feat(registryctl): deliver the Registry Stack 1.0 adopter journey (#598)

Closes #496
Closes #519
Closes #575

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

.github/scripts/ci_changes.py

@@ -77,55 +77,11 @@
     }
 )
 REPO_ROOT = Path(__file__).resolve().parents[2]
-STANDARD_JOURNEY_MANIFEST = (
-    REPO_ROOT / "docs/site/src/data/standard-journeys.yaml"
-)
 AUTHORING_REFERENCE_MANIFEST = (
     REPO_ROOT / "docs/site/scripts/authoring-reference-sources.json"
 )
 
 
-def standard_journey_sources(
-    manifest_path: Path = STANDARD_JOURNEY_MANIFEST,
-) -> frozenset[str]:
-    """Extract the exact canonical source paths from the journey manifest.
-
-    The manifest owns this routing inventory. Keeping the deliberately small
-    parser here avoids adding a YAML dependency to the CI classifier.
-    """
-
-    sources: list[str] = []
-    in_canonical_sources = False
-    for line in manifest_path.read_text(encoding="utf-8").splitlines():
-        if line == "    canonical_sources:":
-            in_canonical_sources = True
-            continue
-        if in_canonical_sources and line.startswith("      - "):
-            source = line.removeprefix("      - ").strip()
-            if (
-                not source
-                or source[0] in {"'", '"', "{", "["}
-                or source.startswith(("/", "../"))
-            ):
-                raise ValueError(
-                    "standard journey canonical_sources must contain "
-                    f"unquoted repository-relative paths: {source!r}"
-                )
-            sources.append(source)
-            continue
-        if in_canonical_sources and line and not line.startswith("      "):
-            in_canonical_sources = False
-
-    if not sources:
-        raise ValueError(
-            f"no standard journey canonical_sources found in {manifest_path}"
-        )
-    return frozenset(sources)
-
-
-STANDARD_JOURNEY_SOURCES = standard_journey_sources()
-
-
 def authoring_reference_contract_sources(
     manifest_path: Path = AUTHORING_REFERENCE_MANIFEST,
 ) -> tuple[str, ...]:
@@ -456,15 +412,13 @@ def classify(
             "crates/registryctl/src/project_authoring/diagnostics.rs",
             "crates/registryctl/src/project_authoring/fixture_diagnostics.rs",
             "crates/registryctl/src/project_authoring/fixture_coverage.rs",
-            "crates/registryctl/src/project_authoring/migration.rs",
             "crates/registryctl/src/project_authoring/output.rs",
             "crates/registryctl/src/project_authoring/preflight.rs",
-            "crates/registryctl/src/project_authoring/promotion.rs",
+            "crates/registryctl/src/project_authoring/promotion_projection.rs",
             "crates/registryctl/src/project_authoring/report_contract.rs",
-            "crates/registryctl/src/project_authoring/semantic_comparison.rs",
+            "crates/registryctl/src/project_authoring/required_product_action.rs",
             "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml",
         }
-        or path in STANDARD_JOURNEY_SOURCES
         for path in paths
     )
     docs_archives = any(
@@ -502,11 +456,21 @@ def classify(
             "LICENSE",
             "docs/site/package-lock.json",
             "docs/site/package.json",
+            "docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh",
+            "docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256",
+            "docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh",
+            "docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256",
             "docs/site/scripts/check-registryctl-tutorials.sh",
             "docs/site/scripts/registryctl-tutorial.mjs",
             "docs/site/scripts/registryctl-tutorial.test.mjs",
+            "docs/site/src/content/docs/configure/oauth-client-credentials.mdx",
+            "docs/site/src/content/docs/operate/approve-initial-baseline.mdx",
+            "docs/site/src/content/docs/tutorials/author-registry-project.mdx",
+            "docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx",
             "docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx",
+            "docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx",
             "docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx",
+            "docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx",
             "release/docker/Dockerfile.registry-notary",
             "release/docker/Dockerfile.registry-relay",
         }

.github/scripts/test_ci_changes.py

@@ -16,7 +16,6 @@
     AUTHORING_REFERENCE_INPUTS,
     RELEASE_SECURITY_WORKFLOWS,
     SHARDS,
-    STANDARD_JOURNEY_SOURCES,
     Workspace,
     authoring_reference_inputs,
     classify,
@@ -423,22 +422,6 @@ def test_first_country_docs_and_journey_routing_matrix(self) -> None:
                     "registryctl_tutorial": True,
                 },
             ),
-            (
-                "docs/site/src/data/standard-journeys.yaml",
-                {
-                    "docs": True,
-                    "rust": False,
-                    "registryctl_tutorial": False,
-                },
-            ),
-            (
-                "docs/site/scripts/generate-standard-journeys.mjs",
-                {
-                    "docs": True,
-                    "rust": False,
-                    "registryctl_tutorial": False,
-                },
-            ),
             (
                 "docs/site/src/components/JourneyGateMatrix.astro",
                 {
@@ -513,17 +496,38 @@ def test_tutorial_package_dependencies_route_the_source_journey(self) -> None:
                 for output, value in expected.items():
                     self.assertEqual(outputs[output], value, output)
 
+    def test_current_reader_journey_inputs_route_the_source_journey(self) -> None:
+        inputs = (
+            "docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh",
+            "docs/site/public/examples/registryctl/jsonplaceholder-todo-live-overlay-v1.sh.sha256",
+            "docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh",
+            "docs/site/public/examples/registryctl/opencrvs-events-api-overlay-v1.sh.sha256",
+            "docs/site/src/content/docs/configure/oauth-client-credentials.mdx",
+            "docs/site/src/content/docs/operate/approve-initial-baseline.mdx",
+            "docs/site/src/content/docs/tutorials/author-registry-project.mdx",
+            "docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx",
+            "docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx",
+            "docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx",
+            "docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx",
+            "docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx",
+        )
+
+        for path in inputs:
+            with self.subTest(path=path):
+                self.assertTrue(
+                    classify(self.workspace, (path,))["registryctl_tutorial"]
+                )
+
     def test_first_country_generation_inputs_run_docs(self) -> None:
         inputs = (
             "crates/registryctl/assets/project-starters/**",
             "crates/registryctl/src/main.rs",
-            "crates/registryctl/src/project_authoring/compiler/relay.rs",
             "crates/registryctl/src/project_authoring/output.rs",
+            "crates/registryctl/src/project_authoring/promotion_projection.rs",
             "crates/registryctl/src/project_authoring/report_contract.rs",
             "crates/registryctl/src/templates/**",
             "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml",
             "crates/registryctl/tests/fixtures/project-authoring/**",
-            "crates/registryctl/tests/project_authoring.rs",
             "crates/registry-relay/src/api/openapi.rs",
             "crates/registry-relay/src/main.rs",
             "crates/registry-relay/src/server.rs",
@@ -543,11 +547,6 @@ def test_docs_job_fetches_ignored_openapi_inputs_before_script_tests(self) -> No
         self.assertIn(fetch, docs_job)
         self.assertLess(docs_job.index(fetch), docs_job.index(test_scripts))
 
-    def test_every_standard_journey_source_routes_to_docs(self) -> None:
-        for source in sorted(STANDARD_JOURNEY_SOURCES):
-            with self.subTest(source=source):
-                self.assertTrue(classify(self.workspace, (source,))["docs"])
-
     def test_other_workflow_changes_do_not_select_the_full_matrix(self) -> None:
         for workflow in sorted(RELEASE_SECURITY_WORKFLOWS):
             with self.subTest(workflow=workflow):

.github/workflows/ci.yml

@@ -631,40 +631,6 @@ jobs:
           cargo test --locked -p registryctl --test project_authoring
           every_cataloged_supported_project_authoring_command_is_automated -- --exact
 
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
-        with:
-          node-version: 22.12.0
-          cache: npm
-          cache-dependency-path: docs/site/package-lock.json
-
-      - name: Install docs shell dependency
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes zsh
-
-      - name: Assert docs shell dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          command -v sh
-          command -v bash
-          command -v zsh
-
-      - name: Install docs dependencies
-        working-directory: docs/site
-        run: npm ci
-
-      - name: Execute required standard journey commands from clean directories
-        working-directory: docs/site
-        env:
-          REGISTRYCTL_BIN: ${{ github.workspace }}/target/debug/registryctl
-        run: >-
-          node --test
-          --test-name-pattern="executes every required noninteractive sequence"
-          scripts/generate-standard-journeys.test.mjs
-
   release-tool:
     name: Release tooling checks
     needs: changes
@@ -680,6 +646,11 @@ jobs:
       - name: Test adopter Compose conformance checker
         run: python3 -m unittest release/scripts/test_check_adopter_compose_contract.py
 
+      - name: Test PostgreSQL runtime recipe
+        env:
+          REGISTRY_POSTGRESQL_DOCKER_PROOF: "1"
+        run: python3 -m unittest release/scripts/test_postgresql_runtime_recipe.py
+
       - name: Check adopter Compose models
         run: bash release/scripts/check_adopter_compose_contract.sh
 
@@ -689,6 +660,12 @@ jobs:
       - name: Test first-country release-form runner
         run: python3 -m unittest release/scripts/test_first_country_release_form.py
 
+      - name: Test RegistryReleaseLockV1 tooling
+        run: python3 -m unittest release/scripts/test_registry_release_lock.py
+
+      - name: Check release-lock runtime and Compose parity
+        run: bash release/scripts/check-runtime-contract-parity.sh
+
       - name: Test release planning commands
         run: python3 -m unittest release/scripts/test_registry_release_plans.py
 
@@ -710,6 +687,9 @@ jobs:
       - name: Test release workflow structure
         run: python3 -m unittest release/scripts/test_release_workflow_structure.py
 
+      - name: Test release workflow guard
+        run: python3 -m unittest release/scripts/test_release_workflow_guard.py
+
       - name: Test release image OCI label checker
         run: python3 -m unittest release/scripts/test_check_release_image_oci_labels.py
 

.github/workflows/docs-pages.yml

@@ -128,10 +128,6 @@ jobs:
         working-directory: docs/site
         run: npm ci
 
-      - name: Check standard journey generation
-        working-directory: docs/site
-        run: node scripts/generate-standard-journeys.mjs --check
-
       - name: Build protected main at /dev/
         working-directory: docs/site
         run: |