docs: record Registry production verification rollout

Author: a19q3

CHANGELOG.md

@@ -44,7 +44,14 @@
   excludes `source_published` and `indexed_pending` by default while preserving
   explicit status queries and direct audit URLs. Package-manifest identity uses
   canonical recursively sorted JSON, eliminating cross-process `HashMap` order
-  drift between publisher and verifier.
+  drift between publisher and verifier. Deploy that worker to the live
+  production topology and exercise external publish, queue claim, real
+  compilation, evidence promotion, static convergence, default visibility, and
+  a fresh consumer install/check/build without an unverified override. The
+  one-time seeded smoke identity and live objects were removed afterward, queue
+  counts returned to zero, and a checksum-verified backup captured the migrated
+  clean state. Production Compose now accepts explicit prebuilt API/verifier
+  image references so shared hosts can deploy with `--no-build`.
 - Close the 0.23 syntax-audit consistency gaps: canonical type declarations
   now use comma-terminated fields, syntax-combination gates cover canonical and
   comma-free compatibility input, checked example mirrors use named `U64_MAX`

docs/CELLSCRIPT_REGISTRY_PHASE1.md

@@ -4,11 +4,13 @@
 CellScript CKB profile. Policy decisions defer to
 [`CELLSCRIPT_REGISTRY_PRODUCTION_BOUNDARY_ADR.md`](CELLSCRIPT_REGISTRY_PRODUCTION_BOUNDARY_ADR.md).
 
-**Production update (2026-07-31)**: the public list/detail/evidence API is live
+**Production update (2026-08-01)**: the public list/detail/evidence API is live
 at `https://api.registry.cellscript.dev`, immutable package objects are served
 independently at `https://registry.cellscript.dev/packages/`, and the live-data
 website is at `https://cellscript.dev/registry/`. The deployed adapter is
-Node/Postgres/filesystem/read-only-nginx; Cloudflare remains an alternative.
+Node/Postgres/filesystem/read-only-nginx with a leased compiler-backed verifier;
+Cloudflare remains an alternative. The live publish-to-install smoke and a
+post-migration checksum-verified backup pass.
 The first publisher-owned JoyID publication and clean-machine install are still
 the final adoption checkpoint, so this walkthrough does not claim that
 interactive acceptance has already happened.

docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md

@@ -12,10 +12,11 @@ canonical location:
 `WitnessArgs.input_type` on the selected script-group witness.
 
 This document records completed 0.23 work. The public Registry infrastructure,
-read/write domains, website, CLI read authority, and evidence chain are
-deployed; the first publisher-owned JoyID publication and clean-machine install
-remain the final Registry adoption checkpoint. Broader RGB++/Fiber evidence and
-the Off-Chain Session Runtime profile remain roadmap work.
+read/write domains, website, CLI read authority, and automatic compiler-backed
+evidence chain are deployed; the first publisher-owned JoyID publication and
+clean-machine install remain the final Registry adoption checkpoint. Broader
+RGB++/Fiber evidence and the Off-Chain Session Runtime profile remain roadmap
+work.
 
 ## At A Glance
 
@@ -303,6 +304,18 @@ containers, volumes, package rows, objects, and test credential were removed
 afterward. This is deployment-mechanics evidence, not publisher-owned JoyID
 evidence.
 
+The same automatic pipeline was then deployed to the live production topology
+from CellScript commit `4b1fdeec`. An explicitly seeded one-time smoke
+principal/capability/namespace completed external `cellc publish`, worker claim,
+real compilation, atomic evidence promotion, static convergence, default-list
+visibility, and a fresh consumer install/check/build without
+`--allow-unverified`. The exact database records were deleted transactionally;
+the two test objects were removed from the served volume and retained only in
+a checksum-verified recovery directory. All queue counts returned to zero, all
+four production containers remained healthy, and a checksum-verified backup
+captured the migrated, cleaned state. This proves the live worker boundary but
+still does not substitute for publisher-owned JoyID authorisation.
+
 These endpoints prove the deployed service boundary, not a publisher-owned
 JoyID signature or first-package install. That interactive positive flow
 remains the explicit adoption checkpoint.

docs/tutorials/phase1-end-to-end.md

@@ -20,6 +20,9 @@ The production surfaces are live at `https://cellscript.dev/registry/`,
 `https://api.registry.cellscript.dev`, and
 `https://registry.cellscript.dev`. The first publisher-owned JoyID publication
 and clean-machine install remain the final interactive adoption checkpoint.
+The automatic compiler-backed worker is deployed and has passed a live
+publish-to-install smoke; that one-time seeded identity is deployment evidence,
+not a substitute for the remaining publisher-owned JoyID flow.
 
 ## Audience
 

docs/wiki/Tutorial-12-Phase1-Registry-End-to-End.md

@@ -127,6 +127,15 @@ object. Queue attempts are bounded; rejected builds dead-letter, while
 operators can inspect metrics and audit an explicit requeue. Admission therefore
 returns `verification: queued`, never a synchronous verification claim.
 
+The worker is live in the production topology as of 2026-08-01. Deployment
+acceptance used an explicitly seeded one-time smoke identity to exercise the
+normal external `cellc publish` path, queue lease, real compiler, evidence
+commit, static publication, default visibility, and a fresh consumer
+install/check/build without an unverified override. The test records and live
+objects were removed afterward, and the migrated clean state was backed up.
+This validates the deployed automation; it deliberately does not count as a
+publisher-owned JoyID capability registration or namespace claim.
+
 ## Consumer Flow
 
 Add a dependency, resolve it, and check the resulting package graph:

roadmap/CELLSCRIPT_0_23_ROADMAP.md

@@ -146,8 +146,9 @@ Source documents:
 
 **Status (2026-08-01): production infrastructure, public reads, website, CLI
 resolution, evidence promotion, and the bounded automatic source/build
-verification pipeline are implemented. Deployment of the new verifier worker
-and its production smoke are the current operational step. The first
+verification pipeline are implemented and deployed. The live worker completed
+the full publish-to-install production smoke, and the migrated database/object
+state has a checksum-verified backup. The first
 publisher-owned positive JoyID publication and clean-machine install remain the
 final adoption checkpoint.**
 
@@ -244,6 +245,10 @@ Production-readiness evidence currently proves:
 - an isolated production Compose topology completed a real `cellc publish` from
   queue admission through leased compilation, evidence persistence,
   `verified_build`, default-list visibility, and static-object publication;
+- the live production topology repeated that path from external `cellc publish`
+  through real compiler verification and a fresh consumer install/check/build
+  without `--allow-unverified`; the explicitly seeded smoke identity and its
+  served rows/objects were removed afterward;
 - live health/readiness checks cover Postgres, the object volume, runtime, and
   admin configuration;
 - the proxy admits a 2 MiB body to application validation and the Node adapter
@@ -255,7 +260,8 @@ Production-readiness evidence currently proves:
   object-hash drift, or source-tree drift;
 - API restart recovery preserves the database, audit log, and object volumes;
 - the daily systemd backup produces checksum-verified Postgres and object-store
-  archives, and both archive formats pass non-destructive restore inspection;
+  archives, both archive formats pass non-destructive restore inspection, and
+  a post-`0002` backup captured the migrated, cleaned production state;
 - the website serves the live Registry and contains no Coming Soon surface.
 - a cryptographically valid WebAuthn-shaped P-256 fixture completes capability
   registration, explicit namespace claim, signed publish, idempotent replay,

roadmap/CELLSCRIPT_ROADMAP.md

@@ -35,7 +35,7 @@ The current project direction is simple:
 | 0.21 planned scope | Semantic closure, authenticated compiler evidence, CLI UX reorganisation, dedicated MCP server and CellScript programming skills, derived cyclic graph views, type-level TemplateLayout metadata, and deferred optional template Merkleisation. | [0.21 roadmap](../docs/CELLSCRIPT_0_21_ROADMAP.md), [0.21 CLI UX plan](CELLSCRIPT_0_21_CLI_UX_PLAN.md) |
 | 0.22 release scope | Released typed transaction views, finite invariant quantifiers, bounded collections, capability entailment, concrete payload enums, validity blocks, borrow regions, stable `E2xxx` diagnostics, and metadata schema 55. | [0.22 release notes](../docs/releases/CELLSCRIPT_0_22_RELEASE_NOTES.md), [0.22 type/set roadmap](CELLSCRIPT_0_22_TYPE_AND_SET_THEORY_ROADMAP.md) |
 | 0.22 bounded Fiber interoperability | The dedicated `fungible-type-group-v1` compiler/adapter path and local-devnet scenarios are implemented. The pinned complete external lifecycle/negative matrix remains pending, so this is not a production-readiness claim. | [0.22 Fiber plan](CELLSCRIPT_0_22_FIBER_NATIVE_SUPPORT_PLAN.md), [operator guide](../examples/fiber/README.md) |
-| 0.23 active scope | The public Registry infrastructure, HTTPS read/write domains, live website browse/detail surfaces, accepted-status CLI resolution, evidence promotion, and native tooling migration are implemented. The first publisher-owned JoyID publication plus clean-machine install remains the Registry adoption checkpoint; RGB++/Fiber and Off-Chain Session Runtime work retain their explicit evidence boundaries. | [0.23 roadmap](CELLSCRIPT_0_23_ROADMAP.md) |
+| 0.23 active scope | The public Registry infrastructure, HTTPS read/write domains, live website browse/detail surfaces, accepted-status CLI resolution, evidence promotion, automatic compiler-backed verification worker, and native tooling migration are implemented and deployed. The live publish-to-install smoke and migrated backup pass; the first publisher-owned JoyID publication plus clean-machine install remains the Registry adoption checkpoint. RGB++/Fiber and Off-Chain Session Runtime work retain their explicit evidence boundaries. | [0.23 roadmap](CELLSCRIPT_0_23_ROADMAP.md) |
 | CKB language fit | CKB-first design is confirmed; remaining gaps are signer binding, continuity policy, capacity policy, and declarative time policy. | [CKB target profiles](../docs/wiki/Tutorial-05-CKB-Target-Profiles.md), [production gates](../docs/wiki/Tutorial-06-Metadata-Verification-and-Production-Gates.md) |
 | Surface syntax | Low-risk syntax pass and 0.13.2 syntax-governance hardening are implemented; authority-sensitive syntax remains staged. | [Surface elegance RFC](../docs/CELLSCRIPT_SURFACE_ELEGANCE_RFC.md), [Syntax-combination audit](../docs/CELLSCRIPT_SYNTAX_COMBO_AUDIT_METHODOLOGY.md) |
 | Collections | Stack-backed fixed-width `Vec<T>` helper surface is implemented; cell-backed and generic map ownership remain fail-closed. | [Collections support matrix](../docs/CELLSCRIPT_COLLECTIONS_SUPPORT_MATRIX.md), [0.13 release scope](../docs/releases/CELLSCRIPT_0_13_RELEASE_SCOPE.md) |
@@ -309,12 +309,13 @@ Detailed status:
 than language-theoretic. It turns the 0.22 compiler facts into running
 infrastructure and absorbs Myelin's off-chain needs into upstream:
 
-- **Public registry production deployment**: stand up the implemented
-  `services/registry-api` Cloudflare Worker on `cellscript.dev` with Neon
-  Postgres via Hyperdrive and R2 source snapshots; wire the Astro frontend
-  and `cellc publish` / `cellc auth capability *` to the live JoyID-rooted
-  write API; keep hash-first verification and the static
-  `/packages/*` read path as the read authority.
+- **Public registry production deployment**: the self-hosted Node/Postgres
+  write service, read-only static object service, live Astro frontend, and
+  compiler-backed verification worker are deployed on the public domains.
+  Hash-first resolution stays limited to accepted evidence states. The first
+  publisher-owned JoyID capability/publication/install is the remaining
+  interactive adoption checkpoint; Cloudflare/Hyperdrive/R2 stays an optional
+  alternative topology.
 - **Native tooling migration complete**: the gate-driving backend, syntax,
   production-evidence, tooling-release, NovaSeal, and Evolving-DOB tools now
   live in Rust crates; website data generation uses Node modules. Evidence

roadmap/CELLSCRIPT_ROADMAP_OVERVIEW.md

@@ -93,7 +93,7 @@ Each release answers a specific question:
 | v0.21 planned scope | Semantic closure, authenticated compiler evidence, CLI UX reorganisation, dedicated MCP server and CellScript programming skills, derived cyclic ProtocolGraph views, type-level TemplateLayout metadata, and deferred optional template Merkleisation. | [v0.21 roadmap](../docs/CELLSCRIPT_0_21_ROADMAP.md), [v0.21 CLI UX plan](CELLSCRIPT_0_21_CLI_UX_PLAN.md) |
 | v0.22 draft scope | Draft type-theory and set-theory guided language hardening proposal. This scope requires pre-talk soundness fixes and Nervos Talk Discussion before adoption: callable effects for ordinary functions, terminal flow metadata, typed transaction-view handles, finite source-view quantifiers, bounded cell-collection design, type validity blocks, explicit borrow regions, capability algebra explanations, concrete payload ADTs, and ProtocolGraph role UX. | [v0.22 type and set theory roadmap draft](CELLSCRIPT_0_22_TYPE_AND_SET_THEORY_ROADMAP.md) |
 | v0.22 Fiber native-support proposal | Proposed no-profile integration for structurally compatible fungible CellScript Type Scripts. Compatibility must be derived from compiler evidence, requires no Fiber fork, and is not complete until the pinned CKB/Fiber lifecycle matrix passes. | [v0.22 no-profile Fiber native-support plan](CELLSCRIPT_0_22_FIBER_NATIVE_SUPPORT_PLAN.md) |
-| v0.23 planned scope | Public registry production deployment on `cellscript.dev`, completed native test/fixture tooling with repository-wide source-policy enforcement, deeper RGB++ / Fiber integration, and an Off-Chain Session Runtime profile with initial concurrency support so the Myelin vendored fork can re-converge on upstream. | [v0.23 roadmap](CELLSCRIPT_0_23_ROADMAP.md) |
+| v0.23 active scope | The public Registry, accepted-status resolver, automatic compiler-backed verification worker, and native test/fixture tooling are deployed or implemented; the live publish-to-install smoke and migrated backup pass. Publisher-owned JoyID adoption, deeper RGB++ / Fiber integration, and the Off-Chain Session Runtime profile remain tracked scope. | [v0.23 roadmap](CELLSCRIPT_0_23_ROADMAP.md) |
 | Spore/RGB++ adapters | Proposed package/adapter slices for a deployable signature verifier, executable bounded CellDep scans, bounded hash/Merkle primitives, and pinned Spore/RGB++ cookbook integrations. None are current production-support claims. | [Spore/RGB++ interoperability plan](CELLSCRIPT_SPORE_RGBPP_INTEROP_PLAN.md) |
 | CKB language fit | CKB-first design is confirmed; remaining hardening areas are signer binding, continuity policy, capacity policy, and declarative time policy. | [CKB target profiles](../docs/wiki/Tutorial-05-CKB-Target-Profiles.md), [production gates](../docs/wiki/Tutorial-06-Metadata-Verification-and-Production-Gates.md) |
 | Surface syntax | Low-risk syntax pass is implemented; authority-sensitive syntax remains staged. | [Surface elegance RFC](../docs/CELLSCRIPT_SURFACE_ELEGANCE_RFC.md) |

services/registry-api/README.md

@@ -148,13 +148,24 @@ so the 5 MiB snapshot plus base64/JSON overhead reaches the Node adapter.
 ```bash
 cp deploy/.env.example deploy/.env
 # Generate and insert independent high-entropy database and admin secrets.
-# If this service directory is deployed outside the repository checkout, set
-# CELLSCRIPT_REGISTRY_SOURCE_ROOT to the absolute CellScript source directory.
+# Pin REGISTRY_API_IMAGE and REGISTRY_VERIFIER_IMAGE to immutable prebuilt
+# linux/amd64 image tags or digests.
 chmod 600 deploy/.env
 docker compose --env-file deploy/.env -f deploy/docker-compose.production.yml config
-docker compose --env-file deploy/.env -f deploy/docker-compose.production.yml up -d --build
+docker compose --env-file deploy/.env -f deploy/docker-compose.production.yml up -d --no-build
 ```
 
+Build the API and verifier images in CI or on a dedicated build host, verify
+their architecture and image identities, then transfer them to the production
+Docker daemon before running the command above. Do not compile the Rust
+compiler/verifier image on a resource-shared production host: the build context
+is intentionally the full CellScript tree and can consume enough CPU and memory
+to interfere with unrelated workloads. `docker compose ... up -d --build`
+remains appropriate for an isolated development or staging host with adequate
+capacity. If Compose builds from a service directory copied out of the
+repository, set `CELLSCRIPT_REGISTRY_SOURCE_ROOT` to the absolute CellScript
+checkout first.
+
 The API container applies tracked migrations before it starts accepting
 traffic. Postgres is reachable only on the internal network. The API, verifier,
 and static services run with read-only root filesystems, bounded temporary
@@ -168,6 +179,16 @@ validation, a structured application 413 at 7 MiB + 1 byte, rejection of
 unauthorised admin writes and static POSTs, path-traversal rejection, API
 restart recovery, and persistent audit/database/object volumes.
 
+On 2026-08-01 the automatic verifier was deployed to the live production
+topology from CellScript commit `4b1fdeec`. A one-time, explicitly seeded smoke
+principal/capability/namespace drove the normal external `cellc publish` path
+through queue claim, real compilation, evidence persistence,
+`verified_build`, static publication, default-list visibility, and a fresh
+consumer install/check/build without `--allow-unverified`. The exact test rows
+were deleted transactionally afterward; its two object files were moved out of
+the served volume into a checksum-verified recovery directory. This is worker
+and deployment evidence, not publisher-owned JoyID authorisation evidence.
+
 Required runtime configuration:
 
 ```text
@@ -177,6 +198,8 @@ REGISTRY_ADMIN_TOKEN
 REGISTRY_ORIGIN
 STATIC_REGISTRY_ORIGIN
 CELLSCRIPT_REGISTRY_SOURCE_ROOT  # Compose build context when deployed out of tree
+REGISTRY_API_IMAGE               # immutable prebuilt API image tag or digest
+REGISTRY_VERIFIER_IMAGE          # immutable prebuilt verifier image tag or digest
 ```
 
 `MAX_INCOMING_BODY_BYTES` limits the Node adapter before the request reaches

services/registry-api/deploy/.env.example

@@ -1,7 +1,11 @@
 REGISTRY_DB_PASSWORD=replace-with-a-generated-secret
 REGISTRY_ADMIN_TOKEN=replace-with-a-generated-secret
+# Pin immutable, prebuilt linux/amd64 image tags or digests in production.
+# REGISTRY_API_IMAGE=cellscript-registry-api:latest
+# REGISTRY_VERIFIER_IMAGE=cellscript-registry-verifier:latest
 # Set this to an absolute checkout/build-context path when the deployment
-# directory is not nested under the CellScript repository.
+# directory is not nested under the CellScript repository and Compose will
+# build the images locally.
 # CELLSCRIPT_REGISTRY_SOURCE_ROOT=/data/cellscript-registry/source
 # REGISTRY_ORIGIN=https://api.registry.cellscript.dev
 # STATIC_REGISTRY_ORIGIN=https://registry.cellscript.dev