Skip to content

Commit 431e0df

Browse files
tobytkershawclaude
tobytkershaw
and
claude
committed
feat: initial registry with seeded artefacts and CI
Content-addressed artefact registry for AgentVault bounded-disclosure contracts. Seeded with existing artefacts from agentvault relay: - 2 schemas (compatibility_signal_v2, mediation_signal_v2) - 1 policy (compatibility_safe_v1) - 1 profile (api-claude-sonnet-v1) - 2 programs (mediation_system_v2, compatibility_system_v2) Includes type-validation schemas in _schemas/, per-kind indexes with aliases and channels, CI validation script (digest, type, consistency), and GitHub Actions workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0 parents  commit 431e0df

22 files changed

Lines changed: 820 additions & 0 deletions

‎.github/workflows/ci.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Registry CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
validate:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- uses: actions/setup-node@v4
16+
with:
17+
node-version: "20"
18+
19+
- name: Install dependencies
20+
run: npm ci
21+
22+
- name: Validate registry
23+
run: node scripts/validate.mjs

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules/

‎CONTRIBUTING.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Contributing to the AgentVault Registry
2+
3+
## Submitting an artefact
4+
5+
1. **Create the payload file** — pure JSON matching the type-validation schema in `_schemas/<kind>.schema.json`. No metadata envelope; the file contains exactly the artefact payload.
6+
7+
2. **Compute the digest**:
8+
- Parse the JSON
9+
- Canonicalize with JCS (RFC 8785)
10+
- SHA-256 hash the canonical form
11+
- Name the file `sha256-<hex>.json`
12+
13+
3. **Add an index entry** in `<kind>s/index.json`:
14+
```json
15+
{
16+
"sha256:<hex>": {
17+
"id": "your_artefact_id",
18+
"version": "1.0.0",
19+
"description": "What this artefact does",
20+
"status": "experimental",
21+
"published_at": "2026-03-07",
22+
"compatibility": {}
23+
}
24+
}
25+
```
26+
27+
4. **Add an alias** (optional but recommended):
28+
```json
29+
"aliases": {
30+
"your_artefact_id": "sha256:<hex>"
31+
}
32+
```
33+
34+
5. **Open a pull request**. CI will validate digest, type schema, and index consistency.
35+
36+
## Rules
37+
38+
- **Aliases are immutable.** Once created, an alias always points to the same digest. New versions get new aliases.
39+
- **Artefacts are append-only.** Entries are never removed. Set `status` to `"deprecated"` to signal an artefact should not be used in new contracts.
40+
- **Channels are mutable.** `name@latest` pointers may be retargeted. Do not rely on channels for reproducible contract construction — use aliases or raw digests.
41+
- **Status values**: `"active"`, `"experimental"`, `"deprecated"`.
42+
43+
## Compatibility metadata
44+
45+
Schemas and policies should declare a `safety_class` in their `compatibility` object:
46+
47+
- `"SAFE"` — enum-only output, no free text, deterministic policy gate
48+
- `"RICH"` — may include bounded free text, must declare explicit entropy controls
49+
50+
The contract builder validates that a `SAFE` policy is not paired with a `RICH` schema.

‎README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# AgentVault Registry
2+
3+
Content-addressed artefact registry for [AgentVault](https://github.com/vcav-io/agentvault) bounded-disclosure contracts.
4+
5+
## What this is
6+
7+
A shared, append-only collection of canonical artefacts that agents reference when constructing contracts. Each artefact is identified by its SHA-256 digest over JCS-canonicalized (RFC 8785) JSON.
8+
9+
**This registry defines what exists.** Relay operators independently decide which artefacts they admit and execute via their local `relay-admission.toml`.
10+
11+
## Artefact kinds
12+
13+
| Kind | Directory | Description |
14+
|------|-----------|-------------|
15+
| `schema` | `schemas/` | JSON Schema for output validation |
16+
| `policy` | `policies/` | Enforcement policy (rules, entropy constraints) |
17+
| `profile` | `profiles/` | Model/provider configuration |
18+
| `program` | `programs/` | Prompt template + assembly logic |
19+
20+
## Structure
21+
22+
```
23+
agentvault-registry/
24+
+-- registry.json # top-level manifest
25+
+-- _schemas/ # type-validation schemas (used by CI)
26+
+-- schemas/
27+
| +-- index.json # per-kind index with aliases and channels
28+
| +-- sha256-<hex>.json # payload files (content-addressed)
29+
+-- policies/
30+
+-- profiles/
31+
+-- programs/
32+
```
33+
34+
## Digest rules
35+
36+
- **Algorithm**: SHA-256
37+
- **Input**: JCS (RFC 8785) canonicalization of the parsed JSON payload
38+
- **Qualified form**: `sha256:<hex>` (in indexes, contracts, allowlists)
39+
- **Filenames**: `sha256-<hex>.json` (hyphen for filesystem safety)
40+
41+
## Contributing
42+
43+
See [CONTRIBUTING.md](CONTRIBUTING.md).
44+
45+
## Validation
46+
47+
```bash
48+
npm ci
49+
npm run validate
50+
```
51+
52+
CI runs three checks per artefact: digest verification, type validation against `_schemas/`, and index consistency (aliases, channels, orphan detection).

‎_schemas/policy.schema.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"title": "RelayEnforcementPolicy",
3+
"description": "Type-validation schema for enforcement policies, derived from the Rust RelayEnforcementPolicy struct",
4+
"type": "object",
5+
"required": ["policy_version", "policy_id", "policy_scope", "rules"],
6+
"additionalProperties": false,
7+
"properties": {
8+
"policy_version": { "type": "string" },
9+
"policy_id": { "type": "string" },
10+
"policy_scope": {
11+
"type": "string",
12+
"enum": ["RELAY_GLOBAL"]
13+
},
14+
"model_profile_allowlist": {
15+
"type": "array",
16+
"items": { "type": "string" },
17+
"default": []
18+
},
19+
"provider_allowlist": {
20+
"type": "array",
21+
"items": { "type": "string" },
22+
"default": []
23+
},
24+
"max_output_tokens": {
25+
"type": ["integer", "null"],
26+
"minimum": 1
27+
},
28+
"rules": {
29+
"type": "array",
30+
"items": { "$ref": "#/definitions/EnforcementRule" }
31+
},
32+
"entropy_constraints": {
33+
"oneOf": [
34+
{ "$ref": "#/definitions/EntropyConstraints" },
35+
{ "type": "null" }
36+
]
37+
}
38+
},
39+
"definitions": {
40+
"EnforcementRule": {
41+
"type": "object",
42+
"required": ["rule_id", "type", "value", "scope", "classification"],
43+
"additionalProperties": false,
44+
"properties": {
45+
"rule_id": { "type": "string" },
46+
"type": {
47+
"type": "string",
48+
"enum": ["unicode_category_reject"]
49+
},
50+
"value": { "type": "string" },
51+
"scope": { "$ref": "#/definitions/RuleScope" },
52+
"classification": { "$ref": "#/definitions/EnforcementClass" }
53+
}
54+
},
55+
"RuleScope": {
56+
"type": "object",
57+
"required": ["kind"],
58+
"additionalProperties": false,
59+
"properties": {
60+
"kind": {
61+
"type": "string",
62+
"enum": ["all_string_values"]
63+
},
64+
"skip_keys": {
65+
"type": "array",
66+
"items": { "type": "string" },
67+
"default": []
68+
}
69+
}
70+
},
71+
"EntropyConstraints": {
72+
"type": "object",
73+
"required": ["budget_bits", "classification"],
74+
"additionalProperties": false,
75+
"properties": {
76+
"budget_bits": { "type": "integer", "minimum": 0 },
77+
"classification": { "$ref": "#/definitions/EnforcementClass" },
78+
"review_trigger_pct": {
79+
"type": ["integer", "null"],
80+
"minimum": 0,
81+
"maximum": 100
82+
}
83+
}
84+
},
85+
"EnforcementClass": {
86+
"type": "string",
87+
"enum": ["GATE", "ADVISORY"]
88+
}
89+
}
90+
}

‎_schemas/profile.schema.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"title": "ModelProfile",
3+
"description": "Type-validation schema for model profiles, derived from the Rust ModelProfile struct",
4+
"type": "object",
5+
"required": ["profile_version", "profile_id", "provider", "model_family", "reasoning_mode", "structured_output"],
6+
"additionalProperties": false,
7+
"properties": {
8+
"profile_version": { "type": "string" },
9+
"profile_id": { "type": "string" },
10+
"provider": { "type": "string" },
11+
"model_family": { "type": "string" },
12+
"reasoning_mode": { "type": "string" },
13+
"structured_output": { "type": "boolean" }
14+
}
15+
}

‎_schemas/program.schema.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"title": "PromptProgram",
3+
"description": "Type-validation schema for prompt programs, derived from the Rust PromptProgram struct",
4+
"type": "object",
5+
"required": ["version", "system_instruction", "input_format"],
6+
"additionalProperties": false,
7+
"properties": {
8+
"version": { "type": "string" },
9+
"system_instruction": { "type": "string" },
10+
"input_format": {
11+
"type": "string",
12+
"enum": ["structured", "narrative"]
13+
}
14+
}
15+
}

‎_schemas/schema.schema.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"title": "AgentVault Output Schema",
3+
"description": "Meta-schema for output schemas — must be a valid JSON Schema with object type and additionalProperties: false",
4+
"type": "object",
5+
"required": ["type", "required", "properties", "additionalProperties"],
6+
"properties": {
7+
"type": {
8+
"type": "string",
9+
"const": "object"
10+
},
11+
"additionalProperties": {
12+
"const": false
13+
}
14+
}
15+
}

‎package-lock.json‎

Lines changed: 73 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"name": "agentvault-registry",
3+
"version": "1.0.0",
4+
"private": true,
5+
"type": "module",
6+
"scripts": {
7+
"validate": "node scripts/validate.mjs"
8+
},
9+
"devDependencies": {
10+
"ajv": "^8.17.1"
11+
}
12+
}

0 commit comments

Comments
 (0)