Reset Solmara around authority-owned Relay and Evidence by jeremi · Pull Request #23 · registrystack/solmara-lab

jeremi · 2026-08-12T16:26:45Z

Summary

reset Solmara around six independently configured, signed, and audited authority-owned Evidence cells
replace Relay V1 and Postgres-backed lab paths with five governed Relay V2 projects over authority-published SQLite sources
preserve all 11 operational requirement IDs, evidence-type IDs, concept IDs, purpose IDs, and programme outcomes
route the programme by authority, verify each assertion against that authority's JWKS, and expose only safe issuer/source presentation
add deterministic immutable-extract and live-Relay lifecycle proofs
rebuild local and Coolify deployment around shared Mint, isolated Transit signers, recoverable authority volumes, digest-pinned images, and optional eSignet login

Release prerequisites

The reset originally targeted Registry Stack v0.19.0. Implementation proved that v0.19.0 Mint could not issue Relay-compatible scoped access tokens and Evidence could not truthfully model Relay V2's declared unresolved response. Those product prerequisites shipped in Registry Stack v0.20.1.

Registry Stack v0.21.0 is the earliest release that publishes the Relay, Evidence, and Mint runtime images this reset requires. Solmara pins v0.22.0, the current release on that line, by exact source tag, source commit, all three official OCI image digests, and the relayctl release-asset SHA-256. Every pin is centralised in versions.env; the release handoff and each hosted deployment consume those same full references without reconstructing them.

source            v0.22.0 @ d9a278a55fa3cd275e391cdf2d94dae342c65edc
relay             ghcr.io/registrystack/relay@sha256:6d58ea62b78db451409e77a96ed45c7f82a72cc17ebc9d4eb65230319fe13d83
evidence          ghcr.io/registrystack/evidence@sha256:175cb81e12125bbb17425bdc2df34b109b0da95b3b1df2d6cb2bfa3223f2c577
mint              ghcr.io/registrystack/mint@sha256:a4aaf418493ce2d14994082b93fb1ccb32b1351d71b3850a694045ad00174e54
relayctl asset    sha256:1354946ffca568d0a95e32de37fb7b45805c3756f21217aca44d1d34babbaebc

Relative to v0.21.0, v0.22.0 adds a container runtime deployment preflight, a strict Mint readiness probe, Mint support for compatible OAuth clients, eager validation of Evidence trusted public keys, and root-owned Relay configuration. The Solmara topology is unchanged.

The separate esignet-relay-authenticator v0.2.0 release is also pinned by exact JAR SHA-256.

Architecture

CRA: immutable birth extract plus Relay death and civil-link lookups
NIA: immutable population extract plus a distinct Relay lookup for eSignet
SRO: immutable poverty extract
MoSD Programme MIS: Relay enrolment lookup
SIPF: Relay pension-payment and survivor-case lookups
NAgDI: Relay voucher and livestock-movement lookups
Programme application: composes independently signed authority assertions and owns cross-authority decisions

Generated databases, packages, private keys, secrets, audit files, and runtime bindings remain untracked.

Verification

Passed from a clean checkout at this revision, against Registry Stack v0.22.0 with a live Docker daemon:

runtime image build: all three official images pulled by pinned digest, each published v0.22.0 tag digest matches its pin, and every image reports org.opencontainers.image.version=0.22.0 and revision=d9a278a5… equal to REGISTRY_STACK_SOURCE_COMMIT
Registry Stack pin and image checks, including --require-public
all five Relay V2 check --production, generate, test, and package gates: 20 relayctl invocations
all six Evidence configuration checks and all 11 requirement fixtures
lint, Svelte checks, 20 publisher tests, 28 scenario tests, 230 cross-product/security tests, 143 Portal tests, and 61 Home tests
local Compose, optional eSignet Compose, hosted, and every Coolify topology validation
local bring-up of all 25 services: every healthcheck green, no crash loops, no unexpected ERROR or WARN in container logs
programme acceptance for child benefit, pension/survivor, voucher, livestock, and generic denial paths: 8 scenarios
live lifecycle proof for mutable MoSD consultation and immutable SRO extract rebinding
Portal live E2E: 8 passed
Home live E2E: 44 passed, 6 intentionally skipped by live-mode selection
real eSignet browser journey through OTP, Mint private-key JWT, NIA Relay V2, consent, token/UserInfo, and Portal redirect

The eSignet UI entrypoint validated SOLMARA_ESIGNET_PUBLIC_HOST and SOLMARA_ESIGNET_UI_PUBLIC_HOST on every start, but only the hosted nginx template carries the placeholders those values substitute. The local topology sets neither, so esignet-ui and esignet-edge exited 78 and never published the eSignet ports. The renderer now requires the public hosts only when the template actually carries placeholders; the hosted template keeps all 12, so hosted rendering stays fail-closed on an absent or injected host.

Rollout

The PR includes side-by-side Coolify provisioning, signer isolation, fixed authority volumes, retained superseded volumes, digest-manifest handoff, rollout checks, and recovery documentation. Hosted images are published from main after this merges, so every org.opencontainers.image.revision label names a permanent commit rather than a squashed branch tip. The live cutover then follows the recoverable side-by-side → switch → disable phases, which retain every superseded volume.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Move the pinned release from v0.21.0 to v0.22.0 so the authority-cell reset lands on the current release rather than one that is already superseded. Relay, Evidence, and Mint move to the v0.22.0 digests, and Relayctl to the v0.22.0 linux-amd64 asset. Every pin was verified against the published artifacts: the three image digests and their org.opencontainers.image version/revision labels come from GHCR, and the Relayctl checksum matches both the release SHA256SUMS and a locally hashed download. All three images carry revision d9a278a5, the v0.22.0 tag commit, so the builder label check holds. The "first coherent release" claims in the README and hosted-deployment docs still refer to v0.21.0, which remains the earliest release publishing all three official images; only the pinned version moves. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

The UI entrypoint validated SOLMARA_ESIGNET_PUBLIC_HOST and SOLMARA_ESIGNET_UI_PUBLIC_HOST on every start, but only the hosted template carries the placeholders those values substitute. The local topology sets neither, so esignet-ui and esignet-edge exited 78 and nothing published the eSignet ports. Require the public hosts only when the template actually carries placeholders. The hosted template keeps all 12, so hosted rendering stays fail-closed on an absent or injected host. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: afc3eda937

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-19T20:11:07Z

@@ -1,6 +1,6 @@
 // Provenance kinds -> field types (portal spec section 5.3, UX section 3).
 export type FieldKind = 'self' | 'verify' | 'fetch' | 'decision';
-export type NotaryId =
+export type AuthorityId =


Preserve the shared portal types additively

Renaming the exported NotaryId contract to AuthorityId makes every existing renderer or provider that still imports NotaryId fail to compile; the same change also replaces Field.notary and later removes required ProofTrace wire members. This shared contract is explicitly additive-only, so retain compatible aliases and properties while introducing the new authority model rather than replacing them in place.

AGENTS.md reference: portal/AGENTS.md:L34-L34

Useful? React with 👍 / 👎.

Both workflows installed just with an unbounded apt-get against Ubuntu's mirrors. That step wedged twice in a row on the merge gate, once for over four hours, so the check never returned and the PR stayed unstable. Download the pinned 1.58.0 linux-musl asset instead and verify its published SHA-256 before use, matching how this repo already pins the Relayctl release asset. Bound both jobs with timeout-minutes so an unreachable dependency fails fast rather than holding the gate open. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 98cbe8a048

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-19T20:18:45Z

-    );
-  }
+function runnerCalls(scenarioKey: string, service: string): RunnerCall[] {
+  if (service === 'childBenefit') return [{ scenarioId: 'birth-to-child-benefit', stepId: 'positive' }];


Separate guardian proof from child evidence collection

When the child-benefit flow verifies caregiver-link, this branch routes the gate itself to birth-to-child-benefit/positive; that scenario requests all five child claims, and the federator consequently contacts CRA, NIA, SRO, and MoSD. The dependent evidence is therefore read before guardianVerified is set, defeating the gate described in +page.svelte. Route caregiver verification to a relationship-only step, and invoke the full positive collection only after that proof succeeds.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-19T20:18:45Z

+for authority, port in {"cra": 4311, "nia": 4312, "mosd": 4314, "sipf": 4315, "nagdi": 4316}.items():
+    with urllib.request.urlopen(f"http://127.0.0.1:{port}/health", timeout=10) as response:


Honor configured Relay ports in smoke probes

When any SOLMARA_*_RELAY_PORT override is used, compose.yaml publishes the Relay on that configured host port, but this smoke still probes only 4311/4312/4314/4315/4316. As a result, just smoke and the release-candidate workflow report unhealthy Relays even though the configured stack is running; resolve each port from the corresponding environment variable as the home and portal probes already do.

Useful? React with 👍 / 👎.

jeremi added 30 commits August 6, 2026 02:43

Migrate local lab to Registry Evidence

a6a92e0

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Reset Solmara around authority-owned Relay and Evidence

3bbe0f8

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Fix pnpm setup in CI

808d6ad

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Stabilize signer replacement race test

f632a67

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Report failing Relay verification stage

1b5f934

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Harden hosted authority provisioning

4ba7b58

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Preserve Relay check diagnostics

f59ef5b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Pin Relay SQLite publication runtime

37ef685

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Smoke signer key binding in release workflow

f1fef9b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Retry verified Registry Stack downloads

390fbfb

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Use pinned Relayctl for runtime packaging

4af1aea

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore: consume Registry Stack v0.21.0 images

6ea2846

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci: reuse verified Relayctl asset

98dd780

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci: keep Solmara lint within repository source

cbb4a79

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test: isolate Relayctl asset fixture

7321716

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix: support Linux-owned local signer binds

ba30d4c

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix: allow Linux CI signers to read bound keys

3b9965d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix: read Linux-owned local runtime secrets

807e7ee

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix: initialize local authority audit volumes

8ef18e7

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix: reject unsafe authority audit files

f4ed0ea

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test: pin authority audit initializer lifecycle

70a96ae

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci: report authority startup failures

28a6e6a

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(local): stage authority runtime secrets

d62d37b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci: report relay startup failures

dbf2455

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(local): align Relay runtime ownership

58a943e

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): isolate authority networks

ff93f4b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(local): stage sealed Relay runtimes

1c495fc

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): close authority rollout origins

60c7c1b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(local): build sealed Relay fixture

b3c2335

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): pass hosted provision origins

5edf0d6

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi added 22 commits August 13, 2026 06:45

fix(hosted): initialize provisioned volumes in image smoke

37f0a34

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): preserve provisioner idempotence

1a8b1c2

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): initialize runner-owned volumes

d17c8ab

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(hosted): tamper immutable runtime in container

51b8205

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(hosted): bound signer startup wait

ce3bbf6

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(hosted): exercise signer socket volume

0162ea9

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(hosted): add side-by-side evidence routes

f146fdb

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): split authority signers

690c556

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): inject secrets through tmpfs

092037d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(hosted): clarify runtime secret storage

2ac5afc

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(hosted): start Mint before Relays

c787298

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): gate rollout on signer and Mint readiness

2b7f7b4

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): make Mint readiness deployment-blocking

aa364b6

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): consume bootstrap secrets before runtime

108b161

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(ci): keep Relay provision smoke secret-free

43aba9d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(ci): smoke disposable provisioner secrets

bbfe01f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): omit tmpfs for secret provisioners

154c085

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): bind Evidence to isolated networks

8eea727

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(ci): share hosted bind-host contract

c920307

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(hosted): install runtime secrets for nonroot services

b9da809

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi marked this pull request as ready for review August 19, 2026 20:07

chatgpt-codex-connector Bot reviewed Aug 19, 2026

View reviewed changes

jeremi merged commit 811a826 into main Aug 19, 2026
1 check passed

chatgpt-codex-connector Bot reviewed Aug 19, 2026

View reviewed changes

Navigation Menu

Uh oh!

Reset Solmara around authority-owned Relay and Evidence - #23

Reset Solmara around authority-owned Relay and Evidence#23
jeremi merged 53 commits into
mainfrom
codex/solmara-authority-cells-reset

jeremi commented Aug 12, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		for authority, port in {"cra": 4311, "nia": 4312, "mosd": 4314, "sipf": 4315, "nagdi": 4316}.items():
		with urllib.request.urlopen(f"http://127.0.0.1:{port}/health", timeout=10) as response:

Uh oh!

Conversation

jeremi commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release prerequisites

Architecture

Verification

Rollout

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jeremi commented Aug 12, 2026 •

edited

Loading