[jeremi]

This adds a reproducible self-hosted agricultural-holdings pilot using Registry Stack 0.27.0 and upstream OpenFn Lightning. Registration creates a holding; a correction submits a governed request; separate reviewer approval leaves the holding unchanged until explicit application. Committed events obtain verified signed registration evidence and produce one minimized destination effect per event.

The change has four review areas:

1. Exact maintained Evidence client dependency and pinned glibc worker packaging, including native execution and job-boundary credential checks.
2. Separate BREG adaptor with metadata-selected authority, explicit idempotency and ETags, and registration/correction workflows.
3. Authenticated exact-byte webhook forwarding and persistent atomic destination deduplication, with failed-workflow and dead-letter recovery.
4. Derived agricultural project, repeatable API provisioning, Compose lifecycle commands, operator documentation and focused Linux acceptance CI.

Relay is excluded from the pilot and unchanged in this branch. Existing legacy packages remain untouched. The assertion confirms registration only, without disclosing the holding name or claiming ownership or programme eligibility.

Validation: 80 Node and 16 Python tests and both adaptor package dry runs passed. Local Linux containers passed the fresh-install journey, retained restart and all three failure scenarios against real pinned BREG, Evidence, Mint and Lightning services. Native imports passed on amd64 and arm64; the full upstream worker supports amd64 only. An isolated PostgreSQL initialization regression also passes with private UID1001-owned inputs. The GitHub Ubuntu acceptance run also passed fresh setup, the complete workflow journey, retained restart and all three failure-recovery scenarios.

No npm publication or deployment to an external account is part of this change. Pilot runtime secrets and private review evidence are excluded.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T14:34:31.935560Z	7deb721	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7deb721dea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep validating the existing workspaces

The root check command previously ran every workspace's check, but this replacement omits @openfn/language-registry-notary and @openfn/language-registry-relay even though both remain under packages/* with their own check suites. Since CI invokes only this command, subsequent regressions in either existing adaptor can merge without any syntax or test coverage; retain the workspace-wide check or explicitly include both packages.

Useful? React with 👍 / 👎.