Add continuous Registry authorisation

Author: a19q3

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+- Close the first-publish browser/CLI loop with `cellc publish --authorise`.
+  cellc now creates and stores the delegated P-256 publishing key locally,
+  opens a 15-minute exact-coordinate wallet session, and resumes publishing
+  automatically after Registry approval; `--no-open` supports remote and
+  terminal-only environments. Session reads expose neither the polling secret
+  nor the resulting key ID to the browser. Submit distinguishes detected
+  in-browser connectors from the complete external-signature directory, uses
+  plain publishing-access language on the first-run path, states the
+  non-replaceable release rule directly, and preserves the explicit CLI path
+  for external wallets and CI. Artifact details now derive one recommended
+  action from availability, verification, deployment, and consumption state.
 - Add an isolated Pudge Testnet Registry Sandbox. Its API, Postgres database,
   object volume, signing origin, RPC identity, website build, wallet storage,
   and deployment evidence are separate from production. Sandbox releases are

docs/CELLSCRIPT_GATE_POLICY.md

@@ -64,9 +64,11 @@ mainnet deployment evidence, additive migrations, worker boundary, and
 database/static-object shape to the CLI-generated Registry entry. It is local
 service coverage, not evidence
 that Cloudflare, R2, Hyperdrive, Neon, DNS, or a production deployment works.
-The CLI coverage includes the explicit first-publish admission sequence:
+The CLI coverage includes both first-publish admission paths: the explicit
 `cellc auth capability submit`, `cellc auth namespace claim`, then
-`cellc publish`; publisher maintenance additionally uses the capability-signed
+`cellc publish` sequence, and the short-lived `cellc publish --authorise`
+browser session in which the private publishing key remains in the local OS
+keychain while the CLI polls with a one-time secret. Publisher maintenance additionally uses the capability-signed
 `cellc artifact set-availability` path, and `cellc artifact cell-dep` performs a
 fresh mainnet liveness check before producing a transaction-builder descriptor.
 Independent reproducibility builders use `cellc auth reproducer create`; CLI

services/registry-api/README.md

@@ -131,6 +131,10 @@ POST /v1/capabilities
 GET  /v1/capabilities/:key_id/check?namespace=:namespace&name=:name
 POST /v1/capabilities/:key_id/revoke
 POST /v1/namespaces/claim
+POST /v1/authorisation-sessions
+GET  /v1/authorisation-sessions/:session_id
+POST /v1/authorisation-sessions/:session_id/challenge
+POST /v1/authorisation-sessions/:session_id/complete
 
 GET  /v1/admin/audit-events
 GET  /v1/admin/verification-queue
@@ -166,6 +170,21 @@ scope:
 Each form also accepts `namespace/*`. Possessing one action does not imply either
 of the others.
 
+For an interactive first publish, `cellc publish --authorise` creates a
+15-minute, exact-coordinate browser session and opens the matching Registry
+site. The CLI generates the delegated P-256 key first and keeps its private key
+in the OS keychain. The API stores only the public key plus hashes of separate
+one-time CLI-polling and browser-approval tokens. The browser token travels in
+the URL fragment, not the query string, so it is absent from HTTP logs and
+Referer headers; browser reads never return the polling token or resulting
+capability key ID. After the wallet approves the
+server-built challenge, the Registry records the capability, claims the
+namespace, and the polling CLI continues the original publish automatically.
+Use `--no-open` to print the browser URL without launching it.
+
+The explicit commands below remain the auditable/manual route for CI, external
+wallet signing, and recovery:
+
 ```bash
 cellc auth capability create --principal-type <principal_type> --principal-id <principal_id> \
   --scope publish:ns/name \

services/registry-api/deploy/docker-compose.production.yml

@@ -53,6 +53,7 @@ services:
       REGISTRY_ADMIN_TOKEN: ${REGISTRY_ADMIN_TOKEN:?REGISTRY_ADMIN_TOKEN is required}
       REGISTRY_ORIGIN: ${REGISTRY_ORIGIN:-https://api.registry.cellscript.dev}
       STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_ORIGIN:-https://registry.cellscript.dev}
+      REGISTRY_WEBSITE_ORIGIN: ${REGISTRY_WEBSITE_ORIGIN:-https://cellscript.dev}
       CKB_MAINNET_RPC_URL: ${CKB_MAINNET_RPC_URL:-https://mainnet.ckb.dev/rpc}
       CKB_RPC_URL: ${CKB_RPC_URL:-https://mainnet.ckb.dev/rpc}
       CKB_RPC_MAX_RESPONSE_BYTES: "8388608"

services/registry-api/deploy/docker-compose.testnet.yml

@@ -43,6 +43,7 @@ services:
       REGISTRY_ADMIN_TOKEN: ${REGISTRY_TESTNET_ADMIN_TOKEN:?REGISTRY_TESTNET_ADMIN_TOKEN is required}
       REGISTRY_ORIGIN: ${REGISTRY_TESTNET_ORIGIN:-https://api.testnet.registry.cellscript.dev}
       STATIC_REGISTRY_ORIGIN: ${STATIC_REGISTRY_TESTNET_ORIGIN:-https://objects.testnet.registry.cellscript.dev}
+      REGISTRY_WEBSITE_ORIGIN: ${REGISTRY_TESTNET_WEBSITE_ORIGIN:-https://testnet.registry.cellscript.dev}
       CKB_RPC_URL: ${CKB_TESTNET_RPC_URL:-https://testnet.ckb.dev/rpc}
       CKB_RPC_MAX_RESPONSE_BYTES: "8388608"
       CKB_MIN_CONFIRMATIONS: "4"

services/registry-api/migrations/0009_authorisation_sessions.sql

@@ -0,0 +1,45 @@
+create table if not exists authorisation_sessions (
+  session_id text primary key,
+  poll_token_hash text not null,
+  browser_token_hash text not null,
+  registry_origin text not null,
+  website_origin text not null,
+  capability_pubkey text not null,
+  requested_scopes text[] not null,
+  capability_expires_at timestamptz not null,
+  cli_version text not null,
+  namespace text not null,
+  name text not null,
+  artifact_kind text not null,
+  status text not null default 'pending',
+  principal_type text,
+  principal_id text,
+  payload jsonb,
+  challenge_token_hash text,
+  capability_key_id text references capabilities(key_id),
+  namespace_status text,
+  audit_request_id text not null,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  completed_at timestamptz,
+  check (session_id ~ '^auth_[0-9a-f]{32}$'),
+  check (poll_token_hash ~ '^sha256:[0-9a-f]{64}$'),
+  check (browser_token_hash ~ '^sha256:[0-9a-f]{64}$'),
+  check (cardinality(requested_scopes) > 0),
+  check (artifact_kind in (
+    'source_library', 'profile_library', 'runtime_verifier',
+    'deployable_contract', 'reproducible_binary', 'template'
+  )),
+  check (status in ('pending', 'authorised', 'review_pending')),
+  check (namespace_status is null or namespace_status in ('active', 'review_pending')),
+  check (
+    (status = 'pending' and capability_key_id is null and namespace_status is null and completed_at is null)
+    or
+    (status in ('authorised', 'review_pending') and capability_key_id is not null
+      and namespace_status is not null and completed_at is not null)
+  )
+);
+
+create index if not exists authorisation_sessions_expiry_idx
+  on authorisation_sessions(expires_at);