Adopt Registry Stack v0.13.0

.github/workflows/release-candidate.yml

@@ -33,10 +33,31 @@ jobs:
       ESIGNET_POSTGRES_IMAGE: postgres:16
       ESIGNET_BASE_IMAGE: mosipid/esignet-with-plugins:1.8.0
       ESIGNET_UI_IMAGE: mosipid/oidc-ui:1.8.0
-      ESIGNET_RELAY_AUTHENTICATOR_REF: 9c066ae897cd3966333d7d75fc77db2e6dc7342c
+      ESIGNET_RELAY_AUTHENTICATOR_REF: 2e7d0e452a778e048f2c259391397d1e1844318e
       STATIC_METADATA_IMAGE: python:3.12-alpine
     steps:
       - uses: actions/checkout@v4
+      - name: Checkout Registry Stack Relay source
+        uses: actions/checkout@v4
+        with:
+          repository: registrystack/registry-stack
+          ref: ${{ env.REGISTRY_STACK_TAG }}
+          path: vendor/registry-stack
+      - name: Verify Registry Stack Relay source
+        run: |
+          set -euo pipefail
+          set -a
+          source versions.env
+          set +a
+          test "$REGISTRY_STACK_SOURCE_REF" = "$REGISTRY_STACK_TAG"
+          test "$(git -C vendor/registry-stack rev-parse HEAD)" = "$REGISTRY_STACK_SOURCE_COMMIT"
+          {
+            printf 'REGISTRY_STACK_SOURCE_COMMIT=%s\n' "$REGISTRY_STACK_SOURCE_COMMIT"
+            printf 'REGISTRY_RELAY_FEATURES=%s\n' "$REGISTRY_RELAY_FEATURES"
+            printf 'SOLMARA_RELAY_RUNTIME_IMAGE=%s\n' "$SOLMARA_RELAY_RUNTIME_IMAGE"
+            printf 'VOLUME_INIT_IMAGE=%s\n' "$VOLUME_INIT_IMAGE"
+            printf 'REGISTRY_STACK_SOURCE_DIR=%s/vendor/registry-stack\n' "$GITHUB_WORKSPACE"
+          } >> "$GITHUB_ENV"
       - name: Checkout eSignet relay authenticator
         uses: actions/checkout@v4
         with:
@@ -96,7 +117,27 @@ jobs:
           push: true
           tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-relay:${{ env.SOLMARA_IMAGE_TAG }}
           build-args: |
-            REGISTRY_RELAY_IMAGE=${{ env.REGISTRY_RELAY_IMAGE }}
+            REGISTRY_RELAY_IMAGE=${{ env.SOLMARA_RELAY_RUNTIME_IMAGE }}
+            VOLUME_INIT_IMAGE=${{ env.VOLUME_INIT_IMAGE }}
+      - name: Verify hosted Relay signed bundles
+        env:
+          SOLMARA_HOSTED_RELAY_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-relay:${{ env.SOLMARA_IMAGE_TAG }}
+        run: |
+          set -euo pipefail
+          for project in cra-civil nia-population sro-social mosd-programme sipf-pensions nagdi-agriculture; do
+            docker run --rm --platform linux/amd64 \
+              -e REGISTRY_RELAY_AUDIT_HASH_SECRET=0123456789abcdef0123456789abcdef \
+              -e REGISTRY_RELAY_AUDIT_PSEUDONYM_EPOCH_1=abcdef0123456789abcdef0123456789 \
+              -e REGISTRY_RELAY_CONSULTATION_DATABASE_URL=postgresql://runtime:placeholder@postgres:5432/consultation?sslmode=require \
+              -e SOLMARA_NIA_DATABASE_URL=postgresql://reader:placeholder@postgres:5432/source?sslmode=require \
+              -e SOLMARA_SIPF_DATABASE_URL=postgresql://reader:placeholder@postgres:5432/source?sslmode=require \
+              "$SOLMARA_HOSTED_RELAY_IMAGE" \
+              config verify-bundle \
+              --bundle-dir "/etc/solmara/hosted-relay-bundles/$project/bundle" \
+              --anchor-path "/etc/solmara/hosted-relay-bundles/$project/trust-anchor.json" \
+              --state-path "/etc/solmara/hosted-relay-bundles/$project/antirollback-seed.json" \
+              | jq -e '.result == "verified" and .bundle_sequence == 1' >/dev/null
+          done
       - name: Build and push hosted Notary image
         uses: docker/build-push-action@v6
         with:
@@ -197,6 +238,7 @@ jobs:
           {
             echo "### Solmara image digests"
             echo
+            echo "- ${SOLMARA_RELAY_RUNTIME_IMAGE}"
             for image in solmara-lab-relay solmara-lab-notary solmara-lab-postgres solmara-lab-static-metadata solmara-lab-scenario-runner solmara-lab-home solmara-lab-portal solmara-lab-esignet-relay solmara-lab-esignet-postgres solmara-lab-esignet-ui solmara-lab-esignet-seed; do
               ref="${SOLMARA_IMAGE_REGISTRY}/${image}:${SOLMARA_IMAGE_TAG}"
               digest="$(docker buildx imagetools inspect "$ref" --format '{{.Manifest.Digest}}')"

.gitignore

@@ -22,6 +22,7 @@ __pycache__/
 .ruff_cache/
 .mypy_cache/
 dist/
+.cache/
 projects/*/.registry-stack/
 *.log
 config/postgres/ssl/*

README.md

@@ -34,11 +34,14 @@ If the exact tool version is not installed, the helper downloads the matching
 release binary and verifies it against the release SHA-256 file.
 
 `registry-projects-runtime-check` can run the compiler comparison without
-starting services. `contract-generation-proof` is a separate release gate for
-one bounded SRO authority pair. It compiles a harmless successor, proves the
-blue pair works, rejects a mixed Relay/Notary generation before Relay execution
-or source dispatch, activates the complete successor, and proves it works. Its
-temporary Compose project and volumes are removed when the check finishes.
+starting services. The project wrapper consumes Registryctl's versioned JSON
+build report and validates its project-owned output root rather than depending
+on Registryctl's private build-directory layout. `contract-generation-proof`
+is a separate release gate for one bounded SRO authority pair. It compiles a
+harmless successor, proves the blue pair works, rejects a mixed Relay/Notary
+generation before Relay execution or source dispatch, activates the complete
+successor, and proves it works. Its temporary Compose project and volumes are
+removed when the check finishes.
 
 The first wave covers three journeys:
 
@@ -75,29 +78,48 @@ just smoke-live # live Notary checks only
 just portal-compose-smoke # HTTP smoke against the Compose portal and live BFF
 just portal-live-e2e # browser e2e against the running local stack
 just hosted-smoke # public hosted health, endpoint, scenario, and portal checks
+just up # local stack with mock portal login
 just up-esignet # local stack with eSignet-backed portal login
+just up-dev # explicit source-built Relay development stack
+just up-esignet-dev # source-built Relay development stack with eSignet
 just smoke-esignet # eSignet public discovery smoke
 just down       # stop the local Compose topology without deleting volumes
 just reset      # stop the local Compose topology and delete its volumes
 just up-generated # clean-checkout generation, compiler comparison, and start
 just registry-projects-runtime-check # regenerate and compare all authority runtime closures
+just hosted-relay-bundles-check # verify hosted Relay signatures and config closure
+just registry-projects-review # complete redacted acquisition and disclosure reports
 just contract-generation-proof # release-only live SRO blue/mixed/successor proof
 just release-pins <registry-stack-tag> # compare committed versions.env pins against a candidate or release tag
 just review     # normal security and release-readiness checks
 just review-release <registry-stack-tag> # candidate review with published pin validation
 ```
 
+Normal startup pulls the immutable feature-enabled Relay runtime pinned in
+`versions.env`; it does not clone or compile Registry Stack. The `*-dev`
+recipes are the explicit source-build path. They verify the pinned source
+commit and build a separate local image, leaving the standalone path unchanged.
+
 `just generate` rewrites generated fixtures. Review those diffs like any other
 committed generated artifact.
 
 ## Image Pins
 
-`versions.env` is the root source for published image digests. The Compose
-fallbacks mirror it so direct `docker compose` runs still use pinned Registry
-Stack images. The current pins are the Registry Stack `v0.10.0` release digest
-assets. Because that release publishes amd64 images, Compose defaults
-`REGISTRY_STACK_PLATFORM` to `linux/amd64`; override it only when the release
-publishes an image for another platform.
+`versions.env` is the root source for published image digests and the exact
+Registry Stack source commit used by Solmara's Relay runtime. The current pins
+are the Registry Stack `v0.13.0` release assets. The published Relay image is
+the immutable release base. The separately published Solmara Relay runtime is
+built from that pinned source with the explicitly declared
+`attribute-release` feature and pinned by digest in the same file. That opt-in
+is required by the NIA eSignet profile because the release Relay intentionally
+excludes beta API features. Normal startup pulls that runtime; the explicit
+`*-dev` recipes rebuild it and refuse a dirty or mismatched source checkout.
+
+Use `just up` rather than invoking `docker compose up` directly so the
+source-pinned Relay runtime is prepared and selected. Because the release
+publishes amd64 images, Compose defaults `REGISTRY_STACK_PLATFORM` to
+`linux/amd64`; override it only when every selected base image is available
+for another platform.
 
 Every authority runs one Relay and one Notary. Relay consultation state and all
 Notary correctness state are PostgreSQL-backed. `just gen-secrets` creates
@@ -106,6 +128,13 @@ each authority. See
 [`docs/notary-postgresql-state.md`](docs/notary-postgresql-state.md) for the
 database map, diagnosis, backup, recovery, and upgrade workflow.
 
+Registry Stack v0.13.0 changes the exact retained Relay result shape. The
+release-owned `REGISTRY_RELAY_STATE_EPOCH=v013` pin gives every authority a
+fresh consultation database and role set, so v0.10.0 and v0.13.0 Relay
+binaries cannot share one state plane. Do not override it to the old,
+unsuffixed database names. The PostgreSQL runbook describes the stopped-writer
+cutover and rollback boundary.
+
 ## Hosted Deployment
 
 See [`docs/hosted-deployment.md`](docs/hosted-deployment.md) for the full
@@ -133,6 +162,16 @@ authority-owned PostgreSQL state, persistent Relay snapshot caches, and
 workload credentials. Notary containers do not use Redis or a writable state
 directory.
 
+Hosted Relay starts from instance-bound signed Config Bundles. The wrapper
+contains only the public trust anchors and signed closures; the offline signing
+key is not committed. A sequence-zero baseline is copied only when a Relay
+state volume is empty, allowing first boot while keeping later bundle sequence
+rollback protection durable in that volume.
+
+Hosted workload agents keep Relay bearer credentials short-lived and confined
+to per-consumer volumes. The separately served workload JWKS contains public
+keys only; private workload JWKs remain Coolify secrets.
+
 Run `just registry-projects-sync` after editing an authority project, then
 `just registry-projects-runtime-check` to verify the local and hosted Relay and
 Notary closures are deterministic.
@@ -144,8 +183,11 @@ refusals, the Visitor Center scenario proxy, and the portal live BFF. Add
 `SOLMARA_HOSTED_SMOKE_BROWSER=1` when you also want hosted Playwright coverage
 for the Visitor Center and portal.
 
-The `release-candidate` workflow builds digest-pinned Solmara-owned images for
-the hosted wrappers and app services, then writes the digest refs to the
+The `release-candidate` workflow verifies the pinned Registry Stack source and
+uses the published feature-enabled Relay runtime digest as the base for the
+hosted Relay wrapper. The runtime is reviewed and published separately, so a
+Solmara candidate does not recompile it. The workflow builds the Solmara-owned
+images and writes their digest refs, together with the runtime pin, to the
 workflow summary for Coolify env vars:
 `SOLMARA_RELAY_IMAGE`, `SOLMARA_NOTARY_IMAGE`, `SOLMARA_POSTGRES_IMAGE`,
 `SOLMARA_STATIC_METADATA_IMAGE`, `SOLMARA_HOME_IMAGE`,
@@ -159,8 +201,8 @@ candidate-only gate locally with `just review-release <registry-stack-tag>`;
 the normal contributor and CI gate remains `just review`.
 
 For local eSignet testing, run `just up-esignet` instead of `just up`, then
-sign in through the portal with Elena's fixture `legacy_nid` and static OTP
-`111111`. This sign-in is the end-to-end check of the NIA
+sign in through the portal with Elena's fixture UIN `2300018263` and static
+OTP `111111`. This sign-in is the end-to-end check of the NIA
 `solmara-nia-userinfo` attribute-release profile and its rotating eSignet
 workload identity. Run `just smoke-esignet` for the public discovery checks.