feat: run BReg and Casework together with rstack dev

.github/scripts/ci_changes.py

@@ -382,6 +382,9 @@
     "docs/site/src/content/docs/configure/casework.mdx",
     "docs/site/src/content/docs/operate/change-a-casework-package.mdx",
     "docs/site/src/content/docs/tutorials/first-casework.mdx",
+    "products/breg/acceptance/reviewed-evidence-journey/**",
+    "products/platform/examples/licensing/**",
+    "products/platform/scripts/test-rstack-dev.py",
 )
 
 # Every input the Registry Messaging tutorial gate replays or is built from.
@@ -573,7 +576,7 @@
 # reader makes carries a token that session issued. The clients in the Casework
 # shard are not on the replayed path.
 CASEWORK_TUTORIAL_PACKAGES = frozenset(
-    {"registry-casework", "registry-caseworkctl", "registry-breg", "registry-bregctl", "registry-thunderid-tooling"}
+    {"registry-casework", "registry-caseworkctl", "registry-breg", "registry-bregctl", "registry-rstack", "registry-thunderid-tooling"}
 )
 
 # The gate builds and runs exactly messagingctl, which links the Messaging

.github/scripts/test_ci_changes.py

@@ -1945,6 +1945,8 @@ def test_casework_tutorial_routing(self) -> None:
             "docs/site/scripts/tutorial-runner/toolsets.mjs",
             "docs/site/src/content/docs/tutorials/first-casework.mdx",
             "docs/site/package.json",
+            "products/platform/examples/licensing/dev.yaml",
+            "products/platform/scripts/test-rstack-dev.py",
         )
         for path in infrastructure:
             with self.subTest(path=path):

.github/workflows/ci.yml

@@ -2697,6 +2697,26 @@ jobs:
             -p registry-breg --features registry-breg/runtime \
             -p registry-bregctl -p registry-rstack --bins
 
+      - name: Install native PostgreSQL 18 and PostGIS for project development
+        # The Ubuntu runner's PostgreSQL 16 is below BReg's minimum.
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
+          sudo env DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends postgresql-18 postgresql-18-postgis-3
+          /usr/lib/postgresql/18/bin/postgres --version
+
+      - name: Verify the combined licensing development run with native PostgreSQL
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo build --locked -p registry-rstack
+          python3 products/platform/scripts/test-rstack-dev.py \
+            --bin-dir "${GITHUB_WORKSPACE}/target/debug" \
+            --postgres-bin-dir /usr/lib/postgresql/18/bin \
+            --scratch-parent "${RUNNER_TEMP}" \
+            --spatial
+
       - name: Execute the Registry Casework tutorials from a reader directory
         shell: bash
         env:

Cargo.toml

@@ -331,6 +331,7 @@ tempfile = { version = "3" }
 thiserror = { version = "2" }
 time = { version = "0.3", features = ["serde", "formatting", "parsing", "macros"] }
 tokio = { version = "1", features = ["fs", "macros", "net", "rt", "rt-multi-thread", "signal", "sync", "time"] }
+postgres-protocol = "=0.6.12"
 tokio-postgres = { version = "=0.7.18", features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-1"] }
 tokio-postgres-rustls = { version = "=0.14.0", default-features = false, features = ["ring", "native-certs"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }

crates/registry-bregctl/Cargo.toml

@@ -52,6 +52,7 @@ hmac.workspace = true
 inquire.workspace = true
 jsonschema.workspace = true
 p256.workspace = true
+postgres-protocol.workspace = true
 rcgen.workspace = true
 registry-platform-canonical-json.workspace = true
 registry-platform-config.workspace = true
@@ -69,6 +70,7 @@ registry-linkml.workspace = true
 registry-manifest-core.workspace = true
 reqwest.workspace = true
 rustix.workspace = true
+rustls.workspace = true
 schemars = { workspace = true, optional = true }
 serde.workspace = true
 serde_json.workspace = true
@@ -79,6 +81,8 @@ tempfile.workspace = true
 thiserror.workspace = true
 time.workspace = true
 tokio = { workspace = true, features = ["rt"] }
+tokio-postgres.workspace = true
+tokio-postgres-rustls.workspace = true
 uuid = { workspace = true, features = ["serde"] }
 zeroize.workspace = true
 registry-platform-crypto.workspace = true
@@ -87,7 +91,4 @@ url.workspace = true
 [dev-dependencies]
 registry-breg.workspace = true
 registry-platform-testing = { workspace = true, features = ["test-utils"] }
-rustls.workspace = true
-tokio-postgres.workspace = true
-tokio-postgres-rustls.workspace = true
 wat = "1.259.0"

crates/registry-bregctl/src/identity_facts.rs

@@ -197,6 +197,37 @@ impl<'a> Grant<'a> {
     }
 }
 
+fn compiled_grants(compiled: &CompiledRegistry) -> impl Iterator<Item = Grant<'_>> {
+    let entity_grants = compiled
+        .entities()
+        .values()
+        .flat_map(|entity| entity.access_profiles.values().map(Grant::profile));
+    let dataset_grants = compiled
+        .statistical_datasets()
+        .values()
+        .flat_map(|dataset| dataset.access_profiles.values().map(Grant::profile));
+    let action_grants = compiled.actions().actions.iter().flat_map(|action| {
+        let proposal = match &action.execution {
+            CompiledActionExecution::Proposal { proposal } => proposal.permissions.as_slice(),
+            CompiledActionExecution::Immediate => &[],
+        };
+        action
+            .permissions
+            .iter()
+            .map(Grant::action)
+            .chain(proposal.iter().map(Grant::proposal))
+    });
+    entity_grants.chain(dataset_grants).chain(action_grants)
+}
+
+/// Clients the runtime must list even if no fixture mints tokens for them.
+pub(crate) fn named_requester_clients(compiled: &CompiledRegistry) -> BTreeSet<String> {
+    compiled_grants(compiled)
+        .flat_map(|grant| grant.requester_clients)
+        .chain(compiled.recipients().clients().map(str::to_owned))
+        .collect()
+}
+
 /// The claims BReg refuses a token for a grant without, apart from the
 /// subject every token carries and the reserved consent claims the engine
 /// fills from the verified client.
@@ -286,26 +317,7 @@ pub(crate) fn facts(
 
     let mut profiles: BTreeMap<String, FactsProfile> = BTreeMap::new();
     let mut omitted_agent_profiles = BTreeSet::new();
-    let entity_grants = compiled
-        .entities()
-        .values()
-        .flat_map(|entity| entity.access_profiles.values().map(Grant::profile));
-    let dataset_grants = compiled
-        .statistical_datasets()
-        .values()
-        .flat_map(|dataset| dataset.access_profiles.values().map(Grant::profile));
-    let action_grants = compiled.actions().actions.iter().flat_map(|action| {
-        let proposal = match &action.execution {
-            CompiledActionExecution::Proposal { proposal } => proposal.permissions.as_slice(),
-            CompiledActionExecution::Immediate => &[],
-        };
-        action
-            .permissions
-            .iter()
-            .map(Grant::action)
-            .chain(proposal.iter().map(Grant::proposal))
-    });
-    for grant in entity_grants.chain(dataset_grants).chain(action_grants) {
+    for grant in compiled_grants(compiled) {
         if grant.actor_kind == Some(ActorKindSource::Agent) {
             omitted_agent_profiles.insert(grant.id.to_owned());
             continue;

crates/registry-bregctl/src/lib.rs

@@ -62,6 +62,7 @@ mod instance_claim_lifecycle;
 mod module_lock_patch;
 mod package_inspection;
 mod package_lifecycle;
+mod project_dev;
 mod proposal_retention;
 mod reconcile_lifecycle;
 mod report;
@@ -225,6 +226,8 @@ enum Command {
     Examples(dev::examples::ExamplesArgs),
     #[command(name = "__dev-supervisor", hide = true)]
     DevSupervisor(dev::SupervisorArgs),
+    #[command(name = "project-dev", hide = true)]
+    ProjectDev(project_dev::Args),
     /// Explain compiled model, access, route, or event inventories.
     Explain(ExplainArgs),
     /// Compare an authoring candidate with a rederived closed package.
@@ -2902,6 +2905,9 @@ where
                 }
             };
         }
+        Command::ProjectDev(args) => {
+            return ExitCode::from(project_dev::run(args, stdout, stderr));
+        }
         Command::Init(args) => match (args.from, args.template.as_deref()) {
             (None, None) => init(&args.destination),
             (None, Some(id)) => starters::run(&args.destination, id),