feat(rstack): generate hosted ThunderID configuration from product identity facts

- `rstack identity generate thunderid` writes hosted ThunderID configuration from each product's own identity facts plus one operator deployment file. `rstack identity check` checks either document offline.
- `bregctl`, `caseworkctl`, `evidencectl` and `messagingctl` each gain `generate identity-facts`, which writes a `registry.identity-facts/v1` document from that product's own configuration.
- Two new platform formats, `registry.identity-facts/v1` and `registry.identity-deployment/v1`, with generated JSON Schemas in `products/platform/schemas`, examples, and editor mappings.
- `caseworkctl generate identity-facts` marks the profiles Casework admits only for a person as requiring a human actor, and refuses a customised human-identity claim; `bregctl` refuses a renamed purpose claim; `evidencectl` refuses a renamed actor-kind, purpose, approver or grant claim, and two task authorities whose issuers derive one assertion issuer id. Hosted generation does not support either.
- Each access profile in the identity facts states the actor kind its product pins (`actorKind`) and lists the claims its product refuses a token without (`requiredClaims`). Generation and `rstack identity check` refuse a machine client or user granted the profile without them, and a browser application that does not project them. On a profile reached by token exchange, `actorKind` applies to the client's own token.
- An explicit actor kind on a client, user or selector must be one the runtimes parse (`human`, `agent` or `service`), whatever the profile states.
- Access profiles may state the actor kinds they admit (`admittedActorKinds`) and the claims that refuse them (`refusedClaims`). Evidence states both, so generation refuses an agent on a standing profile and a principal carrying the actor claim on a profile that is not delegated.
- BReg facts state Action and Proposal profiles and the claims verified-claim lookups read, and `bregctl` refuses a row boundary on a boolean or integer field.
- Every set list in both identity formats refuses a repeated item.
- Release manifests pin external images with an explicit `kind: image-pin`. Every release after 0.45.0 must carry the ThunderID pin.
- The operator guide adds a page: Generate identity configuration.
- Remove the retired Notary config schema (`schemas/registry-notary.config.schema.json`); no gate or product reads it.

BREAKING CHANGE: identity generation derives every principal `sub` from the issuer, in a separate namespace per kind. Every `sub` changes once when a deployment moves to the generator. Update stored `sub` values, token mappings and scope references from `identity-receipt.json`. There is no compatibility shim.

BREAKING CHANGE: `registry-thunderid-tooling` refuses a machine-client JWKS that carries private or symmetric key members, in development mode too.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

.github/scripts/ci_changes.py

@@ -196,6 +196,7 @@
         "registry-mcp",
         "registry-messagingctl",
         "registry-render",
+        "registry-rstack",
         "registry-schedulingctl",
     }
 )

.github/scripts/test_ci_changes.py

@@ -899,8 +899,11 @@ def test_config_check_packages_build_the_programs_the_corpus_runs(self) -> None:
             for step in self.workflow_jobs["config-conformance"]["steps"]
         }
         build = steps["Build configuration check commands"]["run"].split()
+        launcher = steps["Build the launcher check command"]["run"].split()
+        self.assertEqual(launcher, "cargo build --locked -p registry-rstack".split())
         self.assertEqual(
-            {build[index + 1] for index, word in enumerate(build) if word == "-p"},
+            {build[index + 1] for index, word in enumerate(build) if word == "-p"}
+            | {"registry-rstack"},
             CONFIG_CHECK_PACKAGES,
         )
         for package in sorted(CONFIG_CHECK_PACKAGES):
@@ -2244,6 +2247,7 @@ def test_yaml_reader_boundary_inputs_select_platform_hygiene(self) -> None:
             "products/platform/scripts/test_check_yaml_reader_boundary.py",
             "products/platform/scripts/check-mcp-dependencies.py",
             "products/platform/scripts/test_check_mcp_dependencies.py",
+            "products/platform/scripts/check-rstack-dependencies.py",
         ):
             with self.subTest(path=path):
                 self.assertTrue(classify(self.workspace, (path,))["platform_hygiene"])

.github/workflows/ci.yml

@@ -379,6 +379,12 @@ jobs:
       - name: Enforce the YAML reader boundary
         run: products/platform/scripts/check-yaml-reader-boundary.sh
 
+      - name: Test the rstack dependency boundary check
+        run: python3 -m unittest products/platform/scripts/test_check_rstack_dependencies.py
+
+      - name: Keep rstack a plain bootstrap launcher
+        run: python3 products/platform/scripts/check-rstack-dependencies.py
+
   platform-fuzz:
     name: Platform fuzz smoke (${{ matrix.group }})
     needs:
@@ -1991,6 +1997,12 @@ jobs:
           -p registry-breg-mcp -p registry-breg-review -p registry-evidence-oid4vci -p registry-mcp
           -p registry-evidence-oid4vp
 
+      # The launcher is built alone, as the release builds it, so feature
+      # unification with the product tools cannot hide a missing feature or
+      # turn on the session code.
+      - name: Build the launcher check command
+        run: cargo build --locked -p registry-rstack
+
       - name: Run configuration conformance corpus
         run: products/platform/scripts/run-config-conformance.sh --strict --bin-dir target/debug
 

Cargo.lock

@@ -66,6 +66,24 @@ impl AuthorityClaimConfig {
         }
     }
 
+    /// The claim the caller's principal is read from.
+    #[must_use]
+    pub fn principal_claim(&self) -> &str {
+        &self.principal_claim
+    }
+
+    /// The claim the caller's purpose is read from, when one is configured.
+    #[must_use]
+    pub fn purpose_claim(&self) -> Option<&str> {
+        self.purpose_claim.as_deref()
+    }
+
+    /// The claim the caller's actor kind is read from.
+    #[must_use]
+    pub fn actor_kind_claim(&self) -> &str {
+        &self.contextual_claims.actor_kind
+    }
+
     #[must_use]
     pub fn with_contextual_claims(
         mut self,

crates/registry-breg/src/auth.rs

@@ -58,7 +58,7 @@ registry-platform-config.workspace = true
 registry-platform-yaml.workspace = true
 registry-platform-hooks.workspace = true
 registry-platform-httputil.workspace = true
-registry-thunderid-tooling.workspace = true
+registry-thunderid-tooling = { workspace = true, features = ["session"] }
 registry-platform-buildinfo.workspace = true
 registry-cli-api.workspace = true
 registry-cli-reference.workspace = true

crates/registry-bregctl/Cargo.toml

@@ -2177,24 +2177,12 @@ pub(super) fn runtime(root: &Path, state: &State, clients: &Clients, test: bool)
 }
 
 fn local_authority_claims(compiled: &registry_breg::CompiledRegistry) -> Result<Value> {
-    let inventory = registry_breg::authority::authority_inventory(compiled)
-        .context("cannot inspect the compiled registry's authority claims")?;
-    let principal = match inventory
-        .principal_claims
-        .into_iter()
-        .collect::<Vec<_>>()
-        .as_slice()
-    {
-        [claim] => claim.clone(),
-        [] => "registry_principal".to_owned(),
-        claims => bail!(
-            "local development requires one common principal claim across compiled authenticated grants; the compiled registry declares multiple: {}",
-            claims.join(", ")
-        ),
-    };
+    let claims = crate::identity_facts::authority_claims(compiled).map_err(|message| {
+        anyhow::anyhow!("local development requires one common principal claim across compiled authenticated grants; {message}")
+    })?;
     Ok(json!({
-        "principal": principal,
-        "purpose": inventory.purpose_required.then_some("registry_purpose")
+        "principal": claims.principal,
+        "purpose": claims.purpose_required.then_some("registry_purpose")
     }))
 }