Reset Solmara around authority-owned Relay and Evidence

[jeremi]

Summary

• reset Solmara around six independently configured, signed, and audited authority-owned Evidence cells
• replace Relay V1 and Postgres-backed lab paths with five governed Relay V2 projects over authority-published SQLite sources
• preserve all 11 operational requirement IDs, evidence-type IDs, concept IDs, purpose IDs, and programme outcomes
• route the programme by authority, verify each assertion against that authority's JWKS, and expose only safe issuer/source presentation
• add deterministic immutable-extract and live-Relay lifecycle proofs
• rebuild local and Coolify deployment around shared Mint, isolated Transit signers, recoverable authority volumes, digest-pinned images, and optional eSignet login

Release prerequisites

The reset originally targeted Registry Stack v0.19.0. Implementation proved that v0.19.0 Mint could not issue Relay-compatible scoped access tokens and Evidence could not truthfully model Relay V2's declared unresolved response. Those product prerequisites shipped in Registry Stack v0.20.1.

Registry Stack v0.21.0 is the earliest release that publishes the Relay, Evidence, and Mint runtime images this reset requires. Solmara pins v0.22.0, the current release on that line, by exact source tag, source commit, all three official OCI image digests, and the relayctl release-asset SHA-256. Every pin is centralised in versions.env; the release handoff and each hosted deployment consume those same full references without reconstructing them.

source            v0.22.0 @ d9a278a55fa3cd275e391cdf2d94dae342c65edc
relay             ghcr.io/registrystack/relay@sha256:6d58ea62b78db451409e77a96ed45c7f82a72cc17ebc9d4eb65230319fe13d83
evidence          ghcr.io/registrystack/evidence@sha256:175cb81e12125bbb17425bdc2df34b109b0da95b3b1df2d6cb2bfa3223f2c577
mint              ghcr.io/registrystack/mint@sha256:a4aaf418493ce2d14994082b93fb1ccb32b1351d71b3850a694045ad00174e54
relayctl asset    sha256:1354946ffca568d0a95e32de37fb7b45805c3756f21217aca44d1d34babbaebc

Relative to v0.21.0, v0.22.0 adds a container runtime deployment preflight, a strict Mint readiness probe, Mint support for compatible OAuth clients, eager validation of Evidence trusted public keys, and root-owned Relay configuration. The Solmara topology is unchanged.

The separate esignet-relay-authenticator v0.2.0 release is also pinned by exact JAR SHA-256.

Architecture

• CRA: immutable birth extract plus Relay death and civil-link lookups
• NIA: immutable population extract plus a distinct Relay lookup for eSignet
• SRO: immutable poverty extract
• MoSD Programme MIS: Relay enrolment lookup
• SIPF: Relay pension-payment and survivor-case lookups
• NAgDI: Relay voucher and livestock-movement lookups
• Programme application: composes independently signed authority assertions and owns cross-authority decisions

Generated databases, packages, private keys, secrets, audit files, and runtime bindings remain untracked.

Verification

Passed from a clean checkout at this revision, against Registry Stack v0.22.0 with a live Docker daemon:

• runtime image build: all three official images pulled by pinned digest, each published v0.22.0 tag digest matches its pin, and every image reports org.opencontainers.image.version=0.22.0 and revision=d9a278a5… equal to REGISTRY_STACK_SOURCE_COMMIT
• Registry Stack pin and image checks, including --require-public
• all five Relay V2 check --production, generate, test, and package gates: 20 relayctl invocations
• all six Evidence configuration checks and all 11 requirement fixtures
• lint, Svelte checks, 20 publisher tests, 28 scenario tests, 230 cross-product/security tests, 143 Portal tests, and 61 Home tests
• local Compose, optional eSignet Compose, hosted, and every Coolify topology validation
• local bring-up of all 25 services: every healthcheck green, no crash loops, no unexpected ERROR or WARN in container logs
• programme acceptance for child benefit, pension/survivor, voucher, livestock, and generic denial paths: 8 scenarios
• live lifecycle proof for mutable MoSD consultation and immutable SRO extract rebinding
• Portal live E2E: 8 passed
• Home live E2E: 44 passed, 6 intentionally skipped by live-mode selection
• real eSignet browser journey through OTP, Mint private-key JWT, NIA Relay V2, consent, token/UserInfo, and Portal redirect

The eSignet UI entrypoint validated SOLMARA_ESIGNET_PUBLIC_HOST and SOLMARA_ESIGNET_UI_PUBLIC_HOST on every start, but only the hosted nginx template carries the placeholders those values substitute. The local topology sets neither, so esignet-ui and esignet-edge exited 78 and never published the eSignet ports. The renderer now requires the public hosts only when the template actually carries placeholders; the hosted template keeps all 12, so hosted rendering stays fail-closed on an absent or injected host.

Rollout

The PR includes side-by-side Coolify provisioning, signer isolation, fixed authority volumes, retained superseded volumes, digest-manifest handoff, rollout checks, and recovery documentation. Hosted image publication and live Coolify cutover evidence will be completed before this draft is marked ready.