[jeremi]

Summary

Add bregctl generate odrl PROJECT --output DIRECTORY [--access-profile PROFILE] to derive an experimental, partial ODRL description from compiled BReg access profiles. It writes policy JSON-LD, a profile vocabulary and a coverage report for operator review.

Supported get/list grants retain the exact field projection, operation and verified-caller conditions. A grant with unsupported row, membership, consent or task-grant restrictions is omitted completely and reported. Selection supports project, module and extension profiles; a known profile with no supported grants yields an explicit empty export.

Evidence

• cargo test --locked --no-fail-fast -p registry-breg --features runtime --test compiler_contract --test odrl_export: 146 compiler and 9 exporter tests passed, including module selection, complete-grant omission, vocabulary completeness and deterministic examples.

• cargo test --locked -p registry-breg --features runtime --lib odrl_export::tests: passed a 42-case comparison with native profile admission.

• cargo test --locked -p registry-bregctl --test odrl_cli: 3 native CLI tests passed, covering publication, deterministic output, empty coverage and refusal before writing.

• cargo test --locked --no-fail-fast -p registry-manifest-core -p registry-cli-docs -p registry-language-server: all passed, including the renderer and CLI snapshot.

• All-targets Clippy for those five crates with -D warnings, formatting and diff checks passed.

• Identifier generator tests: 25 passed. Catalog regeneration reproduced byte-for-byte and reference closure passed. Configuration conventions: zero unrecorded findings, zero errors; existing baseline exceptions unchanged.

• Focused documentation tests: 28 passed. CLI catalog/reference regeneration, BReg source neutrality and redacted Gitleaks scan passed.

• Native export sweep over all 27 maintained BReg registry projects: 275 record-operation grants considered; 112 of 179 read grants exported. The 67 omitted reads comprise 57 row-boundary, 6 membership and 4 consent grants; 96 non-read grants were also omitted. All projects compiled and exported successfully.

• PyLD expanded all 54 generated policy/profile JSON-LD documents to RDF with remote context fetching disabled. This checks syntax and graph interpretation, not external ODRL or EDC conformance.

• Rebased onto current main (record timers). The only conflict was the BReg changelog, where both entries were kept. Main now declares the record_timer_store engine feature in every package, which moves the registry revision digest; the two committed ODRL examples were regenerated with bregctl generate odrl, and only the digest changed. On the rebased tree: fmt, clippy -D warnings for the five crates, compiler_contract (146) and odrl_export (9), the odrl_export::tests lib test, odrl_cli (3), manifest-core, cli-docs and language-server tests, the CLI catalog regeneration (no diff), products/identifiers/scripts/check.sh and gitleaks all passed. check-contracts.sh passed except the macOS-only webhook-receiver test that cannot load the FIPS dylib; Linux CI covers it.

Notes

The relevant invariant is that unsupported restrictions must never disappear into a broader exported permission. omission_reasons, the exhaustive access-profile audit, and the row/membership/consent/task-grant negative tests pin that boundary.

These are offline operator-review artifacts and may contain non-public configuration names. BReg continues to authorize every request. Runtime behavior and public Manifest generation are unchanged.

The output is not an EDC PolicyDefinition or DSP Offer/Agreement. Direct EDC import can lose rule-level targets and field projections; the documentation states the adapter requirements. No EDC runtime execution, formal external conformance or live identifier-resolver publication was verified. PostgreSQL journeys and the full workspace matrix were not run locally because this change adds an offline exporter; protected CI supplies broader regression coverage.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-29T17:49:14.134135Z We couldn’t complete this review. Comment @codex review to try again.	666e924	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.