Skip to content

chore: pin Registry Stack v0.23.0 #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 2 commits into from
Aug 20, 2026
Merged

chore: pin Registry Stack v0.23.0 #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
55280ab
chore: pin Registry Stack v0.23.0
jeremi Aug 20, 2026
5cc9dff
docs(hosted): record that a cell's route is also its discovery identity
jeremi Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Evidence runtime cannot classify Relay's concealed `consultation.unresolved`
response as a data-free unresolved consultation. Registry Stack v0.21.0 is the
first coherent release that contains both capabilities and publishes official
Relay, Evidence, and Mint runtime images. Solmara tracks that release line and
currently pins v0.22.0, recording its release tag and source commit, those
currently pins v0.23.0, recording its release tag and source commit, those
official OCI references by digest, and the `relayctl` binary checksum in
`versions.env`. The release handoff and every hosted deployment consume those
same full references without reconstructing them from a second deployment
Expand Down
24 changes: 24 additions & 0 deletions docs/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,30 @@
A small dated log of what changed in the visitor center and the lab topology.
Newest entry first.

## 2026-08-20 Registry Stack v0.23.0

Solmara pins Registry Stack v0.23.0 across `versions.env`, the release-pin
gate, and the home release-identity surface. The Relay, Evidence, and Mint OCI
references move to the v0.23.0 digests, and the Relayctl authoring helper is
built from the v0.23.0 `linux-amd64` release asset and its checksum. The
topology is unchanged. The reason to move is security: v0.23.0 upgrades `h2`
to 0.4.17, past RUSTSEC-2026-0258, where a peer could queue unlimited empty
DATA frames on the HTTP/2 path that Relay and Evidence both serve over.

The Evidence deployment contract gained three required fields, so the six cell
bundles are authored rather than only re-pinned. `service.publicOrigin` names
the one routed origin RFC 9728 discovery answers on, which is each cell's own
`<cell>-evidence.solmara.registrystack.org`. Every requirement and every
concept now carries a `handle`, the stable key a client reads a result under;
each is authored to the last segment of the identifier it names. v0.23.0 also
adds Registry Discovery and published Discovery client packages, neither of
which the lab uses yet.

Because the Evidence bundle content changed, the staged runtime a deployment
already holds no longer matches the one this version stages. A local run needs
`just reset` before `just up`. A hosted rollout cannot reuse the existing
Evidence and Relay runtime volumes.

## 2026-08-19 Registry Stack v0.22.0

Solmara pins Registry Stack v0.22.0 across `versions.env`, the release-pin
Expand Down
10 changes: 9 additions & 1 deletion docs/hosted-deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Registry Stack v0.20.0 remains immutable and does not contain the Evidence
capability required by this lab. v0.20.1 contains the required runtime
capabilities but does not publish official Evidence and Mint OCI images.
Registry Stack v0.21.0 is the first coherent release with all three official
runtime images; the lab currently pins v0.22.0 from that line. Do not move a
runtime images; the lab currently pins v0.23.0 from that line. Do not move a
release, substitute a floating source reference, or recreate those runtime
images in Solmara.

Expand Down Expand Up @@ -53,6 +53,14 @@ Evidence hosts are:
- `sipf-evidence.solmara.registrystack.org`
- `nagdi-evidence.solmara.registrystack.org`

Each host is also the cell's own identity. The signed bundle carries it as
`service.publicOrigin`, and the cell answers with it as the `resource` and the
`jwks_uri` prefix of its RFC 9728 protected-resource metadata and in the
`WWW-Authenticate` challenge it returns. `SOLMARA_<CELL>_EVIDENCE_PUBLIC_HOST`
moves the route without moving that identity, so a deployment that sets one
still publishes discovery documents naming the host above. Leave those
overrides unset until the bundle origin is deployment-set as well.

Shared authority state lives at fixed absolute host paths of the form
`/data/solmara-authority-cells/<cell>/<role>` rather than in named volumes.
Coolify rewrites every named volume reference to `{app_uuid}_{key}` and does not
Expand Down
17 changes: 10 additions & 7 deletions evidence/cells/cra/bundle/evidence.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
version: 1
assuranceProfile: production
service: { providerId: https://id.registrystack.org/solmara/evidence/cra, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab }
service: { providerId: https://id.registrystack.org/solmara/evidence/cra, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab, publicOrigin: https://cra-evidence.solmara.registrystack.org }

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Patch publicOrigin for overridden Evidence routes

When a staging or preview deployment sets the supported SOLMARA_*_EVIDENCE_PUBLIC_HOST overrides, Compose routes each cell to that alternate host (scripts/test_hosted_evidence_routes.py:141-157), but all six bundles retain their production publicOrigin; _patch_evidence_origins only rewrites Mint and Relay URLs (scripts/provision-hosted-runtime.py:615-639). RFC 9728 discovery from the staging service therefore identifies the production resource, causing discovery-aware clients to reject the resource mismatch or use production metadata. Pass the deployed Evidence origin into provisioning and rewrite service.publicOrigin, or remove the route overrides.

Useful? React with 👍 / 👎.

issuer: { id: did:web:id.registrystack.org:solmara:authority:cra }
authentication: { kind: oidc-access-token, issuer: https://mint.solmara.registrystack.org, audiences: [solmara-runtime], tokenTypes: [at+jwt], algorithms: [ES256], jwksUri: https://mint.solmara.registrystack.org/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority, maximumTokenLifetimeSeconds: 300, revokedKeyIds: [] }
audit: { format: keyed-jsonl, hashSecretRef: secret:file/audit-hmac-key, hashKeyVersion: 1, failClosed: true }
Expand Down Expand Up @@ -86,7 +86,8 @@ authorityProfiles:
- { requirement: https://id.registrystack.org/solmara/requirement/cra-pension-death/v1, purpose: pension-payment-review, audienceFrom: authenticated-requester, responseFormats: [signed-jws], subjects: [{ role: subject, selectorProfile: solmara-uin-v1, valueOrigin: request }] }
- { requirement: https://id.registrystack.org/solmara/requirement/cra-citizen-record/v1, purpose: citizen-self-service, audienceFrom: authenticated-requester, responseFormats: [signed-jws], subjects: [{ role: subject, selectorProfile: solmara-uin-v1, valueOrigin: request }] }
requirements:
- id: https://id.registrystack.org/solmara/requirement/cra-child-benefit/v1
- handle: cra-child-benefit
id: https://id.registrystack.org/solmara/requirement/cra-child-benefit/v1
kind: information-requirement
acquisition: { kind: single, source: cra-child-benefit }
purposes: [child-benefit-review]
Expand All @@ -96,11 +97,12 @@ requirements:
observationTimezone: Asia/Bangkok
validitySeconds: 3600
derivation: { script: derivations/child-benefit.rhai, parameters: { as_of_date: '2026-07-14' } }
concepts: [{ id: https://id.registrystack.org/solmara/concept/birth-is-registered, form: boolean, required: true, constraints: {} }, { id: https://id.registrystack.org/solmara/concept/child-age-under-5, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: birth-is-registered, id: https://id.registrystack.org/solmara/concept/birth-is-registered, form: boolean, required: true, constraints: {} }, { handle: child-age-under-5, id: https://id.registrystack.org/solmara/concept/child-age-under-5, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/child-benefit.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/cra-child-benefit] }
existenceDisclosure: collapse-unresolved
- id: https://id.registrystack.org/solmara/requirement/cra-pension-death/v1
- handle: cra-pension-death
id: https://id.registrystack.org/solmara/requirement/cra-pension-death/v1
kind: information-requirement
acquisition: { kind: single, source: cra-pension }
purposes: [pension-payment-review]
Expand All @@ -109,11 +111,12 @@ requirements:
evidenceType: https://id.registrystack.org/solmara/evidence-type/cra-death-status/v1
validitySeconds: 300
derivation: { script: derivations/deceased.rhai, parameters: {} }
concepts: [{ id: https://id.registrystack.org/solmara/concept/person-is-deceased, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: person-is-deceased, id: https://id.registrystack.org/solmara/concept/person-is-deceased, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/pension.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/cra-pension] }
existenceDisclosure: collapse-unresolved
- id: https://id.registrystack.org/solmara/requirement/cra-citizen-record/v1
- handle: cra-citizen-record
id: https://id.registrystack.org/solmara/requirement/cra-citizen-record/v1
kind: information-requirement
acquisition: { kind: single, source: cra-citizen }
purposes: [citizen-self-service]
Expand All @@ -122,7 +125,7 @@ requirements:
evidenceType: https://id.registrystack.org/solmara/evidence-type/civil-record-linked/v1
validitySeconds: 300
derivation: { script: derivations/linked.rhai, parameters: {} }
concepts: [{ id: https://id.registrystack.org/solmara/concept/civil-record-linked, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: civil-record-linked, id: https://id.registrystack.org/solmara/concept/civil-record-linked, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/citizen.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/cra-citizen] }
existenceDisclosure: collapse-unresolved
7 changes: 4 additions & 3 deletions evidence/cells/mosd-programme/bundle/evidence.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
version: 1
assuranceProfile: production
service: { providerId: https://id.registrystack.org/solmara/evidence/mosd-programme, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab }
service: { providerId: https://id.registrystack.org/solmara/evidence/mosd-programme, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab, publicOrigin: https://mosd-programme-evidence.solmara.registrystack.org }
issuer: { id: did:web:id.registrystack.org:solmara:authority:mosd-programme-mis }
authentication: { kind: oidc-access-token, issuer: https://mint.solmara.registrystack.org, audiences: [solmara-runtime], tokenTypes: [at+jwt], algorithms: [ES256], jwksUri: https://mint.solmara.registrystack.org/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority, maximumTokenLifetimeSeconds: 300, revokedKeyIds: [] }
audit: { format: keyed-jsonl, hashSecretRef: secret:file/audit-hmac-key, hashKeyVersion: 1, failClosed: true }
Expand Down Expand Up @@ -39,7 +39,8 @@ authorityProfiles:
requesterTags: [solmara-demo]
grants: [{ requirement: https://id.registrystack.org/solmara/requirement/mosd-child-benefit/v1, purpose: child-benefit-review, audienceFrom: authenticated-requester, responseFormats: [signed-jws], subjects: [{ role: subject, selectorProfile: solmara-uin-v1, valueOrigin: request }] }]
requirements:
- id: https://id.registrystack.org/solmara/requirement/mosd-child-benefit/v1
- handle: mosd-child-benefit
id: https://id.registrystack.org/solmara/requirement/mosd-child-benefit/v1
kind: information-requirement
acquisition: { kind: single, source: mosd-child-benefit }
purposes: [child-benefit-review]
Expand All @@ -48,7 +49,7 @@ requirements:
evidenceType: https://id.registrystack.org/solmara/evidence-type/not-enrolled/v1
validitySeconds: 300
derivation: { script: derivations/not-enrolled.rhai, parameters: {} }
concepts: [{ id: https://id.registrystack.org/solmara/concept/not-already-enrolled, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: not-already-enrolled, id: https://id.registrystack.org/solmara/concept/not-already-enrolled, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/child-benefit.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/mosd-child-benefit] }
existenceDisclosure: collapse-unresolved
12 changes: 7 additions & 5 deletions evidence/cells/nagdi/bundle/evidence.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
version: 1
assuranceProfile: production
service: { providerId: https://id.registrystack.org/solmara/evidence/nagdi, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab }
service: { providerId: https://id.registrystack.org/solmara/evidence/nagdi, trustDomain: https://id.registrystack.org/solmara/trust-domain/lab, publicOrigin: https://nagdi-evidence.solmara.registrystack.org }
issuer: { id: did:web:id.registrystack.org:solmara:authority:nagdi }
authentication: { kind: oidc-access-token, issuer: https://mint.solmara.registrystack.org, audiences: [solmara-runtime], tokenTypes: [at+jwt], algorithms: [ES256], jwksUri: https://mint.solmara.registrystack.org/.well-known/jwks.json, principalClaim: sub, requesterTagsClaim: evidence_tags, evidenceAudienceClaim: evidence_audience, grantIdClaim: evidence_grant_id, grantAuthorityClaim: evidence_authority, maximumTokenLifetimeSeconds: 300, revokedKeyIds: [] }
audit: { format: keyed-jsonl, hashSecretRef: secret:file/audit-hmac-key, hashKeyVersion: 1, failClosed: true }
Expand Down Expand Up @@ -64,7 +64,8 @@ authorityProfiles:
- { requirement: https://id.registrystack.org/solmara/requirement/nagdi-voucher/v1, purpose: voucher-eligibility-review, audienceFrom: authenticated-requester, responseFormats: [signed-jws], subjects: [{ role: subject, selectorProfile: farmer-reference-v1, valueOrigin: request }] }
- { requirement: https://id.registrystack.org/solmara/requirement/nagdi-livestock/v1, purpose: livestock-movement-control, audienceFrom: authenticated-requester, responseFormats: [signed-jws], subjects: [{ role: subject, selectorProfile: farmer-reference-v1, valueOrigin: request }] }
requirements:
- id: https://id.registrystack.org/solmara/requirement/nagdi-voucher/v1
- handle: nagdi-voucher
id: https://id.registrystack.org/solmara/requirement/nagdi-voucher/v1
kind: information-requirement
acquisition: { kind: single, source: nagdi-voucher }
purposes: [voucher-eligibility-review]
Expand All @@ -73,11 +74,12 @@ requirements:
evidenceType: https://id.registrystack.org/solmara/evidence-type/climate-smart-voucher/v1
validitySeconds: 300
derivation: { script: derivations/voucher.rhai, parameters: {} }
concepts: [{ id: https://id.registrystack.org/solmara/concept/farmer-registered, form: boolean, required: true, constraints: {} }, { id: https://id.registrystack.org/solmara/concept/data-use-authorized-for-purpose, form: boolean, required: true, constraints: {} }, { id: https://id.registrystack.org/solmara/concept/eligible-for-climate-smart-input-voucher, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: farmer-registered, id: https://id.registrystack.org/solmara/concept/farmer-registered, form: boolean, required: true, constraints: {} }, { handle: data-use-authorized-for-purpose, id: https://id.registrystack.org/solmara/concept/data-use-authorized-for-purpose, form: boolean, required: true, constraints: {} }, { handle: eligible-for-climate-smart-input-voucher, id: https://id.registrystack.org/solmara/concept/eligible-for-climate-smart-input-voucher, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/voucher.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/nagdi-voucher] }
existenceDisclosure: collapse-unresolved
- id: https://id.registrystack.org/solmara/requirement/nagdi-livestock/v1
- handle: nagdi-livestock
id: https://id.registrystack.org/solmara/requirement/nagdi-livestock/v1
kind: information-requirement
acquisition: { kind: single, source: nagdi-livestock }
purposes: [livestock-movement-control]
Expand All @@ -86,7 +88,7 @@ requirements:
evidenceType: https://id.registrystack.org/solmara/evidence-type/livestock-movement/v1
validitySeconds: 300
derivation: { script: derivations/livestock.rhai, parameters: {} }
concepts: [{ id: https://id.registrystack.org/solmara/concept/registered-herd, form: boolean, required: true, constraints: {} }, { id: https://id.registrystack.org/solmara/concept/origin-district-not-quarantined-for-species, form: boolean, required: true, constraints: {} }, { id: https://id.registrystack.org/solmara/concept/eligible-for-livestock-movement-permit, form: boolean, required: true, constraints: {} }]
concepts: [{ handle: registered-herd, id: https://id.registrystack.org/solmara/concept/registered-herd, form: boolean, required: true, constraints: {} }, { handle: origin-district-not-quarantined-for-species, id: https://id.registrystack.org/solmara/concept/origin-district-not-quarantined-for-species, form: boolean, required: true, constraints: {} }, { handle: eligible-for-livestock-movement-permit, id: https://id.registrystack.org/solmara/concept/eligible-for-livestock-movement-permit, form: boolean, required: true, constraints: {} }]
fixtures: fixtures/livestock.yaml
disclosureGuard: { families: [https://id.registrystack.org/solmara/disclosure-family/nagdi-livestock] }
existenceDisclosure: collapse-unresolved
Loading
Loading