry-relay/src/api/attribute_release.rs

Comment thread crates/registry-relay/src/api/openapi.rs Outdated

This was referenced Jul 26, 2026

Improve attribute-release claim-request error diagnostics #493

Open

Clarify or support constant CEL expressions in attribute-release profiles #494

Open

fix(relay): tighten attribute release promotion contracts

9e15035

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi merged commit 01f6297 into main Jul 26, 2026
43 checks passed

jeremi deleted the agent/issue-487-relay-default branch July 26, 2026 09:01

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

		@@ -1,7 +1,10 @@
		# syntax=docker/dockerfile:1.7

		ARG REGISTRY_RELAY_FEATURES="attribute-release,crosswalk-runtime"

Uh oh!

Conversation

jeremi commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Security

Verification

Follow-up release evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeremi commented Jul 26, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

jeremi commented Jul 25, 2026 •

edited

Loading