feat: converge first-adopter runtime configuration and package verification

.github/scripts/ci_changes.py

@@ -106,6 +106,30 @@
 SCHEDULING_PACKAGES = frozenset(SHARDS["scheduling"])
 STACK_CLIENT_PACKAGES = frozenset(SHARDS["stack-client"])
 
+# The runtime configuration conformance gate reads the sources of the runtimes
+# it holds rows for, their generated runtime schemas, and the canonical shared
+# configuration blocks schema. A product that joins the gate joins this set.
+CONFIG_CONFORMANCE_PACKAGES = frozenset(
+    {
+        "registry-platform-config",
+        "registry-breg",
+        "registry-casework",
+        "registry-discovery",
+        "registry-evidence",
+        "registry-relay-v2",
+        "registry-relayctl",
+        "registry-render",
+        "registry-scheduling",
+    }
+)
+CONFIG_CONFORMANCE_INPUTS = (
+    "products/platform/generated/*",
+    "products/platform/scripts/*config-conformance*",
+    "products/breg/generated/runtime/*",
+    "products/casework/generated/runtime/*",
+    "products/scheduling/generated/runtime/*",
+)
+
 # These are the cross-product semantic commitments implemented independently by
 # Base Registry Engine and Relay V2. A change must replay both real product routers,
 # while profile-only tooling and ordinary positive/negative fixtures remain on
@@ -1002,6 +1026,11 @@ def classify(
         or path in {"clippy.toml", "deny.toml", "rustfmt.toml"}
         for path in paths
     )
+    config_conformance = (
+        complete
+        or any(matches(path, *CONFIG_CONFORMANCE_INPUTS) for path in paths)
+        or bool(affected & CONFIG_CONFORMANCE_PACKAGES)
+    )
     release_tool = (
         complete
         or "release_tool" in security_workflow_gates
@@ -1175,6 +1204,7 @@ def classify(
         "platform_assurance": platform_assurance,
         "platform_coverage": platform_coverage,
         "platform_hygiene": platform_hygiene,
+        "config_conformance": config_conformance,
         "discovery_contracts": complete
         or bool(affected & DISCOVERY_PACKAGES)
         or any(matches(path, *DISCOVERY_PROVIDER_INPUTS) for path in paths)

.github/scripts/test_ci_changes.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import fnmatch
+import importlib.util
 import json
 import os
 import re
@@ -31,6 +32,7 @@
     RELAY_CLIENT_PACKAGES,
     RELAY_TUTORIAL_INPUTS,
     STACK_CLIENT_PACKAGES,
+    CONFIG_CONFORMANCE_PACKAGES,
     SECURITY_WORKFLOW_GATES,
     SHARDS,
     LockChange,
@@ -316,6 +318,9 @@ def test_deferred_ci_work_keeps_its_selector_and_explicit_status_guard(
             ),
             "docs-archives": "needs.changes.outputs.docs_archives == 'true'",
             "editor-extensions": "needs.changes.outputs.editors == 'true'",
+            "config-conformance": (
+                "needs.changes.outputs.config_conformance == 'true'"
+            ),
         }
         deferred = {
             name
@@ -400,6 +405,7 @@ def test_ci_scheduling_graph_retains_every_job_and_aggregate_dependency(
             "breg-contracts",
             "breg-wasm",
             "identifiers",
+            "config-conformance",
             "rust-result",
             "casework-postgres",
             "scheduling-contracts",
@@ -439,6 +445,7 @@ def test_ci_scheduling_graph_retains_every_job_and_aggregate_dependency(
                 "casework-postgres",
                 "scheduling-postgres",
                 "scheduling-contracts",
+                "config-conformance",
             ),
             "release-tool-required": ("changes", "release-tool"),
             "release-source-proof-required": ("changes", "release-source-proof"),
@@ -462,6 +469,7 @@ def test_ci_scheduling_graph_retains_every_job_and_aggregate_dependency(
                 "casework-postgres",
                 "scheduling-postgres",
                 "scheduling-contracts",
+                "config-conformance",
                 "release-tool",
                 "release-source-proof",
                 "evidence-tutorials",
@@ -515,7 +523,7 @@ def test_final_aggregate_flattens_rust_results_with_equivalent_outcomes(
             final_needs,
             previous_final_needs.difference({"rust-result"}).union(rust_needs),
         )
-        self.assertEqual(29, len(final_needs))
+        self.assertEqual(30, len(final_needs))
         # Platform line coverage publishes from main and the nightly sweep;
         # it does not hold the merge queue.
         self.assertNotIn("platform-coverage", final_needs)
@@ -615,6 +623,66 @@ def status(job: str, selected: str, result: str) -> int:
                 with self.subTest(job=job, selected=selected, result=result):
                     self.assertEqual(expected, status(job, selected, result))
 
+    def test_config_conformance_inputs_select_the_conformance_gate(self) -> None:
+        for path in (
+            "crates/registry-platform-config/src/blocks.rs",
+            "crates/registry-breg/src/runtime_config.rs",
+            "crates/registry-relay-v2/src/contract.rs",
+            "crates/registry-relayctl/schemas/authoring/runtime.schema.json",
+            "crates/registry-render/src/manifest.rs",
+            "crates/registry-discovery/src/startup.rs",
+            "crates/registry-evidence/src/config.rs",
+            "crates/registry-casework/src/config.rs",
+            "crates/registry-scheduling/src/config.rs",
+            "products/platform/generated/runtime-config-blocks.schema.json",
+            "products/platform/scripts/check-config-conformance.py",
+            "products/breg/generated/runtime/runtime.schema.json",
+            "products/casework/generated/runtime/runtime.schema.json",
+            "products/scheduling/generated/runtime/runtime.schema.json",
+        ):
+            with self.subTest(path=path):
+                self.assertTrue(
+                    classify(self.workspace, (path,))["config_conformance"]
+                )
+        self.assertFalse(
+            classify(self.workspace, ("docs/site/src/content/docs/index.mdx",))[
+                "config_conformance"
+            ]
+        )
+
+    def test_every_config_conformance_row_is_routed(self) -> None:
+        script = Path("products/platform/scripts/check-config-conformance.py")
+        spec = importlib.util.spec_from_file_location("config_conformance", script)
+        assert spec is not None and spec.loader is not None
+        gate = importlib.util.module_from_spec(spec)
+        sys.modules[spec.name] = gate
+        spec.loader.exec_module(gate)
+        packages = {
+            Path(source).parts[1]
+            for row in gate.ROWS
+            for source in row.loader_sources
+        }
+        self.assertLessEqual(packages, CONFIG_CONFORMANCE_PACKAGES)
+        self.assertIn("registry-platform-config", CONFIG_CONFORMANCE_PACKAGES)
+        schemas = {
+            entry.path for row in gate.ROWS for entry in row.hand_schemas
+        } | {
+            row.runtime_schema
+            for row in gate.ROWS
+            if isinstance(row.runtime_schema, str)
+        }
+        for path in sorted(schemas):
+            with self.subTest(path=path):
+                self.assertTrue(
+                    classify(self.workspace, (path,))["config_conformance"]
+                )
+        digest_tests = {row.digest_mismatch.path for row in gate.ROWS}
+        for path in sorted(digest_tests):
+            with self.subTest(path=path):
+                self.assertTrue(
+                    classify(self.workspace, (path,))["config_conformance"]
+                )
+
     def test_shards_cover_every_workspace_package_once(self) -> None:
         assigned = [package for packages in SHARDS.values() for package in packages]
         self.assertCountEqual(assigned, self.workspace.package_names)

.github/workflows/ci.yml

@@ -59,6 +59,7 @@ jobs:
       platform_assurance: ${{ steps.filter.outputs.platform_assurance }}
       platform_coverage: ${{ steps.filter.outputs.platform_coverage }}
       platform_hygiene: ${{ steps.filter.outputs.platform_hygiene }}
+      config_conformance: ${{ steps.filter.outputs.config_conformance }}
       discovery_contracts: ${{ steps.filter.outputs.discovery_contracts }}
       relay_v2_contracts: ${{ steps.filter.outputs.relay_v2_contracts }}
       relay_client_contracts: ${{ steps.filter.outputs.relay_client_contracts }}
@@ -724,6 +725,18 @@ jobs:
           CASEWORKCTL_BIN: ${{ github.workspace }}/target/debug/caseworkctl
           BREGCTL_BIN: ${{ github.workspace }}/target/debug/bregctl
         run: products/casework/scripts/check-checkpoint.sh
+      - name: Verify the rewritten Evidence deployment loads through the Evidence loader
+        # The fixture machinery lives behind postgres-test, but this test needs
+        # neither a database nor an issuer. An inexact name filter that selects
+        # nothing still exits 0, so the step names the test exactly and fails
+        # unless it reports one pass.
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test --locked -p registry-casework --features postgres-test --lib \
+            -- --exact task_grants::native_exchange_tests::the_rewritten_evidence_deployment_loads_through_the_evidence_loader \
+            | tee "${RUNNER_TEMP}/casework-evidence-fixture.log"
+          grep -q 'test result: ok\. 1 passed' "${RUNNER_TEMP}/casework-evidence-fixture.log" || { echo "::error::expected exactly one passing test for the_rewritten_evidence_deployment_loads_through_the_evidence_loader"; exit 1; }
       - name: Verify claims, reconciliation, and durable attempts
         env:
           CASEWORK_TEST_DATABASE_URL: postgresql://casework:casework_test@localhost:${{ job.services.postgres.ports['5432'] }}/casework
@@ -1104,6 +1117,34 @@ jobs:
       - name: Check Registry Record profile artifacts
         run: products/registry-record/scripts/check.sh
 
+  config-conformance:
+    name: Runtime configuration conformance
+    needs:
+      - changes
+      - rust-policy
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.config_conformance == 'true' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+          submodules: false
+
+      - name: Cache Cargo registry
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
+        with:
+          shared-key: workspace-registry
+          cache-targets: false
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Test runtime configuration conformance gate
+        run: python3 -m unittest products/platform/scripts/test_check_config_conformance.py
+
+      - name: Check runtime configuration conformance
+        run: products/platform/scripts/check-config-conformance.py --check-generated
+
   rust-result:
     name: Rust workspace
     if: always()
@@ -1122,6 +1163,7 @@ jobs:
       - casework-postgres
       - scheduling-postgres
       - scheduling-contracts
+      - config-conformance
     runs-on: ubuntu-slim
     timeout-minutes: 5
     env:
@@ -2155,6 +2197,7 @@ jobs:
       - casework-postgres
       - scheduling-postgres
       - scheduling-contracts
+      - config-conformance
       - release-tool
       - release-source-proof
       - evidence-tutorials

.github/workflows/release-candidate.yml

@@ -1764,7 +1764,7 @@ jobs:
             "${casework_install_dir}/caseworkctl" test "${casework_project}"
             "${casework_install_dir}/caseworkctl" package \
               "${casework_project}" --output "${casework_package}"
-            test -f "${casework_package}/casework.package.json"
+            test -f "${casework_package}/SHA256SUMS"
             rm candidate/bundle-root/SHA256SUMS
           fi
           evidencectl_installer="evidencectl-${{ needs.validate.outputs.tag }}-install.sh"

crates/registry-breg-client-node/client.d.ts

@@ -608,6 +608,7 @@ export type BRegIngestionAttemptOutcome =
   | 'invalidItem'
   | 'refused'
   | 'bindingChanged'
+  | 'importAuthorityClosed'
   | 'chunkMismatch'
   | 'runNotOpen'
   | 'unavailable'