Repository navigation
bootstrap: publish the dev-preview signed registry tree - #2
Closed
ZhiXiao-Lin wants to merge 11 commits into
Closed
ZhiXiao-Lin wants to merge 11 commits into
ZhiXiao-Lin wants to merge 11 commits into
Conversation
Admit a3s/registry-selftest 0.1.0 (skill-only), assemble the signed TUF publication under registry/, and document custody, publication, expiry, rotation, withdrawal, and incident procedures for operators. Bootstrap root pin: sha256:068207b2a075ab53e4a633084637169deee05a2fce33eb0362a870f5462b3d8a The tree is assembled and verified with a3s-use-registry-tools from the A3S Use repository (crates/registry-tools). This is a development-preview root, not a production trust root.
The placeholder failed closed until the tooling had a pushed revision; A3S-Lab/Use#256 head is the current reviewed source. Update the pin to the Use main commit when that PR merges.
Give operators a reproducible start/stop/status HTTP transport for the committed registry/ tree without changing the bootstrap trust root. Co-authored-by: Cursor <cursoragent@cursor.com>
Add consume_local.sh and document that Homebrew capability wrappers lack registry routes; smoke + plan-install against the local HTTP transport. Co-authored-by: Cursor <cursoragent@cursor.com>
… ci] Require our PID to own the listen port before claiming ready, refuse foreign busy ports, and encode transport/trust/lifecycle invariants in an automated gate. Co-authored-by: Cursor <cursoragent@cursor.com>
Document transport-vs-trust ownership, assert plan provenance URL/root, reject capability-wrapper clients early, and run the local transport gate in CI. Co-authored-by: Cursor <cursoragent@cursor.com>
Point verify-registry at Use merge d7f6a6e so CI builds a3s-use-registry-tools from main, and document ownership of the landed tooling crate. Co-authored-by: Cursor <cursoragent@cursor.com>
Tip a3s-use requires --scope-kind/--scope-id for installation-scoped plugin commands; without them I5 consume failed closed on invalid_usage. Co-authored-by: Cursor <cursoragent@cursor.com>
Add Tool+MCP+OKF+Skill+UI compose fixture, A3S_USE_REGISTRY_DIR serve override, and first-principles just test::registry coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
Publish the Applet UI demo package into the dev-preview registry tree and fail closed when package source ACL or git HEAD drifts from the signed archive. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
Closing draft: verify CI is red and the PR has been idle since 2026-09-09. Re-open when the signed registry tree verifies green. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The first publication of this Registry, assembled and verified with
a3s-use-registry-toolsfrom A3S-Lab/Use#256:a3s/registry-selftest0.1.0 (skill-only, non-executable, targetany) as the bootstrap verification case — the skill documents how agents consume this Registry.registry/(root v1, metadata v1).docs/operators.md(custody, publication, expiry, rotation, withdrawal, incident procedures) and a CI workflow that verifies the committed tree and re-assembles from the committed admissions.Bootstrap pin
Signing seeds live in operator custody outside this repository.
Scope gate
This is a dev-preview root, not a production trust root. Per this repository's own README, production bootstrap material lands only after the custody, rotation, expiry, withdrawal, mirror-replacement, and recovery procedures (Use roadmap A5) are implemented and reviewed. Reviewers should confirm:
--github A3S-Lab/Use-Registryconsumption path is re-verified after merge.Once merged to
main, clients can consume:a3s-use registry source add official --github A3S-Lab/Use-Registry \ --trust-root sha256:068207b2a075ab53e4a633084637169deee05a2fce33eb0362a870f5462b3d8a --json🤖 Generated with Claude Code